topic Re: Inter-VRF routing on singular Router in ICX Switches

Inter-VRF routing on singular Router

S4mrai — Tue, 02 Apr 2024 15:26:25 GMT

Hi, I have a ICX-7450 stack with 5 members running L3 Code with L3-prem license.

I have a default VRF on VE1 (VLAN 1) and a Non-default VRF on VE 200 (VLAN 200)

I want to allow traffic between VLAN 1 Networks and VLAN 200 Networks :

config excpert:

vlan 1 name DEFAULT by port
router-interface ve 1
spanning-tree 802-1w

vlan 200 name clientx by port
### Here would be the tagged ports
router-interface ve 200
spanning-tree 802-1w

vrf clientx
rd 11:11
ip router-id 10.30.0.16
address-family ipv4
ip route 0.0.0.0/0 10.30.0.254
ip route 172.16.100.0/24 ve 1
exit-address-family
exit-vrf

ip router-id 172.18.10.16
ip route 0.0.0.0/0 172.18.10.254
ip route 10.30.0.0/24 ve 200

interface ve 1
ip address 172.18.10.16 255.255.255.0

interface ve 200
vrf forwarding clientx
ip address 10.30.0.16 255.255.255.0

I just want clients from the default vrf (172.18.10.0/24) to be able to communicate with the clientx vrf (10.30.0.0/24)
Documentation is telling me that VRF Route leaking works by selecting the respective exit interface of the vrf but it doesn't work. Clients cannot reach each other.

I think I am dumb, in cisco I would just use the "import maps" but this is my first time vrf on Ruckus.

(please note: Networks are changed and very simplified in this example, each vrf has more routes which the other side should not see. I only specified the one network which we want inter-Vrf connectivity . This L3 Router is also the gateway for the cleints in their respective vlans.)

Re: Inter-VRF routing on singular Router

Chandini — Tue, 02 Apr 2024 16:38:09 GMT

Hi S4mrai

Thank you for reaching us.

Could you please let me know if this is a new setup ?

Could you share the below output ?

show ip route vrf clientx
ping vrf clientx 10.30.0.16
ping vrf clientx 172.18.10.16

Thanks

Re: Inter-VRF routing on singular Router

S4mrai — Wed, 03 Apr 2024 12:16:49 GMT

Thank you for the fast reply.

SSH@core#show ip route vrf client x
Total number of IP routes: 2
Type Codes - B:BGP D:Connected O:OSPF R:RIP S:Static; Cost - Dist/Metric
BGP Codes - i:iBGP e:eBGP
OSPF Codes - i:Inter Area 1:External Type 1 2:External Type 2
STATIC Codes - v:Inter-VRF
Destination Gateway Port Cost Type Uptime
1 0.0.0.0/0 10.30.0.254 ve 200 1/1 S 0m5s
2 10.30.0.0/24 DIRECT ve 200 0/0 D 7d21h
3 172.18.10.0/24 DIRECT ve 1 1/1 Sv 0m5s

SSH@core#ping vrf clientx 10.30.0.16
Ping self done.

SSH@core#ping vrf clientx 172.18.10.16
Sending 1, 16-byte ICMP Echo to 172.18.10.16, timeout 5000 msec, TTL 64
Type Control-c to abort
Request timed out.
No reply from remote host.

Re: Inter-VRF routing on singular Router

S4mrai — Wed, 03 Apr 2024 12:20:31 GMT

also please ignore this typo ip route 172.16.100.0/24 ve 1 this route was ip route 172.18.10.0/24 ve 1 instead, I just anonymized our networks and misstyoped. I made shure that the routes from default to vrf and vice-versa have the correct networks.

But I still cannot ping from ve200 to ve 1.

Re: Inter-VRF routing on singular Router

Chandini — Fri, 05 Apr 2024 17:23:49 GMT

Hi S4mrai

Thank you for sharing the details.

In the vrf routing table looks like information is populating. Could you try to add the below command to ve 1 also and check

interface ve 1
vrf forwarding clientx

Thanks

Re: Inter-VRF routing on singular Router

S4mrai — Mon, 08 Apr 2024 08:03:12 GMT

Hello I cannot move this in production interface to a different vrf. wouldn't this also mean that both interfaces share the same routing table completely ?

The Setup is:
Firewall1 int 1 -> ICX1 (Gateway-default) ve 1 default VRF Multiple Subnets
Firewall1 int 30 -> ICX1 (Gateway-clientx ) ve 200 clientx VRF Multiple Subnets

We need to reach one of the default subnets from clientx via the ICX Gateway and Vice versa. Routing these Subnets trough the Firewall is not an option.

We also do not want to have both Interfaces in the same VRF and then block access wiith a ACL because we need those Subnets to enter the Firewall in a seperate Interface and then we'd have to use ACL-Policybased Routing

Re: Inter-VRF routing on singular Router

Chandini — Mon, 08 Apr 2024 14:24:17 GMT

Hi S4mrai

Thank you for reaching us

You are correct they will fall in same routing table. I wanted to see when they are part of same routing table if the ping is reachable or no because the two routes do display in the routing table in earlier output you shared.

In case this is a production network I would not recommend the change. I would request you to log a case using the below link as this may need further tests and may require you to share more details.

https://support.ruckuswireless.com/contact-us

Thanks

Re: Inter-VRF routing on singular Router

S4mrai — Mon, 08 Apr 2024 15:04:57 GMT

I solved part of it:

I cleared all vrf and arp wih the "clear" command.

since then L3 Communication works, I can ping between the leaked routes subnets as intended.

Only issue now is: broadcasts are not relayed altough I have an ip helper configured as well as directed broadcasts and I allowed ip forwarding for bootpc and bootps.
Do you want me to post my config here or should I close this and open a new thread ?

Re: Inter-VRF routing on singular Router

Chandini — Tue, 09 Apr 2024 17:18:57 GMT

Hi S4mrai

Thank you for reaching us.

You can post the query here. I will try my best to help you. So is the issue related to DHCP this time ?

Could you help me with more details about the issue you are seeing ?

Thanks

Re: Inter-VRF routing on singular Router

jdryan — Fri, 12 Apr 2024 13:20:20 GMT

Hi S4mrai,

Adding to the post, the directed-broadcast and UDP forwarding is probably not best in case of dhcp.
Here best approach would be to use relay/dhcp-relay on L3 interfaces.
But if the DHCP has to cross the vrf's, then similar route provisioning with relay/dhcp-helper should help.
As relay/dhcp-helper would convert the broadcast of the DHCP to unicast and direct it to the server and with route provisioning it should help cross the VRFs.

Let us know if the bits help !

Re: Inter-VRF routing on singular Router

Mayank — Sun, 14 Apr 2024 08:58:17 GMT

Hi S4mrai,

Adding to the post. As this is a new setup you need to test it out before moving it into production.

In order to check the network flow I would suggest you check out the configuration first to achieve the Baseline.

For VRF Related Configuration you can refer to the below link for your reference:

https://docs.commscope.com/bundle/fastiron-08095-l3guide/page/GUID-FA7A07AF-9EBB-4DDC-81B6-2F3F7E814411.html.

You can also refer to the below short video link for your reference:

Below link for CONFIGURING A MANAGEMENT VRF :

https://youtu.be/1kzIY1SiK_A?si=fRIgk2gh6vkyZZmH

Below link for CONFIGURING MULTI-VRF :

https://youtu.be/vC3bhw1aGzg?si=4HvcHWzl7RqoOrrg

Since the issue is also related to the DHCP you can refer to the below link for your reference:

https://youtu.be/AXCPDVptsyk?si=UwezPcJgoBMVePZX

https://youtu.be/OCE0eEQqQAY?si=YdAdqyjTVcuK4Z7p

Below link for IP HELPER ADDRESS :

https://youtu.be/5eQI-ptLCtY?si=vguL8xxcatGx9s_f

Moving Forward If this issue is not resolved, Please log a ticket with the below link so that we can help you further.

https://support.ruckuswireless.com/contact-us

I hope this information helps you

Please feel free to leave us a message if any concerns

Thanks