Connectivity from Global routing Table to VRF and vice versa

[23nick]

Hello Experts,

Could anyone please help me to achieve below requirement. I have two GRE tunnel from DR-WAN to A-WAN. Tunnel 1 and Tunnel 10 are in vrf SPR on both A-WAN & DR-WAN. On A-SPR-F01 i have subnet 10.98.1.0/24 running & on DR-SPR-CORE i have 10.1.0.0/24. I want A-SPR & DR-SPR to reach each other subnets.

On DR-WAN i put fa2/0 in vrf SPR and configured static route as ip route vrf SPR 10.1.0.0 255.255.0.0 10.1.0.25(DR-SPR-CORE ip) and redistributed it under ospf 1 vrf SPR as redistributed static subnets and i was successful in achieving that.

A-WAN-R01#sh ip route vrf SPR | i O E2
O E2 10.1.0.0/16 [110/20] via 10.1.10.9, 05:01:56, Tunnel10

Question :Now on A-WAN-R01 i do not want interface e6/2 to be in vrf SPR. I have configured static route on A-SPR-F01 as route outside 10.1.0.0 255.255.0.0 10.98.1.25 1. I read few blogs and tried implementing it but no luck. However because of redistribute command on A-WAN-R01 subnet 10.98.0.0/16 was being learned on DR-WAN-R01, but i am unable to ping. Below is what i tried.

Any help would be greatly appreciated. thankyou

TopologyA-WAN-R01DR-WAN-R01

[paul driver]

Hello

Can you from from A-WAN R 0 1 towards 10.98.1.0/24?

If your Fw allowing icmp originating from its outside interface?

[23nick]

Hello Paul,

Thankyou for replying, yes i am able to ping from A-WAN to IP 10.98.1.2(IP of A-SPR-R01 of fa0/0). I have allowed icmp on firewall.

But i am unable to ping from A-SPR-firewall to DR-SPR-CORE ip and vice versa i.e from 10.98.0.0/16  to  10.1.0.0/16. Did i messed up with route leak config on A-WAN-R01(route leak from global routing table(e6/2) to vrf SPR and vice versa).   Please help

Thanks,

Nick

[Meheretab Mengistu]

Hi Nick,
Please provide the output of ping request from DR-WAN-01 fa2/0 to 10.98.1.26, 10.98.1.2.
I am wondering why you choose to use the same IP range in the interconnection links (eg. 10.98.1.25 & .26 while you are using 10.98.0.0/16 for the network behind the Firewall).

HTH,
Meheretab

[23nick]

Hi Meheretab,

Below is the output

Do you think there is problem with ip addressing assignment, because on A-WAN-R01 i have static route 10.98.0.0 255.255.0.0 10.98.1.26 so for any destination for 10.98.0.0/16 it will forward to 10.98.1.26. This static route i have redistributed under router ospf 1 vrf SPR as redistributed static subnets command.

and on A-SPR-FW i have route outside 10.1.0.0 255.255.0.0 10.98.1.25 1.

[Meheretab Mengistu]

Nick,

Thank you for the additional info!
The IP addressing is a little confusing. It is preferable to use separate IP ranges for interconnection links between routers (eg. 10.198.1.24/29) from the site reserved IP block (eg. 10.98.0.0/16).

In your particular case, I saw that you missed a route from GRT (Global Routing Table) to VRF SPR. Please add a route to allow the return traffic from the GRT on A-WAN-R01.

Here is an example of what you need to add:

ip route 10.1.0.0 255.255.0.0 Tunnel1
ip route 10.1.0.0 255.255.0.0 Tunnel10

[23nick]

Hi @Meheretab Mengistu 

Thankyou so much for helping, now DR-SPR-CORE is able to ping firewall ip address, but not 10.98.1.25(A-WAN e6/2). i am checking that. Also i will reconfigure interconnections ip addresses to avoid confusion.

DR-SPR-CORE-S01#ping 10.98.1.26
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.98.1.26, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 68/82/104 ms

DR-SPR-CORE-S01#ping 10.98.1.25
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.98.1.25, timeout is 2 seconds:
.....
Success rate is 0 percent (0/5)

Thanks

Nick

[Meheretab Mengistu]

Once you changed the IP address for the interconnection links, the issue (of not being able to ping the interface IP address) will be resolved (assuming you will add routing for the interconnect IP block as well).