Subject: Management VPN implementation

From: "Steven Godfrey" <[email-masked]>
Date: Fri, 15 Jun 2001 12:36:26 +0100

Hi,
I have a question regarding the use of the management VPN.

They way I have implemented our management VPN on Cisco routers is by
importing all the other Route Descriptors in to the management VPN.
All the other VPN's also import the management VPN as shown below:
ip vrf CUST1
 rd 13009:106
 route-target export 13009:106
 route-target import 13009:106
 route-target import 13009:108
!
ip vrf CUST2
 rd 13009:110
 route-target export 13009:110
 route-target import 13009:110
 route-target import 13009:108
!
<<<<<SNIP>>>>>>>>>>>>
ip vrf MGMNT
 rd 13009:108
 route-target export 13009:108
 route-target import 13009:108
 route-target import 13009:10
 route-target import 13009:102
 route-target import 13009:106
 route-target import 13009:112
 route-target import 13009:110
 route-target import 13009:104
 route-target import 13009:114

This works fine at the moment, my question is when CUST3 is configured say
he uses the same address space as CUST2, i.e. 10.10.10.0/24 when I import
that route descriptor into the management VPN I will get conflicting address
space.

Has anyone resolved this issue in their implementation?

Thanks in Advance,

Steve.

---

From: "Alexander Marhold" <[email-masked]>
Date: Fri, 15 Jun 2001 18:03:09 +0200

Some points on that

a) importing via customer-RTs into the management VPN does not scale
and is cumbersome to implement as for each new customer you need to add
those import RTs

the better way is to export to a separate RT ( separate from any customer)
on all customer sites and to import that one in the MGMT-vrf

b) what connectivity does the MGMT really need ?

as Javier Antich in his mail has already mentioned it is typically the
loopback address only.

so the best way to do those things is:

1) using loopbackaddresses of a specified range for all managed routers
2) SELECTIVE export of only the loopback to this specific RT (RT-x1)
( using the "export map xxx" statement)
3) importing that RT in the MGMT-vrf
4) exporting the MGMT address using the RT (RT-x2)
5) importing that RT on all customer sites having a mangaged router
6) on the managed router specify that SNMP and other protocols are using the
loopback-address as source address for their messages

That`s it

then:
-> you only need one route map and can apply this to all customer vrf's
 can be a template)
-> whenever you enter a new customer site NO config changes on the MGMT site
is needed
-> it is a scalable solution

with best regards

Alexander

__/__/__/__/__/__/__/__/__/__/__/__/__/__/__/__/__/__/__/__/__/
     __/
    __/   Dipl.Ing. Alexander Marhold MBA
   __/   CCIE #3324, CCNP, CCDP, CCSI #20642
  __/   Core & IP Services <Senior Consultant>
 __/   Mobile: ++43-(0)664-16 28 234
__/    PRO IN http://www.proin.com

-----Original Message-----
From: [email-masked] [mailto:[email-masked]]On Behalf Of Steven
Godfrey
Sent: Friday, June 15, 2001 1:36 PM
To: [email-masked]
Subject: Management VPN implementation

Hi,

Thanks in Advance,

Steve.