In this post I will show how to configure VRF’s. We will configure 2 VRF’s on router R3 (one for VPN_A and one for VPN_B) and 2 on router R6 (one for VPN_A and one for VPN_B). Later on we will configure router R3 and R6 so that router R7 can communicate with router R11(VPN_A) and router R8 can communicate with router R13 (VPN_B)

When you configure VRF’s you have to specify a route-distinguisher. This rd will make all ip-addresses within a VPN unique. It turns an ipv4 address into an vpnv4-ipv4 address. You should make sure that the rd which you specify will be unique on a vpn and PE basis. Usually the notation of a rd is like AS:NN. I will use loopback0:nr so it will be easy to track where the routes are coming from.

So on router r3 the vrf configuration for VPN_A will look like :

R3 :

ip vrf VPN_A
rd 3.3.3.3:1
route-target export 3.3.3.3:1
route-target import 6.6.6.6:1
    

As you can see there is also a route-target specified. What a route-target does, is export the routes to BGP and import routes from BGP. When you specify a route-target you can choose to separate the export and import like you see above or specify “both” instead of the export and import keyword. If we would have done so the configuration would have looked like :

ip vrf VPN_A
rd 3.3.3.3:1
route-target both 3.3.3.3:1

With the configuration like above with the both keyword you have to specify the same route-target on all PE devices for this VPN.

But in our example we are going to stick with the first configuration because this way we can choose which routes we want to import into our vrf’s (more on this later).

The vrf configuration for VPN_B on router 3 will look like :

R3 :

ip vrf VPN_B
rd 3.3.3.3:2
route-target export 3.3.3.3:2
route-target import 6.6.6.6:2
    

On router r6 the vrf look like :

R6 :

ip vrf VPN_A
rd 6.6.6.6:1
route-target export 6.6.6.6:1
route-target import 3.3.3.3:1

And for VPN_B :

ip vrf VPN_B
rd 6.6.6.6:2
route-target export 6.6.6.6:2
route-target import 3.3.3.3:2
    

The next thing I will configure are the interface which need to be in VPN_A and VPN_B.

R3 :

interface FastEthernet0/0
 ip vrf forwarding VPN_B
 ip address 31.31.31.3 255.255.255.0
 duplex auto
 speed auto
!
interface FastEthernet2/0
 ip vrf forwarding VPN_A
 ip address 37.37.37.3 255.255.255.0
 duplex auto
 speed auto
    

R6 :

interface FastEthernet0/0
 ip vrf forwarding VPN_A
 ip address 61.61.61.6 255.255.255.0
 duplex auto
 speed auto
!
interface FastEthernet2/0
 ip vrf forwarding VPN_B
 ip address 68.68.68.6 255.255.255.0
 duplex auto
 speed auto
    

Let’s see if we can ping router R8 interface 68.68.68.8 from router R6 :

R6 :

R6#ping vrf VPN_B 68.68.68.8

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 68.68.68.8, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 4/25/52 ms
    

Let’s see if we can ping router R7 interface 37.37.37.7 from router R3 :

R3 :

R3#ping vrf VPN_A 37.37.37.7

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 37.37.37.7, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 16/34/56 ms
    

As you can see the ping now has to be done from within the VRF’s.

So what we have accomplished so far in this series :

- Set up the core network
- Configured vrf’s

In the next post we will configure PE to CE routing, we will start off with static routing between the PE and CE.