Note - 2022-11-09: We opened a support ticket with Dell and they think it is a software bug. Engineering is supposedly working on it now. This question may become moot, or, they might decide not to fix it and we will need a complete redesign.
I have two Dell S5232F-ON switches running OS10. Each switch has several VRFs to segment network traffic. I want to be able to route traffic between VRFs through a transparent firewall, running VyOS. The plan is to advertise routes with iBGP, but I haven't gotten that far - I can't get the VRFs on the same switch to talk to each other at all.
Each firewall only has a single 100G connection, so I need to trunk all the traffic. I can ping from cr00-dmz to cr01-outside (and vice versa), but I can't even get ARP responses between cr00-dmz and cr00-outside.
cr00 configuration
interface vlan50
mode L3
no shutdown
ip vrf forwarding outside
ip address x.x.x.204/31
!
interface vlan150
mode L3
no shutdown
ip vrf forwarding dmz
ip address x.x.x.205/31
!
interface ethernet1/1/5
description fw01
no shutdown
switchport mode trunk
switchport trunk allowed vlan 50,150,152
flowcontrol receive off
spanning-tree disable
!
interface ethernet1/1/6
description fw04
no shutdown
switchport mode trunk
switchport trunk allowed vlan 51
flowcontrol receive off
fw01 configuration:
interfaces {
bridge br50 {
member {
interface eth1.50 {
}
interface eth1.150 {
}
}
}
bridge br52 {
member {
interface eth1.152 {
}
interface eth2.52 {
}
}
}
ethernet eth1 {
hw-id 10:70:fd:9e:49:de
vif 50 {
}
vif 150 {
}
vif 152 {
}
}
ethernet eth2 {
hw-id 10:70:fd:9e:49:df
vif 52 {
}
}
loopback lo {
}
}
I guess it makes sense that cr00 wouldn't respond to an ARP request for another IP it knows it owns, but I would expect that it should work because it is a separate VRF. Is there some setting I am missing? Is there any other way to connect VRFs through an external link (not route leaking since, 1. the vlans are in the same subnet, and 2. that is internal to the router and wouldn't send the traffic through the firewall)?
Routing information for this link:
cr00# show ip route vrf dmz x.x.x.204/31
Routing entry for x.x.x.204/31
Known via connected
Distance 0, Metric 0
Last update 15:26:43
Routing descriptors Blocks:
via x.x.x.205 vlan150
cr00# show ip route vrf outside x.x.x.204/31
Routing entry for x.x.x.204/31
Known via connected
Distance 0, Metric 0
Last update 15:26:53
Routing descriptors Blocks:
via x.x.x.204 vlan50
cr00#
Each VRF is showing the correct route to get to the other side.
This is a simplified configuration. We have more VRFs that are connected the same way, but I tried reducing the problem to the minimum setup.
