* VRF leaking doesn't work
@ 2021-03-02 10:57 Greesha Mikhalkin
2021-03-05 15:37 ` David Ahern
2021-03-06 16:12 ` David Ahern
0 siblings, 2 replies; 9+ messages in thread
From: Greesha Mikhalkin @ 2021-03-02 10:57 UTC (permalink / raw)
To: netdev
Hi. I need a help to understand why VRF leaking doesn’t work in my situation.
I want to set up leaking between 2 VRFs, that are set up by following commands:
# Setup bridge
sudo ip link add bridge type bridge
# Setup VLANs
ip link add link bridge name vlan1 type vlan id 1
ip link add link bridge name vlan2 type vlan id 2
ip addr add 10.0.0.31/32 dev vlan1
ip addr add 10.0.0.32/32 dev vlan2
ip link set vlan1 up
ip link set vlan2 up
# Setup VXLANs
ip link add vni1 type vxlan id 1 local 10.1.0.1 dev lan1 srcport
0 0 dstport 4789 nolearning
ip link add vni2 type vxlan id 2 local 10.1.0.1 dev lan1 srcport
0 0 dstport 4789 nolearning
ip link set vni1 master bridge
ip link set vni2 master bridge
bridge vlan add dev vni1 vid 1 pvid untagged
bridge vlan add dev vni2 vid 2 pvid untagged
ip link set vni1 up
ip link set vni2 up
# Setup VRFs
ip link add vrf1 type vrf table 1000
ip link set dev vrf1 up
ip link add vrf2 type vrf table 1001
ip link set dev vrf2 up
Setting routes:
# Unreachable default routes
ip route add table 1000 unreachable default metric 4278198272
ip route add table 1001 unreachable default metric 4278198272
# Nexthop
ip route add table 1000 100.255.254.3 proto bgp metric 20
nexthop via 10.0.0.11 dev vlan1 weight 1 onlink
I'm trying to setup VRF leaking in following way:
ip r a vrf vrf2 100.255.254.3/32 dev vrf1
ip r a vrf vrf2 10.0.0.31/32 dev vrf1
ip r a vrf vrf1 10.0.0.32/32 dev vrf2
Main goal is that 100.255.254.3 should be reachable from vrf2. But
after this setup it doesn’t work. When i run `ping -I vrf2
100.255.254.3` it sends packets from source address that belongs to
vlan1 enslaved by vrf1. I can see in tcpdump that ICMP packets are
sent and then returned to source address but they're not returned to
ping command for some reason. To be clear `ping -I vrf1 …` works fine.
^ permalink raw reply [flat|nested] 9+ messages in thread
* Re: VRF leaking doesn't work
2021-03-02 10:57 VRF leaking doesn't work Greesha Mikhalkin
@ 2021-03-05 15:37 ` David Ahern
2021-03-05 23:57 ` Greesha Mikhalkin
2021-03-06 16:12 ` David Ahern
1 sibling, 1 reply; 9+ messages in thread
From: David Ahern @ 2021-03-05 15:37 UTC (permalink / raw)
To: Greesha Mikhalkin, netdev
On 3/2/21 3:57 AM, Greesha Mikhalkin wrote:
> Hi. I need a help to understand why VRF leaking doesn’t work in my situation.
> I want to set up leaking between 2 VRFs, that are set up by following commands:
>
> # Setup bridge
> sudo ip link add bridge type bridge
>
> # Setup VLANs
> ip link add link bridge name vlan1 type vlan id 1
> ip link add link bridge name vlan2 type vlan id 2
> ip addr add 10.0.0.31/32 dev vlan1
> ip addr add 10.0.0.32/32 dev vlan2
> ip link set vlan1 up
> ip link set vlan2 up
>
> # Setup VXLANs
> ip link add vni1 type vxlan id 1 local 10.1.0.1 dev lan1 srcport
> 0 0 dstport 4789 nolearning
> ip link add vni2 type vxlan id 2 local 10.1.0.1 dev lan1 srcport
> 0 0 dstport 4789 nolearning
> ip link set vni1 master bridge
> ip link set vni2 master bridge
> bridge vlan add dev vni1 vid 1 pvid untagged
> bridge vlan add dev vni2 vid 2 pvid untagged
> ip link set vni1 up
> ip link set vni2 up
>
> # Setup VRFs
> ip link add vrf1 type vrf table 1000
> ip link set dev vrf1 up
> ip link add vrf2 type vrf table 1001
> ip link set dev vrf2 up
>
> Setting routes:
>
> # Unreachable default routes
> ip route add table 1000 unreachable default metric 4278198272
> ip route add table 1001 unreachable default metric 4278198272
>
> # Nexthop
> ip route add table 1000 100.255.254.3 proto bgp metric 20
> nexthop via 10.0.0.11 dev vlan1 weight 1 onlink
>
> I'm trying to setup VRF leaking in following way:
>
> ip r a vrf vrf2 100.255.254.3/32 dev vrf1
> ip r a vrf vrf2 10.0.0.31/32 dev vrf1
> ip r a vrf vrf1 10.0.0.32/32 dev vrf2
>
> Main goal is that 100.255.254.3 should be reachable from vrf2. But
> after this setup it doesn’t work. When i run `ping -I vrf2
> 100.255.254.3` it sends packets from source address that belongs to
> vlan1 enslaved by vrf1. I can see in tcpdump that ICMP packets are
> sent and then returned to source address but they're not returned to
> ping command for some reason. To be clear `ping -I vrf1 …` works fine.
>
What kernel version? If you have not tried 5.10 or 5.11, please do.
^ permalink raw reply [flat|nested] 9+ messages in thread
* Re: VRF leaking doesn't work
2021-03-05 15:37 ` David Ahern
@ 2021-03-05 23:57 ` Greesha Mikhalkin
0 siblings, 0 replies; 9+ messages in thread
From: Greesha Mikhalkin @ 2021-03-05 23:57 UTC (permalink / raw)
To: David Ahern; +Cc: netdev
Hi David!
Thanks for your answer. Currently kernel version that i use is
5.4.0-54-generic. I tried to upgrade to 5.11.3-051103-generic but that
didn't help.
пт, 5 мар. 2021 г. в 16:37, David Ahern <dsahern@gmail.com>:
>
> What kernel version? If you have not tried 5.10 or 5.11, please do.
^ permalink raw reply [flat|nested] 9+ messages in thread
* Re: VRF leaking doesn't work
2021-03-02 10:57 VRF leaking doesn't work Greesha Mikhalkin
2021-03-05 15:37 ` David Ahern
@ 2021-03-06 16:12 ` David Ahern
[not found] ` <CADbyt66Ujtn5D+asPndkgBEDBWJiMScqicGVoNBVpNyR3iQ6PQ@mail.gmail.com>
1 sibling, 1 reply; 9+ messages in thread
From: David Ahern @ 2021-03-06 16:12 UTC (permalink / raw)
To: Greesha Mikhalkin, netdev
On 3/2/21 3:57 AM, Greesha Mikhalkin wrote:
> Main goal is that 100.255.254.3 should be reachable from vrf2. But
> after this setup it doesn’t work. When i run `ping -I vrf2
> 100.255.254.3` it sends packets from source address that belongs to
> vlan1 enslaved by vrf1. I can see in tcpdump that ICMP packets are
> sent and then returned to source address but they're not returned to
> ping command for some reason. To be clear `ping -I vrf1 …` works fine.
I remember this case now: VRF route leaking works for fowarding, but not
local traffic. If a packet arrives in vrf2, it should get forwarded to
vrf1 and on to its destination. If the reverse route exists then round
trip traffic works.
^ permalink raw reply [flat|nested] 9+ messages in thread
end of thread, other threads:[~2021-03-16 0:46 UTC | newest]
Thread overview: 9+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2021-03-02 10:57 VRF leaking doesn't work Greesha Mikhalkin
2021-03-05 15:37 ` David Ahern
2021-03-05 23:57 ` Greesha Mikhalkin
2021-03-06 16:12 ` David Ahern
[not found] ` <CADbyt66Ujtn5D+asPndkgBEDBWJiMScqicGVoNBVpNyR3iQ6PQ@mail.gmail.com>
2021-03-10 8:34 ` Greesha Mikhalkin
2021-03-12 16:39 ` David Ahern
2021-03-15 17:10 ` Greesha Mikhalkin
2021-03-15 18:41 ` David Ahern
2021-03-16 0:45 ` Greesha Mikhalkin
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.