Leak default route to multiple VRFs while keeping VRFs isolated from each other

Question

I'm working on a configuring stuff on a Cisco Nexus 3k based platform and trying to isolate different things into different VRFs which should not be able to talk to each other.

Some of these VRFs have RFC1918 addressing but need to be able to reach the internet so we have set up a VRF aptly called nat in which a default route is advertised by NAT gateways. We need these gateways because this particular model of Nexus does not support NAT itself.

It set up BGP to leak the default route from vrf nat to vrf blue. And the other way around, of course, because the return packets need to be able to get to the hosts in vrf blue. This is working great.

Now I want to do the same thing for vrf red but if I leak 0.0.0.0/0 from vrf nat to vrf red, hosts in vrf red will be able to reach hosts in vrf blue by being routed through vrf nat by the default route. And vice-versa.

All the examples I've seen of multiple vrfs with a common shared vrf maintain isolation between red and blue by filtering what prefixes are being redistributed/announced. That doesn't help me because I want to announce 0.0.0.0/0 in its entirety to both vrf red and vrf blue.

Is there a good way to do this or do I need to let go of the concept of a shared NAT vrf and give the NAT gateways interfaces in all the natted VRFs?

Answer 1

Turns out, it is possible :)

At first we had some difficulty getting redistribution of the default route from OSPF to the BGP instance used for route leaking working. So I ended up 'just' doing a network 0.0.0.0/0 in (router bgp 65000 > vrf nat > address-family ipv4 unicast).

But when I managed to redistribute the default route from OSPF into the vrf, the result in terms of the routing tables of vrf blue and vrf red looked identical as with the static approach but behaviour was different. In this case the switches are smart enough to not actually forward packets from vrf red to vrf blue and vice versa even though the route table suggests it would.

Answer 2

You will have to keep the VRFs separate until the traffic reaches a firewall or similar device. That will probably mean separate NAT devices for each VRF.