New thread on Cisco VRF route leak

alanchia2000 · ‎05-26-2009

The purpose of this thread is to seek clarifications. The previous thread posted was too long and difficult to understand. So I thought I made the problem even simpler for understanding.

Following is how the switch, Sw1 is connected to the Core Sw.

Sw1 ----- Core Sw

Following contains the configuration :

** Sw1 **

ip classless

interface GigabitEthernet1/0/14

description TestVRF1

no switchport

ip address 192.168.1.1 255.255.255.0

end

ip route 192.168.3.0 255.255.255.0 192.168.1.2

Core sw

ip vrf clientA

rd 100:110

route-target export 100:110

route-target import 100:110

interface GigabitEthernet1/0/2

description 192.168.1.2

no switchport

ip vrf forwarding clientA

ip address 192.168.1.2 255.255.255.0

no cdp enable

end

ip route 192.168.1.0 255.255.255.0 GigabitEthernet1/0/2

ip route vrf clientA 192.168.3.0 255.255.255.0 lo1 192.168.3.1

What I do not understand is why I can't ping 192.168.3.1 from Sw1. Help appreciated.

Harold Ritter · ‎05-27-2009

Try "ip route vrf clientA 192.168.3.1 255.255.255.255 lo1" instead. It works for me.

Regards

Harold Ritter
Sr Technical Leader
CCIE 4168 (R&S, SP)
harold@cisco.com
México móvil: +52 1 55 8312 4915
Cisco México
Paseo de la Reforma 222
Piso 19
Cuauhtémoc, Juárez
Ciudad de México, 06600
México

alanchia2000 · ‎05-27-2009

Curious,when I tried the proposed solution:

ip route vrf clientA 192.168.3.1 255.255.255.255 lo1

I got this error message:

% For VPN routes, must specify a next hop IP address if not a point-to-point interface

Does a Cisco 3750 have anything to do the error?

Anyway, I tried another way which also did not work:

ip route vrf clientA 192.168.3.0 255.255.255.0 Loopback1 192.168.3.1

Any clue?

Harold Ritter · ‎05-28-2009

Alan,

My mistake. This is indeed the normal behavior. I had run my test using an IOS image of mine that didn't have this restriction.

Given this restriction, you will not be able to ping the loopback residing in the global. May I ask what it is that you are trying to achieve with that test?

Regards

Harold Ritter
Sr Technical Leader
CCIE 4168 (R&S, SP)
harold@cisco.com
México móvil: +52 1 55 8312 4915
Cisco México
Paseo de la Reforma 222
Piso 19
Cuauhtémoc, Juárez
Ciudad de México, 06600
México

alanchia2000 · ‎05-28-2009

This was a simple set up to test the behaviour of VRF. In the actual set up, the loopback interface will not be there, rather, it will be a physcial interface. And what I was planning to achieve was to be assured that I easily diagnose issues with just ping test alone. However, it seems that the global interfaces cannot be ping-ed from the VRF zone. Which may make my diagnostic job a little tougher.