Active Nodes
Active routers in this lab: EDGE-1, BORDER-1, CE-CORP-1
Key Concepts
Route Leaking: Global to VRF
To provide internet access from a VRF, the PE must leak the default route (or specific internet prefixes) from the global routing table into the VRF. This is achieved using a static route in the VRF pointing to the global table: ip route vrf CORP 0.0.0.0 0.0.0.0 GigabitEthernet0/1 global or by importing a global route with a second RT. The "global" keyword is critical — it tells the router to resolve the next-hop in the global table, not the VRF table.
NAT for VRF Internet Access
When VRF customers share an internet uplink, NAT translates the private VRF addresses to the PE public IP. The NAT rule uses ip nat inside vrf CORP source list VRF-CORP-NAT interface Gi0/1 overload — the VRF keyword scopes the NAT to only CORP traffic. Without the VRF keyword, NAT would apply to all VRFs indiscriminately, causing routing loops.
Import Map for Selective Leaking
A more scalable approach uses a second RT for internet prefixes. The internet PE adds RT 65000:9999 to the default route, and VRF CORP imports 65000:9999 in addition to 65000:100. This avoids static routes and allows dynamic internet prefix management — the BORDER routers advertise a summary to the PE with the internet RT, and any VRF configured to import it gets internet access automatically.
Critical Configuration
ip route vrf CORP 0.0.0.0 0.0.0.0 GigabitEthernet0/1 global ip nat inside vrf CORP source list VRF-CORP-NAT interface GigabitEthernet0/1 overload ip access-list standard VRF-CORP-NAT permit 192.168.100.0 0.0.0.255 permit 10.255.6.0 0.0.0.255 interface GigabitEthernet0/2 ip nat inside interface GigabitEthernet0/1 ip nat outside