Not all the companies will continue to be considered trusted entities. The link into the MPLS cloud delivers traffic from multiple locations advertised from a single BGP peering session with the PE. Some of those locations will remain internal/trusted sources while others will be considered external/untrusted. Also, the Internet traffic is delivered form this same connection.
The objective is to separate traffic onto different layer 3 links as they exit the edge router. This will allow us to provide firewall services with the traffic landing on different interfaces of a transparent firewall. Since the interfaces are separate, they'll ACLs will be separate as well.
There is support for VRF selection with PBR, but the interface must be removed from the VRF and the "ip vrf receive" used instead. So we cannot learn the routes via BGP in a VRF, and so they land in the global routing table.
We still desire to have the traffic exit the edge router on L3 links that are in separate VRFs. This means we need to dynamically and bidirectionally share routing information from the VRFs that point inside to the firewall with the global routing table.
There is support for importing routes from the global routing table to a VRF using "import ipv4 unicast". However, I cannot find a direct method to dynamically import routes from a VRF to the global routing table.
With a back to back connection, would the traffic flow across the link or would it simply be a method of learning the routes and hext hop?
