CH A P T E R 12

Configuring Layer 3 Virtualization

This chapter describes how to configure Layer 3 virtualization.

This chapter includes the following sections:
• Layer 3 Virtualization, page 12-1
• Licensing Requirements for VRFs, page 12-5
• Guidelines and Limitations, page 12-5
• Default Settings, page 12-6
• Configuring VRFs, page 12-6
• Verifying the VRF Configuration, page 12-13
• Configuration Examples for VRF, page 12-13
• Related Topics, page 12-14
• Additional References, page 12-14

Layer 3 Virtualization
This section includes the following topics:
• Overview of Layer 3 Virtualization, page 12-1
• VRF and Routing, page 12-2
• VRF-Aware Services, page 12-3

Overview of Layer 3 Virtualization

Cisco NX-OS supports virtual routing and forwarding instances (VRFs). Each VRF contains a separate
address space with unicast and multicast route tables for IPv4 and IPv6 and makes routing decisions
independent of any other VRF.
Each router has a default VRF and a management VRF. All Layer 3 interfaces and routing protocols exist
in the default VRF until you assign them to another VRF. The mgmt0 interface exists in the management
VRF. With the VRF-lite feature, the switch supports multiple VRFs in customer edge (CE) switches.
VRF-lite allows a service provider to support two or more Virtual Private Networks (VPNs) with
overlapping IP addresses using one interface.

Cisco Nexus 5600 Series NX-OS Unicast Routing Configuration Guide, Release 7.x
OL-31642-01 12-1
 Chapter 12 Configuring Layer 3 Virtualization
Layer 3 Virtualization

Note The switch does not use Multiprotocol Label Switching (MPLS) to support VPNs.

VRF and Routing

All unicast and multicast routing protocols support VRFs. When you configure a routing protocol in a
VRF, you set routing parameters for the VRF that are independent of routing parameters in another VRF
for the same routing protocol instance.
You can assign interfaces and route protocols to a VRF to create virtual Layer 3 networks. An interface
exists in only one VRF. Figure 12-1 shows one physical network split into two virtual networks with two
VRFs. Routers Z, A, and B exist in VRF Red and form one address domain. These routers share route
updates that do not include router C because router C is configured in a different VRF.

Figure 12-1 VRFs in a Network

Router B
Router A Ethernet 2/1
Router Z
Ethernet 1/1 VRF Red
VRF Red
Ethernet 2/2

186416
VRF Blue
Router C

By default, Cisco NX-OS uses the VRF of the incoming interface to select which routing table to use for
a route lookup. You can configure a route policy to modify this behavior and set the VRF that Cisco
NX-OS uses for incoming packets.
Cisco NX-OS supports route leaking (import and export) between VRFs in a VRF lite scenario. The
following are guidelines for the VRF route-leak feature:
• Supports route-leak between any two non-default VRFs and route-leak from the default VRF to any
other VRF.
• Route-leak to the default VRF is not allowed as it is a global VRF.
• The route-leak feature is implemented using export and import route-targets under the VRF context.
• Filtering a part of the route-leak is done by using route-maps with the match ip address command.
• By default, the maximum prefix that can be leaked is 1000 routes. This is configurable.
• The route-leak feature must have an Enterprise license and the BGP feature enabled.

VRF-Lite
VRF-lite is a feature that enables a service provider to support two or more VPNs, where IP addresses
can be overlapped among the VPNs. VRF-lite uses input interfaces to distinguish routes for different
VPNs and forms virtual packet-forwarding tables by associating one or more Layer 3 interfaces with
each VRF. Interfaces in a VRF can be either physical, such as Ethernet ports, or logical, such as VLAN
SVIs, but a Layer 3 interface cannot belong to more than one VRF at any time.

Cisco Nexus 5600 Series NX-OS Unicast Routing Configuration Guide, Release 7.x
12-2 OL-31642-01
 Chapter 12 Configuring Layer 3 Virtualization
Layer 3 Virtualization

Note Multiprotocol Label Switching (MPLS) and MPLS control plane are not supported in the VRF-lite
implementation.

Note VRF-lite interfaces must be Layer 3 interfaces.

VRF-Aware Services
A fundamental feature of the Cisco NX-OS architecture is that every IP-based feature is VRF aware.
The following VRF-aware servics can select a particular VRF to reach a remote server or to filter
information based on the selected VRF:
• AAA—See the Cisco Nexus 6000 Series NX-OS Security Configuration Guide, Release 7.x, for more
information.
• Call Home—See the Cisco Nexus 6000 Series NX-OS System Management Configuration Guide,
Release 7.x, for more information.
• HSRP—See Chapter 17, “Configuring HSRP” for more information.
• HTTP—See the Cisco Nexus 6000 Series NX-OS Fundamentals Configuration Guide, Release 7.x,
for more information.
• Licensing—See the Cisco NX-OS Licensing Guide for more information.
• NTP—See the Cisco Nexus 6000 Series NX-OS System Management Configuration Guide, Release
7.x, for more information.
• RADIUS—See the Cisco Nexus 6000 Series NX-OS Security Configuration Guide, Release 7.x, for
more information.
• Ping and Traceroute —See the Cisco Nexus 6000 Series NX-OS Fundamentals Configuration Guide,
Release 7.x, for more information.
• SSH—See the Cisco Nexus 6000 Series NX-OS Fundamentals Configuration Guide, Release 7.x, for
more information.
• SNMP—See the Cisco Nexus 6000 Series NX-OS System Management Configuration Guide,
Release 7.x, for more information.
• Syslog—See the Cisco Nexus 6000 Series NX-OS System Management Configuration Guide,
Release 7.x, for more information.
• TACACS+—See the Cisco Nexus 6000 Series NX-OS Security Configuration Guide, Release 7.x, for
more information.
• TFTP—See the Cisco Nexus 6000 Series NX-OS Fundamentals Configuration Guide, Release 7.x,
for more information.
• VRRP—See Chapter 18, “Configuring VRRP” for more information.
See the appropriate configuration guide for each service for more information on configuring VRF
support in that service.
This section contains the following topics:
• Reachability, page 12-4
• Filtering, page 12-4

Cisco Nexus 5600 Series NX-OS Unicast Routing Configuration Guide, Release 7.x
OL-31642-01 12-3
 Chapter 12 Configuring Layer 3 Virtualization
Layer 3 Virtualization

• Combining Reachability and Filtering, page 12-4

Reachability
Reachability indicates which VRF contains the routing information necessary to get to the server
providing the service. For example, you can configure an SNMP server that is reachable on the
management VRF. When you configure that server address on the router, you also configure which VRF
that Cisco NX-OS must use to reach the server.
Figure 12-2 shows an SNMP server that is reachable over the management VRF. You configure router A
to use the management VRF for SNMP server host 192.0.2.1.

Figure 12-2 Service VRF Reachability

SNMP Server
Router A 192.0.2.1
mgmt0
VRF management
186417

Filtering
Filtering allows you to limit the type of information that goes to a VRF-aware service based on the VRF.
For example, you can configure a syslog server to support a particular VRF. Figure 12-3 shows two
syslog servers with each server supporting one VRF. syslog server A is configured in VRF Red, so Cisco
NX-OS sends only system messages generated in VRF Red to syslog server A.

Figure 12-3 Service VRF Filtering

Syslog Server A
Ethernet 2/1
VRF Red
Router A
Ethernet 2/2
186418

VRF Blue
Syslog Server B

Combining Reachability and Filtering

You can combine reachability and filtering for VRF-aware services. You configure the VRF that Cisco
NX-OS uses to connect to that service as well as the VRF that the service supports. If you configure a
service in the default VRF, you can optionally configure the service to support all VRFs.
Figure 12-4 shows an SNMP server that is reachable on the management VRF. You can configure the
SNMP server to support only the SNMP notifications from VRF Red, for example.

Cisco Nexus 5600 Series NX-OS Unicast Routing Configuration Guide, Release 7.x
12-4 OL-31642-01
 Chapter 12 Configuring Layer 3 Virtualization
Licensing Requirements for VRFs

Figure 12-4 Service VRF Reachability Filtering

Router B
SNMP Server Ethernet 2/1
192.0.2.1 Router A
VRF Red
mgmt0
VRF management
Ethernet 2/2

186419
VRF Blue
Router C

Licensing Requirements for VRFs

The following table shows the licensing requirements for this feature:

Product License Requirement

Cisco NX-OS VRFs require no license. Any feature not included in a license package is bundled with the Cisco NX-OS
system images and is provided at no extra charge to you. For a complete explanation of the Cisco NX-OS
licensing scheme, see the Cisco NX-OS Licensing Guide.
Note The NX-OS base license allows you to use the default VRF and you can use the management VRF
for the mgmt0 port. The two default VRFs are automatically created. VRF-lite allows you to create
additional VRFs. The additional VRFs need the NX-OS base license as well.

Guidelines and Limitations

VRFs have the following configuration guidelines and limitations:
• When you make an interface a member of an existing VRF, Cisco NX-OS removes all Layer 3
configuration. You should configure all Layer 3 parameters after adding an interface to a VRF.
• You should add the mgmt0 interface to the management VRF and configure the mgmt0 IP address
and other parameters after you add it to the management VRF.
• If you configure an interface for a VRF before the VRF exists, the interface is operationally down
until you create the VRF.
• Cisco NX-OS creates the default and management VRFs by default. You should make the mgmt0
interface a member of the management VRF.
• The write erase boot command does not remove the management VRF configuration. You must use
the write erase command and then the write erase boot command.
VRF-lite has the following guidelines and limitations:
• A switch with VRF-lite has a separate IP routing table for each VRF, which is separate from the
global routing table.
• Because VRF-lite uses different VRF tables, the same IP addresses can be reused. Overlapped IP
addresses are allowed in different VPNs.
• VRF-lite does not support all MPLS-VRF functionality; it does not support label exchange, LDP
adjacency, or labeled packets.

Cisco Nexus 5600 Series NX-OS Unicast Routing Configuration Guide, Release 7.x
OL-31642-01 12-5
 Chapter 12 Configuring Layer 3 Virtualization
Default Settings

• Multiple virtual Layer 3 interfaces can be connected to a VRF-lite switch.

• The switch supports configuring a VRF by using physical ports, VLAN SVIs, or a combination of
both. The SVIs can be connected through an access port or a trunk port.
• The Layer 3 TCAM resource is shared between all VRFs.
• A switch using VRF can support one global network and up to 64 VRFs. The total number of routes
supported is limited by the size of the TCAM.
• VRF-lite supports BGP, RIP, static routing, EIGRP, EIGRPv6, OSPF, and OSPFv3.
• VRF-lite does not affect the packet switching rate.

Default Settings
Table 12-1 lists the default settings for VRF parameters.

Table 12-1 Default VRF Parameters

Parameters Default
Configured VRFs default, management
routing context default VRF

Configuring VRFs
This section contains the following topics:
• Creating a VRF, page 12-6
• Assigning VRF Membership to an Interface, page 12-8
• Configuring VRF Parameters for a Routing Protocol, page 12-9
• Configuring a VRF-Aware Service, page 12-11
• Setting the VRF Scope, page 12-12

Note If you are familiar with the Cisco IOS CLI, be aware that the Cisco NX-OS commands for this feature
might differ from the Cisco IOS commands that you would use.

Creating a VRF
You can create a VRF in a switch.

SUMMARY STEPS

1. configure terminal
2. vrf context name
3. ip route {ip-prefix | ip-addr ip-mask} {[next-hop | nh-prefix] | [interface next-hop | nh-prefix]} [tag
tag-value [pref]]

Cisco Nexus 5600 Series NX-OS Unicast Routing Configuration Guide, Release 7.x
12-6 OL-31642-01
 Chapter 12 Configuring Layer 3 Virtualization
Configuring VRFs

4. (Optional) show vrf [vrf-name]

5. (Optional) copy running-config startup-config

DETAILED STEPS

Command Purpose
Step 1 configure terminal Enters configuration mode.
Example:
switch# configure terminal
switch(config)#
Step 2 vrf context name Creates a new VRF and enters VRF configuration
mode. The name can be any case-sensitive,
Example:
switch(config)# vrf context Enterprise
alphanumeric string up to 32 characters.
switch(config-vrf)#
Step 3 ip route {ip-prefix | ip-addr ip-mask} Configures a static route and the interface for this
{[next-hop | nh-prefix] | [interface static route. You can optionally configure the next-hop
next-hop | nh-prefix]} [tag tag-value
[pref]
address. The preference value sets the administrative
distance. The range is from 1 to 255. The default is 1.
Example:
switch(config-vrf)# ip route 192.0.2.0/8
ethernet 1/2 192.0.2.4
Step 4 show vrf [vrf-name] (Optional) Displays VRF information.
Example:
switch(config-vrf)# show vrf Enterprise
Step 5 copy running-config startup-config (Optional) Saves this configuration change.
Example:
switch(config)# copy running-config
startup-config

Use the no vrf context command to delete the VRF and the associated configuration:

Command Purpose
no vrf context name Deletes the VRF and all associated configuration.
Example:
switch(config)# no vrf context Enterprise

Any commands available in global configuration mode are also available in VRF configuration mode.
This example shows how to create a VRF and add a static route to the VRF:
switch# configure terminal
switch(config)# vrf context Enterprise
switch(config-vrf)# ip route 192.0.2.0/8 ethernet 1/2
switch(config-vrf)# exit
switch(config)# copy running-config startup-config

Cisco Nexus 5600 Series NX-OS Unicast Routing Configuration Guide, Release 7.x
OL-31642-01 12-7
 Chapter 12 Configuring Layer 3 Virtualization
Configuring VRFs

Assigning VRF Membership to an Interface

You can make an interface a member of a VRF.

BEFORE YOU BEGIN

Assign the IP address for an interface after you have configured the interface for a VRF.

SUMMARY STEPS

1. configure terminal
2. interface interface-type slot/port
3. no switchport
4. vrf member vrf-name
5. ip-address ip-prefix/length
6. (Optional) show vrf vrf-name interface interface-type number
7. (Optional) copy running-config startup-config

DETAILED STEPS

Command Purpose
Step 1 configure terminal Enters configuration mode.
Example:
switch# configure terminal
switch(config)#
Step 2 interface interface-type slot/port Enters interface configuration mode.
Example: Note If this is a 10G breakout port, the slot/port
switch(config)# interface ethernet 1/2 syntax is slot/QSFP-module/port.
switch(config-if)#

Step 3 no switchport Configures the interface as a Layer 3 routed interface.

Example:
switch(config-if)# no switchport
Step 4 vrf member vrf-name Adds this interface to a VRF.
Example:
switch(config-if)# vrf member
RemoteOfficeVRF
Step 5 ip address ip-prefix/length Configures an IP address for this interface. You must
do this step after you assign this interface to a VRF.
Example:
switch(config-if)# ip address
192.0.2.1/16

Cisco Nexus 5600 Series NX-OS Unicast Routing Configuration Guide, Release 7.x
12-8 OL-31642-01
 Chapter 12 Configuring Layer 3 Virtualization
Configuring VRFs

Command Purpose
Step 6 show vrf vrf-name interface (Optional) Displays VRF information.
interface-type number

Example:
switch(config-vrf)# show vrf Enterprise
interface ethernet 1/2
Step 7 copy running-config startup-config (Optional) Saves this configuration change.
Example:
switch(config)# copy running-config
startup-config

This example shows how to add an interface to the VRF:

switch# configure terminal
switch(config)# interface ethernet 1/2
switch(config-if)# no switchport
switch(config-if)# vrf member RemoteOfficeVRF
switch(config-if)# ip address 192.0.2.1/16
switch(config-if)# copy running-config startup-config

Configuring VRF Parameters for a Routing Protocol

You can associate a routing protocol with one or more VRFs. See the appropriate chapter for information
on how to configure VRFs for the routing protocol. This section uses OSPFv2 as an example protocol
for the detailed configuration steps.

SUMMARY STEPS

1. configure terminal
2. router ospf instance-tag
3. vrf vrf-name
4. (Optional) maximum-paths paths
5. interface interface-type slot/port
6. no switchport
7. vrf member vrf-name
8. ip address ip-prefix/length
9. ip router ospf instance-tag area area-id
10. (Optional) copy running-config startup-config

Cisco Nexus 5600 Series NX-OS Unicast Routing Configuration Guide, Release 7.x
OL-31642-01 12-9
 Chapter 12 Configuring Layer 3 Virtualization
Configuring VRFs

DETAILED STEPS

Command Purpose
Step 1 configure terminal Enters configuration mode.
Example:
switch# configure terminal
switch(config)#
Step 2 router ospf instance-tag Creates a new OSPFv2 instance with the configured
instance tag.
Example:
switch(config-vrf)# router ospf 201
switch(config-router)#
Step 3 vrf vrf-name Enters VRF configuration mode.
Example:
switch(config-router)# vrf
RemoteOfficeVRF
switch(config-router-vrf)#
Step 4 maximum-paths paths (Optional) Configures the maximum number of equal
OSPFv2 paths to a destination in the route table for this
Example:
switch(config-router-vrf)# maximum-paths
VRF. Used for load balancing.
4
Step 5 interface interface-type slot/port Enters interface configuration mode.
Example: Note If this is a 10G breakout port, the slot/port
switch(config)# interface ethernet 1/2 syntax is slot/QSFP-module/port.
switch(config-if)#

Step 6 no switchport Configures the interface as a Layer 3 routed interface.

Example:
switch(config-if)# no switchport
Step 7 vrf member vrf-name Adds this interface to a VRF.
Example:
switch(config-if)# vrf member
RemoteOfficeVRF
Step 8 ip address ip-prefix/length Configures an IP address for this interface. You must
do this step after you assign this interface to a VRF.
Example:
switch(config-if)# ip address
192.0.2.1/16
Step 9 ip router ospf instance-tag area area-id Assigns this interface to the OSPFv2 instance and area
configured.
Example:
switch(config-if)# ip router ospf 201
area 0
Step 10 copy running-config startup-config (Optional) Saves this configuration change.
Example:
switch(config)# copy running-config
startup-config

This example shows how to create a VRF and add an interface to the VRF:

Cisco Nexus 5600 Series NX-OS Unicast Routing Configuration Guide, Release 7.x
12-10 OL-31642-01
 Chapter 12 Configuring Layer 3 Virtualization
Configuring VRFs

switch# configure terminal

switch(config)# vrf context RemoteOfficeVRF
switch(config-vrf)# exit
switch(config)# router ospf 201
switch(config-router)# vrf RemoteOfficeVRF
switch(config-router-vrf)# maximum-paths 4
switch(config-router-vrf)# interface ethernet 1/2
switch(config-if)# no switchport
switch(config-if)# vrf member RemoteOfficeVRF
switch(config-if)# ip address 192.0.2.1/16
switch(config-if)# ip router ospf 201 area 0
switch(config-if)# exit
switch(config)# copy running-config startup-config

Configuring a VRF-Aware Service

You can configure a VRF-aware service for reachability and filtering. See the “VRF-Aware Services”
section on page 12-3 for links to the appropriate chapter or configuration guide for information on how
to configure the service for VRFs. This section uses SNMP and IP domain lists as example services for
the detailed configuration steps.

SUMMARY STEPS

1. configure terminal
2. snmp-server host ip-address [filter_vrf vrf-name] [use-vrf vrf-name]
3. vrf context [vrf-name]
4. ip domain-list domain-name [all-vrfs] [use-vrf vrf-name]
5. (Optional) copy running-config startup-config

DETAILED STEPS

Command Purpose
Step 1 configure terminal Enters configuration mode.
Example:
switch# configure terminal
switch(config)#
Step 2 snmp-server host ip-address [filter-vrf Configures a global SNMP server and configures the
vrf-name] [use-vrf vrf-name] VRF that Cisco NX-OS uses to reach the service. Use
Example:
the filter-vrf keyword to filter information from the
switch(config)# snmp-server host selected VRF to this server.
192.0.2.1 use-vrf Red
switch(config-vrf)#
Step 3 vrf context vrf-name Creates a new VRF.
Example:
switch(config)# vrf context Blue
switch(config-vrf)#

Cisco Nexus 5600 Series NX-OS Unicast Routing Configuration Guide, Release 7.x
OL-31642-01 12-11
 Chapter 12 Configuring Layer 3 Virtualization
Configuring VRFs

Command Purpose
Step 4 ip domain-list domain-name Configures the domain list in the VRF and optionally
[all-vrfs][use-vrf vrf-name] configures the VRF that Cisco NX-OS uses to reach
Example:
the domain name listed.
switch(config-vrf)# ip domain-list List
all-vrfs use-vrf Blue
switch(config-vrf)#
Step 5 copy running-config startup-config (Optional) Saves this configuration change.
Example:
switch(config)# copy running-config
startup-config

This example shows how to send SNMP information for all VRFs to SNMP host 192.0.2.1, reachable on
VRF Red:
switch# configure terminal
switch(config)# snmp-server host 192.0.2.1 for-all-vrfs use-vrf Red
switch(config)# copy running-config startup-config

This example shows how to Filter SNMP information for VRF Blue to SNMP host 192.0.2.12, reachable
on VRF Red:
switch# configure terminal
switch(config)# vrf definition Blue
switch(config-vrf)# snmp-server host 192.0.2.12 use-vrf Red
switch(config)# copy running-config startup-config

Setting the VRF Scope

You can set the VRF scope for all EXEC commands (for example, show commands). This automatically
restricts the scope of the output of EXEC commands to the configured VRF. You can override this scope
by using the VRF keywords available for some EXEC commands.
To set the VRF scope, use the following command in EXEC mode:

Command Purpose
routing-context vrf vrf-name Sets the routing context for all EXEC commands.
Default routing context is the default VRF.
Example:
switch# routing-context vrf red
switch%red#

To return to the default VRF scope, use the following command in EXEC mode:

Command Purpose
routing-context vrf default Sets the default routing context.
Example:
switch%red# routing-context vrf default
switch#

Cisco Nexus 5600 Series NX-OS Unicast Routing Configuration Guide, Release 7.x
12-12 OL-31642-01
 Chapter 12 Configuring Layer 3 Virtualization
Verifying the VRF Configuration

Verifying the VRF Configuration

To display the VRF configuration information, perform one of the following tasks:

Command Purpose
show vrf [vrf-name] Displays the information for all or one VRF.
show vrf [vrf-name] detail Displays detailed information for all or one VRF.
show vrf [vrf-name] [interface interface-type Displays the VRF status for an interface.
slot/port]
Note If this is a 10G breakout port, the slot/port
syntax is slot/QSFP-module/port.

Configuration Examples for VRF

This example shows how to configure VRF Red, add an SNMP server to that VRF, and add an instance
of OSPF to VRF Red:
configure terminal
vrf context Red
snmp-server host 192.0.2.12 use-vrf Red
router ospf 201
interface ethernet 1/2
no switchport
vrf member Red
ip address 192.0.2.1/16
ip router ospf 201 area 0

This example shows how to configure VRF Red and Blue, add an instance of OSPF to each VRF, and
create an SNMP context for each OSPF instance in each VRF.:
configure terminal
!Create the VRFs
vrf context Red
vrf context Blue
!Create the OSPF instances and associate them with each VRF
feature ospf
router ospf Lab
vrf Red
router ospf Production
vrf Blue
!Configure one interface to use ospf Lab on VRF Red
interface ethernet 1/2
no switchport
vrf member Red
ip address 192.0.2.1/16
ip router ospf Lab area 0
no shutdown
!Configure another interface to use ospf Production on VRF Blue
interface ethernet 10/2
no switchport
vrf member Blue
ip address 192.0.2.1/16
ip router ospf Production area 0
no shutdown

Cisco Nexus 5600 Series NX-OS Unicast Routing Configuration Guide, Release 7.x
OL-31642-01 12-13
 Chapter 12 Configuring Layer 3 Virtualization
Related Topics

!configure the SNMP server

snmp-server user admin network-admin auth md5 nbv-12345
snmp-server community public ro
!Create the SNMP contexts for each VRF
snmp-server context lab instance Lab vrf Red
snmp-server context production instance Production vrf Blue

Use the SNMP context lab to access the OSPF-MIB values for the OSPF instance Lab in VRF
Red in this example.

Related Topics
The following topics can give more information on VRFs:
• Cisco Nexus 6000 Series NX-OS Fundamentals Configuration Guide, Release 7.x
• Cisco Nexus 6000 Series NX-OS System Management Configuration Guide, Release 7.x

Additional References
For additional information related to implementing virtualization, see the following sections:
• Related Documents, page 12-14
• Standards, page 12-14

Related Documents
Related Topic Document Title
VRF CLI Cisco Nexus 6000 Series Command Reference, Cisco NX-OS
Releases 7.x

Standards
Standards Title
No new or modified standards are supported by this —
feature, and support for existing standards has not been
modified by this feature.

Cisco Nexus 5600 Series NX-OS Unicast Routing Configuration Guide, Release 7.x
12-14 OL-31642-01