Cisco EVN (Easy Virtual Network)

(Stanislav P) #17

Hello,
really nice explanation. Thanks for it.

I have one question about config:
Lets say i dont want to use EVN to configure trunk between ISP1 and ISP2. How does the router know it shloud use VRF Blue with tag 10 and not 20?
Is there another command to use?

Thanks you :wink:

(Rene Molenaar) #18

EVN only knows what tags to use since we configured the tags on the VRFs.

Also, it basically only does this for us:

interface GigabitEthernet3.10
 description Subinterface for VNET Blue
 encapsulation dot1Q 10
 vrf forwarding Blue
 ip address 192.168.56.5 255.255.255.0

The sub-interface above was created by EVN. If you don’t want to use EVN, you could configure sub-interfaces like this yourself.

(Stanislav P) #19

OK, thanks… now it is clear for me because we configure VRF and tag under interface configuration :wink: That is i was confused about.

(Don M) #20

I can’t seem to get an ospf neighborship across the evn trunk. I’ve looked over my config 3 or 4 times and cannot figure out why.

Blue1#sh run
Building configuration...

Current configuration : 1229 bytes
!
! Last configuration change at 01:20:27 UTC Fri May 5 2017
!
version 15.6
service timestamps debug datetime msec
service timestamps log datetime msec
no platform punt-keepalive disable-kernel-core
platform console serial
!
hostname Blue1
!
boot-start-marker
boot-end-marker
!
!
no logging console
!
no aaa new-model
!
!
!
!         
!
!
!
!
!



!
!
!
!
!
!
!
!
!
!
subscriber templating
!
!
!
multilink bundle-name authenticated
!
!
!
!
!
!
!
!
!
!
!
!
!
license udi pid CSR1000V sn 9J8YYZOLADL
!
spanning-tree extend system-id
!
!
redundancy
!
!
!
!         
!
!
! 
!
!
!
!
!
!
!
!
!
!
!
!
! 
! 
! 
! 
! 
! 
!
!         
interface GigabitEthernet1
 ip address 192.168.1.1 255.255.255.0
 negotiation auto
!
interface GigabitEthernet2
 no ip address
 shutdown
 negotiation auto
!
interface GigabitEthernet3
 no ip address
 shutdown
 negotiation auto
!
interface GigabitEthernet4
 no ip address
 shutdown
 negotiation auto
!
router ospf 1
 network 192.168.1.0 0.0.0.255 area 0
!
!         
virtual-service csr_mgmt
!
ip forward-protocol nd
!
no ip http server
no ip http secure-server
!
!
!
!
!
control-plane
!
 !
 !
 !
 !
!
!
!
!
alias exec srs sh run | s router
!         
line con 0
 stopbits 1
line vty 0
 login
line vty 1
 login
 length 0
line vty 2 4
 login
!
!
end

Blue1#              



Red1#sh run
Building configuration...

Current configuration : 1228 bytes
!
! Last configuration change at 01:23:05 UTC Fri May 5 2017
!
version 15.6
service timestamps debug datetime msec
service timestamps log datetime msec
no platform punt-keepalive disable-kernel-core
platform console serial
!
hostname Red1
!
boot-start-marker
boot-end-marker
!
!
no logging console
!
no aaa new-model
!
!
!
!         
!
!
!
!
!



!
!
!
!
!
!
!
!
!
!
subscriber templating
!
!
!
multilink bundle-name authenticated
!
!
!
!
!
!
!
!
!
!
!
!
!
license udi pid CSR1000V sn 97QJRXFRQP2
!
spanning-tree extend system-id
!
!
redundancy
!
!
!
!         
!
!
! 
!
!
!
!
!
!
!
!
!
!
!
!
! 
! 
! 
! 
! 
! 
!
!         
interface GigabitEthernet1
 ip address 192.168.2.2 255.255.255.0
 negotiation auto
!
interface GigabitEthernet2
 no ip address
 shutdown
 negotiation auto
!
interface GigabitEthernet3
 no ip address
 shutdown
 negotiation auto
!
interface GigabitEthernet4
 no ip address
 shutdown
 negotiation auto
!
router ospf 2
 network 192.168.2.0 0.0.0.255 area 0
!
!         
virtual-service csr_mgmt
!
ip forward-protocol nd
!
no ip http server
no ip http secure-server
!
!
!
!
!
control-plane
!
 !
 !
 !
 !
!
!
!
!
alias exec srs sh run | s router
!         
line con 0
 stopbits 1
line vty 0
 login
line vty 1
 login
 length 0
line vty 2 4
 login
!
!
end

Red1#     



ISP1#sh run
Building configuration...

Current configuration : 1676 bytes
!
! Last configuration change at 01:32:03 UTC Fri May 5 2017
!
version 15.6
service timestamps debug datetime msec
service timestamps log datetime msec
no platform punt-keepalive disable-kernel-core
platform console serial
!
hostname ISP1
!
boot-start-marker
boot-end-marker
!
!
vrf definition Blue
 vnet tag 10
 !
 address-family ipv4
 exit-address-family
!
vrf definition Red
 vnet tag 20
 !
 address-family ipv4
 exit-address-family
!
no logging console
!
no aaa new-model
!
!
!
!
!
!
!
!
!



!
!
!         
!
!
!
!
!
!
!
subscriber templating
!
!
!
multilink bundle-name authenticated
!
!
!
!
!
!
!
!
!
!
!         
!
!
license udi pid CSR1000V sn 9DJH6OB907Y
!
spanning-tree extend system-id
!
!
redundancy
!
!
!
!
!
!
! 
!
!
!
!
!
!
!
!         
!
!
!
!
! 
! 
! 
! 
! 
! 
!
!
interface GigabitEthernet1
 vrf forwarding Blue
 ip address 192.168.1.254 255.255.255.0
 negotiation auto
!
interface GigabitEthernet2
 vrf forwarding Red
 ip address 192.168.2.254 255.255.255.0
 negotiation auto
!
interface GigabitEthernet3
 vnet trunk
 ip address 192.168.56.5 255.255.255.0
 negotiation auto
!
interface GigabitEthernet4
 no ip address
 shutdown
 negotiation auto
!
router ospf 1 vrf Blue
 network 192.168.1.0 0.0.0.255 area 0
 network 192.168.56.0 0.0.0.255 area 0
!
router ospf 2 vrf Red
 network 192.168.2.0 0.0.0.255 area 0
 network 192.168.56.0 0.0.0.255 area 0
!
!
virtual-service csr_mgmt
!
ip forward-protocol nd
!
no ip http server
no ip http secure-server
!
!
!
!
!
control-plane
!
 !
 !
 !
 !
!
!
!
!
alias exec dc3 show derived-config | b GigabitEthernet3
alias exec srs sh run | s router
!
line con 0
 stopbits 1
line vty 0
 login    
line vty 1
 login
 length 0
line vty 2 4
 login
!
!
end

ISP1#          

ISP2#sh run
Building configuration...

Current configuration : 1657 bytes
!
! Last configuration change at 01:39:55 UTC Fri May 5 2017
!
version 15.6
service timestamps debug datetime msec
service timestamps log datetime msec
no platform punt-keepalive disable-kernel-core
platform console serial
!
hostname ISP2
!
boot-start-marker
boot-end-marker
!
!
vrf definition Blue
 vnet tag 10
 !
 address-family ipv4
 exit-address-family
!
vrf definition Red
 vnet tag 20
 !
 address-family ipv4
 exit-address-family
!
!
no aaa new-model
!
!
!
!
!
!
!
!
!



!
!
!
!         
!
!
!
!
!
!
subscriber templating
!
!
!
multilink bundle-name authenticated
!
!
!
!
!
!
!
!
!
!
!
!         
!
license udi pid CSR1000V sn 98KHYWG4AV9
!
spanning-tree extend system-id
!
!
redundancy
!
!
!
!
!
!
! 
!
!
!
!
!
!
!
!
!         
!
!
!
! 
! 
! 
! 
! 
! 
!
!
interface GigabitEthernet1
 vrf forwarding Blue
 ip address 192.168.3.254 255.255.255.0
 negotiation auto
!
interface GigabitEthernet2
 vrf forwarding Red
 ip address 192.168.4.254 255.255.255.0
 negotiation auto
!
interface GigabitEthernet3
 vnet trunk
 ip address 192.168.56.6 255.255.255.0
 negotiation auto
!
interface GigabitEthernet4
 no ip address
 shutdown
 negotiation auto
!
router ospf 1 vrf Blue
 network 192.168.3.0 0.0.0.255 area 0
 network 192.168.56.0 0.0.0.255 area 0
!
router ospf 2 vrf Red
 network 192.168.4.0 0.0.0.255 area 0
 network 192.168.56.0 0.0.0.255 area 0
!
!
virtual-service csr_mgmt
!
ip forward-protocol nd
!
no ip http server
no ip http secure-server
!
!
!
!
!
control-plane
!
 !
 !
 !
 !
!
!
!
!
alias exec dc3 show derived-config | b GigabitEthernet3
alias exec srs sh run | s router
!
line con 0
 stopbits 1
line vty 0
 login
line vty 1
 login
 length 0
line vty 2 4
 login
!
!
end

ISP2#   

Blue2#sh run
Building configuration...

Current configuration : 1229 bytes
!
! Last configuration change at 01:23:16 UTC Fri May 5 2017
!
version 15.6
service timestamps debug datetime msec
service timestamps log datetime msec
no platform punt-keepalive disable-kernel-core
platform console serial
!
hostname Blue2
!
boot-start-marker
boot-end-marker
!
!
no logging console
!
no aaa new-model
!
!
!
!         
!
!
!
!
!



!
!
!
!
!
!
!
!
!
!
subscriber templating
!
!
!
multilink bundle-name authenticated
!
!
!
!
!
!
!
!
!
!
!
!
!
license udi pid CSR1000V sn 91RY9ZNDXH1
!
spanning-tree extend system-id
!
!
redundancy
!
!
!
!         
!
!
! 
!
!
!
!
!
!
!
!
!
!
!
!
! 
! 
! 
! 
! 
! 
!
!         
interface GigabitEthernet1
 ip address 192.168.3.3 255.255.255.0
 negotiation auto
!
interface GigabitEthernet2
 no ip address
 shutdown
 negotiation auto
!
interface GigabitEthernet3
 no ip address
 shutdown
 negotiation auto
!
interface GigabitEthernet4
 no ip address
 shutdown
 negotiation auto
!
router ospf 1
 network 192.168.3.0 0.0.0.255 area 0
!
!         
virtual-service csr_mgmt
!
ip forward-protocol nd
!
no ip http server
no ip http secure-server
!
!
!
!
!
control-plane
!
 !
 !
 !
 !
!
!
!
!
alias exec srs sh run | s router
!         
line con 0
 stopbits 1
line vty 0
 login
line vty 1
 login
 length 0
line vty 2 4
 login
!
!
end

Blue2#          


Red2#sh run
Building configuration...

Current configuration : 1228 bytes
!
! Last configuration change at 01:23:20 UTC Fri May 5 2017
!
version 15.6
service timestamps debug datetime msec
service timestamps log datetime msec
no platform punt-keepalive disable-kernel-core
platform console serial
!
hostname Red2
!
boot-start-marker
boot-end-marker
!
!
no logging console
!
no aaa new-model
!
!
!
!         
!
!
!
!
!



!
!
!
!
!
!
!
!
!
!
subscriber templating
!
!
!
multilink bundle-name authenticated
!
!
!
!
!
!
!
!
!
!
!
!
!
license udi pid CSR1000V sn 9XQ8OPC55ZT
!
spanning-tree extend system-id
!
!
redundancy
!
!
!
!         
!
!
! 
!
!
!
!
!
!
!
!
!
!
!
!
! 
! 
! 
! 
! 
! 
!
!         
interface GigabitEthernet1
 ip address 192.168.4.4 255.255.255.0
 negotiation auto
!
interface GigabitEthernet2
 no ip address
 shutdown
 negotiation auto
!
interface GigabitEthernet3
 no ip address
 shutdown
 negotiation auto
!
interface GigabitEthernet4
 no ip address
 shutdown
 negotiation auto
!
router ospf 2
 network 192.168.4.0 0.0.0.255 area 0
!
!         
virtual-service csr_mgmt
!
ip forward-protocol nd
!
no ip http server
no ip http secure-server
!
!
!
!
!
control-plane
!
 !
 !
 !
 !
!
!
!
!
alias exec srs sh run | s router
!         
line con 0
 stopbits 1
line vty 0
 login
line vty 1
 login
 length 0
line vty 2 4
 login
!
!
end

Red2#
(Lazaros Agapides) #21

Hello Don

Can you repost just the commands you used to configure the EVN trunk and the OSPF routing? It will make it clearer and easier to troubleshoot. Thanks!

Laz

(Don M) #22

Hopefully, this will be easier. I don’t know what it means when it says please use the “code” button to post configurations.
ISP1:

vrf definition Blue
 vnet tag 10
 !
 address-family ipv4
 exit-address-family
!
vrf definition Red
 vnet tag 20
 !
 address-family ipv4
 exit-address-family
!
interface GigabitEthernet1
 vrf forwarding Blue
 ip address 192.168.1.254 255.255.255.0
 negotiation auto
!
interface GigabitEthernet2
 vrf forwarding Red
 ip address 192.168.2.254 255.255.255.0
 negotiation auto
!
interface GigabitEthernet3
 vnet trunk
 ip address 192.168.56.5 255.255.255.0
 negotiation auto
!

!
router ospf 1 vrf Blue
 network 192.168.1.0 0.0.0.255 area 0
 network 192.168.56.0 0.0.0.255 area 0
!
router ospf 2 vrf Red
 network 192.168.2.0 0.0.0.255 area 0
 network 192.168.56.0 0.0.0.255 area 0
!

ISP2:

vrf definition Blue
 vnet tag 10
 !
 address-family ipv4
 exit-address-family
!
vrf definition Red
 vnet tag 20
 !
 address-family ipv4
 exit-address-family
!

interface GigabitEthernet1
 vrf forwarding Blue
 ip address 192.168.3.254 255.255.255.0
 negotiation auto
!
interface GigabitEthernet2
 vrf forwarding Red
 ip address 192.168.4.254 255.255.255.0
 negotiation auto
!
interface GigabitEthernet3
 vnet trunk
 ip address 192.168.56.6 255.255.255.0
 negotiation auto
!
!
router ospf 1 vrf Blue
 network 192.168.3.0 0.0.0.255 area 0
 network 192.168.56.0 0.0.0.255 area 0
!
router ospf 2 vrf Red
 network 192.168.4.0 0.0.0.255 area 0
 network 192.168.56.0 0.0.0.255 area 0
!
(Lazaros Agapides) #23

Hello Don.

I’m assuming the EVN trunk is working and that you’ve checked the VRF configuration, and you’ve successfully verified that the vnet trunk has been created with the appropriate show and ping commands. I’m also assuming you’ve checked the output from the command show derived-confg and that the subinterfaces Gi3.10 and Gi3.20 are showing up. Check these first to see that the EVN is working correctly before any routing has been configured.

Looking through your config, I’m not able to find something that stands out as an error. It seems like it should work. Are you using GNS3, real devices or VIRL? Try doing a debug on OSPF to see that hello packets are being sent and see if any are being rejected on the other end or if they’re not actually reaching their destination.

I hope this at least gives you a fresh starting point for your troubleshooting. Keep us posted!

Laz

(Don M) #24

Yes to all of your config questions. I can ping across the trunk, but no neighborship. It is GNS3 with csr1000v (free trial) routers. The vrf config is good. It behaves as expected from the ISP router to the Bluex and Redx routers.

I did turn on ospf debugging and I see the hello going out, but nothing comes back.

(Lazaros Agapides) #25

Hello Don.

I’m not sure how else I can be of help. It looks to me to be a glitch within the GNS3 engine. If everything else is functioning, it is very strange. I will have @ReneMolenaar take a look and see if he has any suggestions.

Thanks!

Laz

(Mercedes G) #26

Hi Rene,

I would like to understand why vrf Green gets all connected and ospf routes replicated from Red and Blue, however when you check vrf Blue route table, for example, only the connected route from Red (replicated from Green) is there, but not the ospf route:

ISP1#show ip route vrf Green (snippet only showing routes copied from vrf Blue & Red)

C   +    192.168.1.0/24 is directly connected, GigabitEthernet1
L        192.168.1.254/32 is directly connected, GigabitEthernet1
      192.168.2.0/24 is variably subnetted, 2 subnets, 2 masks
C   +    192.168.2.0/24 is directly connected, GigabitEthernet2
L        192.168.2.254/32 is directly connected, GigabitEthernet2
O   + 192.168.3.0/24 
           [110/2] via 192.168.56.6 (Blue), 01:26:38, GigabitEthernet3.10
O   + 192.168.4.0/24 
           [110/2] via 192.168.56.6 (Red), 01:19:37, GigabitEthernet3.20
ISP1#show ip route vrf Blue (snippet only showing routes copied from Green/Red)


C   +    5.5.5.0/24 is directly connected, Loopback0  (copied from Green)
L        5.5.5.5/32 is directly connected, Loopback0
      192.168.2.0/32 is subnetted, 1 subnets
L   +    192.168.2.254 is directly connected, GigabitEthernet2 (copied from Green but originally a Red route)

I was also expecting to see this, since that is an originally ospf route in vrf Red that got copied to Green and since all Green routes are replicated to Blue, still don’t get why this one doesn’t make it.

O   + 192.168.4.0/24 
           [110/2] via 192.168.56.6 (Red), 01:19:37, GigabitEthernet3.20
(Rene Molenaar) #27

Hi Mercedes,

Good question, I can’t think of any technical reason why those routes don’t show up but I think they did it on purpose. EVN is one of those “automatically” solutions (unlike VRF lite) and I think they do it so you don’t accidentally share routes from VRF X > Y > Z unintentionally.

If you look at vrf Blue on ISP1, it doesn’t have the entire 192.168.2.0/254 network from VRF Red but only 192.168.2.254 (its own IP address).

Rene

(Kevin W) #28

Hi not a big deal since all the configs work for me and I can lab this, but I am using the
c7200-adventerprisek9-mz.152-4.S3.image not a XE router and everything seems to work fine for me. Am I not running a “true” EVN? Thanks for any help you can give me!

(Rene Molenaar) #29

Hi Kevin,

If the commands are supported and it works then it’s all good. I didn’t know the 7200 also supported this.

Rene

1 Like
(Fady K) #30

Dear Rene, in your video explaining EVN, What kind of SSH/Telnet client are you using? The blue lined background caught my eyes lol

Oh and thanks for the easy and clear explanation of the topic, choosing red and blue client is really smart.

(Lazaros Agapides) #31

Hello Fady

Based on other answers that Rene has given, I believe he uses SecureCRT. The colours and backgrounds can be configured accordingly.

I hope this has been helpful!

Laz

(Johnson J) #32

Hello!
Can you please let me know the difference between:

ip vrf forwarding and vrf forwarding under interface configuration.

(Lazaros Agapides) #33

Hello Johnson

The vrf forwarding command can only be used under the interface configuration. You may be referring to the ip vrf forwarding command which can also be implemented in global configuration mode.

Cisco explains the difference like so:

In earlier Cisco IOS releases, you created a VRF to be applied only to an IPv4 address family (single-protocol VRF) by entering the ip vrf command. To activate the single-protocol VRF on an interface, you entered the ip vrf forwarding (interface configuration) command.

You can now define multiple address families under the same VRF or configure separate VRFs for each IPv4 or IPv6 address family by entering the vrf definition command. To activate the multiprotocol VRF on an interface, you enter the vrf forwarding command. A given VRF, identified by its name and a set of policies, can apply to both an IPv4 VPN and an IPv6 VPN at the same time. This VRF can be activated on a given interface, even though the routing and forwarding tables are different for the IPv4 and IPv6 protocols.

This has been taken from the following Cisco documentation:

I hope this has been helpful!

Laz

1 Like
(Jeremy M) #34

In the VRF Lite lesson, a VRF was created with the ip vrf command, but in this lesson it’s vrf definition. What’s the difference between these?

(Lazaros Agapides) #35

Hello Jeremy

By using the ip vrf command, we are creating a single protocol VRF, namely using IPv4. The vrf definition command creates a VRF with multiprotocol support. So such a VRF can function using IPv4 and IPv6. Notice in this lesson that there is the added command address-family ipv4 which is required to specify the participating protocols, whereas under the ip vrf command, IP is already specified.

Essentially, both configurations are the same, from the moment that only IPv4 is being used.

I hope this has been helpful!

Laz

1 Like
(Kamil K) #36

My question is about a particular situation. What if we have another router in the middle, and we do not want any of its interfaces in any particular vrf but we do want his links to be used as VNET TRUNKS. Is there a way to accomplish such a task ?

I have tried to stick a router in the middle and have created two VRF’s on this router also enabled both interfaces connecting two neighboring routers as VNET TRUNKS.

These two remaining routers have the same vrf’s configured with the same VNET TAGS and enabled on some interfaces and if they were directly connected to each other they would have formed a VNET TRUNK no problem.

Than I have configured super simple OSPF to encompass all of the interfaces on the router in the middle and specific OSPF on both routers connecting to that middle one :slight_smile:

Unfortunately neighborships are not being formed and I am wandering what could I do to solve this. I did not really find any solution in Cisco’s docs for now, so decided to ask here. Sorry for the trouble …

Regards,
Kamil