I am in the process of building a SD Access Lab. My Fusion routers are Cisco Catalyst 3750X's running the latest IOS 15.2(4)E10 with IP Services Licenses and the dual IPv4, IPv6 SDM template (sdm prefer dual-ipv4-and-ipv6 default).
We currently have three routing tables - the GRT and two VRFs; one for Shared-Services and one for the Underlay. There is a link to a firewall in the GRT that has IPv4 & IPv6 addresses. The IPv4 is NAT'd by the Firewall but the IPv6 address is unique (we have a /56 prefix and the link to the firewall uses a /64 from this).
We seem to have hit a platform limitation with the Catalyst 3750X in that it can't import IPv6 prefixes from the GRT to the VRF like we can with IPv4.
If you look at the following snippet of config:
vrf definition SHARED-SERVICES
rd 111:111
route-target export 111:111
route-target import 111:111
route-target import 222:222
!
address-family ipv4
import ipv4 unicast map GLOBAL-TO-VRF
export ipv4 unicast map VRF-TO-GLOBAL
exit-address-family
!
address-family ipv6
import map GLOBAL-TO-VRF-IPv6
export ipv6 unicast map VRF-TO-GLOBAL-IPv6
exit-address-family
!
vrf definition UNDERLAY
rd 222:222
route-target export 222:222
route-target import 222:222
route-target import 111:111
!
address-family ipv4
exit-address-family
!
address-family ipv6
exit-address-family
Under the address-family ipv6 for the VRF SHARED-SERVICES we can add 'export ipv6 unicast map xxx', however for the import there is no option for 'ipv6', there is just the 'map' option. Se we can export IPv6 prefixes from this VRF to the GRT but can't import them.
With IPv4 we have the option to import and export 'ipv4'.
I have tried this on a Catalyst 3650 and the 'import ipv6 map xxx' command is available under the address-family ipv6 so I'm pretty sure it is a platform limitation.
Other than putting the link to the firewall in another VRF is there a way around this?
Cheers
Andy
