VRF route leaking on Nexus 9k

[Kenneth Goh]

I am running GNS3, as shown in the diagram, how do I allow R1 in vrf RED to be able to ping to R2 int vrf BLUE? 

Why are the no option to create route-target?

NXOS1(config)# vrf context RED
NXOS1(config-vrf)# address-family ipv4 unicast
NXOS1(config-vrf-af-ipv4)# ?
maximum Set a limit
no Negate a command or set its defaults
show Show running system information
end Go to exec mode
exit Exit from command interpreter
pop Pop mode from stack or restore from name
push Push current mode to stack or save it under name
where Shows the cli context you are in

NXOS1# show version
Cisco Nexus Operating System (NX-OS) Software
TAC support: http://www.cisco.com/tac
Documents: http://www.cisco.com/en/US/products/ps9372/tsd_products_support_serie
s_home.html
Copyright (c) 2002-2019, Cisco Systems, Inc. All rights reserved.
The copyrights to certain works contained herein are owned by
other third parties and are used and distributed under license.
Some parts of this software are covered under the GNU Public
License. A copy of the license is available at
http://www.gnu.org/licenses/gpl.html.

Nexus 9000v is a demo version of the Nexus Operating System

Software
BIOS: version
NXOS: version 9.3(1)
BIOS compile time:
NXOS image file is: bootflash:///nxos.9.3.1.bin
NXOS compile time: 7/18/2019 15:00:00 [07/19/2019 00:04:48]

Hardware
cisco Nexus9000 9000v Chassis
with 8060900 kB of memory.
Processor Board ID 9MIYLODKSQJ

Device name: NXOS1
bootflash: 3509454 kB
Kernel uptime is 0 day(s), 0 hour(s), 19 minute(s), 0 second(s)

Last reset
Reason: Unknown
System version:
Service:

plugin
Core Plugin, Ethernet Plugin

Active Package(s):

NXOS1#

[MHM Cisco World]

Friend no need anything in NSK about VRF.

VRF is local known in R.

So router with VRF Red need staitc route using 

Ip vrf Red (link between NSK and Router Blue VRF) next-hop NSK IP

And for router vrf Blue 

Ip route vrf Blue (linke between NSK and Routrr vrf Red) next-hop NSK

Then try ping from router to router using 

Pinf vrf (Red or Blue)

That it.

MHM

[M02@rt37]

Hello @Kenneth Goh 

Try to configure first rd under your vrf context and after that see if RT command is available.

[balaji.bandi]

follow below guide and video to start with :

https://www.cisco.com/c/en/us/support/docs/ios-nx-os-software/nx-os-software/213908-configure-vrf-route-leak-on-nexus.html

https://www.youtube.com/watch?v=rLBIG7pCTn4

[Harold Ritter]

Hi @Kenneth Goh ,

You need to enable "feature bgp" to be able to configure the route target.

NXOS1(config)# feature bgp
NXOS1(config)# vrf context Red
NXOS1(config-vrf)# address-family ipv4 uni
NXOS1(config-vrf-af-ipv4)# ?
export VRF export
import VRF import
maximum Set a limit
no Negate a command or set its defaults
route-target Specify Target VPN Extended Communities
show Show running system information
end Go to exec mode
exit Exit from command interpreter
pop Pop mode from stack or restore from name
push Push current mode to stack or save it under name
where Shows the cli context you are in

Regards,

[Kenneth Goh]

Managed to create vrf below, can route leaking be done via only static routes?

vrf context BLUE
address-family ipv4 unicast
route-target import 1:1
route-target export 2:2
vrf context RED
address-family ipv4 unicast
route-target import 2:2
route-target export 1:1

interface Ethernet1/1
no switchport
vrf member RED
ip address 10.10.1.1/24
no shutdown

interface Ethernet1/2
no switchport
vrf member BLUE
ip address 10.10.2.1/24
no shutdown

interface Ethernet1/1

no switchport

vrf member RED

ip address 10.10.1.1/24

no shutdown

interface Ethernet1/2

no switchport

vrf member BLUE

ip address 10.10.2.1/24

no shutdown

[Harold Ritter · Accepted solution]

Hi @Kenneth Goh ,

Yes, you could do something like this.

vrf context Red
ip route 10.10.2.101/32 Ethernet1/2 10.10.2.101 vrf Blue

vrf context Blue
ip route 10.10.1.101/32 Ethernet1/1 10.10.1.101 vrf Red

Regards,

[Kenneth Goh]

Hi @Harold Ritter 

There is no option to enter 'vrf'

NXOS1(config)# ip route 10.10.2.101/32 ethernet 1/2 ?
. Sub interface separator
/ Slash separator
A.B.C.D IP next-hop address in format i.i.i.i

NXOS1# show run

!Command: show running-config
!Running configuration last done at: Tue Dec 26 03:03:58 2023
!Time: Tue Dec 26 03:09:56 2023

version 10.1(1) Bios:version
hostname NXOS1
vdc NXOS1 id 1
limit-resource vlan minimum 16 maximum 4094
limit-resource vrf minimum 2 maximum 4096
limit-resource port-channel minimum 0 maximum 511
limit-resource u4route-mem minimum 248 maximum 248
limit-resource u6route-mem minimum 96 maximum 96
limit-resource m4route-mem minimum 58 maximum 58
limit-resource m6route-mem minimum 8 maximum 8

feature bgp

no password strength-check
username admin password 5 ! role network-admin
ip domain-lookup
copp profile strict
rmon event 1 log trap public description FATAL(1) owner PMON@FATAL
rmon event 2 log trap public description CRITICAL(2) owner PMON@CRITICAL
rmon event 3 log trap public description ERROR(3) owner PMON@ERROR
rmon event 4 log trap public description WARNING(4) owner PMON@WARNING
rmon event 5 log trap public description INFORMATION(5) owner PMON@INFO

vlan 1

vrf context BLUE
address-family ipv4 unicast
route-target import 1:1
route-target export 2:2
vrf context RED
address-family ipv4 unicast
route-target import 2:2
route-target export 1:1
vrf context management

interface Ethernet1/1
no switchport
vrf member RED
ip address 10.10.1.1/24
no shutdown

interface Ethernet1/2
no switchport
vrf member BLUE
ip address 10.10.2.1/24
no shutdown

[Harold Ritter]

Hi @Kenneth Goh ,

Two things I noted.

> NXOS1(config)# ip route 10.10.2.101/32 ethernet 1/2 ?

You need to enter the next hop first as follow and then you will see the vrf option:

R1(config)# ip route 10.10.2.101/32 ethernet 1/2 10.10.2.101 ?
<CR>
<1-255> Route preference
*Default value is 1
name Specify name of the next hop
tag Supply tag value with static route
track Specify the Object to be Tracked
vrf VRF for next-hop if different from this vrf

The second thing is that the static route needs to be entered under the "vrf context" (Red or Blue), not under the global context.

Regards,

[Kenneth Goh]

Apologies, I managed to add the static routes under vrf context. Thanks for your help!

[Harold Ritter]

You are very welcome @Kenneth Goh and thanks for the feedback

[MHM Cisco World]

If you enable vrf (need feature bgp sure in nexus) then you separate the RIB to two VRF'

You config vrf Red interface toward Router Red vrf 

Config vef Blue interface toward Router Blue vrf 

But here your ping will fialed 

You need here since you separate the RIB vrf leaking 

So you want to make 

Vrf red 

route-target export 1:1

Route-target import 1:2

Vrf Blue

Route-target import 1:1

Route-target export 1:2

Then config bgp

Address family ipv4 Red

Redistrubte direct 

Address family ipv4 Blue

Redistrubte Blue

Then your ping success 

MHM