Octet

Two tenants with overlapping addresses on shared routers using VRF-lite

Cisco IOSWorking

Tasks

  1. Create VRFs RED and BLUE on both routers.
  2. Put each interface in its VRF and address it, transit subinterfaces included.
  3. Run OSPF process 10 for RED and process 20 for BLUE, point-to-point on the transit links.
  4. Verify each VRF's table, its neighbor and end-to-end reachability.
  5. Show that the global table and the other tenant cannot reach these networks.

Solution

  1. 1VRFsR1 and R2
    R1 and R2 on Cisco IOS
    vrf definition RED
 address-family ipv4
 exit-address-family
!
vrf definition BLUE
 address-family ipv4
 exit-address-family

    No RD is needed for VRF-lite on current IOS-XE. Add one later if BGP ever carries these VRFs.

  2. 2One OSPF process per VRFR1
    R1 on Cisco IOS
    router ospf 10 vrf RED
 router-id 10.255.10.1
 capability vrf-lite
 passive-interface GigabitEthernet0/0/1
!
router ospf 20 vrf BLUE
 router-id 10.255.20.1
 capability vrf-lite
 passive-interface GigabitEthernet0/0/2

    On R2 use router IDs 10.255.10.2 and 10.255.20.2. Create the processes before the interface lines ip ospf 10 area 0, so each process already exists in the right VRF when an interface joins it. capability vrf-lite turns off the MPLS PE checks that can stop OSPF in a VRF from installing some routes.

  3. 3Interfaces on R1R1
    R1 on Cisco IOS
    interface GigabitEthernet0/0/0
 no ip address
 no shutdown
!
interface GigabitEthernet0/0/0.10
 encapsulation dot1Q 10
 vrf forwarding RED
 ip address 172.16.12.1 255.255.255.252
 ip ospf network point-to-point
 ip ospf 10 area 0
!
interface GigabitEthernet0/0/0.20
 encapsulation dot1Q 20
 vrf forwarding BLUE
 ip address 172.16.12.1 255.255.255.252
 ip ospf network point-to-point
 ip ospf 20 area 0
!
interface GigabitEthernet0/0/1
 vrf forwarding RED
 ip address 10.1.1.1 255.255.255.0
 ip ospf 10 area 0
 no shutdown
!
interface GigabitEthernet0/0/2
 vrf forwarding BLUE
 ip address 10.1.1.1 255.255.255.0
 ip ospf 20 area 0
 no shutdown

    vrf forwarding must come before ip address. On an interface that already has an address, IOS removes it and prints % Interface ... IPv4 disabled and address(es) removed due to enabling VRF ....

  4. 4Interfaces on R2R2
    R2 on Cisco IOS
    interface GigabitEthernet0/0/0
 no ip address
 no shutdown
!
interface GigabitEthernet0/0/0.10
 encapsulation dot1Q 10
 vrf forwarding RED
 ip address 172.16.12.2 255.255.255.252
 ip ospf network point-to-point
 ip ospf 10 area 0
!
interface GigabitEthernet0/0/0.20
 encapsulation dot1Q 20
 vrf forwarding BLUE
 ip address 172.16.12.2 255.255.255.252
 ip ospf network point-to-point
 ip ospf 20 area 0
!
interface GigabitEthernet0/0/1
 vrf forwarding RED
 ip address 10.2.2.1 255.255.255.0
 ip ospf 10 area 0
 no shutdown
!
interface GigabitEthernet0/0/2
 vrf forwarding BLUE
 ip address 10.2.2.1 255.255.255.0
 ip ospf 20 area 0
 no shutdown

    R2 also needs router ospf 10 vrf RED and router ospf 20 vrf BLUE from step 2, with its own router IDs and LAN interfaces passive.

Verify

R1 output
R1# show vrf
Name                             Default RD            Protocols   Interfaces
BLUE                             <not set>             ipv4        Gi0/0/0.20
                                                                   Gi0/0/2
RED                              <not set>             ipv4        Gi0/0/0.10
                                                                   Gi0/0/1

Each VRF has its transit subinterface and its LAN interface.

R1 output
R1# show ip ospf 10 neighbor
Neighbor ID     Pri   State           Dead Time   Address         Interface
10.255.10.2       0   FULL/  -        00:00:35    172.16.12.2     GigabitEthernet0/0/0.10

RED's adjacency is FULL. Priority 0 and no DR role is normal on a point-to-point network type.

R1 output
R1# show ip route vrf RED | begin Gateway
Gateway of last resort is not set

      10.0.0.0/8 is variably subnetted, 3 subnets, 2 masks
C        10.1.1.0/24 is directly connected, GigabitEthernet0/0/1
L        10.1.1.1/32 is directly connected, GigabitEthernet0/0/1
O        10.2.2.0/24 [110/2] via 172.16.12.2, 00:05:12, GigabitEthernet0/0/0.10
      172.16.0.0/16 is variably subnetted, 2 subnets, 2 masks
C        172.16.12.0/30 is directly connected, GigabitEthernet0/0/0.10
L        172.16.12.1/32 is directly connected, GigabitEthernet0/0/0.10

Only RED interfaces appear. Cost 2 is R1's subinterface (1) plus R2's LAN (1).

R1 output
R1# show ip route vrf BLUE 10.2.2.0
Routing entry for 10.2.2.0/24
  Known via "ospf 20", distance 110, metric 2, type intra area
  Last update from 172.16.12.2 on GigabitEthernet0/0/0.20, 00:05:09 ago
  Routing Descriptor Blocks:
  * 172.16.12.2, from 10.255.20.2, 00:05:09 ago, via GigabitEthernet0/0/0.20
      Route metric is 2, traffic share count is 1

The same prefix exists in BLUE, learned by a different process over a different subinterface.

R1 output
R1# ping vrf RED 10.2.2.1 source 10.1.1.1
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.2.2.1, timeout is 2 seconds:
Packet sent with a source address of 10.1.1.1
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/1/2 ms

RED site A reaches RED site B.

R1 output
R1# ping 10.2.2.1
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.2.2.1, timeout is 2 seconds:
.....
Success rate is 0 percent (0/5)

Without vrf, the ping uses the global table, which has no route to either tenant. That is the separation working.

Mistakes people make

  • Typing ip address before vrf forwarding, then finding the interface has no address.
  • Testing with plain ping or traceroute and concluding the network is broken. Every test needs vrf <name>.
  • Mismatched VLAN IDs on the two ends of the transit, so RED's subinterface on one router talks to BLUE's on the other.
  • Forgetting no shutdown on the physical interface. The subinterfaces follow its state.
  • Pointing an interface at an OSPF process that belongs to a different VRF. IOS refuses the ip ospf line.

On other platforms

A virtual-router routing instance is Junos VRF-lite. Shown for RED; BLUE is the same with unit 20 and ge-0/0/2.

Junos
set interfaces ge-0/0/0 vlan-tagging
set interfaces ge-0/0/0 unit 10 vlan-id 10 family inet address 172.16.12.1/30
set interfaces ge-0/0/1 unit 0 family inet address 10.1.1.1/24
set routing-instances RED instance-type virtual-router
set routing-instances RED interface ge-0/0/0.10
set routing-instances RED interface ge-0/0/1.0
set routing-instances RED protocols ospf area 0.0.0.0 interface ge-0/0/0.10 interface-type p2p
set routing-instances RED protocols ospf area 0.0.0.0 interface ge-0/0/1.0 passive

Linux VRFs are devices bound to a routing table. Enslaving an interface moves its routes into that table.

Linux
ip link add RED type vrf table 10
ip link set RED up
ip link set eth1 master RED
ip route show vrf RED
ping -I RED 10.2.2.1

Say it in the interview

"Each tenant gets a VRF, so the same 10.1.1.0/24 can exist twice. Between the routers each VRF has its own 802.1Q subinterface, and each runs its own OSPF process with capability vrf-lite. I verify with show vrf, per-VRF routing tables and pings with the vrf keyword, and I show that the global table cannot reach either tenant. For a handful of VRFs over a few hops this is ideal; with many, I would move to MPLS L3VPN or EVPN."

Book 4.4 Multiprotocol Label Switching