04-02-2024 08:26 AM
Hi, I have a ICX-7450 stack with 5 members running L3 Code with L3-prem license.
I have a default VRF on VE1 (VLAN 1) and a Non-default VRF on VE 200 (VLAN 200)
I want to allow traffic between VLAN 1 Networks and VLAN 200 Networks :
config excpert:
vlan 1 name DEFAULT by port
router-interface ve 1
spanning-tree 802-1w
vlan 200 name clientx by port
### Here would be the tagged ports
router-interface ve 200
spanning-tree 802-1w
vrf clientx
rd 11:11
ip router-id 10.30.0.16
address-family ipv4
ip route 0.0.0.0/0 10.30.0.254
ip route 172.16.100.0/24 ve 1
exit-address-family
exit-vrf
ip router-id 172.18.10.16
ip route 0.0.0.0/0 172.18.10.254
ip route 10.30.0.0/24 ve 200
interface ve 1
ip address 172.18.10.16 255.255.255.0
interface ve 200
vrf forwarding clientx
ip address 10.30.0.16 255.255.255.0
I just want clients from the default vrf (172.18.10.0/24) to be able to communicate with the clientx vrf (10.30.0.0/24)
Documentation is telling me that VRF Route leaking works by selecting the respective exit interface of the vrf but it doesn't work. Clients cannot reach each other.
I think I am dumb, in cisco I would just use the "import maps" but this is my first time vrf on Ruckus.
(please note: Networks are changed and very simplified in this example, each vrf has more routes which the other side should not see. I only specified the one network which we want inter-Vrf connectivity . This L3 Router is also the gateway for the cleints in their respective vlans.)
04-08-2024 01:03 AM
Hello I cannot move this in production interface to a different vrf. wouldn't this also mean that both interfaces share the same routing table completely ?
The Setup is:
Firewall1 int 1 -> ICX1 (Gateway-default) ve 1 default VRF Multiple Subnets
Firewall1 int 30 -> ICX1 (Gateway-clientx ) ve 200 clientx VRF Multiple Subnets
We need to reach one of the default subnets from clientx via the ICX Gateway and Vice versa. Routing these Subnets trough the Firewall is not an option.
We also do not want to have both Interfaces in the same VRF and then block access wiith a ACL because we need those Subnets to enter the Firewall in a seperate Interface and then we'd have to use ACL-Policybased Routing
04-08-2024 07:24 AM
Hi S4mrai
Thank you for reaching us
You are correct they will fall in same routing table. I wanted to see when they are part of same routing table if the ping is reachable or no because the two routes do display in the routing table in earlier output you shared.
In case this is a production network I would not recommend the change. I would request you to log a case using the below link as this may need further tests and may require you to share more details.
Thanks
04-08-2024 08:04 AM
I solved part of it:
I cleared all vrf and arp wih the "clear" command.
since then L3 Communication works, I can ping between the leaked routes subnets as intended.
Only issue now is: broadcasts are not relayed altough I have an ip helper configured as well as directed broadcasts and I allowed ip forwarding for bootpc and bootps.
Do you want me to post my config here or should I close this and open a new thread ?
04-14-2024 01:58 AM
Hi S4mrai,
Adding to the post. As this is a new setup you need to test it out before moving it into production.
In order to check the network flow I would suggest you check out the configuration first to achieve the Baseline.
For VRF Related Configuration you can refer to the below link for your reference:
You can also refer to the below short video link for your reference:
Below link for CONFIGURING A MANAGEMENT VRF :
https://youtu.be/1kzIY1SiK_A?si=fRIgk2gh6vkyZZmH
Below link for CONFIGURING MULTI-VRF :
https://youtu.be/vC3bhw1aGzg?si=4HvcHWzl7RqoOrrg
Since the issue is also related to the DHCP you can refer to the below link for your reference:
https://youtu.be/AXCPDVptsyk?si=UwezPcJgoBMVePZX
https://youtu.be/OCE0eEQqQAY?si=YdAdqyjTVcuK4Z7p
Below link for IP HELPER ADDRESS :
https://youtu.be/5eQI-ptLCtY?si=vguL8xxcatGx9s_f
Moving Forward If this issue is not resolved, Please log a ticket with the below link so that we can help you further.
https://support.ruckuswireless.com/contact-us
I hope this information helps you
Please feel free to leave us a message if any concerns
Thanks
04-09-2024 10:18 AM
Hi S4mrai
Thank you for reaching us.
You can post the query here. I will try my best to help you. So is the issue related to DHCP this time ?
Could you help me with more details about the issue you are seeing ?
Thanks