We are currently in the process of updating some routers in our infrastructure from V6 to V7 as needed for a hardware upgrade.
One of the differences i am encountering is that Client interfaces in a VRF are not getting Srcnat rules applied to them based on the routing mark for the vrfs.
Its almost as though the routing mark is dropped or doesn’t get applied to packets prior to the Srcnat occuring when entering on a VRF listed interface.
Previously on v6 we had the VRF that contained the VLAN/VRRP interfaces for each client subnet.
For each routing mark for these VRFs we have a srcnat rule that would assign them their public IP address on the outbound.
Mangle rule and jump rule would mark traffic for their routing mark on the inbound connections to this public IP.(no mangle rules applied for the “LAN” traffic to get routing marks as this was previously auto applied by being in the vrf)
Currently as an example.
I have VRF for Client A that contains VLAN 472 and VRRP interface.
name="[Customer - Client A]" interfaces=VLAN-472 - Customer - Client A,VRRP-vlan472,VPN-ClientA
I have the srcnat rule
add action=src-nat chain=srcnat comment="[Customer - Client A]" dst-address-list="!Local IPs" routing-mark="[Customer - Client A]" src-address=172.17.204.0/24 to-addresses=203.x.x.x
I have default route in place on the routing table for the VRF that i know is being used as i can direct the icmp packets around by triggering the failover rules to this table. This to me would indicate the packets are on using this correct routing mark just not at srcnat?
add check-gateway=ping distance=1 gateway=103.x.x.x@main routing-mark="[Customer - Client A]"
add comment="Failover Default Route" distance=2 gateway=60.x.x.x@main routing-mark="[Customer - Client A]"
Packet captures are clearing showing the srcnat is not occuring and the ip is being routed without it occuring (i.e the 172.17.204.x are being forwarded)
I have found that if i remove the routing mark from the srcnat rule it applies to the traffic, which wasn’t the case previously as we had a hundred odd srcnat rules based off routing marks for each client.
Am i missing something or do i need to go through and create mangle prerouting rules for the inbound interfaces and src ips to attach the routing mark with V7? Im getting the odd feeling like routing table and routing marks are now more (unsure how to phrase) separate routing entities? Just because your on that table doesn’t mean you get that routing mark?
Im fully self taught on this, so i’m open to all feedback and suggestions.