Can't browse through VRF

RouterOS General
1

Hi.

I’ve got a curios issue. When interfaces and corresponding routes are placed in a VRF, users can’t browse at all. They can ping, traceroute, resolve names etc, but browsing does not work at all. The moment I move all the interfaces and routes back to the main routing table, everything works fine. I’m at a loss as I’ve configured VRF’s a thousand times before and never ran into this issue.

RB2011 running 6.46.1

Relevant config:

/ip route
add distance=1 gateway=100.64.18.106 routing-mark=CLIENT-CORP
/ip route vrf
add interfaces=vlan10-corp-internet-outside,vlan100-corp-lan route-distinguisher=2:2 routing-mark=CLIENT-CORP
/ip firewall nat
add action=src-nat chain=srcnat out-interface=vlan10-corp-internet-outside src-address=10.98.100.0/24 to-addresses=public.ip.comes.here

Any guidance would be greatly appreciated.

2

Hey. Try to add “ip rotue rule” for you vrf to lookup global dst address you want in main table.

3

Thanks I’ll try it.

The thing is I don’t really need the main table. I only use it for management/monitoring so there’s only routing in the main table for monitoring systems.

Internet traffic should be going via the CLIENT-CORP VRF via VLAN10

4

But there is has to be a lookup in a main table or vrf import of global routes in that vrf (route leak) otherwise you can’t go to Internet via this vrf.

5

There is a default route in the vrf.

/ip route
add distance=1 gateway=100.64.18.106 routing-mark=CLIENT-CORP

The users can traceroute to the internet, and sometimes web pages load, but very slowly (takes 3 minutes to load Google). The moment I take interfaces and routes out of VRF, it works fine.

6

Seems like it’s a forwarding bug. Do you have stable ROS packages or long-term? What is cpu utilization of a router?

7

CPU sitting at 3%.
I tried on 6.44.5 as well as 6.46.1 software and firmware versions.
That said I’ve never done this on an RB2011, only on CCR and 3011 routers. I don’t know if the architecture is causing issues at all.

8

Better wait for devs respons I think.

9

Will do, thanks for your time.

10

Anyone?

11

What is your channel bandwidth from ISP?

12

I am the ISP. This is a 100mbps link.

13

The behavior you described sounds a lot like an MTU problem. Have you tried pinging from a user computer with the DF bit set to see if you can get 1500 bytes through?

14

Hi! Thanks for the response.

Everything works fine when I move interfaces and routes into main. Does VRF add size to the packet?

I can get 1472 with DF bit set, but not 1500.

15

I’ve spun up another router, duplicated the configuration and it works fine. Is this possibly an issue with the router itself? I’ve again updated code to latest stable.