CSR1000V Leaking Routes between Global Routing Table and Service VPN

[Taiga2022]

Hi all,

I'm testing a lab and met a deadlock about this issue.

I am using CSR1000v routers as an vEdge for my SDWAN Topology.

I already established the Service VPNs and they are working fine.

I wanted to try to make the Internet traffic under each service VPNs not backhaul and go directly to the Internet just from their own Edge. 

I searched on Google but still no luck so far.

How can I leak the Internet Route from the Global Routing Table to the Service VPN and vice versa?

Thank you in advance for your help.

Sincerely,

[Deepak Kumar]

Hello,

I didn't checked in latest version but as per my knowledge  Direct internet breakout (which is supported through local-tloc function on vEdges but not available in cEdges) for traffic types including SaaS traffic that breaks-out/directly goes to the internet

For this you can configure a static default route pointing to the VPN 0, it will be something similar to route leak from vrf to global on regular IOS. This can be achieved also from the Service VPN template. 

ip nat route vrf 11 0.0.0.0 0.0.0.0 global
!
cEdge#show ip route vrf 11

[Taiga2022]

I tried the command but the static route is not installed in the VRF routing Table.

I'm using IOSXE 16.11.

Is the feature only for 17 version above?

[Kanan Huseynli]

Hi,

route leaking between global and VRF is available, but you also have simple way which is via NAT DIA route.

https://www.cisco.com/c/en/us/td/docs/routers/sdwan/configuration/routing/ios-xe-17/routing-book-xe/m-routing-leaking-for-service-sharing.html

Just configure route to 0.0.0.0/0 in service VRF with next-hop as VPN and NAT enable.

Since, underlay is interface you should have NAT configuration under VPN0 interface and whenever 0.0.0.0/0 exists though NAT enabled interface in global table, it will be available in service VRF too (as nat route).

HTH,

[Taiga2022]

I tried to leak a static route using :

ip nat route vrf X X.X.X.X X.X.X.X global

The route installed and showed up as NAT DIA but the next hop become null 0.

So obviously the routes went inside black hole. 

Is there any way to fix that?

I configured "ip nat outside" on WAN interface.

Configured VRF static route to global.

Is there other things I need to do?