Avaya 8600 Technical Configuration Manual page 77

Site2:5(config-if)# exit
Site2:5(config)# vlan create 3992 name "VRF255-FW2" type port 1
Site2:5(config)# vlan mlt 3992 32
Site2:5(config)# vlan members 3992 4/10
Site2:5(config)# interface Vlan 3992
Site2:5(config-if)# vrf internet
Site2:5(config-if)# ip address 10.255.92.2 255.255.255.0
Site2:5(config-if)# ip vrrp address 92 10.255.92.10
Site2:5(config-if)# ip vrrp 92 holddown-timer 120 priority 200
Site2:5(config-if)# ip vrrp 92 enable
Site2:5(config-if)# exit
Site2:5(config)# router vrf internet
Site2:5(config-vrf)# ip route 0.0.0.0 0.0.0.0 10.255.92.20 weight 10
Site2:5(config-vrf)# ip route 0.0.0.0 0.0.0.0 10.255.91.20 weight 100
Site2:5(config-vrf)# exit

When possible, for simplicity, select a VRRP id to match the VLAN id.
In this case, the lowest 2 digits of the VLAN id are used as VRRP id.

Always increase the VRRP priority above default value 100 for the VRRP Master
Always decrease the VRRP priority below default value 100 for the VRRP Backup
Chose a VRRP hold-down timer at least 50% greater than the actual time it takes for all

the IPVPN routes to be installed following a switch restart. In this design the actual time
for all IPVPN routes to be installed is just over 1 minute; hence a hold-down timer of 2
minutes (120 seconds) was chosen.
To verify operation of the VRRP instances refer to section 3.5
2.2.9.2 Configuring IPVPN RD & RT on the VRFs for the Internet IPVPN
Figure 19 shows the DualHub-Spoke Internet IPVPN as well as how traffic can flow from any of the Green
or Red VRFs (the Spokes) towards the Internet VRFs (the Hubs) and onwards to the Internet via the
firewalls.
For Sites 3, 4 & 5, the underlying SMLT topology will determine whether the Internet bound traffic is MLT
hashed towards the Site1 Hub or the Site2 Hub.
Site1 & Site2 will always route Internet bound traffic to their local firewall or to their remote firewall in case
the local firewall, or link to it, fails.
Obviously return traffic can also flow in the opposite direction (from Hub to Spoke) and the Hub Internet
VRFs will have to know all the IP routes for all the Spokes.
However, no traffic will ever be routed between a Green VRF spoke and a Red VRF spoke (traffic
between Green VRFs is already routed by the Green IPVPN-1 and traffic between Red VRFs is already
routed by the Red IPVPN-2) even though the Hub Internet VRF will have the necessary IP routes to do so
in the control plane. This is enforced by the ERS 8600 in the data plane.
Network Design Implementation to Provide L2 & L3 VPN Connectivity
November 2010
between Sites using SMLT and IPVPN-Lite for ERS 8600
Technical Configuration Guide
avaya.com
77