05-06-2023 06:14 AM - edited 05-06-2023 06:15 AM
We have two TLOCs on a cEdge, with a single service VRF. Bringing in an additional transport and setting up a second service VRF. I want to ensure the new service VRF is using the new TLOC, and only that service VRF. Is there a way to bind a service VRF to a particular TLOC?
Solved! Go to Solution.
05-06-2023 12:14 PM - edited 05-06-2023 12:26 PM
Hi,
there is direct way, like one click "native" configuration.
But there is centralized control policy which can provide you what you want.
In centralized control policy ("Topology") you need OMP route type policy modification. I don't know, how your current policy looks like, but I'll write for clear policy example, you may add with respective sequence number:
Policy should contain:
sequence 1:
match VPN = your VRF
match TLOC = new TLOC
action = accept
sequence 11
match VPN = your VRF
action = reject
sequence 21:
match TLOC List = new TLOC
action = reject
Note: if you don't have policy yet, then don't forget default action, add explicit accept any or change action in default action for rest of routing.
Apply this topology policy in inbound direction for that site (vSmart will receive all routes from site, but will filter in vSmart OMP table and only non-filtered routes will be advertised to rest of sites).
Explanation:
seq1# by this entry OMP routes for respective VRF will be allowed if TLOC is new TLOC. Your VRF will be reachable through new TLOC
seq11# by this entry all routes from site with respective VRF (service VPN) and any other TLOC (other than new TLOC, seq1 is evaluated before and permits routes with new TLOC) will be filtered
seq 21# by this entry any OMP VPN route (for VRF other than your mentioned service VRF) will be filtered over new TLOC
Thus, remote sites will receive any route information about mentioned VRF with only new TLOC. And none of other VRF route information will be available with new TLOC.
05-06-2023 12:14 PM - edited 05-06-2023 12:26 PM
Hi,
there is direct way, like one click "native" configuration.
But there is centralized control policy which can provide you what you want.
In centralized control policy ("Topology") you need OMP route type policy modification. I don't know, how your current policy looks like, but I'll write for clear policy example, you may add with respective sequence number:
Policy should contain:
sequence 1:
match VPN = your VRF
match TLOC = new TLOC
action = accept
sequence 11
match VPN = your VRF
action = reject
sequence 21:
match TLOC List = new TLOC
action = reject
Note: if you don't have policy yet, then don't forget default action, add explicit accept any or change action in default action for rest of routing.
Apply this topology policy in inbound direction for that site (vSmart will receive all routes from site, but will filter in vSmart OMP table and only non-filtered routes will be advertised to rest of sites).
Explanation:
seq1# by this entry OMP routes for respective VRF will be allowed if TLOC is new TLOC. Your VRF will be reachable through new TLOC
seq11# by this entry all routes from site with respective VRF (service VPN) and any other TLOC (other than new TLOC, seq1 is evaluated before and permits routes with new TLOC) will be filtered
seq 21# by this entry any OMP VPN route (for VRF other than your mentioned service VRF) will be filtered over new TLOC
Thus, remote sites will receive any route information about mentioned VRF with only new TLOC. And none of other VRF route information will be available with new TLOC.
05-06-2023 12:41 PM
Hi Kanan. Yes, we do have a centralized policy in place currently for topology. I'll give it a spin in the lab and let you know. Thanks for the reply.
05-08-2023 03:44 AM
Hi Kanan. Tested this morning, and that worked. Thanks again for the reply.
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide