Course 45 - IE Data Center Network Design | Episode 5: Virtual Routing, Multi-Tenancy & Data Center Management Design

Data Center Virtualization and Secure Management ArchitectureEpisode OverviewModern data centers must provide both strong network isolation and reliable administrative access.In this episode, we explore two foundational aspects of data center architecture: Layer 3 network virtualization with Virtual Routing and Forwarding (VRF) and secure infrastructure management through inband and Out-of-Band (OOB) architectures.We begin by examining how VRFs transform a physical routing platform into multiple logically independent routing environments. We then apply these concepts to VXLAN EVPN fabrics, where VRFs provide tenant isolation while keeping overlay traffic separate from the underlying infrastructure network.The second part moves from data-plane architecture to infrastructure administration. We compare inband management with dedicated OOB management and examine how management VRFs, dedicated management interfaces, console access, and terminal servers provide resilient access to critical infrastructure—even when the production network is unavailable.Part I: Layer 3 Network Virtualization with VRF1. Understanding Virtual Routing and ForwardingVirtual Routing and Forwarding (VRF) allows a single physical router or Layer 3 switch to maintain multiple independent routing tables.Instead of every interface and route belonging to one global routing table, individual interfaces can be associated with separate VRF instances.Conceptually:One Physical Device → Multiple Logical RoutersEach VRF can maintain its own:- Interfaces.- Routing table.- Default routes.- Dynamic routing relationships.- Layer 3 forwarding decisions.This provides logical separation without requiring a separate physical router for every tenant or network environment.2. VRF and Multi-Tenant Network IsolationOne of the most important applications of VRF is multi-tenancy.Consider a data center hosting multiple customers or organizational environments. Each tenant may require independent IP addressing and routing policies.VRFs allow these environments to coexist on the same physical infrastructure while keeping their routing information logically separated.The architecture can be represented as:Physical Network Device→ Tenant VRF A→ Tenant VRF B→ Tenant VRF CEach tenant maintains an independent Layer 3 forwarding context.This prevents routes belonging to one tenant from automatically appearing in another tenant's routing table.3. VRF LightTraditional large-scale service-provider architectures may use technologies such as MPLS to provide sophisticated VPN segmentation.VRF Lite provides a simpler approach when MPLS is not required.VRF Lite allows administrators to create multiple isolated routing domains directly on supported network devices.It can be useful in:- Enterprise networks.- Data center environments.- Multi-tenant deployments.- Network virtualization projects.- Segmented infrastructure designs.The primary objective is straightforward:Provide independent routing tables without requiring an MPLS-based VPN architecture.4. VRF in VXLAN EVPN FabricsVRFs become particularly important in modern VXLAN EVPN data centers.A VXLAN EVPN fabric generally contains two conceptual network layers:UnderlayThe routed infrastructure that provides transport between fabric devices.It may use technologies such as:- OSPF.- BGP.- PIM.- ECMP.OverlayThe logical tenant network built on top of the underlay.Tenant VRFs provide independent Layer 3 routing environments within this overlay.This separation means that infrastructure routing and tenant routing can operate independently.Conceptually:Underlay Routing → VXLAN Transport → Tenant VRF → Tenant Networks5. Separating Tenant and Infrastructure RoutingA major advantage of VRF-based segmentation is the ability to prevent tenant traffic from interfering with the infrastructure control plane.For example, underlay routing protocols such as OSPF or multicast-related infrastructure mechanisms such as PIM operate within the infrastructure context.Tenant routes remain within their corresponding VRFs.This creates a layered architecture:Infrastructure VRF / Global Routing Context→ Fabric Transport→ Tenant VRF 1→ Tenant VRF 2→ Tenant VRF 3This separation improves organization, scalability, and control over routing policies.6. Border Leaf HandoffsTenant networks eventually need to communicate with resources outside the VXLAN fabric.This may include:- Internet connectivity.- External enterprise networks.- WAN routers.- Firewalls.- Load balancers.- Other data centers.Border leaf switches can provide these external handoff points.The important architectural principle is that the tenan