Chris,
Does your switch or router have VRF-lite in its feature set?
I had a similar problem wrapping my brain around layer-3 segmentation. What
you describe seems similar in concept to problems I faced in the past couple
of years. I found some docs at Cisco that were close to what I wanted to,
and they covered Policy-Based Routing and VRF as two solutions. A lot of
what those documents talked about re. VRF was using either MPLS or GRE
tunnels. That seemed a bit heavy for my campus LAN. So I found instead
VRF-lite, which worked without all that MPLS and GRE stuff. I implemented
VRF-lite in my core switch/routers because it was going to be easier to
implement and maintain than PBR and traditional VRF.
Basically, VRF and VRF-lite create alternate independent RIBs (route tables)
in your switch or router. Unless you configure some way to explicitly share
or leak routes between each of them and your global table, they won't.
So you could create a totally separate routing process (OSPF, BGP, static
routes, whatever) that is independent of your main OSPF IGP. As far as your
existing internal OSPF, your switch/router's OSPF area 0 is an ASBR with a
default route leading out to your content filter and firewall.
What you might do with this is to create a VRF definition for your external
connections, including the one coming back from the "outside" of your
firewall.
ip vrf externalzone
rd 111:222
Then put your group of "external zone" interfaces into
int fa1/0
ip vrf forwarding externalzone
ip address 10.0.0.1 255.255.255.0
exit
int fa2/0
ip vrf forwarding externalzone
ip address 10.0.1.1 255.255.255.0
exit
int fa3/0
ip vrf forwarding externalzone
ip address 10.0.2.1 255.255.255.0
exit
Then you set up your routing for the VRF. I'll show you OSPF and static
routes.
router ospf 333 vrf externalzone
log-adjacency-changes
capability vrf-lite
area 0 stub no-summary
passive-interface default
network 10.0.0.0 0.0.0.255 area 0
network 10.0.1.0 0.0.0.255 area 0
network 10.0.2.0 0.0.0.255 area 0
distribute-list deny-def-route out
ip route vrf externalzone 0.0.0.0 0.0.0.0 <uplink-1-farside-ip>
ip route vrf externalzone 0.0.0.0 0.0.0.0 <uplink-2-farside-ip> 20
ip route vrf externalzone <internal nets> 10.0.2.2
It works for VLAN SVIs as well as L3 routed physical ports. Just make sure
your switch/router has VRF-line in its feature set.
If you have this feature available, here are some links to other web pages
that can help you understand it better.
http://www.cisco.com/en/US/solutions/collateral/ns340/ns517/ns431/ns658/net_qanda0900aecd804a16ae.html
http://www.cisco.com/en/US/netsol/ns658/networking_solutions_package.html
http://www.cisco.com/application/pdf/en/us/guest/netsol/ns171/c649/ccmigration_09186a0080851cc6.pdf
http://www.ciscosystems.com/en/US/docs/optical/15000r4_0/ethernet/454/guide/vrf.pdf
http://www.cisco.com/en/US/tech/tk436/tk832/technologies_configuration_example09186a0080231a3e.shtml
http://www.cisl.ucar.edu/nets/devices/routers/cisco/vrf/testbed.shtml
http://www.cisl.ucar.edu/nets/devices/routers/cisco/vrf/final.shtml
http://www.cisl.ucar.edu/nets/devices/routers/cisco/vrf/cheatsheet.shtml
At 05:52 PM 1/9/2009, Chris Burwell wrote:
I am looking for a bit of guidance on logically segmenting an existing
router. Currently I have a core network router that has fiber
connections to all of our buildings. Each building is in it's own
VLAN. We run OSPF on the router and all VLANS are in the same area
0.0.0.1.
In the future things are going to change, one of which will be our
ISP. So we will have two fiber connections to the outside world. One
will go to the internet VIA a yet to be named ISP, while the other
will go to an external entity that provides some services to us. Since
money is tight right now, I want to try to use our current hardware
for the new setup.
What I am unsure about is how everything would be setup. I know that
the two external connections will be in their own VLAN, but it is the
routing part that I am trying to wrap my head around. Would we have to
run a separate routing instance for the two external connections? I
ask this because once the outbound traffic makes it past our firewall,
the router is going to have to make a decision on if the traffic
should be routed to the external entity or to the internet. Would we
be able to accomplish this with our current routing setup?
The setup will be the two external connections on their own VLAN. A
third connection will also be a part of that VLAN, and this will
provide the "outside" link on our firewall. From there the firewall
will connect to another port on our internal network (which is again
on it's own VLAN, but this VLAN is part of our internal OSPF area). SO
outbound traffic would travel into the internal interface on the
firewall, out the external interface and back into our core router.
>From here the decision needs to be made on what link the packet should
be forwarded out of.
I appreciate any help!
- Chris
_______________________________________________
cisco-nsp mailing list [email protected]
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/
--
Douglas C. Stephens | UNIX/Windows/Email Admin
System Support Specialist | Network/DNS Admin
Information Systems | Phone: (515) 294-6102
Ames Laboratory, US DOE | Email: [email protected]
_______________________________________________
cisco-nsp mailing list [email protected]
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/
