Subject: VRF and overlapping addresses ...

From: Elwin Eliazer <[email-masked]>
Date: Sat, 21 Apr 2001 18:38:11 -0700 (PDT)

Hi,

The 2547bis states that, when a site is in multiple
VPNs, the VRF associated with that site contains
routes from the full set of VPNs of which the site is
a member.

Thus a VRF has an associated group of VPNs.

Though the VRF holds VPN-IPv4 addresses, the data-path
address-match can only be done with plain-IPv4
address, and hence these VPNs in the VPN group, have
to be in the same IP address space (or should not have
overlapping IP subnet/addresses).

However, section 1.4 in 2547bis-02 confuses me. It
states that, so long as the overlapping part of the
address space does not belong to any of the sites
which the two VPNs have in common, it should not be
ambiguous.

Take for example:

VPN-1 = site1, site2, site3
VPN-2 = site1, site4

Let's assume site2 and site4 have overlapping
addresses. When a packet destined for a host in site4
originates from site1, is looked up in PE, how is the
VRF able to choose between site2 and site4?

Am i missing something here?

Thanks,
Elwin.

=====
-------
Elwin Stelzer Eliazer
Corona Networks
San Jose, CA
408-519-3832
-------

__________________________________________________
Do You Yahoo!?
Yahoo! Auctions - buy the things you want at great prices
http://auctions.yahoo.com/

---

From: "Alexander Marhold" <[email-masked]>
Date: Sun, 22 Apr 2001 08:54:30 +0200

>Am i missing something here?

YES and NO, but it is not easy to detect
the simple answer is, that you must decide which addresses you will allow 
to enter site1 vrf, so for the overlapping addresses you should decide to
either not import them on site1 at all, or only from site2 and NOT from 
site 4 or vice versa.

Excerpt from DRAFT:
   If two VPNs have no sites in common, then they may have overlapping
   address spaces.  That is, a given address might be used in VPN V1 as
   the address of system S1, but in VPN V2 as the address of a
   completely different system S2.  This is a common situation when the
   VPNs each use an RFC1918 private address space.  
   (In fact, two VPNs
   which do have sites in common may have overlapping address spaces, as
   long as the overlapping part of the address space does not belong to
   any of the sites which the two VPNs have in common.)

Seeing your point I would suggest to  rephrase it that way:
   In fact, two VPNs
   which do have sites in common may have overlapping address spaces, as
   long as the overlapping part of the address space does not belong to
   any of the sites which the two VPNs have in common ...
   ...and those overlapping addresses are not forwarded to shared sites 
   from more than one VPN.)

---

From: Elwin Eliazer <[email-masked]>
Date: Mon, 23 Apr 2001 23:30:12 -0700 (PDT)

Alex,

Hope the corrections you have mentioned are the
intentions of the authors, and the draft gets updated
accordingly.

Thanks,
Elwin.

=====
-------
Elwin Stelzer Eliazer
Corona Networks
San Jose, CA
408-519-3832
-------