VRF Question

[N3om]

Hi
We ahve an FTD and subnet 172.16.251.0/24 ingresses via a sub-interface in global routing then egresses via an interface in a user deifned vrf, my question is how do I route the return traffic to 172.16.251.0/24

1. Do I add a static route in the vrf pointing to the global interface for 172.16.251.0/24

2. Do I just add a static route in global pointing to the 172.16.251.0/24 network via the global interface

Thanks

[M02@rt37]

Hello @N3om 

You need route leaking ...

Explore this documentation please: https://www.cisco.com/c/en/us/td/docs/security/firepower/660/fdm/fptd-fdm-config-guide-660/fptd-fdm-virtual-routers.html

[Flavio Miranda]

@N3om 

 This is a trick question. 

 Does it means that the ingress traffic via global routing table and egress traffic via vrf is working currently? 

 Why the return traffic is not using the same interface as ingress traffic?  

If you say "egresses via an interface in a user deifned vrf", then you might already have a routing send egress traffic to interface with vrf. 

Wondering if this is not cause assymetric routing. 

[N3om]

@Flavio Miranda 

 Does it means that the ingress traffic via global routing table and egress traffic via vrf is working currently?  YES

 Why the return traffic is not using the same interface as ingress traffic?  Thats the question we dont have a route to the subnet yet

[Flavio Miranda · Accepted solution]

considering the ingress interface is on global routing table, and if you intend to send traffic back, it should be necessary one static route return the traffic on that interface.