To create the VRF, perform the following steps:

1. Create VRF with gateway through CLI configuration.

   VRF gets created with a default route in the VRF routing table.

2. For the PAPN use case, each PAPN is associated with its own VRF having the default route. Each PAPN VRF must be defined on SMF and leaf switch.

3. For the Static and Dynamic policy removal use case, VRF with default route is created on SMF to handle outbound routes through the default route added by VRF.

   SMF continues to use global VRF for L3 VIP advertisement toward leaf switch. Hence, on leaf, no specific VRF is required for this use case.

To modify the device or gateway on the existing VRF, use the following steps:

1. Disassociate the VRF to be modified from endpoint and router.

2. Delete the VRF and apply the configuration changes.

   Important

   Make sure you delete the VRF in running system only.

3. Create VRF with modified device or gateway.

4. Associate newly created VRF with modified device or gateway with the endpoint and router. Apply the configuration changes.

To delete the device or gateway on the existing VRF, use the following steps:

1. Disassociate the VRF to be deleted from the endpoint and router.

2. Delete the VRF and apply the configuration changes.

   Important

   Make sure you delete the VRF in running system only.

3. If the VRF is shared across logical SMFs, delete the VRF from all logical SMFs to completely remove the VRF configuration from the interface. This is applicable only for static and dynamic use case.

This feature has the following limitations:

• NAS-IP for authentication and accounting requests must be the same as the interface CoA-NAS VIP-IP in the RADIUS endpoint CoA-NAS interface configuration.

• The VRFs configured under RADIUS server-group and RADIUS endpoint must be the same.

• For the Disconnect Message (DM) request, the client VRF and the server VRF (CoA-NAS VIP VRF) must match. If there is a mismatch, the DM request is discarded.

The VRF configuration is applicable for both PAPN, and Static and Dynamic use cases.

To configure the VRFs in global configuration mode, use the following sample configuration:

config 
   vrf name vrf_name gateway gateway_ipv4_address gatewayIpv6 gateway_ipv6_address device interface_name linkDevice linked_device_name 
   end 

Important

VRF creation and deletion operations are supported. To modify the existing VRF, VRF must be deleted and then added again.

NOTES:

• vrf name vrf_name —Specify the VRF name. The maximum VRF length supported is 15.

• gateway gateway_ipv4_address —Specify the IPv4 address of the gateway.

• gatewayIpv6 gateway_ipv6_address —Specify the IPv6 address of the gateway.

• device interface_name —Specify the name of the public bonded interface.

• linkDevice linkedDevice_name —Specify the name of the private bonded interface. This field is applicable only for Static and Dynamic use case.

To configure the endpoint and associate with the VRF, use the following sample configuration:

config 
   instance instance-id instance_id 
       endpoint { gtp | pfcp | radius } 
          interface { coa-nas | s5 | s5e | s2b | s11 | n4 } 
             vip-ip ip_address [ vip-interface  interface_name| vip-port vip_port | vrf vrf_name ] 
             end 

NOTES:

• endpoint { gtp | pfcp | radius } —Specify the endpoint name. It can be GTP, PFCP protocol, or RADIUS.

  For PAPN support, use the RADIUS endpoint. For the static and dynamic policy removal use case, select the GTP or PFCP protocol.

• interface { coa-nas | s5 | s5e | s2b | s11 | n4 } —Specify the interface based on the use case. For PAPN support, select coa-nas interface. For the policy removal use case, use any of the other available interfaces.

• vip-ip ip_address —Specify the IPv4 address of the configured endpoint.

• vip-port vip_port —Specify the port number of endpoint.

• vip-interface interface_name —Specify the interface name. Note that this is a bonded interface which is associated with VRF.

• vrf vrf_name —Specify the VRF name defined using global VRF configuration.

To configure the VRF in RADIUS server group, use the following sample configuration:

config 
   profile radius   
      server-group group_name 
         vrf vrf_name 
         server-private { radius_server_ip_address port_number  | [ range ] }  
            priority radius_server_priority 
            secret radius_server_secret_key 
            type { acct | auth } 
            end 

NOTES:

• server-private { radius_server_ip_address port_number | [ range ] } —Specify the IP address and port number of the private RADIUS servers used for accounting and authentication requests. This server is private to the specific server-group.

  Private servers in the server-group will be given priority over global servers that are associated to the group. If private servers are unreachable or dead, global servers will be selected to send authentication or accounting requests.

• priority radius_server_priority —Specify the priority of RADIUS server.

• secret radius_server_secret_key —Specify the RADIUS server shared secret key.

  Must be a string.

• type { acct | auth } —Specify the type of private RADIUS server used for accounting and authentication requests.

• server-private { radius_server_ip_address port_number [ priority radius_server_priority | secret radius_server_secret | type { acct | auth } ] | [ range ] }

• range —Specify the IP address range.

• vrf vrf_name —Specify the VRF name to be configured in AAA server group.

  If VRF is configured in server-group, it is recommended to configure servers using server-private and not associate the global servers.

To define the VRF in RADIUS Dynamic-authorization/COA configuration, use the following sample configuration:

config 
   profile radius-dynamic-author 
      client client_ip_address vrf vrf_name 
         nas-identifier nas_identifier_port 
         secret secret_key 
         end 

NOTES:

• client client_ip_address —Specify the RADIUS Dynamic-authorization client configuration.

• vrf vrf_name —Specify the VRF name to be configured in AAA server group.

  If VRF is configured in server-group, it is recommended to configure servers using server-private and not associate the global servers.

• nas-identifier nas_identifier_port —Specify the dynamic authorization NAS identifier.

• secret secret_key —Specify the dynamic authorization server shared secret key.

To associate VRF with BGP for BGP peering, use the following sample configuration:

config 
   router bgp bgp_name 
       interface interface_name 
           vrf  vrf_name 
           end 

NOTES:

• interface interface_name —Specify the local BGP interface.

• vrf `vrf_name —Specify the VRF details to be associated with BGP.

The following statistics are updated to support the VRF feature.

• bgp_outgoing_routerequest_total - This statistics includes "vrf" label to indicate the total count of successful BGP outgoing routes per VRF.

• bgp_outgoing_failedrouterequest_total - This statistics includes "vrf" label to indicate the total count of failed BGP outgoing routes per VRF.

• bgp_speaker_bfd_peer_status - This statistics includes "vrf" label to indicate the BFD peer status.