# When and where to use "capability vrf-lite"

**URL:** <https://forum.networklessons.com/t/when-and-where-to-use-capability-vrf-lite/14877>\
**Category:** MPLS\
**Created:** [July 13, 2021, 1:28am UTC](https://forum.networklessons.com/t/when-and-where-to-use-capability-vrf-lite/14877 "2021-07-13T01:28:32Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![jmjohnston36](https://cdn-forum.networklessons.com/letter_avatar_proxy/v4/letter/j/bc79bd/32.png) [@jmjohnston36](https://forum.networklessons.com/u/jmjohnston36)\
**Post date:** [July 13, 2021, 1:28am UTC](https://forum.networklessons.com/t/when-and-where-to-use-capability-vrf-lite/14877/1 "2021-07-13T01:28:32Z")

</div>

Hello,

I’m trying to get some clarity on when the “capability vrf-lite” command is necessary when using OSPF as the CE-PE routing protocol for site-to-site connectivity with MPLS L3VPN. Is this command is only necessary if the CE router has VRF-Lite implemented with the VRF assigned interface associated with the OSPF instance? If so this would be required on both sides/sites? I hope this makes sense.

See below quick topology:

 ![image](https://cdn-forum.networklessons.com/uploads/default/original/2X/4/4c2a380b6d643d0ad611b10395bb51f7059d4178.png)

---

<div class="post-metadata">

**Author:** ![lagapidis](https://cdn-forum.networklessons.com/user_avatar/forum.networklessons.com/lagapidis/32/4949_2.png) [@lagapidis](https://forum.networklessons.com/u/lagapidis)\
**Post date:** [July 14, 2021, 6:48am UTC](https://forum.networklessons.com/t/when-and-where-to-use-capability-vrf-lite/14877/2 "2021-07-14T06:48:58Z")

</div>

Hello James

The `capability vrf-lite` command is used to suppress provider edge (PE) checks that are needed to prevent loops when the PE is performing mutual redistribution of packets between the OSPF and BGP protocols. When VRFs are being used on a router that is not a PE, that is, one that is not running BGP like a CE, then the checks can be turned off to allow for correct population of the VRF routing table.

Specifically, this command should be enabled:

- only on the CE router
- only when you have VRFs on your CE router

The specific check that is suppressed is the DN check. This [Cisco documentation](https://www.cisco.com/c/en/us/support/docs/ip/open-shortest-path-first-ospf/117588-technote-dnbit-00.html#anc2) explains it like so. It describes the issue using the NX-OS, but the principle is the same:

> In an L3VPN setup with OSPF used as a routing protocol between PE and CE routers, when MP-BGP (Border Gateway Protocol) routes that come over from an Multiprotocol Label Switching (MPLS) cloud are redistributed into OSPF on the PE router, all LSAs (whether type 3, type 5 or type 7) are generated with the DN bit set. When a PE receives, from a CE router, a type 3, 5, or 7 LSA with the DN bit set, the information from the LSA is not used in the OSPF route calculation. As a result, the LSA is not translated into a BGP route. The DN bit check prevents routing loops.

More detailed info can be found about this particular feature in the following Cisco links:

> **[IP Routing: OSPF Configuration Guide, Cisco IOS Release 15SY - OSPF Support...](https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/iproute_ospf/configuration/15-sy/iro-15-sy-book/iro-sup-vrf.html)**
>
> IP Routing: OSPF Configuration Guide, Cisco IOS Release 15SY -OSPF Support for Multi-VRF on CE Routers

> **[Where to configure the "capability vrf lite", on CE or PE?](https://community.cisco.com/t5/routing/where-to-configure-the-quot-capability-vrf-lite-quot-on-ce-or-pe/td-p/2812305)**
>
> My understanding is: 1. "capability vrf lite" will make OSPF process to install the routes even with DN bit set. 2. PE running VRF will set the DN bit when advertising to CE if OSPF is used for PE-CE routing. But CE is the device to check the DN bit...

I hope this has been helpful!

Laz

---

<div class="post-metadata">

**Author:** ![jmjohnston36](https://cdn-forum.networklessons.com/letter_avatar_proxy/v4/letter/j/bc79bd/32.png) [@jmjohnston36](https://forum.networklessons.com/u/jmjohnston36)\
**Post date:** [July 15, 2021, 3:36pm UTC](https://forum.networklessons.com/t/when-and-where-to-use-capability-vrf-lite/14877/3 "2021-07-15T15:36:33Z")

</div>

I appreciate your knowledge and answer. Thanks Laz!