Hi All, Am hoping someone here can give me a cleaner solution to what I'm doing as detailed below. Since at the moment I have a feeling the solution I have in place only works because of "features that may end up being fixed" in the future.
This is a 7606 RSP720 running SRB1 btw. Ok, I have a tunnel interface (GRE) on a router, the interface is in the global zone as outbound traffic going out of the tunnel shouldn't pass through the vrf for a variety of reasons. Inbound, there is a policy based route that matches on interface tunnel 2 and drops it into the vrf like so: ip policy route-map pbr-in route-map pbr-in permit 10 match interface Tunnel2 set vrf INBOUND-TRAFFIC ! That vrf then has a static route to another router, so that inbound traffic gets sent to a point where we do bandwidth shaping etc. The router announces xxx.xxx.0.0/16 as a less specific, that is statically routed to null0 purely for announcement purposes. So far... so good... all of this works... Now comes the problem... on the same router there are a series of SVI's with attached /24s in the same network. Now, in the vrf all traffic inbound follows the vrf default route to another router, including when it attempts to flow to the SVI's. If I import the /16 into the vrf (which is easy to do, its announced in BGP), because that's statically routed in the global to null0, the vrf sends all traffic to null0, ignoring the more specifics in the global (kind of expected). You cannot statically route to a loopback on the router in the global (%Invalid next hop address (it's this router)) You have to have the networks announced in bgp to import them into the vrf... So the hack that I came up with was to add network statements for each /24 in the bgp configs, then do an aggregate-address xxx.xxx.0.0 255.255.0.0 summary-only. Strangely, this allows the import into the vrf of the /24s to work, though it strikes me as broken behavior. Anyone got a cleaner solution to get directly connected routes into a VRF? :) Andrew Alston TENET - Chief Technology Officer _______________________________________________ cisco-nsp mailing list [email protected] https://puck.nether.net/mailman/listinfo/cisco-nsp archive at http://puck.nether.net/pipermail/cisco-nsp/
