How VRFs Work (VRF Lite) | VRFs Part 1
Вставка
- Опубліковано 19 жов 2024
- How VRFs Work (VRF Lite) | VRFs Part 1
VRFs, or Virtual Routing and Forwarding, are virtual routing tables. They enable separation of one part of the network from another.
There could be many reasons to do this. It could be for security, to separate the inside network from the DMZ. Or, it could be to separate BU's, or separate customers from each other.
This video explains VRF basics, what they are used for, when they are used, and how they work.
This includes two labs you can follow along with.
The first lab starts at the beginning and shows basic VRF configuration to separate two customers.
The second lab shows how you can use VRFs to force traffic through a firewall for security purposes.
You can download the labs, and practice on your own if you want (Patreon).
networkdirecti...
Part 1: VRF Lite - The Fundamentals of how VRF's work. This covers route separation, why you need it, and how it's configured
• How VRFs Work (VRF Lit...
Part 2: Dynamic Routing - Taking it a step further, we see how to add OSPF, EIGRP, and BGP routing, all while keeping it VRF-aware
• Dynamic Routing with V...
Part 3: Route Targets - VRF's are local to each router. But, we can use route-targets and MP-BGP to share routes between VRF's on different routers. The ed result? VRF's are spanned across your network!
• Route Target Import an...
Part 4: Route Leaking - VRF's keep routes separate, but what if you have some important services to share? How do you share the routes then? With Route Leaking!
• Leak Routes Between VRF's
For more information, have a look at networkdirecti...
/ networkdirection
/ netwrkdirection
/ networkdirection
the first video where vrf is cleary explained... thanx
Thankyou!
I also found it hard to find a clear explanation (which is why I tried to make one)
This is really solid bud. Been doing this stuff for 10+ years. Showed this to some entry level guys on my team and they picked it up instantly. Great work!
Thanks Rougewolf! I am really glad you have been able to find the videos beneficial! Have a great day.
Hello ! I can only confirm since i'm a entry level network engineer who never heard about VRFs and your video explained it very well ! I got it now ;) Thanks buddy !
You are great bro, first time I found great explanation to this topic, we need more videos series for other network topics
Thanks Techno Ocean.
Working through a GRE series right now. Considering a DMVPN series in the near future.
Never understood this before hitting here God bless you sir
Thank you for sharing. Simple explanation of a complex subject. Great work.
Glad you like it, thanks for the feedback
I love the way how you keep it simple and short! Thank you very much for the great content :)
Thanks for the feedback
very easy explanation from the beginning to the end. New subscriber!
I'm amazed how easy looks the concept after your explanation. Kudos for this great content.
Thanks!
Thanks for this video, now i feel more confident on VRF's.
Beautifully explained
Thanks
excellent!! Just what I was looking for. Thanks for your time.
Glad to help!
The Videos are great for refreshing one's knowledge, top.
Glad you like it
Nice video, glad to have found this channel. Thanks for sharing.
Glad to help
Awesome video, once again! I also really enjoy how you run into errors on purpose, because that's likely what someone configuring VRFs for the first time would run into.
But a little sad that it's only available on an enterprise service license level in IOS, if you run another license level on your L3 device, you won't be able to use VRFs. :(
Thanks again 😀
Some platforms (like the N5k I think) allow VRF lite on a lower license, and full VRF on a higher license
Roman Matys This is not a lab issue, but a real life enterprise issue for me :P
You’re the best!!!!! Thanks for the knowledge dump!
You're welcome!
great video. lots of work put into this to make it easily digestible
great explanation thanks
Glad you liked it
Amazing! Simple and clear explanation. Thank you!
Great explanation. Thank you
Great explanation!
Thanks!
Nice one. Keep up the good work.
Thanks!
Amazing job! You guys rock!!
Thanks mate!
thank you! amazing video!
Great work on these vids. would be awesome to see some more vids in relation to routing and switching
Hi Alenbilic, thanks for the suggestion. Is there anything specific that you are after?
@@NetworkDirection im the middle of studying for my CCNP route switch. so detailed info on the layer 2 and 3 technologies and also some vids in regards to the TSHOOT exam. e.g troubleshooting scenarios, would be awesome
** GREAT WORK ------ THANKS FOR SHARING ------- CHEERS PEOPLE ! **
Glad you like it!
how u make it so easy to understand :) well done
Hours of writing and rewriting the script :)
Thanks for watching
Great videos, thank you very much!
You're welcome!
Very Helpful. Thank you
Glad it was helpful!
absolutely fantastic Teacher !
Fantastic mate
Concept well explained.Ty.
What is the difference btn vrf and vrf-lite.Need to know how both works and their respective configuration as well.
Part 4 will explain this better, but in short, VRF uses MPLS or similar technology to share informatio with other routers. VRF-Lite does not.
help a lot, Thanks for sharing
Happy to help! Glad you're getting some value from the videos!
Great video and right to the point!. i have a scenario where i want to use 1 VRF and leak 1 route to the global table, is it possible?.
Hey man.
I've done the 9 Network fundamental videos.
This video makes very little sense to me.I don't really understand the concepts and purpose here.
Could you give me some info about it and what I should learn now.
(cuz this is too advanced for me)
I appreciate your job man keep up.
Yeah, the VRF videos are going to be a bit more advanced than the fundamental ones.
I would suggest looking at reading up on CCENT or CCNA to fill in a few gaps before moving into the deeper topics.
Nice ansswer
Thank you for the video, much appreciated. You mention the global routing table can still be used even with the VRF tables, is there a common instance where you would want to use both?
In one case, I use the global routing table to carry infrastructure routes. How to get from one environment to another, that sort of thing
Then I use VRFs for the tenant traffic.
That was a good question!
@@NetworkDirection can you explain with more easier scenario?
On using the global routing table with VRF's? Sure.
I like to use the global routing table for infrastructure. If I have a few routers, I will connect them and get BGP (or some routing protocol) working in the global routing table.
Then a customer comes along. I don't want them knowing about all my routes. I just want to help them move packets around while keeping my infrastructure secure. That's when I would create a VRF. Customers will have their own routes, and they will all go in the VRF.
Extra customers get their own VRF's too.
As you get to part 3 of this series, this will probably make more sense.
Very nice video...helps a lot...keep it coming :)
Superuseful video !
That's good to hear, thanks!
Nice Video.....appreciated
Here's the lab files (Patreon):
networkdirection.net/VRF+Lab+1
Really nice video! built something like this for my employer a couple of years ago, now spans multiple VRFs for internal divisions and individual business clients we process data for, inter VRF routing is accomplished with OSPF :)
It works really well doesn't it? Rock solid
Can we say that we have configured the firewall with a router on a stick config?
Do you not need to configure a route distinguisher when you create the VRF?
Vrf commands can be cumbersome to work with, so on some platforms there is a command that can help out a lot: #routing-context vrf CustA and then you can use the regular commands. Much easier!
I didn't know about that shortcut, thanks!
amazing vid !
Thanks man.. Good sub!
You're very welcome!
I've never heard of VRF's before. Is this new? What products support this feature? How do we know if a certain product supports this feature?
I had the same question. Please answer!!!!!!!!!
very good
Subbed!!!
Amazing Explanation about VRF. Great work bro !!! How can the overlapping ip subnet 10.10.0.0/24 exchange between them ? what is the feature in the FW that can allow it ?
The only way to have overlapping subnets communicate with each other is by sending the traffic to an L3 device (router or firewall), where there is no VRF, or the traffic is in the same VRF.
This device then needs to use NAT to make the networks appear unique.
It's a complicated scenario, so avoid it if you can
@@NetworkDirection It does sound complicated, is it something you'd usually see in real networks? Why would companies do that besides bad design?
@@ithereos9554 I've done it myself in some cases. I've used it when working for a cloud provider. We had different customers connected through WAN links. We couldn't control their IP space, and they couldn't control ours. So in a case like this, we can use NAT.
However, if you have control, use unique subnets to avoid using NAT.
@@ithereos9554 Service Providers use this to divide customer overlapping 10/8 rfc1918 networks. And customers can communicate over Service Provider MPLS network separately. You can do this always when you have many customers and you need to separate them into domains.
awesome!
Thanks!
I want to install an SOHO network please I need guidelines on how to do it
how come adding the router will allow hosts from different VLANs to communicate with each other? (without additional config. like a router on a stick.)
Generally they will have an IP address in each of those VLANs, and will be able to pass packets from one to the other
I couldnt understand gi 0/3 sub interface, as per your diagrams there are .9 and .13 interface towards firewall and not .3 interface ..?
Looking at 9:58, it is .13, not .3
Is that the part you mean, or is there somewhere else I'm missing?
Good
Thanks
Good🎉
Thnxxxxxxxxxxx!!!!!
is it possible for you two create video scenerio like:- one router with two ISP and router runnning two routing protocol rip and osp.rip for acitve and ospf for standby
In part 2, I'll show you how to configure dynamic routing (OSPF and EIGRP) with VRF's, which might be similar to what you're asking for.
I'm not sure how you would use RIP for active and OSPF for secondary though.
For dual-ISP, I would use BGP
yes but i have seen such senerio..customer having one router with two isp one nomal and 2ndar 3g cellular link..abd only ospf and rip config are there..i can share you config if you provide me email....nowa days i am too much confuse about this
Sure, send it through. My details are on the website.
How to do static route with VRF in Cisco iOS ?
How come Core1 router ports(.1 and .5) are in the same network, Aren't they suppose to be on different network ?
They are in different networks. They are /30's
@@NetworkDirection yes yes, thank you .will need to refresh my subnetting..thanks again.
No worries, glad to help.
I have some IP addressing and subnetting videos coming in about two weeks if you're interested
@@NetworkDirection that would be great..subscribe and enabled notification..
Good to hear 😀
Why does the vrf definition command not work on my IOS? I have to use # IP VRF CustA on my router. Also, ADDRESS-FAMILY IPV4 command not recognised in vrf configuration mode. What IOS are you using?
Have you tried downloading the labs from the site?
Are custa and b 10.10.0.0 networks on different interface and if so are they sub interfaces?
The 10.0.0.0 network are on different routers.
Is that what you mean?
he is pinging (ping vrf custB 10.20.0.1) unsuccessfully. How it could be successful; he did not define the route to 10.20.0.0 for custB vrf?
how did you do it can you share with me , thank you
How did I create the VRF do you mean?
I don't get your explanation at all. You show some topology with IPs, when you configure the routes in the vRFs they are all differents. :| I'm totally confused by this video.
Hagenes Corners
It's 2023 and you still charge in order to view some firewall configuration!!.
Make it free man.. specially your old labs.
6$ for some firewall config🦂
I'm literally configuring this right now except with Cisco 3850s and clustered as sRX345 that need to route back for nat. Thank you for this! It's wonky for sure but a work around I had to do due to vendor compliance.
Glad this is helping!
I also use SRX345's. They use the term 'routing-instance'. The 'virtual router' type is most similar to Cisco's VRF-Lite, as discussed in this video
networkdirection.net/articles/routingandswitching/juniper-routers-and-switches/juniper-routing-instances/
Awesome explanation!
Thanks!