OSPF Route Leaking Between VRF's

RouterOS
1

i am getting owned trying to do dynamic route leaking between vrf’s using ospf. this is routeros 7.18.
for a basic topology:
i have created bridge1 interface in vrf1, ip address 192.168.1.1/24
i have created bridge2 interface in vrf2, ip address 192.168.2.1/24
i have attached a sub-interface to bridge1, also added to vrf1, ip address 10.0.0.1/29
i have attached a sub-interface to bridge2, in vrf2, ip address 10.0.0.2/29

now the ospf part is not that technical. the issue is, i am trying to form a neighborship on the 10.0.0.0/29 network, and failing. cause somehow, the two vlan interfaces on 10.0.0.0/29 can’t talk to each other on the ospf broadcast address.

how do i achieve this last leg? adding each sub-interface to a bridge results in nothing helpful at all. somehow, i need l2 connectivity between the two sub-interfaces.

is this doable in routeros?

2

Make a network diagram and show whatever configuration you currently have so that others can jump start to check your config and might be able help you in the process, specially VRF has few quirks and limitation in Mikrotik land haha

EDIT: additional tip please define your clear goals it is somehow messed up honestly

3

You might want to try a “hairpin” physical cable first between port in different VRFs to see if the OSPF portion will work. Not sure if routeros will form an adjacency with itself. ROSv6 had issues with this, but i’ve not tried it in ROSv7.

4

yes it does

yes it will. thanks for dropping by :+1:

2 Likes
5

I thought the requirement is hazy when I see Kevin reply and re-read it was me who doesn’t understand the question and I try to lab it yeah it works it form an adjacency to it’s own now my question is what is the circumstance that you are doing this in real world setting? I really enjoy it looking forward to hear from both of you :slight_smile:

image
image643×251 7.45 KB

image
image900×484 13.4 KB

image
image443×413 10.9 KB

6

I think I got one scenario if you are an SP and want to provide multitenancy for customers :slight_smile: hahaha or you want to create an isolated lab the possibility is endless.

7

fell free to laugh, but basically, bgp-vpn is still above my head as i’m learning networking, and a physical cable to do ospf isn’t. so there you go :slight_smile:

and basically, it’s as the title suggets, i was trying to get an easier way to do route leaking between vrfs. a hairpin cable on the appliance might be amusing, but it gets the job done until i learn to do better.

8

Don’t get me wrong, I really enjoy this thread because it’s broaden my horizon I laugh not because of you it’s me who didn’t think outside of the box, I’m sorry if you feel offended i didn’t mean to, peace out!

9

no worries! maybe you could even help me with the correct syntax for only advertising only certain routes into vrf1 :grin: cause right now, ospf is advertising everything and not obeying my filter rule of
if (dst == 10.1.60.0/23) { accept;} else{reject;} for some reason. i’m trying to do Out-Filter with it.

10

VRF route leaking is freaking awesome if you grasp the concept, it was really confusing at first but this is very powerful if you want to slice and dice the hardware

11

it’s a must if you want to slice and dice hardware.

12

is this exact match or you might need dst in ? what you are trying to achieved?

if I were you i’ll go this way

if (dst == 10.1.60.0/23) { reject; } accept;

so if doesn’t match your criteria no harm done it will announce the prefix, it was easier to debug this way

13

i am trying to only advertise exactly that route into vrf1, from the main ospf area.

14

i need that flipped though. i only want that one network advertised.

15

try this first

if (dst in 10.1.60.0/23) { accept; } reject;

16

absolutely nothing happens with i apply it to an instance as a filter-out rule, nor if i apply it to an instance as a filter-in rule.

i wonder if it’s because i’m using ospf to have the router peer with itself and something is going wonky.

or maybe it has something to do with going interarea?

17

I will reproduce your issue and update you once i have something

18

ok i also applied the rule to a second router in a totally different area, as a filter-in rule, and it had no effect.

19

Did you read this?

20

yes. the vrf part is working. i have traffic flow everywhere.

it’s the route filtering i am having a problem with. and even watching the official mikrotik youtube on ospf, and following the route filtering section, i’m not having any luck.