WEBVTT 00:00:00.000 --> 00:00:08.360 So now we need to learn about Virtual Routing and Forwarding or VRFs for short. 00:00:08.360 --> 00:00:17.160 So what are VRFs? Why do they even exist? Well what we need to understand is that VRFs are a way 00:00:17.160 --> 00:00:23.600 that we can take one of our physical routers and turn it into multiple virtual routers. 00:00:23.600 --> 00:00:31.080 That's right. Let me repeat that. VRF is a way that we can take a physical router and turn it 00:00:31.080 --> 00:00:40.599 into multiple virtual routers. So when you look at this router here, we have a single physical 00:00:40.599 --> 00:00:45.959 router. And notice how we've taken this one single physical router and turn it into three different 00:00:45.959 --> 00:00:52.360 routers. In actuality, it would be four because you would still have the original router plus the 00:00:52.959 --> 00:01:01.720 VRFs. So whenever you create VRFs, you are creating specific VRFs, but your original router still 00:01:01.720 --> 00:01:07.800 exists. And it is its own VRF called the default VRF. So whether you're using VRFs or not, you're 00:01:07.800 --> 00:01:13.879 technically using the default VRF. But after that, you start breaking it up into multiple virtual 00:01:13.879 --> 00:01:19.480 routers and you get more and more and more virtual routers. The thing about this is that you need to 00:01:19.480 --> 00:01:29.000 recognize that for each VRF, you are going to be associating interfaces specifically with that VRF. 00:01:29.000 --> 00:01:38.360 And those interfaces are going to be part of that VRF and no other VRF. And you're also going to 00:01:38.360 --> 00:01:43.959 have a different routing table for each and every single VRF. You're also going to have different 00:01:44.199 --> 00:01:53.639 forwarding tables, ARP caches, and you name it. Everything about that VRF is isolated from every 00:01:53.639 --> 00:02:01.160 other VRF. And therefore, traffic from one VRF cannot interfere with another VRF. 00:02:01.879 --> 00:02:07.000 Now, can we do what is called VRF leaking? Sure, of course we can. And that's really good when 00:02:07.000 --> 00:02:12.839 you have something like a shared service of some type. Let's say in our data center, we have a 00:02:12.839 --> 00:02:18.520 shared DHCP server, and we want to share that DHCP server with all of our VRFs. We could leak 00:02:18.520 --> 00:02:23.960 that particular network that the DHCP server is in, or specifically the DHCP server itself, 00:02:24.600 --> 00:02:28.759 and its associated IP address, maybe just put it in its own subnet as an example, 00:02:28.759 --> 00:02:34.679 and into that VRF. So that way, we can leak that service into all of the VRFs. Same thing with 00:02:34.679 --> 00:02:38.279 a lot of other services. You might have a DNS server. Instead of having a different DNS server 00:02:38.279 --> 00:02:42.440 for every single VRF, we could have one DNS server that we leak into that. So that way, 00:02:42.600 --> 00:02:46.119 we have the ability to use that DNS server, even though it's not part of the VRF. 00:02:46.839 --> 00:02:51.479 So why might you want to use VRFs? So first of all, in the exam, when they talk about VRFs, 00:02:51.479 --> 00:02:56.759 it's because you're trying to isolate different aspects of your network. So for example, 00:02:58.600 --> 00:03:03.320 we have set up right now, we have our different VLANs. We have VLAN 10, VLAN 20, VLAN 30, 00:03:03.320 --> 00:03:07.639 all of those different VLANs in our environment. But once we get to our Layer 3 routed environment, 00:03:08.199 --> 00:03:12.199 once we... Excuse me. One second. 00:03:29.399 --> 00:03:33.880 So we have our different VLANs, but then once we get into our Layer 3 routed environment, 00:03:34.600 --> 00:03:40.759 all of that traffic just intermingles together across the same links, within the same subnets, 00:03:41.320 --> 00:03:47.800 within the same Layer 2, Layer 3 networks, within the same routing tables, within the same routing 00:03:47.800 --> 00:03:53.399 protocols. So although we're isolating down at our VLANs, we're not really isolating anywhere else, 00:03:53.399 --> 00:04:00.520 are we, in our environment. And so if you require the need to isolate that traffic as it's flowing 00:04:00.520 --> 00:04:06.360 through the Layer 3 network, then that's where VRFs are going to come into play in order for you 00:04:06.360 --> 00:04:12.119 to do that. So look at this environment here. If I wanted to isolate the 10 network up here from 00:04:12.119 --> 00:04:16.200 this network here, from this network here, I would essentially have to create three different 00:04:16.200 --> 00:04:20.839 physical networks. So that way there, I could have a separate physical Layer 3 network from 00:04:20.839 --> 00:04:27.320 this network, from this network. But with VRFs, we could combine it all together because now this 00:04:27.320 --> 00:04:33.799 router is actually three different routers. This router right here, I have a VRF for this, I have 00:04:33.799 --> 00:04:39.320 a VRF for this, and I have a VRF for this. We'll call it the red, green, and blue VRFs. And these 00:04:39.320 --> 00:04:42.279 routing tables are going to have different, these routers are going to have different routing tables 00:04:42.279 --> 00:04:46.760 for each and every single one of those VRFs. Notice how I'm still using a physical cable here, 00:04:46.760 --> 00:04:51.880 just one cable. But what are we using? Subinterfaces. So each subinterface is going to 00:04:51.880 --> 00:04:58.200 be part of a different VRF. Each subinterface is going to be part of a different routing process. 00:04:58.920 --> 00:05:02.279 So that way there, I can isolate and separate everything out when it's all said and done. 00:05:03.160 --> 00:05:07.880 So I just want to go ahead and demonstrate this for you. We're going to build a virtual network, 00:05:07.880 --> 00:05:12.359 a VRF in our particular case, in our topology that we have right here. 00:05:14.200 --> 00:05:20.119 So our goal here, let's say, is we're going to take this network here. No, actually, I have a 00:05:20.119 --> 00:05:22.920 different network set up right now for this, because I didn't want to mess everything up 00:05:23.559 --> 00:05:29.160 for our discussions on GRE after the fact. So let's go to DSW-1, 00:05:29.160 --> 00:05:33.880 and I'm going to type in show IP interface brief. And you'll see here that we have 00:05:36.519 --> 00:05:41.880 this VLAN up and running right now. So that particular network is going to be, 00:05:41.880 --> 00:05:47.959 let's just check its subnet mask with show IP interface VLAN 421. 00:05:49.559 --> 00:05:58.040 So we are dealing with the network over here. I'll just write it out here, 10.40.12.0 00:05:58.679 --> 00:06:05.959 slash 26. That's what we have over here right now. 10.40.12.0 slash 26. Let's go over to branch. 00:06:05.959 --> 00:06:12.440 And over on branch, we have directly connected to us, let's go with this one right here, 00:06:13.000 --> 00:06:23.079 10.0.255.0 slash 24. So I write that out over here, 10.0.255.0 slash 24. So what we're going 00:06:23.079 --> 00:06:30.920 to do is we are now going to put both of these networks in their own VRF, a completely different 00:06:30.920 --> 00:06:36.359 routing process on these routers. And their traffic is not going to be allowed to intermingle 00:06:36.359 --> 00:06:40.119 with any other traffic on this network. They're going to have their own routing tables. They're 00:06:40.119 --> 00:06:44.200 going to have their own everything. In addition to that, I'm now going to have to modify the rest 00:06:44.200 --> 00:06:48.600 of my network here. I'm going to have to modify the rest of my network. So that way there, 00:06:49.160 --> 00:06:58.359 I carve up this environment. So that way there, there is a virtual network for the VRF. 00:06:59.079 --> 00:07:05.000 So let's call the VRF here. Somebody tell me what we're going to call this VRF. What's the name 00:07:05.000 --> 00:07:11.399 going to be for this? Give me a name. I can name it anything I want. First person who chats in a 00:07:11.399 --> 00:07:16.359 name, we're going to call the VRF that. It doesn't matter. You might name your VRFs based on 00:07:16.359 --> 00:07:20.920 departments. You might base them based on customers. You might base them on anything you want. 00:07:21.880 --> 00:07:29.480 But maybe we'll do VRF. Anybody? Anybody? No names? Nobody? Everybody is asleep right now? 00:07:33.399 --> 00:07:36.359 WMH. What does that stand for? What does that mean? 00:07:37.160 --> 00:07:40.920 I don't want to write it out and then all of a sudden it's inappropriate. 00:07:43.720 --> 00:07:45.559 Where the magic happens. Awesome. 00:07:45.880 --> 00:07:50.920 Where magic happens. I like it. So that's what we're going to do. 00:07:52.920 --> 00:07:59.720 So first things first, let's show you how to create your VRFs. So we're going to type in 00:07:59.720 --> 00:08:08.600 configure terminal. We're going to type in VRF definition. And when I type in VRF definition, 00:08:09.000 --> 00:08:12.040 and when I type in VRF definition, this is where I give it our name. 00:08:13.399 --> 00:08:19.959 We said we're going to call it where the magic happens. All right. Now, if I put in question 00:08:19.959 --> 00:08:23.079 mark, what you're going to see is that we have things for address families. That's what I want 00:08:23.079 --> 00:08:28.839 to talk about right now. So address families are so that way there we can set it up for IPv4. 00:08:29.399 --> 00:08:34.039 And we can set it up for IPv6. Right now we only have an IPv4 network. So I'm going to type in 00:08:34.119 --> 00:08:45.000 as IPv4 here and then type in unicast. And that's it. So for IPv4 unicast. Now, since I did not type 00:08:45.000 --> 00:08:52.520 it in for IPv6, it's not going to go into effect for IPv6. So right now if we type in do show run 00:08:52.520 --> 00:09:03.960 pipe to section VRF, you'll see that we now have a VRF configured. And the VRF is VRF definition 00:09:04.200 --> 00:09:12.599 WMH where the magic happens. And our address family is IPv4, meaning that it's been turned 00:09:12.599 --> 00:09:19.719 on and enabled for IPv4 networks and traffic and interfaces. So if I want it enabled for IPv6, 00:09:19.719 --> 00:09:24.200 all I have to do is type in address family IPv6. All right. So with that in mind, 00:09:25.159 --> 00:09:30.440 now what do we need to do? Well, if we type in do show VRF, 00:09:31.559 --> 00:09:38.280 you'll see that I have the VRF created, but there are no interfaces that are part of that VRF. 00:09:43.320 --> 00:09:47.960 Also, if we type in do show IP route VRF, 00:09:47.960 --> 00:10:05.719 we have our very own routing table for this VRF. 00:10:17.960 --> 00:10:43.719 Interesting, isn't it? So let's go ahead now and take interface VLAN 421 and move it to this VRF. 00:10:48.039 --> 00:10:51.719 We are now going to type in, since we're in interface VLAN 421 configuration mode, 00:10:55.719 --> 00:11:05.400 VRF forwarding. And in the name of the VRF, and I'm going to hit enter. Notice it says it has 00:11:05.400 --> 00:11:13.239 just removed the IP addressing off my interface. That's why I showed you this. We had an IP address 00:11:13.400 --> 00:11:22.840 now it's gone. Why? Because I have just moved that interface from the subnet it lived in, 00:11:22.840 --> 00:11:29.559 where it was, to now a completely different VRF. A totally different routing process on this router. 00:11:30.359 --> 00:11:35.000 So now I have to reconfigure it. So I want you to remember that for the exam. 00:11:35.159 --> 00:11:39.559 So now I have to reconfigure it. So I want you to remember that for the exam. 00:11:41.320 --> 00:11:47.479 You have to type in VRF forwarding, and then you will have to put the IP address on the interface 00:11:47.479 --> 00:11:51.960 that you want. In this case, we're just going to use the same one. I'm perfectly fine with that. 00:11:53.080 --> 00:11:58.039 But always remember the order here. If you do the IP address first, 00:11:58.599 --> 00:12:04.119 and then you go ahead, and you type this in, it will remove the IP address off the interface. 00:12:09.640 --> 00:12:14.599 And if they're not logging anything on the exam, and you forget that, and you're doing a config, 00:12:14.599 --> 00:12:17.640 does that mean that you actually won't have an IP address on your interface? Yeah, 00:12:17.640 --> 00:12:21.080 that's what that means. Which means it's not going to work for you. And you'll be troubleshooting, 00:12:21.080 --> 00:12:24.520 why did that work? Why did that work? It's all because the IP address was removed. 00:12:24.520 --> 00:12:28.440 It happens automatically. You can't do anything about that. You got to add it in after the fact. 00:12:29.320 --> 00:12:33.159 So go to the interface, VRF forwarding, the name of the VRF, 00:12:33.159 --> 00:12:36.200 then put in the IP address and something else you need. Remember those three steps. 00:12:38.440 --> 00:12:42.760 All right. So now that this is done, let's type in do show VRF. 00:12:43.640 --> 00:12:46.760 And you'll see that VLAN 421 is part of this VRF. 00:12:46.919 --> 00:12:55.719 Now, let's look at the routing table again. Do show IP route VRF WMH. 00:12:57.880 --> 00:13:04.599 And we have our interface in this routing table with its network ID. Let's go back to our 00:13:04.599 --> 00:13:12.599 global routing table or the default VRF. And we're going to go back to our global routing table. 00:13:12.599 --> 00:13:20.840 Global routing table or the default VRF routing table. And you'll see that that network is no 00:13:20.840 --> 00:13:27.640 longer in here. So it was in here before 10.40.12. It would have shown up here. Let's go back up. 00:13:28.280 --> 00:13:30.200 You'll see that in the routing table from before. 00:13:32.919 --> 00:13:39.239 10.40.12.0. There it is. It's no longer in here because it doesn't belong to the default VRF 00:13:39.239 --> 00:13:44.760 anymore. It belongs to what? The new VRF. And notice it never says default VRF or anything 00:13:44.760 --> 00:13:49.559 like that, but that's a term they use. So default VRF on the exam means your normal 00:13:49.559 --> 00:13:55.960 routing table, your default routing table. Default VRF, default routing table, global routing table, 00:13:55.960 --> 00:14:00.679 all terms used interchangeably on the exam for the same thing. And then your other VRFs have 00:14:00.679 --> 00:14:07.320 their own routing tables. So I can have lots of VRFs on my router. So technically speaking, 00:14:07.320 --> 00:14:15.640 if I wanted to take every single one of my subnets and my end user networks and essentially 00:14:15.640 --> 00:14:20.520 create VRFs for them and then create VRFs for where the resources are and do all of that for 00:14:20.520 --> 00:14:28.840 isolation, you could totally do that. So Andrew, the command I showed was this. 00:14:28.840 --> 00:14:34.119 So if you type in show IP route, it shows you the default routing table, the default VRF. You have 00:14:34.119 --> 00:14:44.599 to type in this command. So show IP route. Oh, you mean, oh, if you want to look at it specifically 00:14:44.599 --> 00:14:48.760 like this one here, that's what you mean? Okay, let me show you that then. So do show, 00:14:49.640 --> 00:14:55.960 if you type in IP route, it will be say 10.40.12.0 slash 26. 00:14:56.919 --> 00:15:00.440 See, subnet not in table. You see that? Subnet not in table. 00:15:06.359 --> 00:15:10.440 So what you'd have to do is you'd have to type in VRF. 00:15:17.880 --> 00:15:19.640 Wrong spot. It's got to go before it. 00:15:26.440 --> 00:15:34.440 There you go. Now you can see it that way. Is that what you were looking for? 00:15:42.599 --> 00:15:48.440 Now let's think about OSPF for a second. Right now we have an OSPF process running. 00:15:48.760 --> 00:15:55.000 Yeah. So again, Nexus does it differently. And the thing is we're preparing for iOS 00:15:55.000 --> 00:16:02.200 on this certification exam. Yeah. So we have this OSPF process running. Now remember, 00:16:02.200 --> 00:16:09.559 every single interface that is participating right now in this OSPF process is part of my 00:16:10.119 --> 00:16:21.000 global routing environment, my default routing table, my default VRF. So I wouldn't be able to 00:16:21.000 --> 00:16:28.039 put an interface that is in a different VRF in this routing process. You can't do that. 00:16:28.919 --> 00:16:35.080 So let's create another routing process. Let's create, for example, router OSPF. 00:16:35.239 --> 00:16:41.159 We'll call it OSPF process number two. And we're going to type in VRF. 00:16:42.119 --> 00:16:46.599 And we're going to create this one for our WMH. 00:16:51.559 --> 00:16:54.679 Right. So now we have a totally different routing process. Let's type in router ID. 00:16:54.679 --> 00:17:02.919 I'll give it 0.0.0.1, 2, 3, 4, 3 in this case. Okay. So notice how the router ID is 00:17:03.320 --> 00:17:08.280 used by that process. So I can't use the same router ID. So let's go ahead and put 13 in there 00:17:08.280 --> 00:17:15.239 or 12. Let's change it to 13. Right. But there you go. There's an example of setting up now 00:17:15.239 --> 00:17:18.439 a different routing process for a different VRF. 00:17:32.920 --> 00:17:45.479 So there's process number two. So let's go ahead and let's go back into that process. 00:17:48.280 --> 00:17:54.280 And let's type in, for example, something like passive interface VLAN 421, just for fun, 00:17:54.280 --> 00:17:57.400 just to show you that, you know, we can still do passive interface. We can still 00:17:57.400 --> 00:18:01.719 do a whole bunch of different options. Well, let's go to interface VLAN 421 now, 00:18:01.719 --> 00:18:07.239 and let's type in IP OSPF 2. And let's put it, let's just do area 0 for this example. 00:18:10.439 --> 00:18:16.040 So I can build an entirely different OSPF process with entirely different interfaces 00:18:16.040 --> 00:18:21.719 participating in different areas for this entire VRF. It doesn't have to match the same 00:18:21.719 --> 00:18:25.400 area boundaries as we did with our other routing process. That's right. 00:18:26.839 --> 00:18:31.560 So documentation is really important when you're doing VRFs and ensuring that you have a document 00:18:31.560 --> 00:18:35.719 for this VRF and this VRF and this VRF and that you're using the right commands to verify 00:18:35.719 --> 00:18:43.719 everything. So now if I type in do show IP OSPF interface brief, for example, what are we seeing 00:18:43.719 --> 00:18:50.520 here? Oh, right. It shows me all of them. You see that? But pay attention, process ID number two. 00:18:51.160 --> 00:18:53.959 Process ID number two, that's for something totally different. 00:18:55.640 --> 00:19:02.280 If I type in do show IP OSPF database, there's a database for process ID one, 00:19:02.280 --> 00:19:05.800 there's a database for process ID two. So we have a different database for that. 00:19:10.920 --> 00:19:16.359 Now, if you're using OSPF address families, then you would have a different address family for each 00:19:16.359 --> 00:19:20.359 and every single one of your VRF. So you'd have one process, but different address families for 00:19:20.359 --> 00:19:36.439 each and every single one of them. Now, if we go over here between DSW1 and R2, 00:19:37.719 --> 00:19:49.000 because this is an iOS router, I cannot create subinterfaces here. Subinterfaces are not allowed. 00:19:49.959 --> 00:19:55.959 So in reality, what I'm doing would not be the best solution in the real world, because 00:19:57.239 --> 00:20:04.119 I would have to dedicate this entire link to my VRF, which is not something I would want to do 00:20:04.119 --> 00:20:07.239 in the real world. Now, there are other multilayer switches out there that allow you to do sub 00:20:07.239 --> 00:20:11.640 interfaces on routed ports nowadays. Okay, well, this one doesn't support it because it's too old. 00:20:12.599 --> 00:20:16.760 So I'm just going to go ahead and show you how you can take an entire physical interface 00:20:17.640 --> 00:20:22.520 and throw it into a VRF. But more than likely, in a real production environment here, 00:20:22.520 --> 00:20:27.560 you would be doing a subinterface between those two entities. So that way there, you could use 00:20:27.560 --> 00:20:34.199 that link for different VRFs, and not just associated with one very specific VRF, right? 00:20:34.199 --> 00:20:38.920 So this is just for demonstration purposes. You can see how this works. But what we're going to 00:20:38.920 --> 00:20:44.280 do is we're going to go to interface, gigabit ethernet 1.0.0.14. And again, what are we going 00:20:44.280 --> 00:20:50.359 to type in here? We're going to type in, I'm going to grab the IP address first, do show I run 00:20:51.079 --> 00:20:56.199 interface gigabit ethernet 1.0.0.14. And what we're going to type in, oh, and notice we're 00:20:56.199 --> 00:21:02.599 in IP OSPF area one. So let's see what happens here. If I say VRF forwarding, and 00:21:05.400 --> 00:21:09.880 WMH. So you'll see here that the interface addresses were removed, 00:21:10.439 --> 00:21:18.119 OSPF went down. So if you look at the output now, you'll see that everything's gone. Everything's 00:21:18.119 --> 00:21:25.000 gone. So what we're going to do, remember we have HSRP tracking on and everything. That's 00:21:25.000 --> 00:21:31.239 why we're seeing all these HSRP messages. So now though, let's go ahead and put it in the VRF. 00:21:33.000 --> 00:21:38.199 Or we already put it in the VRF, I should say. And now we are going to put the IP address on it. 00:21:38.199 --> 00:21:45.000 I still want this IP address. And now we're going to type in IP OSPF two area zero. 00:21:45.959 --> 00:21:50.040 So if we type in do show IP OSPF interface brief now, 00:21:50.599 --> 00:21:54.199 you'll see that I've got the two interfaces as a part of OSPF process number two. 00:21:57.160 --> 00:22:04.040 Go over to somebody like R2 right now. If we look at our interface, gigabit ethernet 0.0. 00:22:04.680 --> 00:22:08.199 Right, I want to make sure it's in the right VRF. So first of all, let's create our VRF, 00:22:08.760 --> 00:22:10.280 VRF definition. 00:22:14.439 --> 00:22:19.079 And then we're going to have to type in address family IPv4, unicast. 00:22:21.400 --> 00:22:25.160 And then we're going to go ahead and we're going to go to our interface. So interface 00:22:25.160 --> 00:22:26.359 gigabit ethernet 0.0. 00:22:26.359 --> 00:22:34.280 And actually, let's create a routing process. First, let's do router OSPF two for VRF, WMH. 00:22:37.079 --> 00:22:41.079 And then we're going to type in router ID don't need one by a typical router ID. 00:22:43.479 --> 00:22:51.400 We'll type in what we want to do here, 0.0.0.99 for fun. And then let's go ahead and 00:22:52.359 --> 00:22:55.319 go back to interface gigabit ethernet 0.0. 00:23:00.359 --> 00:23:05.319 VRF definition or no VRF forwarding. 00:23:08.839 --> 00:23:15.319 Now let's type in IP address and our IP address is 10.40.23. 00:23:15.959 --> 00:23:27.479 Now let's type in IP address and our IP address is 10.40.23.5, 0.0, 2 by 5, 2 by 5, 2 by 5, 00:23:27.479 --> 00:23:33.160 2 by 2, and IP OSPF two area zero. And we should form a neighbor adjacency 00:23:33.880 --> 00:23:39.560 with DSW1 across that interface. And there we go, we have. 00:23:40.520 --> 00:23:48.280 So again, now if we take a look at do show IP route here, you'll notice that there is no reference 00:23:48.839 --> 00:23:54.439 to 10.40.12.0 in this routing table. And if there is, that means I've done something wrong. 00:23:55.479 --> 00:24:00.280 And there's not. But if we look at this routing table instead, VRF, 00:24:04.040 --> 00:24:08.520 you'll now see that we have learned that. And it's specifically in this routing table 00:24:09.479 --> 00:24:22.040 and no other routing table. Now let's go over to the other interface. So interface 00:24:22.040 --> 00:24:31.400 fastethernet 0.1.0. And let's type in VRF forwarding. And let's put our IP address on 00:24:31.400 --> 00:24:42.839 that interface. Now IP address is going to be 10.45.33.1, 2 by 5, 2 by 5, 2 by 5, 2 by 2, 00:24:42.839 --> 00:24:49.319 and then IP OSPF two area zero. I'm just going to put it all in area zero in this case, 00:24:49.959 --> 00:24:59.079 in this example. And so if we look at our routing table, we'll see that that interface is now part 00:24:59.079 --> 00:25:09.479 of this VRF. So it's no longer this interface. Oh, let's pause there. Okay, so right now notice 00:25:09.479 --> 00:25:15.959 how I took the whole physical interface, and I moved it to this VRF. Okay, so that's a problem 00:25:15.959 --> 00:25:23.560 for us. Why is that a problem for us? Because now this link here can't be used for any of the other 00:25:23.560 --> 00:25:27.000 subnets, any of the other VLANs, any of the other broadcast domains we have. 00:25:27.959 --> 00:25:31.719 So I'm going to show you instead how to use subinterfaces between there. 00:25:32.520 --> 00:25:39.959 So let's go ahead and remove this now instead. We'll take it out of there. 00:25:46.439 --> 00:25:48.119 Let's look at our interface config. 00:25:57.479 --> 00:26:00.760 All right, so no IP address, IP network, point to point, all that's normal. So now 00:26:01.400 --> 00:26:04.520 let's go ahead and create a subinterface instead. So if we go interface 00:26:05.319 --> 00:26:11.239 fast even at 0 slash 1 slash 0 dot, let's just do 100 here. 00:26:13.319 --> 00:26:16.520 Now what we can do is we can put the subinterface in the VRF, 00:26:17.079 --> 00:26:31.880 and then let's put, let's do IP address 10 dot 45 dot 33. No, let's do 243. In this case 1045, 00:26:31.880 --> 00:26:39.479 43, 1, 255, 255, 255 dot 252. So we'll do 43 for the other one here, 43. 00:26:40.280 --> 00:26:43.640 All right, but I got my error. Why? Just like we talked about in your VLAN routing, 00:26:43.640 --> 00:26:47.880 you have to put your encapsulation first. So because it's a subinterface, I need an encapsulation 00:26:48.439 --> 00:26:55.239 dot 1Q. Then I got to use a VLAN. Let's use VLAN 100 for this. So I'm using, you got to use VLANs 00:26:55.239 --> 00:27:03.800 whenever you're doing VRFs on subinterfaces. And now we can go ahead and do a VLAN 100. 00:27:03.800 --> 00:27:19.479 So let's go ahead and take a look at our config. That's the physical interface, 00:27:19.479 --> 00:27:23.000 but if we type in dot 100, you'll see there's our subinterface. 00:27:23.719 --> 00:27:27.400 So we look at our routing table now, we should, for that VRF, you should see that it's different. 00:27:27.400 --> 00:27:35.640 All right, because we got the subinterface in there now for that particular network. 00:27:44.839 --> 00:27:49.400 Can the physical interface still be part of our old routing environment? Absolutely, 00:27:49.400 --> 00:27:56.040 absolutely. Which it's been removed. Why? Because of the fact that what happened to us. 00:27:57.719 --> 00:28:03.719 What did we do? I took it all off. So let's add it back in now. Interface FastEthernet 0 slash 00:28:03.719 --> 00:28:12.119 1 slash 0. IP address 10 dot 45 dot 33 dot 1, 2 by 5, 2 by 5, 2 by 5, 00:28:14.280 --> 00:28:24.199 2 by 2. And then let's say that you are IP OSPF 1 area 0. All right. 00:28:27.400 --> 00:28:43.719 All right. So we've got this side set up. Let's go over to branch and set up branches 00:28:43.719 --> 00:28:50.680 subinterface now. Oops, that's right. We're not area 0 on that. I got to go back. 00:28:52.040 --> 00:28:56.040 That's why it's not working. I just realized I'm like the neighborhood hasn't come up yet. 00:28:56.760 --> 00:29:03.319 Why is that wrong area? Because in our other environment or we have this as area one 00:29:04.439 --> 00:29:10.439 from our OSPF days. So there, that's fixed up now. All right. So going over to branch, 00:29:11.160 --> 00:29:15.880 configure terminal and we'll type in VRF definition. 00:29:19.160 --> 00:29:22.520 And then we're going to say address family IPV for Unicast. 00:29:23.400 --> 00:29:28.839 Exit out of there now that we've created the VRF and we're going to go to interface gigabit 00:29:28.839 --> 00:29:33.400 Ethernet 0 slash 0 dot and we'll create a subinterface on that gig interface. 00:29:33.400 --> 00:29:40.760 Say encapsulation dot 1 Q 100 to match the other side. And then we will type an IP address and we 00:29:40.760 --> 00:29:49.319 said it's 10 dot 45 dot 43 dot 2, 2 by 5, 2 by 5, 2 by 5 dot 2 by 2. Let me just make sure 00:29:49.319 --> 00:29:58.520 that address is 100 percent correct. 10, 45, 43, 1, 10, 45, 43, 2. That looks good. 00:29:58.520 --> 00:30:03.160 Oh, I didn't put it in the VRF, did I? I did not put it in the VRF. So 00:30:03.800 --> 00:30:08.199 if I hit enter there and now we say VRF forwarding. 00:30:11.959 --> 00:30:15.640 Right now you'll see the address is gone again. So I got to put it all back in. 00:30:15.640 --> 00:30:19.719 So be mindful of that on the exam, that if you actually do it in the wrong order, 00:30:19.719 --> 00:30:22.839 then you're going to have to re-input all the commands again. Keep that in mind. 00:30:24.280 --> 00:30:29.479 All right. So if we take a look at do show IP route, we shouldn't see 10 dot 40 in here. 00:30:31.880 --> 00:30:36.839 Like we talked about before, 10, 40, 12, 0 shouldn't be in here. Which VRF is it in? 00:30:36.839 --> 00:30:45.160 It's in our other VRF. And there you go. Oh, no, it's not in here yet. Why? We didn't put 00:30:45.640 --> 00:30:55.800 IP OSPF. We've got to create a routing process. IP router OSPF to VRF. Got to set that up first. 00:30:59.400 --> 00:31:07.000 And then go back to our interface, gigabit ethernet 0 slash 0 dot 100. IP OSPF to area 0 00:31:07.000 --> 00:31:13.880 as an example. And we should form a neighborship over with that router R2 on that particular link. 00:31:15.640 --> 00:31:26.920 All right. And then lastly, let's not forget about our sub interface right here. So do 00:31:26.920 --> 00:31:32.920 show run interface fast ethernet 0 slash 0 slash 0 dot I think it's 25. 00:31:35.319 --> 00:31:41.079 There it is. So what we're going to do is we're going to put this entire interface in our WMH 00:31:41.079 --> 00:31:54.920 VRF. So we'll type in this. Then we'll type in VRF forwarding. So, folks, for the exam, 00:31:54.920 --> 00:31:58.040 it's quite possible you might have to do this on multiple devices. Just keep that in mind. 00:32:00.520 --> 00:32:03.880 Maybe not as many as I've done here, but it's quite possible you might have to do 00:32:03.880 --> 00:32:07.319 something like this. So know the steps. Know the commands. You have to know them. 00:32:12.359 --> 00:32:15.640 All right. Now we're going to put back in what? We're going to put back in our IP. Oh, 00:32:15.640 --> 00:32:19.640 we're going to put in this. Then we're going to put in this. 00:32:22.439 --> 00:32:25.959 And then we're going to put an IP OSPF to area 0. 00:32:26.439 --> 00:32:34.520 So do show IP OSPF interface brief. All right. So we got those two interfaces spinning around 00:32:34.520 --> 00:32:48.520 in process. 00:32:56.839 --> 00:33:05.319 So IP route VRF. All right. My neighborhood's not forming between R2 and branch. I've done 00:33:05.319 --> 00:33:14.520 something wrong in my config. Yeah, let me double check that. 00:33:14.599 --> 00:33:23.000 So these two are in area 0, but I'm in area 0 over on R2. That's what we set up here. Everybody 00:33:23.000 --> 00:33:27.800 was supposed to be in area 0 for this one. Do show IP OSPF interface brief. Did I do it wrong 00:33:28.760 --> 00:33:33.959 over here? Let's check our IP address. 00:33:39.959 --> 00:33:43.959 All right. So I'm in area 0, but I'm in area 0 over on R2. 00:33:43.959 --> 00:33:47.959 So I'm in area 0, but I'm in area 0 over on R2. 00:33:47.959 --> 00:33:53.959 So I'm in area 0, but I'm in area 0 over on R2. 00:33:54.680 --> 00:33:59.400 Let's check out this, because this is the sub interface. I don't, I think I forgot to 00:33:59.400 --> 00:34:08.919 enable the routing process there. Yeah, it's not enabled. That's why. IP OSPF to area 0. 00:34:08.919 --> 00:34:10.120 Now that should work between them. 00:34:16.840 --> 00:34:20.520 Yeah, there you go. All right. So now I've got it. Just forgot to enable OSPF on that 00:34:20.600 --> 00:34:25.800 sub interface. Too much config. All right. So take a peek at this now. You'll see that 00:34:25.800 --> 00:34:34.120 I've learned about that network all the way over on there, over on this router. And it's 00:34:34.120 --> 00:34:41.320 in its own routing table. We have our own routing construct. We have our own OSPF process 00:34:41.320 --> 00:34:49.800 for this network. So it's isolated. It's segmented. Segmented, segmented, segmented. 00:34:49.800 --> 00:34:54.199 Segmented. All of that stuff that we need in order to accomplish our objective. 00:34:55.639 --> 00:35:02.120 All right. So that is VRFs, folks. And we call this VRF Lite. It allows you to build 00:35:02.120 --> 00:35:08.120 virtual networks on top of your Layer 3 infrastructure. So VLANs are your virtual 00:35:08.120 --> 00:35:13.959 construct for Layer 2. So VLANs and trunks, I should say, are your virtual construct for Layer 00:35:13.959 --> 00:35:21.639 2. And then for Layer 3, you've got your VRFs. Now VRFs are very, very popular with what? With 00:35:21.639 --> 00:35:29.800 service providers. Why are they very popular with service providers? Because of a service called 00:35:29.800 --> 00:35:39.639 MPLS Layer 3 VPNs, which are not a topic of this specific certification exam. But there's something 00:35:39.639 --> 00:35:47.239 that is commonly used with MPLS Layer 3 VPNs. We call them Route Targets and Route Distinguishers. 00:35:48.600 --> 00:35:56.520 And you are expected to know that here in our discussion of VRFs only because you can use Route 00:35:56.520 --> 00:36:02.439 Targets and Route Distinguishers even if you're just working with VRF Lite. Even though I didn't 00:36:02.439 --> 00:36:07.800 need them in this particular case. All right. Even though I didn't need them in this particular case, 00:36:08.679 --> 00:36:14.360 it is just something that you have the opportunity to use. So what I'm going to do is I'm going to 00:36:14.360 --> 00:36:25.159 use some slides that I have for my MPLS Layer 3 VPN discussion. So this environment here from 00:36:25.159 --> 00:36:31.320 this router all the way to this router, this is the service provider's environment. 00:36:32.040 --> 00:36:35.479 This is their MPLS domain. If you don't know what MPLS is, that's okay. 00:36:37.320 --> 00:36:43.879 This, let's say, is you. And this is, let's say, your headquarters. 00:36:45.000 --> 00:36:49.639 And this over here is also you, but this is your branch office. 00:36:53.560 --> 00:36:54.919 So if you look down here, 00:36:55.719 --> 00:37:03.879 what do we have? Let's say this is me. And this is my branch office. And this is me. 00:37:04.679 --> 00:37:12.120 And this is my headquarters. Notice how we're both connected up here. 00:37:13.879 --> 00:37:19.639 Notice how we're both connected up here. Notice how we're both going to use this MPLS environment. 00:37:20.520 --> 00:37:25.639 So first of all, the service provider is going to use what? VRFs to isolate routes learned 00:37:25.639 --> 00:37:30.600 from the CE routers. What are the CE routers? Those are your routers. CE router. CE router. 00:37:30.600 --> 00:37:36.600 Those are your routers. CE router. CE router. Those are my routers. Okay. So the CE routers 00:37:36.600 --> 00:37:40.360 are in the possession of the customer of the service provider, me and you. 00:37:41.560 --> 00:37:45.080 So now the service provider on this router, what do they need to do? 00:37:45.959 --> 00:37:53.000 They need to isolate your routes from my routes. Because the goal here is for you to be able to 00:37:53.000 --> 00:38:02.520 take your routes here and train branch about those routes and train headquarters about branches 00:38:02.520 --> 00:38:08.760 routes. So that way there you can successfully route traffic from your headquarters to your 00:38:08.760 --> 00:38:15.479 traffic from your headquarters to your branch and back through the MPLS environment. 00:38:17.719 --> 00:38:24.679 And same thing with me. So notice how on this router, there's a VRF table for you and there's 00:38:24.679 --> 00:38:32.439 a VRF table for me. There's a VRF table over here as well on this side for you and me. 00:38:33.399 --> 00:38:39.000 So typically what would happen here is let's say you're running OSPF and I'm running EIGRP. 00:38:40.360 --> 00:38:49.000 You're running OSPF. I'm running EIGRP. What's running in here? Multi-protocol BGP. 00:38:52.360 --> 00:38:57.560 As a result of that, you are going to be running BGP here typically as well. 00:38:58.120 --> 00:39:02.840 And same thing with me. And so you're going to redistribute from your routing protocol 00:39:03.879 --> 00:39:13.159 into BGP. So you redistribute, I redistribute. So now you have BGP, eBGP. Neighborships 00:39:14.199 --> 00:39:20.439 with the service provider. And so when they receive your routes as BGP routes, 00:39:20.439 --> 00:39:24.679 they're going to put your BGP routes in here and they're going to put my BGP routes in here. 00:39:25.639 --> 00:39:28.280 And this is going to happen on both sides. 00:39:31.479 --> 00:39:38.280 And so now that they've been able to successfully put all of that information into the VRFs and BGP, 00:39:38.280 --> 00:39:45.080 they'll have the ability to work the BGP magic with Layer 3 MPLS VPNs and basically take the 00:39:45.080 --> 00:39:49.959 information here, share it here, etc. And then they're going to be able to put it into the 00:39:49.959 --> 00:39:55.800 Ns and basically take the information here, share it here, etc. Take the information here, 00:39:55.800 --> 00:40:03.320 share it here. And the end result is what? The end result is that each side, each VRF table 00:40:03.320 --> 00:40:09.560 learns about the other information. And then that information can be sent via BGP to here. 00:40:09.560 --> 00:40:14.439 And then I redistribute it back or you redistribute it back into OSPF. And then the information from 00:40:14.439 --> 00:40:19.080 here via BGP can come down here, which then I redistribute back into EIGRP. 00:40:20.840 --> 00:40:27.479 So that's the whole premise here of MPLS. Okay, I don't worry about any of this. This is not me. 00:40:27.479 --> 00:40:32.679 This is what the service provider does. I don't worry about any of this stuff in this type of 00:40:32.679 --> 00:40:38.040 case. I worry about taking my routes, redistributing the BGP and forming that EBGP session with the 00:40:38.040 --> 00:40:44.919 service provider. But here's the problem we can run into in this case. Overlapping address spaces. 00:40:45.239 --> 00:40:50.199 Problem. Overlapping address spaces. And this can happen to you with your VRFs as well. So that's 00:40:50.199 --> 00:40:53.879 why we're talking about this right now. Because even if you're not doing this and you're using 00:40:53.879 --> 00:41:00.919 VRF like we did in our environment, what happens if two of your networks that are in different VRFs 00:41:00.919 --> 00:41:07.000 have the exact same addressing space? It can happen. Because remember, these are different 00:41:07.000 --> 00:41:13.639 isolated processes. They're totally separate from each other. You could have the same network 00:41:13.879 --> 00:41:23.800 twice now. So how do you make sure that that overlapping address space, you see them, 00:41:23.800 --> 00:41:32.840 there they are, you are using 10.0.1.0.24, I am using 10.0.1.0.24. How do we make sure that doesn't 00:41:32.840 --> 00:41:40.280 cause confusion when it's brought into BGP? Because in this VRF table, it's okay. In this VRF 00:41:41.000 --> 00:41:47.639 table, it's okay. But when we start sharing it using BGP, that becomes a problem. How does 00:41:50.120 --> 00:41:57.639 the service provider make sure that the overlapping address spaces do not cause a problem? 00:41:58.919 --> 00:42:02.280 They use what are called route distinguishers. That's what I want you to remember here. Route 00:42:02.280 --> 00:42:07.159 distinguishers help solve the problem of overlapping address spaces. That's what you 00:42:07.159 --> 00:42:15.639 need to know. And what are they? They are simply a 64-bit identifier that is added to that IPv4 00:42:15.639 --> 00:42:22.919 or IPv6 network address to make it unique. It's also known as the VPN identifier when it's all 00:42:22.919 --> 00:42:31.800 said and done. So take this and add the 64-bit to it. Take this, add the 64-bit to it. Now they 00:42:31.800 --> 00:42:37.080 are unique as they are being shared from here to here. So you're not doing this in this scenario. 00:42:37.080 --> 00:42:43.479 The service provider is doing this. So they would have it set up as part of their VRFs in order to 00:42:43.479 --> 00:42:49.879 make this happen. So here's what your address would now look like. It would be the route distinguisher 00:42:50.520 --> 00:42:55.639 plus the IPv4 address giving you what is called the VPNv4 address. And the same thing would be 00:42:55.639 --> 00:43:11.159 true for VPNv6. Let me just give you a little example here. Route distinguisher 1 colon 111 00:43:11.159 --> 00:43:19.479 has been assigned to customer 1 VRF. Route distinguisher 2 colon 222 is assigned to customer 2 00:43:19.479 --> 00:43:26.360 VRF. So when you're doing these route distinguishers as an example, I'll just come 00:43:26.360 --> 00:43:31.639 over here. It's done under the VRF configuration mode. So VRF definition, 00:43:35.000 --> 00:43:41.399 address. No, actually, I believe it's done right here in this new configuration 00:43:42.280 --> 00:43:47.639 construct. So the address family configuration, route distinguisher, there it is. So route 00:43:47.639 --> 00:43:52.919 distinguisher. And then you can put in the route distinguisher for that particular VRF. 00:43:54.520 --> 00:43:58.760 So notice you can put like, if you have an autonomous system number associated with that 00:43:58.760 --> 00:44:03.080 customer, then you can put their autonomous system number in there. And then just some 00:44:03.080 --> 00:44:07.879 random number that you want to put with it. Or it says you can use an IP address in front if you 00:44:07.879 --> 00:44:13.719 want to. You can pretty much do anything you want, folks. Right. So in my case, for example, 1 colon 00:44:13.719 --> 00:44:20.040 111, if I really just want to do that, they're done. So now if we take a look at do show VRF, 00:44:20.840 --> 00:44:26.040 you'll see that I have a route distinguisher now for that VRF. 00:44:28.439 --> 00:44:32.040 So I would create a different route distinguisher for each and every single one of those VRFs 00:44:32.600 --> 00:44:36.439 and make sure it's consistent on all the devices that I need to have this on. 00:44:37.800 --> 00:44:41.719 So in this case, I have it here in an MPLS environment. I'd have it here in an MPLS 00:44:41.719 --> 00:44:47.959 environment. So now what does that mean? It means when we share the route, so when we share 10.0.1.0 00:44:47.959 --> 00:44:55.560 size 24 this way, it's going to have that VRF attached to it. When I share this 10.0.1.0 size 24, 00:44:55.560 --> 00:44:58.520 it's going to have that route distinguisher attached to it. I think I said VRF in there. 00:44:58.520 --> 00:45:00.840 It's going to have the route distinguisher attached to it. It's going to have the route 00:45:00.840 --> 00:45:08.040 distinguisher attached to it. Right. So let's look at an example this way. So when the 192.168.1.0 00:45:08.040 --> 00:45:14.120 is being advertised, look, it's 1 colon 111 colon the IP address. So that way, when it arrives at 00:45:14.120 --> 00:45:17.800 this side, right, the route distinguisher matches. I know it's unique. I know it's for that particular 00:45:17.800 --> 00:45:22.120 customer. Same thing with this as well. This one here is going to be 2 colon 222. 00:45:23.879 --> 00:45:29.560 And when we're coming the other way now, you'll see how now they're unique. 10.0.1.0 size 24, 00:45:29.560 --> 00:45:34.600 10.0.1.0 size 24, notice now how they're unique because of the route distinguisher. 00:45:34.600 --> 00:45:37.719 So what are you trying to learn from this? You are purely trying to learn for this 00:45:37.719 --> 00:45:45.320 particular exam that if they ask you about how you ensure in a VRF when there are 00:45:46.679 --> 00:45:55.479 duplicate networks in different VRFs, how do you ensure they're unique? How do you distinguish 00:45:55.479 --> 00:46:02.840 one from the other? Route distinguishers. That's how you distinguish one from the other. 00:46:03.560 --> 00:46:07.320 Route distinguishers. That's right in the name. I distinguish this route 00:46:07.320 --> 00:46:09.719 from this route using a route distinguisher. 00:46:12.040 --> 00:46:16.199 But we also have to remember that as we are leaving here, going to here, 00:46:16.919 --> 00:46:23.959 we are actually doing an export. We are exporting from this VRF, and therefore, we now have to 00:46:23.959 --> 00:46:31.239 import into the VRF there. We are exporting from here, and we have to import into here. Likewise, 00:46:31.239 --> 00:46:36.840 we are exporting from here, and we'll have to import into there. We're exporting from here, 00:46:36.840 --> 00:46:44.679 and we'll have to import into there. So in my case, when you think about it, 00:46:44.679 --> 00:46:49.800 I was essentially just going from what? One router to the next router directly connected. 00:46:49.800 --> 00:46:53.719 One router to the next router directly connected. One router to the next. That's how we were doing 00:46:53.719 --> 00:46:59.959 it. But when you're doing it in MPLS Layer 3 VPN, notice how this router is participating in VRF. 00:46:59.959 --> 00:47:07.879 The other one is these aren't. These are not. So it becomes more challenging to ensure isolation 00:47:07.879 --> 00:47:12.760 when sharing routes, whereas in my VRF Lite scenario earlier where we were just going from 00:47:12.760 --> 00:47:17.399 distribution one to router two to the branch router, it's just hop by hop by hop by hop. 00:47:17.399 --> 00:47:23.159 Every router is participating in it. These ones are not. So how do we ensure isolation? How do I 00:47:23.159 --> 00:47:27.959 export on one router and make sure it's being imported properly on the other router when it's 00:47:27.959 --> 00:47:33.800 all said and done? How do we ensure isolation when sharing routes? The answer is route targets. 00:47:34.520 --> 00:47:39.560 Route targets. So with a route target, essentially what we're doing is we're identifying 00:47:39.560 --> 00:47:44.919 our VPN membership of that particular route. So that way there we can control the import and export 00:47:44.919 --> 00:47:48.439 functions. That's what you want to get away from this discussion, right? Well, how do you control 00:47:48.439 --> 00:47:53.879 the import and export functions when you are working with VRFs? Route targets. Route targets. 00:47:53.879 --> 00:47:58.679 So what you would do is you would create a route target for your imports 00:47:58.679 --> 00:48:02.120 and your exports. Now they can be the same value. They can be the exact same value. 00:48:05.959 --> 00:48:11.320 In this case, I'm using the exact same value for import and I'm using the same value for export. 00:48:11.320 --> 00:48:15.399 But you can easily say I want a route target for import to be this. I want a route target for export 00:48:15.399 --> 00:48:22.600 to be this on that VRF, right? They don't have to be the same number. But what you have to realize 00:48:22.600 --> 00:48:30.840 is that the numbers have to be matching on each side. So if I'm using that as my export target, 00:48:31.479 --> 00:48:38.199 then this has to be the import target here. If I'm using this as my export target, 00:48:38.199 --> 00:48:43.879 then that has to be the import target here. So think of this scenario. If this is export, 00:48:43.879 --> 00:48:53.239 then this is import. What if we had another route target of 1 colon 101 here for import, 00:48:53.239 --> 00:49:01.239 then I would have to have a route target over here 1 colon 101 for export. So I export to import. 00:49:01.239 --> 00:49:09.719 I export to import. Important for you to know that for the exam, that if all of a sudden you 00:49:09.719 --> 00:49:13.080 see a scenario with two route targets, okay, which one's export, which one's import, it'll tell you. 00:49:14.040 --> 00:49:18.439 And make sure that the other side is the flip. They've got to be flipped from each other. 00:49:18.439 --> 00:49:22.679 Because if this is export, that's import. This is export, that's import. 00:49:27.000 --> 00:49:30.120 So make sure that you have those lined up properly as they need to be. 00:49:33.719 --> 00:49:34.840 And so it is 00:49:35.800 --> 00:49:41.800 attached to the route when we are building that VPN v4 address. So here's your route 00:49:41.800 --> 00:49:46.600 distinguisher. Here's your IP address. Now you add the route target onto that as well. 00:49:48.760 --> 00:49:53.159 So now when that information is being sent, what do you have? You have the route target, 00:49:54.199 --> 00:50:00.679 you have the route distinguisher, and you have the prefix. So you have the route target controlling 00:50:00.919 --> 00:50:06.439 export, and then import. You have the route distinguisher to ensure uniqueness, 00:50:06.439 --> 00:50:13.719 to distinguish any duplicate addresses from each other. It's a lot, I know, but little things I 00:50:13.719 --> 00:50:20.679 want you to remember for the certification exam when it comes to VRFs. So if you need route 00:50:20.679 --> 00:50:24.360 distinguishers and route targets in your environment, then you can set them up as I've 00:50:24.360 --> 00:50:29.320 shown you. So in this case, we set up the route distinguisher in this example. So if you need 00:50:30.120 --> 00:50:37.239 a route distinguisher in this example, so on an exam, per se, if they say you must create a VRF 00:50:37.239 --> 00:50:40.600 and it's going to have to have a route distinguisher associated with it of such and 00:50:40.600 --> 00:50:44.679 such, well, I just showed you how to create the route distinguisher. What about the route target 00:50:44.679 --> 00:50:53.159 for import and export? Route target right here. And so you'll see that if I type in both, 00:50:53.800 --> 00:50:57.639 or I can just turn around and I don't even have to type in both, I can just type in the number, 00:50:58.520 --> 00:51:02.360 or you can type an export and the number for export and an import, the number for import, 00:51:02.360 --> 00:51:05.560 you just have to make sure the other device, the receiving device on the other side 00:51:05.560 --> 00:51:07.879 is using the appropriate numbers as well. 00:51:13.239 --> 00:51:21.959 So let's just remind ourselves here, show run pipe to section VRF. So VRF definition, 00:51:21.959 --> 00:51:25.959 creating a route distinguisher, route target as we talked about, your address family, 00:51:25.959 --> 00:51:30.120 and then under your interfaces, so show run interface gigabit ethernet zero size zero. 00:51:31.959 --> 00:51:35.399 VRF forwarding is the command for that, puts your IP address on it, 00:51:35.399 --> 00:51:40.120 put it in the right routing process. And then what was the other interface we did? 00:51:40.120 --> 00:51:45.080 It was fast ethernet, zero slash one slash zero dot 100, I believe. 00:51:49.560 --> 00:51:53.719 And in this case, we have to do a sub interface. So we did the encapsulation on that. 00:51:53.719 --> 00:51:59.239 So great question that I get every once in a while. So Raymond, you've done this on physical 00:51:59.239 --> 00:52:05.320 interfaces today, you've done it on SVIs, you've done them on sub interfaces. Can you also do them 00:52:05.320 --> 00:52:13.239 on things like GRE tunnels? Meaning can I have a GRE tunnel in a specific VRF? And the answer 00:52:13.239 --> 00:52:19.959 to that is yes. So if you create, for example, interface tunnel, let's just go ahead and say 00:52:19.959 --> 00:52:26.280 we're going to create an interface tunnel 50, then you can put that in a VRF. So you can type 00:52:26.280 --> 00:52:35.239 in VRF forwarding, and then put it in VRF, like we have here. And now that tunnel interface is 00:52:35.239 --> 00:52:40.120 in the VRF. Keep that in mind, folks, because that's a really great question. I'm glad you 00:52:40.120 --> 00:52:46.439 asked it today, that can we do VRF some tunnel interfaces? Absolutely, you can. Yeah, don't 00:52:46.439 --> 00:52:49.959 forget that.