Route Leaking between VRF and GRT

[dundient]

Hello everybody,

I have a router with two interfaces in separate routing tables. G1 in vrf A with 192.168.0.0/24 being an overlay network and G2 in GRT with 1.1.12.0/24 being an underlay network. Both interfaces serve as Default gateway to two devices which are:

USER 192.168.0.1 - GW 192.168.0.254/24 (G1 interface)

SERVER 1.1.12.1 - GW 1.1.12.254/24 (G2 interface)

I need to get access to underlay network SERVER from overlay network USER but the routes shouldn't appear on each others routing tables. This is needed because of the future collabs with other networks and for separating a strong underlay and overlay networks. 

Are there any possible solutions for this problem?

I've tried route leaking, route leaking with PBR but could not archive the result that i wanted. 

Any ideas?

Thank you in advance

[Harold Ritter]

Hi @dundient ,

Your requirements and what you tried seem to be contradictory. 

First you say

> I need to get access to underlay network SERVER from overlay network USER but the routes shouldn't appear on each     > others routing tables.

but then you continue

> I've tried route leaking, route leaking with PBR

Route leaking would cause the route from VRF A to be present in the global routing table and vice versa.

If it is ok for the VRF A route to be present in the global routing table and vice versa, you can fulfill the requirement with that simple configuration.

ip route 192.168.0.0 255.255.255.0 GigabitEthernet1

! Since the ip route vrf command requires a next hop, you would need one host route for each and every server

! The following sample route assumes that the server is configured with address 1.1.12.2

ip route vrf A 1.1.12.2 255.255.255.255 GigabitEthernet2 1.1.12.2

With that configuration, all hosts on subnet 192.168.0.0/24 could access the server with address 1.1.12.2 and vice versa.

Regards,

[Harold Ritter · Accepted solution]

Hi @dundient ,

And if you do not want the route from vrf A to be present in the global routing table (GRT) and vice versa, you could use the following configuration that just uses PBR to route between vrf A and the GRT.

interface GigabitEthernet1

 vrf forwarding vrfA

 ip address 192.168.0.1 255.255.255.0

 ip policy route-map vrfA_global

!

interface GigabitEthernet2

 ip address 1.1.12.1 255.255.255.0

 ip policy route-map global_vrfA

!

route-map vrfA_global permit 10

 match ip address 101

 set global

!

route-map global_vrfA permit 10

 match ip address 102

 set vrf vrfA

!

access-list 101 permit ip 192.168.0.0 0.0.0.255 1.1.12.0 0.0.0.255

access-list 102 permit ip 1.1.12.0 0.0.0.255 192.168.0.0 0.0.0.255

I am also attaching the configuration guide for VRF aware PBR:

https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst9600/software/release/17-4/configuration_guide/rtng/b_174_rtng_9600_cg/configuring_vrf_aware_pbr.html#id_111673

Regards,

[dundient]

Good day @Harold Ritter 

Apologize for the late response.

This is exactly what I was looking for. Thank you very much!

[Harold Ritter]

You are very welcome @dundient and thanks for the feedback