Monday, May 06, 2024

Example Campus VRF Configuration

Quick Summary of a Cisco VRF-Lite Configuration for a Campus Environment

Architecture

Traditional 3 tier architecture - core, distribution, access.

  • Central firewalls (HA Pair, Active/Passive)
  • Core switches (VSS pair)
  • Distribution switches (VSS pairs)


Virtual Routing and Forwarding

Campus is divided up into 6 VRFs (VRF-Lite):

  • Building Management Systems (BMS) - HVAC, FIPS, CCTV, Emergency Lighting, ECPs etc
  • Information & Communications Technology (ICT) -  Things unique to IT but don't assume secure
  • General Staff (STAFF) - General business staff
  • Affiliates (AFFIL) - Guests, 3rd parties
  • Edge (EDGE) - Printers, Audio/Visual equipment, Voice
  • Network Management (NETINF) - Switch management

Each VRF has a Route Distinguisher (RD), and Route Targets (RT Import/Export)


In this case, the RD and RT import/export are all the per VRF.
  • BMS 65535:100
  • ICT 65535:110
  • STAFF 65535:120
  • AFFIL 65535:130
  • EDGE 65535:140
  • NETINF 65535:150
Each VRF has its own router process and therefore its own route tables, in the example below, OSPFv2 has been used.


Firewall interfaces (Core switch - Firewall)

These are VLAN interfaces trunked over a LAG between the core switches and the firewalls.

  • BMS VLAN 3000
  • ICT VLAN 3010
  • STAFF VLAN 3020
  • AFFIL VLAN 3030
  • EDGE VLAN 3040
  • NETINF VLAN 3050


Core switch interfaces (Per Building: Core switch - Disitribution Switch)

These are P2P VLANs on a LAG between the core switches and the distribution switches. One per VRF, per building. So the first building gets VLANs 2010, 2100, 2200, 2300, 2400, 2500, the second building gets VLANs 2011, 2101, 2201, 2301, 2401, 2501 and so on.

  • BMS VLAN 2010 - 2099
  • ICT VLAN 2100 - 2199
  • STAFF VLAN 2200 - 2299
  • AFFIL VLAN 2300 - 2399
  • EDGE VLAN 2400 - 2499
  • NETINF VLAN 2500 - 2599


Distribution switch interfaces (one pair per building ie VSS/VLT/MCLAG)

These are the access VLANs. They are what endpoints/clients will be using. I use the same VLANs per each building because the boundary is the distribution switches.

  • BMS VLAN 1000 - 1009
  • ICT VLAN 1010 - 1019
  • STAFF VLAN 1020 - 1029
  • AFFIL VLAN 1030 - 1039
  • EDGE VLAN 1040 - 1049
  • NETINF VLAN 1050 - 1059


IP Schema and Routing

In the examples below I have used a Class A RFC1918 address range and OSPFv2 routing.


Example Core and Distribution Switch VRF-Lite configuration


Using the AFFIL VRF as an example. To create the other VRFs you simply copy the configuration while changing the identifiers/numbers/addresses to suite.





Core Switch

A static default route to the firewall's AFFIL VLAN interface is used.

ip vrf AFFIL
 description Affiliates
 rd 65535:130
 route-target export 65535:130
 route-target import 65535:130

ip multicast-routing vrf AFFIL 

vlan 3030
 name AFFIL_P2P_FW

vlan 2300
 name AFFIL_P2P_BldA

interface Loopback130
 description Loop Back AFFIL
 ip vrf forwarding AFFIL
 ip address 10.30.5.1 255.255.255.255
 no ip proxy-arp
 ip pim sparse-mode
 ip ospf 130 area 0

interface Loopback131
 description Mulitcast RP AFFIL
 ip vrf forwarding AFFIL
 ip address 10.30.5.253 255.255.255.255
 no ip proxy-arp
 ip pim sparse-mode
 ip ospf 130 area 0

interface Vlan3030
 description Firewall AFFIL
 ip vrf forwarding AFFIL
 ip address 10.30.2.5 255.255.255.240
 no ip redirects
 no ip proxy-arp
!
interface Vlan2300
 description Building A AFFIL
 ip vrf forwarding AFFIL
 ip address 10.30.3.1 255.255.255.252
 no ip redirects
 no ip proxy-arp
 ip ospf 130 area 0

 router ospf 130 vrf AFFIL
 router-id 10.30.5.1
 capability vrf-lite
 passive-interface default
 no passive-interface Loopback130
 no passive-interface Loopback131
 no passive-interface Vlan2300
 default-information originate always

ip pim vrf AFFIL rp-address 10.30.5.253 override

ip route vrf AFFIL 0.0.0.0 0.0.0.0 10.30.2.3

Associate the appropriate VLANs with the Firewall and the distribution switch interfaces.


Distribution Switch

Layer 3 between core and distribution. Layer 2 between distribution and access. VLANs 1030 - 1032 are the SVIs for the access networks for the building - these will be trunked/tagged to each access switch/stack and associated on each port as appropriate as an access/untagged VLAN.

ip vrf AFFIL
 rd 65535:130
 route-target export 65535:130
 route-target import 65535:130

ip multicast-routing vrf AFFIL 

interface Loopback130
 description General Management Loop Back AFFIL
 ip vrf forwarding AFFIL
 ip address 10.30.5.10 255.255.255.255
 no ip proxy-arp
 ip pim sparse-mode
 ip ospf 130 area 0

interface Vlan1030
 description AFFIL_VLAN1030
 ip vrf forwarding AFFIL
 ip address 10.30.100.1 255.255.255.0

interface Vlan1031
 description AFFIL_VLAN1031
 ip vrf forwarding AFFIL
 ip address 10.30.101.1 255.255.255.0

interface Vlan1032
 description AFFIL_VLAN1032
 ip vrf forwarding AFFIL
 ip address 10.30.102.1 255.255.255.0

interface Vlan2300
 description AFFIL_P2P_BldA
 ip vrf forwarding AFFIL
 ip address 10.30.3.2 255.255.255.252
 no ip redirects
 no ip proxy-arp
 ip pim sparse-mode
 ip ospf network point-to-point
 ip ospf 130 area 0

router ospf 130 vrf AFFIL
 router-id 10.30.5.10
 redistribute connected subnets
 passive-interface default
 no passive-interface Loopback130
 no passive-interface Vlan1030

ip pim vrf AFFIL rp-address 10.30.5.253

Associate the appropriate VLANs with the core switch interfaces and downstream access switches.


Posted by at

1 comment:

Anonymous said...

Beautiful

12:03 am

Post a Comment

Subscribe to: Post Comments (Atom)