DMVPN With Internet In A Separate VRF - Revision history

Casey at 04:30, 13 July 2015

2015-07-13T04:30:21Z

Casey at 04:29, 13 July 2015

2015-07-13T04:29:03Z

Casey at 04:27, 13 July 2015

2015-07-13T04:27:57Z

Casey at 04:23, 13 July 2015

2015-07-13T04:23:10Z

Casey at 04:22, 13 July 2015

2015-07-13T04:22:51Z

Casey at 04:22, 13 July 2015

2015-07-13T04:22:19Z

Casey: Created page with "This is the complementary to Hosting Multiple DMVPNs and DMVPN With Multiple VRFs. Let's say you want to have your Internet connection isolated in a VRF. This would..."

2015-07-13T04:18:56Z

Created page with "This is the complementary to Hosting Multiple DMVPNs and DMVPN With Multiple VRFs. Let's say you want to have your Internet connection isolated in a VRF. This would..."

New page

This is the complementary to [[Hosting Multiple DMVPNs]] and [[DMVPN With Multiple VRFs]].

Let's say you want to have your Internet connection isolated in a VRF. This would allow you to use the global table for your private traffic. Or you're an ISP and want to keep everything isolated by VRFs, including Internet. That allows you to use your global table just for MPLS.

First, set up your Internet VRF:
<PRE>
ip vrf INTERNET
rd 1:1
!
interface FastEthernet0
description INTERNET CONNECTION
ip vrf forwarding INTERNET
ip address 192.0.2.2 255.255.255.252
!
ip route vrf INTERNET 0.0.0.0 0.0.0.0 192.0.2.1 name DEFAULT_ROUTE
</PRE>

Everything else is configured like any of my other DMVPN examples, with the exception of two things.

Firstly, instead of defining a standard ISAKMP crypto key with the '''crypto isakmp key ...''' command, you'll create a keyring and associate it with a VRF:
<PRE>
crypto keyring CRYPTOKEYRING vrf INTERNET
pre-shared-key address 0.0.0.0 0.0.0.0 key aw3s0m3crypt0k3y
</PRE>

Secondly, you need to associate the encapsulated tunnel traffic with the VRF. This is not the same as just using the '''ip vrf forwarding <VRF>''' command!
<PRE>
interface Tunnel0
tunnel vrf INTERNET
</PRE>

@@ Line 8: / Line 8: @@
 * You want to prevent the local users from using the local internet feed, and force them through some firewalls and content filters at your head office.
 * You're an ISP and want to keep everything isolated by VRFs, including Internet.  That allows you to use your global table just for MPLS.
 ==Configuration==

@@ Line 9: / Line 9: @@
 * You're an ISP and want to keep everything isolated by VRFs, including Internet.  That allows you to use your global table just for MPLS.
 First, set up your Internet VRF:
 <PRE>

@@ Line 31: / Line 31: @@
 </PRE>
-Secondly, you need to associate the encapsulated tunnel traffic with the VRF.  This command tells the router which VRF to use for sending the packets out after they have been given a GRE header and encrypted.  This is not the same as the '''ip vrf forwarding <VRF>''' command, which tells the router which VRF the packets should go in to after they have been received from the internet, decrypted, and have had the GRE header removed.
+Secondly, you need to associate the encapsulated tunnel traffic with the VRF.  This command tells the router which VRF to use for sending the packets out after they have been given a GRE header and encrypted.  This is not the same as the '''ip vrf forwarding <VRF>''' command, which tells the router which VRF the packets should go in to after they have been received from the internet, decrypted, and have had the GRE header removed.  Both commands can be applied to the interface if there are VRFs for the internet and private side.
 <PRE>
 interface Tunnel0
   tunnel vrf INTERNET
 </PRE>

@@ Line 1: / Line 1: @@
 This is the complementary to [[Hosting Multiple DMVPNs]] and [[DMVPN With Multiple VRFs]].
-Let's say you want to have your Internet connection isolated in a VRF.  This would allow you to use the global table for your private traffic.  Or you're an ISP and want to keep everything isolated by VRFs, including Internet.  That allows you to use your global table just for MPLS.
+Let's say you want to have your Internet connection isolated in a VRF.  A couple scenarios why:
 First, set up your Internet VRF: