Solved: vrf-lite

Sunny Banks · ‎03-26-2024

Hello gentle people,

I'm labbing a vrf-lite setup and I feel the config is good. Per the topology, CORP works but PROD does not. The networks behind the core neighbour are pingable for CORP but not PROD. Here's the config for R1 & R2 : -

R1#show run
Building configuration...

Current configuration : 2183 bytes
!
upgrade fpd auto
version 12.4
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname R1
!
boot-start-marker
boot-end-marker
!
logging message-counter syslog
!
no aaa new-model
ip source-route
no ip icmp rate-limit unreachable
ip cef
!
!
ip vrf CORP
!
ip vrf PROD
!
!
!
no ip domain lookup
no ipv6 cef
!
multilink bundle-name authenticated
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
archive
log config
hidekeys
!
!
!
!
!
ip tcp synwait-time 5
!
!
!
!
interface Ethernet0/0
no ip address
shutdown
duplex auto
!
interface GigabitEthernet0/0
ip vrf forwarding CORP
ip address 10.10.10.1 255.255.255.0
duplex full
speed 1000
media-type gbic
negotiation auto
!
interface FastEthernet1/0
no ip address
shutdown
duplex auto
speed auto
!
interface FastEthernet1/1
no ip address
shutdown
duplex auto
speed auto
!
interface FastEthernet2/0
no ip address
shutdown
duplex auto
speed auto
!
interface FastEthernet2/1
no ip address
shutdown
duplex auto
speed auto
!
interface GigabitEthernet3/0
ip vrf forwarding PROD
ip address 10.10.10.1 255.255.255.0
negotiation auto
!
interface GigabitEthernet4/0
no ip address
negotiation auto
!
interface GigabitEthernet4/0.1
encapsulation dot1Q 10
ip vrf forwarding CORP
ip address 30.30.30.1 255.255.255.252
!
interface GigabitEthernet4/0.2
encapsulation dot1Q 20
ip vrf forwarding PROD
ip address 30.30.30.5 255.255.255.252
!
interface FastEthernet5/0
no ip address
shutdown
duplex half
!
interface GigabitEthernet6/0
no ip address
shutdown
negotiation auto
!
router ospf 1 vrf PROD
log-adjacency-changes
network 10.10.10.0 0.0.0.255 area 0
network 30.30.30.0 0.0.0.3 area 0
!
router ospf 2 vrf CORP
log-adjacency-changes
network 10.10.10.0 0.0.0.255 area 0
network 30.30.30.0 0.0.0.3 area 0
!
ip forward-protocol nd
no ip http server
no ip http secure-server
!
!
!
no cdp log mismatch duplex
!
!
!
!
!
!
control-plane
!
!
!
!
!
!
!
gatekeeper
shutdown
!
!
line con 0
exec-timeout 0 0
privilege level 15
logging synchronous
stopbits 1
line aux 0
exec-timeout 0 0
privilege level 15
logging synchronous
stopbits 1
line vty 0 4
login
!
end

R2#show run
Building configuration...

Current configuration : 2183 bytes
!
upgrade fpd auto
version 12.4
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname R2
!
boot-start-marker
boot-end-marker
!
logging message-counter syslog
!
no aaa new-model
ip source-route
no ip icmp rate-limit unreachable
ip cef
!
!
ip vrf CORP
!
ip vrf PROD
!
!
!
no ip domain lookup
no ipv6 cef
!
multilink bundle-name authenticated
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
archive
log config
hidekeys
!
!
!
!
!
ip tcp synwait-time 5
!
!
!
!
interface Ethernet0/0
no ip address
shutdown
duplex auto
!
interface GigabitEthernet0/0
ip vrf forwarding CORP
ip address 20.20.20.1 255.255.255.0
duplex full
speed 1000
media-type gbic
negotiation auto
!
interface FastEthernet1/0
no ip address
shutdown
duplex auto
speed auto
!
interface FastEthernet1/1
no ip address
shutdown
duplex auto
speed auto
!
interface FastEthernet2/0
no ip address
shutdown
duplex auto
speed auto
!
interface FastEthernet2/1
no ip address
shutdown
duplex auto
speed auto
!
interface GigabitEthernet3/0
ip vrf forwarding PROD
ip address 20.20.20.1 255.255.255.0
negotiation auto
!
interface GigabitEthernet4/0
no ip address
negotiation auto
!
interface GigabitEthernet4/0.1
encapsulation dot1Q 10
ip vrf forwarding CORP
ip address 30.30.30.2 255.255.255.252
!
interface GigabitEthernet4/0.2
encapsulation dot1Q 20
ip vrf forwarding PROD
ip address 30.30.30.6 255.255.255.252
!
interface FastEthernet5/0
no ip address
shutdown
duplex half
!
interface GigabitEthernet6/0
no ip address
shutdown
negotiation auto
!
router ospf 1 vrf PROD
log-adjacency-changes
network 20.20.20.0 0.0.0.255 area 0
network 30.30.30.0 0.0.0.3 area 0
!
router ospf 2 vrf CORP
log-adjacency-changes
network 20.20.20.0 0.0.0.255 area 0
network 30.30.30.0 0.0.0.3 area 0
!
ip forward-protocol nd
no ip http server
no ip http secure-server
!
!
!
no cdp log mismatch duplex
!
!
!
!
!
!
control-plane
!
!
!
!
!
!
!
gatekeeper
shutdown
!
!
line con 0
exec-timeout 0 0
privilege level 15
logging synchronous
stopbits 1
line aux 0
exec-timeout 0 0
privilege level 15
logging synchronous
stopbits 1
line vty 0 4
login
!
end

I've taken multiple looks and it seems good. Am I missing something obvious?

Thanks in advance,

Sunny

David Ruess · ‎03-26-2024

Hello,

Your PROD OSPF configuration is incorrect. Your network statement doesn't cover the interfaces in the PROD VRF. I'm assuming you also don't have PROD OSPF neighborship. Change it to include the .5 and .6 interfaces respectively/ Once you change that it should work.

-David

View solution in original post

Marius Gunnerud · ‎03-26-2024

at first glance you OSPF configuration is incorrect:

router ospf 1 vrf PROD
log-adjacency-changes
network 10.10.10.0 0.0.0.255 area 0
network 30.30.30.0 0.0.0.3 area 0

you are advertising 30.30.30.0/30 network when you should be advertising 30.30.30.4/30 network

router ospf 1 vrf PROD
log-adjacency-changes
network 10.10.10.0 0.0.0.255 area 0
network 30.30.30.4 0.0.0.3 area 0

--
Please remember to select a correct answer and rate helpful posts

View solution in original post

MHM Cisco World · ‎03-26-2024

Nothing wrong in your config still

There is one piece missing' the RD of vrf

You need to add RD for each VRF

Then wr config' close lab and open it again and check

As my colleague mention the subnet and mask is also wrong you use ""network 30.30.30.0 0.0.0.3"" but you need to use ""network 30.30.30.4/30""

MHM

David Ruess · ‎03-26-2024