Cisco Nexus 7000 Series NX-OS Unicast Routing Configuration Guide, Release 6.x
Configuring Layer 3 Virtualization
Downloads: This chapterpdf (PDF - 277.0KB) The complete bookPDF (PDF - 6.2MB) | The complete bookePub (ePub - 1.41MB) | The complete bookMobi (Mobi - 2.5MB) | Feedback

Table of Contents

Configuring Layer 3 Virtualization

Finding Feature Information

Layer 3 Virtualization

Overview of Layer 3 Virtualization

VRF and Routing

VRF-Aware Services

Reachability

Filtering

Combining Reachability and Filtering

Licensing Requirements for VRFs

Prerequisites for VRF

Guidelines and Limitations for VRFs

Default Settings

Configuring VRFs

Creating a VRF

Assigning VRF Membership to an Interface

Configuring VRF Parameters for a Routing Protocol

Configuring a VRF-Aware Service

Setting the VRF Scope

Verifying the VRF Configuration

Configuration Examples for VRF

Additional References

Related Documents

Standards

Feature History for VRF

Configuring Layer 3 Virtualization

This chapter describes how to configure Layer 3 virtualization on the Cisco NX-OS device.

This chapter includes the following sections:

Finding Feature Information

Your software release might not support all the features documented in this module. For the latest caveats and feature information, see the Bug Search Tool at https//tool.cisco.com/bugsearch/ and the release notes for your software release. To find information about the features documented in this module, and to see a list of the releases in which each feature is supported, see the New and Changed Information section or the Feature History table below.

Layer 3 Virtualization

This section contains the following topics:

Overview of Layer 3 Virtualization

Cisco NX-OS supports a hierarchy of virtualization that can divide the physical system resources into multiple virtual device contexts (VDCs). Each VDC acts as a standalone device with both Layer 2 and Layer 3 services available. You can configure up to 4 VDCs, including the default VDC. See the Cisco Nexus 7000 Series NX-OS Virtual Device Context Configuration Guide for more information on VDCs.

Cisco NX-OS further virtualizes each VDC to support virtual routing and forwarding instances (VRFs). You can configure multiple VRFs in a VDC. Each VRF contains a separate address space with unicast and multicast route tables for IPv4 and IPv6 and makes routing decisions independent of any other VRF.

Figure 1-1 shows multiple independent VRFs in two different VDCs.

Figure 1-1 Multiple VRFs in VDCs

 

A VRF name is local to a VDC, so you can configure two VRFs with the same name if the VRFs exist in different VDCs. In Figure 1-1, VRF A in VDC 2 is independent of VRF B and VRF A in VDC n.

Each router has a default VRF and a management VRF:

Management VRF

  • The management VRF is for management purposes only.
  • Only the mgmt 0 interface can be in the management VRF.
  • The mgmt 0 interface cannot be assigned to another VRF.
  • The mgmt 0 interface is shared among multiple VDCs.
  • No routing protocols can run in the management VRF (static only).

Default VRF

  • All Layer 3 interfaces exist in the default VRF until they are assigned to another VRF.
  • Routing protocols run in the default VRF context unless another VRF context is specified.
  • The default VRF uses the default routing context for all show commands.
  • The default VRF is similar to the global routing table concept in Cisco IOS.

VRF and Routing

All unicast and multicast routing protocols support VRFs. When you configure a routing protocol in a VRF, you set routing parameters for the VRF that are independent of routing parameters in another VRF for the same routing protocol instance.

You can assign interfaces and route protocols to a VRF to create virtual Layer 3 networks. An interface exists in only one VRF. Figure 1-2 shows one physical network split into two virtual networks with two VRFs. Routers Z, A, and B exist in VRF Red and form one address domain. These routers share route updates that do not include Router C because Router C is configured in a different VRF.

Figure 1-2 VRFs in a Network

 

By default, Cisco NX-OS uses the VRF of the incoming interface to select which routing table to use for a route lookup. You can configure a route policy to modify this behavior and set the VRF that Cisco NX-OS uses for incoming packets. See Chapter 1, “Configuring Policy-Based Routing” for more information.

Cisco NX-OS supports route leaking (import or export) between VRFs, both in VRF lite and MPLS VPN scenarios. VRF lite does not require an MPLS license for route leaking. For more information on route leaking, see the Cisco Nexus 7000 Series NX-OS MPLS Configuration Guide .

VRF-Aware Services

A fundamental feature of the Cisco NX-OS architecture is that every IP-based feature is VRF aware.

The following VRF-aware services can select a particular VRF to reach a remote server or to filter information based on the selected VRF:

  • AAA—See the Cisco Nexus 7000 Series NX-OS Security Configuration Guide for more information.
  • Call Home—See the Cisco Nexus 7000 Series NX-OS System Management Configuration Guide for more information.
  • DNS—See Chapter 1, “Configuring DNS” for more information.
  • GLBP—See Chapter 1, “Configuring GLBP” for more information.
  • HSRP—See Chapter 1, “Configuring HSRP” for more information.
  • HTTP—See the Cisco Nexus 7000 Series NX-OS Fundamentals Configuration Guide for more information.
  • NetFlow—See the Cisco Nexus 7000 Series NX-OS System Management Configuration Guide for more information.
  • NTP—See the Cisco Nexus 7000 Series NX-OS System Management Configuration Guide for more information.
  • RADIUS—See the Cisco Nexus 7000 Series NX-OS Security Configuration Guide for more information.
  • Ping and Traceroute —See the Cisco Nexus 7000 Series NX-OS Fundamentals Configuration Guide for more information.
  • SSH—See the Cisco Nexus 7000 Series NX-OS Fundamentals Configuration Guide for more information.
  • SNMP—See the Cisco Nexus 7000 Series NX-OS System Management Configuration Guide for more information.
  • Syslog—See the Cisco Nexus 7000 Series NX-OS System Management Configuration Guide for more information.
  • TACACS+—See the Cisco Nexus 7000 Series NX-OS Security Configuration Guide for more information.
  • TFTP—See the Cisco Nexus 7000 Series NX-OS Fundamentals Configuration Guide for more information.
  • VRRP—See Chapter 1, “Configuring VRRP” for more information.
  • XML—See the Cisco NX-OS XML Interface User Guide for more information.

See the appropriate configuration guide for each service for more information on configuring VRF support in that service.

This section contains the following topics:

Reachability

Reachability indicates which VRF contains the routing information needed to get to the server providing the service. For example, you can configure an SNMP server that is reachable on the management VRF. When you configure that server address on the router, you also configure which VRF that Cisco NX-OS must use to reach the server.

Figure 1-3 shows an SNMP server that is reachable over the management VRF. You configure Router A to use the management VRF for the SNMP server host 192.0.2.1.

Figure 1-3 Service VRF Reachability

 

Filtering

Filtering allows you to limit the type of information that goes to a VRF-aware service based on the VRF. For example, you can configure a syslog server to support a particular VRF. Figure 1-4 shows two syslog servers with each server supporting one VRF. syslog server A is configured in VRF Red, so Cisco NX-OS sends only system messages generated in VRF Red to syslog server A.

Figure 1-4 Service VRF Filtering

 

 

Combining Reachability and Filtering

You can combine reachability and filtering for VRF-aware services. You can configure the VRF that Cisco NX-OS uses to connect to that service as well as the VRF that the service supports. If you configure a service in the default VRF, you can optionally configure the service to support all VRFs.

Figure 1-5 shows an SNMP server that is reachable on the management VRF. You can configure the SNMP server to support only the SNMP notifications from VRF Red, for example.

Figure 1-5 Service VRF Reachability Filtering

 

Licensing Requirements for VRFs

The following table shows the licensing requirements for this feature:

 

Product
License Requirement

Cisco NX-OS

VRFs require no license. Any feature not included in a license package is bundled with the Cisco NX-OS system images and is provided at no extra charge to you. For a complete explanation of the Cisco NX-OS licensing scheme, see the Cisco NX-OS Licensing Guide .

Prerequisites for VRF

VRFs have the following prerequisites:

  • You must install the appropriate license to use VDCs other than the default VDC (see the Cisco Nexus 7000 Series NX-OS Virtual Device Context Configuration Guide for configuration information and the Cisco NX-OS Licensing Guide for licensing information).

Guidelines and Limitations for VRFs

VRFs have the following configuration guidelines and limitations:

  • When you make an interface a member of an existing VRF, Cisco NX-OS removes all Layer 3 configurations. You should configure all Layer 3 parameters after adding an interface to a VRF.
  • You should add the mgmt0 interface to the management VRF and configure the mgmt0 IP address and other parameters after you add it to the management VRF.
  • If you configure an interface for a VRF before the VRF exists, the interface is operationally down until you create the VRF.
  • Cisco NX-OS creates the default and management VRFs by default. You should make the mgmt0 interface a member of the management VRF.
  • The write erase boot command does not remove the management VRF configurations. You must use the write erase command and then the write erase boot command.

Default Settings

Table 1-1 lists the default settings for VRF parameters.

 

Table 1-1 Default VRF Parameters

Parameters
Default

Configured VRFs

Default, management

routing context

Default VRF

Configuring VRFs

This section contains the following topics:


NoteIf you are familiar with the Cisco IOS CLI, be aware that the Cisco NX-OS commands for this feature might differ from the Cisco IOS commands that you would use. If you are familiar with the Cisco IOS CLI, be aware that the Cisco NX-OS commands for this feature might differ from the Cisco IOS commands that you would use.


Creating a VRF

You can create a VRF in a VDC.

BEFORE YOU BEGIN

Ensure that you are in the correct VDC (or use the switchto vdc command).

SUMMARY STEPS

1. configure terminal

2. vrf context vrf-name

3. (Optional) ip route {ip-prefix | ip-addr ip-mask} {[next-hop | nh-prefix] | [interface next-hop | nh-prefix]} [tag tag-value [pref]

4. (Optional) show vrf [ vrf-name ]

5. (Optional) copy running-config startup-config

DETAILED STEPS

 

Command
Purpose

Step 1

configure terminal

 

Example:

switch# configure terminal

switch(config)#

Enters global configuration mode.

Step 2

vrf context name

 

Example:

switch(config)# vrf context Enterprise

switch(config-vrf)#

Creates a new VRF and enters VRF configuration mode. The name can be any case-sensitive, alphanumeric string up to 32 characters.

Step 3

ip route { ip-prefix | ip-addr ip-mask } {[ next-hop | nh-prefix ] | [ interface next-hop | nh-prefix ]} [ tag tag-value [ pref ]

 

Example :

switch(config-vrf)# ip route 192.0.2.0/8 ethernet 1/2 192.0.2.4

(Optional) Configures a static route and the interface for this static route. You can optionally configure the next-hop address. The preference value sets the administrative distance. The range is from 1 to 255. The default is 1.

Step 4

show vrf [ vrf-name ]

 

Example :

switch(config-vrf)# show vrf Enterprise

(Optional) Displays VRF information.

Step 5

copy running-config startup-config

 

Example:

switch(config)# copy running-config startup-config

(Optional) Saves this configuration change.

To delete the VRF and the associated configuration, use the following command in global configuration mode:

 

Command
Purpose

no vrf context name

 

Example:

switch(config)# no vrf context Enterprise

Deletes the VRF and all associated configurations.

Any commands available in global configuration mode are also available in VRF configuration mode.

This example shows how to create a VRF and add a static route to the VRF:

switch# configure terminal

switch(config)# vrf context Enterprise

switch(config-vrf)# ip route 192.0.2.0/8 ethernet 1/2

switch(config-vrf)# exit

switch(config)# copy running-config startup-config

Assigning VRF Membership to an Interface

You can make an interface a member of a VRF.

BEFORE YOU BEGIN

Ensure that you are in the correct VDC (or use the switchto vdc command).

Assign the IP address for an interface after you have configured the interface for a VRF.

SUMMARY STEPS

1. configure terminal

2. interface interface-type slot/port

3. vrf member vrf-name

4. ip-address ip-prefix/length

5. (Optional) show vrf vrf-name interface interface-type number

6. (Optional) copy running-config startup-config

DETAILED STEPS

 

Command
Purpose

Step 1

configure terminal

 

Example:

switch# configure terminal

switch(config)#

Enters global configuration mode.

Step 2

interface interface-type slot/port

 

Example :

switch(config)# interface ethernet 1/2

switch(config-if)#

Enters interface configuration mode.

Step 3

vrf member vrf-name

 

Example:

switch(config-if)# vrf member RemoteOfficeVRF

Adds this interface to a VRF.

Step 4

ip address ip-prefix/length

 

Example:

switch(config-if)# ip address 192.0.2.1/16

Configures an IP address for this interface. You must do this step after you assign this interface to a VRF.

Step 5

show vrf vrf-name interface interface-type number

 

Example :

switch(config-vrf)# show vrf Enterprise interface ethernet 1/2

(Optional) Displays VRF information.

Step 6

copy running-config startup-config

 

Example:

switch(config)# copy running-config startup-config

(Optional) Saves this configuration change.

This example shows how to add an interface to the VRF:

switch# configure terminal

switch(config)# interface ethernet 1/2

switch(config-if)# vrf member RemoteOfficeVRF

switch(config-if)# ip address 192.0.2.1/16

switch(config-if)# copy running-config startup-config

Configuring VRF Parameters for a Routing Protocol

You can associate a routing protocol with one or more VRFs. See the appropriate chapter for information on how to configure VRFs for the routing protocol. This section uses OSPFv2 as an example protocol for the detailed configuration steps.

BEFORE YOU BEGIN

Ensure that you are in the correct VDC (or use the switchto vdc command).

SUMMARY STEPS

1. configure terminal

2. router ospf instance-tag

3. vrf vrf-name

4. (Optional) maximum-paths paths

5. interface interface-type slot/port

6. vrf member vrf-name

7. ip address ip-prefix/length

8. ip router ospf instance-tag area area-id

9. (Optional) copy running-config startup-config

DETAILED STEPS

 

Command
Purpose

Step 1

configure terminal

 

Example:

switch# configure terminal

switch(config)#

Enters global configuration mode.

Step 2

router ospf instance-tag

 

Example:

switch(config-vrf)# router ospf 201

switch(config-router)#

Creates a new OSPFv2 instance with the configured instance tag.

Step 3

vrf vrf-name

 

Example:

switch(config-router)# vrf RemoteOfficeVRF

switch(config-router-vrf)#

Enters VRF configuration mode.

Step 4

maximum-paths paths

 

Example:

switch(config-router-vrf)# maximum-paths 4

(Optional) Configures the maximum number of equal OSPFv2 paths to a destination in the route table for this VRF. Used for load balancing.

Step 5

interface interface-type slot/port

 

Example :

switch(config)# interface ethernet 1/2

switch(config-if)#

Enters interface configuration mode.

Step 6

vrf member vrf-name

 

Example:

switch(config-if)# vrf member RemoteOfficeVRF

Adds this interface to a VRF.

Step 7

ip address ip-prefix/length

 

Example:

switch(config-if)# ip address 192.0.2.1/16

Configures an IP address for this interface. You must do this step after you assign this interface to a VRF.

Step 8

ip router ospf instance-tag area area-id

 

Example:

switch(config-if)# ip router ospf 201 area 0

Assigns this interface to the OSPFv2 instance and area configured.

Step 9

copy running-config startup-config

 

Example:

switch(config)# copy running-config startup-config

(Optional) Saves this configuration change.

This example shows how to create a VRF and add an interface to the VRF:

switch# configure terminal

switch(config)# vrf context RemoteOfficeVRF

switch(config-vrf)# exit

switch(config)# router ospf 201

switch(config-router)# vrf RemoteOfficeVRF

switch(config-router-vrf)# maximum-paths 4

switch(config-router-vrf)# interface ethernet 1/2

switch(config-if)# vrf member RemoteOfficeVRF

switch(config-if)# ip address 192.0.2.1/16

switch(config-if)# ip router ospf 201 area 0

switch(config-if)# exit

switch(config)# copy running-config startup-config

Configuring a VRF-Aware Service

You can configure a VRF-aware service for reachability and filtering. See the “VRF-Aware Services” section for links to the appropriate chapter or configuration guide for information on how to configure the service for VRFs. This section uses SNMP and IP domain lists as example services for the detailed configuration steps.

BEFORE YOU BEGIN

Ensure that you are in the correct VDC (or use the switchto vdc command).

SUMMARY STEPS

1. configure terminal

2. snmp-server host ip-address [filter-vrf vrf-name] [use-vrf vrf-name]

3. vrf context [ vrf-name ]

4. ip domain-list domain-name [ all-vrfs ][ use-vrf vrf-name ]

5. (Optional) copy running-config startup-config

DETAILED STEPS

 

Command
Purpose

Step 1

configure terminal

 

Example:

switch# configure terminal

switch(config)#

Enters global configuration mode.

Step 2

snmp-server host ip-address [ filter-vrf vrf-name ] [ use-vrf vrf-name ]

 

Example:

switch(config)# snmp-server host 192.0.2.1 use-vrf Red

switch(config-vrf)#

Configures a global SNMP server and configures the VRF that Cisco NX-OS uses to reach the service. Use the filter-vrf keyword to filter information from the selected VRF to this server.

Step 3

vrf context vrf-name

 

Example:

switch(config)# vrf context Blue

switch(config-vrf)#

Creates a new VRF.

Step 4

ip domain-list domain-name [ all-vrfs ][ use-vrf vrf-name ]

 

Example:

switch(config-vrf)# ip domain-list List all-vrfs use-vrf Blue

switch(config-vrf)#

Configures the domain list in the VRF and optionally configures the VRF that Cisco NX-OS uses to reach the domain name listed.

Step 5

copy running-config startup-config

 

Example:

switch(config)# copy running-config startup-config

(Optional) Saves this configuration change.

This example shows how to send SNMP information for all VRFs to SNMP host 192.0.2.1, reachable on VRF Red:

switch# configure terminal

switch(config)# snmp-server host 192.0.2.1 for-all-vrfs use-vrf Red

switch(config)# copy running-config startup-config

 

This example shows how to filter SNMP information for VRF Blue to SNMP host 192.0.2.12, reachable on VRF Red:

switch# configure terminal

switch(config)# vrf context Blue

switch(config-vrf)# snmp-server host 192.0.2.12 use-vrf Red

switch(config)# copy running-config startup-config

Setting the VRF Scope

You can set the VRF scope for all EXEC commands (for example, show commands). This automatically restricts the scope of the output of EXEC commands to the configured VRF. You can override this scope by using the VRF keywords available for some EXEC commands.

To set the VRF scope, use the following command in EXEC mode:

 

Command
Purpose

routing-context vrf vrf-name

 

Example:

switch# routing-context vrf red

switch%red#

Sets the routing context for all EXEC commands. Default routing context is the default VRF.

To return to the default VRF scope, use the following command in EXEC mode:

 

Command
Purpose

routing-context vrf default

 

Example:

switch%red# routing-context vrf default

switch#

Sets the default routing context.

Verifying the VRF Configuration

To display VRF configuration information, perform one of the following tasks:

 

Command
Purpose

show vrf [vrf-name]

Displays the information for all or one VRF.

show vrf [vrf-name] detail

Displays detailed information for all or one VRF.

show vrf [vrf-name] [interface interface-type slot/port]

Displays the VRF status for an interface.

Configuration Examples for VRF

This example shows how to configure VRF Red, add an SNMP server to that VRF, and add an instance of OSPF to VRF Red:

configure terminal

vrf context Red

snmp-server host 192.0.2.12 use-vrf Red

router ospf 201

vrf Red

interface ethernet 1/2

vrf member Red

ip address 192.0.2.1/16

ip router ospf 201 area 0

 

This example shows how to configure VRF Red and Blue, add an instance of OSPF to each VRF, and create an SNMP context for each OSPF instance in each VRF:

configure terminal
!Create the VRFs
vrf context Red
vrf context Blue
vrf context Green
!Create the OSPF instances and associate them with a single VRF or multiple VRFs (recommended)
feature ospf
router ospf Lab
vrf Red
!
router ospf Production
vrf Blue
router-id 1.1.1.1
vrf Green
router-id 2.2.2.2
!Configure one interface to use ospf Lab on VRF Red
interface ethernet 1/2
vrf member Red
ip address 192.0.2.1/16
ip router ospf Lab area 0
no shutdown
!Configure another interface to use ospf Production on VRF Blue
interface ethernet 10/2
vrf member Blue
ip address 192.0.2.1/16
ip router ospf Production area 0
no shutdown
!
interface ethernet 10/3
vrf member Green
ip address 192.0.2.1/16
ip router ospf Production area 0
no shutdown
 
!configure the SNMP server
snmp-server user admin network-admin auth md5 nbv-12345
snmp-server community public ro
!Create the SNMP contexts for each VRF
snmp-server context lab instance Lab vrf Red
snmp-server context production instance Production vrf Blue
!Use the SNMP context lab to access the OSPF-MIB values for the OSPF instance Lab in VRF Red in this example.
 
Use the SNMP context lab to access the OSPF-MIB values for the OSPF instance Lab in VRF Red in this example.

Additional References

For additional information related to implementing virtualization, see the following sections:

Related Documents

Related Topic
Document Title

VRF CLI

Cisco Nexus 7000 Series NX-OS Unicast Routing Command Reference

VRFs

Cisco Nexus 7000 Series NX-OS Fundamentals Configuration Guide
Cisco Nexus 7000 Series NX-OS MPLS Configuration Guide
Cisco Nexus 7000 Series NX-OS System Management Configuration Guide

VDCs

Cisco Nexus 7000 Series NX-OS Virtual Device Context Configuration Guide

Standards

Standards
Title

No new or modified standards are supported by this feature, and support for existing standards has not been modified by this feature.

Feature History for VRF

Table 1-2 lists the release history for this feature.

 

Table 1-2 Feature History for VRF

Feature Name
Releases
Feature Information

VRF

4.0(1)

This feature was introduced.