A very common approach for networks is to have the management interface of the network node (switch, router, load balancer, etc.) in a separate VRF [Virtual Routing and Forwarding] instance. This has many security benefits, especially in the case of internet facing devices.<\/p>\n
Main ones from my perspective are:<\/p>\n
Arista EOS for quite some time has supported VRFs, but something that you need to keep in mind when using them is that the VRF has it’s own routing table. So when you create a VRF e.g. MGMT-VRF all your addresses and routes for the management network are no longer in the default routing instance. A very common approach for networks is to have the management interface of the network node (switch, router, load balancer, etc.) in a separate VRF [Virtual Routing and Forwarding] instance. This has many security benefits, especially in the case of internet facing devices. Main ones from my perspective are: Separate routing table to the rest […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[96,38],"tags":[97,161,160,106,42,163,162,164,159],"series":[],"class_list":["post-322","post","type-post","status-publish","format-standard","hentry","category-arista","category-linux","tag-arista-2","tag-cli","tag-copy-command","tag-eos","tag-linux-2","tag-management","tag-routing-instance","tag-system-management","tag-vrf"],"_links":{"self":[{"href":"https:\/\/flat-planet.net\/index.php?rest_route=\/wp\/v2\/posts\/322","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/flat-planet.net\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/flat-planet.net\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/flat-planet.net\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/flat-planet.net\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=322"}],"version-history":[{"count":1,"href":"https:\/\/flat-planet.net\/index.php?rest_route=\/wp\/v2\/posts\/322\/revisions"}],"predecessor-version":[{"id":323,"href":"https:\/\/flat-planet.net\/index.php?rest_route=\/wp\/v2\/posts\/322\/revisions\/323"}],"wp:attachment":[{"href":"https:\/\/flat-planet.net\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=322"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/flat-planet.net\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=322"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/flat-planet.net\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=322"},{"taxonomy":"series","embeddable":true,"href":"https:\/\/flat-planet.net\/index.php?rest_route=%2Fwp%2Fv2%2Fseries&post=322"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
\n
\nswitch(config)# vrf definition MGMT-VRF
\nswitch(config-vrf-MGMT-VRF)# rd 123:12
\nswitch(config)# interface et1
\nswitch(config-if-et1)# vrf forwarding MGMT-VRF
\n<\/code>
\nSome commands are VRF aware e.g. ping. For example you can run the following command:
\n
\nping vrf MGMT-vrf 10.10.10.1
\n<\/code>
\nUnfortunately not all commands are VRF aware yet – an obvious one is the copy command. The solution to this is to switch to the routing-context that you are trying to copy to\/from and then run the copy command (this applies to all non-VRF-aware commands).
\n
\nswitch# routing-context vrf MGMT-VRF
\nswitch# show routing-context vrf
\nCurrent VRF routing-context is MGMT-VRF
\nswitch# copy ...
\n<\/code>
\nThen afterwards switch back to the default
\n
\nswitch# routing-context vrf default
\n<\/code><\/p>\n","protected":false},"excerpt":{"rendered":"