Contents

Introduction

Prerequisites

Requirements

Components Used

Background Information

Topology

Initial Verification

Interface and Static Route Configuration

Configuration

Final Verification

Introduction

This document describes the process to configure route leak between Global Routing Table (GRT) to VRF with Cisco IOS® XR software.

Prerequisites

Requirements

Cisco recommends that you have knowledge of these topics:

- Knowledge of Basic IP Routing

- Knowledge of Cisco IOS and Cisco IOS XR command line

Components Used

This procedure is not restricted to any software release in Cisco IOS XR therefore, all releases can be used to complete the next steps.

The information in this document is based on these software and hardware versions:

- Router with Cisco IOS XR software

- Router with Cisco IOS software

The information in this document was created from the devices in a specific lab environment. All of the devices used in this document started with a cleared (default) configuration. If your network is live, ensure that you understand the potential impact of any command.

Background Information

The purpose of this demonstration is to show the configuration for route leak between global route table and vrf  route table on Cisco IOS XR.

Topology

Initial Verification

Interface and Static Route Configuration

ASR9901-1

RP/0/RSP0/CPU0:ASR9901-1#show run interface gi0/0/0/0

Wed Oct 19 15:21:21.122 UTC

interface GigabitEthernet0/0/0/0

cdp

vrf ORANGE

ipv4 address 192.168.10.1 255.255.255.0

!

RP/0/RSP0/CPU0:ASR9901-1#show run router static

Tue Feb  7 19:24:42.730 UTC

router static

vrf ORANGE

address-family ipv4 unicast

172.16.20.0/24 192.168.10.2

ASR9901-2

RP/0/RSP0/CPU0:ASR9901-2#show run int gi0/0/0/0

Wed Oct 19 15:40:18.599 UTC

interface GigabitEthernet0/0/0/0

cdp

vrf ORANGE

ipv4 address 192.168.10.2 255.255.255.0

!

RP/0/RSP0/CPU0:ASR9901-2#show run int gi0/0/0/6

Wed Oct 19 15:41:08.593 UTC

interface GigabitEthernet0/0/0/6

cdp

ipv4 address 172.16.20.1 255.255.255.0

!

CISCO2911-3

CISCO2911-3#show run interface gigabitEthernet0/1

Building configuration...

Current configuration : 100 bytes

!

interface GigabitEthernet0/0

ip address 172.16.20.2 255.255.255.0

duplex auto

speed auto

end

CISCO2911-3#show run | section ip route

ip route 192.168.10.0 255.255.255.0 172.16.20.1

Test connectivity with ping, for example, ASR9901-1 can ping ASR9901-2 on VRF ORANGE.

RP/0/RSP0/CPU0:ASR9901-1#ping vrf ORANGE 192.168.10.2

Wed Oct 19 15:57:50.548 UTC

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 192.168.10.2, timeout is 2 seconds:

!!!!!

Success rate is 100 percent (5/5), round-trip min/avg/max = 2/2/3 ms

ASR9901-2 can ping CISCO2911-3 on default vrf (GRT).

RP/0/RSP0/CPU0:ASR9901-2#ping 172.16.20.2

Wed Oct 19 15:58:05.961 UTC

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 172.16.20.2, timeout is 2 seconds:

!!!!!

Success rate is 100 percent (5/5), round-trip min/avg/max = 1/1/2 ms

If you try to test the reachability from subnet 192.168.10.0/24 on ASR9K-1 (VRF ORANGE) to subnet 172.16.20.0/24 located on router 2911, this test must fail as no configuration has been implemented on ASR9K-2 to complete the connectivity between VRF ORANGE and the GRT.

RP/0/RSP0/CPU0:ASR9901-1#ping 172.16.20.2 vrf ORANGE

Wed Oct 19 19:45:11.801 UTC

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 172.16.20.2, timeout is 2 seconds:

.....

Success rate is 0 percent (0/5)

Configuration

Step1. Configure a BGP process in ASR9K-2, this is the router that performs the route leak and where the configuration needs to be applied. Besides the creation of the BGP process, you need to use some network statements to make sure that the prefixes that you plan to leak get installed in the corresponding BGP table:

RP/0/RSP0/CPU0:ASR9901-2#show run router bgp

Wed Oct 19 20:21:55.118 UTC

router bgp 100

bgp router-id 10.10.10.10

address-family ipv4 unicast

network 172.16.20.0/24

!

address-family vpnv4 unicast

!

vrf ORANGE

rd 100:100

address-family ipv4 unicast

network 192.168.10.0/24

!

!

!

RP/0/RSP0/CPU0:ASR9901-2#

As you can see, there is no need to create any BGP neighborship, BGP is needed to place these prefixes into the BGP table.

Step 2. Configure the route policies, these policies are intended to help you filter which prefixes are permitted to be leaked. In this example, the route-policy GLOBAL-2-VRF and route-policy VRF-2-GLOBAL are used.

RP/0/RSP0/CPU0:ASR9901-2#show run route-policy GLOBAL-2-VRF

Wed Oct 19 20:37:56.548 UTC

route-policy GLOBAL-2-VRF

if destination in (172.16.20.0/24) then

pass

endif

end-policy

!

RP/0/RSP0/CPU0:ASR9901-2#show run route-policy VRF-2-GLOBAL

Wed Oct 19 20:38:10.538 UTC

route-policy VRF-2-GLOBAL

if destination in (192.168.10.0/24 le 32) then

pass

endif

end-policy

!

RP/0/RSP0/CPU0:ASR9901-2#

Step 3. Configure the VRF and apply the route-policy created at the previous step with the commands import from default-vrf route-policy <policy name> and export to default-vrf route-policy <policy name> as shown in the next output:

RP/0/RSP0/CPU0:ASR9901-2#show run vrf ORANGE

Wed Oct 19 20:40:38.851 UTC

vrf ORANGE

address-family ipv4 unicast

import from default-vrf route-policy GLOBAL-2-VRF

import route-target

100:100

!

export to default-vrf route-policy VRF-2-GLOBAL

export route-target

100:100

!

!

!

RP/0/RSP0/CPU0:ASR9901-2#

Final Verification

Once the previous configuration has been committed, you can verify the reachability from subnet 192.168.10.0/24 on ASR9K-1 (VRF ORANGE) to subnet 172.16.20.0/24 located on router 2911, which initially failed. However, with the appropriate configuration, this ping test is now successful:

RP/0/RSP0/CPU0:ASR9901-1#ping 172.16.20.2 vrf ORANGE

Wed Oct 19 22:07:47.897 UTC

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 172.16.20.2, timeout is 2 seconds:

!!!!!

Success rate is 100 percent (5/5), round-trip min/avg/max = 2/2/3 ms

RP/0/RSP0/CPU0:ASR9901-1#

A debug ip icmp configured on the router 2911 can also help to verify if the router send the echo reply back to ASR9K-1:

CISCO2911-3#debug ip icmp

ICMP packet debugging is on

CISCO2911-3#

CISCO2911-3#

*Oct 19 21:34:20.069: ICMP: echo reply sent, src 172.16.20.2, dst 192.168.10.1, topology BASE, dscp 0 topoid 0

*Oct 19 21:34:20.073: ICMP: echo reply sent, src 172.16.20.2, dst 192.168.10.1, topology BASE, dscp 0 topoid 0

*Oct 19 21:34:20.077: ICMP: echo reply sent, src 172.16.20.2, dst 192.168.10.1, topology BASE, dscp 0 topoid 0

*Oct 19 21:34:20.077: ICMP: echo reply sent, src 172.16.20.2, dst 192.168.10.1, topology BASE, dscp 0 topoid 0

*Oct 19 21:34:20.081: ICMP: echo reply sent, src 172.16.20.2, dst 192.168.10.1, topology BASE, dscp 0 topoid 0

CISCO2911-3#

Another verification is to check if the prefixes appear in the RIB and BGP tables, for this example, the GRT or default-vrf shows the next information:

RP/0/RSP0/CPU0:ASR9901-2#show route

Wed Oct 19 22:15:03.930 UTC

Codes: C - connected, S - static, R - RIP, B - BGP, (>) - Diversion path

D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area

N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2

E1 - OSPF external type 1, E2 - OSPF external type 2, E - EGP

i - ISIS, L1 - IS-IS level-1, L2 - IS-IS level-2

ia - IS-IS inter area, su - IS-IS summary null, * - candidate default

U - per-user static route, o - ODR, L - local, G  - DAGR, l - LISP

A - access/subscriber, a - Application route

M - mobile route, r - RPL, t - Traffic Engineering, (!) - FRR Backup path

Gateway of last resort is not set

C    10.88.174.0/24 is directly connected, 1d20h, MgmtEth0/RSP0/CPU0/0

L    10.88.174.223/32 is directly connected, 1d20h, MgmtEth0/RSP0/CPU0/0

L    10.10.10.10/32 is directly connected, 04:33:44, Loopback100

C    172.16.20.0/24 is directly connected, 07:03:18, GigabitEthernet0/0/0/6

L    172.16.20.1/32 is directly connected, 07:03:18, GigabitEthernet0/0/0/6

B    192.168.10.0/24 is directly connected, 03:02:21, GigabitEthernet0/0/0/0 (nexthop in vrf ORANGE)

RP/0/RSP0/CPU0:ASR9901-2#

RP/0/RSP0/CPU0:ASR9901-2#show ip bgp

Wed Oct 19 22:15:13.069 UTC

BGP router identifier 10.10.10.10, local AS number 100

BGP generic scan interval 60 secs

Non-stop routing is enabled

BGP table state: Active

Table ID: 0xe0000000   RD version: 5

BGP main routing table version 5

BGP NSR Initial initsync version 3 (Reached)

BGP NSR/ISSU Sync-Group versions 0/0

BGP scan interval 60 secs

Status codes: s suppressed, d damped, h history, * valid, > best

i - internal, r RIB-failure, S stale, N Nexthop-discard

Origin codes: i - IGP, e - EGP, ? - incomplete

Network            Next Hop            Metric LocPrf Weight Path

*> 172.16.20.0/24     0.0.0.0                  0         32768 i

*> 192.168.10.0/24    0.0.0.0                  0         32768 i

Processed 2 prefixes, 2 paths

RP/0/RSP0/CPU0:ASR9901-2#

Now, the next output shows the information displayed for the VRF ORANGE:

RP/0/RSP0/CPU0:ASR9901-2#show route vrf ORANGE

Wed Oct 19 22:21:24.559 UTC

Codes: C - connected, S - static, R - RIP, B - BGP, (>) - Diversion path

D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area

N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2

E1 - OSPF external type 1, E2 - OSPF external type 2, E - EGP

i - ISIS, L1 - IS-IS level-1, L2 - IS-IS level-2

ia - IS-IS inter area, su - IS-IS summary null, * - candidate default

U - per-user static route, o - ODR, L - local, G  - DAGR, l - LISP

A - access/subscriber, a - Application route

M - mobile route, r - RPL, t - Traffic Engineering, (!) - FRR Backup path

Gateway of last resort is not set

B    172.16.20.0/24 is directly connected, 01:43:49, GigabitEthernet0/0/0/6 (nexthop in vrf default)

C    192.168.10.0/24 is directly connected, 07:06:38, GigabitEthernet0/0/0/0

L    192.168.10.2/32 is directly connected, 07:06:38, GigabitEthernet0/0/0/0

RP/0/RSP0/CPU0:ASR9901-2#

RP/0/RSP0/CPU0:ASR9901-2#

RP/0/RSP0/CPU0:ASR9901-2#show bgp vrf ORANGE

Wed Oct 19 22:21:34.887 UTC

BGP VRF ORANGE, state: Active

BGP Route Distinguisher: 100:100

VRF ID: 0x60000003

BGP router identifier 10.10.10.10, local AS number 100

Non-stop routing is enabled

BGP table state: Active

Table ID: 0xe0000012   RD version: 9

BGP main routing table version 9

BGP NSR Initial initsync version 4 (Reached)

BGP NSR/ISSU Sync-Group versions 0/0

Status codes: s suppressed, d damped, h history, * valid, > best

i - internal, r RIB-failure, S stale, N Nexthop-discard

Origin codes: i - IGP, e - EGP, ? - incomplete

Network            Next Hop            Metric LocPrf Weight Path

Route Distinguisher: 100:100 (default for vrf ORANGE)

*> 172.16.20.0/24     0.0.0.0                  0         32768 i

*> 192.168.10.0/24    0.0.0.0                  0         32768 i

Processed 2 prefixes, 2 paths