I'm in the process of deploying a small SP network that will provide *regular* Internet connectivity, as well as provide L3 VPNs for a multitude of services. In our design, we're thinking to keep the global internet in the "master" routing instance (i.e. non-VRF), just using plain BGP routing, and having separate connectivity (intranets, private and semi-private services) in VRFs and using route-target import/exports.
Small example; Cust-A connects to PE1, Cust-B connects to PE2, both with dot1Q tagged sub-interfaces. In addition to this connection, they both have another logical connection to the same PE routers across the same interface on a different VLAN thats in the "master" instance for regular Internet. In the case of their VRF sub-interface, here's how we do the forwarding: PE1 === ip vrf Cust-A rd 65001:100 route-target export 65001:100 route-target import 65001:100 route-target import 65001:200 interface FastEthernet2/1.10 description Cust-A Internet encapsulation dot1Q 10 ip address x.x..x.x 255.255.255.252 interface FastEthernet2/1.20 description Cust-A VPN encapsulation dot1Q 20 ip vrf forwarding Cust-A ip address x.x..x.x 255.255.255.252 PE2 === ip vrf Cust-B rd 65001:200 route-target export 65001:200 route-target import 65001:200 route-target import 65001:100 interface FastEthernet2/1.10 description Cust-B Internet encapsulation dot1Q 10 ip address x.x..x.x 255.255.255.252 interface FastEthernet2/1.20 description Cust-B VPN encapsulation dot1Q 20 ip vrf forwarding Cust-B ip address x.x..x.x 255.255.255.252 In this case, both customers run BGP (as they're multihomed to other ISPs), and are advertising their Arin-assigned network to both the "Internet" link in the regular BGP unicast address family and to the VRF links on the BGP VRF address family. Because of this, they are both learning each others' networks across the *regular* BGP link as well as the VRF BGP link. For political and billing reasons, this may not be ideal, mainly because they are "paying" for connectivity to the Internet service, but the VRF/VPN connectivity is 'free', so they want to be sure that forwarding between each other chooses the VPN path. I haven't been able to find any "best practice" that addresses this issue. What do people normally do in this setup? Send MED on the customer routes across the Internet peering so they will prefer the "intranet" path? Use a combo of tags/communities to filter the CE routes on the Internet peering? I can think of a couple of ways to do it, but I'm looking for some recommendations. _______________________________________________ cisco-nsp mailing list [email protected] https://puck.nether.net/mailman/listinfo/cisco-nsp archive at http://puck.nether.net/pipermail/cisco-nsp/
