on 03-11-2013 11:31 AM
Virtual Routing and Forwarding (VRF) tables are logically isolated entities that enable multiple VPN’s to share a common core such as Internet while keeping private networks traffic segregated from the Internet traffic.In some cases, we will need to allow global prefixes to be installed in vrf table and vice-versa. Currently this can be done by adding a static route, etc.Customers want a way to dynamically leak routes between global and vrf table. This is accomplished through the new feature BGP Dynamic Route-leaking that provides a flexibility of leaking multiple prefixes using route-policy for import and export.
Dynamic Route leaking feature is introduced to import routes from global/default vrf to non-default vrf and vice-versa.
Basic Configuration CLI
vrf <VRF_NAME>
address-family <ADDRESS_FAMILY>
import from default-vrf route-policy <POLICY_NAME>
vrf <VRF_NAME>
address-family <ADDRESS_FAMILY>
export to default-vrf route-policy <POLICY_NAME>
Configuration on Cisco router |
---|
route-policy dyna-route-leak-8-x if destination in (8.0.0.0/24) then pass endif end-policy vrf vrf1 address-family ipv4 unicast import from default-vrf route-policy dyna-route-leak-8-x import route-target 1:1 ! |
Existing Global entry for the route:
RP/0/RSP0/CPU0:vc#sh bgp 8.0.0.0/24
Wed Jan 16 10:48:52.515 PST
BGP routing table entry for 8.0.0.0/24
Versions:
Process bRIB/RIB SendTblVer
Speaker 272161 272161
Last Modified: Jan 16 10:38:15.025 for 00:10:37
Paths: (1 available, best #1)
Not advertised to any peer
Path #1: Received by speaker 0
Not advertised to any peer
65008
192.200.1.2 (metric 2) from 6.6.6.6 (6.6.6.6)
Origin incomplete, localpref 100, valid, internal, best, group- best, import-candidate
Received Path ID 0, Local Path ID 1, version 272161
RP/0/RSP0/CPU0:vc#
Show command to see imported route in vrf1
RP/0/RSP0/CPU0:vc#sh bgp vrf vrf1 8.0.0.0/24
Wed Jan 16 10:49:10.665 PST
BGP routing table entry for 8.0.0.0/24, Route Distinguisher: 3.3.3.3:0
Versions:
Process bRIB/RIB SendTblVer
Speaker 258011 258011
Last Modified: Jan 16 10:38:15.025 for 00:10:55
Paths: (1 available, best #1)
Advertised to CE update-groups (with more than one peer):
0.2
Path #1: Received by speaker 0
Advertised to CE update-groups (with more than one peer):
0.2
65008
192.200.1.2 (metric 2) from 6.6.6.6 (6.6.6.6)
Origin incomplete, localpref 100, valid, internal, best, group-best,
import-candidate, imported- This tag gets added for the imported route
Received Path ID 0, Local Path ID 1, version 258011
Source VRF: default, Source Route Distinguisher: 0:0
RP/0/RSP0/CPU0:vc#
RP/0/RSP0/CPU0:vc#sh cef vrf vrf1 8.0.0.0/24
Wed Jan 16 10:50:08.130 PST
8.0.0.0/24, version 110154, internal 0x14000001 (ptr 0x75714894) [1], 0x0 (0x0), 0x0 (0x0)
Updated Jan 16 10:38:15.502
Prefix Len 24, traffic index 0, precedence n/a, priority 3
via 192.200.1.2, 7 dependencies, recursive [flags 0x6010]
path-idx 0 [0x72d9f6e0 0x0]
next hop VRF - 'default', table - 0xe0000000---- next hop would still point to the default vrf for a route imported in vrf table
next hop 192.200.1.2 via 192.200.1.0/24
RP/0/RSP0/CPU0:vc#
Configuration on Cisco router |
---|
route-policy dyna-route-leak-comm-9-x if community matches-every (65008:9) then pass endif end-policy vrf vrf2 address-family ipv4 unicast import from default-vrf route-policy dyna-route-leak-comm-9-x import route-target 1:2 |
Global Entry for route:
RP/0/RSP0/CPU0:vc#sh bgp 9.0.0.0/24
Fri Jan 4 16:27:10.080 PST
BGP routing table entry for 9.0.0.0/24
…..
………
………
Not advertised to any peer
65008
1.1.1.1 (metric 9) from 1.1.1.1 (1.1.1.1)
Origin IGP, localpref 100, valid, internal, best, group-best, import-candidate
Received Path ID 0, Local Path ID 1, version 739583
Community: 65008:9
Show command to see imported route in vrf2
RP/0/RSP0/CPU0:vc#sh bgp vrf vrf2 9.0.0.0
Wed Jan 16 11:07:39.941 PST
BGP routing table entry for 9.0.0.0/24, Route Distinguisher: 1:2
.....
....
192.200.1.2 (metric 2) from 6.6.6.6 (6.6.6.6)
Origin incomplete, localpref 100, valid, internal, best, group-best,
import-candidate, imported
......
Configuration on Cisco router |
---|
route-policy dyna-route-leak-aspath-prefix-10-x if as-path originates-from '65008' and destination in (10.0.0.0/24) then pass endif end-policy ! vrf vrf3 address-family ipv4 unicast import from default-vrf route-policy dyna-route-leak-aspath-prefix-10-x import route-target 1:3 |
Global entry for the route:
RP/0/RSP0/CPU0:vc#sh bgp 10.0.0.0/24
Wed Jan 16 11:13:46.446 PST
BGP routing table entry for 10.0.0.0/24
……
…….
Show command to see imported route in vrf3
RP/0/RSP0/CPU0:vc#sh bgp vrf vrf3 10.0.0.0/24
Wed Jan 16 11:14:10.537 PST
BGP routing table entry for 10.0.0.0/24, Route Distinguisher: 1:3
…..
…..
Origin incomplete, localpref 100, valid, internal, best, group-best,
import-candidate, imported
…….
RP/0/RSP0/CPU0:vc#sh cef vrf vrf3 10.0.0.0
Wed Jan 16 11:14:21.743 PST
10.0.0.0/24, version 58508, internal 0x14000001 (ptr 0x75b37d34) [1], 0x0 (0x0), 0x0 (0x0)
…….
next hop VRF - 'default', table - 0xe0000000
next hop 192.200.1.2 via 192.200.1.0/24
RP/0/RSP0/CPU0:vc#
Configuration on Cisco router |
---|
route-policy dyna-route-leak-aspath-prefix-comm-11-x if as-path originates-from '65008' and destination in (11.0.0.0/24) and community matches-every (65008:11) then pass endif end-policy
vrf vrf4 address-family ipv4 unicast import from default-vrf route-policy dyna-route-leak-aspath-prefix-comm-11-x import route-target 1:4 |
Global entry for the route:
RP/0/RSP0/CPU0:vc#sh bgp 11.0.0.0/24
Wed Jan 16 11:20:59.420 PST
BGP routing table entry for 11.0.0.0/24
…..
…..
Show command to see imported route in vrf4
RP/0/RSP0/CPU0:vc#sh bgp vrf vrf4 11.0.0.0
Wed Jan 16 11:22:48.438 PST
BGP routing table entry for 11.0.0.0/24, Route Distinguisher: 1:4
……
……
Origin incomplete, localpref 100, valid, internal, best, group-best,
import-candidate, imported
……..
RP/0/RSP0/CPU0:vc#sh cef vrf vrf4 11.0.0.0
Wed Jan 16 11:23:27.457 PST
11.0.0.0/24, version 39030, internal 0x14000001 (ptr 0x75b37da4) [1], 0x0 (0x0), 0x0 (0x0)
Updated Jan 16 11:22:50.079
.......
next hop VRF - 'default', table - 0xe0000000
next hop 192.200.1.2 via 192.200.1.0/24
RP/0/RSP0/CPU0:vc#
Cisco configuration on the router |
---|
route-policy dyna-route-leak-26-x if destination in (26.0.0.0/30) then pass endif end-policy vrf vrf1 address-family ipv4 unicast export to default-vrf route-policy dyna-route-leak-26-x export route-target 1:1 |
VRF entry for the route:
RP/0/RSP0/CPU0:vc#sh bgp vrf vrf1 26.0.0.0
Wed Jan 16 11:34:20.369 PST
BGP routing table entry for 26.0.0.0/30, Route Distinguisher: 3.3.3.3:0
…….
……
Show command to see exported route in the global table
RP/0/RSP0/CPU0:vc#sh bgp 26.0.0.0
Wed Jan 16 11:34:46.949 PST
BGP routing table entry for 26.0.0.0/30
……..
…….
Advertised to update-groups (with more than one peer):
0.7 0.8
65002
192.172.1.2 from 192.172.1.2 (192.172.1.2)
Origin incomplete, localpref 100, valid, external, best, group-best, import-candidate, imported -••à This tag gets added for the imported route
Received Path ID 0, Local Path ID 1, version 372157
Extended community: RT:1:1
Origin-AS validity: not-found
Source VRF: vrf1, Source Route Distinguisher: 3.3.3.3:0
RP/0/RSP0/CPU0:vc#sh cef 26.0.0.0
Wed Jan 16 11:34:54.832 PST
26.0.0.0/30, version 2038985, internal 0x14004001 (ptr 0x759afa7c) [1], 0x0 (0x72fee3d8), 0x400 (0x74714080)
………
next hop VRF - 'vrf1', table - 0xe0000042••à next hop would still point to the vrf table for a route imported in global table
……….
Cisco Configuration on the router |
---|
route-policy dyna-route-leak-comm-27-x if community matches-every (65004:27) then pass endif end-policy ! vrf vrf2 address-family ipv4 unicast export to default-vrf route-policy dyna-route-leak-comm-27-x export route-target 1:2 ! |
VRF Entry for route:
RP/0/RSP0/CPU0:vc#sh bgp vrf vrf2 27.0.0.0
Wed Jan 16 11:42:48.873 PST
BGP routing table entry for 27.0.0.0/30, Route Distinguisher: 1:2
……
……
Show command to see exported route in the global table
RP/0/RSP0/CPU0:vc#sh bgp 27.0.0.0
Wed Jan 16 11:44:26.564 PST
BGP routing table entry for 27.0.0.0/30
……
……..
192.172.2.2 from 192.172.2.2 (192.172.2.2)
Origin EGP, localpref 100, valid, external, best, group-best, import-candidate, imported
………
RP/0/RSP0/CPU0:vc#sh cef 27.0.0.0
Wed Jan 16 11:44:33.638 PST
27.0.0.0/30, version 2038990, internal 0x14004001 (ptr 0x759afbc0) [1], 0x0 (0x72fee360), 0x400 (0x74b8c278)
………
next hop VRF - 'vrf2', table - 0xe0000043
…….
Cisco configuration on the router |
---|
route-policy dyna-route-leak-aspath-prefix-28-x if as-path originates-from '65006' and destination in (28.0.0.0/30) then pass endif end-policy
vrf vrf3 address-family ipv4 unicast export to default-vrf route-policy dyna-route-leak-aspath-prefix-28-x export route-target 1:3 |
Vrf entry for the route:
RP/0/RSP0/CPU0:vc#sh bgp vrf vrf3 28.0.0.0
Wed Jan 16 11:47:04.085 PST
BGP routing table entry for 28.0.0.0/30, Route Distinguisher: 1:3
………
……
Show command to see exported route in the global table
RP/0/RSP0/CPU0:vc#sh bgp 28.0.0.0
Wed Jan 16 11:48:31.484 PST
BGP routing table entry for 28.0.0.0/30
……..
……..
Origin incomplete, localpref 100, valid, external, best, group-best, import-candidate, imported
……
RP/0/RSP0/CPU0:vc#sh cef 28.0.0.0
Wed Jan 16 11:47:53.249 PST
28.0.0.0/30, version 2059119, internal 0x14000001 (ptr 0x759af9a4) [1], 0x0 (0x72fee400), 0x400 (0x754ea778)
……..
………
next hop VRF - 'vrf3', table - 0xe0000044
……
Cisco configuration on the router |
---|
route-policy dyna-route-leak-aspath-prefix-comm-29-x if as-path originates-from '65008' and destination in (29.0.0.0/30) and community matches-every (65008:29) then pass endif end-policy
vrf vrf4 address-family ipv4 unicast export to default-vrf route-policy dyna-route-leak-aspath-prefix-comm-29-x export route-target 1:4 |
Vrf entry for the route:
RP/0/RSP0/CPU0:vc#sh bgp vrf vrf4 29.0.0.0
Wed Jan 16 11:54:34.259 PST
BGP routing table entry for 29.0.0.0/30, Route Distinguisher: 1:4
……
……….
Show command to see exported route in the global table
RP/0/RSP0/CPU0:vc#sh bgp 29.0.0.0
Wed Jan 16 11:54:51.833 PST
BGP routing table entry for 29.0.0.0/30
……..
……..
Origin incomplete, localpref 100, valid, external, best, group-best,
import-candidate, imported
……
RP/0/RSP0/CPU0:vc#sh cef 29.0.0.0
Wed Jan 16 11:54:56.327 PST
29.0.0.0/30, version 2059125, internal 0x14004001 (ptr 0x72d4c304) [1], 0x0 (0x75554448), 0x400 (0x754fa470)
……..
next hop VRF - 'vrf4', table - 0xe0000045
…….
Cisco Configuration on the router |
---|
route-policy dyna-route-leak-8-x if destination in (12.0.0.0/24) then pass endif end-policy
vrf vrf1 address-family ipv4 unicast import from default-vrf route-policy dyna-route-leak-8-x |
Similarly this route-policy can be imported under multiple vrf to import this prefix.
Global entry for the route
RP/0/RSP0/CPU0:vc#sh bgp 12.0.0.0/24
Wed Jan 16 12:05:11.712 PST
BGP routing table entry for 12.0.0.0/24
…….
……….
Show command to see route imported in multiple vrf’s
VRF1:
RP/0/RSP0/CPU0:vc#sh bgp vrf vrf1 12.0.0.0/24
Wed Jan 16 12:05:30.630 PST
BGP routing table entry for 12.0.0.0/24, Route Distinguisher: 3.3.3.3:0
VRF2:
RP/0/RSP0/CPU0:vc#sh bgp vrf vrf2 12.0.0.0/24
Wed Jan 16 12:07:08.524 PST
BGP routing table entry for 12.0.0.0/24, Route Distinguisher: 1:2
VRF3:
RP/0/RSP0/CPU0:vc#sh bgp vrf vrf3 12.0.0.0/24
Wed Jan 16 12:07:12.441 PST
BGP routing table entry for 12.0.0.0/24, Route Distinguisher: 1:3
VRF4:
RP/0/RSP0/CPU0:vc#sh bgp vrf vrf4 12.0.0.0/24
Wed Jan 16 12:07:17.185 PST
BGP routing table entry for 12.0.0.0/24, Route Distinguisher: 1:4
Vrf entry in all the vrf’s:
RP/0/RSP0/CPU0:vc#sh bgp vrf vrf1 12.0.0.0/24
Wed Jan 16 12:05:30.630 PST
BGP routing table entry for 12.0.0.0/24, Route Distinguisher: 3.3.3.3:0
…….
……….
Origin incomplete, localpref 100, valid, internal, best, group-best, import-candidate, imported
……….
RP/0/RSP0/CPU0:vc#sh bgp vrf vrf2 12.0.0.0/24
Wed Jan 16 12:07:08.524 PST
BGP routing table entry for 12.0.0.0/24, Route Distinguisher: 1:2
……
………
Origin incomplete, localpref 100, valid, internal, best, group-best, import-candidate, imported
……
RP/0/RSP0/CPU0:vc#sh bgp vrf vrf3 12.0.0.0/24
Wed Jan 16 12:07:12.441 PST
BGP routing table entry for 12.0.0.0/24, Route Distinguisher: 1:3
……..
……..
Origin incomplete, localpref 100, valid, internal, best, group-best, import-candidate, imported
……
RP/0/RSP0/CPU0:vc#sh bgp vrf vrf4 12.0.0.0/24
Wed Jan 16 12:07:17.185 PST
BGP routing table entry for 12.0.0.0/24, Route Distinguisher: 1:4
…….
……
Origin incomplete, localpref 100, valid, internal, best, group-best, import-candidate, imported
….......
Traffic direction: Cisco ----> Junos
27.0.0.0(vrf2) ----> 9.0.0.0
Dynamic route-leaking based on Community on Cisco ASR9K:
-Import from default-vrf
Cisco configuration on the router |
---|
route-policy dyna-route-leak-comm-9-x if community matches-every (65008:9) then pass endif end-policy
vrf vrf2 address-family ipv4 unicast import from default-vrf route-policy dyna-route-leak-comm-9-x |
Global entry for 9.0.0.0 on Cisco ASR9K:
RP/0/RSP0/CPU0:vc#sh bgp 9.0.0.0
Wed Feb 13 00:33:04.007 PST
BGP routing table entry for 9.0.0.0/24
……
…….
Route as seen in CISCO vrf table after route-leaking
RP/0/RSP0/CPU0:vc#sh bgp vrf vrf2 9.0.0.0
Wed Feb 13 00:33:56.913 PST
BGP routing table entry for 9.0.0.0/24, Route Distinguisher: 1:2
…….
……….
Origin incomplete, localpref 100, valid, internal, best, group-best, import-
candidate, imported
……..
Cef entry for the route:
RP/0/RSP0/CPU0:vc#sh cef vrf vrf2 9.0.0.0
Wed Feb 13 00:37:02.628 PST
9.0.0.0/24, version 150018, internal 0x14000001 (ptr 0x74e1ef84) [1], 0x0 (0x0), 0x0 (0x0)
……
……
next hop VRF - 'default', table - 0xe0000000
……..
Traffic direction : Junos --> Cisco
9.0.0.0 --> 27.0.0.0(vrf2)
Dynamic route-leaking based on Community on Cisco ASR9K:
-Export to default vrf:
Cisco configuration on the router |
---|
route-policy dyna-route-leak-comm-27-x if community matches-every (65004:27) then pass endif end-policy ! vrf vrf2 address-family ipv4 unicast export to default-vrf route-policy dyna-route-leak-comm-27-x |
Vrf entry for the route:
RP/0/RSP0/CPU0:vc#sh bgp vrf vrf2 27.0.0.0
Wed Feb 13 00:20:02.109 PST
BGP routing table entry for 27.0.0.0/30, Route Distinguisher: 1:2
……
……
Route as seen in CISCO Global table after route-leaking
RP/0/RSP0/CPU0:vc#sh bgp 27.0.0.0
Wed Feb 13 00:23:13.598 PST
BGP routing table entry for 27.0.0.0/30
……
……
Origin EGP, localpref 100, valid, external, best, group-best, import-candidate, imported
…….
CEF entry for the route:
RP/0/RSP0/CPU0:vc#sh cef 27.0.0.0
Wed Feb 13 00:22:19.199 PST
27.0.0.0/30, version 357462, internal 0x14000001 (ptr 0x71cedfe0) [1], 0x0 (0x73a9a798), 0x400 (0x74690070)
……
……
next hop VRF - 'vrf2', table - 0xe0000012
……..
Traffic direction: cisco -----> junos
16.0.0.0---- 15.0.0.0(vrf1)
Route-leaking on Juniper ----- vrf to global:
Juniper configuration on the node |
---|
root@MX960# show routing-instances vrf1 instance-type vrf; interface xe-5/1/0.101; route-distinguisher 1:1; vrf-import vrf1-import; vrf-export vrf1-export{ routing-options { auto-export; } protocols { bgp { family inet { unicast; } group ROUTE-LEAK { type external; family inet { unicast { rib-group vrf1-to-global; } } neighbor 192.7.1.2 { peer-as 65002; } } } } |
Route as seen in Juniper Global table after route-leaking
root@MX960# run show route 15.0.0.0
inet.0: 70048 destinations, 70054 routes (70048 active, 0 holddown, 0 hidden)
@ = Routing Use Only, # = Forwarding Use Only
+ = Active Route, - = Last Active, * = Both
15.0.0.0/24 *[BGP/170] 00:14:03, localpref 100
AS path: 65002 ?
> to 192.7.1.2 via xe-5/1/0.101
vrf1.inet.0: 20038 destinations, 20038 routes (20038 active, 0 holddown, 0 hidden)
+ = Active Route, - = Last Active, * = Both
15.0.0.0/24 *[BGP/170] 18:34:44, localpref 100
AS path: 65002 ?
> to 192.7.1.2 via xe-5/1/0.101
Traffic direction: Junos ----->CISCO
15.0.0.0(vrf1)---- 16.0.0.0
Route-leaking on Juniper global--- to----vrf:
Juniper configuration on the node |
---|
root@MX960# show protocols bgp group ROUTE-LEAK-internal type internal; family inet { unicast { rib-group global-to-vrf1; } } local-as 65000; neighbor 3.3.3.3 { local-address 6.6.6.6 peer-as 65000; } |
Route as seen in Juniper vrf table after route-leaking
root@MX960# run show route 16.0.0.0
inet.0: 70048 destinations, 70054 routes (70048 active, 0 holddown, 0 hidden)
@ = Routing Use Only, # = Forwarding Use Only
+ = Active Route, - = Last Active, * = Both
16.0.0.0/24 *[BGP/170] 00:58:02, localpref 100, from 3.3.3.3
AS path: 65010 ?
> to 12.1.1.2 via xe-5/2/0.0
vrf1.inet.0: 20038 destinations, 20038 routes (20038 active, 0 holddown, 0 hidden)
+ = Active Route, - = Last Active, * = Both
16.0.0.0/24 *[BGP/170] 00:05:43, localpref 100, from 3.3.3.3
AS path: 65010 ?
> to 12.1.1.2 via xe-5/2/0.0
Traffic direction:
CISCO (26.0.0.0) VRF1------- JUNOS (15.0.0.0) VRF1
Dynamic route-leaking configuration on CISCO ASR9K |
---|
route-policy dyna-route-leak-15-x if destination in (15.0.0.0/24) then pass endif end-policy
vrf vrf1 address-family ipv4 unicast import from default-vrf route-policy dyna-route-leak-15 |
Route as seen in CISCO vrf table after route-leaking
RP/0/RSP0/CPU0:vc#sh bgp vrf vrf1 15.0.0.0
Thu Feb 7 10:44:05.506 PST
BGP routing table entry for 15.0.0.0/24, Route Distinguisher: 1:1
…….
…….
Not advertised to any peer
65002
6.6.6.6 (metric 1) from 6.6.6.6 (6.6.6.6)
Origin incomplete, localpref 100, valid, internal, best, group-best, import-candidate, imported
Received Path ID 0, Local Path ID 1, version 128819
Extended community: RT:1:1
Source VRF: default, Source Route Distinguisher: 0:0
Traffic direction:
JUNOS (15.0.0.0) VRF1------- CISCO (26.0.0.0) VRF1
Header 1 |
---|
route-policy dyna-route-leak-26-x if destination in (26.0.0.0/30) then pass endif end-policy !
vrf vrf1 address-family ipv4 unicast export to default-vrf route-policy dyna-route-leak-26-x |
Route as seen in Juniper vrf table after route-leaking
root@MX960# run show route 26.0.0.0
inet.0: 60028 destinations, 60034 routes (60028 active, 0 holddown, 0 hidden)
@ = Routing Use Only, # = Forwarding Use Only
+ = Active Route, - = Last Active, * = Both
26.0.0.0/30 *[BGP/170] 00:00:03, localpref 100, from 3.3.3.3
AS path: 65002 ?
> to 12.1.1.2 via xe-5/2/0.0
vrf1.inet.0: 10018 destinations, 10018 routes (10018 active, 0 holddown, 0 hidden)
+ = Active Route, - = Last Active, * = Both
26.0.0.0/30 *[BGP/170] 00:00:03, localpref 100, from 3.3.3.3
AS path: 65002 ?
> to 12.1.1.2 via xe-5/2/0.0
N/A
Sheetal Bhogale
Software Engineer, ASR9K SIT Team
Hi Michalis,
I got the workaround solution that might help, currently I dont have IOX lab to test it.
Need you to try it out on your network/lab.
On your PE gateway router:
1) Let say your TEST_VPN_Internet VRF internal route is 200.1.0.0/24 and learned from remote PE.
2) Add the static route on TEST_VPN_Internet VRF with short subnet mask(200.1.0.0/23) point to null0 to generate local route.
3) Then Export 200.1.0.0/23 to global routing using RT export with route-policy.
Since confirm that only local route can be exported, the trick here is to generate local route with shorter subnet mask to null0.
thanks
Hi tckoon,
I will evaluate your workaround but i think that it doesn't match in my case.
Regards,
Michael
Further study in detail the workaround I suggested it will not work. As the /23 route that leak into global routing.
the /23 route next-hop is null0..... so traffic will send to null0.
you're just using that route to "suck" traffic towards you, once it enters, we have the more specific routes /24's to the vrf.
xander
Hello Michalis
I am trying to do exactly the same thing as you di last year... take some MP-BGP learned customer routes at a central PE and export them into the default VRF. I have encountered the same issues with you with not being able to do this, and I can only export the local connected/static routes. Did you manage to find a way to do this?
Thanks
Hi,
No I didn't find any workaround. Here is the response from cisco TAC :
As of today, we do not support the leaking of the imported routes (VPN) to be exported to the global table as ip routes. Hence, only local routes in VRF can be exported to GRT. To export vpnv4 prefixes, please, export them on their "home" remote PE.
Thanks,
Michael
Thanks Michalis, I thought that would be the answer, although it is quite a lot more work to do it that way for us ;-)
The "import from default-vrf" imports from the BGP global table, so first you need to redistribute the static route into BGP. Then the vrf Tester will import the route.
Importing routes from the default-vrf in two ASR9010 (XR Version 5.1.3) routers i get two different outputs from the "show route vrf" command for those routes:
In the first one:
B 148.103.156.0/24 is directly connected, 4d18h, GigabitEthernet0/0/0/0 (nexthop in vrf default)
In the second one:
B 190.94.83.0/24 is directly connected, 00:00:03 route fallback in vrf default
Why in the second one is doing a fallback?
Also, in the second one i get the next error for a linecard:
LC/0/3/CPU0:Mar 2 12:39:11.647 UTC: fib_mgr[177]: Fallback VRF is not supported on this Linecard
Probably needs some more detail as to how you're importing the route(s).
it may be the way that they are pulled into the table.
(show cef x y det loc provide any additional clue?)
xander
No clue yet
Here a comparison chart with more details:
FIRST ROUTER | SECOND ROUTER |
sho run vrf Imp-VRF | sho run vrf Imp-VRF |
vrf Imp-VRF address-family ipv4 unicast import from default-vrf route-policy Global_to_Imp-VRF advertise-as-vpn import route-target 12345:669 ! export route-target 12345:669 ----------------------------------------------------------------- # show run route-policy Global_to_Imp-VRF route-policy Global_to_Imp-VRF if destination in CONNECTED then pass endif end-policy | vrf Imp-VRF address-family ipv4 unicast import from default-vrf route-policy Global_to_Imp-VRF advertise-as-vpn import route-target 12345:669 ! export route-target 12345:669 ----------------------------------------------------------------- # sho run route-policy Global_to_Imp-VRF route-policy Global_to_Imp-VRF if destination in CONNECTED then pass endif end-policy |
show cef 1.1.1.0/24 detail location 0/0/CPU0 | show cef 2.2.2.0/23 detail location 0/0/CPU0 |
1.1.1.0/24, version 147546, attached, connected, glean adjacency, internal 0x40000c1 0x0 (ptr 0xa808be04) [1], 0x0 (0xa8b4bc88), 0x0 (0x0) ....... via GigabitEthernet0/0/0/0.1060, 28 dependencies, weight 0, class 0 [flags 0x8] path-idx 0 NHID 0x0 [0xa48bb7c4 0x0] glean adjacency Load distribution: 0 (refcount 2) Hash OK Interface Address 0 Y GigabitEthernet0/0/0/0.1060 glean | 2.2.2.0/23, version 3239, attached, connected, glean adjacency, internal 0xc0000c1 (ptr 0x88fe7228) [1], 0x0 (0x8abea164), 0x0 (0x0) ....... via GigabitEthernet0/0/0/6.113, 18 dependencies, weight 0, class 0 [flags 0x8] path-idx 0 NHID 0x0 [0x880cc090 0x0] glean adjacency Load distribution: 0 (refcount 2) Hash OK Interface Address 0 Y GigabitEthernet0/0/0/6.113 glean |
show route 1.1.1.0/24 detail | show route 2.2.2.0/23 detail |
Routing entry for 1.1.1.0/24 Known via "connected", distance 0, metric 0 (connected) Installed Feb 17 20:04:10.760 for 2w0d Routing Descriptor Blocks directly connected, via GigabitEthernet0/0/0/0.1060 ....... Route Priority: RIB_PRIORITY_CONNECTED (3) SVD Type RIB_SVD_TYPE_LOCAL Download Priority 0, Download Version 147546 No advertising protos. | Routing entry for 2.2.2.0/23 Known via "connected", distance 0, metric 0 (connected) Installed Oct 3 04:56:11.681 for 21w5d Routing Descriptor Blocks directly connected, via GigabitEthernet0/0/0/6.113 ....... Route Priority: RIB_PRIORITY_CONNECTED (3) SVD Type RIB_SVD_TYPE_LOCAL Download Priority 0, Download Version 3239 No advertising protos. |
show bgp 1.1.1.0/24 detail | show bgp 2.2.2.0/23 detail |
BGP routing table entry for 1.1.1.0/24 Versions: Process bRIB/RIB SendTblVer Speaker 12687 12687 Flags: 0x04040001+0x00000000; Last Modified: Feb 17 20:04:11.130 for 2w0d Paths: (1 available, best #1) Advertised to peers (in unique update groups): 130.122.64.8 Path #1: Received by speaker 0 Flags: 0x400000004504000b, import: 0x1f Advertised to peers (in unique update groups): 130.122.64.8 Local 0.0.0.0 from 0.0.0.0 (172.18.211.2) Origin incomplete, metric 0, localpref 100, weight 32768, valid, redistributed, best, group-best, import-candidate Received Path ID 0, Local Path ID 1, version 12687 | BGP routing table entry for 2.2.2.0/23 Versions: Process bRIB/RIB SendTblVer Speaker 46022 46022 Flags: 0x04040001+0x00000100; Last Modified: Feb 24 17:10:22.754 for 1w0d Paths: (1 available, best #1) Advertised to peers (in unique update groups): 100.40.216.80 Path #1: Received by speaker 0 Flags: 0x400000004504000b, import: 0x1f Advertised to peers (in unique update groups): 100.40.216.80 Local 0.0.0.0 from 0.0.0.0 (172.18.211.4) Origin incomplete, metric 0, localpref 100, weight 32768, valid, redistributed, best, group-best, import-candidate Received Path ID 0, Local Path ID 1, version 46022 |
show bgp vrf Imp-VRF 1.1.1.0/24 detail | show bgp vrf Imp-VRF 2.2.2.0/23 detail |
BGP routing table entry for 1.1.1.0/24, Route Distinguisher: 12345:251002669 ....... ....... Local 0.0.0.0 from 0.0.0.0 (172.18.211.2) Origin incomplete, metric 0, localpref 100, weight 32768, valid, extranet, best, group-best, import-candidate, imported Received Path ID 0, Local Path ID 1, version 4150 Extended community: RT:12345:669 Source VRF: default, Source Route Distinguisher: 0:0 | BGP routing table entry for 2.2.2.0/23, Route Distinguisher: 12345:251004669 ....... ....... Local 0.0.0.0 from 0.0.0.0 (172.18.211.4) Origin incomplete, metric 0, localpref 100, weight 32768, valid, extranet, best, group-best, import-candidate, imported Received Path ID 0, Local Path ID 1, version 2104 Extended community: RT:12345:669 Source VRF: default, Source Route Distinguisher: 0:0 |
show route vrf Imp-VRF 1.1.1.0/24 detail | show route vrf Imp-VRF 2.2.2.0/23 detail |
Routing entry for 1.1.1.0/24 Known via "bgp 12345", distance 200, metric 0 (connected), type locally generated Installed Feb 26 16:53:45.064 for 5d16h Routing Descriptor Blocks directly connected, via GigabitEthernet0/0/0/0.1060 Nexthop in Vrf: "default", Table: "default", IPv4 Unicast, Table Id: 0xe0000000 ....... Route Priority: RIB_PRIORITY_NON_RECURSIVE_LOW (9) SVD Type RIB_SVD_TYPE_LOCAL Download Priority 3, Download Version 299 No advertising protos. | Routing entry for 2.2.2.0/23 Known via "bgp 12345", distance 200, metric 0 (connected), type locally generated Installed Feb 24 18:18:20.749 for 1w0d Routing Descriptor Blocks directly connected Nexthop in Vrf: "default", Table: "default", IPv4 Unicast, Table Id: 0xe0000000 ....... Route Priority: RIB_PRIORITY_NON_RECURSIVE_LOW (9) SVD Type RIB_SVD_TYPE_LOCAL Download Priority 3, Download Version 213 No advertising protos. |
show cef vrf Imp-VRF 1.1.1.0/24 detail location 0/0/CPU0 | show cef vrf Imp-VRF 2.2.2.0/23 detail location 0/0/CPU0 |
1.1.1.0/24, version 299, attached, glean adjacency, internal 0x4000081 0x0 (ptr 0xa4f446e4) [1], 0x0 (0xa94368b0), 0x0 (0x0) Updated Feb 26 16:53:49.669 Prefix Len 24, traffic index 0, precedence n/a, priority 3 gateway array (0xa80a93d8) reference count 1, flags 0x0, source rib (6), 0 backups [2 type 3 flags 0x10101 (0xa7b28808) ext 0x0 (0x0)] LW-LDI[type=3, refc=1, ptr=0xa94368b0, sh-ldi=0xa7b28808] via GigabitEthernet0/0/0/0.1060, 28 dependencies, weight 0, class 0 [flags 0x6008] path-idx 0 NHID 0x0 [0xa48bb7c4 0x0] next hop VRF - 'default', table - 0xe0000000 glean adjacency
Load distribution: 0 (refcount 2)
Hash OK Interface Address 0 Y GigabitEthernet0/0/0/0.1060 glean | 2.2.2.0/23, version 213, attached, internal 0x4000081 (ptr 0x885af7e4) [1], 0x0 (0x8b977094), 0x0 (0x0)
Updated Feb 24 18:18:29.410 Prefix Len 23, traffic index 0, precedence n/a, priority 3 gateway array (0x8b0db658) reference count 1, flags 0x0, source rib (5), 0 backups [2 type 3 flags 0x10101 (0x8ee3ede0) ext 0x0 (0x0)] LW-LDI[type=3, refc=1, ptr=0x8b977094, sh-ldi=0x8ee3ede0] via point2point, 0 dependencies, weight 0, class 0 [flags 0x6018] path-idx 0 NHID 0x0 [0x8814a1dc 0x0] next hop VRF - 'default', table - 0xe0000000
Load distribution: 0 (refcount 2)
Hash OK Interface Address 0 Y Unknown UNKNOWN ADDRESS |
it looks like the adj didnt collapse on router 2 here.
how is the IGP next hop advertised? is that with a static route.
also are both devices running the exact same XR version (just to exclude that discrepancy).
we need to look at the routing for the iBGP peering address and make sure that that routing goes fine and is resolved via the same level(s) between the two devices.
cheers!
xander
Hi Xander,
In the previous table i made a mistake with the outputs. The second router outputs were from a ASR9001 from which i have the same behavior. The comparison chart from the two ASR9010 looks exactly the same as the previous one excepting the last command that looks like this:
FIRST ROUTER | SECOND ROUTER |
show cef vrf Imp-VRF 1.1.1.0/24 detail location 0/0/CPU0 | show cef vrf Imp-VRF 2.2.2.0/24 detail location 0/0/CPU0 |
1.1.1.0/24, version 3700, attached, glean adjacency, internal 0x4000081 0x0 (ptr 0xa4f446e4) [1], 0x0 (0xa94368b0), 0x0 (0x0) Updated Mar 4 15:03:52.044 Prefix Len 24, traffic index 0, precedence n/a, priority 3 gateway array (0xa80a93d8) reference count 1, flags 0x0, source rib (6), 0 backups [2 type 3 flags 0x10101 (0xa7b28808) ext 0x0 (0x0)] LW-LDI[type=3, refc=1, ptr=0xa94368b0, sh-ldi=0xa7b28808] via GigabitEthernet0/0/0/0.1060, 28 dependencies, weight 0, class 0 [flags 0x6008] path-idx 0 NHID 0x0 [0xa48bb7c4 0x0] next hop VRF - 'default', table - 0xe0000000 glean adjacency
Load distribution: 0 (refcount 2)
Hash OK Interface Address 0 Y GigabitEthernet0/0/0/0.1060 glean | %Prefix not found or IP is not running. VRF Imp-VRF. |
show cef vrf Imp-VRF 1.1.1.0/24 detail | show cef vrf Imp-VRF 2.2.2.0/24 detail |
1.1.1.0/24, version 3700, attached, internal 0x4000081 0x0 (ptr 0xad8b3754) [1], 0x0 (0xad8370c8), 0x0 (0x0) Updated Mar 4 15:03:52.036 remote adjacency to GigabitEthernet0/0/0/0.1060 Prefix Len 24, traffic index 0, precedence n/a, priority 3 gateway array (0xad6731b0) reference count 1, flags 0x0, source rib (6), 0 backups [2 type 3 flags 0x10101 (0xad7586fc) ext 0x0 (0x0)] LW-LDI[type=3, refc=1, ptr=0xad8370c8, sh-ldi=0xad7586fc] via GigabitEthernet0/0/0/0.1060, 28 dependencies, weight 0, class 0 [flags 0x6008] path-idx 0 NHID 0x0 [0xad013320 0x0] next hop VRF - 'default', table - 0xe0000000 remote adjacency
Load distribution: 0 (refcount 2) Hash OK Interface Address 0 Y GigabitEthernet0/0/0/0.1060 remote | 2.2.2.0/24, version 3956, attached, internal 0x4000081 0x0 (ptr 0xad9663f4) [1], 0x0 (0xad85a958), 0x0 (0x0)
Hash OK Interface Address |
Regarding the version, both have exactly the same one: 5.1.3 but there is a discrepancy in a SMU:
FIRST ROUTER | SECOND ROUTER |
show install active summary | show install active summary |
Active Packages: disk0:asr9k-services-infra-5.1.3
disk0:asr9k-optic-px-5.1.3 disk0:asr9k-doc-px-5.1.3 disk0:asr9k-bng-px-5.1.3 disk0:asr9k-fpd-px-5.1.3 disk0:asr9k-mpls-px-5.1.3 disk0:asr9k-video-px-5.1.3 disk0:asr9k-mcast-px-5.1.3 disk0:asr9k-mgbl-px-5.1.3 disk0:asr9k-services-px-5.1.3 disk0:asr9k-mini-px-5.1.3 disk0:asr9k-k9sec-px-5.1.3 disk0:asr9k-px-5.1.3.sp1-1.0.0 | Active Packages: disk0:asr9k-services-infra-5.1.3 disk0:iosxr-fwding-5.1.3.sp1-1.0.0 disk0:asr9k-fwding-5.1.3.sp1-1.0.0 disk0:asr9k-optic-px-5.1.3 disk0:asr9k-doc-px-5.1.3 disk0:asr9k-bng-px-5.1.3 disk0:asr9k-fpd-px-5.1.3 disk0:asr9k-mpls-px-5.1.3 disk0:asr9k-video-px-5.1.3 disk0:asr9k-mcast-px-5.1.3 disk0:asr9k-mgbl-px-5.1.3 disk0:asr9k-services-px-5.1.3 disk0:asr9k-mini-px-5.1.3 disk0:asr9k-k9sec-px-5.1.3
|
show version | show version |
Cisco IOS XR Software, Version 5.1.3[Default] Copyright (c) 2014 by Cisco Systems, Inc. ……. asr9k-9000v-nV-supp-5.1.3.sp1, V 1.0.0[SMU], Cisco Systems, at disk0:asr9k-9000v-nV-supp-5.1.3.sp1-1.0.0 Built on Tue Nov 18 06:31:42 TRI 2014 By iox-lnx-008 in /san1/EFR/sp_r51x_5_1_3/workspace for pie
iosxr-fwding-5.1.3.sp1, V 1.0.0[SMU], Cisco Systems, at disk0:iosxr-fwding-5.1.3.sp1-1.0.0 Built on Tue Nov 18 06:31:42 TRI 2014 By iox-lnx-008 in /san1/EFR/sp_r51x_5_1_3/workspace for pie
asr9k-fwding-5.1.3.sp1, V 1.0.0[SMU], Cisco Systems, at disk0:asr9k-fwding-5.1.3.sp1-1.0.0 Built on Tue Nov 18 06:31:42 TRI 2014 By iox-lnx-008 in /san1/EFR/sp_r51x_5_1_3/workspace for pie
asr9k-px-5.1.3.sp1, V 1.0.0[SMU], Cisco Systems, at disk0:asr9k-px-5.1.3.sp1-1.0.0 Built on Tue Nov 18 06:31:54 TRI 2014 By iox-lnx-008 in /san1/EFR/sp_r51x_5_1_3/workspace for pie ……. ## All the other packets are the same | Cisco IOS XR Software, Version 5.1.3[Default] Copyright (c) 2014 by Cisco Systems, Inc. …….
iosxr-fwding-5.1.3.sp1, V 1.0.0[SMU], Cisco Systems, at disk0:iosxr-fwding-5.1.3.sp1-1.0.0 Built on Tue Nov 18 06:31:42 TRI 2014 By iox-lnx-008 in /san1/EFR/sp_r51x_5_1_3/workspace for pie
asr9k-fwding-5.1.3.sp1, V 1.0.0[SMU], Cisco Systems, at disk0:asr9k-fwding-5.1.3.sp1-1.0.0 Built on Tue Nov 18 06:31:42 TRI 2014 By iox-lnx-008 in /san1/EFR/sp_r51x_5_1_3/workspace for pie
……. ## All the other packets are the same |
Regarding the questions related to the IGP next hop and the iBGP peer, the route imported is a Directly connected route (local for those routers), there isn't a next hop.
Thanks,
Marlon,
that SP inconsistency worries me a bit, can you have that fixed to make sure that they are truly both running the same packages?
The other problem I see is that the prefix is in the cef table (shown when you have the command plain without location keyword), but the LC doesn't see it, this could be a SVD issue.
Try to configure a dummy subinterface with some dummy ip address in that vrf on some interface on LC 0. (may be svd related, though should be disabled in 513).
What I meant by next hops is that you have an iBGP peering.
that is likely using Loopbacks. How is the routing for the loopbacks done as they are the bgp next hop, need to make sure that that is fine too, may be unrelated but good to check.
finally, ensure that the label allocation mode for both ends is the same.
regards
xander
I'm going to schedule the SP installation and i'll let you know.
Apparently is not a SVD issue cause the SVD state is "unsupported" and the role is "standard" so i believe is not enabled. I've configured a subinterface for the Imp-VRF vrf on the LC 0 but it seems good. (look for the outputs).
The iBGP next hops are known via isis and also looks good.
The label allocation mode is per prefix in both (default config).
FIRST ROUTER | SECOND ROUTER |
show svd state | show svd state |
Selective VRF Download (SVD) Feature State: SVD Configuration State Unsupported SVD Operational State Unsupported | Selective VRF Download (SVD) Feature State: SVD Configuration State Unsupported SVD Operational State Unsupported |
show cef vrf Imp-VRF 10.10.10.0/24 detail location 0/0/CPU0 | show cef vrf Imp-VRF 20.20.20.0/24 detail location 0/0/CPU0 |
10.10.10.0/24, version 3934, attached, connected, glean adjacency, internal 0xc0000c1 0x0 (ptr 0xa9946064) [1], 0x0 (0xa8b407c0), 0x0 (0x0) Updated Mar 5 12:39:11.474 Prefix Len 24, traffic index 0, precedence n/a, priority 0 gateway array (0xa8ad9b70) reference count 1, flags 0x0, source rib (6), 0 backups [2 type 3 flags 0x10101 (0xa8becbd8) ext 0x0 (0x0)] LW-LDI[type=3, refc=1, ptr=0xa8b407c0, sh-ldi=0xa8becbd8] via GigabitEthernet0/0/0/38.3, 2 dependencies, weight 0, class 0 [flags 0x8] path-idx 0 NHID 0x0 [0xa48c34d0 0x0] glean adjacency
Load distribution: 0 (refcount 2)
Hash OK Interface Address 0 Y GigabitEthernet0/0/0/38.3 glean | 20.20.20.0/24, version 4186, attached, connected, glean adjacency, internal 0xc0000c1 0x0 (ptr 0xa5247f64) [1], 0x0 (0xa75b8a08), 0x0 (0x0) Updated Mar 5 12:02:28.383 Prefix Len 24, traffic index 0, precedence n/a, priority 0 gateway array (0xab108708) reference count 1, flags 0x0, source rib (6), 0 backups [2 type 3 flags 0x10101 (0xaaee2358) ext 0x0 (0x0)] LW-LDI[type=3, refc=1, ptr=0xa75b8a08, sh-ldi=0xaaee2358] via GigabitEthernet0/0/0/21.1280, 2 dependencies, weight 0, class 0 [flags 0x8] path-idx 0 NHID 0x0 [0xa4bdc634 0x0] glean adjacency
Load distribution: 0 (refcount 2)
Hash OK Interface Address 0 Y GigabitEthernet0/0/0/21.1280 glean |
show route vrf Imp-VRF | i 10.10.10.0 | show route vrf Imp-VRF | i 20.20.20.0 |
C 10.10.10.0/24 is directly connected, 00:19:56, GigabitEthernet0/0/0/38.3 | C 20.20.20.0/24 is directly connected, 00:37:38, GigabitEthernet0/0/0/21.1280 |
show route vrf Imp-VRF | i 20.20.20.0 | show route vrf Imp-VRF | i 10.10.10.0 |
B 20.20.20.0/24 [200/0] via 172.18.251.1 (nexthop in vrf default), 00:38:01 | B 10.10.10.0/24 [200/0] via 172.18.251.2 (nexthop in vrf default), 00:19:44 |
show route 172.18.251.1 | show route 172.18.251.2 |
Routing entry for 172.18.251.1/32 Known via "isis PROVIDER", distance 115, metric 50, type level-2 Installed Feb 24 14:47:18.514 for 1w2d Routing Descriptor Blocks 192.168.224.214, from 172.18.251.1, via TenGigE0/3/0/2.10 Route metric is 50 192.168.224.201, from 172.18.251.1, via TenGigE0/6/0/3 Route metric is 50 No advertising protos. | Routing entry for 172.18.251.2/32 Known via "isis PROVIDER", distance 115, metric 50, type level-2 Installed Feb 24 01:42:37.825 for 1w2d Routing Descriptor Blocks 172.18.50.21, from 172.18.251.2, via TenGigE0/3/0/1 Route metric is 50 No advertising protos. |
ping vrf Imp-VRF 20.20.20.20 source 10.10.10.10 | ping vrf Imp-VRF 10.10.10.10 source 20.20.20.20 |
Sending 5, 100-byte ICMP Echos to 20.20.20.20, timeout is 2 seconds: !!!!! Success rate is 100 percent (5/5), round-trip min/avg/max = 1/1/3 ms | Sending 5, 100-byte ICMP Echos to 10.10.10.10, timeout is 2 seconds: !!!!! Success rate is 100 percent (5/5), round-trip min/avg/max = 1/1/3 ms |
show run router bgp 12345 vrf Imp-VRF | show run router bgp 12345 vrf Imp-VRF |
router bgp 12345 vrf Imp-VRF rd 12345:251002669 address-family ipv4 unicast redistribute connected | router bgp 12345 vrf Imp-VRF rd 12345:251001669 address-family ipv4 unicast redistribute connected |
Thanks and regards,
Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: