Skip to main content

VRF lite at Enterprise

In this scenario we have two internet line and separate the user group for internet using.
I want to setup  NET_G1 group use internet line 1 and NET_G2 group use internet line 2.
At NET_G1 sale and MKT department are included and at NET_G2 HR and IT are included.

First step create the vrf.

R1/R4/R5
ip vrf NET_G1
ip vrf NET_G2

Second step -set the interfaces belong to vrf.

R1
ip vrf NET_G1
ip vrf NET_G2


int f0/0
ip vrf forwarding NET_G1
ip add 10.10.10.2 255.255.255.252
description Internet 1
no sh

int f1/0
no sh
ip vrf forwading NET_G2
ip add 172.16.12.2 255.255.255.252
description Internet 2
no sh

int f2/0
no sh

int f2/0.10
encapsulation dot1q 10
ip vrf for NET_G1
ip add 192.168.14.1 255.255.255.252

int f2/0.20
encapsulation dot1q 20
ip vrf for NET_G2
ip add 192.168.14.1 255.255.255.252

int f3/0
no sh

int f3/0.10
encapsulation dot1q 10
ip vrf for NET_G1
ip add 192.168.15.1 255.255.255.252

int f3/0.20
encapsulation dot1q 20
ip vrf for NET_G2
ip add 192.168.15.1 255.255.255.252

R4
int f0/0
no sh

int f0/0.10
encapsulation dot1q 10
ip vrf for NET_G1
ip add 192.168.14.2 255.255.255.252

int f0/0.20
encapsulation dot1q 20
ip vrf for NET_G2
ip add 192.168.14.2 255.255.255.252

int lo0
ip vrf for NET_G1
ip add 192.168.1.1 255.255.255.0
description sale

int lo1
ip vrf for NET_G2
ip add 192.168.2.1 255.255.255.0
description HR

R5
int f0/0
no sh

int f0/0.10
encapsulation dot1q 10
ip vrf for NET_G1
ip add 192.168.15.2 255.255.255.252

int f0/0.20
encapsulation dot1q 20
ip vrf for NET_G2
ip add 192.168.15.2 255.255.255.252

int lo0
ip vrf for NET_G1
ip add 192.168.3.1 255.255.255.0
description MKT

int lo1
ip vrf for NET_G2
ip add 192.168.4.1 255.255.255.0
description IT

Let configure the ospf routing.Please make sure the router ID must different.

R1
router ospf 1 vrf NET_G1
router-id 1.1.1.1
net 192.168.14.0 0.0.0.3 area 0
net 192.168.15.0 0.0.0.3 area 0

router ospf 2 vrf NET_G2
router-id 1.1.1.2
net 192.168.14.0 0.0.0.3 area 0
net 192.168.15.0 0.0.0.3 area 0

R4
router ospf 1 vrf NET_G1
router-id 1.1.4.1
net 192.168.1.0 0.0.0.255 area 0
net 192.168.14.0 0.0.0.3 area 0

router ospf 2 vrf NET_G2
router-id 1.1.4.2
net 192.168.2.0 0.0.0.255 area 0
net 192.168.14.0 0.0.0.3 area 0

R5

router ospf 1 vrf NET_G1
router-id 1.1.5.1
net 192.168.3.0 0.0.0.255 area 0
net 192.168.15.0 0.0.0.3 area 0

router ospf 2 vrf NET_G2
router-id 1.1.5.2
net 192.168.4.0 0.0.0.255 area 0
net 192.168.15.0 0.0.0.3 area 0

Now we can verify the each vrf routing table

R1#sh ip route vrf NET_G1
Gateway of last resort is not set

     192.168.14.0/30 is subnetted, 1 subnets
C       192.168.14.0 is directly connected, FastEthernet2/0.10
     192.168.15.0/30 is subnetted, 1 subnets
C       192.168.15.0 is directly connected, FastEthernet3/0.10
     10.0.0.0/30 is subnetted, 1 subnets
C       10.10.10.0 is directly connected, FastEthernet0/0
O    192.168.1.0/24 [110/2] via 192.168.14.2, 00:43:09, FastEthernet2/0.10
O    192.168.3.0/24 [110/2] via 192.168.15.2, 00:43:09, FastEthernet3/0.10

R1#sh ip route vrf NET_G2
Gateway of last resort is not set

     192.168.14.0/30 is subnetted, 1 subnets
C       192.168.14.0 is directly connected, FastEthernet2/0.20
     192.168.15.0/30 is subnetted, 1 subnets
C       192.168.15.0 is directly connected, FastEthernet3/0.20
O    192.168.4.0/24 [110/2] via 192.168.15.2, 00:43:45, FastEthernet3/0.20
O    192.168.2.0/24 [110/2] via 192.168.14.2, 00:43:45, FastEthernet2/0.20

For internet using default route is needed. So let make it.

ip route vrf NET_G1 0.0.0.0 0.0.0.0 10.10.10.1
ip route vrf NET_G2 0.0.0.0 0.0.0.0 172.16.12.1

R1#sh ip route vrf NET_G1 static
S*   0.0.0.0/0 [1/0] via 10.10.10.1

R1#sh ip route vrf NET_G2 static
S*   0.0.0.0/0 [1/0] via 172.16.12.1

Ok, let check from R4 and R5
R4#sh ip route vrf NET_G1
Gateway of last resort is not set

     192.168.14.0/30 is subnetted, 1 subnets
C       192.168.14.0 is directly connected, FastEthernet0/0.10
     192.168.15.0/30 is subnetted, 1 subnets
O       192.168.15.0 [110/2] via 192.168.14.1, 00:48:19, FastEthernet0/0.10
C    192.168.1.0/24 is directly connected, Loopback0
O    192.168.3.0/24 [110/3] via 192.168.14.1, 00:48:19, FastEthernet0/0.10


R5#sh ip route vrf NET_G2
Gateway of last resort is not set

     192.168.15.0/30 is subnetted, 1 subnets
C       192.168.15.0 is directly connected, FastEthernet0/0.20
     192.168.14.0/30 is subnetted, 1 subnets
O       192.168.14.0 [110/2] via 192.168.14.1, 00:46:57, FastEthernet0/0.20
O    192.168.2.0/24 [110/3] via 192.168.14.1, 00:46:57, FastEthernet0/0.20
C    192.168.4.0/24 is directly connected, Loopback1

Gateway of last resort is not set that mean R4 and R5 don't have gateway.
Let inject the default route to OSPF.

R1
router ospf 1
default-information originate
exit

router ospf 2
default-information originate


Verify the R4 and R5 routing tables.

R4#sh ip route vrf NET_G1
Gateway of last resort is 192.168.14.1 to network 0.0.0.0

     192.168.14.0/30 is subnetted, 1 subnets
C       192.168.14.0 is directly connected, FastEthernet0/0.10
     192.168.15.0/30 is subnetted, 1 subnets
O       192.168.15.0 [110/2] via 192.168.14.1, 00:02:58, FastEthernet0/0.10
C    192.168.1.0/24 is directly connected, Loopback0
O    192.168.3.0/24 [110/3] via 192.168.14.1, 00:02:58, FastEthernet0/0.10
O*E2 0.0.0.0/0 [110/1] via 192.168.14.1, 00:02:58, FastEthernet0/0.10

R5#sh ip route vrf NET_G2    
Gateway of last resort is 192.168.15.1 to network 0.0.0.0

     192.168.14.0/30 is subnetted, 1 subnets
O       192.168.14.0 [110/2] via 192.168.15.1, 00:04:37, FastEthernet0/0.20
     192.168.15.0/30 is subnetted, 1 subnets
C       192.168.15.0 is directly connected, FastEthernet0/0.20
C    192.168.4.0/24 is directly connected, Loopback1
O    192.168.2.0/24 [110/3] via 192.168.15.1, 00:04:37, FastEthernet0/0.20
O*E2 0.0.0.0/0 [110/1] via 192.168.15.1, 00:03:16, FastEthernet0/0.20

Now we can use internet. Actually we need to config NAT but let skip on this post.

R4
R4#ping vrf NET_G1 10.10.10.2 so lo0

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.10.10.2, timeout is 2 seconds:
Packet sent with a source address of 192.168.1.1
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 8/11/12 ms
R4#ping vrf NET_G1 10.10.10.2 so lo1

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.10.10.2, timeout is 2 seconds:
Packet sent with a source address of 192.168.2.1
.....
Success rate is 0 percent (0/5)
Labels:

Comments

Post a Comment

Popular posts from this blog

How to setup AWS VPC Peering (VPC to VPC)

    Hi Everyone... ဒီကနေ့တော့ VPC Peering လုပ်တဲ့ အကြောင်းလေးပြောပြပေးသွားမှာပါ။ VPC peering ဘာလို့လုပ်တာလဲ ဘယ်အချိန်တွေမှာသုံးတာလဲဆိုတာကို ကြည့်ရအောင်... သိတဲ့ အတိုင်း ပဲ AWS networking မှာ VPC ကမပါမဖြစ်အရေးပါပါတယ် AWS account တခုရဲ့ AWS region တခုမှာ VPC 5ခုအများဆုံး ထားလို့ရပါတယ်... AZ မဟုတ်ပါဘူး အဲ့ဒါလေးတော့သတိထားရမှာပါ.. peering က one to one ဖြစ်တဲ့အတွက် VPC များလာရင်တော့ configuation complex ဖြစ်လာပါမယ်၊ နောက်တခုကတခြား AWS account တွေရဲ့ VPC နဲ့ချိတ်ဆက်သုံးချင်တာတွေလဲရှိနိုင်ပါတယ် အဲ့လို VPC တွေများလာမယ်ဆိုရင်တော့ Transit Gateway ကိုသုံးတာက ပိုစိတ်ချမ်းသာရပါတယ်။ VPC နည်းသေးတယ် နောင်လဲတိုးလာဖို့ မရှိသေးဘူးဆိုရင်တော့ အခုနည်းလမ်းက ပိုအဆင်ပြေပါတယ်. ဆိုတော့ Pubilc VPC နဲ့ Private VPC ဆိုပြီးရှိတယ်ဆိုပါစို့ Pubilc VPC ထဲက webserver က Private VPC ထဲ က database ကိုလှမ်းသုံးချင်တယ်ဆိုရင် အဲ့ဒီ VPC တွေကို peering လုပ်ပေးဖို့လိုပါတယ်.. Peering လုပ်မယ်ဆိုရင်တော့ VPC ထဲက peering connections ကိုရွေးရပါမယ်. ပြီးရင်တော့ Create peering connections ကို click ပါ၊ ဒီ box ကျလာရင်တော့ name မှာ
Post a Comment
Read more

Access-list at SVI

SVI (Switch Virtual Interfaces) We use the SVI for inter vlan routing. In this scenario I will configure the access list with SVI. In this scenario I want to permit vlan 10 network to vlan 50 Server farm. Vlan 10 and vlan 20 can communicate each other. First create vlan and then interface vlan#. Switch(config)#vlan 10 Switch(config)#interface vlan 10 Switch(config-if)#ip address 192.168.10.254 255.255.255.0 Switch(config)#vlan 20 Switch(config)#interface vlan 20 Switch(config-if)#ip address 192.168.20.254 255.255.255.0 Switch(config)#vlan 50 Switch(config)#interface vlan 50 Switch(config-if)#ip address 192.168.50.254 255.255.255.0 when we finish the vlan interface create make sure the switch port are belong to each vlan. Port to vlan assign configure is Switch(config)#interface g0/1 Switch(config-if)#switchport access vlan 10 Switch(config)#interface g0/2 Switch(config-if)#switchport access vlan 20 Switch(config)#int
1 comment
Read more

BGP Disable Connected Check and EBGP Multi Hop

Figure 1.1 In this scenario I use OSPF for TCP reachability. We can see the difference 'disable connected' check and 'EBGP multihop'. We can use both for EBGP neighbor connection with loopback address. Disable connected check This command used to disable the connection verification process for ebgp. Use for ebgp neighbor are directly connected and they using the loopback address for peering. It not increment TTL but neighbor must reachable at single hop. EBGP multihop This command can use for ebgp neighbor are not directly connected. It increment TTL. R1 router bgp 100  neighbor 2.2.2.2 remote-as 200  neighbor 2.2.2.2 disable-connected-check  neighbor 2.2.2.2 update-source Loopback0  neighbor 3.3.3.3 remote-as 300  neighbor 3.3.3.3 ebgp-multihop 2  neighbor 3.3.3.3 update-source Loopback0 R2 router bgp 200  neighbor 1.1.1.1 remote-as 100  neighbor 1.1.1.1 disable-connected-check  neighbor 1.1.1.1 update-source Loopback0 R3
Post a Comment
Read more