MPLS Multi-VRF (VRF-Lite)

The MPLS Multi-VRF feature enables a service provider to support two or more VPNs, where the IP addresses can overlap several VPNs. The MPLS Multi-VRF feature uses input interfaces to distinguish routes for different VPNs and forms virtual packet-forwarding tables by associating one or more Layer 3 interfaces with each VRF. Interfaces in a VRF can be either physical, such as FastEthernet ports, or logical, such as VLAN Switched Virtual Interfaces (SVIs), but a Layer 3 interface cannot belong to more than one VRF at any one time. The Multi-VRF feature allows an operator to support two or more routing domains on a CE device, with each routing domain having its own set of interfaces and its own set of routing and forwarding tables. The MPLS Multi-VRF feature makes it possible to extend the Label Switched Paths (LSPs) to the CE and into each routing domain that the CE supports.

The MPLS Multi-VRF feature works as follows:

• Each CE device advertises its site's local routes to a provider edge (PE) device and learns the remote VPN routes from that PE device.
• PE devices exchange routing information with CE devices by using static routing or a routing protocol such as BGP, RIPv1, or RIPv2.
• PE devices exchange MPLS label information with CE devices through LDP or BGP.
• The PE device needs to maintain VPN routes only for those VPNs to which it is directly attached, eliminating the requirement that the PE maintain all of the service provider's VPN routes. Each PE device maintains a VRF for each of its directly connected sites. Two or more interfaces on a PE device can be associated with a single VRF if all the sites participate in the same VPN. Each VPN is mapped to a specified VRF. After learning local VPN routes from CE devices, the PE device exchanges VPN routing information with other PE devices through internal BGP (iBGP).

With the MPLS Multi-VRF feature, two or more customers can share one CE device, and only one physical link is used between the CE and the PE devices. The shared CE device maintains separate VRF tables for each customer and routes packets for each customer based on that customer's own routing table. The MPLS Multi-VRF feature extends limited PE device functionality to a CE device, giving it the ability, through the maintenance of separate VRF tables, to extend the privacy and security of a VPN to the branch office.

The figure below shows a configuration where each CE device acts as if it were two CE devices. Because the MPLS Multi-VRF feature is a Layer 3 feature, each interface associated with a VRF must be a Layer 3 interface.

Following is the packet-forwarding process in an MPLS Multi-VRF CE-enabled network, as illustrated in the figure above:

• When the CE receives a packet from a VPN, it looks up the routing table based on the input interface. When a route is found, the CE imposes the MPLS label it received from the PE for that route and forwards the packet to the PE.
• When the ingress PE receives a packet from the CE, it swaps the incoming label with the corresponding label stack and sends it to the MPLS network.
• When an egress PE receives a packet from the network, it swaps the VPN label with the label it earlier had received for the route from the CE, and forwards it to the CE.
• When a CE receives a packet from an egress PE, it uses the incoming label on the packet to forward the packet to the correct VPN.

To configure Multi-VRF, you create a VRF table and then specify the Layer 3 interface associated with that VRF. Next, you configure the routing protocols within the VPN, and between the CE and the PE. BGP is the preferred routing protocol for distributing VPN routing information across the provider's backbone.

The Multi-VRF network has three major components:

• VPN route target communities: These are lists of all other members of a VPN community. You need to configure VPN route targets for each VPN community member.
• Multiprotocol BGP peering of VPN community PE devices: This propagates VRF reachability information to all members of a VPN community. You need to configure BGP peering in all PE devices within a VPN community.
• VPN forwarding: This transports all traffic between VPN community members across a VPN service-provider network.

When BGP is used as the routing protocol, it can also be used for MPLS label exchange between the PE and CE devices. By contrast, if Open Shortest Path First (OSPF), Enhanced Interior Gateway Routing Protocol (EIGRP), RIP, or static routing is used, LDP must be used to signal labels.

To configure the MPLS Multi-VRF feature, create a VRF table, specify the Layer 3 interface associated with that VRF, and then configure the routing protocols within the VPN and between the CE and the PE devices.

Consider these points when configuring the MPLS Multi-VRF feature in your network:

• A device with the MPLS Multi-VRF feature is shared by several customers, and each customer has its own routing table.
• Because each customer uses a different VRF table, the same IP addresses can be reused. Overlapping IP addresses are allowed in different VPNs.
• The MPLS Multi-VRF feature lets several customers share the same physical link between the PE and CE devices. Trunk ports with several VLANs separate packets among the customers. Each customer has its own VLAN.
• For the PE device, there is no difference between using the MPLS Multi-VRF feature or using several CE devices. In the figure above, for example, four virtual Layer 3 interfaces are connected to the MPLS Multi-VRF CE device.
• The MPLS Multi-VRF feature does not affect the packet switching rate.

SUMMARY STEPS

1.    enable

2.    configure terminal

3.    ip routing

4.    ip vrf vrf-name

5.    rd route-distinguisher

6.    route-target {export | import | both} route-target-ext-community

7.    import map route-map

8.    exit

9.    interface type-number

10.    ip vf forwarding vrf-name

11.    end

12.    show ip vrf

DETAILED STEPS

	Command or Action	Purpose
Step 1	enable Example: Device> enable	Enables privileged EXEC mode. Enter your password if prompted.
Step 2	configure terminal Example: Device# configure terminal	Enters global configuration mode.
Step 3	ip routing Example: Device(config)# ip routing	Enables IP routing.
Step 4	ip vrf vrf-name Example: Device(config)# ip vrf v1	Names the VRF and enters VRF configuration mode.
Step 5	rd route-distinguisher Example: Device(config-vrf)# rd 100:1	Creates a VRF table by specifying a route distinguisher. Enter either an autonomous system number and an arbitrary number (xxx:y), or an IP address and an arbitrary number (A.B.C.D:y).
Step 6	route-target {export | import | both} route-target-ext-community Example: Device(config-vrf)# route-target export 100:1	Creates a list of import, export, or import and export route target communities for the specified VRF. Enter either an autonomous system number and an arbitrary number (xxx:y), or an IP address and an arbitrary number (A.B.C.D:y). Note    This command works only if BGP is running.
Step 7	import map route-map Example: Device(config-vrf)# import map importmap1	(Optional) Associates a route map with the VRF.
Step 8	exit Example: Device(config-vrf)# exit	Returns to global configuration mode.
Step 9	interface type-number Example: Device(config)# interface fastethernet3/0.10	Specifies the Layer 3 interface to be associated with the VRF and enters interface configuration mode. The interface can be a routed port or an SVI.
Step 10	ip vf forwarding vrf-name Example: Device(config-if)# ip vrf forwarding v1	Associates the VRF with the Layer 3 interface.
Step 11	end Example: Device(config-if)# end	Exits interface configuration mode and returns to privileged EXEC mode.
Step 12	show ip vrf Example: Device# show ip vrf	Displays the settings of the VRFs.

SUMMARY STEPS

1.    enable

2.    configure terminal

3.    router bgp autonomous-system-number

4.    network ip-address mask network-mask

5.    redistribute ospf process-id match internal

6.    network ip-address area area-id

7.    address-family ipv4 vrf vrf-name

8.    neighbor {ip-address | peer-group-name} remote-as as-number

9.    neighbor address activate

DETAILED STEPS

	Command or Action	Purpose
Step 1	enable Example: Device> enable	Enables privileged EXEC mode. Enter your password if prompted.
Step 2	configure terminal Example: Device# configure terminal	Enters global configuration mode.
Step 3	router bgp autonomous-system-number Example: Device(config)# router bgp 100	Configures the BGP routing process with the autonomous system number passed to other BGP devices, and enters router configuration mode.
Step 4	network ip-address mask network-mask Example: Device(config-router)# network 10.0.0.0 mask 255.255.255.0	Specifies a network and mask to announce using BGP.
Step 5	redistribute ospf process-id match internal Example: Device(config-router)# redistribute ospf 2 match internal	Sets the device to redistribute OSPF internal routes.
Step 6	network ip-address area area-id Example: Device(config-router)# network 10.0.0.0 255.255.255.0 area 0	Identifies the network address and mask on which OSPF is running, and the area ID of that network address.
Step 7	address-family ipv4 vrf vrf-name Example: Device(config-router)# address-family ipv4 vrf v12	Identifies the name of the VRF instance that will be associated with the next two commands, and enters VRF address-family mode.
Step 8	neighbor {ip-address | peer-group-name} remote-as as-number Example: Device(config-router-af)# neighbor 10.0.0.3 remote-as 100	Informs this device's BGP neighbor table of the neighbor's address (or peer group name) and the neighbor's autonomous system number.
Step 9	neighbor address activate Example: Device(config-router-af)# neighbor 10.0.0.3 activate	Activates the advertisement of the IPv4 address-family neighbors.

SUMMARY STEPS

1.    enable

2.    configure terminal

3.    router bgp autonomous-system-number

4.    address-family ipv4 vrf vrf-name

5.    neighbor {ip-address | peer-group-name} remote-as as-number

6.    neighbor address send-label [explicit-null]

7.    neighbor address activate

8.    end

9.    configure terminal

10.    interface type number

11.    mpls bgp forwarding

DETAILED STEPS

	Command or Action	Purpose
Step 1	enable Example: Device> enable	Enables privileged EXEC mode. Enter your password if prompted.
Step 2	configure terminal Example: Device# configure terminal	Enters global configuration mode.
Step 3	router bgp autonomous-system-number Example: Device(config)# router bgp 100	Configures the BGP routing process with the autonomous system number passed to other BGP devices and enters router configuration mode.
Step 4	address-family ipv4 vrf vrf-name Example: Device(config-router)# address-family ipv4 vrf v12	Identifies the name of the VRF instance that will be associated with the next two commands and enters address family configuration mode.
Step 5	neighbor {ip-address | peer-group-name} remote-as as-number Example: Device(config-router-af)# neighbor 10.0.0.3 remote-as 100	Informs this device's BGP neighbor table of the neighbor's address (or peer group name) and the neighbor's autonomous system number.
Step 6	neighbor address send-label [explicit-null] Example: Device(config-router-af)# neighbor 10.0.0.3 send-label	Enables the device to use BGP to distribute MPLS labels along with the IPv4 routes to the peer devices. If a BGP session is running when you issue this command, the BGP session flaps immediately after the command is issued.
Step 7	neighbor address activate Example: Device(config-router-af)# neighbor 10.0.0.3 activate	Activates the advertisement of the IPv4 address-family neighbors.
Step 8	end Example: Device(config-router-af)# end	Exits address family configuration mode and returns to privileged EXEC mode.
Step 9	configure terminal Example: Device# configure terminal	Enters global configuration mode.
Step 10	interface type number Example: Device(config)# interface fastethernet3/0.10	Enters interface configuration mode for the interface to be used for the BGP session. The interface can be a routed port or an SVI.
Step 11	mpls bgp forwarding Example: Device(config-if)# mpls bgp forwarding	Enables MPLS forwarding on the interface.

SUMMARY STEPS

1.    enable

2.    configure terminal

3.    router ospf process-id [vrf vpn-name]

4.    log-adjacency-changes

5.    redistribute bgp autonomous-system-number subnets

6.    network ip-address subnet-mask area area-id

7.   end

8.    show ip ospf

DETAILED STEPS

	Command or Action	Purpose
Step 1	enable Example: Device> enable	Enables privileged EXEC mode. Enter your password if prompted.
Step 2	configure terminal Example: Device# configure terminal	Enters global configuration mode.
Step 3	router ospf process-id [vrf vpn-name] Example: Device(config)# router ospf 100 vrf v1	Enables OSPF routing, specifies a VRF table, and enters router configuration mode.
Step 4	log-adjacency-changes Example: Device(config-router)# log-adjacency-changes	(Optional) Logs changes in the adjacency state. This is the default state.
Step 5	redistribute bgp autonomous-system-number subnets Example: Device(config-router)# redistribute bgp 800 subnets	Sets the device to redistribute information from the BGP network to the OSPF network.
Step 6	network ip-address subnet-mask area area-id Example: Device(config-router)# network 10.0.0.0 255.255.255.0 area 0	Indicates the network address and mask on which OSPF runs, and the area ID of that network address.
Step 7	end Example: Device(config-router)# end	Exits router configuration mode and returns to privileged EXEC mode.
Step 8	show ip ospf Example: Device# show ip ospf	Displays information about the OSPF routing processes.

SUMMARY STEPS

1.    enable

2.    configure terminal

3.    interface type number

4.    mpls ip

DETAILED STEPS

	Command or Action	Purpose
Step 1	enable Example: Device> enable	Enables privileged EXEC mode. Enter your password if prompted.
Step 2	configure terminal Example: Device# configure terminal	Enters global configuration mode.
Step 3	interface type number Example: Device(config)# interface fastethernet3/0.10	Enters subinterface configuration mode for the interface associated with the VRF. The interface can be a routed port or an SVI.
Step 4	mpls ip Example: Device(config-subif)# mpls ip	Enables MPLS forwarding of IPv4 packets along normally routed paths for this interface.