Well, the purpose of this lab challenge is to combine the concepts of VRF and
GRE and
make sure that we can configure each one individually, but also then make sure
we can
combine them together.
And so what we're going to do is we're going to start off just by getting our
tunnel established,
making sure we can ping from router 5 to router 6 over there at the parameters
there in our
topology.
And at that point, we will have built a GRE tunnel.
And then we're going to take a quick moment to check that recursive routing WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And then we're going to take a quick moment to check that recursive routing
situation
and what might cause that.
And then to prevent that in the future, we're going to create a different VRF
for this OSPF
domain, which is our underlay.
We're going to establish that as a VRF, establish that OSPF is now part of the
new VRF, and
then we want to form the tunnel across that new VRF as well.
So if you haven't yet done so, be sure to hit the pause button on this video
and go and
go through the lab yourself.
You just have to click the link in the skill to fire up this topology of the WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
You just have to click the link in the skill to fire up this topology of the
exact same
topology here where we've got the six different router tabs available, and you
can click through
and perform all of these steps yourself.
Once you're done and you've given it a good shot, if you need any to review any
of the
steps, then that's what we're about to do is kind of go through this here
together.
So let's go ahead and start with task one here, which is simply building the
GRE tunnel
between routers three and four.
So what we're going to do is we're going to start off on router three, get into WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So what we're going to do is we're going to start off on router three, get into
global
configuration mode and configure that tunnel interface.
And I'm going to create that tunnel source of 10, 0, 13, and 3.
And tunnel destination is router four, 10, 0, 24, dot four.
And then I'm going to go ahead and configure my p address while I'm here.
That would be 34 dot three slash 24. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
That would be 34 dot three slash 24.
And now I'm going to go over to router four and basically do the same thing
interface
tunnel zero tunnel source 10, 0, 24, 4 tunnel destination 10, 0, 13, 3.
And then IP address 10, 0, 34, this is dot four.
Okay, so that was quick.
Let's find out if this worked.
So I'm just going to ping across the tunnel to 34 dot three, and we've already
got our
ping. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
ping.
So it's one of the best ways to just test to see if the tunnel is up is just p
inging the
other side via the tunnel.
And so next we're on to task two, which is activating ERP across the tunnel.
So we're already already running ERP here.
If I do a section ERP on router four, we should see I've got an ERP
relationship with router
six, router three should have one with router five.
Let's just go confirm that.
I get it's done show IP, ERP neighbor, I suppose. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
I get it's done show IP, ERP neighbor, I suppose.
So there we go.
And then show IP, ERP neighbor on this side.
And there we go.
So we do see that and we see the configuration.
So we want to do is want to add the tunnel into this configuration.
Now we haven't yet gotten to ERP here within the encore course.
And so we're not going to spend a whole lot of time on the ERP configuration.
We mostly just want to do the basic step of adding in a new network statement WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
We mostly just want to do the basic step of adding in a new network statement
of 10 dot
zero dot 34 dot four with all zeros.
Now we'll activate it only on the tunnel interface since that matches the
address perfectly.
Router ERP 10 network 10 dot zero dot 34 dot three.
And we should see that as soon as I hit enter here that the tunnel or the ERP
neighbor forms
over the tunnel and it did.
So that is task two. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So that is task two.
And at this point we have ERP everywhere.
So I should be able to get onto router five and ping over to six dot six dot
six dot six,
which is router six's loopback address.
So we're going all the way from this five.
Well, actually we didn't specify the source.
We didn't specify the source here source of all five.
There we go.
So now we're truly going from five dot five dot five dot five the six dot six
dot six
dot six.
And so we have full connectivity.
But now we want to pause before we get on to the VRF configuration and see the WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
But now we want to pause before we get on to the VRF configuration and see the
routing
recursion issue that might occur, whether it's in production or other lab
environments.
And so we're going to get onto router three and we're going to advertise.
Let's get onto router ERP 10 here.
And what we're going to do is we're going to advertise this tunnel source via
the tunnel.
So I'm going to advertise this subnet.
Right now that subnet's only part of the OSPF domain. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Right now that subnet's only part of the OSPF domain.
It's not part of ERP.
And this router, which has the route this way, is going to know that, hey, this
is my only
route.
It happens to have administrative distance of 110, but it's the only way I know
how to
get to that address.
Well as soon as it comes in this side, it's going to see ERP having an
administrative
distance of 90 and saying, oh, I've got a better route to 10.0.13.0/24.
Therefore I'm going to form the tunnel out the tunnel, which is a recursive WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Therefore I'm going to form the tunnel out the tunnel, which is a recursive
problem.
So let's go ahead and see that in action.
I've gotten onto router three.
I just need to advertise that network in to the, I guess, across the tunnel.
So I could do one of two things.
I could do the physical address like we typically do here with all zeros for
the wildcard to
specify this exact address.
I'm going to look for an interface with that exact address and activate that
for ERP. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
for ERP.
Or I could do what happens to occur in a lot of even production environments
where we just
say network tend does here it is here it is zero, which activates the ERP and
all of my
interfaces.
So what if we were to do that?
Well, because I activated on all interfaces, gig one zero is going to be
advertised in.
Now, if I just sit here on router three, I might think everything is good until
ERP times
out.
Look at that timing couldn't have been better.
ERP timed out.
Why did we lose our ERP neighbor across tunnel zero? WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Why did we lose our ERP neighbor across tunnel zero?
Well, let's go look at router four.
Router four who just got this new advertised route decided, hey, that's a
better route.
I'm going to go that way and then we see tunnel is temporarily disabled due to
recursive routing
along with this tunnel recurved down.
I want to say that error message.
So this is exactly what we'd expect.
Now here, look, what's going to try again?
It just brought the tunnel up to try it.
And because again, the ERP route went away, it does not physically shut the WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And because again, the ERP route went away, it does not physically shut the
interface
down.
This decides, hey, we're going to temporarily disable the tunnel.
Then we lost ERP because of that, which we saw on router three.
And then eventually we said, all right, you know what, let's go ahead and try
again.
So we disable the disablement.
We enable tunnel zero, bring it up, which of course leads to our ERP
neighborhood forming,
which leads to this new route being advertised again, which leads to it being WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
which leads to this new route being advertised again, which leads to it being
disabled due
to recursive routing, which leads to the tunnel going down.
And then all of a sudden we decide eventually to bring the tunnel back up and
life continues
to loop forever.
We're never going to recover from this because we have done something we should
never have
done, which is on router three, we advertised the underlay source and
destination.
Everyone say it there, the tunnel endpoint was advertised across the tunnel. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Everyone say it there, the tunnel endpoint was advertised across the tunnel.
And so that's something we always want to prevent.
So let's go and get back into router ERP 10 and say, no network 10 dot 0 dot 0
dot 0,
remove that statement.
We'll just do a quick show run section ERP to make sure that it looks good.
We should only see the couple network statements, one for the tunnel and one
for the physical
address, which we do right here, physical address facing router five, by the
way. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
way.
And so now ERP is back.
So we can get rid of all of those markings on the diagram because we got rid of
that
advertisement.
So a couple of things about this.
First of all, we can prevent it like we just did simply by not advertising that
interface.
Things do get a little trickier if we're running ERP everywhere, which is
usually not what we
want to do.
Here we happen to have OSPF running in the underlay subnets.
But if we were running ERP down here, this would be a little bit more tricky.
Now granted, we do have the scenario where, again, the metric is low on the WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Now granted, we do have the scenario where, again, the metric is low on the
tunnel.
And so that should prevent it as well.
There's a lot of things in place to prevent this, but we do need to be aware
that it could
occur.
And the best way to prevent it is simply to place this underlay into its own
routing domain,
which is of course a VRF.
So let's go ahead and move on to task three.
And we're going to create a VRF on router three.
So that is the VRF definition command.
I'm going to use the word underlay and all caps in order to name this one WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
I'm going to use the word underlay and all caps in order to name this one
address family
IPv4 activate that.
And now I need to place this physical interface gig one zero into the underlay
VRF.
So interface gig one zero if I do a show run on gig one zero, I should see that
it's 13.3.
I'm going to say VRF forwarding underlay, which removes the IP addresses.
And now I can simply grab this configuration and paste it back in. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And now I can simply grab this configuration and paste it back in.
Next, I need the tunnel is still down.
So let's first of all, at this point, we should still be able to ping the
tunnel destination.
So if I use my ping, keeping in mind, I have to specify the underlay VRF now, I
should
be able to ping out the underlay to 10.0.24.4.
Is that the right?
Yeah, well, we did not get it. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Yeah, well, we did not get it.
All right, so let's make sure that everything looks good here.
So that was ping VR VRF gig one zero underlay 13.3.
That is the correct.
Oh, okay.
I jumped the gun.
I meant to ping router one here.
We should be able to ping across to router one.
So let's do that.
13.1 should be router one and we can ping.
So why can we ping router one but not router four? WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So why can we ping router one but not router four?
Because we haven't updated OSPF to exist inside of this VRF.
OSPF on router three still exists inside the default VRF.
And so let's go ahead and add OSPF into make it VRF aware.
I'm going to say no router OSPF one and then say router OSPF one, put it into
the VRF and
add my network statement, which should just be that interface 10.0.13.3.
Oops, area zero. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Oops, area zero.
I'm doing too much ERP lately.
They'll just use area zero for OSPF one there and boom, we've got OSPF.
Now I should be able to use that same command to ping router four and there we
go.
So router three is primed and ready to build a tunnel across the VRF.
So how do we go about doing that?
Well, I simply have to get onto the tunnel interface and I use the command
tunnel VRF
underlay.
And now the tunnel knows to build itself across the underlay, even though the WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And now the tunnel knows to build itself across the underlay, even though the
tunnel itself
is still part of the overlay.
So the tunnel is up, ERP is running and this brings up an interesting point
because it
if I go to router five right now, I can ping across the tunnel and yet I've
only created
this VRF on router three.
Keep in mind VRFs in a VRF light scenario, meaning no MPLS tagging is occurring
.
VRFs are a local concept only, meaning that router one doesn't need to know it WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
VRFs are a local concept only, meaning that router one doesn't need to know it
's in a
VRF.
Router one can operate in the default VRF, no problem.
Router two can operate in the default VRF, no problem.
Router four is by the end of this going to be participating in the underlay VRF
.
I could call it underlay, I could call it CBT.
I don't have to call it the same thing because it's local to router four.
The VRF on router three is local to router three. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
The VRF on router three is local to router three.
So even though I've only configured the VRF for router three because everything
is in
place on router three, it's all going to work and it is working.
Everything's great.
We're not doing ping router six, but we're not done until we've finished our
configuration
on router four, so let's go do that.
We're basically just going to do the exact same thing as we just did on router
three.
I'm going to do a config T, make our VRF definition and I will just keep the
same name for clarity
sake, activate it on the address family for IPv4 and then we'll get on to that WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
sake, activate it on the address family for IPv4 and then we'll get on to that
physical
interface interface gig two zero.
We'll look at that interface to get the IP address.
I always like to do that and then say VRF forwarding underlay wipes the IP
addresses
and now I can just grab it right back.
That's a beautiful thing.
All right, so next I'm going to let's go ahead and wipe OSPF.
So I'm going to say no router OSPF one and then say router OSPF one with a VRF WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So I'm going to say no router OSPF one and then say router OSPF one with a VRF
of underlay
work.
The physical network is when we just did 10 dot zero dot 24 dot four all zeros.
Here is zero OSPF is established.
Pinging should be working.
Ping VRF underlay 10 dot zero dot 13 dot three.
That would be router three and I just came across the underlay routing is WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
That would be router three and I just came across the underlay routing is
working.
Everything's good except our tunnel is still on a downstate and the reason is
because I
haven't told the tunnel to build across the underlay.
Still trying to build across the default VRF and that some of those subnets no
longer
exist in the default VRF.
So all I need to do is use that tunnel VRF underlay command and we should see
the tunnel
come back up and not only did it come back up but ERP was established over it
immediately.
So that's a force of habit to save the configuration but the big test is hey WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So that's a force of habit to save the configuration but the big test is hey
can we ping from
router five to router six.
I'm going to go to router five ping router six from the router five loop back
and indeed
we've got that.
So play around with these configurations.
I think this is a great lab from start to finish to really practice all of
these concepts.
Wipe it out and once you're done with it and do it again from scratch and try
to memorize
all these commands and make sure you can do everything from start to finish and WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
all these commands and make sure you can do everything from start to finish and
build
not only GRE tunnels but also different VRFs while building the GRE tunnels
across those
VRFs.
I hope this has been informative for you and I'd like to thank you for viewing.