CloudLabBox
Try the free demo

CCNP ENCOR lab 15 of 36

VRF-Lite: separate routing tables over one link

Carry Fernhill's corporate network and a vendor-managed IoT network over the same Leeds–Bristol link with VRF-Lite: two routing tables, overlapping addresses, OSPF in one VRF and static routes in the other, and proof that they can't see each other.

Run this lab

It needs Lite: its 6 nodes are set to 6 vCPU and 3,072 MB in total. That fits the free demo too.

In your workspace: Shared, then CCNP ENCOR 350-401 guided labs, then 15 - VRF-Lite - separate routing tables over one link

Try it free for 30 minutesRun it on Lite from £3 a day

The free demo needs no card and no email. Every lab plan includes every guided lab.

Level
Intermediate
Time
About 65 minutes
Nodes need
6 vCPU, 3,072 MB
Smallest plan
Lite

The scenario

Fernhill Freight's warehouses are getting new handheld scanners. The scanner vendor manages its own small routers (IOT1 in Leeds and IOT2 in Bristol) and insists on using its standard addressing, which by bad luck is exactly the same as Fernhill's corporate addressing. Security also wants the scanners kept completely apart from corporate systems.

There's only one link between the Leeds and Bristol routers (R1 and R2), and no budget for another. You'll use VRF-Lite: two virtual routers in each physical router, two 802.1Q sub-interfaces on the shared link, OSPF for corporate, and static routes for the scanners, as the vendor requires.

DeviceInterfaceVRFAddressConnects to
R1Gi0/0.10 (VLAN 10)CORP10.0.12.1/30R2 Gi0/0.10
R1Gi0/0.20 (VLAN 20)IOT10.0.12.1/30R2 Gi0/0.20
R1Gi0/1CORP10.1.0.1/30CORP1 Gi0/0 (10.1.0.2)
R1Gi0/2IOT10.1.0.1/30IOT1 Gi0/0 (10.1.0.2)
R2Gi0/0.10 / Gi0/0.20CORP / IOT10.0.12.2/30R1
R2Gi0/1CORP10.2.0.1/30CORP2 Gi0/0 (10.2.0.2)
R2Gi0/2IOT10.2.0.1/30IOT2 Gi0/0 (10.2.0.2)
CORP1 / IOT1Lo10 (LAN) / Lo1 (identity)–10.1.1.1/24 / 10.100.1.1 and 10.200.1.1–
CORP2 / IOT2Lo10 (LAN) / Lo1 (identity)–10.2.2.1/24 / 10.100.2.2 and 10.200.2.2–

CORP1 and CORP2 already run OSPF area 0 towards R1 and R2. IOT1 and IOT2 already have default routes towards R1 and R2. Only R1 and R2 need configuring. Use route distinguishers 65010:10 (CORP) and 65010:20 (IOT).

Topology: CORP1 and IOT1 hang off R1; CORP2 and IOT2 hang off R2; R1 Gi0/0 — R2 Gi0/0 carries both VRFs.

What you’ll practise

  • Create VRFs with the multi-protocol vrf definition syntax and explain the route distinguisher
  • Assign physical and 802.1Q sub-interfaces to VRFs and re-apply their addresses
  • Run OSPF inside one VRF and static routing inside another
  • Verify VRF tables, VRF-aware ping and the separation between overlapping address spaces
  • Explain how VRF-Lite compares with VLANs, MPLS L3VPN and device virtualisation

The tasks

  1. Create the VRFs
  2. Put the edge interfaces into their VRFs
  3. Split the shared link with 802.1Q sub-interfaces
  4. Route the corporate VRF with OSPF
  5. Route the IoT VRF with static routes
  6. Prove the separation

The Lab Tasks pane has the scenario, these tasks, the checks to run, hints and the full solution.

Topology and devices

The network as it opens in EVE-NG, drawn from the lab’s own canvas, and the image each node runs.

Topology of VRF-Lite - separate routing tables over one link6 nodes, 5 links. Every link is listed as text below the diagram.R1R2CORP1IOT1CORP2IOT2Gi0/0Gi0/0Gi0/0Gi0/1Gi0/0Gi0/2Gi0/0Gi0/1Gi0/0Gi0/2
6 nodes, with the interface names each link uses. On a narrow screen, scroll the diagram sideways.
Every link, as text
  • R1 Gi0/0 to R2 Gi0/0
  • CORP1 Gi0/0 to R1 Gi0/1
  • IOT1 Gi0/0 to R1 Gi0/2
  • CORP2 Gi0/0 to R2 Gi0/1
  • IOT2 Gi0/0 to R2 Gi0/2
Nodes in VRF-Lite: separate routing tables over one link, with the image each runs and the vCPU and RAM it’s set to
NodeDeviceImage in Add NodeSet to
R1Cisco IOSvvios-adventerprisek9-m.spa.159-3.m91 vCPU, 512 MB
R2Cisco IOSvvios-adventerprisek9-m.spa.159-3.m91 vCPU, 512 MB
CORP1Cisco IOSvvios-adventerprisek9-m.spa.159-3.m91 vCPU, 512 MB
IOT1Cisco IOSvvios-adventerprisek9-m.spa.159-3.m91 vCPU, 512 MB
CORP2Cisco IOSvvios-adventerprisek9-m.spa.159-3.m91 vCPU, 512 MB
IOT2Cisco IOSvvios-adventerprisek9-m.spa.159-3.m91 vCPU, 512 MB

How to open this lab

  1. Sign in to your workspace at lab.cloudlabbox.com.

  2. In File Manager, open Shared, then the folder CCNP ENCOR 350-401 guided labs.

  3. Open 15 - VRF-Lite - separate routing tables over one link and start its nodes, then open Lab Tasks for the scenario and the steps.

The lab is read-only. You can start the nodes and configure the devices, but changes to the topology can’t be saved. To change it, rebuild it in your own folder.

More CCNP ENCOR labs

All CCNP ENCOR labs

Related labs in other courses

CloudLabBox is independent of Cisco. The lab follows exam topics and isn’t vendor training material; vendor names identify the exams and the images in the workspace.