Re: Route Leaking issue in Global to vrf

nikhil93 · ‎01-17-2020

Hello Everyone,

We recently are doing a cloud setup and facing an issue with VRF Route-Leaking. Let me explaing you the Scenario.

Bellow is the simple network connection diagram. I have attached the detailed one on the discussion.

Problem Statement : From the Vlan42 which is in the Default VRF , i am able to reach the Firewall. But from the Customer VRF( Non-Default VRF ) i am not able to reach my Firewall.

Firewall ( Reverse routes for all subnets are given )

|

Nexus 9k1 ------- Nexus9k2 ( Both running in VPC )

\ /

Cisco Server ( Core is in VPC Portchannel with the Nexus 9K - Nic Teamed )

Now i have created multiple vlans on the 9K Peers .

Vlan 42 - 10.4.2.0/24 - Default vrf

Vlan 43 - 10.4.3.0/24 - Os-Nw-Vrf

Below is the configuration of vlans.

vlan 42
name Mgmt-Vlan

interface Vlan42
description "Mgmt-Vlan-Gateway"
no shutdown
ip address 10.4.2.2/24
hsrp 42
priority 110
ip 10.4.2.1

vlan 43
name OS-Network-Vlan

interface Vlan43
description "OS-Network-Vlan-Gateway"
no shutdown
vrf member OS-Network-Vlan
no ip redirects
ip address 10.4.3.2/24
no ipv6 redirects
hsrp 43
priority 110
ip 10.4.3.1

Now BGP Route-Leaking Configuration.

ip prefix-list Default-to-BGP seq 5 permit 0.0.0.0/0 le 32

route-map ALL permit 10
match ip address prefix-list Default-to-BGP
ex

ip prefix-list NETWORK seq 1 permit 0.0.0.0/0 le 32

route-map Default-To-VRF43 permit 10
match ip address prefix-list NETWORK

router bgp 100
address-family ipv4 unicast
network 0.0.0.0/0
network 10.4.1.0/24
network 10.4.2.0/24
redistribute direct route-map ALL
redistribute static route-map ALL
vrf OS-Network-Vlan
address-family ipv4 unicast
network 10.4.3.0/24
redistribute direct route-map ALL

I Have done the route-leaking and the ip routing table lokks something like this

Ip route for Default VRF:

0.0.0.0/0, ubest/mbest: 1/0
*via 10.4.1.1, [1/0], 1d18h, static
10.4.1.0/24, ubest/mbest: 1/0, attached
*via 10.4.1.2, Eth1/21, [0/0], 1d18h, direct
10.4.1.2/32, ubest/mbest: 1/0, attached
*via 10.4.1.2, Eth1/31, [0/0], 1d18h, local
10.4.2.0/24, ubest/mbest: 1/0, attached
*via 10.4.2.2, Vlan42, [0/0], 3d02h, direct
10.4.2.1/32, ubest/mbest: 1/0, attached
*via 10.4.2.1, Vlan42, [0/0], 3d02h, hsrp
10.4.2.2/32, ubest/mbest: 1/0, attached
*via 10.4.2.2, Vlan42, [0/0], 3d02h, local
10.4.3.0/24, ubest/mbest: 1/0, attached
*via 10.4.3.2%OS-Network-Vlan, Vlan43, [20/0], 00:56:01, bgp-100, external
, tag 100

VRF OS-Network-Vlan IP Route Table

ITI-N9K-1(config)# sh ip route vrf os-Network-Vlan
IP Route Table for VRF "OS-Network-Vlan"
'*' denotes best ucast next-hop
'**' denotes best mcast next-hop
'[x/y]' denotes [preference/metric]
'%<string>' in via output denotes VRF <string>

0.0.0.0/0, ubest/mbest: 1/0
*via 10.4.1.1%default, [20/0], 00:58:22, bgp-100, external, tag 100
10.4.1.0/24, ubest/mbest: 1/0, attached
*via 10.4.1.2%default, Eth1/21, [20/0], 00:58:22, bgp-100, external, tag 10
0
10.4.2.0/24, ubest/mbest: 1/0, attached
*via 10.4.2.2%default, Vlan642, [20/0], 00:58:22, bgp-100, external, tag 10
0
10.4.3.0/24, ubest/mbest: 1/0, attached
*via 10.4.3.2, Vlan43, [0/0], 3d02h, direct
10.4.3.1/32, ubest/mbest: 1/0, attached
*via 10.4.3.1, Vlan43, [0/0], 3d02h, hsrp
10.4.3.2/32, ubest/mbest: 1/0, attached
*via 10.4.3.2, Vlan43, [0/0], 3d02h, local

==========================================================================================

I AM NOT ABLE TO REACH THE FIREWALL FROM MY "OS-NETWORK-VLAN" vrf . I am able to reach my Siwtchport connecting to Firewall, but i am not able reach the firewall. Please help.

ITI-N9K-1(config)# ping 10.4.1.2 vrf os-Network-Vlan ---- PINGING MY SWITCHPORT-CONNECTIGN_TO FIREWALL
PING 10.4.1.2 (10.4.1.2): 56 data bytes
64 bytes from 10.4.1.2: icmp_seq=0 ttl=255 time=0.51 ms
64 bytes from 10.4.1.2: icmp_seq=1 ttl=255 time=0.349 ms
64 bytes from 10.4.1.2: icmp_seq=2 ttl=255 time=0.397 ms
64 bytes from 10.4.1.2: icmp_seq=3 ttl=255 time=0.346 ms
64 bytes from 10.4.1.2: icmp_seq=4 ttl=255 time=0.311 ms

--- 10.4.1.2 ping statistics ---
5 packets transmitted, 5 packets received, 0.00% packet loss
round-trip min/avg/max = 0.311/0.382/0.51 ms

ITI-N9K-1(config)# ping 10.4.1.1 vrf os-Network-Vlan --- PINGING TO FIREWALL FROM VRF os-Network-Vlan
PING 10.4.1.1 (10.4.1.1): 56 data bytes
Request 0 timed out
Request 1 timed out
Request 2 timed out
Request 3 timed out
Request 4 timed out

--- 10.4.1.1 ping statistics ---
5 packets transmitted, 0 packets received, 100.00% packet loss