Segmenting a VLAN with VRF

[Chad Parish]

My company has four sites connected over MPLS using BGP and within each site we use EIGRP.  In each site we have a vlan (lets call it vlan 3) that needs to be segmented from the other vlans at layer 3.  Within the individual lans this would likely just require the use of VRF-Lite.  I would create the VRF, associate it to the SVI and build a second EIGRP instance to deal with dynamic routing for Vlan 3.  

However, clients on vlan 3 at one location will need to be able to reach clients on vlan 3 at the other sites.  

Do I therefore need to create a second BGP instance (using address family) that will also be associated to the segmented VRF?

[Georg Pauwen]

Hello,

can't you simply apply access lists to the SVIs at each site ?

[Chad Parish]

We could and normally we do.  But the security team has specificly requested we segment this lan from the global route cache.

[paul driver]

hello

racls are a good option but if you wish to use vrf  I see no reason why you cannot 

I am assuming these vlan 3 users at each site be in  a different ip address subnet - meaning your not extending a vlan over sites?

Once the “vlan3” traffic hits  PE rtr of each site it will go over the mpls backbone with all the other traffic and you then should be able just to import that traffic between each sites segregated vrf