cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
390
Views
0
Helpful
1
Replies
andrew.butterworth
Rising star

Import IPv6 prefixes from Global into VRF - platform limitation Catalyst 3750x?

I am in the process of building a SD Access Lab.  My Fusion routers are Cisco Catalyst 3750X's running the latest IOS 15.2(4)E10 with IP Services Licenses and the dual IPv4, IPv6 SDM template (sdm prefer dual-ipv4-and-ipv6 default).

We currently have three routing tables - the GRT and two VRFs; one for Shared-Services and one for the Underlay.  There is a link to a firewall in the GRT that has IPv4 & IPv6 addresses.  The IPv4 is NAT'd by the Firewall but the IPv6 address is unique (we have a /56 prefix and the link to the firewall uses a /64 from this).

We seem to have hit a platform limitation with the Catalyst 3750X in that it can't import IPv6 prefixes from the GRT to the VRF like we can with IPv4.

If you look at the following snippet of config:

vrf definition SHARED-SERVICES
 rd 111:111
 route-target export 111:111
 route-target import 111:111
 route-target import 222:222
 !
 address-family ipv4
  import ipv4 unicast map GLOBAL-TO-VRF
  export ipv4 unicast map VRF-TO-GLOBAL
 exit-address-family
 !
 address-family ipv6
  import map GLOBAL-TO-VRF-IPv6
  export ipv6 unicast map VRF-TO-GLOBAL-IPv6
 exit-address-family
!
vrf definition UNDERLAY
 rd 222:222
 route-target export 222:222
 route-target import 222:222
 route-target import 111:111
 !
 address-family ipv4
 exit-address-family
 !
 address-family ipv6
 exit-address-family

Under the address-family ipv6 for the VRF SHARED-SERVICES we can add 'export ipv6 unicast map xxx', however for the import there is no option for 'ipv6', there is just the 'map' option.  Se we can export IPv6 prefixes from this VRF to the GRT but can't import them.

With IPv4 we have the option to import and export 'ipv4'.

 

I have tried this on a Catalyst 3650 and the 'import ipv6 map xxx' command is available under the address-family ipv6 so I'm pretty sure it is a platform limitation.

 

Other than putting the link to the firewall in another VRF is there a way around this?

 

Cheers

Andy

1 REPLY 1
ngkin2010
Enthusiast

Hi,

 

How about using static route like:

 

ipv6 route vrf A ::/0 2000::1 nexthop-vrf default
Content for Community-Ad
This widget could not be displayed.