Solved: Default Route leaking from GRT to VRF

Steven Williams · ‎03-27-2019

How can I get the default route into a vrf from the global route table? I can get the VRF routes into the global route table but not the other way around.

!
! Last configuration change at 19:52:06 EET Wed Mar 27 2019
!
version 15.2
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
service compress-config
!
hostname CORE-SW-01
!
boot-start-marker
boot-end-marker
!
!
vrf definition GREEN_PROD
rd 65001:10
!
address-family ipv4
import ipv4 unicast map GRT_TO_GREEN_PROD
export ipv4 unicast map GREEN_PROD_TO_GRT
route-target export 65001:10
route-target import 65001:10
exit-address-family
!
!
no aaa new-model
clock timezone EET 2 0
!
!
!
!
!
!
ip vrf BLUE_PROD
rd 65000:30
!
ip vrf YELLOW_CAO
rd 65000:21
!
ip vrf YELLOW_PROD
rd 65000:20
!
!
!
ip cef
no ip igmp snooping
no ipv6 cef
!
!
!
spanning-tree mode rapid-pvst
spanning-tree extend system-id
spanning-tree vlan 700,730,740,742 priority 0
!
vlan internal allocation policy ascending
!
vlan 1740
name GREEN_PROD_EGRESS
lldp run
!
!
!
!
!
!
!
!
!
!
!
!
!
!
interface Loopback0
no shutdown
ip address 10.10.10.3 255.255.255.255
!
interface Port-channel1
no shutdown
switchport trunk encapsulation dot1q
switchport trunk native vlan 999
switchport mode trunk
bandwidth 100
!
interface Ethernet0/0
no shutdown
no switchport
ip address 10.51.100.2 255.255.255.252
no ip redirects
no ip unreachables
no ip proxy-arp
duplex auto
spanning-tree portfast edge
!
interface Ethernet0/1
no shutdown
switchport access vlan 998
shutdown
!
interface Ethernet0/2
no shutdown
no switchport
ip address 10.51.102.2 255.255.255.252
no ip redirects
no ip unreachables
no ip proxy-arp
duplex auto
!
interface Ethernet0/3
no shutdown
switchport access vlan 998
shutdown
!
interface Ethernet1/0
no shutdown
!
interface Ethernet1/1
no shutdown
!
interface Ethernet1/2
no shutdown
switchport trunk allowed vlan 700,730,999
switchport trunk encapsulation dot1q
switchport trunk native vlan 999
switchport mode trunk
!
interface Ethernet1/3
no shutdown
!
interface Ethernet2/0
no shutdown
switchport access vlan 998
switchport trunk allowed vlan 121,122,999
switchport trunk encapsulation dot1q
switchport trunk native vlan 999
switchport mode trunk
!
interface Ethernet2/1
no shutdown
switchport access vlan 998
switchport trunk allowed vlan 115,999
switchport trunk encapsulation dot1q
switchport trunk native vlan 999
switchport mode trunk
!
interface Ethernet2/2
no shutdown
switchport access vlan 998
switchport trunk allowed vlan 700,730,999
switchport trunk encapsulation dot1q
switchport trunk native vlan 999
switchport mode trunk
!
interface Ethernet2/3
no shutdown
switchport access vlan 998
switchport trunk allowed vlan 740,742,999
switchport trunk encapsulation dot1q
switchport trunk native vlan 999
switchport mode trunk
!
interface Ethernet3/0
no shutdown
switchport access vlan 998
shutdown
!
interface Ethernet3/1
no shutdown
switchport access vlan 998
shutdown
!
interface Ethernet3/2
no shutdown
switchport access vlan 998
shutdown
!
interface Ethernet3/3
no shutdown
switchport access vlan 998
shutdown
!
interface Ethernet4/0
no shutdown
switchport access vlan 998
shutdown
!
interface Ethernet4/1
no shutdown
switchport access vlan 998
shutdown
!
interface Ethernet4/2
no shutdown
switchport access vlan 998
shutdown
!
interface Ethernet4/3
no shutdown
switchport access vlan 998
shutdown
!
interface Ethernet5/0
no shutdown
switchport access vlan 998
switchport mode access
shutdown
!
interface Ethernet5/1
no shutdown
switchport access vlan 998
switchport mode access
shutdown
!
interface Ethernet5/2
no shutdown
switchport trunk encapsulation dot1q
switchport trunk native vlan 999
switchport mode trunk
channel-group 1 mode active
!
interface Ethernet5/3
no shutdown
switchport trunk encapsulation dot1q
switchport trunk native vlan 999
switchport mode trunk
channel-group 1 mode active
!
interface Vlan115
no shutdown
ip vrf forwarding BLUE_PROD
ip address 192.168.15.3 255.255.255.0
no ip redirects
no ip unreachables
no ip proxy-arp
standby 15 ip 192.168.15.1
!
interface Vlan121
no shutdown
ip vrf forwarding YELLOW_CAO
ip address 192.168.21.3 255.255.255.0
no ip redirects
no ip unreachables
no ip proxy-arp
standby 21 ip 192.168.21.1
!
interface Vlan122
no shutdown
ip vrf forwarding YELLOW_CAO
ip address 192.168.22.3 255.255.255.0
no ip redirects
no ip unreachables
no ip proxy-arp
standby 22 ip 192.168.22.1
!
interface Vlan700
no shutdown
ip vrf forwarding YELLOW_PROD
ip address 10.20.0.2 255.255.255.0
no ip redirects
no ip unreachables
no ip proxy-arp
standby 0 ip 10.20.0.1
standby 0 priority 110
standby 0 preempt delay minimum 30 reload 30
!
interface Vlan730
no shutdown
ip vrf forwarding YELLOW_PROD
ip address 10.20.30.2 255.255.255.0
no ip redirects
no ip unreachables
no ip proxy-arp
standby 30 ip 10.20.30.1
standby 30 priority 110
standby 30 preempt delay minimum 30 reload 30
!
interface Vlan740
no shutdown
vrf forwarding GREEN_PROD
ip address 10.20.40.2 255.255.255.0
standby 40 ip 10.20.40.1
standby 40 priority 110
standby 40 preempt delay minimum 30 reload 30
!
interface Vlan742
no shutdown
vrf forwarding GREEN_PROD
ip address 10.20.42.2 255.255.255.0
standby 42 ip 10.20.42.1
standby 42 priority 110
standby 42 preempt delay minimum 30 reload 30
ip ospf priority 10
!
router bgp 65001
bgp router-id 10.10.10.3
bgp log-neighbor-changes
network 10.51.100.0 mask 255.255.255.252
network 10.51.102.0 mask 255.255.255.252
redistribute connected
redistribute static
neighbor 10.51.100.1 remote-as 65001
neighbor 10.51.100.1 soft-reconfiguration inbound
neighbor 10.51.102.1 remote-as 65001
neighbor 10.51.102.1 soft-reconfiguration inbound
maximum-paths ibgp 2
!
address-family ipv4 vrf GREEN_PROD
network 10.20.40.0 mask 255.255.255.0
network 10.20.42.0 mask 255.255.255.0
redistribute static
exit-address-family
!
ip forward-protocol nd
!
no ip http server
no ip http secure-server
!
ip route vrf GREEN_PROD 0.0.0.0 0.0.0.0 10.51.100.1
ip route vrf GREEN_PROD 0.0.0.0 0.0.0.0 10.51.102.1
!
!
!
ip prefix-list ALLOW_DEFAULT_ROUTE seq 5 permit 0.0.0.0/0
!
ip prefix-list EXPORT_GREEN_PROD_TO_GRT seq 5 permit 10.20.40.0/24
ip prefix-list EXPORT_GREEN_PROD_TO_GRT seq 10 permit 10.20.42.0/24
!
ip prefix-list GREEN_PROD_TO_GRT seq 5 permit 10.20.42.0/24
ip prefix-list GREEN_PROD_TO_GRT seq 15 permit 10.20.40.0/24
!
ip prefix-list GRT_TO_GREEN_PROD seq 5 permit 0.0.0.0/0
!
ip prefix-list REDISTRIBUTE_STATIC seq 5 permit 10.20.0.0/24
ip prefix-list REDISTRIBUTE_STATIC seq 10 permit 10.20.30.0/24
ip prefix-list REDISTRIBUTE_STATIC seq 15 permit 10.20.40.0/24
ip prefix-list REDISTRIBUTE_STATIC seq 20 permit 10.20.42.0/24
!
ip prefix-list REDISTRO_CONNECTED seq 5 permit 10.10.10.3/32
!
route-map STATIC_TO_OSPF permit 10
match ip address prefix-list REDISTRIBUTE_STATIC
!
route-map CONNTECTED_TO_BGP permit 10
match ip address prefix-list REDISTRO_CONNECTED
!
route-map GLOBAL_TO_VRF permit 10
match ip address prefix-list ALLOW_DEFAULT_ROUTE
!
route-map GREEN_PROD_TO_GRT permit 10
match ip address prefix-list GREEN_PROD_TO_GRT
!
route-map EXPORT_GREEN_TO_GRT permit 10
match ip address prefix-list EXPORT_GREEN_PROD_TO_GRT
!
!
!
control-plane
!
!
line con 0
logging synchronous
line aux 0
line vty 0 4
login
!
!
end

paul driver · ‎03-27-2019

Hello

@Steven Williams wrote:
I guess I can do this via static but is there a way to do it via BGP and route leaking?

Try the following:

ip prefix-list default-route permit 0.0.0.0/0
route-map default-route_rm
match ip address default-route

ip vrf xx
rd x:x
import ipv4 unicast map default-route_rm

Please rate and mark as an accepted solution if you have found any of the information provided useful.
This then could assist others on these forums to find a valuable answer and broadens the community’s global network.

Kind Regards
Paul

View solution in original post

paul driver · ‎03-27-2019

Hello

@Steven Williams wrote:

How can I get the default route into a vrf from the global route table? I can get the VRF routes into the global route table but not the other way around.

You need to specify the "global" keyword in the static vrf

Example:
ip route vrf GREEN_PROD 0.0.0.0 0.0.0.0 10.51.100.1 global

Also for return traffic into you vrf don't forget to also tell the rtr how to reach you vrf routes
ip route 10.51.100.x 255.255.255.x <interface>

Please rate and mark as an accepted solution if you have found any of the information provided useful.
This then could assist others on these forums to find a valuable answer and broadens the community’s global network.

Kind Regards
Paul

Steven Williams · ‎03-27-2019

Using BGP to get the routes in each VRF to the GRT. THe global is what I was missing on the static.

paul driver · ‎03-27-2019

Hello

@Steven Williams wrote:
Using BGP to get the routes in each VRF to the GRT. THe global is what I was missing on the static.

The last example was indeed for a default static into the GREEN_PROD, are you wanting to route-leak between the other vrf's or just add a default into also?

Please elaborate?

Please rate and mark as an accepted solution if you have found any of the information provided useful.
This then could assist others on these forums to find a valuable answer and broadens the community’s global network.

Kind Regards
Paul

Steven Williams · ‎03-27-2019

I am learning the default route via north bound firewalls from BGP. Then I am getting the routes/networks from my VRFs into the Global Route table so the firewalls can route back. Now I need to get the learned default route from the global route table into each VRF. I guess I can do this via static but is there a way to do it via BGP and route leaking?

paul driver · ‎03-27-2019

Hello

@Steven Williams wrote:
I guess I can do this via static but is there a way to do it via BGP and route leaking?

Try the following:

ip prefix-list default-route permit 0.0.0.0/0
route-map default-route_rm
match ip address default-route

ip vrf xx
rd x:x
import ipv4 unicast map default-route_rm

Please rate and mark as an accepted solution if you have found any of the information provided useful.
This then could assist others on these forums to find a valuable answer and broadens the community’s global network.

Kind Regards
Paul

mwood000111 · ‎03-27-2019

Steven,

What is the purpose of the route-map statement below:

route-map GLOBAL_TO_VRF permit 10
match ip address prefix-list ALLOW_DEFAULT_ROUTE

I dont see the route-map referenced in any policy-route map on an interface. What interfaces are supposed to be using the global routing table? Thanks.

Steven Williams · ‎03-27-2019

its dead. I was messing around with some things.

mwood000111 · ‎03-27-2019

Ah, fair enough. I just realized I misread your question too. You already have the global routing table populated, you need it in VRF. Ive done similar inter-VRF routing before (in this case VRF to global) in using route-maps to set particular VRF. Id have to look in old configs to pull that out to confirm.

Steven Williams · ‎03-27-2019

Here was the final config to make it work.

!
! Last configuration change at 22:20:47 EET Wed Mar 27 2019
!
version 15.2
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
service compress-config
!
hostname CORE-SW-01
!
boot-start-marker
boot-end-marker
!
!
vrf definition GREEN_PROD
rd 65001:10
!
address-family ipv4
import ipv4 unicast map GLOBAL_TO_VRF
export ipv4 unicast map GREEN_PROD_TO_GRT
route-target export 65001:10
route-target import 65001:10
exit-address-family
!
!
no aaa new-model
clock timezone EET 2 0
!
!
!
!
!
!
ip vrf BLUE_PROD
rd 65000:30
!
ip vrf YELLOW_CAO
rd 65000:21
!
ip vrf YELLOW_PROD
rd 65000:20
!
!
!
ip cef
no ip igmp snooping
no ipv6 cef
!
!
!
spanning-tree mode rapid-pvst
spanning-tree extend system-id
spanning-tree vlan 700,730,740,742 priority 0
!
vlan internal allocation policy ascending
!
vlan 1740
name GREEN_PROD_EGRESS
lldp run
!
!
!
!
!
!
!
!
!
!
!
!
!
!
interface Loopback0
no shutdown
ip address 10.10.10.3 255.255.255.255
!
interface Port-channel1
no shutdown
switchport trunk encapsulation dot1q
switchport trunk native vlan 999
switchport mode trunk
bandwidth 100
!
interface Ethernet0/0
no shutdown
no switchport
ip address 10.51.100.2 255.255.255.252
no ip redirects
no ip unreachables
no ip proxy-arp
duplex auto
spanning-tree portfast edge
!
interface Ethernet0/1
no shutdown
switchport access vlan 998
shutdown
!
interface Ethernet0/2
no shutdown
no switchport
ip address 10.51.102.2 255.255.255.252
no ip redirects
no ip unreachables
no ip proxy-arp
duplex auto
!
interface Ethernet0/3
no shutdown
switchport access vlan 998
shutdown
!
interface Ethernet1/0
no shutdown
!
interface Ethernet1/1
no shutdown
!
interface Ethernet1/2
no shutdown
switchport trunk allowed vlan 700,730,999
switchport trunk encapsulation dot1q
switchport trunk native vlan 999
switchport mode trunk
!
interface Ethernet1/3
no shutdown
!
interface Ethernet2/0
no shutdown
switchport access vlan 998
switchport trunk allowed vlan 121,122,999
switchport trunk encapsulation dot1q
switchport trunk native vlan 999
switchport mode trunk
!
interface Ethernet2/1
no shutdown
switchport access vlan 998
switchport trunk allowed vlan 115,999
switchport trunk encapsulation dot1q
switchport trunk native vlan 999
switchport mode trunk
!
interface Ethernet2/2
no shutdown
switchport access vlan 998
switchport trunk allowed vlan 700,730,999
switchport trunk encapsulation dot1q
switchport trunk native vlan 999
switchport mode trunk
!
interface Ethernet2/3
no shutdown
switchport access vlan 998
switchport trunk allowed vlan 740,742,999
switchport trunk encapsulation dot1q
switchport trunk native vlan 999
switchport mode trunk
!
interface Ethernet3/0
no shutdown
switchport access vlan 998
shutdown
!
interface Ethernet3/1
no shutdown
switchport access vlan 998
shutdown
!
interface Ethernet3/2
no shutdown
switchport access vlan 998
shutdown
!
interface Ethernet3/3
no shutdown
switchport access vlan 998
shutdown
!
interface Ethernet4/0
no shutdown
switchport access vlan 998
shutdown
!
interface Ethernet4/1
no shutdown
switchport access vlan 998
shutdown
!
interface Ethernet4/2
no shutdown
switchport access vlan 998
shutdown
!
interface Ethernet4/3
no shutdown
switchport access vlan 998
shutdown
!
interface Ethernet5/0
no shutdown
switchport access vlan 998
switchport mode access
shutdown
!
interface Ethernet5/1
no shutdown
switchport access vlan 998
switchport mode access
shutdown
!
interface Ethernet5/2
no shutdown
switchport trunk encapsulation dot1q
switchport trunk native vlan 999
switchport mode trunk
channel-group 1 mode active
!
interface Ethernet5/3
no shutdown
switchport trunk encapsulation dot1q
switchport trunk native vlan 999
switchport mode trunk
channel-group 1 mode active
!
interface Vlan115
no shutdown
ip vrf forwarding BLUE_PROD
ip address 192.168.15.3 255.255.255.0
no ip redirects
no ip unreachables
no ip proxy-arp
standby 15 ip 192.168.15.1
!
interface Vlan121
no shutdown
ip vrf forwarding YELLOW_CAO
ip address 192.168.21.3 255.255.255.0
no ip redirects
no ip unreachables
no ip proxy-arp
standby 21 ip 192.168.21.1
!
interface Vlan122
no shutdown
ip vrf forwarding YELLOW_CAO
ip address 192.168.22.3 255.255.255.0
no ip redirects
no ip unreachables
no ip proxy-arp
standby 22 ip 192.168.22.1
!
interface Vlan700
no shutdown
ip vrf forwarding YELLOW_PROD
ip address 10.20.0.2 255.255.255.0
no ip redirects
no ip unreachables
no ip proxy-arp
standby 0 ip 10.20.0.1
standby 0 priority 110
standby 0 preempt delay minimum 30 reload 30
!
interface Vlan730
no shutdown
ip vrf forwarding YELLOW_PROD
ip address 10.20.30.2 255.255.255.0
no ip redirects
no ip unreachables
no ip proxy-arp
standby 30 ip 10.20.30.1
standby 30 priority 110
standby 30 preempt delay minimum 30 reload 30
!
interface Vlan740
no shutdown
vrf forwarding GREEN_PROD
ip address 10.20.40.2 255.255.255.0
standby 40 ip 10.20.40.1
standby 40 priority 110
standby 40 preempt delay minimum 30 reload 30
!
interface Vlan742
no shutdown
vrf forwarding GREEN_PROD
ip address 10.20.42.2 255.255.255.0
standby 42 ip 10.20.42.1
standby 42 priority 110
standby 42 preempt delay minimum 30 reload 30
ip ospf priority 10
!
router bgp 65001
bgp router-id 10.10.10.3
bgp log-neighbor-changes
network 10.51.100.0 mask 255.255.255.252
network 10.51.102.0 mask 255.255.255.252
redistribute connected
neighbor 10.51.100.1 remote-as 65001
neighbor 10.51.100.1 soft-reconfiguration inbound
neighbor 10.51.102.1 remote-as 65001
neighbor 10.51.102.1 soft-reconfiguration inbound
maximum-paths ibgp 2
!
address-family ipv4 vrf GREEN_PROD
network 10.20.40.0 mask 255.255.255.0
network 10.20.42.0 mask 255.255.255.0
maximum-paths ibgp 2
exit-address-family
!
ip forward-protocol nd
!
no ip http server
no ip http secure-server
!
!
!
!
ip prefix-list ALLOW_DEFAULT_ROUTE seq 5 permit 0.0.0.0/0
!
ip prefix-list GREEN_PROD_TO_GRT seq 5 permit 10.20.42.0/24
ip prefix-list GREEN_PROD_TO_GRT seq 15 permit 10.20.40.0/24
!
route-map GLOBAL_TO_VRF permit 10
match ip address prefix-list ALLOW_DEFAULT_ROUTE
!
route-map GREEN_PROD_TO_GRT permit 10
match ip address prefix-list GREEN_PROD_TO_GRT
!
!
!
control-plane
!
!
line con 0
logging synchronous
line aux 0
line vty 0 4
login
!
!
end