I'm working on a configuring stuff on a Cisco Nexus 3k based platform and trying to isolate different things into different VRFs which should not be able to talk to each other.

Some of these VRFs have RFC1918 addressing but need to be able to reach the internet so we have set up a VRF aptly called nat in which a default route is advertised by NAT gateways. We need these gateways because this particular model of Nexus does not support NAT itself.

It set up BGP to leak the default route from vrf nat to vrf blue. And the other way around, of course, because the return packets need to be able to get to the hosts in vrf blue. This is working great.

Now I want to do the same thing for vrf red but if I leak from vrf nat to vrf red, hosts in vrf red will be able to reach hosts in vrf blue by being routed through vrf nat by the default route. And vice-versa.

All the examples I've seen of multiple vrfs with a common shared vrf maintain isolation between red and blue by filtering what prefixes are being redistributed/announced. That doesn't help me because I want to announce in its entirety to both vrf red and vrf blue.

Is there a good way to do this or do I need to let go of the concept of a shared NAT vrf and give the NAT gateways interfaces in all the natted VRFs?

  • What happens after the NAT gateway? Can traffic go from blue through the nat and then to the red (natted) address?
    – Ron Trunk
    Aug 21, 2018 at 13:24
  • no, the NAT gateways are configured to not allow that. It's the nexus hops between the hosts and the nat gateway I'm worried about.
    – Marlies
    Aug 21, 2018 at 13:27

2 Answers 2


Turns out, it is possible :)

At first we had some difficulty getting redistribution of the default route from OSPF to the BGP instance used for route leaking working. So I ended up 'just' doing a network in (router bgp 65000 > vrf nat > address-family ipv4 unicast).

But when I managed to redistribute the default route from OSPF into the vrf, the result in terms of the routing tables of vrf blue and vrf red looked identical as with the static approach but behaviour was different. In this case the switches are smart enough to not actually forward packets from vrf red to vrf blue and vice versa even though the route table suggests it would.


You will have to keep the VRFs separate until the traffic reaches a firewall or similar device. That will probably mean separate NAT devices for each VRF.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.