1 00:00:00,000 --> 00:00:03,960 [AUDIO LOGO] 2 00:00:03,960 --> 00:00:07,930 3 00:00:07,930 --> 00:00:09,790 So the next thing we want to look at 4 00:00:09,790 --> 00:00:13,570 is actually leaking routes between VRFs 5 00:00:13,570 --> 00:00:17,680 or between the global routing table and a VRF. 6 00:00:17,680 --> 00:00:21,790 Now, we already know that we can move routes between VRFs 7 00:00:21,790 --> 00:00:23,530 using route targets. 8 00:00:23,530 --> 00:00:26,590 We've configured our import and export route targets 9 00:00:26,590 --> 00:00:27,880 under our VRFs. 10 00:00:27,880 --> 00:00:31,150 And of course, that's what we've used to control which 11 00:00:31,150 --> 00:00:33,310 routes go into which VRFs. 12 00:00:33,310 --> 00:00:38,170 We would generally consider that normal layer 3 VPN operation. 13 00:00:38,170 --> 00:00:42,700 What we're talking about here is doing it just for some routes. 14 00:00:42,700 --> 00:00:46,270 The problem with doing the import and export route targets 15 00:00:46,270 --> 00:00:49,570 is, it would do all the routes in the VRF. 16 00:00:49,570 --> 00:00:53,360 And maybe, we just want to leak a small portion of them. 17 00:00:53,360 --> 00:00:55,210 So the main thing we're going to do 18 00:00:55,210 --> 00:00:57,760 is something called an export map. 19 00:00:57,760 --> 00:01:00,370 And we're going to use that to put a particular route 20 00:01:00,370 --> 00:01:04,750 target on just a subset of the routes in a VRF. 21 00:01:04,750 --> 00:01:07,210 Now, there's another interesting feature 22 00:01:07,210 --> 00:01:10,480 that we're going to look at on IOS XE. 23 00:01:10,480 --> 00:01:13,340 But we'll save that until we get to look at it. 24 00:01:13,340 --> 00:01:16,690 So let's go ahead and jump in, look at the topology. 25 00:01:16,690 --> 00:01:19,420 We're going to be doing this between customer A and customer 26 00:01:19,420 --> 00:01:20,980 B on router 5. 27 00:01:20,980 --> 00:01:22,818 But let's just take a look at where that is. 28 00:01:22,818 --> 00:01:24,610 And then, we'll jump in to the command line 29 00:01:24,610 --> 00:01:30,130 and get some routes leaking between the two customers. 30 00:01:30,130 --> 00:01:32,490 So as we jump into this demonstration, 31 00:01:32,490 --> 00:01:37,320 remember that there are actually three VRFs on router 5. 32 00:01:37,320 --> 00:01:41,190 We have two for customer A and one for customer B. 33 00:01:41,190 --> 00:01:43,830 And what we're going to be doing is 34 00:01:43,830 --> 00:01:49,080 leaking routes between essentially router 8 and router 35 00:01:49,080 --> 00:01:51,990 10 and, therefore, get connectivity 36 00:01:51,990 --> 00:01:56,020 between these two routers, between the two different VRFs. 37 00:01:56,020 --> 00:01:58,230 So let's go ahead and jump into the command line 38 00:01:58,230 --> 00:02:01,660 and take a look at how this works. 39 00:02:01,660 --> 00:02:06,210 So to start with, let's leak router 10's loopback 40 00:02:06,210 --> 00:02:09,389 into the VRF customer A1. 41 00:02:09,389 --> 00:02:12,210 Now, in order to do this, the first thing we're going to need 42 00:02:12,210 --> 00:02:16,930 is a prefix list to match on router 10's loopback. 43 00:02:16,930 --> 00:02:20,790 So we'll call this PL_CustB_EXPORT, 44 00:02:20,790 --> 00:02:23,460 and it will simply permit router 10's loopback. 45 00:02:23,460 --> 00:02:26,340 The next thing we're going to need is a route map. 46 00:02:26,340 --> 00:02:30,330 We'll call this RM_CustB_EXPORT. 47 00:02:30,330 --> 00:02:34,050 It will match on the prefix list that we just created. 48 00:02:34,050 --> 00:02:37,110 And the key here is, we're going to use this 49 00:02:37,110 --> 00:02:39,630 to set the extended community. 50 00:02:39,630 --> 00:02:42,810 And we're going to add a route target to it. 51 00:02:42,810 --> 00:02:44,490 The route target that we want to add, 52 00:02:44,490 --> 00:02:46,770 we can really just use pretty much whatever. 53 00:02:46,770 --> 00:02:50,470 We'll just use 100:500 for this example. 54 00:02:50,470 --> 00:02:52,380 But here's a real key. 55 00:02:52,380 --> 00:02:56,100 We need to make sure that we do this additive. 56 00:02:56,100 --> 00:02:58,800 If we don't do it additive, this will actually 57 00:02:58,800 --> 00:03:01,710 overwrite the existing route targets. 58 00:03:01,710 --> 00:03:04,290 In which case, this wouldn't get sent 59 00:03:04,290 --> 00:03:06,540 to customer B's headquarters. 60 00:03:06,540 --> 00:03:09,330 So we want to make sure we're not actually breaking anything 61 00:03:09,330 --> 00:03:12,700 when we do this adding of the route target. 62 00:03:12,700 --> 00:03:15,510 So we need to make sure we put additive on there. 63 00:03:15,510 --> 00:03:18,360 Then, we'll go into the customer's VRF, 64 00:03:18,360 --> 00:03:21,030 into the address family, and we'll 65 00:03:21,030 --> 00:03:23,610 add this as an export map. 66 00:03:23,610 --> 00:03:25,704 So it's going to be RM_CustB_EXPORT. 67 00:03:25,704 --> 00:03:28,800 68 00:03:28,800 --> 00:03:31,090 We'll exit configuration. 69 00:03:31,090 --> 00:03:32,820 And now, let's verify that it's actually 70 00:03:32,820 --> 00:03:34,390 added that route target. 71 00:03:34,390 --> 00:03:41,040 So we'll do a show bgp, vpnv4 unicast for the VRF customer B, 72 00:03:41,040 --> 00:03:44,430 and we'll look for the 10.10.10.10. 73 00:03:44,430 --> 00:03:46,740 And we see that, so far, it still just has 74 00:03:46,740 --> 00:03:48,342 the normal route target on it. 75 00:03:48,342 --> 00:03:49,800 So what we're going to do is, we're 76 00:03:49,800 --> 00:03:51,760 going to have to clear this. 77 00:03:51,760 --> 00:03:54,010 So go ahead and clear the connections. 78 00:03:54,010 --> 00:03:55,830 And if we take a look at the command again, 79 00:03:55,830 --> 00:04:01,650 now we see that the route target 100:500 is on this update, as 80 00:04:01,650 --> 00:04:04,470 well as the route target for customer B, which 81 00:04:04,470 --> 00:04:08,770 is the 100:2000 that we've been using this whole time. 82 00:04:08,770 --> 00:04:12,210 So, so far, we've added an export route target 83 00:04:12,210 --> 00:04:13,890 on this update. 84 00:04:13,890 --> 00:04:18,537 Now, we have to get this update to get into customer A's VRF. 85 00:04:18,537 --> 00:04:20,370 And specifically, we're going to be doing it 86 00:04:20,370 --> 00:04:23,820 into customer A1's once VRF. 87 00:04:23,820 --> 00:04:26,310 So we'll go back into configuration. 88 00:04:26,310 --> 00:04:29,040 We'll go into the customer A1 VRF, 89 00:04:29,040 --> 00:04:33,250 and we'll do a route target import of the 100:500. 90 00:04:33,250 --> 00:04:35,010 So now, we should take any routes 91 00:04:35,010 --> 00:04:39,900 with the 100:500, which is now router 10 loopback, 92 00:04:39,900 --> 00:04:43,912 and put that here in the customer A1 VRF. 93 00:04:43,912 --> 00:04:45,870 So let's go ahead and look at the routing table 94 00:04:45,870 --> 00:04:48,030 for customer A1. 95 00:04:48,030 --> 00:04:53,893 And what we see right here is this BGP route for 10.10.10.10. 96 00:04:53,893 --> 00:04:55,560 And we can see a little bit further here 97 00:04:55,560 --> 00:04:58,050 in the line, where it actually tells us 98 00:04:58,050 --> 00:05:02,840 that this has been imported from customer B VRF. 99 00:05:02,840 --> 00:05:07,400 So now, we have a route leaking from the customer B VRF 100 00:05:07,400 --> 00:05:10,100 into one of the customer A VRFs. 101 00:05:10,100 --> 00:05:13,370 Now, we could, of course, do the opposite 102 00:05:13,370 --> 00:05:17,270 to get a route from customer A to go to Customer B. 103 00:05:17,270 --> 00:05:19,730 And that would give us reachability. 104 00:05:19,730 --> 00:05:23,330 However, we want to explore a different option. 105 00:05:23,330 --> 00:05:27,630 IOS XE has a unique way that we can do this. 106 00:05:27,630 --> 00:05:30,260 So let's go ahead and take a look at that. 107 00:05:30,260 --> 00:05:32,030 Before we do that, however, let's make 108 00:05:32,030 --> 00:05:35,060 sure that route's getting all the way out to the customer. 109 00:05:35,060 --> 00:05:37,070 We'll just do a show IP route, and we 110 00:05:37,070 --> 00:05:38,570 see right here that it is. 111 00:05:38,570 --> 00:05:42,590 It's coming in as an OSPF external type 2, 112 00:05:42,590 --> 00:05:45,600 and it's, of course, pointing to router 5 as the next hop. 113 00:05:45,600 --> 00:05:47,420 So this route has made it all the way 114 00:05:47,420 --> 00:05:48,870 through to the customer. 115 00:05:48,870 --> 00:05:51,590 So now, let's go back over to router 5. 116 00:05:51,590 --> 00:05:54,290 And we're going to take a look at this rather unique way 117 00:05:54,290 --> 00:05:59,270 to leak the routes between the VRFs called route replication. 118 00:05:59,270 --> 00:06:01,670 Route replication was actually designed 119 00:06:01,670 --> 00:06:05,906 to be part of easy virtual network or EVN. 120 00:06:05,906 --> 00:06:07,490 EVN is pretty much dead. 121 00:06:07,490 --> 00:06:09,960 We don't really see it in use too much anymore. 122 00:06:09,960 --> 00:06:13,530 However, we still have the route replicate feature. 123 00:06:13,530 --> 00:06:16,020 So let's take a look at how this works. 124 00:06:16,020 --> 00:06:18,510 We'll go back into configuration mode. 125 00:06:18,510 --> 00:06:20,640 We're still going to need a prefix list. 126 00:06:20,640 --> 00:06:25,790 So let's call this prefix list underscore route replicate 127 00:06:25,790 --> 00:06:27,470 from-- 128 00:06:27,470 --> 00:06:29,420 and we'll just call this A1 since the name 129 00:06:29,420 --> 00:06:31,070 is getting a little long. 130 00:06:31,070 --> 00:06:34,640 It's going to be coming from the customer A1 VRF. 131 00:06:34,640 --> 00:06:37,970 And we'll simply say to permit router 8 to loopback. 132 00:06:37,970 --> 00:06:40,490 Once again, we're going to need a route map. 133 00:06:40,490 --> 00:06:43,100 We'll follow the same naming convention, 134 00:06:43,100 --> 00:06:45,630 and we'll tell it to match our address. 135 00:06:45,630 --> 00:06:49,220 So that takes care of our prefix list and our route map. 136 00:06:49,220 --> 00:06:52,100 Then, we go into the customer B VRF, 137 00:06:52,100 --> 00:06:57,483 into the address family IPv4, and we type route-replicate. 138 00:06:57,483 --> 00:06:59,150 And the first thing we have to configure 139 00:06:59,150 --> 00:07:02,310 is what VRF this route is coming from. 140 00:07:02,310 --> 00:07:06,980 So it's going to be coming from the VRF customer A1. 141 00:07:06,980 --> 00:07:09,390 It wants to know if it's unicast or multicast, 142 00:07:09,390 --> 00:07:10,910 so we'll say unicast. 143 00:07:10,910 --> 00:07:13,160 Then, it's going to want to know what routing protocol 144 00:07:13,160 --> 00:07:14,610 is coming from. 145 00:07:14,610 --> 00:07:17,840 Well, this route is originating in OSPF, 146 00:07:17,840 --> 00:07:20,300 specifically process 101. 147 00:07:20,300 --> 00:07:24,470 That's the OSPF process for customer A1. 148 00:07:24,470 --> 00:07:27,080 If we want, we could just hit Enter right now, 149 00:07:27,080 --> 00:07:29,460 and it would bring in all the routes. 150 00:07:29,460 --> 00:07:32,810 So technically, we didn't need a route map, 151 00:07:32,810 --> 00:07:36,330 but we did it, so we could just do this one prefix. 152 00:07:36,330 --> 00:07:38,210 So we'll go ahead and apply our route map. 153 00:07:38,210 --> 00:07:41,540 We'll exit configuration, and we will 154 00:07:41,540 --> 00:07:44,210 have to clear the routing table for customer B 155 00:07:44,210 --> 00:07:46,620 to get this to populate. 156 00:07:46,620 --> 00:07:53,220 So we'll say, clear IP route for the VRF customer B, all routes. 157 00:07:53,220 --> 00:07:55,970 So now, if we look at the routing table for customer B, 158 00:07:55,970 --> 00:08:01,280 notice that we have this OSPF route with a plus. 159 00:08:01,280 --> 00:08:04,850 And if we look up at our legend, the plus 160 00:08:04,850 --> 00:08:07,190 is for a replicated route. 161 00:08:07,190 --> 00:08:09,710 And that's exactly what we just did. 162 00:08:09,710 --> 00:08:12,410 We also see that it's learned this from router 8, 163 00:08:12,410 --> 00:08:14,810 coming from customer A1. 164 00:08:14,810 --> 00:08:17,180 So this is looking good. 165 00:08:17,180 --> 00:08:21,050 But there is one caveat with replicated routes. 166 00:08:21,050 --> 00:08:23,270 If we go out to the customer side, 167 00:08:23,270 --> 00:08:26,810 so router 10 in this case, and we say, show 168 00:08:26,810 --> 00:08:30,770 IP route, notice that network is not 169 00:08:30,770 --> 00:08:33,690 making it out to the customer. 170 00:08:33,690 --> 00:08:36,110 So, here's the dilemma. 171 00:08:36,110 --> 00:08:40,659 If we go back to router 5, we have a question here. 172 00:08:40,659 --> 00:08:44,220 The question is, how do we get this route 173 00:08:44,220 --> 00:08:49,920 into BGP, which is the CEPE that we're running with router 10? 174 00:08:49,920 --> 00:08:52,180 Now, you might think to yourself, 175 00:08:52,180 --> 00:08:55,200 well, it's showing up here as an OSPF route, 176 00:08:55,200 --> 00:09:00,450 so why don't we just redistribute OSPF into BGP? 177 00:09:00,450 --> 00:09:01,990 That's a good thought. 178 00:09:01,990 --> 00:09:05,640 But when you redistribute OSPF into BGP, 179 00:09:05,640 --> 00:09:08,130 you have to give it a process ID. 180 00:09:08,130 --> 00:09:10,800 What process ID are you going to give it? 181 00:09:10,800 --> 00:09:14,490 If you try to give it to 101, that's for a different VRF. 182 00:09:14,490 --> 00:09:19,200 There's no process ID or OSPF identifier associated 183 00:09:19,200 --> 00:09:21,810 with this particular route. 184 00:09:21,810 --> 00:09:24,600 It also doesn't work to do a redistribute connected, 185 00:09:24,600 --> 00:09:28,770 and it also doesn't work to try to inject it into BGP, even 186 00:09:28,770 --> 00:09:30,330 with a network statement. 187 00:09:30,330 --> 00:09:32,910 The network statement doesn't consider that route 188 00:09:32,910 --> 00:09:35,820 to be in the routing table for the purposes of route 189 00:09:35,820 --> 00:09:36,870 injection. 190 00:09:36,870 --> 00:09:40,530 So I never say never, but I'm not 191 00:09:40,530 --> 00:09:44,970 aware of any way to get this route into BGP to send it 192 00:09:44,970 --> 00:09:46,080 to the customer. 193 00:09:46,080 --> 00:09:48,910 And that was really never its intention anyway. 194 00:09:48,910 --> 00:09:52,950 So it's not too surprising that there's not an obvious method 195 00:09:52,950 --> 00:09:54,030 to do that. 196 00:09:54,030 --> 00:09:58,050 The idea here is the customer has a different route 197 00:09:58,050 --> 00:10:00,300 to get to the service provider. 198 00:10:00,300 --> 00:10:01,530 Here's a big hint-- 199 00:10:01,530 --> 00:10:05,610 probably a default route to get to the service provider. 200 00:10:05,610 --> 00:10:07,920 And then the service provider is the one 201 00:10:07,920 --> 00:10:10,350 that has the more specific routes that have been 202 00:10:10,350 --> 00:10:12,570 replicated between the VRFs. 203 00:10:12,570 --> 00:10:15,270 So one possible solution to this problem 204 00:10:15,270 --> 00:10:19,350 would be to have a default route on router 10. 205 00:10:19,350 --> 00:10:21,150 Now, we could either go to router 10 206 00:10:21,150 --> 00:10:24,090 and give it a static default route, pointing to the service 207 00:10:24,090 --> 00:10:27,390 provider, or we could just have the service provider here, 208 00:10:27,390 --> 00:10:30,600 generate a default route for router 10. 209 00:10:30,600 --> 00:10:32,170 So let's go ahead and do that. 210 00:10:32,170 --> 00:10:34,530 Let's have router 5 generate a default 211 00:10:34,530 --> 00:10:37,000 route going to router 10. 212 00:10:37,000 --> 00:10:40,260 So we'll go back into configuration mode into router 213 00:10:40,260 --> 00:10:46,800 BGP 100, into the address family IPv4 unicast for the VRF 214 00:10:46,800 --> 00:10:53,580 customer B. And for the neighbor 192.168.51.10, 215 00:10:53,580 --> 00:10:56,130 we will do a default originate. 216 00:10:56,130 --> 00:11:00,510 We'll exit configuration, and let's go over to router 10. 217 00:11:00,510 --> 00:11:03,010 So let's do our show IP route here again. 218 00:11:03,010 --> 00:11:08,090 And now, we have a default route, pointing to router 5. 219 00:11:08,090 --> 00:11:10,160 So let's think about where we are. 220 00:11:10,160 --> 00:11:12,920 Router 10 has a default route pointing 221 00:11:12,920 --> 00:11:15,800 to its VRF on router 5. 222 00:11:15,800 --> 00:11:18,860 The VRF for customer B on router 5 223 00:11:18,860 --> 00:11:23,150 has a replicated route for router 8 loopback 224 00:11:23,150 --> 00:11:25,280 to go to the other VRF. 225 00:11:25,280 --> 00:11:28,430 That VRF, of course, has customer A's route 226 00:11:28,430 --> 00:11:30,680 because it's had it the whole time. 227 00:11:30,680 --> 00:11:35,630 And going the other way, we're using our export map 228 00:11:35,630 --> 00:11:40,850 to get the route from customer B's VRF into customer A's VRF, 229 00:11:40,850 --> 00:11:45,420 so router 8 has the route to get to router 10's loopback. 230 00:11:45,420 --> 00:11:48,140 So since we have routes both directions 231 00:11:48,140 --> 00:11:51,980 using different methods, but we have routes both directions. 232 00:11:51,980 --> 00:11:54,570 That means we should have connectivity. 233 00:11:54,570 --> 00:11:56,640 Let's give it a test. 234 00:11:56,640 --> 00:11:58,950 Let's do a a trace to 10.8.8.8.8, 235 00:11:58,950 --> 00:12:01,530 sourcing it from our own loopback. 236 00:12:01,530 --> 00:12:03,570 And we see it's not a very far trip. 237 00:12:03,570 --> 00:12:06,570 It goes to router 5, goes directly to router 8, 238 00:12:06,570 --> 00:12:08,440 but it's definitely working. 239 00:12:08,440 --> 00:12:11,940 So our leaking of these routes between the customers 240 00:12:11,940 --> 00:12:16,360 is working exactly as we intended. 241 00:12:16,360 --> 00:12:18,960 So in this video, we looked at how 242 00:12:18,960 --> 00:12:22,980 to leak routes between VR apps for our customers. 243 00:12:22,980 --> 00:12:26,130 We saw how we could do this with either an export map, 244 00:12:26,130 --> 00:12:29,130 or we could do this with route replication, 245 00:12:29,130 --> 00:12:31,650 specifically on IOS XE. 246 00:12:31,650 --> 00:12:34,320 The preferred choice, of course, would normally 247 00:12:34,320 --> 00:12:35,520 be the export map. 248 00:12:35,520 --> 00:12:37,350 That is what they're intended for. 249 00:12:37,350 --> 00:12:41,250 And route replicate is an older feature, 250 00:12:41,250 --> 00:12:43,620 but, again, it is available if we need 251 00:12:43,620 --> 00:12:45,810 to use it for whatever reason. 252 00:12:45,810 --> 00:12:47,340 The next thing we want to look at 253 00:12:47,340 --> 00:12:50,010 is doing conditional label advertisement. 254 00:12:50,010 --> 00:12:52,440 Maybe we don't always need a label 255 00:12:52,440 --> 00:12:55,270 for every prefix in the routing table. 256 00:12:55,270 --> 00:12:58,480 And that's exactly what we're going to take a look at next. 257 00:12:58,480 --> 00:13:01,830 Until then, I hope this has been informative for you, 258 00:13:01,830 --> 00:13:04,970 and I'd like to thank you for viewing. 259 00:13:04,970 --> 00:13:09,000