I'm working on a configuring stuff on a Cisco Nexus 3k based platform and trying to isolate different things into different VRFs which should not be able to talk to each other.
Some of these VRFs have RFC1918 addressing but need to be able to reach the internet so we have set up a VRF aptly called
nat in which a default route is advertised by NAT gateways. We need these gateways because this particular model of Nexus does not support NAT itself.
It set up BGP to leak the default route from
vrf nat to
vrf blue. And the other way around, of course, because the return packets need to be able to get to the hosts in
vrf blue. This is working great.
Now I want to do the same thing for
vrf red but if I leak
vrf nat to
vrf red, hosts in
vrf red will be able to reach hosts in
vrf blue by being routed through
vrf nat by the default route. And vice-versa.
All the examples I've seen of multiple vrfs with a common shared vrf maintain isolation between red and blue by filtering what prefixes are being redistributed/announced. That doesn't help me because I want to announce
0.0.0.0/0 in its entirety to both
vrf red and
Is there a good way to do this or do I need to let go of the concept of a shared NAT vrf and give the NAT gateways interfaces in all the natted VRFs?