In a hybrid cloud solution where there is an APIC layer (On-Premise) and a Public Cloud Site, the CSR 1000v instance connects the Data Centers through Layer-3 boundaries. The CSR 1000v instance has a VRF instance configured with two sets of import and export route-targets. One set of the import/export route target is associated with the BGP EVPN session with VXLAN encapsulation and L3 routing information in the On-Premise router. The other set of import/export route-target is associated with the L3VPN BGP neighbour in the service provider network. The CSR 1000v instance enables the L3 traffic movement across the EVPN by stitching the route between the On-Premise site and the service provider network.

The CSR 1000v instance forwards traffic across the EVPN even if the VRFs have the same VTEP IP (VxLAN tunnel endpoint) and RMAC (router MAC address). With this feature, the CSR1000v instance uses a binding label to setup the routing and forwaring chain.

Using the VRF Route Sharing functionality, you can deploy shared services across hybrid clouds. The shared services that run on the public cloud can be consumed by the endpoints on the On-Premise Site. The CSR 1000v instance shares the L3 prefix to multiple VRFs on the On-Premise Site, and vice versa. The APIC layer imports the addresses and the services are thus consumed in the APIC side.

• The VRF Sharing functionality supports up to 32 common VRFs, and 1000 customer VRF combination.

• This functionality does not support RT filters.

• VRF Route Sharing is supported only for IPv4 addresses and not IPv6 addresses.

Before you configure the VRF Route Sharing functionality to enable the traffic between the ACI and the public cloud, ensure that:

• You configure VRF1 and VRF2 on the vPC pair of ACI.

• VRF3 are VRF4 on the CSR 1000v instance which peers with VGW have two RTs for each VRF.

• The CSR 1000v instance imports EVPN routes of VRF1&2 from ACI into VRF3&4.

• The IP BGP on the CSR 1000v side redistributes the routes to the gateway in the public cloud.

• The next-hop of routes from ACI are the spine of the border leaf of the ACI.

• There are no overlaps of prefix across the Route Sharing VRF.

• Advertise the L3 VPN routing and to forward the VRF prefixes to the EVPN neighbours. Run the advertise l2vpn evpn command and and export stitching RTs to push the native routes towards the EVPN.

The following is a sample topology that is used as an example to explain the VRF Route Sharing in a hybrid cloud:

In the above-mentioned topology, the CSR 1000v instance is deployed on the VM of the public cloud. Site A is an ACI deployment site, while Site B is the public cloud. Leaf 1 and Leaf 2 are the Virtual Port Channel (vPC) pair for ACI. These two vPCs are configured with different Route Distinguishers (RD). Here, VRF 1 and VRF 2 are configured on the vPC pair for ACI. For example,

VRF1 - RT:RT-EVPN-1, prefix:1.1.1.1

VRF2 - RT:RT-EVPN-2, prefix:2.2.2.2

VRF3 and VRF4 are configured on the CSR 1000v instance. These two VRFs pair with the Voice Gateway (VGW), and these two VRFs have two different Route Targets (RT). For example,

VRF3 – RT for EVPN: RT-EVPN-3, RT for IP BGP: RT-3, prefix:3.3.3.3

VRF4 – RT for EVPN: RT-EVPN-4, RT for IP BGP: RT-4, prefix:4.4.4.4

In the topology, the BGP-EVPN fabric is present between the ACI and the CSR 1000v instance in the public cloud and the IP BGP protocol is used between the CSR 1000v instance and the Cloud Service Provider such as Azure. The BGP-EVPN fabric redistributes the stitching routes between the EVPN and the IP BGP.

To enable the traffic flow between the ACI Site and the Public Cloud, both ACI and the CSR 1000v instance need to support VRF Route Sharing.

The CSR 1000v instance must be able to import the EVPN routes of VRF1 and VRF2 from ACI into VRF3 and VRF4. The IP BGP on the CSR side then redistributes the routes to the VGW in the public cloud.

Note	When the VTEP (VxLAN Tunnel Endpoint) IP and the RMAC (Route MAC addrress) are the same for two leafs, and the VNIC alone differs, the CSR1000v instance can forward the traffic across the tunnel.