CloudLabBox
Try the free demo

MPLS and L3VPN lab 3 of 11

From VRF-lite to L3VPN

Two customers with overlapping addresses run over VRF-lite and a sub-interface per customer. Replace that with a real L3VPN: RDs, route targets, a VPNv4 session between PE loopbacks and a two-label stack through an MPLS core that knows nothing about either customer.

Run this lab

It needs Lite: its 5 nodes are set to 5 vCPU and 2,560 MB in total. That fits the free demo too.

In your workspace: Shared, then MPLS and L3VPN guided labs, then 03 - From VRF-lite to L3VPN

Try it free for 30 minutesRun it on Lite from £3 a day

The free demo needs no card and no email. Every lab plan includes every guided lab.

Level
Intermediate
Time
About 75 minutes
Nodes need
5 vCPU, 2,560 MB
Smallest plan
Lite

The scenario

You've joined Wrenfield Networks, a regional carrier in AS 65100. Two customers have offices near your two exchange sites: Alder Foods and Birch Logistics. Both picked the same addresses years ago, so 192.168.1.0/24 and 192.168.2.0/24 each exist twice.

A colleague kept them apart with VRF-lite: one routing table per customer on each PE, and a dot1Q sub-interface per customer on a direct PE1 to PE2 cable. It works, but every new customer means a new sub-interface, a new subnet and new static routes, and the cable is about to be ceased. The MPLS core through P is already up, so your job is to move both customers onto it as a proper L3VPN.

CustomerVRFSitesRD on PE1RD on PE2Route target
Alder FoodsALDERA1 (192.168.1.0/24), A2 (192.168.2.0/24)65100:10165100:10265100:100
Birch LogisticsBIRCHLoopback20 on PE1 (192.168.1.0/24), Loopback20 on PE2 (192.168.2.0/24)65100:20165100:20265100:200

To keep the lab small, each Birch office is a loopback in VRF BIRCH on its PE. Birch's 192.168.2.10 stands in for a server that Alder doesn't have.

DeviceInterfaceAddressConnects to
A1Loopback1192.168.1.1/24
A1Gi0/0172.16.1.2/30PE1 Gi0/0
PE1Loopback010.255.0.1/32
PE1Gi0/0172.16.1.1/30A1 Gi0/0
PE1Gi0/110.0.12.1/30P Gi0/0
PE1Loopback20192.168.1.1/24, 192.168.1.10/24
PE1Gi0/3.1010.10.10.1/30
PE1Gi0/3.2010.10.20.1/30
PLoopback010.255.0.2/32
PGi0/010.0.12.2/30PE1 Gi0/1
PGi0/110.0.23.1/30PE2 Gi0/1
PE2Loopback010.255.0.3/32
PE2Gi0/0172.16.2.1/30A2 Gi0/0
PE2Gi0/110.0.23.2/30P Gi0/1
PE2Loopback20192.168.2.1/24, 192.168.2.10/24
PE2Gi0/3.1010.10.10.2/30
PE2Gi0/3.2010.10.20.2/30
A2Loopback1192.168.2.1/24
A2Gi0/0172.16.2.2/30PE2 Gi0/0

What you’ll practise

  • Explain what a VRF does on its own and what VRF-lite costs as customers grow
  • Explain what a route distinguisher does and how it differs from a route target
  • Build a VPNv4 iBGP session between PE loopbacks and carry extended communities
  • Read the VPN label and the transport label in the FIB and in a traceroute
  • Prove that a P router holds no customer routes and that two customers stay separate

The tasks

  1. Read what VRF-lite gives you
  2. Clear out VRF-lite
  3. Give each VRF an RD and route targets
  4. Build the VPNv4 session
  5. Put each customer's routes into the VPN
  6. Prove the traffic uses labels

The Lab Tasks pane has the scenario, these tasks, the checks to run, hints and the full solution.

Topology and devices

The network as it opens in EVE-NG, drawn from the lab’s own canvas, and the image each node runs.

Topology of From VRF-lite to L3VPN5 nodes, 5 links. Every link is listed as text below the diagram.A1PE1PPE2A2Gi0/0Gi0/0Gi0/0Gi0/0Gi0/1Gi0/0Gi0/1Gi0/1Gi0/3Gi0/3
5 nodes, with the interface names each link uses. On a narrow screen, scroll the diagram sideways.
Every link, as text
  • A1 Gi0/0 to PE1 Gi0/0
  • PE1 Gi0/1 to P Gi0/0
  • P Gi0/1 to PE2 Gi0/1
  • PE2 Gi0/0 to A2 Gi0/0
  • PE1 Gi0/3 to PE2 Gi0/3
Nodes in From VRF-lite to L3VPN, with the image each runs and the vCPU and RAM it’s set to
NodeDeviceImage in Add NodeSet to
A1Cisco IOSvvios-adventerprisek9-m.spa.159-3.m91 vCPU, 512 MB
PE1Cisco IOSvvios-adventerprisek9-m.spa.159-3.m91 vCPU, 512 MB
PCisco IOSvvios-adventerprisek9-m.spa.159-3.m91 vCPU, 512 MB
PE2Cisco IOSvvios-adventerprisek9-m.spa.159-3.m91 vCPU, 512 MB
A2Cisco IOSvvios-adventerprisek9-m.spa.159-3.m91 vCPU, 512 MB

How to open this lab

  1. Sign in to your workspace at lab.cloudlabbox.com.

  2. In File Manager, open Shared, then the folder MPLS and L3VPN guided labs.

  3. Open 03 - From VRF-lite to L3VPN and start its nodes, then open Lab Tasks for the scenario and the steps.

The lab is read-only. You can start the nodes and configure the devices, but changes to the topology can’t be saved. To change it, rebuild it in your own folder.

More MPLS and L3VPN labs

All MPLS and L3VPN labs

Related labs in other courses

CloudLabBox is independent of Cisco, Juniper Networks and MikroTik. The lab follows exam topics and isn’t vendor training material; vendor names identify the exams and the images in the workspace.