NETWORK ENGINEER BLOG

Tips and Reviews for Engineers

Cisco Shared Services について

例えば、VRF-Lite でネットワークを分離したとして、共通でアクセスする必要があるサービスがいくつかあります。仮想ネットワーク毎にサービスを用意するのは、費用的な問題等、現実的ではない場合があります。
Cisco の Route Replication は、異なる VRF の RIB*1を相互にコピーします。これにより、複雑なルートマージなしに、別の仮想ネットワークへ到達する事が可能となります。

f:id:FriendsNow:20130105155233p:plain:w600

上図は、ASR1001 を Fusion Point*2とした場合の Route Replication のイメージになります。
USER-A, USER-B, USER-C は、それぞれ SERVICES のネットワーク:172.16.1.0/24 の情報を持ちます。SERVICES では、USER-A, USER-B, USER-C の情報を持ちません。各ネットワークが重複しているためです。
SERVICES から、USER-A, USER-B, USER-C への通信については、NAT を使用して、到達性を確保します。

Route Replication 設定例

設定は下記のとおり、とてもシンプルです。

hostname ASR1001
!
vrf definition SERVICES
 !
 address-family ipv4
 exit-address-family
!
vrf definition USER-A
 !
 address-family ipv4
  route-replicate from vrf SERVICES unicast all
 exit-address-family
!
vrf definition USER-B
 !
 address-family ipv4
  route-replicate from vrf SERVICES unicast all
 exit-address-family
!
vrf definition USER-C
 !
 address-family ipv4
  route-replicate from vrf SERVICES unicast all
 exit-address-family
!
interface GigabitEthernet0/0/0
 no ip address
 negotiation auto
!
interface GigabitEthernet0/0/0.10
 encapsulation dot1Q 10
 vrf forwarding USER-A
 ip address 10.1.1.1 255.255.255.0
 ip nat inside
!
interface GigabitEthernet0/0/0.20
 encapsulation dot1Q 20
 vrf forwarding USER-B
 ip address 10.1.1.1 255.255.255.0
 ip nat inside
!
interface GigabitEthernet0/0/0.30
 encapsulation dot1Q 30
 vrf forwarding USER-C
 ip address 10.1.1.1 255.255.255.0
 ip nat inside
!
interface GigabitEthernet0/0/1
 no ip address
 negotiation auto
!
interface GigabitEthernet0/0/1.100
 encapsulation dot1Q 100
 vrf forwarding SERVICES
 ip address 172.16.1.1 255.255.255.0
 ip nat outside
!
ip nat inside source static 192.168.1.100 1.1.1.100 vrf USER-A
ip nat inside source static 192.168.1.100 1.1.2.100 vrf USER-B
ip nat inside source static 192.168.1.100 1.1.3.100 vrf USER-C
!
ip route vrf USER-A 192.168.1.0 255.255.255.0 10.1.1.2
ip route vrf USER-B 192.168.1.0 255.255.255.0 10.1.1.2
ip route vrf USER-C 192.168.1.0 255.255.255.0 10.1.1.2
<...snip...>

上記例では、SERVICE RIB を全てコピーしていますが、Route-MAP を併用し、任意のネットワークのみコピーする事も可能です。例えば、下記は tag:5000 を付与した静的ルートのみコピーする例になります。

ASR1001#conf t
Enter configuration commands, one per line.  End with CNTL/Z.
ASR1001(config)#vrf definition SERVICES
ASR1001(config-vrf)# address-family ipv4
ASR1001(config-vrf-af)#route-replicate from vrf USER-A unicast static route-map USER-A
ASR1001(config-vrf-af)#exit
ASR1001(config-vrf)#exit
ASR1001(config)#route-map USER-A
ASR1001(config-route-map)#match tag 5000
ASR1001(config-route-map)#exit
ASR1001(config)#ip route vrf USER-A 0.0.0.0 0.0.0.0 10.1.1.2 tag 5000
ルーティングテーブル確認方法

ルーティングテーブルの確認は、従来の show ip route vrf "VRF NAME" コマンド及び、routing-context モードから行う事が可能です。下記は、routing-context モードを使用した際の例になります。
左側に"+"が付いているネットワークが、Route Replication により、leak された情報になります。

VRF USER-A のルーティング情報

ASR1001#routing-context vrf USER-A
ASR1001%USER-A#sh ip route

Routing Table: USER-A
Codes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGP
       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area 
       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
       E1 - OSPF external type 1, E2 - OSPF external type 2
       i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
       ia - IS-IS inter area, * - candidate default, U - per-user static route
       o - ODR, P - periodic downloaded static route, H - NHRP, l - LISP
       + - replicated route, % - next hop override

Gateway of last resort is not set

      10.0.0.0/8 is variably subnetted, 2 subnets, 2 masks
C        10.1.1.0/24 is directly connected, GigabitEthernet0/0/0.10
L        10.1.1.1/32 is directly connected, GigabitEthernet0/0/0.10
      172.16.0.0/16 is variably subnetted, 4 subnets, 2 masks
C        172.16.1.0/24 is directly connected, GigabitEthernet0/0/1.10
L        172.16.1.1/32 is directly connected, GigabitEthernet0/0/1.10
C   +    172.16.1.0/24 
           is directly connected (SERVICES), GigabitEthernet0/0/1.100
L        172.16.1.1/32 is directly connected, GigabitEthernet0/0/1.100
S     192.168.1.0/24 [1/0] via 10.1.1.2

VRF USER-B のルーティング情報

ASR1001%USER-A#routing-context vrf USER-B
ASR1001%USER-B#sh ip route

Routing Table: USER-B
Codes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGP
       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area 
       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
       E1 - OSPF external type 1, E2 - OSPF external type 2
       i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
       ia - IS-IS inter area, * - candidate default, U - per-user static route
       o - ODR, P - periodic downloaded static route, H - NHRP, l - LISP
       + - replicated route, % - next hop override

Gateway of last resort is not set

      10.0.0.0/8 is variably subnetted, 2 subnets, 2 masks
C        10.1.1.0/24 is directly connected, GigabitEthernet0/0/0.20
L        10.1.1.1/32 is directly connected, GigabitEthernet0/0/0.20
      172.16.0.0/16 is variably subnetted, 4 subnets, 2 masks
C        172.16.1.0/24 is directly connected, GigabitEthernet0/0/1.20
L        172.16.1.1/32 is directly connected, GigabitEthernet0/0/1.20
C   +    172.16.1.0/24 
           is directly connected (SERVICES), GigabitEthernet0/0/1.100
L        172.16.1.1/32 is directly connected, GigabitEthernet0/0/1.100
S     192.168.1.0/24 [1/0] via 10.1.1.2

VRF USER-C のルーティング情報

ASR1001%USER-B#routing-context vrf USER-C
ASR1001%USER-C#sh ip route

Routing Table: USER-C
Codes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGP
       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area 
       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
       E1 - OSPF external type 1, E2 - OSPF external type 2
       i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
       ia - IS-IS inter area, * - candidate default, U - per-user static route
       o - ODR, P - periodic downloaded static route, H - NHRP, l - LISP
       + - replicated route, % - next hop override

Gateway of last resort is not set

      10.0.0.0/8 is variably subnetted, 2 subnets, 2 masks
C        10.1.1.0/24 is directly connected, GigabitEthernet0/0/0.30
L        10.1.1.1/32 is directly connected, GigabitEthernet0/0/0.30
      172.16.0.0/16 is variably subnetted, 4 subnets, 2 masks
C        172.16.1.0/24 is directly connected, GigabitEthernet0/0/1.30
L        172.16.1.1/32 is directly connected, GigabitEthernet0/0/1.30
C   +    172.16.1.0/24 
           is directly connected (SERVICES), GigabitEthernet0/0/1.100
L        172.16.1.1/32 is directly connected, GigabitEthernet0/0/1.100
S     192.168.2.0/24 [1/0] via 10.1.1.2

VRF SERVICES のルーティング情報

ASR1001%USER-C#routing-context vrf SERVICES
ASR1001%SERVICES#sh ip route

Routing Table: SERVICES
Codes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGP
       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area 
       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
       E1 - OSPF external type 1, E2 - OSPF external type 2
       i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
       ia - IS-IS inter area, * - candidate default, U - per-user static route
       o - ODR, P - periodic downloaded static route, H - NHRP, l - LISP
       + - replicated route, % - next hop override

Gateway of last resort is not set

      172.16.0.0/16 is variably subnetted, 2 subnets, 2 masks
C        172.16.1.0/24 is directly connected, GigabitEthernet0/0/1.100
L        172.16.1.1/32 is directly connected, GigabitEthernet0/0/1.100

なお、Native なルーティングテーブルに戻るには、"routing-context vrf global" を発行します。

*1:Routing Infomation Base

*2:異なる VRF RIB を共存させるポイント