# When and where to use "capability vrf-lite"

**URL:** https://forum.networklessons.com/t/when-and-where-to-use-capability-vrf-lite/14877
**Category:** MPLS
**Created:** [July 13, 2021, 1:28am UTC](https://forum.networklessons.com/t/when-and-where-to-use-capability-vrf-lite/14877 "2021-07-13T01:28:32Z")
**Posts on this page:** 1
**Showing post:** 2

<div class="post-metadata">

### Author: ![lagapidis](https://cdn-forum.networklessons.com/user_avatar/forum.networklessons.com/lagapidis/32/4949_2.png) [@lagapidis](https://forum.networklessons.com/u/lagapidis)
#### Post date: [July 14, 2021, 6:48am UTC](https://forum.networklessons.com/t/when-and-where-to-use-capability-vrf-lite/14877/2 "2021-07-14T06:48:58Z")

</div>

Hello James

The `capability vrf-lite` command is used to suppress provider edge (PE) checks that are needed to prevent loops when the PE is performing mutual redistribution of packets between the OSPF and BGP protocols. When VRFs are being used on a router that is not a PE, that is, one that is not running BGP like a CE, then the checks can be turned off to allow for correct population of the VRF routing table.

Specifically, this command should be enabled:

- only on the CE router
- only when you have VRFs on your CE router

The specific check that is suppressed is the DN check. This [Cisco documentation](https://www.cisco.com/c/en/us/support/docs/ip/open-shortest-path-first-ospf/117588-technote-dnbit-00.html#anc2) explains it like so. It describes the issue using the NX-OS, but the principle is the same:

> In an L3VPN setup with OSPF used as a routing protocol between PE and CE routers, when MP-BGP (Border Gateway Protocol) routes that come over from an Multiprotocol Label Switching (MPLS) cloud are redistributed into OSPF on the PE router, all LSAs (whether type 3, type 5 or type 7) are generated with the DN bit set. When a PE receives, from a CE router, a type 3, 5, or 7 LSA with the DN bit set, the information from the LSA is not used in the OSPF route calculation. As a result, the LSA is not translated into a BGP route. The DN bit check prevents routing loops.

More detailed info can be found about this particular feature in the following Cisco links:

> **[IP Routing: OSPF Configuration Guide, Cisco IOS Release 15SY - OSPF Support...](https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/iproute_ospf/configuration/15-sy/iro-15-sy-book/iro-sup-vrf.html)**
>
> IP Routing: OSPF Configuration Guide, Cisco IOS Release 15SY -OSPF Support for Multi-VRF on CE Routers

> **[Where to configure the "capability vrf lite", on CE or PE?](https://community.cisco.com/t5/routing/where-to-configure-the-quot-capability-vrf-lite-quot-on-ce-or-pe/td-p/2812305)**
>
> My understanding is: 1. "capability vrf lite" will make OSPF process to install the routes even with DN bit set. 2. PE running VRF will set the DN bit when advertising to CE if OSPF is used for PE-CE routing. But CE is the device to check the DN bit...

I hope this has been helpful!

Laz

---

_[View the full topic](https://forum.networklessons.com/t/when-and-where-to-use-capability-vrf-lite/14877)._