Hello Guys
I am trying to implement vrf route leaking using ESGs. If you check the attached diagram my goal is to bypass the flow going through the firewall when all the endpoints in EPG_VLAN200 want to communicate with especific endpoints in EPG_VLAN100. Any other traffic (for both EPGs) must go through the firewall (interVRF).
The need to use ESGs is because:
1. We can't apply a contract to an ESG and EPG at the same time.
2. We need to leak traffic from and to specific endpoints in EPG_VLAN100
So, I have configured two ESGs:
1. ESG_VLAN100 contains especific IP address selectors
2. ESG_VLAN200 contains the EPG_VLAN200 as selectors
3. I have created a contract with the default filter and tenant as scope and I have applied the contract as consumed by ESG_VLAN100 and as provided by ESG_VLAN200.
4. Under each VRF I have configured InterVRF Leaked Routes for ESG to accomplish my goal (bypass the traffic).
5. I have a vzAny contract (consumed/provided). This configuration is applied both to vrf Blue and vrf Red.
Under these circumstances, the vrf route leaking works as expected, however when the endpoints in EPG_VLAN201 (vrf Red) wants to communicate with the especific endpoints in ESG_VLAN100 (vrf Blue) the traffic is denied. The same happens when the endpoints in EPG_VLAN101 (vrf Blue) want to communicate with the endpoints in ESG_VLAN200 (vrf Red).
Looking forward for your comments. Thanks in advance.
