Thank you,
From your point of view, the weakness of that kind of architecture does not come from the vrf concept but from the security of the interconnexion ?
With a route-map, we get a stateless accesslist filtering, with a firewall a stateful filtering.
To fully understand what you say :
Router :
ip vrf blue
rd 800:1
route-target export 800:1
route-target import 800:1
ip vrf red
rd 900:1
route-target export 900:1
route-target import 900:1
int fa0/0
description FW_IN
ip vrf forwarding blue
ip address 10.10.0.2 255.255.255.0
int fa0/1
description FW_OUT
ip vrf forwarding red
ip address 10.10.1.2 255.255.255.0
ip route vrf blue 10.10.1.0 255.255.255.0 10.10.0.1
ip route vrf red 10.10.0.0 255.255.255.0 10.10.1.1
Firewall with two interfaces 10.10.0.1 ; 10.10.1.1
Is my architecture correct ?
