Cisco IOS XE Security Configuration Guide: Securing the Data Plane, Release 2
Bias-Free Language
The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.
- Updated:
- May 27, 2010
Chapter: Configuring the VRF-Aware Service Infrastructure
- Finding Feature Information
- Contents
- Restrictions for Configuring the VRF-Aware Software Infrastructure Scale
- Information About Configuring the VRF-Aware Software Infrastructure Scale
- How to Configure VASI
- Configuration Examples for VASI
- Additional References
- Feature Information for Configuring VRF-Aware Software Infrastructure Scale
Configuring the VASI (VRF-Aware Software Infrastructure) Scale
This module describes how to configure the VRF-Aware Software Infrastructure Scale feature. The VRF-Aware Software Infrastructure (VASI) Scale feature allows you to apply services such as access control lists (ACLs), Network Address Translation (NAT), policing, and zone-based firewalls to traffic that is flowing across two different Virtual Routing and Forwarding (VRF) instances. The VASI interfaces support redundancy of the Route Processor (RP) and Forwarding Processor (FP). This feature supports Multiprotocol Label Switching (MPLS) traffic over VASI interfaces and IPv4 and IPv6 unicast traffic on VASI interfaces.
Finding Feature Information
Your software release may not support all the features documented in this module. For the latest feature information and caveats, see the release notes for your platform and software release. To find information about the features documented in this module, and to see a list of the releases in which each feature is supported, see the "Feature Information for Configuring VRF-Aware Software Infrastructure Scale" section.
Use Cisco Feature Navigator to find information about platform support and Cisco software image support. To access Cisco Feature Navigator, go to http://www.cisco.com/go/cfn. An account on Cisco.com is not required.
Contents
•
Restrictions for Configuring the VRF-Aware Software Infrastructure Scale
•Information About Configuring the VRF-Aware Software Infrastructure Scale
•Configuration Examples for VASI
•Feature Information for Configuring VRF-Aware Software Infrastructure Scale
Restrictions for Configuring the VRF-Aware Software Infrastructure Scale
VASI interfaces do not support the attachment of queue-based features. The following commands are not supported on a modular quality of service (QoS) CLI (MQC) policy that is attached to VASI interfaces:
•bandwidth (policy-map class)
•fair-queue
•priority
•queue-limit
•random-detect
•shape
Information About Configuring the VRF-Aware Software Infrastructure Scale
VASI Overview
VASI is implemented by using virtual interface pairs, where each of the interfaces in the pair is associated with a different VRF. The VASI virtual interface is the next hop interface for any packet that needs to be switched between these two VRFs. VASI interfaces provide the framework necessary to configure a firewall or a NAT between VRF instances.
Each interface pair is associated with two different VRF instances. The two virtual interfaces, called vasileft and vasiright, in a pair are logically wired back-to-back and are completely symmetrical. Each interface has an index. The association of the pairing is done automatically based on the two interface indexes such that vasileft automatically gets paired to vasiright. You can configure either static routing or dynamic routing with Border Gateway Protocol (BGP), Enhanced Interior Gateway Routing Protocol (EIGRP), or Open Shortest Path First (OSPF). BGP dynamic routing protocol restrictions and configuration are valid for BGP routing configurations between VASI interfaces.
How to Configure VASI
•Configuring the VASI Interface (required)
Configuring the VASI Interface
VASI must be enabled on both interfaces of the VASI pair (vasileft and vasiright). You can configure VRF on any VASI interface. Perform the following task to configure the VASI interfaces.
SUMMARY STEPS
1. enable
2. configure terminal
3. interface vasileft number
4. vrf forwarding table-name [downstream table-name]
5. ip address {ip-address mask [secondary] | pool pool-name}
6. exit
7. interface vasiright number
8. vrf forwarding table-name [downstream table-name]
9. ip address {ip-address mask [secondary] | pool pool-name}
10. exit
11. ip route [vrf vrf-name] destination-prefix destination-prefix-mask {vasileft | vasiright} number
12. end
DETAILED STEPS
Configuration Examples for VASI
•Example: Configuring the VASI Interface
Example: Configuring the VASI Interface
The following example shows how to configure the VASI interface. VASI must be enabled for each interface of the VASI pair (vasileft and vasiright). You can configure VRF on any VASI interface. See the "Configuring the VASI Interface" section for configuration information.
Router(config)# interface vasileft 200
Router(config-if)# vrf forwarding table1
Router(config-if)# ip address 192.168.0.1 255.255.255.0
Router(config-if)# exit
Router(config)# ip route vrf t1 10.0.0.1 255.255.0.0 vasileft 200
Router(config)# interface vasiright 200
Router(config-if)# vrf forwarding table2
Router(config-if)# ip address 192.168.1.1 255.255.255.0
Router(config-if)# exit
Router(config)# ip route 10.0.0.2 255.255.255.0 vasiright 200
Additional References
Related Documents
|
|
|
|---|---|
Cisco IOS commands |
|
Security commands |
|
Configuring NAT for IP Address Conservation feature |
"Configuring NAT for IP Address Conservation" module of the IP Addressing Configuration Guide |
IP routing: BGP |
|
IP routing: EIGRP |
|
IP routing: OSPF |
|
VRF Aware Cisco IOS Firewall feature |
"VRF Aware Cisco IOS Firewall" module of the Security Configuration Guide: Securing the Control Plane |
Zone-based Policy Firewall feature |
"Zone-based Policy Firewall" module of the Security Configuration Guide: Securing the Control Plane |
Standards
|
|
|
|---|---|
No new or modified standards are supported, and support for existing standards has not been modified. |
— |
MIBs
|
|
|
|---|---|
None |
To locate and download MIBs for selected platforms, Cisco software releases, and feature sets, use Cisco MIB Locator found at the following URL: |
RFCs
|
|
|
|---|---|
None |
— |
Technical Assistance
Feature Information for Configuring VRF-Aware Software Infrastructure Scale
Table 1 lists the features in this module and provides links to specific configuration information.
Use Cisco Feature Navigator to find information about platform support and software image support. Cisco Feature Navigator enables you to determine which software images support a specific software release, feature set, or platform. To access Cisco Feature Navigator, go to http://www.cisco.com/go/cfn. An account on Cisco.com is not required.
Note Table 1 lists only the software release that introduced support for a given feature in a given software release train. Unless noted otherwise, subsequent releases of that software release train also support that feature.
Feedback