by nature V refs are absolute they're there to keep route separate but perhaps
we have a service that our customers need to access for this to work we will
want to share our routes with a customer we can do this without leaking if you've
watched the first three videos you'll be quite familiar with this topology this
time we're just going to add a new network to each core router these
networks offer shared services to our customers to start with our customers
will not be able to reach these networks our job will be to make sure that they
can while still keeping customers separate from each other for our shared
services will create a new vrf will leave the global routing table for
infrastructure and forwarding only we'll also export and import all routes with
route target 65,000 won this needs to be done on both of our core routers
now we'll create our networks and put them straight
into the correct vrf
you
for us the easiest way to advertise these routes is in BGP there'd be no
real advantage to configuring a new routing protocol for these networks if
we did we eventually have to redistribute them into BGP anyway
we can quickly check that the routes are converged on both calls
what's next for our shared services to work we need to reach the customer
networks for that we need to export routes from the customer brf's
we're going to use a different route target here 123 will be used for any
customer route that needs to be imported into the shared vrf notice that this
means we can use more than one route target on a set of routes this gives us
a bit more control over what's going on
we will also need to get the shared routes into the customers VRS
we repeat this confit on the second call
having a look at each routing table we can see that the shared services vrf has
the customer routes
I would like to draw your attention to the 10 1000 Network in the shared vrf
this is the overlapping IP space that each of our customers have now that it's
back in the same vrf overlapping is once again a problem bgp will essentially
just pick one and ignore the other customers also have access to shared
routes but they still don't have access to each other this is all very well and
good but this leaks all routes within a vrf what if a customer wants to be a bit
more selective in what they're leaking well yes we can do that to remember how
a route target is attached all bgp prefix as a community well we can fiddle
with the communities to control what's imported and what's exported let's say
for example that customer a does not want the 10 2000 prefix exported to the
shared vrf first take a look at the prefix in the BGP database see the
extended communities these are out target's 65,000 10 is fine we use that
to share routes across the core 65,000 123 is the problem as long as it's there
it will be imported into the shared vrf there are a few steps in removing this
route target first we need a prefixed list to identify this route
then we create a route map this matches the prefix list we just created and then
sets the route targets that we should see
this will override the existing list so we include sixty-five thousand ten but
we don't include sixty-five thousand 123 now that we've got our logic in place we
can apply it directly to the customer via ref in the ipv4 address family when
we're filtering route targets we call it an export map
if we now take a look prefix in BGP we see that nothing's
changed yet give it a moment be jiff he's a bit slow sometimes here we go we
now only have one route target attached to the prefix we can further confirm
this by looking at the shared vrf and seeing that this route is now gone there
is something interesting to point out before moving on
notice that the route map didn't need a permit statement at the end you normally
need this with the route maps export maps are a little bit different and you
don't need the permit here there is a downside of this though what if a
customer created a route that we don't approve of let's see how this might look
on one of the customer B routers we're creating a rogue route 1 - 7 3600 I call
this a rogue route as this is part of the internet routing space unless the
customer owns this network which in our lab they don't they shouldn't really be
using it and they've advertised this into EIGRP as well which means that it
will be automatically redistributed into BGP we can confirm this by looking the
shared vrf now we shouldn't just block it like we did with the 10.20 network a
moment ago I say this because well we don't know what rogue route they're
going to create next instead we can create a whitelist of networks that they
are allowed to export to us just to keep it brief
we'll only configure this for customer B we'll start by removing the config that
leaks all routes
now we'll create a prefix list on each core router these are the white lists of
networks that will leak for customer be
for we create a route map to match the prefix lists and set the route targets
you
sorry I just realize I've made a crucial mistake
we need to use the additive keyword here
rather than overriding the list of Route targets we're adding the route target to
any prefix in our list
and finally we apply it as an export map in the vrf
you
now when we check the prefix it no longer has the shared services route
target
notice that this method doesn't stop bgp learning their route but it does stop it
propagating it through the core if we have a look at a good route for
comparison we might need to wait for BGP to catch up
okay if we have a look at a good route for comparison it still has the shared
services route target attached
and we get final confirmation when we look at the shared vrf
the rogue route is gone but all the good routes are still there so you've
probably noticed that there are two ways to implement the RFS you can use them on
their own or you can use them with a technology like MPLS technically using
VRS without MPLS is called vrf light or you can use them with other technologies
like the X LAN if you want to see VRS with a VX LAN I recommend you check out
my VX line series I hope you've enjoyed this series and I'd like to see you
again in whatever video comes next