We use vrf in our network for separating user / production traffic vs management traffic. but the way we have used it has turned out to be messy and we are in a situation where we no longer have the distinction between the two. I personally feel that vrf is a great way to separate management vs user traffic.
Here is why I am in a dilema
If VLANS for users computers and server VLANS are in USERS vrf
and management servers ( including domain controllers, AD) are in management vrf , there is no way this will work . and this was the reason we thought it was going to work. now I am wondering if using vrf is even necessary in an enterprise environment when management traffic can be separated on server end and not so much at the clients end.
Hello, very interesting scenario! I was in a similar position to you. I agree VRF's are great for management purposes, as it provides you with total segregation of routing instances. In fact the newer cisco devices come with vrf's configured for management out the box, with a separate interface for management only (for the network device itself).
However, when it comes to enterprise networks and you have domain controllers, file servers, messaging, maybe ACS or ISE, proxies etc... and other services that should be available for your users, is there any point in using vrf's to separate users from management servers. Lets take for example:
A PC on the domain, and I want to log in using my AD credentials. You need to be able to contact the domain controller(s) in order to login right? Since vrf's are contained they will have no routes to get to different networks in other vrf's. Except when configured to do so.
Anyway, nevertheless - you are still going to be providing reachability via routing, so this defeats the purpose kindof... It could add unnecessary complexity too.
Me personally, I just made sure that they were separated by VLAN's and had a dedicated vrf for management, i.e. ssh, snmp etc... to the network devices. I weighed up and thought its not worth doing something that will not really be of any benefit. I can understand the need for ISPs and large service providers to use this but not business/enterprise.
I hope this helps.
Please rate useful posts & remember to mark any solved questions as answered. Thank you.