Hi Gerald, Thanks for your inputs. Will try this configuration and let you know how it goes..!
Cheers Hitesh On Thu, Oct 11, 2012 at 9:50 PM, Gerald Krause <[email protected]> wrote: > Hi Hitesh, > > just to let you know how our working config looks like. We had some > problems in the beginning with Half duplex VRF on earlier IOS versions. > Now we're running 122-33.SRE on a NPE-G2 and it works as expected. > > Traffic from site1 to site2 (both terminated via L2TP/PPP on the same > LNS) will be directed (egress) to port GE0/3.148 towards the firewall > 10.99.16.254 and then back (ingress) on port GE0/3.149 if the firewall > permit the traffic. > > > LNS CONFIG > ========== > > LNS1#sh run vrf CUSTVRF-DOWN > Building configuration... > > Current configuration : 603 bytes > ip vrf CUSTVRF-DOWN > rd 100:2 > route-target export 100:2 > route-target import 100:2 > ! > ! > interface GigabitEthernet0/3.149 > encapsulation dot1Q 149 > ip vrf forwarding CUSTVRF-DOWN > ip address 10.99.16.227 255.255.255.240 > ! > router bgp 10000 > ! > address-family ipv4 vrf CUSTVRF-DOWN > no synchronization > redistribute connected > redistribute static > exit-address-family > ! > end > > > LNS1#sh run vrf CUSTVRF-UP > Building configuration... > > Current configuration : 816 bytes > ip vrf CUSTVRF-UP > rd 100:3 > route-target export 100:3 > route-target import 100:1 > ! > ! > interface GigabitEthernet0/3.148 > encapsulation dot1Q 148 > ip vrf forwarding CUSTVRF-UP > ip address 10.99.16.243 255.255.255.240 > ! > interface Loopback102 > description CUSTVRF > ip vrf forwarding CUSTVRF-UP > ip address 10.99.17.254 255.255.255.255 > ! > router bgp 10000 > ! > address-family ipv4 vrf CUSTVRF-UP > no synchronization > redistribute connected > redistribute static > default-information originate > exit-address-family > ! > ip route vrf CUSTVRF-UP 0.0.0.0 0.0.0.0 10.99.16.254 > end > > > RADIUS ACCOUNTS (freeRadius) > =============== > > cust-vrfsite1 Password == xxxx > Cisco-AVPair += ip:ip-unnumbered=Loopback102 > Cisco-AVPair += ip:addr=10.99.17.68 > Cisco-AVPair += ip:vrf-id=CUSTVRF-UP downstream CUSTVRF-DOWN > Cisco-AVPair += ip:route=10.98.8.0 255.255.255.0 > > cust-vrfsite2 Password == yyyy > Cisco-AVPair += ip:ip-unnumbered=Loopback102 > Cisco-AVPair += ip:addr=10.99.17.69 > Cisco-AVPair += ip:vrf-id=CUSTVRF-UP downstream CUSTVRF-DOWN > Cisco-AVPair += ip:route=10.98.9.0 255.255.255.0 > > > > Gerald > > > Am 11.10.2012 07:45, schrieb Hitesh Vinzoda: > > Hi Arie, > > > > This is already in place and the virtual-access interfaces belongs to > this > > vrf and so do their PPP host router. > > > > This routes are not visible in upstream vrt U which is great but these > > routes do appear in Downstream vrf D so that is the reason they route > > locally and doesnt go towards hub CE. > > > > The illustrations that i have seen before have CE sites connected on > > different PE routers whereas in my case the CE routers are connected to > > same PE and hence we want to avoid local routing on the LNS. > > > > Please let me know your thoughts over this. > > > > Thanks > > Hitesh > > > > On Wed, Oct 10, 2012 at 11:27 PM, Arie Vayner (avayner) > > <[email protected]>wrote: > > > >> So basically your PPP connections are in the global routing table…**** > >> > >> What is the profile you are downloading from RADIUS (debug radius) for > >> them?**** > >> > >> ** ** > >> > >> You most likely should be downloading the “ip vrf forwarding U > downstream > >> D” command using the RADIUS attribute “lcp:interface-config=ip vrf > >> forwarding U downstream D”…**** > >> > >> > >> > http://www.cisco.com/en/US/docs/ios/12_3/feature/guide/ghdpvrf.html#wp1099907 > >> **** > >> > >> ** ** > >> > >> Arie**** > >> > >> ** ** > >> > >> *From:* Hitesh Vinzoda [mailto:[email protected]] > >> *Sent:* Wednesday, October 10, 2012 00:44 > >> > >> *To:* Arie Vayner (avayner) > >> *Cc:* Cisco Mailing list > >> *Subject:* Re: [c-nsp] Half duplex VRF**** > >> > >> ** ** > >> > >> Hi Arie,**** > >> > >> ** ** > >> > >> Below is the desired excerpt. We can't see the VRF config being applied > to > >> the interfaces but its visible in "show ip int virtual-access". I have > >> tried two different way in RADIUS attributes but the results are the > same. > >> **** > >> > >> ** ** > >> > >> LNS#show ppp all**** > >> > >> Interface/ID OPEN+ Nego* Fail- Stage Peer Address Peer > Name**** > >> > >> ------------ --------------------- -------- --------------- > >> --------------------**** > >> > >> Vi4 LCP+ CHAP+ IPCP+ LocalT 192.168.254.200 \**** > >> > >> [email protected]**** > >> > >> Vi3 LCP+ CHAP+ IPCP+ LocalT 192.168.254.100 \**** > >> > >> [email protected]**** > >> > >> LNS#show run int vir**** > >> > >> LNS#show run int virtual-acc**** > >> > >> LNS#show run int virtual-access 3**** > >> > >> Building configuration...**** > >> > >> ** ** > >> > >> Current configuration : 78 bytes**** > >> > >> !**** > >> > >> interface Virtual-Access3**** > >> > >> ip mtu 1492**** > >> > >> ip verify unicast reverse-path**** > >> > >> end**** > >> > >> ** ** > >> > >> LNS#show run int virtual-access 4**** > >> > >> Building configuration...**** > >> > >> ** ** > >> > >> Current configuration : 78 bytes**** > >> > >> !**** > >> > >> interface Virtual-Access4**** > >> > >> ip mtu 1492**** > >> > >> ip verify unicast reverse-path**** > >> > >> end**** > >> > >> =================**** > >> > >> ** ** > >> > >> LNS#show ip int virtual-access 3**** > >> > >> Virtual-Access3 is up, line protocol is up**** > >> > >> Interface is unnumbered. Using address of Loopback2 (2.2.2.1)**** > >> > >> Broadcast address is 255.255.255.255**** > >> > >> Peer address is 192.168.254.100**** > >> > >> MTU is 1492 bytes**** > >> > >> Helper address is not set**** > >> > >> Directed broadcast forwarding is disabled**** > >> > >> Outgoing access list is not set**** > >> > >> Inbound access list is not set**** > >> > >> Proxy ARP is enabled**** > >> > >> Local Proxy ARP is disabled**** > >> > >> Security level is default**** > >> > >> Split horizon is enabled**** > >> > >> ICMP redirects are always sent**** > >> > >> ICMP unreachables are always sent**** > >> > >> ICMP mask replies are never sent**** > >> > >> IP fast switching is enabled**** > >> > >> IP Flow switching is disabled**** > >> > >> IP CEF switching is enabled**** > >> > >> IP CEF switching turbo vector**** > >> > >> IP CEF turbo switching turbo vector**** > >> > >> VPN Routing/Forwarding "U"**** > >> > >> Downstream VPN Routing/Forwarding "D"**** > >> > >> Associated unicast routing topologies:**** > >> > >> ipv4 topologies in downstream VRF "D" :**** > >> > >> Topology "base", operation state is UP**** > >> > >> ipv4 topologies in upstream(forwarding) VRF "U":**** > >> > >> Topology "base", operation state is UP**** > >> > >> ===============================================**** > >> > >> Thanks**** > >> > >> Hitesh**** > >> > >> ** ** > >> > >> On Tue, Oct 9, 2012 at 9:52 PM, Arie Vayner (avayner) < > [email protected]> > >> wrote:**** > >> > >> Hitesh, how does your virtual-access look like for the spokes?**** > >> > >> Can you please share the “show run interface virtual-access xx” for the > >> spokes?**** > >> > >> **** > >> > >> Tnx**** > >> > >> Arie**** > >> > >> **** > >> > >> *From:* Hitesh Vinzoda [mailto:[email protected]] > >> *Sent:* Tuesday, October 09, 2012 09:05 > >> *To:* Arie Vayner (avayner) > >> *Cc:* Cisco Mailing list > >> *Subject:* Re: [c-nsp] Half duplex VRF**** > >> > >> **** > >> > >> Hi Arie,**** > >> > >> **** > >> > >> I have attached topology, .Net file and configs of related devices. R8 > and > >> R9 are simulating spokes whereas Internet-RTR is simulating Hub.**** > >> > >> **** > >> > >> Cheers**** > >> > >> **** > >> > >> Hitesh**** > >> > >> On Tue, Oct 9, 2012 at 8:37 PM, Arie Vayner (avayner) < > [email protected]> > >> wrote:**** > >> > >> Hitesh, can you maybe share some of your configs? > >> Arie**** > >> > >> > >> -----Original Message----- > >> From: [email protected] [mailto: > >> [email protected]] On Behalf Of Hitesh Vinzoda > >> Sent: Tuesday, October 09, 2012 07:04 > >> To: Cisco Mailing list > >> Subject: [c-nsp] Half duplex VRF > >> > >> I am trying to setup half duplex vrf to save vrf's on the LNS. Does > anyone > >> has working configuration for spokes and Hub connected on the same PE > >> router i.e. LNS. So far i able to export-import the routes but the > traces > >> from one spoke to other goes directly via LNS instead of via Hub. > >> > >> Please advise. > >> > >> TIA > >> Hitesh**** > >> > >> _______________________________________________ > >> cisco-nsp mailing list [email protected] > >> https://puck.nether.net/mailman/listinfo/cisco-nsp > >> archive at http://puck.nether.net/pipermail/cisco-nsp/**** > >> > >> **** > >> > >> ** ** > >> > > _______________________________________________ > > cisco-nsp mailing list [email protected] > > https://puck.nether.net/mailman/listinfo/cisco-nsp > > archive at http://puck.nether.net/pipermail/cisco-nsp/ > > > > _______________________________________________ cisco-nsp mailing list [email protected] https://puck.nether.net/mailman/listinfo/cisco-nsp archive at http://puck.nether.net/pipermail/cisco-nsp/
