So now we need to learn about Virtual Routing and Forwarding or VRFs for short.
So what are VRFs? Why do they even exist? Well what we need to understand is that VRFs are a way
that we can take one of our physical routers and turn it into multiple virtual routers.
That's right. Let me repeat that. VRF is a way that we can take a physical router and turn it
into multiple virtual routers. So when you look at this router here, we have a single physical
router. And notice how we've taken this one single physical router and turn it into three different
routers. In actuality, it would be four because you would still have the original router plus the
VRFs. So whenever you create VRFs, you are creating specific VRFs, but your original router still
exists. And it is its own VRF called the default VRF. So whether you're using VRFs or not, you're
technically using the default VRF. But after that, you start breaking it up into multiple virtual
routers and you get more and more and more virtual routers. The thing about this is that you need to
recognize that for each VRF, you are going to be associating interfaces specifically with that VRF.
And those interfaces are going to be part of that VRF and no other VRF. And you're also going to
have a different routing table for each and every single VRF. You're also going to have different
forwarding tables, ARP caches, and you name it. Everything about that VRF is isolated from every
other VRF. And therefore, traffic from one VRF cannot interfere with another VRF.
Now, can we do what is called VRF leaking? Sure, of course we can. And that's really good when
you have something like a shared service of some type. Let's say in our data center, we have a
shared DHCP server, and we want to share that DHCP server with all of our VRFs. We could leak
that particular network that the DHCP server is in, or specifically the DHCP server itself,
and its associated IP address, maybe just put it in its own subnet as an example,
and into that VRF. So that way, we can leak that service into all of the VRFs. Same thing with
a lot of other services. You might have a DNS server. Instead of having a different DNS server
for every single VRF, we could have one DNS server that we leak into that. So that way,
we have the ability to use that DNS server, even though it's not part of the VRF.
So why might you want to use VRFs? So first of all, in the exam, when they talk about VRFs,
it's because you're trying to isolate different aspects of your network. So for example,
we have set up right now, we have our different VLANs. We have VLAN 10, VLAN 20, VLAN 30,
all of those different VLANs in our environment. But once we get to our Layer 3 routed environment,
once we... Excuse me. One second.
So we have our different VLANs, but then once we get into our Layer 3 routed environment,
all of that traffic just intermingles together across the same links, within the same subnets,
within the same Layer 2, Layer 3 networks, within the same routing tables, within the same routing
protocols. So although we're isolating down at our VLANs, we're not really isolating anywhere else,
are we, in our environment. And so if you require the need to isolate that traffic as it's flowing
through the Layer 3 network, then that's where VRFs are going to come into play in order for you
to do that. So look at this environment here. If I wanted to isolate the 10 network up here from
this network here, from this network here, I would essentially have to create three different
physical networks. So that way there, I could have a separate physical Layer 3 network from
this network, from this network. But with VRFs, we could combine it all together because now this
router is actually three different routers. This router right here, I have a VRF for this, I have
a VRF for this, and I have a VRF for this. We'll call it the red, green, and blue VRFs. And these
routing tables are going to have different, these routers are going to have different routing tables
for each and every single one of those VRFs. Notice how I'm still using a physical cable here,
just one cable. But what are we using? Subinterfaces. So each subinterface is going to
be part of a different VRF. Each subinterface is going to be part of a different routing process.
So that way there, I can isolate and separate everything out when it's all said and done.
So I just want to go ahead and demonstrate this for you. We're going to build a virtual network,
a VRF in our particular case, in our topology that we have right here.
So our goal here, let's say, is we're going to take this network here. No, actually, I have a
different network set up right now for this, because I didn't want to mess everything up
for our discussions on GRE after the fact. So let's go to DSW-1,
and I'm going to type in show IP interface brief. And you'll see here that we have
this VLAN up and running right now. So that particular network is going to be,
let's just check its subnet mask with show IP interface VLAN 421.
So we are dealing with the network over here. I'll just write it out here, 10.40.12.0
slash 26. That's what we have over here right now. 10.40.12.0 slash 26. Let's go over to branch.
And over on branch, we have directly connected to us, let's go with this one right here,
10.0.255.0 slash 24. So I write that out over here, 10.0.255.0 slash 24. So what we're going
to do is we are now going to put both of these networks in their own VRF, a completely different
routing process on these routers. And their traffic is not going to be allowed to intermingle
with any other traffic on this network. They're going to have their own routing tables. They're
going to have their own everything. In addition to that, I'm now going to have to modify the rest
of my network here. I'm going to have to modify the rest of my network. So that way there,
I carve up this environment. So that way there, there is a virtual network for the VRF.
So let's call the VRF here. Somebody tell me what we're going to call this VRF. What's the name
going to be for this? Give me a name. I can name it anything I want. First person who chats in a
name, we're going to call the VRF that. It doesn't matter. You might name your VRFs based on
departments. You might base them based on customers. You might base them on anything you want.
But maybe we'll do VRF. Anybody? Anybody? No names? Nobody? Everybody is asleep right now?
WMH. What does that stand for? What does that mean?
I don't want to write it out and then all of a sudden it's inappropriate.
Where the magic happens. Awesome.
Where magic happens. I like it. So that's what we're going to do.
So first things first, let's show you how to create your VRFs. So we're going to type in
configure terminal. We're going to type in VRF definition. And when I type in VRF definition,
and when I type in VRF definition, this is where I give it our name.
We said we're going to call it where the magic happens. All right. Now, if I put in question
mark, what you're going to see is that we have things for address families. That's what I want
to talk about right now. So address families are so that way there we can set it up for IPv4.
And we can set it up for IPv6. Right now we only have an IPv4 network. So I'm going to type in
as IPv4 here and then type in unicast. And that's it. So for IPv4 unicast. Now, since I did not type
it in for IPv6, it's not going to go into effect for IPv6. So right now if we type in do show run
pipe to section VRF, you'll see that we now have a VRF configured. And the VRF is VRF definition
WMH where the magic happens. And our address family is IPv4, meaning that it's been turned
on and enabled for IPv4 networks and traffic and interfaces. So if I want it enabled for IPv6,
all I have to do is type in address family IPv6. All right. So with that in mind,
now what do we need to do? Well, if we type in do show VRF,
you'll see that I have the VRF created, but there are no interfaces that are part of that VRF.
Also, if we type in do show IP route VRF,
we have our very own routing table for this VRF.
Interesting, isn't it? So let's go ahead now and take interface VLAN 421 and move it to this VRF.
We are now going to type in, since we're in interface VLAN 421 configuration mode,
VRF forwarding. And in the name of the VRF, and I'm going to hit enter. Notice it says it has
just removed the IP addressing off my interface. That's why I showed you this. We had an IP address
now it's gone. Why? Because I have just moved that interface from the subnet it lived in,
where it was, to now a completely different VRF. A totally different routing process on this router.
So now I have to reconfigure it. So I want you to remember that for the exam.
You have to type in VRF forwarding, and then you will have to put the IP address on the interface
that you want. In this case, we're just going to use the same one. I'm perfectly fine with that.
But always remember the order here. If you do the IP address first,
and then you go ahead, and you type this in, it will remove the IP address off the interface.
And if they're not logging anything on the exam, and you forget that, and you're doing a config,
does that mean that you actually won't have an IP address on your interface? Yeah,
that's what that means. Which means it's not going to work for you. And you'll be troubleshooting,
why did that work? Why did that work? It's all because the IP address was removed.
It happens automatically. You can't do anything about that. You got to add it in after the fact.
So go to the interface, VRF forwarding, the name of the VRF,
then put in the IP address and something else you need. Remember those three steps.
All right. So now that this is done, let's type in do show VRF.
And you'll see that VLAN 421 is part of this VRF.
Now, let's look at the routing table again. Do show IP route VRF WMH.
And we have our interface in this routing table with its network ID. Let's go back to our
global routing table or the default VRF. And we're going to go back to our global routing table.
Global routing table or the default VRF routing table. And you'll see that that network is no
longer in here. So it was in here before 10.40.12. It would have shown up here. Let's go back up.
You'll see that in the routing table from before.
10.40.12.0. There it is. It's no longer in here because it doesn't belong to the default VRF
anymore. It belongs to what? The new VRF. And notice it never says default VRF or anything
like that, but that's a term they use. So default VRF on the exam means your normal
routing table, your default routing table. Default VRF, default routing table, global routing table,
all terms used interchangeably on the exam for the same thing. And then your other VRFs have
their own routing tables. So I can have lots of VRFs on my router. So technically speaking,
if I wanted to take every single one of my subnets and my end user networks and essentially
create VRFs for them and then create VRFs for where the resources are and do all of that for
isolation, you could totally do that. So Andrew, the command I showed was this.
So if you type in show IP route, it shows you the default routing table, the default VRF. You have
to type in this command. So show IP route. Oh, you mean, oh, if you want to look at it specifically
like this one here, that's what you mean? Okay, let me show you that then. So do show,
if you type in IP route, it will be say 10.40.12.0 slash 26.
See, subnet not in table. You see that? Subnet not in table.
So what you'd have to do is you'd have to type in VRF.
Wrong spot. It's got to go before it.
There you go. Now you can see it that way. Is that what you were looking for?
Now let's think about OSPF for a second. Right now we have an OSPF process running.
Yeah. So again, Nexus does it differently. And the thing is we're preparing for iOS
on this certification exam. Yeah. So we have this OSPF process running. Now remember,
every single interface that is participating right now in this OSPF process is part of my
global routing environment, my default routing table, my default VRF. So I wouldn't be able to
put an interface that is in a different VRF in this routing process. You can't do that.
So let's create another routing process. Let's create, for example, router OSPF.
We'll call it OSPF process number two. And we're going to type in VRF.
And we're going to create this one for our WMH.
Right. So now we have a totally different routing process. Let's type in router ID.
I'll give it 0.0.0.1, 2, 3, 4, 3 in this case. Okay. So notice how the router ID is
used by that process. So I can't use the same router ID. So let's go ahead and put 13 in there
or 12. Let's change it to 13. Right. But there you go. There's an example of setting up now
a different routing process for a different VRF.
So there's process number two. So let's go ahead and let's go back into that process.
And let's type in, for example, something like passive interface VLAN 421, just for fun,
just to show you that, you know, we can still do passive interface. We can still
do a whole bunch of different options. Well, let's go to interface VLAN 421 now,
and let's type in IP OSPF 2. And let's put it, let's just do area 0 for this example.
So I can build an entirely different OSPF process with entirely different interfaces
participating in different areas for this entire VRF. It doesn't have to match the same
area boundaries as we did with our other routing process. That's right.
So documentation is really important when you're doing VRFs and ensuring that you have a document
for this VRF and this VRF and this VRF and that you're using the right commands to verify
everything. So now if I type in do show IP OSPF interface brief, for example, what are we seeing
here? Oh, right. It shows me all of them. You see that? But pay attention, process ID number two.
Process ID number two, that's for something totally different.
If I type in do show IP OSPF database, there's a database for process ID one,
there's a database for process ID two. So we have a different database for that.
Now, if you're using OSPF address families, then you would have a different address family for each
and every single one of your VRF. So you'd have one process, but different address families for
each and every single one of them. Now, if we go over here between DSW1 and R2,
because this is an iOS router, I cannot create subinterfaces here. Subinterfaces are not allowed.
So in reality, what I'm doing would not be the best solution in the real world, because
I would have to dedicate this entire link to my VRF, which is not something I would want to do
in the real world. Now, there are other multilayer switches out there that allow you to do sub
interfaces on routed ports nowadays. Okay, well, this one doesn't support it because it's too old.
So I'm just going to go ahead and show you how you can take an entire physical interface
and throw it into a VRF. But more than likely, in a real production environment here,
you would be doing a subinterface between those two entities. So that way there, you could use
that link for different VRFs, and not just associated with one very specific VRF, right?
So this is just for demonstration purposes. You can see how this works. But what we're going to
do is we're going to go to interface, gigabit ethernet 1.0.0.14. And again, what are we going
to type in here? We're going to type in, I'm going to grab the IP address first, do show I run
interface gigabit ethernet 1.0.0.14. And what we're going to type in, oh, and notice we're
in IP OSPF area one. So let's see what happens here. If I say VRF forwarding, and
WMH. So you'll see here that the interface addresses were removed,
OSPF went down. So if you look at the output now, you'll see that everything's gone. Everything's
gone. So what we're going to do, remember we have HSRP tracking on and everything. That's
why we're seeing all these HSRP messages. So now though, let's go ahead and put it in the VRF.
Or we already put it in the VRF, I should say. And now we are going to put the IP address on it.
I still want this IP address. And now we're going to type in IP OSPF two area zero.
So if we type in do show IP OSPF interface brief now,
you'll see that I've got the two interfaces as a part of OSPF process number two.
Go over to somebody like R2 right now. If we look at our interface, gigabit ethernet 0.0.
Right, I want to make sure it's in the right VRF. So first of all, let's create our VRF,
VRF definition.
And then we're going to have to type in address family IPv4, unicast.
And then we're going to go ahead and we're going to go to our interface. So interface
gigabit ethernet 0.0.
And actually, let's create a routing process. First, let's do router OSPF two for VRF, WMH.
And then we're going to type in router ID don't need one by a typical router ID.
We'll type in what we want to do here, 0.0.0.99 for fun. And then let's go ahead and
go back to interface gigabit ethernet 0.0.
VRF definition or no VRF forwarding.
Now let's type in IP address and our IP address is 10.40.23.
Now let's type in IP address and our IP address is 10.40.23.5, 0.0, 2 by 5, 2 by 5, 2 by 5,
2 by 2, and IP OSPF two area zero. And we should form a neighbor adjacency
with DSW1 across that interface. And there we go, we have.
So again, now if we take a look at do show IP route here, you'll notice that there is no reference
to 10.40.12.0 in this routing table. And if there is, that means I've done something wrong.
And there's not. But if we look at this routing table instead, VRF,
you'll now see that we have learned that. And it's specifically in this routing table
and no other routing table. Now let's go over to the other interface. So interface
fastethernet 0.1.0. And let's type in VRF forwarding. And let's put our IP address on
that interface. Now IP address is going to be 10.45.33.1, 2 by 5, 2 by 5, 2 by 5, 2 by 2,
and then IP OSPF two area zero. I'm just going to put it all in area zero in this case,
in this example. And so if we look at our routing table, we'll see that that interface is now part
of this VRF. So it's no longer this interface. Oh, let's pause there. Okay, so right now notice
how I took the whole physical interface, and I moved it to this VRF. Okay, so that's a problem
for us. Why is that a problem for us? Because now this link here can't be used for any of the other
subnets, any of the other VLANs, any of the other broadcast domains we have.
So I'm going to show you instead how to use subinterfaces between there.
So let's go ahead and remove this now instead. We'll take it out of there.
Let's look at our interface config.
All right, so no IP address, IP network, point to point, all that's normal. So now
let's go ahead and create a subinterface instead. So if we go interface
fast even at 0 slash 1 slash 0 dot, let's just do 100 here.
Now what we can do is we can put the subinterface in the VRF,
and then let's put, let's do IP address 10 dot 45 dot 33. No, let's do 243. In this case 1045,
43, 1, 255, 255, 255 dot 252. So we'll do 43 for the other one here, 43.
All right, but I got my error. Why? Just like we talked about in your VLAN routing,
you have to put your encapsulation first. So because it's a subinterface, I need an encapsulation
dot 1Q. Then I got to use a VLAN. Let's use VLAN 100 for this. So I'm using, you got to use VLANs
whenever you're doing VRFs on subinterfaces. And now we can go ahead and do a VLAN 100.
So let's go ahead and take a look at our config. That's the physical interface,
but if we type in dot 100, you'll see there's our subinterface.
So we look at our routing table now, we should, for that VRF, you should see that it's different.
All right, because we got the subinterface in there now for that particular network.
Can the physical interface still be part of our old routing environment? Absolutely,
absolutely. Which it's been removed. Why? Because of the fact that what happened to us.
What did we do? I took it all off. So let's add it back in now. Interface FastEthernet 0 slash
1 slash 0. IP address 10 dot 45 dot 33 dot 1, 2 by 5, 2 by 5, 2 by 5,
2 by 2. And then let's say that you are IP OSPF 1 area 0. All right.
All right. So we've got this side set up. Let's go over to branch and set up branches
subinterface now. Oops, that's right. We're not area 0 on that. I got to go back.
That's why it's not working. I just realized I'm like the neighborhood hasn't come up yet.
Why is that wrong area? Because in our other environment or we have this as area one
from our OSPF days. So there, that's fixed up now. All right. So going over to branch,
configure terminal and we'll type in VRF definition.
And then we're going to say address family IPV for Unicast.
Exit out of there now that we've created the VRF and we're going to go to interface gigabit
Ethernet 0 slash 0 dot and we'll create a subinterface on that gig interface.
Say encapsulation dot 1 Q 100 to match the other side. And then we will type an IP address and we
said it's 10 dot 45 dot 43 dot 2, 2 by 5, 2 by 5, 2 by 5 dot 2 by 2. Let me just make sure
that address is 100 percent correct. 10, 45, 43, 1, 10, 45, 43, 2. That looks good.
Oh, I didn't put it in the VRF, did I? I did not put it in the VRF. So
if I hit enter there and now we say VRF forwarding.
Right now you'll see the address is gone again. So I got to put it all back in.
So be mindful of that on the exam, that if you actually do it in the wrong order,
then you're going to have to re-input all the commands again. Keep that in mind.
All right. So if we take a look at do show IP route, we shouldn't see 10 dot 40 in here.
Like we talked about before, 10, 40, 12, 0 shouldn't be in here. Which VRF is it in?
It's in our other VRF. And there you go. Oh, no, it's not in here yet. Why? We didn't put
IP OSPF. We've got to create a routing process. IP router OSPF to VRF. Got to set that up first.
And then go back to our interface, gigabit ethernet 0 slash 0 dot 100. IP OSPF to area 0
as an example. And we should form a neighborship over with that router R2 on that particular link.
All right. And then lastly, let's not forget about our sub interface right here. So do
show run interface fast ethernet 0 slash 0 slash 0 dot I think it's 25.
There it is. So what we're going to do is we're going to put this entire interface in our WMH
VRF. So we'll type in this. Then we'll type in VRF forwarding. So, folks, for the exam,
it's quite possible you might have to do this on multiple devices. Just keep that in mind.
Maybe not as many as I've done here, but it's quite possible you might have to do
something like this. So know the steps. Know the commands. You have to know them.
All right. Now we're going to put back in what? We're going to put back in our IP. Oh,
we're going to put in this. Then we're going to put in this.
And then we're going to put an IP OSPF to area 0.
So do show IP OSPF interface brief. All right. So we got those two interfaces spinning around
in process.
So IP route VRF. All right. My neighborhood's not forming between R2 and branch. I've done
something wrong in my config. Yeah, let me double check that.
So these two are in area 0, but I'm in area 0 over on R2. That's what we set up here. Everybody
was supposed to be in area 0 for this one. Do show IP OSPF interface brief. Did I do it wrong
over here? Let's check our IP address.
All right. So I'm in area 0, but I'm in area 0 over on R2.
So I'm in area 0, but I'm in area 0 over on R2.
Let's check out this, because this is the sub interface. I don't, I think I forgot to
enable the routing process there. Yeah, it's not enabled. That's why. IP OSPF to area 0.
Now that should work between them.
Yeah, there you go. All right. So now I've got it. Just forgot to enable OSPF on that
sub interface. Too much config. All right. So take a peek at this now. You'll see that
I've learned about that network all the way over on there, over on this router. And it's
in its own routing table. We have our own routing construct. We have our own OSPF process
for this network. So it's isolated. It's segmented. Segmented, segmented, segmented.
Segmented. All of that stuff that we need in order to accomplish our objective.
All right. So that is VRFs, folks. And we call this VRF Lite. It allows you to build
virtual networks on top of your Layer 3 infrastructure. So VLANs are your virtual
construct for Layer 2. So VLANs and trunks, I should say, are your virtual construct for Layer
2. And then for Layer 3, you've got your VRFs. Now VRFs are very, very popular with what? With
service providers. Why are they very popular with service providers? Because of a service called
MPLS Layer 3 VPNs, which are not a topic of this specific certification exam. But there's something
that is commonly used with MPLS Layer 3 VPNs. We call them Route Targets and Route Distinguishers.
And you are expected to know that here in our discussion of VRFs only because you can use Route
Targets and Route Distinguishers even if you're just working with VRF Lite. Even though I didn't
need them in this particular case. All right. Even though I didn't need them in this particular case,
it is just something that you have the opportunity to use. So what I'm going to do is I'm going to
use some slides that I have for my MPLS Layer 3 VPN discussion. So this environment here from
this router all the way to this router, this is the service provider's environment.
This is their MPLS domain. If you don't know what MPLS is, that's okay.
This, let's say, is you. And this is, let's say, your headquarters.
And this over here is also you, but this is your branch office.
So if you look down here,
what do we have? Let's say this is me. And this is my branch office. And this is me.
And this is my headquarters. Notice how we're both connected up here.
Notice how we're both connected up here. Notice how we're both going to use this MPLS environment.
So first of all, the service provider is going to use what? VRFs to isolate routes learned
from the CE routers. What are the CE routers? Those are your routers. CE router. CE router.
Those are your routers. CE router. CE router. Those are my routers. Okay. So the CE routers
are in the possession of the customer of the service provider, me and you.
So now the service provider on this router, what do they need to do?
They need to isolate your routes from my routes. Because the goal here is for you to be able to
take your routes here and train branch about those routes and train headquarters about branches
routes. So that way there you can successfully route traffic from your headquarters to your
traffic from your headquarters to your branch and back through the MPLS environment.
And same thing with me. So notice how on this router, there's a VRF table for you and there's
a VRF table for me. There's a VRF table over here as well on this side for you and me.
So typically what would happen here is let's say you're running OSPF and I'm running EIGRP.
You're running OSPF. I'm running EIGRP. What's running in here? Multi-protocol BGP.
As a result of that, you are going to be running BGP here typically as well.
And same thing with me. And so you're going to redistribute from your routing protocol
into BGP. So you redistribute, I redistribute. So now you have BGP, eBGP. Neighborships
with the service provider. And so when they receive your routes as BGP routes,
they're going to put your BGP routes in here and they're going to put my BGP routes in here.
And this is going to happen on both sides.
And so now that they've been able to successfully put all of that information into the VRFs and BGP,
they'll have the ability to work the BGP magic with Layer 3 MPLS VPNs and basically take the
information here, share it here, etc. And then they're going to be able to put it into the
Ns and basically take the information here, share it here, etc. Take the information here,
share it here. And the end result is what? The end result is that each side, each VRF table
learns about the other information. And then that information can be sent via BGP to here.
And then I redistribute it back or you redistribute it back into OSPF. And then the information from
here via BGP can come down here, which then I redistribute back into EIGRP.
So that's the whole premise here of MPLS. Okay, I don't worry about any of this. This is not me.
This is what the service provider does. I don't worry about any of this stuff in this type of
case. I worry about taking my routes, redistributing the BGP and forming that EBGP session with the
service provider. But here's the problem we can run into in this case. Overlapping address spaces.
Problem. Overlapping address spaces. And this can happen to you with your VRFs as well. So that's
why we're talking about this right now. Because even if you're not doing this and you're using
VRF like we did in our environment, what happens if two of your networks that are in different VRFs
have the exact same addressing space? It can happen. Because remember, these are different
isolated processes. They're totally separate from each other. You could have the same network
twice now. So how do you make sure that that overlapping address space, you see them,
there they are, you are using 10.0.1.0.24, I am using 10.0.1.0.24. How do we make sure that doesn't
cause confusion when it's brought into BGP? Because in this VRF table, it's okay. In this VRF
table, it's okay. But when we start sharing it using BGP, that becomes a problem. How does
the service provider make sure that the overlapping address spaces do not cause a problem?
They use what are called route distinguishers. That's what I want you to remember here. Route
distinguishers help solve the problem of overlapping address spaces. That's what you
need to know. And what are they? They are simply a 64-bit identifier that is added to that IPv4
or IPv6 network address to make it unique. It's also known as the VPN identifier when it's all
said and done. So take this and add the 64-bit to it. Take this, add the 64-bit to it. Now they
are unique as they are being shared from here to here. So you're not doing this in this scenario.
The service provider is doing this. So they would have it set up as part of their VRFs in order to
make this happen. So here's what your address would now look like. It would be the route distinguisher
plus the IPv4 address giving you what is called the VPNv4 address. And the same thing would be
true for VPNv6. Let me just give you a little example here. Route distinguisher 1 colon 111
has been assigned to customer 1 VRF. Route distinguisher 2 colon 222 is assigned to customer 2
VRF. So when you're doing these route distinguishers as an example, I'll just come
over here. It's done under the VRF configuration mode. So VRF definition,
address. No, actually, I believe it's done right here in this new configuration
construct. So the address family configuration, route distinguisher, there it is. So route
distinguisher. And then you can put in the route distinguisher for that particular VRF.
So notice you can put like, if you have an autonomous system number associated with that
customer, then you can put their autonomous system number in there. And then just some
random number that you want to put with it. Or it says you can use an IP address in front if you
want to. You can pretty much do anything you want, folks. Right. So in my case, for example, 1 colon
111, if I really just want to do that, they're done. So now if we take a look at do show VRF,
you'll see that I have a route distinguisher now for that VRF.
So I would create a different route distinguisher for each and every single one of those VRFs
and make sure it's consistent on all the devices that I need to have this on.
So in this case, I have it here in an MPLS environment. I'd have it here in an MPLS
environment. So now what does that mean? It means when we share the route, so when we share 10.0.1.0
size 24 this way, it's going to have that VRF attached to it. When I share this 10.0.1.0 size 24,
it's going to have that route distinguisher attached to it. I think I said VRF in there.
It's going to have the route distinguisher attached to it. It's going to have the route
distinguisher attached to it. Right. So let's look at an example this way. So when the 192.168.1.0
is being advertised, look, it's 1 colon 111 colon the IP address. So that way, when it arrives at
this side, right, the route distinguisher matches. I know it's unique. I know it's for that particular
customer. Same thing with this as well. This one here is going to be 2 colon 222.
And when we're coming the other way now, you'll see how now they're unique. 10.0.1.0 size 24,
10.0.1.0 size 24, notice now how they're unique because of the route distinguisher.
So what are you trying to learn from this? You are purely trying to learn for this
particular exam that if they ask you about how you ensure in a VRF when there are
duplicate networks in different VRFs, how do you ensure they're unique? How do you distinguish
one from the other? Route distinguishers. That's how you distinguish one from the other.
Route distinguishers. That's right in the name. I distinguish this route
from this route using a route distinguisher.
But we also have to remember that as we are leaving here, going to here,
we are actually doing an export. We are exporting from this VRF, and therefore, we now have to
import into the VRF there. We are exporting from here, and we have to import into here. Likewise,
we are exporting from here, and we'll have to import into there. We're exporting from here,
and we'll have to import into there. So in my case, when you think about it,
I was essentially just going from what? One router to the next router directly connected.
One router to the next router directly connected. One router to the next. That's how we were doing
it. But when you're doing it in MPLS Layer 3 VPN, notice how this router is participating in VRF.
The other one is these aren't. These are not. So it becomes more challenging to ensure isolation
when sharing routes, whereas in my VRF Lite scenario earlier where we were just going from
distribution one to router two to the branch router, it's just hop by hop by hop by hop.
Every router is participating in it. These ones are not. So how do we ensure isolation? How do I
export on one router and make sure it's being imported properly on the other router when it's
all said and done? How do we ensure isolation when sharing routes? The answer is route targets.
Route targets. So with a route target, essentially what we're doing is we're identifying
our VPN membership of that particular route. So that way there we can control the import and export
functions. That's what you want to get away from this discussion, right? Well, how do you control
the import and export functions when you are working with VRFs? Route targets. Route targets.
So what you would do is you would create a route target for your imports
and your exports. Now they can be the same value. They can be the exact same value.
In this case, I'm using the exact same value for import and I'm using the same value for export.
But you can easily say I want a route target for import to be this. I want a route target for export
to be this on that VRF, right? They don't have to be the same number. But what you have to realize
is that the numbers have to be matching on each side. So if I'm using that as my export target,
then this has to be the import target here. If I'm using this as my export target,
then that has to be the import target here. So think of this scenario. If this is export,
then this is import. What if we had another route target of 1 colon 101 here for import,
then I would have to have a route target over here 1 colon 101 for export. So I export to import.
I export to import. Important for you to know that for the exam, that if all of a sudden you
see a scenario with two route targets, okay, which one's export, which one's import, it'll tell you.
And make sure that the other side is the flip. They've got to be flipped from each other.
Because if this is export, that's import. This is export, that's import.
So make sure that you have those lined up properly as they need to be.
And so it is
attached to the route when we are building that VPN v4 address. So here's your route
distinguisher. Here's your IP address. Now you add the route target onto that as well.
So now when that information is being sent, what do you have? You have the route target,
you have the route distinguisher, and you have the prefix. So you have the route target controlling
export, and then import. You have the route distinguisher to ensure uniqueness,
to distinguish any duplicate addresses from each other. It's a lot, I know, but little things I
want you to remember for the certification exam when it comes to VRFs. So if you need route
distinguishers and route targets in your environment, then you can set them up as I've
shown you. So in this case, we set up the route distinguisher in this example. So if you need
a route distinguisher in this example, so on an exam, per se, if they say you must create a VRF
and it's going to have to have a route distinguisher associated with it of such and
such, well, I just showed you how to create the route distinguisher. What about the route target
for import and export? Route target right here. And so you'll see that if I type in both,
or I can just turn around and I don't even have to type in both, I can just type in the number,
or you can type an export and the number for export and an import, the number for import,
you just have to make sure the other device, the receiving device on the other side
is using the appropriate numbers as well.
So let's just remind ourselves here, show run pipe to section VRF. So VRF definition,
creating a route distinguisher, route target as we talked about, your address family,
and then under your interfaces, so show run interface gigabit ethernet zero size zero.
VRF forwarding is the command for that, puts your IP address on it,
put it in the right routing process. And then what was the other interface we did?
It was fast ethernet, zero slash one slash zero dot 100, I believe.
And in this case, we have to do a sub interface. So we did the encapsulation on that.
So great question that I get every once in a while. So Raymond, you've done this on physical
interfaces today, you've done it on SVIs, you've done them on sub interfaces. Can you also do them
on things like GRE tunnels? Meaning can I have a GRE tunnel in a specific VRF? And the answer
to that is yes. So if you create, for example, interface tunnel, let's just go ahead and say
we're going to create an interface tunnel 50, then you can put that in a VRF. So you can type
in VRF forwarding, and then put it in VRF, like we have here. And now that tunnel interface is
in the VRF. Keep that in mind, folks, because that's a really great question. I'm glad you
asked it today, that can we do VRF some tunnel interfaces? Absolutely, you can. Yeah, don't
forget that.