search

VRF to Global Internet Access (IOS-XE)

Load vpnv4.inet.access.init.cfg

#IOS-XE
config replace flash:vpnv4.inet.access.init.cfg

#IOS-XR
configure
load bootflash:vpnv4.inet.access.init.cfg
commit replace
y

L3VPN is fully setup, with R7 and R8 as CEs. BGP is established with R1 and XR2 in the default table.

Allow R7 and R8 to have access to the internet via R2.

  • They should both be able to ping 1.1.1.1.

  • Do not configure any new IP addresses on R7 or R8.

  • Do not leak R7s and R8s IP addresses out to the internet.

hashtag
Answer

hashtag
Explanation

The easiest way to provide internet access to a VPN is to run the internet in its own VRF. This allows you to easily use RTs and import policies to provide internet access.

Providing internet access in the global table is not as easy. On IOS-XE, we can point a default route in the VRF to the global table, but we must specify a connected/local nexthop.

We do not have a good way to route the return traffic received in the global table back to the original VRF. The only way I can tell to accomplish this is to use the egress PE NAT feature.

hashtag
Verification

R7 and R8 can ping 1.1.1.1

R2 NATs the source to its interface address. Return traffic is automatically routed back into the VRF via the VRF flag on the NAT entry.

PreviousTroubleshoot #4 (OSPF Inter-AS)NextVRF to Global Internet Access (IOS-XR)

Last updated