I’m trying to rebuild a router that currently uses PBR with a TON of firewall filter and mangle rules to use VRF instead.
The situation I’m working with, is an open access network. The network operator gets it’s Internet access from the participating providers. Each provider needs to be in it’s own VRF, leaving the default VRF for the network operator.
Here’s my initial configuration, which is working very well for the providers and their customers:
Not sure what you’re asking about the ‘core.’ It’s just a router (CCR1036, soon to be replaced with a CCR2004) that serves as a L3 gateway for both fiber and wireless subscribers.
Currently, we’re not using VRF at all, just basic policy based routing, which works, but requires a bit of work in the firewall to keep things relatively secure.
With the VRF configuration I posted, the routing is straight, the subscribers and providers are 100% isolated from each other. The problem is getting internet access to/for the management network, which exists in the default (main) routing table.
Using various routing and/or mangle rules to hop VRFs, I can get some basic connectivity (ping), but can not do so much as a DNS lookup, much less establish a TCP connection to/from anything.
That’s where I started. Of course ROS7 is a bit different, but here’s where I’m at:
[admin@Core] > /ip route pr where active=yes
Flags: D - DYNAMIC; A - ACTIVE; c, s, y - BGP-MPLS-VPN
Columns: DST-ADDRESS, GATEWAY, DISTANCE
# DST-ADDRESS GATEWAY DISTANCE
DAc 192.168.99.0/24 ether1.99 0
DAc 100.99.200.0/22 ether1.200@VRF.200 0
0 As 0.0.0.0/0 172.23.251.1@VRF.100 1
DAc 100.99.100.0/22 ether1.100@VRF.100 0
DAc 172.23.251.0/30 ether8@VRF.100 0
[admin@Core] > /int dis ether1.200
[admin@Core] > /ip route pr where active=yes
Flags: D - DYNAMIC; A - ACTIVE; c, s, y - BGP-MPLS-VPN
Columns: DST-ADDRESS, GATEWAY, DISTANCE
# DST-ADDRESS GATEWAY DISTANCE
DAc 192.168.99.0/24 ether1.99 0
0 As 0.0.0.0/0 172.23.251.1@VRF.100 1
DAc 100.99.100.0/22 ether1.100@VRF.100 0
DAc 172.23.251.0/30 ether8@VRF.100 0
[admin@Core] >
[admin@Core] > ping 8.8.8.8
SEQ HOST SIZE TTL TIME STATUS
0 no route to host
1 no route to host
sent=2 received=0 packet-loss=100%
[admin@Core] > ping 8.8.8.8 vrf=VRF.100
SEQ HOST SIZE TTL TIME STATUS
0 8.8.8.8 56 118 11ms750us
0 8.8.8.8 56 118 11ms770us
1 8.8.8.8 56 118 12ms483us
1 8.8.8.8 56 118 12ms683us
sent=2 received=4 packet-loss=-100% min-rtt=11ms750us avg-rtt=12ms171us max-rtt=12ms683us
[admin@Core] > /ip route add routing-table=main gateway=172.23.251.1@VRF.100
[admin@Core] > ping 8.8.8.8
SEQ HOST SIZE TTL TIME STATUS
0 8.8.8.8 56 118 8ms445us
1 8.8.8.8 56 118 15ms896us
sent=2 received=2 packet-loss=0% min-rtt=8ms445us avg-rtt=12ms170us max-rtt=15ms896us
[admin@Core] > ping google.com
invalid value for argument address:
invalid value of mac-address, mac address required
invalid value for argument ipv6-address
while resolving ip-address: could not get answer from dns server
[admin@Core] >
As you can see, after adding a default route for main to jump to VRF.100, I can ping the name server, but cannot actually resolve DNS. Also cannot establish any TCP connections.
Also, there’s a NAT rule in place, but this fails:
[admin@Core] > /ip fire nat pr
Flags: X - disabled, I - invalid; D - dynamic
0 chain=srcnat action=masquerade src-address-list=Management out-interface-list=Outside
[admin@Core] > ping 8.8.8.8 src-address=192.168.99.1
SEQ HOST SIZE TTL TIME STATUS
0 8.8.8.8 timeout
1 8.8.8.8 timeout
2 8.8.8.8 timeout
sent=3 received=0 packet-loss=100%
If, however, I loop back to another physical interface, the main routing table/VRF behaves 100%.
i’m not even sure what that paremeter is for exactly… the table is set by routing-table parameter, and which VRF the gateway can be found in is set by @vrfname in gateway parameter.
even after googling, this is all i’ve found about it:
vrf-interface () Internal use only parameter which allows identifying to which VRF route should be added. Used by services that add routes dynamically, for example, DHCP client. Shown for debugging purposes.
