FRR route leak between vrf and default routing tables. #16753

nitinraj92 · 2024-09-05T15:32:08Z

nitinraj92
Sep 5, 2024

Hi Guys. I am fairly new to frr deamon and I am experimenting with a vrf topology. there is ospf running in 2 vrfs vrf-green and vrf-black and bgp is running in default vrf. I want to do route leak between vrf-green to default and vrf-black to default and vise-versa. This is the current configuration I am using.

CE2B# show running-config
Building configuration...

Current configuration:
!
frr version 10.1
frr defaults traditional
hostname CE2B
log syslog informational
ip import-table 12
ip import-table 13
no ipv6 forwarding
service integrated-vtysh-config
!
ip prefix-list PF_VRF_GREEN seq 5 permit 192.168.100.0/24
ip prefix-list PF_VRF_BLACK seq 6 permit 192.168.200.0/24
!
vrf vrf-black
 vni 13
exit-vrf
!
vrf vrf-green
 ip protocol bgp route-map VRF_GREEN_IN
 ip nht table route-map VRF_GREEN_IN
 ip nht bgp route-map VRF_GREEN_IN
 vni 12
exit-vrf
!
router bgp 64302
 bgp router-id 7.7.7.7
 no bgp ebgp-requires-policy
 neighbor 172.16.6.1 remote-as 64502
 neighbor 172.16.6.1 update-source eth1
 !
 address-family ipv4 unicast
  network 172.16.6.0/30
  network 192.168.13.0/24
  redistribute connected
  redistribute static
  redistribute table 12 route-map VRF_GREEN_OUT
  redistribute table 13 route-map VRF_BLACK_OUT
 exit-address-family
exit
!
router ospf vrf vrf-green
 ospf router-id 222.22.22.2
 redistribute connected
 redistribute static
 redistribute bgp metric 100 route-map VRF_GREEN_IN
 network 192.168.100.0/24 area 0
exit
!
router ospf vrf vrf-black
 ospf router-id 77.77.77.77
 redistribute connected
 redistribute static
 redistribute bgp metric 100 route-map VRF_BLACK_IN
 network 192.168.200.0/24 area 1
exit
!
route-map VRF_GREEN_OUT permit 10
 match ip address prefix-list PF_VRF_GREEN
 set community 100:100 additive
exit
!
route-map VRF_GREEN_IN permit 10
 match community 100:100 any
 set metric 100
 set table 12
exit
!
route-map VRF_BLACK_OUT permit 10
 match ip address prefix-list PF_VRF_BLACK
 set community 100:200 additive
exit
!
route-map VRF_BLACK_IN permit 10
 match community 100:200 exact-match
 set table 13
exit
!
segment-routing
 traffic-eng
 exit
exit
!
end

I can see that the routes from vrf are leaking to default but not in reverse direction.

CE2B# show ip route vrf all
Codes: K - kernel route, C - connected, L - local, S - static,
       R - RIP, O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP,
       T - Table, v - VNC, V - VNC-Direct, A - Babel, F - PBR,
       f - OpenFabric, t - Table-Direct,
       > - selected route, * - FIB route, q - queued, r - rejected, b - backup
       t - trapped, o - offload failure

VRF default:
K>* 0.0.0.0/0 [0/0] via 172.16.6.1, wan0, 00:21:30
B>* 1.1.1.0/24 [20/0] via 172.16.6.1, wan0, weight 1, 00:16:19
B>* 1.1.2.0/24 [20/0] via 172.16.6.1, wan0, weight 1, 00:16:19
B>* 10.5.0.0/24 [20/0] via 172.16.6.1, wan0, weight 1, 00:19:28
C>* 169.254.100.0/24 is directly connected, s5.mgmt, 00:21:30
L>* 169.254.100.1/32 is directly connected, s5.mgmt, 00:21:30
K>* 172.11.58.40/32 [0/1] via 172.16.6.1, wan0, 00:21:30
B>* 172.16.1.0/30 [20/200] via 172.16.6.1, wan0, weight 1, 00:19:28
B>* 172.16.2.0/30 [20/0] via 172.16.6.1, wan0, weight 1, 00:19:28
B>* 172.16.3.0/30 [20/20] via 172.16.6.1, wan0, weight 1, 00:19:28
B>* 172.16.4.0/30 [20/20] via 172.16.6.1, wan0, weight 1, 00:19:28
B>* 172.16.5.0/30 [20/0] via 172.16.6.1, wan0, weight 1, 00:19:28
C>* 172.16.6.0/30 is directly connected, wan0, 00:21:30
L>* 172.16.6.2/32 is directly connected, wan0, 00:21:30
T[12]>* 192.168.100.0/24 [15/10] is directly connected, lan0.100 (vrf vrf-green), weight 1, 00:21:29
T[12]>* 192.168.100.1/32 [15/0] is directly connected, lan0.100 (vrf vrf-green), 00:21:29
B>* 192.168.101.0/24 [20/0] via 172.16.6.1, wan0, weight 1, 00:16:19
T[13]>* 192.168.200.0/24 [15/10] is directly connected, lan0.200 (vrf vrf-black), weight 1, 00:21:29
T[13]>* 192.168.200.1/32 [15/0] is directly connected, lan0.200 (vrf vrf-black), 00:21:29
B>* 192.168.201.0/24 [20/0] via 172.16.6.1, wan0, weight 1, 00:19:28

VRF vrf-black:
T[13]   192.168.200.0/24 [15/10] is directly connected, lan0.200 (vrf vrf-black), weight 1, 00:21:29
O   192.168.200.0/24 [110/10] is directly connected, lan0.200, weight 1, 00:21:29
C>* 192.168.200.0/24 is directly connected, lan0.200, 00:21:30
L>* 192.168.200.1/32 is directly connected, lan0.200, 00:21:30

VRF vrf-green:
T[12]   192.168.100.0/24 [15/10] is directly connected, lan0.100 (vrf vrf-green), weight 1, 00:21:29
O   192.168.100.0/24 [110/10] is directly connected, lan0.100, weight 1, 00:21:29
C>* 192.168.100.0/24 is directly connected, lan0.100, 00:21:30
L>* 192.168.100.1/32 is directly connected, lan0.100, 00:21:30

The bgp status is getting the community string but it's not getting leaked to vrf.

CE2B# show ip bgp
BGP table version is 19, local router ID is 7.7.7.7, vrf id 0
Default local pref 100, local AS 64302
Status codes:  s suppressed, d damped, h history, u unsorted, * valid, > best, = multipath,
               i internal, r RIB-failure, S Stale, R Removed
Nexthop codes: @NNN nexthop's vrf id, < announce-nh-self
Origin codes:  i - IGP, e - EGP, ? - incomplete
RPKI validation codes: V valid, I invalid, N Not found

     Network          Next Hop            Metric LocPrf Weight Path
 *>  1.1.1.0/24       172.16.6.1                             0 64502 64402 ?
 *>  1.1.2.0/24       172.16.6.1                             0 64502 64402 ?
 *>  10.5.0.0/24      172.16.6.1               0             0 64502 ?
 *>  172.16.1.0/30    172.16.6.1             200             0 64502 ?
 *>  172.16.2.0/30    172.16.6.1               0             0 64502 ?
 *>  172.16.3.0/30    172.16.6.1              20             0 64502 ?
 *>  172.16.4.0/30    172.16.6.1              20             0 64502 ?
 *>  172.16.5.0/30    172.16.6.1               0             0 64502 i
 *>  172.16.6.0/30    0.0.0.0                  0         32768 i
 *                    0.0.0.0                  0         32768 ?
 *                    172.16.6.1               0             0 64502 i
     192.168.13.0/24  0.0.0.0                  0         32768 i
 *>  192.168.100.0/24 0.0.0.0                 10         32768 ?
 *>  192.168.101.0/24 172.16.6.1                             0 64502 64402 ?
 *>  192.168.200.0/24 0.0.0.0                 10         32768 ?
 *>  192.168.201.0/24 172.16.6.1                             0 64502 64402 ?

Displayed 14 routes and 16 total paths
CE2B# show ip bgp 1.1.1.0/24
BGP routing table entry for 1.1.1.0/24, version 17
Paths: (1 available, best #1, table default)
  Advertised to non peer-group peers:
  172.16.6.1
  64502 64402
    172.16.6.1 from 172.16.6.1 (11.11.11.11)
      Origin incomplete, valid, external, best (First path received)
      Community: 100:100
      Extended Community: RT:100:100
      Last update: Thu Sep  5 20:42:33 2024
CE2B#

Please let me know if I am missing some configuration. Sorry for spamming this channel. I am not sure the right channel for the frr configuration issues. Any help is appreciated. thanks in advance.

nitinraj92 · 2024-09-06T10:50:03Z

nitinraj92
Sep 6, 2024
Author

I have seen a lot of configurations by using evpn. But I wanted to perform route-leak without EVPN as I am running a userspace dataplane which works on the l2 interfaces and the vpn runs in the dataplane. I am looking for a dynamic route manager.
I have used bird routing suite before and it had pipe protocol which can be used to leak/share routes between 2 vrfs or tables. For the same setup as above, I can create 2 pipes, 1 between vrf-default and vrf-green and another between vrf-default and vrf-black.I am looking for a similar configuration.

ipv4 table rt_global;
ipv4 table rt_vrfa;
ipv4 table rt_vrfb;

filter redist_global_vrfa__imp_filter {
    if (source=RTS_STATIC) then {
        bgp_community.add((100,100));
        accept;
    }
    if ! (source=RTS_OSPF) then reject;
    bgp_community.add((100,100));
    accept;
}

filter redist_global_vrfa__exp_filter {
    if ! (source = RTS_BGP ) then reject;
    if (100,100) ~ bgp_community then accept;
    reject;
}

protocol pipe redist_global_vrfa {
    table rt_global;
    peer table rt_vrfa;
    import filter redist_global_vrfa__imp_filter;
    export filter redist_global_vrfa__exp_filter;
}

filter redist_global_vrfb__imp_filter {
    if ! (source=RTS_OSPF) then reject;
    bgp_community.add((100,200));
    accept;
}

filter redist_global_vrfb__exp_filter {
    if ! (source = RTS_BGP ) then reject;
    if (100,200) ~ bgp_community then accept;
    reject;
}

protocol pipe redist_global_vrfb {
    table rt_global;
    peer table rt_vrfb;
    import filter redist_global_vrfb__imp_filter;
    export filter redist_global_vrfb__exp_filter;
}

0 replies

donaldsharp · 2024-09-06T11:16:55Z

donaldsharp
Sep 6, 2024
Maintainer

router bgp XXX
address-family ipv4 uni
import vrf green
import vrf blue

router bgp vrf green XXX
address-fmaily ipv4 uni
import vrf default

.....

1 reply

nitinraj92 Sep 6, 2024
Author

Thanks a lot for replying.
With the above configuration, the routes are not going to green or black vrf but instead, they are getting deleted from default vrf as well.

CE2B# show ip route vrf all
Codes: K - kernel route, C - connected, L - local, S - static,
       R - RIP, O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP,
       T - Table, v - VNC, V - VNC-Direct, A - Babel, F - PBR,
       f - OpenFabric, t - Table-Direct,
       > - selected route, * - FIB route, q - queued, r - rejected, b - backup
       t - trapped, o - offload failure

VRF default:
K>* 0.0.0.0/0 [0/0] via 172.16.6.1, wan0, 00:00:08
C>* 169.254.100.0/24 is directly connected, s5.mgmt, 00:00:08
L>* 169.254.100.1/32 is directly connected, s5.mgmt, 00:00:08
K>* 172.11.58.40/32 [0/1] via 172.16.6.1, wan0, 00:00:08
C>* 172.16.6.0/30 is directly connected, wan0, 00:00:08
L>* 172.16.6.2/32 is directly connected, wan0, 00:00:08
B>* 192.168.100.0/24 [20/0] is directly connected, vrf-green (vrf vrf-green), weight 1, 00:00:02
B>* 192.168.200.0/24 [20/0] is directly connected, vrf-black (vrf vrf-black), weight 1, 00:00:02

VRF vrf-black:
O   192.168.200.0/24 [110/10] is directly connected, lan0.200, weight 1, 00:00:07
C>* 192.168.200.0/24 is directly connected, lan0.200, 00:00:08
L>* 192.168.200.1/32 is directly connected, lan0.200, 00:00:08

VRF vrf-green:
O   192.168.100.0/24 [110/10] is directly connected, lan0.100, weight 1, 00:00:07
C>* 192.168.100.0/24 is directly connected, lan0.100, 00:00:08
L>* 192.168.100.1/32 is directly connected, lan0.100, 00:00:08

Instead, I have tried to use route map to only send a routes marked with community to be imported like this.

router bgp 64302
 bgp router-id 7.7.7.7
 no bgp ebgp-requires-policy
 neighbor 172.16.6.1 remote-as 64502
 neighbor 172.16.6.1 update-source eth1
 !
 address-family ipv4 unicast
  network 172.16.6.0/30
  network 192.168.13.0/24
  redistribute connected
  redistribute static
  import vrf vrf-green
  import vrf vrf-black
 exit-address-family
exit
!
router bgp 64302 vrf vrf-green
 bgp router-id 7.7.7.7
 neighbor 172.16.6.1 remote-as 64502
 !
 address-family ipv4 unicast
  redistribute kernel
  redistribute connected route-map VRF_GREEN_OUT
  redistribute ospf metric 100 route-map VRF_GREEN_OUT
  import vrf route-map VRF_GREEN_IN
 exit-address-family
exit
!
router bgp 64302 vrf vrf-black
 neighbor 172.16.6.1 remote-as 64502
 !
 address-family ipv4 unicast
  redistribute kernel
  redistribute connected route-map VRF_BLACK_OUT
  redistribute ospf metric 100 route-map VRF_BLACK_OUT
  import vrf route-map VRF_BLACK_IN
 exit-address-family
exit
!
route-map VRF_GREEN_IN permit 10
 match community 100:100 exact-match
 set local-preference 100
 set table 12
exit
!
route-map VRF_BLACK_IN permit 10
 match community 100:200 exact-match
 set local-preference 100
 set table 13
exit
!

Then it's going to same state. Routes getting imported from vrf to default but not in the reverse direction.

CE2B# show ip route vrf all
Codes: K - kernel route, C - connected, L - local, S - static,
       R - RIP, O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP,
       T - Table, v - VNC, V - VNC-Direct, A - Babel, F - PBR,
       f - OpenFabric, t - Table-Direct,
       > - selected route, * - FIB route, q - queued, r - rejected, b - backup
       t - trapped, o - offload failure

VRF default:
K>* 0.0.0.0/0 [0/0] via 172.16.6.1, wan0, 00:05:57
B>* 1.1.1.0/24 [20/0] via 172.16.6.1, wan0, weight 1, 00:03:57
B>* 1.1.2.0/24 [20/0] via 172.16.6.1, wan0, weight 1, 00:03:57
B>* 10.5.0.0/24 [20/0] via 172.16.6.1, wan0, weight 1, 00:03:57
C>* 169.254.100.0/24 is directly connected, s5.mgmt, 00:05:57
L>* 169.254.100.1/32 is directly connected, s5.mgmt, 00:05:57
K>* 172.11.58.40/32 [0/1] via 172.16.6.1, wan0, 00:05:57
B>* 172.16.1.0/30 [20/200] via 172.16.6.1, wan0, weight 1, 00:03:57
B>* 172.16.2.0/30 [20/0] via 172.16.6.1, wan0, weight 1, 00:03:57
B>* 172.16.3.0/30 [20/20] via 172.16.6.1, wan0, weight 1, 00:03:57
B>* 172.16.4.0/30 [20/20] via 172.16.6.1, wan0, weight 1, 00:03:57
B>* 172.16.5.0/30 [20/0] via 172.16.6.1, wan0, weight 1, 00:03:57
C>* 172.16.6.0/30 is directly connected, wan0, 00:05:57
L>* 172.16.6.2/32 is directly connected, wan0, 00:05:57
B>* 192.168.100.0/24 [20/0] is directly connected, vrf-green (vrf vrf-green), weight 1, 00:05:51
B>* 192.168.101.0/24 [20/0] via 172.16.6.1, wan0, weight 1, 00:03:57
B>* 192.168.200.0/24 [20/0] is directly connected, vrf-black (vrf vrf-black), weight 1, 00:05:51
B>* 192.168.201.0/24 [20/0] via 172.16.6.1, wan0, weight 1, 00:03:57

VRF vrf-black:
O   192.168.200.0/24 [110/10] is directly connected, lan0.200, weight 1, 00:05:56
C>* 192.168.200.0/24 is directly connected, lan0.200, 00:05:57
L>* 192.168.200.1/32 is directly connected, lan0.200, 00:05:57

VRF vrf-green:
O   192.168.100.0/24 [110/10] is directly connected, lan0.100, weight 1, 00:05:11
C>* 192.168.100.0/24 is directly connected, lan0.100, 00:05:57
L>* 192.168.100.1/32 is directly connected, lan0.100, 00:05:57
CE2B# show ip bgp
BGP table version is 13, local router ID is 7.7.7.7, vrf id 0
Default local pref 100, local AS 64302
Status codes:  s suppressed, d damped, h history, u unsorted, * valid, > best, = multipath,
               i internal, r RIB-failure, S Stale, R Removed
Nexthop codes: @NNN nexthop's vrf id, < announce-nh-self
Origin codes:  i - IGP, e - EGP, ? - incomplete
RPKI validation codes: V valid, I invalid, N Not found

     Network          Next Hop            Metric LocPrf Weight Path
 *>  1.1.1.0/24       172.16.6.1                             0 64502 64402 ?
 *>  1.1.2.0/24       172.16.6.1                             0 64502 64402 ?
 *>  10.5.0.0/24      172.16.6.1               0             0 64502 ?
 *>  172.16.1.0/30    172.16.6.1             200             0 64502 ?
 *>  172.16.2.0/30    172.16.6.1               0             0 64502 ?
 *>  172.16.3.0/30    172.16.6.1              20             0 64502 ?
 *>  172.16.4.0/30    172.16.6.1              20             0 64502 ?
 *>  172.16.5.0/30    172.16.6.1               0             0 64502 i
 *>  172.16.6.0/30    0.0.0.0                  0         32768 i
 *                    0.0.0.0                  0         32768 ?
 *                    172.16.6.1               0             0 64502 i
     192.168.13.0/24  0.0.0.0                  0         32768 i
 *>  192.168.100.0/24 0.0.0.0@82<              0         32768 ?
 *>  192.168.101.0/24 172.16.6.1                             0 64502 64402 ?
 *>  192.168.200.0/24 0.0.0.0@83<              0         32768 ?
 *>  192.168.201.0/24 172.16.6.1                             0 64502 64402 ?

Displayed 14 routes and 16 total paths
CE2B# show ip bgp vrf vrf-green
BGP table version is 1, local router ID is 7.7.7.7, vrf id 82
Default local pref 100, local AS 64302
Status codes:  s suppressed, d damped, h history, u unsorted, * valid, > best, = multipath,
               i internal, r RIB-failure, S Stale, R Removed
Nexthop codes: @NNN nexthop's vrf id, < announce-nh-self
Origin codes:  i - IGP, e - EGP, ? - incomplete
RPKI validation codes: V valid, I invalid, N Not found

     Network          Next Hop            Metric LocPrf Weight Path
 *>  192.168.100.0/24 0.0.0.0                  0         32768 ?

Displayed 1 routes and 1 total paths
CE2B# show ip bgp vrf vrf-black
BGP table version is 1, local router ID is 192.168.200.1, vrf id 83
Default local pref 100, local AS 64302
Status codes:  s suppressed, d damped, h history, u unsorted, * valid, > best, = multipath,
               i internal, r RIB-failure, S Stale, R Removed
Nexthop codes: @NNN nexthop's vrf id, < announce-nh-self
Origin codes:  i - IGP, e - EGP, ? - incomplete
RPKI validation codes: V valid, I invalid, N Not found

     Network          Next Hop            Metric LocPrf Weight Path
 *>  192.168.200.0/24 0.0.0.0                  0         32768 ?

Displayed 1 routes and 1 total paths
CE2B# show ip bgp 1.1.1.0/24
BGP routing table entry for 1.1.1.0/24, version 4
Paths: (1 available, best #1, table default)
  Advertised to non peer-group peers:
  172.16.6.1
  64502 64402
    172.16.6.1 from 172.16.6.1 (11.11.11.11)
      Origin incomplete, valid, external, best (First path received)
      Community: 100:100
      Last update: Fri Sep  6 17:55:03 2024
CE2B#

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

FRR route leak between vrf and default routing tables. #16753

{{title}}

{{editor}}'s edit

{{editor}}'s edit

Replies: 2 comments 1 reply

{{title}}

{{editor}}'s edit

{{editor}}'s edit

{{title}}

{{title}}

Select a reply

FRR route leak between vrf and default routing tables. #16753

nitinraj92 Sep 5, 2024

Replies: 2 comments · 1 reply

nitinraj92 Sep 6, 2024 Author

donaldsharp Sep 6, 2024 Maintainer

nitinraj92 Sep 6, 2024 Author

nitinraj92
Sep 5, 2024

Replies: 2 comments 1 reply

nitinraj92
Sep 6, 2024
Author

donaldsharp
Sep 6, 2024
Maintainer

nitinraj92 Sep 6, 2024
Author