Juniper MX: Leaking routes from RIB into VRF

Question

Aim

We have a firewall terminating IPSec VPNs to AWS. These are used in the event of failure of a pair of AWS Direct Connects. Currently, the VPNs are routed to AWS over the same Direct Connects that they are backing up - if the Direct Connects stop routing traffic for some reason, the VPNs break also.

Proposed Solution

Create a VRF on Juniper MX into which we import AWS routes learned from Transit and not those learned from the Direct Connects.

Implementation

phil@mx# show routing-instances
be-fw-tunnels {
    instance-type virtual-router;
    interface ae0.336;
    routing-options {
        instance-import vrf_be_fw_tunnels;
    }
}

phil@mx# show policy-options policy-statement vrf_be_fw_tunnels
term no_aws_direct {
    from {
        instance master;
        community Direct;
    }
    then reject;
}
term aws_indirect {
    from {
        instance master;
        as-path aws-indirect;
    }
    then accept;
}
term no_more {
    then reject;
}

phil@mx# show policy-options as-path aws-indirect
".* (14618|16509)$";

Problem

The solution works to the extent that some Amazon routes are leaked into the VRF however only for prefixes which are not advertised by Amazon on the Direct Connect at all. This is, I presume, because instance-import imports from the FIB and the routes of interest installed in the FIB are all from the Direct Connect peering.

Question

Is it possible to import into a VRF from the RIB, such that all possible routes are considered for import... not just the currently active ones?

Answer 1

The solution seems to be to use rib-group. I always assumed rib-group and instance-import were interchangeable though, as the name suggests, rib-group works in the RIB whereas instance-import only works on the FIB.

Syntax is significantly more complex but it's nice in such that you can apply rib-group to individual BGP peers which avoids the need to explicitly filter out the routes you don't want.

phil@mx# show routing-instances
be-fw-tunnels {
    description "VRF importing specific DFZ routes for use by BE FW tunnels";
    instance-type virtual-router;
    interface ae0.236;
}

phil@mx# show routing-options rib-groups
/* Export some IPv4 routes from the main table into the be-fw-tunnels table */
be-fw-tunnels-v4 {
    import-rib [ inet.0 be-fw-tunnels.inet.0 ];
    import-policy vrf_be_fw_tunnels;
}
/* Export some IPv6 routes from the main table into the be-fw-tunnels table */
be-fw-tunnels-v6 {
    import-rib [ inet6.0 be-fw-tunnels.inet6.0 ];
    import-policy vrf_be_fw_tunnels;
}

phil@mx# show policy-options policy-statement vrf_be_fw_tunnels
term aws_indirect {
    from as-path aws-indirect;
    then accept;
}
term no_more {
    then reject;
}

phil@mx# show groups
/* Apply to BGP groups from which you want to export certain routes to the be-fw-tunnels VRF */
aws-to-vrf-v4 {
    protocols {
        bgp {
            group <*> {
                neighbor "<[0-9]*.[0-9]*.[0-9]*.[0-9]*>" {
                    family inet {
                        unicast {
                            rib-group be-fw-tunnels-v4;
                        }
                    }
                }
            }
        }
    }
}
/* Apply to BGP groups from which you want to export certain routes to the be-fw-tunnels VRF */
aws-to-vrf-v6 {
    protocols {
        bgp {
            group <*> {
                neighbor <*:*:*> {
                    family inet6 {
                        unicast {
                            rib-group be-fw-tunnels-v6;
                        }
                    }
                }
            }
        }
    }
}

phil@mx# show protocols bgp group Transit
apply-groups [ aws-to-vrf-v4 aws-to-vrf-v6 ];
...