- [Instructor] Earlier in this module
we talked about different types
of virtual machines we could have.
Virtual servers, virtual routers,
virtual firewalls, virtual switches, and so on.
And we could virtualize those inside of a physical server.
Well similarly we can virtualize routers
inside of a physical router.
Let's say that we're a service provider
or we have different Tenants
that we want to keep isolated from one another,
but I don't want to have to buy a router for Tenant A
and another router for Tenant B
and another router for Tenant C.
What we can do is allow all of these Tenants
to be virtualized.
They can have their own virtual router
and those virtual routers are running on
this underlying physical router.
And they are going to be truly isolated from one another.
They're not even going to see each other's IP routing tables,
they're going to have their own routing tables.
And this technology that allows us to do
this router virtualization on a physical router,
it's called virtual routing and forwarding or VRF for short.
Now let's go out to a live interface
and take a look at how to configure VRF.
We're going to begin our VRF configuration
by creating a multi-protocol VRF routing instance
for each Tenant that we have,
and we're going to specify the address family to be used,
and by address family I'm talking about
are we using IP Version 4 or IP Version 6?
Well you can guess based on our topology
we're going to be using IP Version 4.
So let's get started.
Let's go into global configuration mode
and I'll say vrf definition
and I'm going to call our first Tenant, TENANT-A,
and I'll say it's going to belong
to the address-family of ipv4.
Let's create another VRF instance
and I'll call this one TENANT-B,
it's also going to be using address-family ipv4,
and what we want to do now
is go into each of our four interfaces
in this topology that we see,
and we want to assign each interface
to one of these VRF instances.
Notice that Gigabit 0/1 and 0/2,
they're going to belong to TENANT-A.
0/3 and 0/4 they're going to belong to TENANT-B
and they're going to have their own routing tables,
TENANT-A and TENANT-B.
Let's get started by going into int gig 0/1
and I'll say vrf forwarding TENANT-A.
I want Gigabit 0/1 to be part of
TENANT-A's virtualized router,
and I'll say that its IP address is
192.0.2.1 with a 24-bit subnet mask,
and by default our router interfaces
are administratively shutdown
so let's do a no shut to bring that up.
And let's go into int gig 0/2.
You can see Gigabit 0/1 coming up there.
And on interface Gigabit 0/2
we also want to belong to TENANT-A
and the IP address
is going to be 10.1.1.1
again with a 24-bit subnet mask,
and let's administratively bring this up.
We'll do a no shut, which is short for no shutdown,
and something I want you to notice here
is I gave this interface an IP address of 10.1.1.1/24
I want to do the same thing for Gigabit 0/3.
Have you ever tried that on a Cisco router?
Go to different interfaces
and maybe you've accidentally tried
to type in the same IP address on different interfaces?
Or maybe even IP addresses
that were part of the same network,
you tried to apply those to different interfaces,
and the Cisco router told you that no, no, no,
you have an IP address overlap.
Well I'm about to have what looks to be a possible overlap.
I'm going to assign the same IP address of 10.1.1.1
to both of these interfaces.
Let's see what happens.
Let's go into int gig 0/3,
and I want this to belong to a different VRF instance
instead of TENANT-A it's going to be TENANT-B,
and I'm going to assign the same IP address to TENANT-B.
Now it looks like maybe in a previous configuration
it already had an IP address assigned,
but that's disabled now that we belong to
a specific VRF instance.
Let's say
ip address 10.1.1.1 with a 24-bit subnet mask
it's the very same IP address that I assigned
to Gigabit 0/2 and I did not get an error,
because we're in different virtual router instances.
They cannot see one another.
Even though I got the very same IP address applied
to different interfaces
neither Tenant knows about the other Tenant.
Let's administratively bring this up,
if it's not already,
and let's go into interface Gigabit 0/4.
We'll say int gig 0/4
and this is going to belong to TENANT-B as well,
and its IP address is
198.51.100.1
with a 24-bit subnet mask.
Let's do a no shut to bring it up
and we're done.
We've now configured
two VRF instances on this one physical router,
and we've assigned IP addresses to a couple of interfaces
for each of our instances.
So we can route between different networks for each Tenant.
If we want to see what VRF's we created
we can do a show ip vrf.
This will tell us that we have two VRF instances,
TENANT-A and TENANT-B,
which shows the interfaces belonging to each Tenant.
So Gigabit 0/1, 0/2, those belong to TENANT-A.
0/3 and 0/4, those belong to TENANT-B.
Now let's look at the routing table for TENANT-A.
Instead of just doing a show IP route,
I'll do a show ip route vrf
followed by the VRF name of TENANT-A,
and we're going to see these two networks
that are directly connected to us.
10.1.1.0/24 and we've got a local member of that
the IP address of the interface of 10.1.1.1/32.
We're also connected to the network of 192.0.2.0/24,
and our local interface has an IP address of 192.0.2.1
so we're only seeing IP addresses
that were assigned to TENANT-A interfaces,
and if we look at the IP routing table for TENANT-B,
notice that it also has a 10.1.1.0/24 network,
but it's a different network.
Even though it's got the same network address
traffic in the 10.1.1.0 network on TENANT-B
is not going to be seen by the 10.1.1.0 network on TENANT-A.
But in addition to these two IP routing tables that we have
one for TENANT-A and one for TENANT-B
there's also a global routing table,
and we can see that
with our traditional show ip route command.
And right now I don't have any global routes,
I don't have any interfaces
not belonging to a Tenant at the moment.
So let's create a virtual one.
Let's create a loop-back interface.
Let's go into global configuration mode
and I'll say int lo0
and let's assign the IP address of
5.5.5.5 I'll give it a 32-bit subnet mask
so just one IP address in this network,
and loop-back interfaces are up by default
so no need to do a no shutdown,
and let's see if it shows up in our global routing table.
I'll do a show ip route.
Yes it does.
We see it in the global routing table.
Does it show up in the routing tables of our VRF's?
Let's take a look.
Lets do a show ip route for TENANT-A,
and do we see the 5.5.5.5 network?
No we don't.
What about TENANT-B?
No we don't.
So we see at this point we have three routing tables.
We've got a global routing table
and I've got a routing table for each of my Tenants,
and they are isolated from one another.
Now in the real world
beyond the scope of what we need to know for this exam,
just a heads up for you
in case you want to dive deeper into this,
there is a way to leak routes on the global routing table
into one of our VRF routing tables, or vice-versa.
So maybe we had a default route for example
in the global routing table.
We could leak that into our Tenant's IP routing tables,
and we would do that using a route map.
But for our purposes for this exam blue print
I just want you to know what a VRF is,
and how to do this basic configuration
where we created the VRF instance,
we said what kind of IP address are we assigning
in other words what address family are we going to be using
IPv4 or IPv6,
then once we defined our VRF instances,
we went into physical interfaces,
said you belong to this VRF instance,
we assigned an IP address.
We brought it up and we were able to keep
interfaces on the same physical router
isolated from one another simply by
assigning them to different VRF instances.