NEXUS VRF LEAKING

[Sebastian Adolfo Yanez]

Hi!

I need help configuring VRF leaking on Cisco Nexus.

I have a pair of Cisco Nexus C9372PX. There are a lot of VLANs, almost 500 VLANs, and SVIs. Yes, the Nexus are doing routing tasks. Each of these VLANs is a customer, so I need to isolated in some manner.

I am trying with VRF. But I have three questions:

1. I need to configure it without using ACLs. Is it possible? Prefix IP? How?

2. I need all the VRFs to be able to know the default gateway from VRF default. There is only one router that gives connection to Internet an it is on the default VRF.

3. Of course VRFs are isolated from each other. But in some cases I need VRFs to be able to reach another management VRF. I need this to work based on destination port. Is it possible?

Thanks!

Sebastian Yañez

[paul driver]

Hello

---

@Sebastian Adolfo Yanez wrote:

Hi!

1. I need to configure it without using ACLs. Is it possible? Prefix IP? How?

Example:
vrf vlan 12  & vlan 34
vlan 25 wan vlan

ip route 0.0.0.0/0 Vlan25 10.1.25.5  <----global default route
ip route 10.1.12.0/24 Vlan12  <----return path for global rib for vlan 12
ip route 10.1.34.0/24 Vlan34 <----return path for global rib for vlan 34

feature interface-vlan

vrf context 12

vrf context 34

interface Vlan12
no shutdown
vrf member 12 < once you apply the vrf context  if ip address is applied it will be removed.
ip address 10.1.12.254/24

interface Vlan34
no shutdown
vrf member 34 < once you apply the vrf context  if ip address is applied it will be removed.
ip address 10.1.34.254/24

interface Vlan25
description WAN Gateway
no shutdown
ip address 10.1.25.254/24

2. I need all the VRFs to be able to know the default gateway from VRF default. There is only one router that gives connection to Internet an it is on the default VRF.

3. Of course VRFs are isolated from each other. But in some cases I need VRFs to be able to reach another management VRF. I need this to work based on destination port. Is it possible?

vrf context 12
ip route 0.0.0.0/0 vlan 25 10.1.25.5  < global default route
ip route 10.1.34.34/32 Vlan34 vrf 34  < host route to a vlan 34 host

vrf context 34
ip route 0.0.0.0/0 vlan 25 10.1.25.5 < global default route
ip route 10.1.12.12/32 Vlan12 vrf 12 < host route to a vlan 12 host

[Sebastian Adolfo Yanez]

Hi!

Thanks for your answer.

Communication between VRFs is ok.

But none of the VRFs can reach default gateway. In my case interface connected to Internet is a non switchport (routed port).

switch#
switch# sh runn

!Command: show running-config
!Time: Tue Dec 18 16:50:58 2018

version 7.0(3)I7(5) Bios:version
vdc switch id 1
limit-resource vlan minimum 16 maximum 4094
limit-resource vrf minimum 2 maximum 4096
limit-resource port-channel minimum 0 maximum 511
limit-resource u4route-mem minimum 248 maximum 248
limit-resource u6route-mem minimum 96 maximum 96
limit-resource m4route-mem minimum 58 maximum 58
limit-resource m6route-mem minimum 8 maximum 8
feature bgp
feature pbr
feature interface-vlan

no password strength-check
username admin password 5 $5$scPQXMFx$BeAQL1S11aRfytP555PgIjjVeuQcEVfGS67CVwnzLM
D role network-admin
ip domain-lookup
copp profile strict
snmp-server user admin network-admin auth md5 0x31ba15afab144bd69700692fec24371a
priv 0x31ba15afab144bd69700692fec24371a localizedkey
rmon event 1 description FATAL(1) owner PMON@FATAL
rmon event 2 description CRITICAL(2) owner PMON@CRITICAL
rmon event 3 description ERROR(3) owner PMON@ERROR
rmon event 4 description WARNING(4) owner PMON@WARNING
rmon event 5 description INFORMATION(5) owner PMON@INFO

ip route 0.0.0.0/0 Ethernet1/3 192.168.2.3
ip route 192.168.10.0/24 Vlan10
ip route 192.168.11.0/24 Vlan11
vlan 1-2,10-11
vlan 2
name casa
vlan 10
name TUCAI
vlan 11
name AGM

vrf context AGM
ip route 0.0.0.0/0 Ethernet1/3 192.168.2.3
ip route 192.168.10.2/32 Vlan10 vrf TUCAI
vrf context TUCAI
ip route 0.0.0.0/0 Ethernet1/3 192.168.2.3
ip route 192.168.11.2/32 Vlan11 vrf AGM
vrf context management

interface Vlan1
no shutdown

interface Vlan2
no shutdown

interface Vlan10
no shutdown
vrf member TUCAI
ip address 192.168.10.1/24

interface Vlan11
no shutdown
vrf member AGM
ip address 192.168.11.1/24

interface Ethernet1/1
switchport access vlan 10
spanning-tree port type edge

interface Ethernet1/2
switchport access vlan 11
spanning-tree port type edge

interface Ethernet1/3
no switchport
ip address 192.168.2.80/24
no shutdown

interface Ethernet1/4

interface Ethernet1/5

interface Ethernet1/6

interface Ethernet1/7

interface Ethernet1/8

interface Ethernet1/9

interface Ethernet1/10

interface Ethernet1/11

interface Ethernet1/12

interface Ethernet1/13

interface Ethernet1/14

Any advise?

Thanks!!!

Sebastian