topic Re: Route single VRF Traffic to another Interface in Software-Defined Access (SD-Access)

Route single VRF Traffic to another Interface

otgnwp — Fri, 15 Nov 2024 05:16:28 GMT

Hi,

We have a requirement where we need to route single VRF (SSOL_Vrf) Traffic in SDA Fabric. Currently all vrf traffic is being forwarded based on default route, as a new requirement we need to forward it to new firewall being a part of SDA Fabric.

Sharing topology below for your reference and Border1 and Fusion 1 switch Configuration for review

Thanks in advance

Regards,

Mohammed Asif

Re: Route single VRF Traffic to another Interface

Andrii Oliinyk — Fri, 15 Nov 2024 05:53:09 GMT

i'd start with analysis of how default route currently injected into VRF (FNs would be good place to start) & then develop action plane to replace it with one from new FW.

Re: Route single VRF Traffic to another Interface

otgnwp — Fri, 15 Nov 2024 06:20:36 GMT

Hi,

Please refer attached Border 1 Switch and Fusion 1 Switch configuration.

Border 1 Switch is part of SDA Fabric. Where as Fusion 1 Switch not a part of SDA fabric. BGP routing Protocol uses between Border 1 switch and Fusion 1 switch to route vrf traffic outside SDA Fabric.

Thanks in Advance

Regards,

Mohammed Asif

Re: Route single VRF Traffic to another Interface

Andrii Oliinyk — Fri, 15 Nov 2024 10:06:23 GMT

it's well known fact that FNs r not part of the Fabric in supported designs as well as VPNv4 BGP AIF Option A is used for BN-FN peering. it doesnt bring any matter to analysis yet to be done. as i said above: start with investigation on FNs of how default route gets injected into VRF.
UPD. i guess simplest way for u would be replacing target VRF's interconnect on FNs from that toward Core to one toward new FW. Injection of default route into VRF on FNs is matter of technique.

Re: Route single VRF Traffic to another Interface

Torbjørn — Fri, 15 Nov 2024 08:50:50 GMT

Am I interpreting this correctly?

Traffic is currently being routed to your fusion node, which in turn is forwarding it directly to the core
You wish to force this traffic to be routed towards your firewall from your fusion node
The firewall is external to the fabric, as shown in your topology drawing

If that is the case I would configure a new "intermediate" VRF on your fusion nodes used only for routing between the border and your firewall. This way you can have one FW interface in each VRF(one in the "SDA peering" VRF and one in the "upstream" VRF) to force traffic through your FW. I would also consider connecting both fusion nodes to the firewall such that you get fusion node redundancy for the VRF.

Please see the following diagram for a better depiction of what I mean:

Re: Route single VRF Traffic to another Interface

otgnwp — Fri, 15 Nov 2024 09:29:36 GMT

Hi Torbjon,

Thanks for Response,

Traffic is currently being routed to your fusion node, which in turn is forwarding it directly to the core - Yes
You wish to force this traffic to be routed towards your firewall from your fusion node - Yes, i have Mutliple Vrf Border node, which i need route only one vrf traffic to New Firewall not all vrf Traffic.
Will Intermediate Vrf forward traffic of all vrf or only single vrf i.e; SSOL_Vrf.

Thanks in Advance,

Regards,

Mohammed Asif

Re: Route single VRF Traffic to another Interface

Torbjørn — Fri, 15 Nov 2024 09:54:20 GMT

On your fusion node you should:

Create new intermediate VRF on your fusion node(s)
Move the interface you use for peering against the SSOL_Vrf VN into the new intermediate VRF
Create a new subinterface or move a physical interface connected to your firewall to the intermediate VRF
Configure routing within the new VRF such that you both have a BGP peering against your SDA border handoff and against the firewall.
Create a new subinterface or move a separate physical interface connected to your firewall to your desired "upstream" VRF
Configure routing between the "upstream vrf" on your fusion node and the "upstream vrf" interface of your firewall.

This will result in a configuration that only forces the traffic in your SSOL_Vrf VN through the firewall. Routing for all other VNs should be unaffected by this change.