4

Note - 2022-11-09: We opened a support ticket with Dell and they think it is a software bug. Engineering is supposedly working on it now. This question may become moot, or, they might decide not to fix it and we will need a complete redesign.

I have two Dell S5232F-ON switches running OS10. Each switch has several VRFs to segment network traffic. I want to be able to route traffic between VRFs through a transparent firewall, running VyOS. The plan is to advertise routes with iBGP, but I haven't gotten that far - I can't get the VRFs on the same switch to talk to each other at all.

Router connection diagram

Each firewall only has a single 100G connection, so I need to trunk all the traffic. I can ping from cr00-dmz to cr01-outside (and vice versa), but I can't even get ARP responses between cr00-dmz and cr00-outside.

cr00 configuration

interface vlan50
 mode L3
 no shutdown
 ip vrf forwarding outside
 ip address x.x.x.204/31
!
interface vlan150
 mode L3
 no shutdown
 ip vrf forwarding dmz
 ip address x.x.x.205/31
!
interface ethernet1/1/5
 description fw01
 no shutdown
 switchport mode trunk
 switchport trunk allowed vlan 50,150,152
 flowcontrol receive off
 spanning-tree disable
!
interface ethernet1/1/6
 description fw04
 no shutdown
 switchport mode trunk
 switchport trunk allowed vlan 51
 flowcontrol receive off

fw01 configuration:

interfaces {
    bridge br50 {
        member {
            interface eth1.50 {
            }
            interface eth1.150 {
            }
        }
    }
    bridge br52 {
        member {
            interface eth1.152 {
            }
            interface eth2.52 {
            }
        }
    }
    ethernet eth1 {
        hw-id 10:70:fd:9e:49:de
        vif 50 {
        }
        vif 150 {
        }
        vif 152 {
        }
    }
    ethernet eth2 {
        hw-id 10:70:fd:9e:49:df
        vif 52 {
        }
    }
    loopback lo {
    }
}

I guess it makes sense that cr00 wouldn't respond to an ARP request for another IP it knows it owns, but I would expect that it should work because it is a separate VRF. Is there some setting I am missing? Is there any other way to connect VRFs through an external link (not route leaking since, 1. the vlans are in the same subnet, and 2. that is internal to the router and wouldn't send the traffic through the firewall)?


Routing information for this link:

cr00# show ip route vrf dmz x.x.x.204/31

Routing entry for x.x.x.204/31
Known via connected
Distance 0, Metric 0
Last update 15:26:43
Routing descriptors Blocks:
    via x.x.x.205 vlan150

cr00# show ip route vrf outside x.x.x.204/31

Routing entry for x.x.x.204/31
Known via connected
Distance 0, Metric 0
Last update 15:26:53
Routing descriptors Blocks:
    via x.x.x.204 vlan50
cr00#

Each VRF is showing the correct route to get to the other side.


This is a simplified configuration. We have more VRFs that are connected the same way, but I tried reducing the problem to the minimum setup.

9
  • We need to see your routing
    – Ron Trunk
    Aug 10, 2022 at 19:30
  • I don't have any routing set up yet - I need to start by just connecting the two interface together so one side can ping the other side. Each interface has a route by virtue of being "connected". I added this to the question though.
    – yakatz
    Aug 10, 2022 at 20:30
  • 2
    What are you trying to accomplish with VRFs? If you're using an external firewall to route between LANs, then the switches don't need to be doing any L3 work.
    – Ricky
    Aug 11, 2022 at 0:50
  • @Ricky The firewalls are transparent - that is just what they are. Our existing setup has the transparent firewall between our ISP and our routers, but that means we need to filter our DMZ traffic elsewhere (mainly ACLs in the router which are a pain to keep in sync with the firewalls). We want the DMZ traffic to pass through the same firewall as public traffic, so we really need a separate edge router, but that is not in the budget and we are trying to fake it with VRF.
    – yakatz
    Aug 11, 2022 at 4:07
  • 1
    @RonTrunk That seems to be the issue - both VLAN interfaces have the same MAC address. Dell OS10 doesn't seem to offer a way to override that.
    – yakatz
    Aug 11, 2022 at 16:44

1 Answer 1

2

Dell engineering told me that, while it seems like it should work, this is not possible in the current firmware and this capability will not be added to the firmware.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.