Route-leak between 2 VRF on same router

[EasyNetDev]

Hi all,

I tried to find out a solution to this issue, but I'm out of idea, except the static routes.
I have multiple VRF, one of them is called "internet". There I have the full routing table. I have another VRF, let call it "vrf2", where I have some special devices and I want to isolate them from the rest of the network, but I need also to give them access to internet.
To route a default route from internet VRF to this VRF is ok using static route from "vrf2" to "internet". But Also I have some dynimc IP addresses for some VPN clients which I need to announce from this "vrf2" to "inernet" for the income traffic to know in which VRF should go.

I know in Cisco is done similar to this:

ip prefix-list GLOBAL permit 10.10.1.0/24
!
route-map GLOBAL_TO_VRF permit 10
match ip address prefix-list GLOBAL
!
ip vrf RED
rd 1:1
import ipv4 unicast mapGLOBAL_TO_VRF
!

In FRR "rd" and "rt" is under BGP address-family ipv4 unicast section. I'm thinking this route-leak can be done here under "address-family ipv4 unicast", but I have no clue how to do it.

There is a way to do it in FRR at this moment?

[donaldsharp]

http://docs.frrouting.org/en/latest/bgp.html#clicmd-import-vrf-VRFNAME

[EasyNetDev]

Hi @donaldsharp

Thanks. I notice this command, but unfortunaltelly if I'm trying to use this command I can't export the VRF via VPN MP-BGP :(.
Those comands are not compatible with rt/rd commands:

This shortcut syntax mode is not compatible with the explicit import vpn and export vpn statements for the two VRF’s involved.

So there is no way in this moment to import some routes from another VFR and then export as VPN via MP-BGP.
If I'm using route-leak from antoher router, if that router is going to be rebooted this router where I can't do this trick will losing the connectivity. I have only dual router setup, unfortunatelly.

[EasyNetDev]

Hi all,

I think I found a solution. Is actually using the BGP VPN route-leak. It seems that if I'm exporting an prefix from local VRF1 to VPN and the in the VRF2 I'm importing the correct RT the route from VRF1 shows in VRF2.

I did this test:

BGP and Zebra configuration:

interface mgmt
 ip address 10.90.100.1/32
exit
!
interface vpn
 ip address 10.100.100.1/32
exit

..

router bgp 65001 vrf mgmt
 bgp router-id 10.90.100.1
 !
 address-family ipv4 unicast
  redistribute connected route-map VRF-MGMT-CONNECTED
  rd vpn export 65001:11000
  rt vpn both 65001:11000
  export vpn
  import vpn
 exit-address-family
exit
!
router bgp 65001 vrf vpn
 bgp router-id 10.100.100.1
 !
 address-family ipv4 unicast
  rd vpn export 65001:19000
  rt vpn import 65001:19000 65001:11000
  rt vpn export 65001:19000
  export vpn
  import vpn
 exit-address-family
exit

route-map VRF-MGMT-CONNECTED permit 1000
 set extcommunity rt 65001:11000
exit

Where vpn and mgmt interfaces are the VRFs and I'm using them as Loopback interfaces for each VRF.

Then the output is looking like this:

R01# sh bgp vrf vpn ipv4 unicast
BGP table version is 1, local router ID is 10.100.100.1, vrf id 11
Default local pref 100, local AS 65001
Status codes:  s suppressed, d damped, h history, * valid, > best, = multipath,
               i internal, r RIB-failure, S Stale, R Removed
Nexthop codes: @NNN nexthop's vrf id, < announce-nh-self
Origin codes:  i - IGP, e - EGP, ? - incomplete
RPKI validation codes: V valid, I invalid, N Not found

   Network          Next Hop            Metric LocPrf Weight Path
*> 10.90.100.1/32   0.0.0.0@102<             0         32768 ?

Displayed  1 routes and 1 total paths

R01# sh bgp vrf vpn ipv4 unicast 10.90.100.1/32
BGP routing table entry for 10.90.100.1/32, version 1
Paths: (1 available, best #1, vrf vpn)
  Not advertised to any peer
  Imported from 65001:11000:10.90.100.1/32
  Local
    0.0.0.0 from 0.0.0.0 (10.100.100.1) vrf mgmt(102) announce-nh-self
      Origin incomplete, metric 0, weight 32768, valid, sourced, local, best (First path received)
      Extended Community: RT:65001:11000 RT:65001:11000
      Originator: 89.X.X.1 -> THIS IS THE LOCAL ROUTER!
      Last update: Sun Mar  6 21:40:31 2022

R01# show ip route vrf vpn
Codes: K - kernel route, C - connected, S - static, R - RIP,
       O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP,
       T - Table, v - VNC, V - VNC-Direct, A - Babel, F - PBR,
       f - OpenFabric,
       > - selected route, * - FIB route, q - queued, r - rejected, b - backup
       t - trapped, o - offload failure

VRF vpn:
B>* 10.90.100.1/32 [20/0] is directly connected, mgmt (vrf mgmt), weight 1, 00:13:51
C>* 10.100.100.1/32 is directly connected, vpn, 00:18:03

Seems that the export VRF to VPN and import VPN to VRF on the same router is working very well. Unfortunatelly is not well documented.
Perhaps I can write down a tutorial for the manual. It could help?

[EasyNetDev]

Good. I already have written a tutorial for my multi-loopback driver for Linux, because I notice an issue with dummy driver used as loopbak under VRF. Is not working properly, so I create a new driver based on dumm, internal Linux loopback, VRF interfaces.

https://github.com/EasyNetDev/linux-multi-loopback

So I will try to add a tutorial in the documents.

[f0o]

I just noticed a peculiar behavior when an VRF gets added an IP.

Both rd and rt parameters get overwritten.

I have:

router bgp 65001 vrf RED
 !
 address-family ipv4 unicast
  redistribute connected
  rt vpn export 65001:10 65001:1
  rd vpn export 65001:10
  export vpn

but when an interface inside RED gets an IP assigned it automagically updates to:

router bgp 65001 vrf RED
 !
 address-family ipv4 unicast
  redistribute connected
  rt vpn export 1.2.3.4:3
  rd vpn export 1.2.3.4:3
  export vpn

Is there a way to not have frr do that?

[EasyNetDev]

Do you have bgp router ID configured on bgp router vrf?
Otherwise it will rewrite rt and rd.
When you have bgp router id configured it will keep rt and rd that you configured and it will not be override when you change interfaces IP.

[f0o]

TIL - let me test that real quick

//EDIT: You are absolutely right! After adding a router-id it no longer overwrites the rd/rt parameters!

[EasyNetDev]

Nice!
Indeed is the normal behavior. When you don't have a router id, the first IP in the VRF is set as rd/rt.
So, each time you change the first IP in the VRF will obviously rewrite the RD/RT.