I am currently struggeling to steer my traffic and looking for some advise.
My current setup is an internet facing CCR2004 which is also the endpoint of several VPN tunnels and does DNAT as well.
After that I have placed a firewall for IDS, Layer7 inspection and such things.
Then there is a CCR2116 which does my interVLAN routing.
All three devices are connected via OSPF within the 0.0.0.0 area.
My intention is to have all VPN traffic bypass the firewall and go to CCR2116 directly. To do that I have a dedicated connection between CCR2004 and 2116 but as soon as this is up and running any traffic will go over this new connection including WAN traffic which should be directed via the firewall.
Currently I have set the interface costs to a higher value for traffic steering but this also includes that VPN traffic goes via firewall.
So far I have also tried to setup VRFs but as soon as I do that my CCR2004 is no longer reachable via CCR2116.
I can see that they exchange routes via OSPF but are losing connection - this process repeats until forever.
On CCR2004 I can see that it would know each network twice - 1x via main table & 1x via vrf.
Unfortunately I do not know how to continue my journey to steer the traffic.
By my thought would be to use some routing rules at both ends.
(Though your environment looks complicated)
Assuming vlan502, 10.0.3.0/30 is your direct path.
For wg_roadwarrior
On the 2004 Something like:
/routing rule
add action=lookup comment=“min-prefix=0, all except 0.0.0.0/0” disabled=no min-prefix=0 src-address=10.0.81.0/24 table=direct2116
** Not sure how this (min-prefix=0) behaves with routes that can change… **
** You might need a few rules that cover all local networks
