topic Re: Multi-VR routes and security policies issues in General Topics

Multi-VR routes and security policies issues

CZaloba — Sun, 14 Feb 2016 22:06:49 GMT

I have an issue where we have mulit-VRs in place 1) default and 2nd) VR that is utilized for DMZ and untrust routes

Both VR's share a common zone name "public" for example.

I have issues routing where for instance I have my internal network segments in the VR's FIB's and my routed networks fail to return back through the correct interfaces.

I have a need for select internal subnets but RFC 1918 and Public routed ranges reaching into into the DMZ for administrating a Server.

The security policy logic is in place and sound transit zone VR default > public zone (VR Untrust/DMZ) with applications ssh,ssh-tunnel.

This DMZ server also has restricted subnets from Public zone to allow Untrust traffic to server.

Issue my my server works from untrust perspective, however if my more trusted zones access the server in the DMZ I don't get traffic there.

Server is a Virtualized we got it to route properly once we added a second v-nic to the host server and had the server administrator add static routes pointing out a different gateway which lays in the VR default.

I am hoping as we build and scale this network edge / dmz services over the internet that we don't have to apply host routing and allow OSPF to take place and advertise into both respected Virtual Routers.

Still working with TAC on this.

Re: Multi-VR routes and security policies issues

reaper — Mon, 15 Feb 2016 13:05:02 GMT

Hi!

could you provide a schematic to help us gain some insight into your design ?

If you want to keep networks separate through multiple VRs, I would recommend also changing the zones so none are shared to prevent confusion or accidental overlap. To enable intra-VR routing, static routes need to be added in the VR where you assign the other VR as next hop and a returning static route needs to be in place to allow the traffic to take the same route back

Re: Multi-VR routes and security policies issues

CZaloba — Thu, 24 Mar 2016 12:03:06 GMT

Sorry for not getting back we ended up putting static routes to next hop vr XYZ. Until we want to decide going down the BGP option or the OSPF with loopback (port to port) on PA in different VR's.