Multitenancy using VRF with Dell SmartFabric OS10 Implementation Guide
Introduction
Solution introduction
Implementation Guide introduction
Document purpose
Revision history
Multitenancy Use Cases
Overview
VRF can be used to enable multitenancy for several use cases. It enables data center operators to provide separate isolated networks for customers using existing switch infrastructure. VRF enables a top-of-rack or leaf switch to support more than one customer securely. Overlapping IP address space can exist in a L3 switch, where VRFs isolate them. Layer 3 path isolation with VRF is better than Layer 3 VLAN alone. The VRF enables route table isolation, and the VLAN provides data path isolation.
Public cloud repatriation use case
Consider how VRF can be used in a public cloud repatriation use case. The customer migrates servers, storage, and applications back into their data center from the public cloud. They have determined this move reduces total cost of ownership, improves performance, and gives them more control over their resources and data. They use Dell Technologies products to do so.
IT resources for the sales and marketing user groups are repatriated. They stand up a new server for each. There is an existing switch and server for the general corporate user group. A challenge is that cloud-based sales and marketing resources have IP addresses that overlap with each other and an existing corporate server. They prefer to not reassign the sales and marketing IP address ranges.
Consider two high-level designs that they can use for repatriation. With the first design, the company could purchase additional switches and add them to the data center along with the existing corporate server. The new sales and marketing servers would each be connected to their own switch. See Figure 1.
Figure 1. Data center multitenancy by adding switches
Alternately the company could use their existing switch and rack (which has capacity) to host the new sales and marketing servers alongside the existing corporate server. They could use VRFs to segment the new servers. See Figure 2.
Figure 2. Data center multitenancy with VRF
The customer has chosen the second option, to add the new servers to the existing switch and use VRFs to segment traffic. VRFs are configured in the switch for each server, creating separate routing tables to segment traffic between the existing and new servers. The corporate server already resides in the default VRF, colored in yellow in Figure 2. Two new VRFs are created for sales and marketing, which are colored in red and blue. The VRFs isolate the control and data planes for each set of resources using different routing tables for each. VLANs are also configured for each server to further isolate the data plane.
The example configurations in this guide are built around a single-switch VRF use case. The example use case shows a simple network and compute environment to communicate key VRF information. A more complex environment with a leaf-spine network and multiple ports that are used on each server is supported with VRF.
Another use case where VRF can be helpful is in virtualized environments leveraging Network Virtualization Overlay (NVO). Dell PowerSwitch switches can be used with VMware NSX-T. VRF is configured in the PowerSwitch switches to enable network multitenancy, and NSX-T enables network and compute multitenancy. See the related reference in the Technical Resources chapter.
VRF in Dell SmartFabric OS10
Some key facts to be aware of with VRF in OS10 include:
- VRF is a feature that enables multitenancy in a Dell PowerSwitch.
- VRF is a feature that separates data in a network by creating multiple logical routers (a routing table per VRF) within a physical L3 switch.
- VRF allows network paths to be segmented (per domain or customer) without using multiple devices. It does so by configuring multiple different routing tables that co-exist within the same L3 switch simultaneously.
- VRF increases network security and can eliminate specific needs for encryption and authentication by automatically separating traffic in each VRF.
- Each VRF must be assigned an ingress and egress interface. Interfaces can be physical or virtual.
- IP address space can be overlapped among different VRF instances as the control plane (routing tables) are isolated.
- Within a VRF instance, routing can be statically provisioned, or exchanged using dynamic routing protocols. All forwarding components are VRF-aware and provisioned within the context of a VRF instance.
- Route leaking is supported across VRF Instances using static routes, dynamic routing protocols, or both. Route leaking enables traffic to flow across VRFs in a controlled manner when wanted.
- VRF can also work smoothly in virtualized environments, such as with VMware NSX.
- The VRF feature is supported with the Dell Virtual Link Trunking (VLT) multipathing technology.
- VRFs are local to a physical switch. Note the following:
- The VRF IDs of VRs running on a physical switch are not exchanged with VRF VRs running on other physical switches.
- Yet VRFs can extend to other switches by assigning VLANs to VRFs and trunking the VLANs.
- This configuration requires specific VRF-to-VLAN mapping at each involved switch.
- VXLAN can also be used to stretch the VLANs.
- VRRP or Proxy ARP used with VLT can be configured on interfaces that belong to a VRF instance.
- There is no restriction on the number of VLANs that can be assigned to a VRF instance.
- The size of the IPv4 CAM limits the total number of routes that are supported in VRF.
Table 1 summarizes VRF support in OS10 software,
Table 1. VRF support in OS10 software
|
Item |
Support |
Notes |
|
Supported Platforms |
Dell PowerSwitch family |
See Reference section. |
|
Supported OS10 software releases |
Dell SmartFabric OS10 10.4.1.0 or later |
Some features require a later release. |
|
VRFs Supported |
One management VRF One default VRF 512 nondefault VRFs with static routing 128 nondefault VRFs with dynamic routing |
Use the default and nondefault VRFs for routing. |
|
Routing supported |
Static routing Dynamic routing: OSPFv2, OSPFv3, BGP |
N/A |
|
Dynamic routing: OSPFv2, OSPFv3, BGP |
Physical and virtual |
N/A |
|
Services supported |
Many, such as DHCP, DNS, HTTP, SSH server |
In both management and nondefault VRFs |
|
Route leaking |
Static and dynamic |
N/A |
VRF example lab setup
Figure 3 shows the example lab setup that is used in this guide. The lab setup illustrates the repatriation use case where the customer is bringing back storage and servers from the cloud. Two Dell S5248F-ON switches are configured as leaf switches in two different racks. They are each connected to the Data Center Cloud with a 100 GbE port that is configured as a trunk port with allowed VLANs.
Three tenants are enabled with VRFs in each switch. The default VRF (in yellow) has interfaces for existing corporate resources that are assigned to it. Logical and physical interfaces are assigned by default to the default VFR. The sales VRF is created with loopback 1 and VLAN 20 and VLAN 200 interfaces that are assigned to it. The marketing VRF is created and loopback 2 and VLAN 30 and VLAN 300 are created and assigned to it.
The loopback interfaces assigned to each VRF simulates end hosts. Each tenant has unique VLAN interfaces but use overlapping IP addresses that are inherited from the cloud on their respective VLANs. A trunk is configured in each switch to connect the switch to the Data Center Cloud and to each other.
Figure 3. Example lab setup using two S5248F-ON leaf switches with VRF and overlapping IP address scheme
Validated Components
Dell PowerSwitch S5248F-ON
The validated example lab uses the Dell PowerSwitch S5248F-ON for each rack switch. It is a single rack-unit (1U), multilayer switch with 48 25 GbE SFP28 ports, four 100GbE QSFP28 ports, and two 200 GbE QFSP28-DD ports.
The S5248F-ON uses the Broadcom Trident3 (BCM56873) network processing unit. The S5248F-ON switches are installed with OS10 version 5.4.6.
Figure 4. Dell PowerSwitch S5248F-ON switch front view