VRF-lite, NAT and route-leaking

Hello, community. I'm trying to reproduce setup with two customers (R1 and R2), PE router (R3) and common services (R4).
Here is configuration:
R1:
interface Loopback0
ip address 10.10.1.1 255.255.255.255
interface FastEthernet1/0
ip address 192.168.15.1 255.255.255.0
ip route 0.0.0.0 0.0.0.0 192.168.15.5
R2:
interface Loopback0
ip address 10.10.2.2 255.255.255.255
interface FastEthernet1/0
ip address 192.168.16.1 255.255.255.192
ip route 0.0.0.0 0.0.0.0 192.168.16.5
R3:
ip vrf VRF1
rd 1:1
route-target export 1:1
route-target import 1:1
ip vrf VRF2
rd 2:2
route-target export 2:2
route-target import 2:2
interface FastEthernet0/0
description R1
ip vrf forwarding VRF1
ip address 192.168.15.5 255.255.255.192
ip nat inside
ip virtual-reassembly
interface FastEthernet0/1
description R2
ip vrf forwarding VRF2
ip address 192.168.16.5 255.255.255.192
ip nat inside
ip virtual-reassembly
interface FastEthernet1/0
description R4
ip address 1.1.1.1 255.255.255.0
ip nat outside
ip virtual-reassembly
ip route 0.0.0.0 0.0.0.0 1.1.1.2
ip route vrf VRF1 0.0.0.0 0.0.0.0 FastEthernet1/0 1.1.1.2 global
ip route vrf VRF1 10.10.0.0 255.255.0.0 192.168.15.1
ip route vrf VRF2 0.0.0.0 0.0.0.0 FastEthernet1/0 1.1.1.2 global
ip route vrf VRF2 10.10.0.0 255.255.0.0 192.168.16.1
ip nat inside source list 15 interface FastEthernet1/0 vrf VRF1 overload
ip nat inside source list 16 interface FastEthernet1/0 vrf VRF2 overload
access-list 15 permit 192.0.0.0 0.255.255.255
access-list 15 permit 10.10.0.0 0.0.255.255
access-list 16 permit 192.0.0.0 0.255.255.255
access-list 16 permit 10.10.0.0 0.0.255.255
R4:
interface Loopback0
ip address 10.10.10.10 255.255.255.255
interface FastEthernet0/0
ip address 1.1.1.2 255.255.255.0
ip route 0.0.0.0 0.0.0.0 1.1.1.1
The configuration is not operational.
r1#ping 192.168.15.5
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 192.168.15.5, timeout is 2 seconds:
Success rate is 100 percent (5/5), round-trip min/avg/max = 68/89/116 ms
r1#ping 192.168.15.5 source l0
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 192.168.15.5, timeout is 2 seconds:
Packet sent with a source address of 10.10.1.1
Success rate is 100 percent (5/5), round-trip min/avg/max = 68/86/92 ms
r1#ping 1.1.1.1 source l0
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 1.1.1.1, timeout is 2 seconds:
Packet sent with a source address of 10.10.1.1
Success rate is 80 percent (4/5), round-trip min/avg/max = 292/357/400 ms
r1#ping 1.1.1.2 source l0
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 1.1.1.2, timeout is 2 seconds:
Packet sent with a source address of 10.10.1.1
Success rate is 80 percent (4/5), round-trip min/avg/max = 160/187/216 ms
r1#ping 10.10.10.10 source l0
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.10.10.10, timeout is 2 seconds:
Packet sent with a source address of 10.10.1.1
Success rate is 0 percent (0/5)
I can't ping R4's loopback address ("shared resource" or also known as "common service")
The same is with R2 ( second customer).
But I can still ping R4's loopback from R3:
R3#ping 10.10.10.10
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.10.10.10, timeout is 2 seconds:
Success rate is 100 percent (5/5), round-trip min/avg/max = 40/88/116 ms
This is routing table on R3:
R3#sh ip route | begin Gateway
Gateway of last resort is 1.1.1.2 to network 0.0.0.0
     1.0.0.0/24 is subnetted, 1 subnets
C       1.1.1.0 is directly connected, FastEthernet1/0
S*   0.0.0.0/0 [1/0] via 1.1.1.2
R3#sh ip route vrf VRF1 | begin Gateway
Gateway of last resort is 1.1.1.2 to network 0.0.0.0
     192.168.15.0/26 is subnetted, 1 subnets
C       192.168.15.0 is directly connected, FastEthernet0/0
     10.0.0.0/16 is subnetted, 1 subnets
S       10.10.0.0 [1/0] via 192.168.15.1
S*   0.0.0.0/0 [1/0] via 1.1.1.2, FastEthernet1/0
R3#sh ip route vrf VRF2 | begin Gateway
Gateway of last resort is 1.1.1.2 to network 0.0.0.0
     10.0.0.0/16 is subnetted, 1 subnets
S       10.10.0.0 [1/0] via 192.168.16.1
     192.168.16.0/26 is subnetted, 1 subnets
C       192.168.16.0 is directly connected, FastEthernet0/1
S*   0.0.0.0/0 [1/0] via 1.1.1.2, FastEthernet1/0
So the question is what is the problem cause? How to troubleshoot? What is the troubleshooting steps?

Hi Eugene Khabarov
The problem here is that at the PE we have the static route for the Major Subnet 10.10.0.0/16 pointing back to the CEs of which the destination ping IP 10.10.10.10 is part of.
We need to remove the Major X /16 route from PE and configure explicit X /32 route for the CE Loopback to make this work
no ip route vrf VRF1 10.10.0.0 255.255.0.0 192.168.15.1
ip route vrf VRF1 10.10.1.1 255.255.0.0 192.168.15.1
no ip route vrf VRF2 10.10.0.0 255.255.0.0 192.168.16.1
ip route vrf VRF2 10.10.2.2 255.255.0.0 192.168.16.1
Hope this helps to answer your query.
Regards
Varma

Similar Messages

  • CSM VRF Lite OSPF and IPSEC/GRE

    We have a pretty complex vpn configuration. Its a site-to-site VRF-Lite GRE/IPSEC VPN that would be considered a point-to-point, each router is connected to two peers in a ring.
    CSM complains about discovering this VPN configuration due to the VRF and the fact that OSPF with multiple OSPF processes is not supported.
    My question is, can we still monitor the tunnels. We'd like to monitor the tunnels, but that seems impossible unless we can get CSM to see the tunnels which it currently is not.

    VRF Lite and MPLS-VPN act independently so they can work independently. And there is no specific need for mapping. If link is for VRF A on PE so you can make it part of vrf A in CE as well. Both VRFs are independent of each other.
    http://www.cisco.com/en/US/products/hw/switches/ps4324/products_configuration_guide_chapter09186a00801cddd9.html#1045190
    THis document is for 4500 but logic holds the same.

  • NAT and Routed Network with Two ISP's on one router

    I'm sure this has been done covered many times, but I am not finding it.
    I have two ISP connections.
    With ISP-A I have a /30 between us and 200.100.100.0/24 is routed to me via the /30 for thsi example we will say the /30 is 1.1.1.1 on isp end and 1.1.1.2 on my end
    With ISP-B I have a 100.0.0.0/29 subnet. and the ISP gateway is on that subnet at 100.0.0.1
    On the inside of my network I have devices using both 200.100.100.x addresses and devices on 192.168.100.x that need to use NAT.
    I would like all of the devices on 200.100.100.x addresses to continue using ISP-A as their gateway.
    Everything on 192.168.100.x should use NAT and go out ISP-B
    I have tried
    ip nat inside source route-map ISP-A interface GigabitEthernet0/1 overload
    route-map ISP-B permit 10
     match ip address 101
     match interface GigabitEthernet0/1
     set ip next-hop 100.0.0.1
    route-map ISP-A permit 10
     match ip address 111
     match interface Multilink1
     set ip next-hop 1.1.1.1
    The problem comes when I have default routes to ISP-A in the router than none of the ISP-B traffic works, and vice versa.

    I think for this to work correctly and be able to split traffic between the 2 ISPs, you would need to use BGP, because default is going to use one ISP or the other.
    If you can use BGP, this link will help you in load shearing between multiple ISPs when you have one router.
    http://www.cisco.com/c/en/us/support/docs/ip/border-gateway-protocol-bgp/13762-40.html#conf4
    HTH

  • Vlan subinterface nat and routing

    hi,
    i've a cisco 1800 with .248 pool public ip .The router is connected with dce on serial port to my isp and
    is configured with first public ip of my subnet on fe0/0 .
    I've to serve to vlan (1 and 20) with this router so i 've connected the router fe0/0 to switch trunk port
    and created a subinterface fe0/0.20 with dot1q encryption and ip 192.168.40.1. I also created a dhcp pool for vlan20 interface.
    Now i can go to internet trought fe/0.0 . configured vlan 20 device receive 192.168.40.0/24 ip so dhcp pool work.
    vlan 20 device can ping 192.168.40.1 and 82.85.162.1 (fe0/0.20 and fe0/0) but not want to go to internet.
    show ip nat traslation is empty.
    this is my show ip route:
    Gateway of last resort is 213.205.53.77 to network 0.0.0.0
         217.133.64.0/32 is subnetted, 1 subnets
    C       217.133.64.49 is directly connected, Virtual-Access1
    C    192.168.40.0/24 is directly connected, FastEthernet0/0.20
         82.0.0.0/26 is subnetted, 1 subnets
    C       82.85.162.0 is directly connected, FastEthernet0/0
         213.205.53.0/32 is subnetted, 1 subnets
    C       213.205.53.77 is directly connected, Virtual-Access1
    S*   0.0.0.0/0 [1/0] via 213.205.53.77
    this is my configuration:
    Current configuration : 2586 bytes
    version 12.4
    service timestamps debug datetime msec localtime show-timezone
    service timestamps log datetime msec localtime show-timezone
    service password-encryption
    hostname ##############
    boot-start-marker
    boot-end-marker
    logging message-counter syslog
    logging buffered 64000
    no logging console
    enable secret 5 ####################
    aaa new-model
    aaa session-id common
    clock timezone GMT+1 1
    clock summer-time GMT+2 recurring
    no ip source-route
    ip dhcp excluded-address 82.85.162.1
    ip dhcp excluded-address 192.168.40.1
    ip dhcp pool LAN_Roma_Eletronica
       network 82.85.162.0 255.255.255.192
       default-router 82.85.162.1
       dns-server 213.205.36.70 213.205.32.70
       lease 0 0 15
    ip dhcp pool vlan20
       network 192.168.40.0 255.255.255.0
       default-router 192.168.40.1
       dns-server 8.8.8.8 8.8.4.4
       lease 0 0 15
    ip cef
    no ip domain lookup
    ip name-server 213.205.32.70
    ip name-server 213.205.36.70
    multilink bundle-name authenticated
    username ######### password 7 #########
    archive
     log config
      hidekeys
    interface FastEthernet0/0
     ip address 82.85.162.1 255.255.255.192
     ip nat outside
     ip virtual-reassembly
     duplex auto
     speed auto
     no keepalive
    interface FastEthernet0/0.20
     encapsulation dot1Q 20
     ip address 192.168.40.1 255.255.255.0
     ip nat inside
     ip virtual-reassembly
    interface FastEthernet0/1
     no ip address
     duplex auto
     speed auto
    interface Serial0/0/0
     bandwidth 2048
    no ip address
     encapsulation frame-relay IETF
     no fair-queue
     frame-relay traffic-shaping
     hold-queue 4096 in
     hold-queue 4096 out
    interface Serial0/0/0.100 point-to-point
     bandwidth 1600
     no cdp enable
     frame-relay interface-dlci 100 ppp Virtual-Template1
      class FR-1600
    interface Virtual-Template1
     bandwidth 1600
     ip address negotiated
     ip tcp adjust-mss 1410
     keepalive 5
     ppp chap hostname #################
     ppp chap password 7 ################
     ppp pap sent-username ############## password 7 ##############
     ppp ipcp route default
    ip forward-protocol nd
    no ip http server
    ip nat inside source list 110 interface FastEthernet0/0 overload
    map-class frame-relay FR-1600
     frame-relay cir 1600000
     frame-relay bc 200000
     frame-relay mincir 1000000
    access-list 1 permit 192.168.40.0 0.0.0.255
    access-list 110 permit ip 192.168.40.0 0.0.0.255 any
    control-plane
    line con 0
     session-timeout 60
     exec-timeout 60 0
     privilege level 15
    line aux 0
     privilege level 15
    line vty 0 4
     session-timeout 60
     access-class 10 in
     exec-timeout 60 0
    scheduler allocate 20000 1000
    end

    There's 2 problems:
    1- your "ip nat outside" location is wrong, you must put it on virtual-template1.
    2-change "ip nat inside source list 110 interface FastEthernet0/0 overload" to "ip nat inside source list 110 interface virtual-template1 overload"
    HTH
    Houtan

  • Howto control/filter traffic between VRF-(lite) using route leaking?

    Hi,
    does anybody know how I can control/filter the traffic between two vrf when I use route leaking or also normal route target export/import connections, maybe with an acl, in the following scenarios?
    Scenario 1:
    I use a normal MPLS network with several PE routers (maybe ASR series) which connect to the CE routers via OSPF. Two VPNs are configured on the PE routers and I want one of PE routers to allow/route traffic between these VPNs but especially traffic on tcp port 80 and no other ports. I'm only aware of bindung acls to logical or physical interfaces but I don't know how to do this here.
    Scenario 2:
    Same as scenario 1 but not the PE router will connect the VPN but a separate router-on-a -tick (e.g. 4900M) which is connected to one of the PE routers should do this job with vrf-lite and route leaking (address-family ipv4 vrf ...). Also here I want only to allow tcp port 80 between the vpns
    Kind Regards,
    Thorsten

    Thanks.
    That's what I was assuming. In my experience this solution does not scale with increasing number of vpn and inter vpn traffic via route target.
    Is it correct that there is only one common acl per vpn where all rules for the communication to all other vpns are configured? Doesn't this acl become too complex and too error-prone to administrate in a real network environment? Further on in my understanding this acl has to be configured per vpn on all pe routers which have interfaces to ce routers for that vpn.
    Does cisco offer software for managing this?

  • AAA Authentication and VRF-Lite

    Hi!
    I've run into a strange problem, when using AAA Radius authentication and VRF-Lite.
    The setting is as follows. A /31 linknet is setup between PE and CE (7206/g1 and C1812), where PE sub-if is a part of an MPLS VPN, and CE uses VRF-Lite to keep the local services seperated (where more than one VPN is used..).
    Access to the CE, via telnet, console etc, will be authenticated by our RADIUS servers, based on the following setup:
    --> Config Begins <---
    aaa new-model
    aa group server radius radius-auth
    server x.x.4.23 auth-port 1645 acct-port 1646
    server x.x.7.139 auth-port 1645 acct-port 1646
    aaa authentication login default group radius-auth local
    aaa authentication enable default group radius-auth enable
    radius-server host x.x.4.23 auth-port 1645 acct-port 1646 key <key>
    radius-server host x.x.7.139 auth-port 1645 acct-port 1646 key <key>
    ip radius source-interface <outside-if> vrf 10
    ---> Config Ends <---
    The VRF-Lite instance is configured like this:
    ---> Config Begins <---
    ip vrf 10
    rd 65001:10
    ---> Config Ends <---
    Now - if I remove the VRF-Lite setup, and use global routing on the CE (which is okey for a single-vpn setup), the AAA/RADIUS authentication works just fine. When I enable "ip vrf forwarding 10" on the outside and inside interface, the AAA/RADIUS service is unable to reach the two defined servers.
    I compared the routing table when using VRF-Lite and global routing, and they are identical. All routes are imported via BGP correctly, and the service as a whole works without problems, in other words, the AAA/RADIUS part is the only service not working.

    Just wanted to help future people as some of the answers I found here were confusing.
    This is all you need from the AAA perspective:
    aaa new-model
    aaa group server radius RADIUS-VRF-X
    server-private 192.168.1.10 auth-port 1812 acct-port 1813 key 7 003632222D6E3839240475
    ip vrf forwarding X
    aaa authentication login default group RADIUS-VRF-X local
    aaa authorization exec default group X local if-authenticated
    Per VRF AAA reference:
    http://www.cisco.com/c/en/us/td/docs/ios/12_2/12_2b/12_2b4/feature/guide/12b_perv.html#wp1024168

  • Need help on VRF lite

    I have implement VRF lite feature for one of the customer...it's working fine..But i m not so clear of following command ...........Can any one explane the same.
    router ospf 511 vrf abc
    capability vrf-lite <--------What is use of this command..is this is reletaed to BGP to OSPF redistribution..?

    Hi,
    VRF lite converts the router into multiple virtual routers each one with its separated routing table, interfaces and routing protocols.
    The OSPF Support for Multi-VRF on CE Routers feature provides the capability of suppressing provider edge (PE) checks that are needed to prevent loops when the PE is performing a mutual redistribution of packets between the OSPF and BGP protocols. When VPN routing and forward (VRF) is used on a router that is not a PE (that is, one that is not running BGP), the checks can be turned off to allow for correct population of the VRF routing table with routes to IP prefixes.
    When the OSPF process is associated with the VRF, several checks are performed when link-state advertisements (LSAs) are received. PE checks are needed to prevent loops when the PE is performing a mutual redistribution between OSPF and BGP interfaces. In some situations, performing PE checks might not be desirable. The concept of VRFs can be used on a router that is not a PE router (that is, a router that is not running BGP). With the capability vrf-lite command, the checks can be turned off to allow correct population of the VRF routing table with routes to IP prefixes.
    This command suppresses the Provider Edge (PE) specific checks on a router when the OSPF process is associated with the VRF.
    HTH, please do rate all helpful posts,
    Mohammed Mahmoud.

  • VRF AWARE NAT

    hi, i want to implement vrf aware nat and i want to create a single pool for all vrfs. when the traffic returns is there a way the ios identify which vrf the IP belongs to so i dont have to specify the pool for each vpn whit static routes? Thanks ahead- asanes

    Hi,
    As I understand you want to integrate NAT with MPLS based VPNs.
    Follwing Cisco link should help:
    http://www.cisco.com/univercd/cc/td/doc/product/software/ios122/122newft/122t/122t13/ftnatvpn.htm#wp1035671
    Cheers,
    Sultan.

  • IP VRF-Lite

    Hi,
    we had a network with Cat4500 SupV as Core and Cat3750/Cat3750G (not metro!) as Distribution platform.
    I'm finding out if using VRF Lite is possible to separate two entities that use the same physical network and span the whole net to have one, max. two, contact point between these entities...to implement security policy
    Should this work with the platform we had or to implement a VRF network we should have had Cat6500 ???
    If this not work the only solution available is to use RACL at each Distribution node where there are both entitites to separate the traffic
    thanks for any help

    Hello,
    yes what you want to do is possible.
    You will need the "multi-VRF aka VRF lite" where IP routing is performed. So in case the Cat3750 are pure Layer2 switches the VRFs are not needed there.
    Think of a VRF as a sort of virtual router to which certain VLAN/ethernet interfaces are attached.
    To separate two entities you would create two VRFs in the Catalyst 4500 according to "Configuring VRF-lite"
    http://www.cisco.com/en/US/products/sw/iosswrel/ps5187/products_command_reference_chapter09186a008017d03c.html#wp1062144
    and also in the Catalyst 3750 along the description in "Configuring Multi-VRF CE"
    http://www.cisco.com/en/US/products/hw/switches/ps5023/products_configuration_guide_chapter09186a00804764c7.html#wp1320198
    Note that there has being a name change from VRF-lite to Multy-VRF. This is however exactly the same feature - afaik marketing wanted the change because it sounds better.
    Did this help? Then please rate the post.
    Martin

  • Howto: Zones in private subnets using ipfilter's NAT and Port forwarding

    This setup supports the following features:
    * Requires 1 Network interface total.
    * Supports 1 or more public ips.
    * Allows Zone to Zone private network traffic.
    * Allows internet access from the global zones.
    * Allows direct (via ipfilter) internet access to ports in non-global zones.
    (change networks to suit your needs, the number of public and private ip was lowered to simplify this doc)
    Network setup:
    iprb0 65.38.103.1/24
    defaultrouter 65.38.103.254
    iprb0:1 192.168.1.1/24 (in global zone)
    Create a zone on iprb0 with an ip of 192.168.1.2
    ### Example /etc/ipf/ipnat.conf
    # forward from a public port to a private zone port
    rdr iprb0 65.38.103.1/32 port 2222 -> 192.168.1.2 port 22
    # force outbound zone traffic thru a certain ip address
    # required for mail servers because of reverse lookup
    map iprb0 192.168.1.2/32 -> 65.38.103.1/32 proxy port ftp ftp/tcp
    map iprb0 192.168.1.2/32 -> 65.38.103.1/32 portmap tcp/udp auto
    map iprb0 192.168.1.2/32 -> 65.38.103.1
    # allow any 192.168.1.x zone to use the internet
    map iprb0 192.168.1.0/24 -> 0/32 proxy port ftp ftp/tcp
    map iprb0 192.168.1.0/24 -> 0/32 portmap tcp/udp auto
    map iprb0 192.168.1.0/24 -> 0/32For testing purposes you can leave /etc/ipf/ipf.conf empty.
    Be aware the you must "svcadm disable ipfilter; svcadm enable ipfilter" to reload rules and the rules stay loaded if they are just disabled(bug).
    Zones can't modify their routes and inherit the default routes of the global zone. Because of this we have to trick the non-global zones into using a router that doesn't exist.
    Create /etc/init.d/zone_route_hack
    Link this file to /etc/rc3.d/S99zone_route_hack.
    #/bin/sh
    # based on information found at
    # http://blogs.sun.com/roller/page/edp?entry=using_branded_zones_on_a
    # http://forum.sun.com/jive/thread.jspa?threadID=75669&messageID=275741
    fake_router=192.168.1.254
    public_net=65.38.103.0
    router=`netstat -rn | grep default | grep -v " $fake_router " | nawk '{print $2}'`
    # send some data to the real network router so we look up it's arp address
    ping -sn $router 1 1 >/dev/null
    # record the arp address of the real router
    router_arp=`arp $router | nawk '{print $4}'`
    # delete any existing arp address entry for our fake private subnet router
    arp -d $fake_router >/dev/null
    # assign the real routers arp address to our fake private subnet router
    arp -s $fake_router $router_arp
    # route our private subnet through our fake private subnet router
    route add default $fake_router
    # Can't create this route until the zone/interface are loaded
    # Adjust this based on your hardware and number of zones
    sleep 300
    # Duplicate this line for every non-global zone with a private ip that
    # will have ipfilter rdr (redirects) pointing to it
    route add -net $public_net 192.168.1.2 -ifaceNow we have both public and private ip addresses on our one iprb0 interface. If we'd really like our private zone network to really be private we don't want any non-NAT'ed 192.168.1.x traffic leaving the interface. Since ipfilter can't block traffic between zones because they use loopbacks we can just block the 192.168.1.x traffic and the zones can still talk.
    The following /etc/ipf/ipf.conf defaults to deny.
    # ipf.conf
    # IP Filter rules to be loaded during startup
    # See ipf(4) manpage for more information on
    # IP Filter rules syntax.
    # INCOMING DEFAULT DENY
    block in all
    block return-rst in proto tcp all
    # two open ports one of which is redirected in ipnat.conf
    pass in quick on iprb0 proto tcp from any to any port = 22 flags S keep state keep frags
    pass in quick on iprb0 proto tcp from any to any port = 2222 flags S keep state keep frags
    # INCOMING PING
    pass in quick on iprb0 proto icmp from any to 65.38.103.0/24 icmp-type 8 keep state
    # INCOMING GLOBAL ZONE UNIX TRACEROUTE FIX PART 1
    #pass in quick on iprb0 proto udp from any to 65.38.103.0/24 keep state
    # OUTGOING RULES
    block out all
    # ALL INTERNAL TRAFFIC STAYS INTERNAL (Zones use non-filtered loopback)
    # remove/edit as needed to actually talk to local private physical networks
    block out quick from any to 192.168.0.0/16
    block out quick from any to 172.16.0.0/12
    block out quick from any to 10.0.0.0/8
    block out quick from any to 0.0.0.0/8
    block out quick from any to 127.0.0.0/8
    block out quick from any to 169.254.0.0/16
    block out quick from any to 192.0.2.0/24
    block out quick from any to 204.152.64.0/23
    block out quick from any to 224.0.0.0/3
    # Allow traffic out the public interface on the public address
    pass out quick on iprb0 from 65.38.103.1/32 to any flags S keep state keep frags
    # OUTGOING PING
    pass out quick on iprb0 proto icmp from 65.38.103.1/32 to any icmp-type 8 keep state
    # Allow traffic out the public interface on the private address (needs nat and router arp hack)
    pass out quick on iprb0 from 192.168.1.0/24 to any flags S keep state keep frags
    # OUTGOING PING
    pass out quick on iprb0 proto icmp from 192.168.1.0/24 to any icmp-type 8 keep state
    # INCOMING TRACEROUTE FIX PART 2
    #pass out quick on iprb0 proto icmp from 65.38.103.1/32 to any icmp-type 3 keep stateIf you want incoming and outgoing internet in your zones it is easier if you just give them public ips and setup a firewall in the global zone. If you have limited public ip address(I'm setting up a colocation 1u server) then you might take this approach. One of the best things about doing thing this way is that any software configured in the non-global zones will never be configured to listen on an ip address that might change if you change public ips.

    Instead of using the script as a legacy_run script, set it up in SMF.
    First create the file /var/svc/manifest/system/ip-route-hack.xml with
    the following
    ---Start---
    <?xml version="1.0"?>
    <!DOCTYPE service_bundle SYSTEM
    "/usr/share/lib/xml/dtd/service_bundle.dtd.1">
    <!--
    ident "@(#)ip-route-hack.xml 1.0 09/21/06"
    -->
    <service_bundle type='manifest' name='NATtrans:ip-route-hack'>
    <service
    name='system/ip-route-hack'
    type='service'
    version='1'>
    <create_default_instance enabled='true' />
    <single_instance />
    <dependency
    name='physical'
    grouping='require_all'
    type='service'
    restart_on='none'>
    <service_fmri value='svc:/network/physical:default' />
    </dependency>
    <dependency
    name='loopback'
    grouping='require_all'
    type='service'
    restart_on='none'>
    <service_fmri value='svc:/network/loopback:default' />
    </dependency>
    <exec_method
    type='method'
    name='start'
    exec='/lib/svc/method/svc-ip-route-hack start'
    timeout_seconds='0' />
    <property_group name='startd' type='framework'>
    <propval name='duration' type='astring'
    value='transient' />
    </property_group>
    <stability value='Unstable' />
    <template>
    <common_name>
    <loctext xml:lang='C'>
    Hack to allow zone to NAT translate.
    </loctext>
    </common_name>
    <documentation>
    <manpage
    title='zones'
    section='1M'
    manpath='/usr/share/man' />
    </documentation>
    </template>
    </service>
    </service_bundle>
    ---End---
    then modify /var/svc/manfiest/system/zones.xml and add the following
    dependancy
    ---Start---
    <dependency
    name='inet-ip-route-hack'
    type='service'
    grouping='require_all'
    restart_on='none'>
    <service_fmri value='svc:/system/ip-route-hack' />
    </dependency>
    ---End---
    Finally create the file /lib/svc/method/svc-ip-route-hack with the
    contents of S99zone_route_hack, minus the sleep timer (perms 0755). Run
    'svccfg import /var/svc/manifest/system/ip-route-hack.xml' and 'svccfg
    import /var/svc/manifest/system/zones.xml'.
    This will guarantee that ip-route-hack is run before zones are started,
    but after the interfaces are brought on line. It is worth noting that
    zones.xml may get overwritten during a patch, so if it suddenly stops
    working, that could be why.

  • Static NAT and same IP address for two interfaces

    We have a Cisco ASA 5520 and in order to conserve public IP addresses and configuration (possibly) can we use the same public IP address for a static NAT with two different interfaces? Here is an example of what I'm refering too where 10.10.10.10 would be the same public IP address.
    static (inside,Outside) 10.10.10.10  access-list inside_nat_static_1
    static (production,Outside) 10.10.10.10  access-list production_nat_static_1
    Thanks for any help.
    Jeff

    Hi Jeff,
    Unfortunately this cannot be done, on the ASA packet classification is done on the basis of mac-address, destination nat and route, and here you are confusing the firewall, to which interface does the ip belong to. I haven't ever tried to do it, but it should cause you issues.
    Thanks,
    Varun Rao
    Security Team,
    Cisco TAC

  • VRF Route leaking to internet

    I'm just starting to learn about route leaking today, so I'm still trying to figure this out.
    In short, I've created three vlans and put them in a vrf and would like them to access the internet.  At this point, I have vrf created, vlans assigned and a global route leaked from the vrf to the gateway of last resort.  A machine in the vrf is able to ping all three vlan gateways, but cannot still get to the internet.
    I have everything on a 6509 core switch, and my firewall is an ASA 5505.  I've also tried putting routing configs in using eigrp, but the vrf networks never made it to the ASA.  Attached are my configs on both.  If anyone could help me with what I'm missing that would be great.  Thanks!
    ****  6509 Config  ****
    lab-core6509#sh run
    Building configuration...
    Current configuration : 22128 bytes
    ! Last configuration change at 17:31:43 pst Tue Jan 7 2014 by rmf
    ! NVRAM config last updated at 12:30:19 pst Tue Jan 7 2014 by rmf
    upgrade fpd auto
    version 12.2
    no service pad
    service tcp-keepalives-in
    service tcp-keepalives-out
    service timestamps debug datetime msec localtime show-timezone
    service timestamps log datetime msec localtime show-timezone
    no service password-encryption
    service sequence-numbers
    service counters max age 5
    hostname lab-core6509
    boot-start-marker
    boot system flash disk0:s72033-ipservicesk9_wan-mz.122-33.SXI.bin
    boot-end-marker
    aaa new-model
    aaa authentication login default local
    aaa authorization exec default local
    aaa session-id common
    clock timezone pst -8
    clock summer-time PDT recurring
    clock calendar-valid
    ip subnet-zero
    ip dhcp excluded-address 192.168.80.1 192.168.80.9
    ip dhcp pool 192.168.80.0/24
       network 192.168.80.0 255.255.255.0
       default-router 192.168.80.1
       domain-name procopio-guest.com
       dns-server 8.8.8.8
    ip vrf bingfish
    rd 123:1
    ip domain-name company.local
    mls ip slb purge global
    mls netflow interface
    no mls flow ip
    no mls flow ipv6
    mls cef error action reset
    spanning-tree mode pvst
    diagnostic bootup level minimal
    diagnostic cns publish cisco.cns.device.diag_results
    diagnostic cns subscribe cisco.cns.device.diag_commands
    fabric timer 15
    redundancy
    main-cpu
      auto-sync running-config
    mode sso
    vlan internal allocation policy ascending
    vlan access-log ratelimit 2000
    interface Port-channel10
    switchport
    switchport trunk encapsulation dot1q
    switchport mode trunk
    interface GigabitEthernet1/1
    switchport
    switchport access vlan 500
    switchport mode access
    spanning-tree portfast edge
    ~SNIP~  (I don't think anyone cares about all the interface configs!)
    interface Vlan510
    description voice server net
    ip address 10.90.10.1 255.255.255.0
    no ip redirects
    no ip unreachables
    no ip proxy-arp
    no ip mroute-cache
    interface Vlan666
    ip address 10.90.253.1 255.255.255.0
    interface Vlan851
    description bingfish client net
    ip vrf forwarding bingfish
    ip address 10.249.1.1 255.255.255.0
    no ip redirects
    no ip unreachables
    no ip proxy-arp
    no ip mroute-cache
    interface Vlan852
    description bingfish server net
    ip vrf forwarding bingfish
    ip address 10.249.2.1 255.255.255.0
    no ip redirects
    no ip unreachables
    no ip proxy-arp
    no ip mroute-cache
    interface Vlan853
    description bingfish management net
    ip vrf forwarding bingfish
    ip address 10.249.3.1 255.255.255.0
    no ip redirects
    no ip unreachables
    no ip proxy-arp
    no ip mroute-cache
    interface Vlan901
    description guest network
    ip address 192.168.80.1 255.255.255.0
    ip access-group guest-net in
    no ip redirects
    no ip unreachables
    no ip proxy-arp
    no ip mroute-cache
    interface Vlan912
    description internet perimeter
    ip address 10.91.2.1 255.255.255.0
    no ip redirects
    no ip unreachables
    no ip proxy-arp
    no ip mroute-cache
    interface Vlan999
    description management net
    ip address 10.90.100.1 255.255.255.0
    no ip redirects
    no ip unreachables
    no ip proxy-arp
    no ip mroute-cache
    router eigrp 200
    network 10.0.0.0
    address-family ipv4 vrf bingfish
      autonomous-system 99
      network 10.249.1.0 0.0.0.255
      network 10.249.2.0 0.0.0.255
      network 10.249.3.0 0.0.0.255
      redistribute static metric 10000 100 255 1 1500
    exit-address-family
    ip classless
    ip route 0.0.0.0 0.0.0.0 10.91.1.2
    ip route vrf bingfish 0.0.0.0 0.0.0.0 10.91.1.2 global
    no ip http server
    no ip http secure-server
    ip access-list extended guest-net
    deny   ip any 10.0.0.0 0.255.255.255
    permit ip any any
    control-plane
    dial-peer cor custom
    line con 0
    exec-timeout 30 0
    line vty 0 4
    exec-timeout 30 0
    line vty 5 15
    exec-timeout 30 0
    ntp logging
    ntp authenticate
    ntp trusted-key 10
    ntp clock-period 17179851
    ntp source Vlan500
    ntp master
    ntp server 10.90.1.50 prefer
    end
    ****  ASA 5505 Config  ****
    lab-5505asa# sh run
    : Saved
    ASA Version 8.2(5)
    hostname lab-5505asa
    domain-name company.local
    names
    dns-guard
    interface Ethernet0/0
    description inside
    interface Ethernet0/1
    description outside
    switchport access vlan 2
    interface Ethernet0/2
    description dmz
    switchport access vlan 4
    speed 100
    duplex full
    interface Ethernet0/3
    interface Ethernet0/4
    interface Ethernet0/5
    interface Ethernet0/6
    interface Ethernet0/7
    interface Vlan1
    nameif inside
    security-level 100
    ip address 10.91.1.2 255.255.255.0
    ospf cost 10
    interface Vlan2
    nameif outside
    security-level 0
    ip address <outside ip> 255.255.255.128
    ospf cost 10
    interface Vlan4
    nameif DMZ
    security-level 50
    ip address 172.16.35.1 255.255.255.0
    ospf cost 10
    boot system disk0:/asa825-k8.bin
    ftp mode passive
    clock timezone PST -8
    clock summer-time PDT recurring
    dns server-group DefaultDNS
    domain-name company.local
    object-group service DM_INLINE_SERVICE_1
    service-object tcp eq domain
    service-object udp eq domain
    service-object udp eq ntp
    object-group service DM_INLINE_TCP_1 tcp
    port-object eq www
    port-object eq https
    object-group network DM_INLINE_NETWORK_1
    network-object host 10.90.1.10
    network-object host 10.90.1.11
    object-group network DM_INLINE_NETWORK_2
    network-object host <outside ip>
    network-object host<outside ip>
    object-group service DM_INLINE_SERVICE_2
    service-object tcp eq domain
    service-object udp eq domain
    object-group service DM_INLINE_TCP_2 tcp
    port-object eq ftp
    port-object eq ftp-data
    port-object eq www
    port-object eq https
    port-object eq 3008
    port-object eq 3010
    port-object eq ssh
    object-group network DM_INLINE_NETWORK_3
    network-object 216.9.240.0 255.255.240.0
    network-object 68.171.224.0 255.255.224.0
    object-group service DM_INLINE_TCP_4 tcp
    port-object eq 3268
    port-object eq 3269
    port-object eq ldap
    port-object eq ldaps
    object-group network DM_INLINE_NETWORK_6
    network-object host 172.16.35.12
    network-object host 172.16.35.13
    object-group service DM_INLINE_TCP_5 tcp
    port-object eq www
    port-object eq https
    object-group network DM_INLINE_NETWORK_7
    network-object host 172.16.35.12
    network-object host 172.16.35.13
    object-group network DM_INLINE_NETWORK_8
    network-object host 172.16.36.45
    network-object host 172.16.36.46
    object-group service DM_INLINE_TCP_6 tcp
    port-object eq 2598
    port-object eq citrix-ica
    port-object eq www
    object-group service DM_INLINE_TCP_7 tcp
    port-object eq www
    port-object eq https
    object-group service DM_INLINE_TCP_3 tcp
    port-object eq www
    port-object eq https
    object-group network DM_INLINE_NETWORK_4
    network-object host<outside ip>
    network-object host <outside ip>
    network-object host <outside ip>
    object-group network DM_INLINE_NETWORK_5
    network-object host 172.16.35.12
    network-object host 172.16.35.13
    object-group network DM_INLINE_NETWORK_10
    network-object host 172.16.36.15
    network-object host 172.16.36.42
    object-group network xenapp_servers
    network-object host 10.90.1.45
    network-object host 10.90.1.46
    network-object host 10.90.5.54
    object-group network xendesktop_servers
    network-object host 10.90.1.38
    network-object host 10.90.1.54
    object-group network DM_INLINE_NETWORK_11
    network-object host 172.16.36.10
    network-object host 172.16.36.42
    network-object 10.80.1.0 255.255.255.0
    group-object xenapp_servers
    group-object xendesktop_servers
    object-group network DM_INLINE_NETWORK_9
    network-object host 172.16.36.27
    network-object host 172.16.36.31
    object-group network DM_INLINE_NETWORK_12
    network-object host 74.117.58.150
    network-object host 97.95.240.159
    object-group network DM_INLINE_NETWORK_13
    network-object 10.90.10.0 255.255.255.0
    network-object 192.168.80.0 255.255.255.0
    network-object 10.249.0.0 255.255.0.0
    object-group network DM_INLINE_NETWORK_14
    network-object 10.90.1.0 255.255.255.0
    network-object 10.90.5.0 255.255.255.0
    access-list outside_access_in extended deny ip object-group DM_INLINE_NETWORK_12 any log disable
    access-list outside_access_in extended permit tcp any host <outside ip>eq 3389 log disable
    access-list outside_access_in extended permit tcp any host<outside ip>eq smtp log disable
    access-list outside_access_in extended permit tcp any object-group DM_INLINE_NETWORK_4 object-group DM_INLINE_TCP_7 log disable
    access-list dmz_access_in extended permit ip any any log disable
    access-list inside_access_in extended deny ip host 10.90.100.25 any log disable
    access-list inside_access_in extended permit ip object-group DM_INLINE_NETWORK_13 any log disable
    access-list inside_access_in extended permit tcp host 10.90.1.27 host 172.16.35.11 eq smtp log disable
    access-list inside_access_in extended permit ip 10.80.1.0 255.255.255.0 any log disable
    access-list inside_access_in extended permit tcp host 10.90.1.33 object-group DM_INLINE_NETWORK_3 eq 3101 log disable
    access-list inside_access_in extended permit tcp object-group DM_INLINE_NETWORK_14 any object-group DM_INLINE_TCP_2 log disable
    access-list inside_access_in extended permit object-group DM_INLINE_SERVICE_2 object-group DM_INLINE_NETWORK_1 object-group DM_INLINE_NETWORK_2 log disable
    access-list inside_access_in extended permit udp host 10.90.1.50 any eq ntp log disable
    access-list DMZ_access_in extended permit ip object-group DM_INLINE_NETWORK_5 object-group DM_INLINE_NETWORK_11 log disable
    access-list DMZ_access_in extended permit tcp host 172.16.35.10 host 172.16.36.27 eq smtp log disable
    access-list DMZ_access_in extended permit object-group DM_INLINE_SERVICE_1 host 172.16.35.10 host 172.16.36.10 log disable
    access-list DMZ_access_in extended permit tcp host 172.16.35.11 any eq smtp log disable
    access-list DMZ_access_in extended permit tcp host 172.16.35.10 any object-group DM_INLINE_TCP_1 log disable
    access-list DMZ_access_in remark rule for cag to owa
    access-list DMZ_access_in extended permit tcp host 172.16.35.13 object-group DM_INLINE_NETWORK_9 object-group DM_INLINE_TCP_3 log disable
    access-list DMZ_access_in extended permit tcp host 172.16.35.10 host 172.16.36.10 object-group DM_INLINE_TCP_4 log disable
    access-list DMZ_access_in extended permit tcp object-group DM_INLINE_NETWORK_6 object-group DM_INLINE_NETWORK_10 object-group DM_INLINE_TCP_5 log disable
    access-list DMZ_access_in extended permit tcp object-group DM_INLINE_NETWORK_7 object-group DM_INLINE_NETWORK_8 object-group DM_INLINE_TCP_6 log disable inactive
    access-list slow-down extended permit ip 10.90.0.0 255.255.0.0 any
    access-list slow-down extended permit ip any 10.90.0.0 255.255.0.0
    pager lines 24
    logging enable
    logging trap debugging
    logging asdm warnings
    logging host inside 10.90.1.65 6/1470
    logging permit-hostdown
    mtu inside 1500
    mtu outside 1500
    mtu DMZ 1500
    no failover
    icmp unreachable rate-limit 1 burst-size 1
    asdm image disk0:/asdm-713.bin
    asdm history enable
    arp timeout 14400
    global (inside) 2 interface
    global (outside) 1 interface
    global (DMZ) 1 interface
    nat (inside) 1 10.80.1.0 255.255.255.0
    nat (inside) 1 10.90.1.0 255.255.255.0
    nat (inside) 1 10.90.5.0 255.255.255.0
    nat (inside) 1 192.168.80.0 255.255.255.0
    nat (inside) 1 10.249.0.0 255.255.0.0
    nat (DMZ) 1 172.16.35.0 255.255.255.0
    static (DMZ,outside)<outside ip>172.16.35.10 netmask 255.255.255.255 dns
    static (DMZ,outside) <outside ip>172.16.35.55 netmask 255.255.255.255 dns
    static (DMZ,outside) <outside ip>172.16.35.50 netmask 255.255.255.255 dns
    static (DMZ,outside) <outside ip>172.16.35.60 netmask 255.255.255.255 dns
    static (inside,outside) <outside ip>10.90.1.21 netmask 255.255.255.255 dns
    static (inside,DMZ) 172.16.36.31 10.90.1.31 netmask 255.255.255.255
    static (inside,DMZ) 172.16.36.10 10.90.1.10 netmask 255.255.255.255
    static (inside,DMZ) 172.16.36.27 10.90.1.27 netmask 255.255.255.255
    static (inside,DMZ) 172.16.36.15 10.90.1.15 netmask 255.255.255.255
    static (inside,DMZ) 172.16.36.42 10.90.1.42 netmask 255.255.255.255
    static (inside,DMZ) 10.90.1.0 10.90.1.0 netmask 255.255.255.0
    static (inside,DMZ) 10.80.1.0 10.80.1.0 netmask 255.255.255.0
    static (inside,DMZ) 10.90.5.0 10.90.5.0 netmask 255.255.255.0
    access-group inside_access_in in interface inside
    access-group outside_access_in in interface outside
    access-group DMZ_access_in in interface DMZ
    router eigrp 200
    network 10.0.0.0 255.0.0.0
    passive-interface default
    no passive-interface inside
    route outside 0.0.0.0 0.0.0.0 209.242.145.129 1
    route inside 10.0.0.0 255.0.0.0 10.91.1.1 1
    route inside 10.249.0.0 255.255.0.0 10.91.1.1 1
    route inside 192.168.80.0 255.255.255.0 10.91.1.1 1
    timeout xlate 3:00:00
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    timeout tcp-proxy-reassembly 0:01:00
    timeout floating-conn 0:00:00
    dynamic-access-policy-record DfltAccessPolicy
    aaa authentication ssh console LOCAL
    aaa authentication enable console LOCAL
    http server enable
    http 10.0.0.0 255.0.0.0 inside
    no snmp-server location
    no snmp-server contact
    snmp-server enable traps snmp authentication linkup linkdown coldstart
    crypto ipsec security-association lifetime seconds 28800
    crypto ipsec security-association lifetime kilobytes 4608000
    telnet timeout 5
    ssh 10.0.0.0 255.0.0.0 inside
    ssh timeout 60
    console timeout 0
    threat-detection basic-threat
    threat-detection statistics
    threat-detection statistics host number-of-rate 3
    threat-detection statistics tcp-intercept rate-interval 30 burst-rate 400 average-rate 200
    ntp server 10.90.1.50 source inside prefer
    webvpn
    class-map inspection_default
    match default-inspection-traffic
    policy-map type inspect dns preset_dns_map
    parameters
      message-length maximum 512
    policy-map global_policy
    class inspection_default
      inspect dns preset_dns_map
      inspect ftp
      inspect h323 h225
      inspect h323 ras
      inspect rsh
      inspect rtsp
      inspect sqlnet
      inspect skinny 
      inspect sunrpc
      inspect xdmcp
      inspect netbios
      inspect tftp
      inspect icmp
      inspect pptp
      inspect ip-options
    service-policy global_policy global
    prompt hostname context
    no call-home reporting anonymous
    call-home
    profile CiscoTAC-1
      no active
      destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService
      destination address email [email protected]
      destination transport-method http
      subscribe-to-alert-group diagnostic
      subscribe-to-alert-group environment
      subscribe-to-alert-group inventory periodic monthly
      subscribe-to-alert-group configuration periodic monthly
      subscribe-to-alert-group telemetry periodic daily
    Cryptochecksum:9ba1f1f89fa1a88af05e2fc5fdba3090
    : end

    So it would appear I've solved it by adding a static route in the global routing table back to the subnets in the vrf:
    ip classless
    ip route 0.0.0.0 0.0.0.0 10.91.1.2
    ip route 10.249.1.0 255.255.255.0 Vlan851   <-----------------------
    ip route vrf bingfish 0.0.0.0 0.0.0.0 10.91.1.2 global
    Thanks

  • CSR1000V VRF Route Leaking vs GNS

    Hi folks,
    working on 2 lab envronments. I have successfully configured VRF route leaking on GNS3, however can't get it working on CSR1000v with same config (only IP's and name's of VRF etc is different). Is there something on the CSR1000v that I have to do that's different from GNS? Is there a reason why the route in GNS is in both the OSPF database and the routing table yet in ESXi it's only in the database?
    OSPF between neighbors
    BGP to do route leaking
    GNS - leaking route 220.0.0.0
    GNS - Neighbor running OSPF has 220.0.0.0 in the database and the routing table for VRF 100
    ESXi - leaking route 45.0.0.0
    ESXi - Neighbor running OSPF has 45.0.0.0 in the database and is NOT in the routing table for VRF cavia
    GNS - 3640's with c3640-js-mz.124-17
    ESXi - CSR1000V with Cisco IOS XE Software, Version 03.12.00.S
    On both labs using BGP to leak routes between VRF's.
    GNS LAB
    VRF's --------------------------------------------------
    ip vrf 100
     rd 100:100
     route-target export 1:100
     route-target import 1:300
    ip vrf 200
     rd 200:200
     route-target export 1:200
     route-target import 1:300
    ip vrf 300
     rd 300:300
     route-target export 1:300
     route-target import 1:100
     route-target import 1:200
    OSPF --------------------------------------------------------------
    router ospf 100 vrf 100
     router-id 4.4.4.4
     log-adjacency-changes
     redistribute bgp 10 subnets
     network 100.0.0.0 0.0.0.3 area 0
     network 0.0.0.0 255.255.255.255 area 0
    router ospf 200 vrf 200
     router-id 44.44.44.44
     log-adjacency-changes
     redistribute bgp 10 subnets
     network 200.0.0.0 0.0.0.3 area 0
     network 0.0.0.0 255.255.255.255 area 0
    BGP -------------------------------------------------------------
    router bgp 10
     no synchronization
     bgp log-neighbor-changes
     no auto-summary
     address-family ipv4 vrf 300
      no synchronization
      network 220.0.0.0 mask 255.255.255.252
     exit-address-family
     address-family ipv4 vrf 200
      redistribute ospf 200 vrf 200
      no synchronization
     exit-address-family
     address-family ipv4 vrf 100
      redistribute ospf 100 vrf 100
      no synchronization
     exit-address-family
    R4#sh ip bgp vpnv4 all
    BGP table version is 17, local router ID is 44.44.44.44
    Status codes: s suppressed, d damped, h history, * valid, > best, i - internal,
                  r RIB-failure, S Stale
    Origin codes: i - IGP, e - EGP, ? - incomplete
       Network          Next Hop            Metric LocPrf Weight Path
    Route Distinguisher: 100:100 (default for vrf 100)
    *> 10.0.0.0/24      100.0.0.1                2         32768 ?
    *> 100.0.0.0/30     0.0.0.0                  0         32768 ?
    *> 220.0.0.0/30     0.0.0.0                  0         32768 i
    Route Distinguisher: 200:200 (default for vrf 200)
    *> 20.0.0.0/24      200.0.0.1                2         32768 ?
    *> 200.0.0.0/30     0.0.0.0                  0         32768 ?
    *> 220.0.0.0/30     0.0.0.0                  0         32768 i
    Route Distinguisher: 300:300 (default for vrf 300)
    *> 10.0.0.0/24      100.0.0.1                2         32768 ?
    *> 20.0.0.0/24      200.0.0.1                2         32768 ?
    *> 100.0.0.0/30     0.0.0.0                  0         32768 ?
    *> 200.0.0.0/30     0.0.0.0                  0         32768 ?
    *> 220.0.0.0/30     0.0.0.0                  0         32768 i
    -----------------------on neighbor R3 220.0.0.0 (in vrf 300) is in the routing table for vrf 100 as designed----------------------
    R3#sh ip route vrf 100
         220.0.0.0/30 is subnetted, 1 subnets
    O E2    220.0.0.0 [110/1] via 100.0.0.2, 00:29:48, FastEthernet1/0.10
         100.0.0.0/30 is subnetted, 1 subnets
    C       100.0.0.0 is directly connected, FastEthernet1/0.10
         10.0.0.0/24 is subnetted, 1 subnets
    C       10.0.0.0 is directly connected, FastEthernet0/0
    ----------------------OSPF Database on neighbor R3-------------------------------------------
    R3#sh ip ospf data
                OSPF Router with ID (33.33.33.33) (Process ID 200)
                    Router Link States (Area 0)
    Link ID         ADV Router      Age         Seq#       Checksum Link count
    33.33.33.33     33.33.33.33     521         0x80000006 0x005A0E 2
    44.44.44.44     44.44.44.44     541         0x80000006 0x001C18 1
                    Net Link States (Area 0)
    Link ID         ADV Router      Age         Seq#       Checksum
    200.0.0.2       44.44.44.44     540         0x80000005 0x006820
                    Type-5 AS External Link States
    Link ID         ADV Router      Age         Seq#       Checksum Tag
    220.0.0.0       44.44.44.44     540         0x80000005 0x009BAE 3489660938
                OSPF Router with ID (3.3.3.3) (Process ID 100)
                    Router Link States (Area 0)
    Link ID         ADV Router      Age         Seq#       Checksum Link count
    3.3.3.3         3.3.3.3         722         0x80000006 0x008C9F 2
    4.4.4.4         4.4.4.4         581         0x80000006 0x00F845 1
                    Net Link States (Area 0)
    Link ID         ADV Router      Age         Seq#       Checksum
    100.0.0.2       4.4.4.4         581         0x80000005 0x00FEA7
                    Type-5 AS External Link States
    Link ID         ADV Router      Age         Seq#       Checksum Tag
    220.0.0.0       4.4.4.4         581         0x80000005 0x00509A 3489660938
    ESXi LAB
    VRF's----------------------------------------------------------
    vrf definition cavia
     rd 1:100
     address-family ipv4
      route-target export 1000:100
      route-target import 1000:300
     exit-address-family
    vrf definition microsoft
     rd 1:200
     address-family ipv4
      route-target export 1000:200
      route-target import 1000:300
     exit-address-family
    vrf definition shared
     rd 1:300
     address-family ipv4
      route-target export 1000:300
      route-target import 1000:100
      route-target import 1000:200
     exit-address-family
    OSPF ----------------------------------------------------------------
    router ospf 100 vrf cavia
     redistribute bgp 50 subnets
     network 172.100.200.0 0.0.0.3 area 0
     network 0.0.0.0 255.255.255.255 area 0
    router ospf 200 vrf microsoft
     redistribute bgp 50 subnets
     network 172.200.200.0 0.0.0.3 area 0
     network 0.0.0.0 255.255.255.255 area 0
    BGP -----------------------------------------------------------------
    router bgp 50
     bgp log-neighbor-changes
     address-family ipv4 vrf cavia
      redistribute ospf 100
     exit-address-family
     address-family ipv4 vrf microsoft
      redistribute ospf 200
     exit-address-family
     address-family ipv4 vrf shared
      network 45.0.0.0 mask 255.255.255.252
     exit-address-family
    ---------------45.0.0.0 is in the correct BGP VRF's----------------
    R8#sh ip bgp vpnv4 all
    BGP table version is 20, local router ID is 8.8.8.8
    Status codes: s suppressed, d damped, h history, * valid, > best, i - internal, 
                  r RIB-failure, S Stale, m multipath, b backup-path, f RT-Filter, 
                  x best-external, a additional-path, c RIB-compressed, 
    Origin codes: i - IGP, e - EGP, ? - incomplete
    RPKI validation codes: V valid, I invalid, N Not found
         Network          Next Hop            Metric LocPrf Weight Path
    Route Distinguisher: 1:100 (default for vrf cavia)
     *>  45.0.0.0/30      0.0.0.0                  0         32768 i
     *>  80.100.0.0/30    172.100.200.1            2         32768 ?
     *>  172.100.100.0/30 172.100.200.1            2         32768 ?
     *>  172.100.100.4/30 172.100.200.1            2         32768 ?
     *>  172.100.200.0/30 0.0.0.0                  0         32768 ?
    Route Distinguisher: 1:200 (default for vrf microsoft)
     *>  45.0.0.0/30      0.0.0.0                  0         32768 i
     *>  80.200.0.0/30    172.200.200.1            2         32768 ?
     *>  172.200.100.0/30 172.200.200.1            2         32768 ?
     *>  172.200.100.4/30 172.200.200.1            2         32768 ?
     *>  172.200.200.0/30 0.0.0.0                  0         32768 ?
    Route Distinguisher: 1:300 (default for vrf shared)
     *>  45.0.0.0/30      0.0.0.0                  0         32768 i
     *>  80.100.0.0/30    172.100.200.1            2         32768 ?
     *>  80.200.0.0/30    172.200.200.1            2         32768 ?
     *>  172.100.100.0/30 172.100.200.1            2         32768 ?
     *>  172.100.100.4/30 172.100.200.1            2         32768 ?
     *>  172.100.200.0/30 0.0.0.0                  0         32768 ?
     *>  172.200.100.0/30 172.200.200.1            2         32768 ?
         Network          Next Hop            Metric LocPrf Weight Path
     *>  172.200.100.4/30 172.200.200.1            2         32768 ?
     *>  172.200.200.0/30 0.0.0.0                  0         32768 ?
    -----------------------on neighbor R1 45.0.0.0 (in vrf shared) is not in the routing table for vrf cavia----------------------
    R1#sh ip route vrf cavia
    Gateway of last resort is 172.100.200.2 to network 0.0.0.0
    S*    0.0.0.0/0 [1/0] via 172.100.200.2
          80.0.0.0/8 is variably subnetted, 3 subnets, 2 masks
    C        80.100.0.0/30 is directly connected, GigabitEthernet1.1
    L        80.100.0.1/32 is directly connected, GigabitEthernet1.1
    B        80.100.0.4/30 [20/0] via 80.100.0.2, 03:52:22
          172.100.0.0/16 is variably subnetted, 7 subnets, 2 masks
    C        172.100.100.0/30 is directly connected, GigabitEthernet3.1
    L        172.100.100.2/32 is directly connected, GigabitEthernet3.1
    C        172.100.100.4/30 is directly connected, GigabitEthernet2.1
    L        172.100.100.6/32 is directly connected, GigabitEthernet2.1
    B        172.100.101.0/30 [20/0] via 80.100.0.2, 03:52:22
    C        172.100.200.0/30 is directly connected, GigabitEthernet4.1
    L        172.100.200.1/32 is directly connected, GigabitEthernet4.1
    ----------------------OSPF Database on neighbor R1 -------------------------------------------
    R1#
    R1#sh ip ospf data
                OSPF Router with ID (172.100.200.1) (Process ID 100)
                    Router Link States (Area 0)
    Link ID         ADV Router      Age         Seq#       Checksum Link count
    172.100.200.1   172.100.200.1   668         0x8000000A 0x009F4E 4
    172.100.200.2   172.100.200.2   681         0x80000007 0x005F5C 1
                    Net Link States (Area 0)
    Link ID         ADV Router      Age         Seq#       Checksum
    172.100.200.1   172.100.200.1   668         0x80000002 0x0012BD
                    Type-5 AS External Link States
    Link ID         ADV Router      Age         Seq#       Checksum Tag
    45.0.0.0        172.100.200.2   441         0x80000002 0x0047E1 3489660978
    80.100.0.4      172.100.200.1   1679        0x80000008 0x00A883 3489725929
    172.100.101.0   172.100.200.1   1679        0x80000008 0x00C4A9 3489725929

    BUMP

  • Route leaking from VRF to Global on same router with VLAN interface

    Hi all,
    I would like to do some route leaking from VRF to Global and Global to VRF on the same router. Here is an output of the config:
    interface FastEthernet4
    description ***Connection to WAN***
    ip vrf forwarding FVRF
    ip address 10.0.0.6 255.255.255.0
    interface Vlan100
    description ***LAN***
    ip address 192.168.227.1 255.255.255.0
    So what I want is to import 192.168.227.0 /24 into FVRF and import 10.0.0.0 /24 into the global routing table.
    I though I could do that config but it is not possible:
    (config)#ip route vrf FVRF 192.168.227.0 255.255.255.0 vlan 100
    % For VPN or topology routes, must specify a next hop IP address if not a point-to-point interface
    OR
    DK-SLVPN(config)#ip route vrf FVRF 192.168.227.0 255.255.255.0 vlan 100 192.168.227.1 global
    %Invalid next hop address (it's this router)
    Any ideas are really welcome.
    Best regards,
    Laurent

    Hi,
    I have tried the following solution:
    Add 10.0.0.0 /24 From VRFto Global:
    ip route 10.0.0.0 255.255.255.0 FastEthernet4
    Add 192.168.227.0 /24 from Global to VRF:
    router bgp 64512
    bgp log-neighbor-changes
    address-family ipv4
      no synchronization
      redistribute connected
      no auto-summary
    exit-address-family
    ip prefix-list Global-VRF seq 5 permit 192.168.227.0/24
    route-map Global permit 10
    match ip address prefix-list Global-VRF
    ip vrf FVRF
      rd 1:1
      import ipv4 unicast map Global
    So now the VRF table looks like that:
    #      sh ip route vrf FVRF
    C        10.0.0.0/24 is directly connected, FastEthernet4
    S        10.0.0.1/32 [254/0] via 10.0.0.1, FastEthernet4
    L        10.0.0.6/32 is directly connected, FastEthernet4
    B     192.168.227.0/24 is directly connected, 00:15:12, Vlan100
    The Global table looks like this:
    #sh ip route
    Gateway of last resort is 10.1.0.107 to network 0.0.0.0
    D*    0.0.0.0/0 [90/1709056] via 10.1.0.107, 3d02h, Tunnel1
           10.0.0.0/8 is variably subnetted, 8 subnets, 2 masks
    S        10.0.0.0/24 is directly connected, FastEthernet4
    C        10.1.0.0/24 is directly connected, Tunnel1
    L        10.1.0.227/32 is directly connected, Tunnel1
    C        10.2.0.0/24 is directly connected, Tunnel2
    L        10.2.0.227/32 is directly connected, Tunnel2
    C        10.10.10.227/32 is directly connected, Loopback100
           192.168.227.0/24 is variably subnetted, 2 subnets, 2 masks
    C        192.168.227.0/24 is directly connected, Vlan100
    L        192.168.227.1/32 is directly connected, Vlan100
    But When I try to ping it still doesn´t work:
    #ping vrf FVRF 192.168.227.1 source fastEthernet 4
    Type escape sequence to abort.
    Sending 5, 100-byte ICMP Echos to 192.168.227.1, timeout is 2 seconds:
    Packet sent with a source address of 10.0.0.6
    Success rate is 0 percent (0/5)
    #ping 10.0.0.1 source vlan 100
    Type escape sequence to abort.
    Sending 5, 100-byte ICMP Echos to 10.0.0.1, timeout is 2 seconds:
    Packet sent with a source address of 192.168.227.1
    Success rate is 0 percent (0/5)
    Any ideas?
    Regards,
    Laurent

  • VRF-Lite on one 6509; How to route traffic from global to VRF.

    To anyone that can lead me in the right direction:
    I have a 6509 switch with IOS " s3223-adventerprise_wan-mz.122-33.SXJ2.bin"  on it. I am running VRF-lite on it and would like to route some subnets from the global route table to the VRF route table. How can I do this and stay on the same physical switch.  I am using EIGRP for the global network and route table and static routing within the the VRF.  Any suggestions or recommendations?  Thanks in advance for your help in this matter...

    Hello,
    You need to use (Static route) in both directions, One Static in the VRF table points to the Global interface, and another one in the Global point to the VRF interface for the recieved traffic. After that, you Can Redistribute the Global Static route into Eigrp for end-to-end connectivity!
    Example:
    Consider you have 2 interfaces in your Core SW-6509: One is G0/1 and the other is G0/2
    G0/1 is placed into the Global table , and G0/2 is part of VRF (X)
    interface G0/1
    IP address 1.1.1.1 255.255.255.0
    inteface G0/2
    ip vrf forwarding X
    ip address 2.2.2.2 255.255.255.0
    Consider Subnet Y.Y.Y.Y in the Global and you want to have it accessible from the VRF!
    configure this:  (ip route vrf X  y.y.y.y y.y.y.y.y G0/1 Global)
    Configure also this for the return traffic from the Global table: (ip route 2.2.2.2 z.z.z.z G0/2)
    You Can then redistribute the Global static into the Eigrp as below:
    router Eigrp 1
    no auto summary
    redistribute static metric 1.1.1.1.1
    HTH
    Mohamed

Maybe you are looking for

  • Error connecting to an EJB 3.0 Remote on OC4J 10.1.3.2 from Tomcat

    Hi, I want to connect to a Remote Session Bean running on the OC4J 10.1.3 and it doesn´t work. I have connected to it from a java standalone application using: public static void main(String [] args) { try { final Context context = getInitialContext(

  • Digital Signature: Need More Control

    I am trying to use Digital Signatures in my form. I need to be able to specify following 1. Dialog box with Add Digital ID button is opened always even if there is only one Digital ID exists in the system. 2. Default to Ask me which Digital ID use ne

  • Deleting only previous versions of an item (programmatically)

    Is it possible (if so, how?) to delete the old versions of a portal item, but leave the current version alone? I have a procedure that uses wwsbr_api.delete_item to delete items, but it removes every version of the item, including the current version

  • Reading context on upper case

    Hi All!! I have done a Web Dynpro ABAP which access to a table of the database to retrieve some entries. This access is made by a field introduced on the main view. The data on the table are sensitive to capital and small letters. I use the method if

  • How can I reinstall apple software support, mobile device support, bonjour

    For windows 7 pro. Can't download itunes 11. till I reinstall the above.