SD WAN Route leaking on WAN edge routers

[Kenneth Goh]

Currently both cEdge and vEdge are to be able to access to internet, where both vEdge and cEdge is able to ping to 8.8.8.8 sourcing from 172.16.10.10 and 172.16.10.30 respectively. But hosts facing vEdge VPN 10 and cEdge vrf 1 are not able to route to transit router and to internet router. 

I believe there is a need to leak routes to global routing table, please help with the needed commands. Thanks in advanced!

[MHM Cisco World]

There is NATing in cEdge and vEdge ?

[Kenneth Goh]

Hi, are you able to show me the command? But I think it’s more about return route from internet router not been able to reach both VPN 10 & vrf 1.

[DanielP211]

If I understand correctly you would have to do default route leaking between the "internet VPN - 172.16.10.0*/24" and VPN10. But I really don't have enough info to help further...

[M02@rt37]

Hello @Kenneth Goh ,

Regarding you topology you will need to enable to configure route leaking from the VPN/VRF to the global routing table. We need more info to go further.

[Kenneth Goh]

Yes, that is what I am trying to find out on what is the command to enter?

[Kenneth Goh]

What is the command to allow route leaking (on vEdge & cEdge) for transit router to be able to reach both 10.0.11.0/24 and 10.0.30.0/24 network?

On transit router there is static route for 10.0.11.0/24 and 10.0.30.0/24 network.

ip route10.0.11.0 255.255.255.0 172.16.10.10

ip route 10.0.30.0 255.255.255.0 172.16.10.30

[MHM Cisco World]

the leak routing is between VPNx and VPNy not between VPNx/y and VPN0 
the route is redistrubte between VPN0 and VPNx/y 
VPN0 run OMP 
VPNx/y run other routing 

NOW what you need not leak routing but DIA config in VPN0 in vEdge 

[Kenneth Goh]

What I mean is routing leak from the Global routing table to the VPN and VRF for vEdge and cEdge respectively as routes from Internet router to transit router cannot reach both 10.0.11.0/24 and 10.0.30.0/24 network.

[MHM Cisco World]

for me the solution is DAI 
leaking route is only between VPNx and VPNy not between VPN0 and VPNx/y

[Kenneth Goh]

cEdge#sh run | in nat route
ip nat route vrf 65528 0.0.0.0 0.0.0.0 global
ip nat route vrf 1 0.0.0.0 0.0.0.0 global

cEdge#ping vrf 1 8.8.8.8 source 10.0.30.30
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 8.8.8.8, timeout is 2 seconds:
Packet sent with a source address of 10.0.30.30
.....

[MHM Cisco World]

https://fastreroute.com/cisco-sd-wan-direct-internet-access-dia-step-by-step/

[Kenneth Goh]

I am not sure why is it not working on cEdge.

cEdge#sh run int GigabitEthernet 1
Building configuration...

Current configuration : 137 bytes
!
interface GigabitEthernet1
ip address 172.16.10.30 255.255.255.0
ip nat outside
negotiation auto
no mop enabled
no mop sysid
end

cEdge#sh run | in nat route
ip nat route vrf 65528 0.0.0.0 0.0.0.0 global
ip nat route vrf 10 0.0.0.0 0.0.0.0 global
ip nat route vrf 1 0.0.0.0 0.0.0.0 global

cEdge#show ip route vrf 10 | in Nd
n - NAT, Ni - NAT inside, No - NAT outside, Nd - NAT DIA
n*Nd 0.0.0.0/0 [6/0], 00:41:57, Null0

cEdge#ping vrf 10 8.8.8.8
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 8.8.8.8, timeout is 2 seconds:
.....
Success rate is 0 percent (0/5)

cEdge#ping 8.8.8.8
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 8.8.8.8, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 3/3/4 ms

[MHM Cisco World]

Sorry' you mentioned NAT and select leak route !!! It hot maybe make my brain melting.

[Kanan Huseynli]

Route leaking between global and service VPN is possible:

Use VPN 1 (VRF 1) VPN template and configure route leaking as below:

https://www.cisco.com/c/en/us/td/docs/routers/sdwan/configuration/routing/ios-xe-17/routing-book-xe/m-routing-leaking-for-service-sharing.html#Cisco_Concept.dita_ee6c10fd-043d-44c1-9f33-2785408636bb