Question regarding VRF & licensing

[PingMePlz]

I have to setup a simple network with one vlan and a vrf. I have not setup vrf before. This is an isolated network, say in a lab. Once ready, it will be connected to some external network which is already in place.

Devices connected to each switch should be able to talk to each other, IPs will be assigned from 1 subnet using vlan10. Switch being considered for use is IE-9320-24P4X.

So questions I have are:

• Will i need to configure vrf on each switch in the diagram or just the switch 1 (which is what will be connected outside)?
• Which license is advisable to have on these switches - Network Essentials or Network Advantage. I believe advantage is needed if we are configuring vrf but want to confirm.

[Royalty · Accepted solution]

Hi @PingMePlz,

Can confirm Advantage licensing is required

Also, see the following for the IE9300 Configuration Guide and the IE9300 Product Data Sheet

https://www.cisco.com/c/en/us/td/docs/switches/lan/cisco_ie9300/software/Configuration_Guide/b-vrf-cg/m-vrf-cg.html
Note:"You must have a Network Advantage license to configure VRF Definition."

https://www.cisco.com/c/en/us/products/collateral/switches/catalyst-ie9300-rugged-series/catalyst-ie9300-rugged-series-ds.html
Ref: Product Specifications, Table 10.

You’re correct! In general, routers include VRF and routing feature support with the Essentials license, but switching platforms require the Advantage license to enable L3 (routing) features such as VRF-lite.

[PingMePlz]

Thanks @Royalty ! This is helpful.

just checking on first query again as I have limited knowledge on vrf:

• Will i need to configure vrf on each switch in the diagram or just the switch 1 (which is what will be connected outside)?

[Royalty]

No problem!

Apologies for missing that question which happens to be important!

Where you need to configure a VRF depends on the configuration and intended design of the network. For example, if switches 3, 4, 5 and 6 are running as L3 switches and are acting as the default gateway for the LAN devices then you would potentially need VRFs configured on them, but that also depends on what the intended use of the VRF is, in terms of what it is trying to isolate. If all of your switches are running L2 apart from switch 1 then you only need the VRF configured on SW1. It really depends what you are trying to isolate

I'm interested in your comment here:

I have to setup a simple network with one vlan and a vrf. 

---

Are the only devices connected in this entire LAN part of VLAN 10 or are there other devices? What is the use case for the VRF from your perspective? Is the purpose of the VRF to prevent VLAN 10 communicating from some of the external network or is it the prevention of communication from VLAN 10 to other internal LAN networks? What would be the configuration and intended setup between switch 1 and the external network? Is it performing L3 routing and running routing protocols? You may not need a VRF to achieve this and it depends on how large your network is. For example, is this network something that is being scaled out to many sites or is this a one-off?

Sorry if that is sounding too confusing, some of the questions negate the others etc. but I'm mobile at the moment so just quickly typing down questions that have sprung to mind! It's hard to answer where you need to configure it and if VRFs would be a good choice from the information available

[PingMePlz]

No problem at all—your questions help me gain better insight and understand things more thoroughly. First, thank you for taking the time to respond even while you’re on the move.

Now, starting with a less-than-ideal answer: this is part of a task, and we haven’t been given any details about the external network or the purpose of the VRF. I’m not sure how they plan to integrate this setup externally—maybe there are overlapping IPs or some other requirement, or perhaps someone just shared a standard set of parameters without confirming if they’re needed. Either way, it has to be configured and delivered! Unfortunately, there’s no one available to clarify these points.

Yes, all devices connected in this entire LAN part of VLAN 10 using static IPs from the subnet.

[Royalty]

Sounds to me as if you just need to define the VRF on switch 1 and associate its interfaces to the VRF!