[c-nsp] IOSXE / route leaking between VRFs and GT

[Vladislav A. VASILEV]

I've got the following three requirements:

1) perform 2) and 3) on the same router
2) source NAT private networks (received as mp-bgp routes) on R1 (no issues
here)
3) leak select mp-bgp prefixes into the global table (from a CP perspective
routes are being leaked, but I can't get any traffic through)

here's the test topology:

global_table---R1---vasileft1---vasiright1---vrf_table---R1(PE)[ge1]---mp-bgp_routes----[ge1]R2(PE)


All config being tested on:
Cisco IOS XE Software, Version 17.03.02
Cisco IOS Software [Amsterdam], Virtual XE Software
(X86_64_LINUX_IOSD-UNIVERSALK9-M), Version 17.3.2, RELEASE SOFTWARE (fc3)

in summary: R1's loopback1 (in global table) needs connectivity to R2's
loopback1 (in VRF A)

Configuration on R1:

hostname R1

vrf definition A
rd 1:1
route-target export 1:1
route-target import 1:1
address-family ipv4
export ipv4 unicast map to-global
exit-address-family

interface Loopback0
ip address 1.1.1.1 255.255.255.255
ip router isis ISIS
isis circuit-type level-2-only

interface Loopback1
ip address 11.11.11.11 255.255.255.255

interface GigabitEthernet1
ip address 10.10.1.1 255.255.255.252
ip router isis ISIS
negotiation auto
no mop enabled
no mop sysid
isis circuit-type level-2-only
isis network point-to-point

interface vasileft1
ip address 10.10.2.1 255.255.255.252
no keepalive

interface vasiright1
vrf forwarding A
ip address 10.10.2.2 255.255.255.252
no keepalive

segment-routing mpls
connected-prefix-sid-map
address-family ipv4
1.1.1.1/32 index 1 range 1
exit-address-family

router isis ISIS
net 49.0000.0000.0001.00
is-type level-2-only
metric-style wide
segment-routing mpls

router bgp 1
bgp router-id 1.1.1.1
bgp log-neighbor-changes
neighbor 2.2.2.2 remote-as 1
neighbor 2.2.2.2 update-source Loopback0
address-family vpnv4
neighbor 2.2.2.2 activate
neighbor 2.2.2.2 send-community extended
address-family ipv4 vrf A
redistribute static <--- redistribute the leaked route from GT to VRF A

ip route vrf A 11.11.11.11 255.255.255.255 10.10.2.1 <-- leak global route
into VRF A
ip prefix-list to-global seq 10 permit 22.22.22.22/32

route-map to-global permit 10
match ip address prefix-list to-global
set ip next-hop 10.10.2.2 <------- without setting the next-hoop to
vasiright1's IP the route does not get leaked

R1#sh ip ro

1.0.0.0/32 is subnetted, 1 subnets
C 1.1.1.1 is directly connected, Loopback0
2.0.0.0/32 is subnetted, 1 subnets
i L2 2.2.2.2 [115/20] via 10.10.1.2, 00:20:55, GigabitEthernet1
10.0.0.0/8 is variably subnetted, 4 subnets, 2 masks
C 10.10.1.0/30 is directly connected, GigabitEthernet1
L 10.10.1.1/32 is directly connected, GigabitEthernet1
C 10.10.2.0/30 is directly connected, vasileft1
L 10.10.2.1/32 is directly connected, vasileft1
11.0.0.0/32 is subnetted, 1 subnets
C 11.11.11.11 is directly connected, Loopback1
22.0.0.0/32 is subnetted, 1 subnets
*B 22.22.22.22 [200/0] via 10.10.2.2 (A), 00:09:50*

R1#sh ip ro 22.22.22.22
Routing entry for *22.22.22.22/32 <http://22.22.22.22/32>*
Known via "bgp 1", distance 200, metric 0, type internal
Last update from 10.10.2.2 00:10:10 ago
Routing Descriptor Blocks:
* *10.10.2.2 (A)*, from 2.2.2.2, 00:10:10 ago
opaque_ptr 0x7F13B34F1938
Route metric is 0, traffic share count is 1
AS Hops 0
MPLS label: none

R1#sh ip ro vrf A
10.0.0.0/8 is variably subnetted, 2 subnets, 2 masks
C 10.10.2.0/30 is directly connected, vasiright1
L 10.10.2.2/32 is directly connected, vasiright1
11.0.0.0/32 is subnetted, 1 subnets
S 11.11.11.11 [1/0] via 10.10.2.1
22.0.0.0/32 is subnetted, 1 subnets
*B 22.22.22.22 [200/0] via 2.2.2.2, 00:10:39*



R2#sh ip ro vrf A
11.0.0.0/32 is subnetted, 1 subnets
*B 11.11.11.11 [200/0] via 1.1.1.1, 00:09:29*
22.0.0.0/32 is subnetted, 1 subnets
C 22.22.22.22 is directly connected, Loopback1


Thank you!
Vladislav Vasilev