Vrf

[SajeshB]

Need help to understand route between Vlan and Vrf configured vlan

We have 2 L3  vlan created on core switch.

Int vlan 26

Ip add 10.18.71.1

Ip ospf 100 area 0

Int vlan 413

Ip vrf forwarding Red

Ip add 163.122.136.94

Exit 

Ip vrf red

Rd 6453:Red

Route target export 6453:Red

Route target export 6453:Red

Router bgp 6453

Address-family ipv4 vrf red

Redistribute connected

Redistribute static

Exit-address-family

Ip route vrf red 0.0.0.0 0.0.0.0 163.122.136.91

Now i have first firewall connected to vlan 26 and all the traffic from firewall is getting nat to vlan 26 Ip.

And from vlan 26 the traffic is flowing to vlan 413 and going to second firewall as vlan 413 is in vrf and default route is pointed toward second firewall Ip

How the traffic is flowing from vlan 26 to vlan 413 as vlan 413 is in vrf ??

Do i need to check anything in Bgp configuration.

[Giuseppe Larosa]

Hello @SajeshB ,

>> How the traffic is flowing from vlan 26 to vlan 413 as vlan 413 is in vrf ??

via the two external firewall devices according to your description.

Please note that playing with route targets in MP BGP is a good way to create communication between two different VRFs, but it does not apply to the global routing table GRT because they miss the route target attribute.

Even if you had two different VRFs you should not try to import / export using route targets because you will risk to bypass the external firewalls.

Hope to help

Giuseppe

[SajeshB]

Thanks for the reply.

Can u pls see the attach simple network digram both the firewall are not connected.

[Giuseppe Larosa · Accepted solution]

Hello,

you are right the two firewalls are not connected.

In this case route leakage should be configured between VRF and global routing table using static routes.

Hope to help

Giuseppe

[SajeshB]

Spoiler

Thankyou so much i was also searching the same.

[SajeshB]

Thankyou so much i was also searching the same.