Greets - I've reviewed a number of DMVPN-VRF aware configs and most of them deal with passing the entire vrf path across the tunnel, which is fine, but for the time being, I only need to implement vrf-lite on my spoke routers due to a security requirement for a guest WAP (onboard HWIC AP).
To date, the DMVPN has been functioning fine as a standalone spoke (among many), with Vlans where necessary, and in the lab the VRF side is functioning correctly.
I've been attempting to merge the VRF and the DMVPN spoke-only configs but the tunnel creation gets stuck in routing.
The attached config shows the DMVPN at the global routing level and still works fine - I want to apply the tunnel to vrf BLUE (only).
Thus with the attached config if I do a global ping 172.20.0.1, I have success. Of course if I ping vrf BLUE 172.20.0.1, I get nothing, but that's expected since there is no defined route for it.
I'm pretty sure something is happening at the NAT level where the Vlan NAT is happening before the final routing, thus should I be looking to add a BVI after the Vlan (taking the NAT out of the Vlan and putting it into the BVI, and then only VRF-ing the BVI? This would force the priority of Vlan -> Route -> Nat@BVI -> Exit (right?) but in doing that won't I lose the VRF delineation at the BVI? (thus negating the security needed for this experiment in the first place?)
I would have expected that something like:
Tunnel0
vrf forwarding BLUE
...
no ip route 172.20.0.0 255.255.0.0 10.0.0.254 !(to clear the global route)
ip route vrf BLUE 172.20.0.0 255.255.0.0 Gi0/0 10.0.0.254
would have spun things up, but it got me nowhere.
Do I really need the tunnel to forward the vrf, or in this instance is that command used just to indicate the protection to the vrf? (It does correctly show protected in the dmvpn if I do this, which is expected).
I'm sure I'm off by only a couple config lines, if anyone could shed some light on it, I'd certainly appreciate it. I've been enjoying my new foray into vrf; it's just a little difficult to wrap one's head around "when" certain things happen versus at just the global level.
Final note is there is NO vrf running at the hub level. I'm hoping that isn't a requirement. It may be an expansion in the future, but not at all necessary right now.
Thanks & Regards,
Ted.
