VPN Routing and Forwarding (VRF)-Lite Software Configuration Guide for Cisco 1000 Series Connected Grid Routers (Cisco IOS)
Available Languages
Table of Contents
VPN Routing and Forwarding (VRF)-Lite Software Configuration Guide for Cisco 1000 Series Connected Grid Routers (Cisco IOS)
With the VRF-lite feature, the Connected Grid 1000 Series Router (hereafter referred to as CGR 1000) supports multiple VPN routing and forwarding (VRF) instances to provide traffic isolation in an enterprise network. In this implementation, VRFs are used to segment a private physical infrastructure into virtual, isolated networks.
This document addresses both IPv4 and IPv6 VRF-lite.
Note The CGR 1000 does not use Multiprotocol Label Switching (MPLS) for VRF-lite.
Information About VRF-lite
VRF-lite provides traffic isolation by using input interfaces to distinguish routes for different VLANs and forms virtual packet-forwarding tables by associating one or more Layer 3 interfaces with each VRF. Interfaces in a VRF can be either physical, such as Ethernet ports, or logical, such as VLAN SVIs and loopback interfaces, but a Layer 3 interface cannot belong to more than one VRF at any time.
Note VRF-lite interfaces must be Layer 3 interfaces.
Figure 1 shows an example of a VRF-lite implementation for the CGR 1000.
In Figure 1, two CGR 1000 routers are connected to the head-end router in a FlexVPN hub-and-spoke configuration. VRF Green is mapped to VLAN1, and VRF Orange is mapped to VLAN2. Each router has a serial interface, associated with a local IP address, to transport raw socket traffic from Remote Terminal Units (RTUs). Ethernet ports in VLAN2 and the loopback interface used by raw socket on each CGR 1000 are configured in VRF Orange so that traffic from those interfaces can be isolated and routed to SCADA Server A according to the FlexVPN tunnel configuration.
For more information about FlexVPN, see FlexVPN Software Configuration Guide for Cisco 1000 Series Connected Grid Routers (Cisco IOS) .
VRF-Aware Services
VRF-Aware services are services that run on multiple routing instances and that can be configured on a per-VRF basis. A VRF-aware service uses a VRF table rather than the global routing table for routing traffic associated with the service. Any configured VRF in the system can be specified for a VRF-aware service.
VRF-aware services are implemented in platform-independent modules. Each platform has its own limit on the number of VRFs it supports.
VRF-aware Domain Name System (DNS) is an example of a VRF-aware service. In VRF-aware DNS, a VRF table can be configured so that DNS can forward queries to name servers using the VRF table rather than the named DNS server in the global IP address space.
Ping is another example of a VRF-aware service. You can ping a host in a user-specified VRF.
In addition to services such as DNS and ping, the following CGR 1000 features are VRF-aware:
Prerequisites
Planning for the network, including IP addressing, interface and VLAN details, traffic types, etc. must be completed.
Guidelines and Limitations
- VRF-lite interfaces must be Layer 3 interfaces.
- Multiple VLANs share a router with VRF-lite, and each VLAN is associated with a VRF.
- VRF-lite on the CGR 1000 does not support MPLS.
- The CGR 1000 supports configuring VRF by using physical ports, VLAN SVIs, loopback interface, or a combination. You can connect SVIs through an access port or a trunk port.
- A single VRF can be configured for both IPv4 and IPv6.
- You can associate an interface with only one VRF. You cannot configure a VRF for IPv4 and a different VRF for IPv6 on the same interface.
- IPv4 and/or IPv6 routing for a given VRF needs to be configured. You can use most routing protocols (BGP, OSPF, EIGRP, RIP and static routing).
Default Settings
If no commands have yet been entered to specify a VRF, the system's default configuration is as follows:
Configuring VRF-lite
In earlier Cisco IOS releases, you created a VRF to be applied only to an IPv4 address family (single-protocol VRF) by entering the ip vrf command. To activate the single-protocol VRF on an interface, you entered the ip vrf forwarding (interface configuration) command.
You can now define multiple address families under the same VRF or configure separate VRFs for each IPv4 or IPv6 address family by entering the vrf definition command. To activate the multiprotocol VRF on an interface, you enter the vrf forwarding command. A given VRF, identified by its name and a set of policies, can apply to both an IPv4 VPN and an IPv6 VPN at the same time. This VRF can be activated on a given interface, even though the routing and forwarding tables are different for the IPv4 and IPv6 protocols.
The procedure and examples in this document use the multiprotocol CLI.
Note You can still use the single-protocol CLI to define an IPv4 address within a VRF and an IPv6 address in the global routing table on the same interface.
BEFORE YOU BEGIN
Review the information in the “Information About VRF-lite” section and “Guidelines and Limitations” section.
DETAILED STEPS
Use the no vrf definition vrf-name global configuration command to delete a VRF and to remove all interfaces from it.
Use the no vrf forwarding interface configuration command to remove an interface from the VRF.
Verifying Configuration
When you configure VRF table “a” with the IPv6 address family and attach the VRF to the interface with IPv6 address 1::2/64, the show ipv6 route vrf a command displays the following output:
Configuration Example
This section shows an example VRF-lite configuration with FlexVPN tunnels. In this example, a CGR 1000 acts as the FlexVPN spoke where end devices such as meters and RTUs are attached. The CGR is connected to redundant ASR hubs and has the following VRFs defined:
- VRF METER is defined for forwarding IPv6 traffic from smart meters through a GRE IPv4 over FlexVPN tunnel.
- VRF RTU is defined for IEC 101 to 104 protocol translation and TCP raw socket traffic. This configuration uses the VRF-aware and VRF-lite features to forward the RTU traffic to redundant hubs over IPSec tunnels.
- VRF CC is defined for forwarding the protocol translation traffic to the SCADA control center.
Obtaining Documentation and Submitting a Service Request
For information on obtaining documentation, using the Cisco Bug Search Tool (BST), submitting a service request, and gathering additional information, see What’s New in Cisco Product Documentation at: http://www.cisco.com/en/US/docs/general/whatsnew/whatsnew.html .
Subscribe to What’s New in Cisco Product Documentation , which lists all new and revised Cisco technical documentation, as an RSS feed and deliver content directly to your desktop using a reader application. The RSS feeds are a free service.
This document is to be used in conjunction with the documents listed in the “Related Documents” section.
Cisco and the Cisco logo are trademarks or registered trademarks of Cisco and/or its affiliates in the U.S. and other countries. To view a list of Cisco trademarks, go to this URL: www.cisco.com/go/trademarks . Third-party trademarks mentioned are the property of their respective owners. The use of the word partner does not imply a partnership relationship between Cisco and any other company. (1110R)
Any Internet Protocol (IP) addresses and phone numbers used in this document are not intended to be actual addresses and phone numbers. Any examples, command display output, network topology diagrams, and other figures included in the document are shown for illustrative purposes only. Any use of actual IP addresses or phone numbers in illustrative content is unintentional and coincidental.
FeedbackContact Cisco
- Open a Support Case
- (Requires a Cisco Service Contract)