On Wednesday 07 May 2008, Rubens Kuhl Jr. wrote: > The issue with VRFs is that it can't do policy routing, > because it's already a routing table selection... I agree > that box security should be taken care with CoPP. Put > Internet customers on the main VRF, but carefully design > ACL, policy-routing and CoPP to reach your security > goals. VRFs are great with overlapping IP spaces, but on > the Internet where everybody on the world agrees on an > addressing plan, just use plaing routing.
I agree with this - having global (Internet) routes in a VRF, I think, adds complexity. One situation where we have considered doing this is when we want a specific PE router to have access to only a specific set of routes on a public border router. Other than that, we keep it quite simple :-). Cheers, Mark.
signature.asc
Description: This is a digitally signed message part.
_______________________________________________ cisco-nsp mailing list [email protected] https://puck.nether.net/mailman/listinfo/cisco-nsp archive at http://puck.nether.net/pipermail/cisco-nsp/
