Help with simple VRF setup

perpaal · ‎08-30-2011

Hi

I`m trying to get a simple VRF and routing setup going.

The "routers" are Cisco C3750G-12S-E

What I want to do is separate the management network form all else.

The public network is illustrated with private IP ranges, these are really public ranges.

I think the best way to solve this will be using VRF for management, and regular routing for public network, right?

Putting the management network in it`s own VRF.

But witch routing protocol should I use here...

Very very happy if someone can make me a configuration example

Marwan ALshawi · ‎08-30-2011

quick question are you going to use out of band management ?

what i mean separate interface connected to switch for example just for managment access

perpaal · ‎08-30-2011

Management will be inband I guess.

As the link between the routers/switches is leased lines...

Jonathancert_2 · ‎08-30-2011

This is a basic VRF lite configs and should get you up and running. Make sure your IOS version supports VRF. Unless you have non-Cisco devices, i would just stick with EIGRP as the routing protocol.

ROUTER A

ip vrf manage

rd 10:1

interface GigabitEthernet0/0

 description Management VRF

 ip vrf forwarding manage

 ip address 10.10.2.1 255.255.255.0

router eigrp 10 vrf manage

  network 10.10.2.0

ROUTER B

ip vrf manage

rd 10:1

interface GigabitEthernet0/0

 description Management VRF

 ip vrf forwarding manage

 ip address 10.10.3.1 255.255.255.0

router eigrp 10 vrf manage

  network 10.10.3.0

ROUTER C

ip vrf manage

rd 10:1

interface GigabitEthernet0/0

 description Management VRF

 ip vrf forwarding manage

 ip address 10.10.4.1 255.255.255.0

router eigrp 10 vrf manage

  network 10.10.4.0


Jonathan,

perpaal · ‎08-30-2011

Thank you.

I might use some other equpment in the network at a later time, so I rather not use EIGRP.

What would you use then?

And how wold the config be with the public range?

Reza Sharifi · ‎08-30-2011

Hi,

You don't have to use EIGRP, you can use OSPF or if it is small network, you can use static.

HTH

Edison Ortiz · ‎08-30-2011

Here is a config with OSPF

Router A

ip vrf management

rd 1:1

interface vlan 10

ip vrf forwarding management

ip address 10.10.2.1 255.255.255.0

interface vlan 20

ip add 192.168.12.1 255.255.255.0

interface vlan 101

description OSPF routing interface

ip vrf forwarding management

ip add 1.1.2.1 255.255.255.255.252

interface vlan 201

description OSPF routing interface

ip add 192.168.2.1 255.255.255.252

router ospf 1 vrf management

network 10.10.2.1 0.0.0.0 area x

network 1.1.2.1 0.0.0.0 area x

router ospf 1

network 192.168.12.1 0.0.0.0 area x

network 192.168.2.1 0.0.0.0 area x

interface gx/x

description connection to Router B

switchport mode trunk

switchport trunk encapsulation dot1q

switchport trunk allowed vlan 101,201

Router B

ip vrf management

rd 1:1

interface vlan 30

ip vrf forwarding management

ip address 10.10.3.1 255.255.255.0

interface vlan 40

ip add 192.168.13.1 255.255.255.0

interface vlan 101

description OSPF routing interface

ip vrf forwarding management

ip add 1.1.2.2 255.255.255.255.252

interface vlan 103

description OSPF routing interface

ip vrf forwarding management

ip add 1.1.3.2 255.255.255.255.252

interface vlan 201

description OSPF routing interface

ip add 192.168.2.2 255.255.255.252

interface vlan 301

description OSPF routing interface

ip add 192.168.3.2 255.255.255.252

router ospf 1 vrf management

network 10.10.3.1 0.0.0.0 area x

network 1.1.2.2 0.0.0.0 area x

network 1.1.3.2 0.0.0.0 area x

router ospf 1

network 192.168.13.1 0.0.0.0 area x

network 192.168.2.2 0.0.0.0 area x

network 192.168.3.2 0.0.0.0 area x

interface gx/x

description connection to Router A

switchport mode trunk

switchport trunk encapsulation dot1q

switchport trunk allowed vlan 101,201

interface gx/x

description connection to Router C

switchport mode trunk

switchport trunk encapsulation dot1q

switchport trunk allowed vlan 103,301

Router C

ip vrf management

rd 1:1

interface vlan 50

ip vrf forwarding management

ip address 10.10.4.1 255.255.255.0

interface vlan 60

ip add 192.168.14.1 255.255.255.0

interface vlan 103

description OSPF routing interface

ip vrf forwarding management

ip add 1.1.3.1 255.255.255.255.252

interface vlan 301

description OSPF routing interface

ip add 192.168.3.1 255.255.255.252

router ospf 1 vrf management

network 10.10.4.1 0.0.0.0 area x

network 1.1.3.1 0.0.0.0 area x

router ospf 1

network 192.168.14.1 0.0.0.0 area x

network 192.168.3.1 0.0.0.0 area x

interface gx/x

description connection to Router B

switchport mode trunk

switchport trunk encapsulation dot1q

switchport trunk allowed vlan 103,301

Marwan ALshawi · ‎08-30-2011

in this case you can either use the example posted by Edison

OR

you can have the management subnet/traffic to be run in its own vrf using GRE tunneling

in this case the tunnel source and destination between routers will be the normal phsycal interface in the 192.168.x.x subnet while the tunnel itself will be under management VRF and runing its own routing such as eigrp or OSPF

in the case you can have two seperate networks

HTH

if helpful Rate

perpaal · ‎08-31-2011

I see that you make 2 link subnets, one for the management net and one for the public net.

(VLAN101/201 for router A)

Do I need this because of VRF, seperate link nets for each VRF?

For the public IP ranges, should I use public IPs also for the link nets, or does this not matter?

Edison Ortiz · ‎08-31-2011

On a typical L3 routing on a switch, if you have 2 subnets - you need to create two L3 Vlans. This has nothing to do with VRF.

If you have public IPs, just replace the IPs you posted with your public ones.

perpaal · ‎08-31-2011

- "On a typical L3 routing on a switch, if you have 2 subnets - you need to create two L3 Vlans. This has nothing to do with VRF"

Yes but VLAN 101 and 201 are linknets between Router A and Router B right?

Normally one would just need noe linknet here, but I guess when using VRF seperating the routing tables, you need one for each VRF?

- "If you have public IPs, just replace the IPs you posted with your public ones."

When creating a linknet for the public ranges, should I use public IPs for the linknet also, or can I just use private IP ranges (192.168.x.x/10.x.x.x) here to save some IP addresses?

Edison Ortiz · ‎08-31-2011

Correct, you need to create 2 Vlans for OSPF adjancencies as you are running 2 different routing tables.

You can use private or public, it is your choice. Be careful with using public ones, if you don't own the public IP address pool and someone is already using that pool in the internet, your hosts won't be able to access those services.

We often recommend customers if they want to use public IP addressing in their internal network, they must own it.