VRF routing support

VRF supports static routing, OSPF, and BGP. Other routing protocols require using VDOMs.

BGP

The following BGP examples are provided:

• BGP example 1: update VRF neighbors

• BGP example 2: use overlapping subnets

BGP example 1: update VRF neighbors

In this example, BGP is used to update the VRF that it is neighbors with.

The hub is configured with two neighbors connected to two interfaces. The branches are configured to match the hub, with branch networks configured to redistribute into BGP.

Policies must be created on the hub and branches to allow traffic between them.

To configure the hub:

config router bgp
    set as 65000
    config neighbor
        edit "10.101.101.2"
            set soft-reconfiguration enable
            set interface "port2"
            set remote-as 65101
            set update-source "port2"
        next
        edit "10.102.102.2"
            set soft-reconfiguration enable
            set interface "port3"
            set remote-as 65102
            set update-source "port3"
        next
    end
end

To configure branch 101:

config router bgp
    set as 65101
    config neighbor
        edit "10.101.101.1"
            set soft-reconfiguration enable
            set interface "port2"
            set remote-as 65000
            set update-source "port2"
        next
    end
    config redistribute connected
        set status enable
    end
end

To configure branch 102:

config router bgp
    set as 65102
    config neighbor
        edit "10.102.102.1"
            set soft-reconfiguration enable
            set interface "port2"
            set remote-as 65000
            set update-source "port2"
        next
    end
    config redistribute connected
        set status enable
    end
end

To verify the BGP neighbors and check the routing table on the hub:

# get router info bgp summary
BGP router identifier 192.168.0.1, local AS number 65000
BGP table version is 2
2 BGP AS-PATH entries
0 BGP community entries

Neighbor 		V	AS		MsgRcvd	MsgSent	TblVer	InQ	OutQ Up/Down	State/PfxRcd
10.101.101.2	4	65101		4		4		2		0	0	00:01:05	3
10.102.102.2	4	65102		3		3		1		0	0	00:00:30	3

Total number of neighbors 2

# get router info routing-table all
Routing table for VRF=0
Codes (…)
S*	0.0.0.0/0 [10/0] via 192.168.0.254, port1
C	10.101.101.0/24 is directly connected, port2
C	10.102.102.0/24 is directly connected, port3
C	192.168.0.0/24 is directly connected, port1
B	192.168.101.0/24 [20/0] via 10.101.101.2, port2, 00:01:25
B	192.168.102.0/24 [20/0] via 10.102.102.2, port3, 00:00:50

To configure VRF on the hub:

1. Put the interfaces into VRF:

   config system interface
       edit port2
           set vrf 10
       next
       edit port3
           set vrf 20
       next
   end
   

2. Restart the router to reconstruct the routing tables:

   # execute router restart

3. Check the routing tables:

   # get router info routing-table all
   Routing table for VRF=0
   Codes (…)
   S*	0.0.0.0/0 [10/0] via 192.168.0.254, port1
   C	192.168.0.0/24 is directly connected, port1
   
   Routing table for VRF=10
   C	10.101.101.0/24 is directly connected, port2
   B	192.168.101.0/24 [20/0] via 10.101.101.2, port2, 00:02:25
   
   Routing table for VRF=20
   C	10.102.102.0/24 is directly connected, port3
   B	192.168.102.0/24 [20/0] via 10.102.102.2, port2, 00:01:50
   

4. Check the BGP summary:

   # get router info bgp summary
   
   VRF 10 BGP router identifier 10.101.101.1, local AS number 65000
   BGP table version is 1
   2 BGP AS-PATH entries
   0 BGP community entries
   
   Neighbor 		V	AS		MsgRcvd	MsgSent	TblVer	InQ	OutQ Up/Down	State/PfxRcd
   10.101.101.2	4	65101		4		4		2		0	0	00:02:05	3
   
   Total number of neighbors 1
   
   VRF 10 BGP router identifier 10.101.101.1, local AS number 65000
   BGP table version is 1
   2 BGP AS-PATH entries
   0 BGP community entries
   
   Neighbor 		V	AS		MsgRcvd	MsgSent	TblVer	InQ	OutQ Up/Down	State/PfxRcd
   10.102.102.2	4	65102		3		3		1		0	0	00:01:30	3
   
   Total number of neighbors 1
   

BGP example 2: use overlapping subnets

Building on BGP example 1: update VRF neighbors, example 2 includes two additional interfaces assigned to different VRFs: port4 belongs to VRF 10, and port5 belongs to VRF 20. The IP address and subnet configuration on port4 and port5 are identical, resulting in subnet overlap.

The hub needs to selectively advertise the overlapping prefix through BGP only to the peer within VRF 10. By default, the config network command of BGP does not advertise prefix on a per-VRF basis.

Thus to achieve selective route advertisement to a BGP peer belonging to specific VRF, route maps can be used.

To configure the hub:

1. Allow configuration of subnet overlap:

   config system settings
       set allow-subnet-overlap enable
   end

2. Configure IP addresses on port4 and port5:

   config system interface
       edit "port4"
           set ip 192.168.103.1 255.255.255.0
       next
   end
   config system interface
       edit "port5"
           set ip 192.168.103.1 255.255.255.0
       next
   end

3. Put port4 into VRF 10 and port5 into VRF 20:

   config system interface
       edit "port4"
           set vrf 10
       next
   end
   config system interface
       edit "port5"
           set vrf 20
       next
   end

4. Advertise the overlapped subnet inside BGP using the config network command.

   By default, prefix 192.168.103.0/24 is advertised to BGP peers of all VRFs.

   config router bgp
       set as 65000
       config neighbor
           edit "10.101.101.2"
               set soft-reconfiguration enable
               set interface "port4"
               set remote-as 65101
               set update-source "port4"
           next
           edit "10.102.102.2"
               set soft-reconfiguration enable
               set interface "port3"
               set remote-as 65102
               set update-source "port3"
           next
       end
       config network
           edit 1
               set prefix 192.168.103.0 255.255.255.0
           next
       end
   end

To verify the routing table before using route-map:

1. Verify that the routing table on Branch 101 displays only BGP routes:

   # get router info routing-table bgp 
   Routing table for VRF=0
   B       192.168.103.0/24 [20/0] via 10.102.102.1, port2, 00:17:04, [1/0]

2. Verify that the routing table on Branch 102 displays only BGP routes:

   # get router info routing-table bgp 
   Routing table for VRF=0
   B       192.168.103.0/24 [20/0] via 10.101.101.1, port2, 00:18:48

To use a route map to advertise a prefix for each VRF:

1. Configure route-map on hub to match VRF 10:

   config router route-map
       edit "VRF_10"
           config rule
               edit 1
                   set match-vrf 10
               next
           end
       next
   end

2. Use route-map inside hub's BGP configuration (that is, inside the config network command) to selectively advertise a prefix 192.168.103.0/24 to BGP peers that belong to VRF 10 (that is, Branch 101):

   config router bgp
       set as 65000
       config neighbor
           edit "10.101.101.2"
               set soft-reconfiguration enable
               set interface "port4"
               set remote-as 65101
               set update-source "port4"
           next
           edit "10.102.102.2"
               set soft-reconfiguration enable
               set interface "port3"
               set remote-as 65102
               set update-source "port3"
           next
       end
       config network
           edit 1
               set prefix 192.168.103.0 255.255.255.0
               set route-map "VRF_10"
           next
       end
   end

To verify the routing table after using route-map:

1. Verify the routing table on Branch 101:

   # get router info routing-table bgp 
   Routing table for VRF=0
   B       192.168.103.0/24 [20/0] via 10.102.102.1, port2, 00:17:04, [1/0]

2. Check the routing table on Branch 102. The routes are not advertised to BGP peer belonging to VRF 20.

   # get router info routing-table bgp 
   No route available

3. Verify advertised BGP routes on hub on per-neighbor basis:

   # get router info bgp neighbors 10.101.101.2 advertised-routes
   VRF 10 BGP table version is 1, local router ID is 192.168.103.1
   Status codes: s suppressed, d damped, h history, * valid, > best, i - internal
   Origin codes: i - IGP, e - EGP, ? - incomplete
   
      Network          Next Hop            Metric     LocPrf Weight RouteTag Path
   *> 192.168.103.0    10.101.101.1                  100  32768        0 i <-/->
   
   Total number of prefixes 1
   
   # get router info bgp neighbors 10.102.102.2 advertised-routes
   % No prefix for neighbor 10.102.102.2

OSPF

OSPF routes in VRFs work the same as BGP: the interface that OSPF is using is added to the VRF.

To configure the hub:

1. Configure OSPF:

   config router ospf
       set router-id 1.1.1.1
       config area
           edit 0.0.0.0
           next
       end
       config ospf-interface
           edit Branch101
               set interface “port2”
               set dead-interval 40
               set hello-interval 10
           next
           edit Branch102
               set dead-interval 40
               set hello-interval 10
           next
       end
       config network
           edit 0
               set prefix 10.101.101.0 255.255.255.0
           next
           edit 0
               set prefix 10.102.102.0 255.255.255.0
           next
           edit 0
               set prefix 192.168.1.0 255.255.255.0
           next
       end
   end

2. Put the interfaces into VRF:

   config system interface
       edit port2
           set vrf 10
       next
       edit port3
           set vrf 20
       next
   end
   

To configure branch 101:

config router ospf
    set router-id 101.101.101.101
    config area
        edit 0.0.0.0
        next
    end
    config ospf-interface
        edit HUB
            set interface port2
            set dead-interval 40
            set hello-interval 10
        next
    end
    config network
        edit 0
            set prefix 10.101.101.0 255.255.255.0
        next
        edit 0
            set prefix 192.168.101.0 255.255.255.0
        next
    end
end

To check the routing table and OSPF summary:

# get router info routing-table ospf

# get router info ospf interface

Static route

Static routes in VRFs work the same as BGP and OSPF because the interface that the static route is using is added to the VRF.

To add a VRF ID in a static route in the GUI:

1. Configure the interface:

   1. Go to Network > Interfaces.

   2. Click Create New > Interface or Edit an existing interface.

   3. Enter a value in the VRF ID field.

   4. Configure the other settings as needed.

   5. Click OK.

2. Add a static route to VRF. For example, using blackhole:

   1. Go to Network > Static Routes.

   2. Click Create New and select the type of static route.

   3. Enter a Subnet.

   4. In the Interface field, select Blackhole.

   5. In the VRF ID field, enter the ID created in step one.

   6. Click OK.

To add a VRF ID in a static route in the CLI:

1. Configure the interface:

   config system interface
       edit port2
           set vrf 10
       next
   end

2. Add a static route to the VRF. For example, using blackhole:

   config router static
       edit 3
           set dst 0.0.0.0/0
           set blackhole enable
           set vrf 10
       next
   end

A static route can also be added to the VRF when using an IPsec interface by enabling VPN ID with IPIP encapsulation. See SD-WAN segmentation over a single overlay for more information.

To add a static route to the VRF when using IPsec:

config vpn ipsec phase1-interface
    edit "vpn1"
        set interface "port2"
        set auto-discovery-receiver enable
        set encapsulation vpn-id-ipip
        set remote-gw 1.1.101.1
        set psksecret ******
    next
end
config router static
    edit 1
        set dst 10.32.0.0 255.224.0.0
        set device "vpn1"
        set vrf 10 
    next
end

To check the routing table:

# get router info routing-table static