server vrf -- mpls/bgp -- ASR -- internet -- vpn peer -- internet
I have a ASR with a lot of policy tunnels. Sometimes there is a need to route all traffic from our datacenter through a IPsec VPN tunnel. For example it might be a network segment that has no internet access of firewall and servers on that segment need internet access.
With a VXR I would create normal policy tunnel and define VPN tunnel destination proxyID ANY.
ip access-list extended vpn-acl
permit ip 192.168.0.0 0.0.0.255 any
That would ofc be mirrored by the remote VPN device. For some reason crypto map reverse-route static doesn't add default route to vrf routing table so I would add a static route.
ip route vrf vpn-vrf 0.0.0.0 0.0.0.0 ethernet0/0(internet interface) x.x.x.x (vpn peer IP)
On a VXR this would allow 192.168.0.0/24 subnet to access any IP address via the VPN tunnel. It would also allow VXR to use BGP to advertise default route to server segment.
On the ASR non of this works and I can't figure out why. Adding the static route will add it to vpn vrf routing table but it will not advertise to server segment. BGP is configured to advertise statics and default.
address-family ipv4 vrf vpn-vrf
redistribute connected
redistribute static
default-information originate
exit-address-family
Any ideas? Or shall I open a TAC for this?
P.S. Tunnel interface is not possible due to some limitations in the architecture. I'll have to figure out why I can't use those.
