VRF to Global Internet Access (IOS-XR)
Last updated
Last updated
Load vpnv4.inet.access.init.cfg
L3VPN is fully setup. BGP is established with R1 and XR2 in the default table.
Allow R7 and R8 to have access to the internet via XR1.
They should both be able to ping 20.20.20.20.
Do not use NAT to accomplish this.
Route leaking between a VRF and the global table is done under the VRF config using the “import/export to” statement.
My first thought was to try to use a static route between the global table and VRF table to leak routes, but this didn’t work. There is no “global” keyword for VRF static routes on IOS-XR like we have on IOS-XE.
Instead, we leak routes under the VRF config itself. The configuration leaks the VPN loopbacks (7.7.7.7/32 and 8.8.8.8/32) into the default/global table, and leaks all routes (PASS policy) into the VRF.
The global table now has the CE loopbacks. The route contains the service label from the VPN route.
The VRF table also has the individual routes of the global table:
Now XR1 just needs to originate a default route into the VRF in order to draw internet traffic:
CE7 and CE8 can ping 20.20.20.20:
Note that for this to work, XR1 must run BGP for the default and VRF tables. The import and export policies work by exporting BGP routes between the tables. Therefore, at a minimum, you need to run BGP and advertise the routes even if you have no BGP neighbors.
