I am currently trying to set up a cloud application on the guestshell of an ISR4331. It installs a connector that needs to have connectivity to the internet. I assume the issue is not specific to what kind of application it is, but just generically about using the guestshell, or rather any virtual container within an iOS system.

The router has an external and internal VRF - the IP of the guestshell is in the subnet of the external interface on the external VRF. The problem seems to be that this connector (which installs itself via prebuilt script) creates a VirtualPortGroup that shares the IP of the physical interface, but the config that it sets up does not seem to be VRF-aware.

So currently i have:

  • VRF External on Gig0/0/1 with ip .250.33
  • VRF Internal on Gig0/0/0 with ip .251.33
  • a VPG with ip unnumbered Gig0/0/1
  • a guestshell with ip .250.36

The connector set up a static route to the guestshell ip, but it created it in the default VRF, pointing to the VPG. I cant move this route to the VRF, because a static route in a VRF needs an IP or a point-to-point interface as a next hop. Putting the VPG itself into the VRF did not help either.

Here are the current ip routes:

Gateway of last resort is not set is subnetted, 1 subnets
S is directly connected, VirtualPortGroup0

Here are the routes of the External VRF:

Gateway of last resort is to network

S* [1/0] via is variably subnetted, 2 subnets, 2 masks
C is directly connected, GigabitEthernet0/0/1
L is directly connected, GigabitEthernet0/0/1

Here are the interface and guestshell configs:

interface VirtualPortGroup0
 ip unnumbered GigabitEthernet0/0/1
interface GigabitEthernet0/0/0
 description *** INSIDE  ***
 vrf forwarding Internal-200
 ip address
 no ip redirects
 no ip unreachables
 no ip proxy-arp
 negotiation auto
 no cdp enable
interface GigabitEthernet0/0/1
 description *** EXTERNAL  ***
 vrf forwarding External-100
 ip address
 no ip redirects
 no ip unreachables
 no ip proxy-arp
 media-type rj45
 negotiation auto
app-hosting appid guestshell
 app-vnic gateway0 virtualportgroup 0 guest-interface 0
  guest-ipaddress netmask
 app-default-gateway guest-interface 0

My expectation would be that i somehow have to make the guestshell "VRF-aware", so it shows up as a local route in the External VRF. But it does not seem like this is possible, so im afraid i will probably need a more complex solution - i saw that there are ways to work around this with a NAT or with leaking routes, but i am not primarily a networker so this a little too much for me.

Also, a limitation of the application is that the IP of the guestshell HAS to be on the same subnet as the external interface.

Currently it seems like the guestshell is completely detached - i cant ping it either with or without a VRF:

ping vrf External-100
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to, timeout is 2 seconds:
Success rate is 0 percent (0/5)
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to, timeout is 2 seconds:
Success rate is 0 percent (0/5)

I cant ping anything from inside the guestshell either:

guestshell run ping
PING ( 56(84) bytes of data.
From icmp_seq=1 Destination Host Unreachable
From icmp_seq=2 Destination Host Unreachable
From icmp_seq=3 Destination Host Unreachable
From icmp_seq=4 Destination Host Unreachable
--- ping statistics ---
4 packets transmitted, 0 received, +4 errors, 100% packet loss, time 3108ms

Sadly the Cisco guide i am using does not mention VRFs at all, so i dont know if that is even possible. Any ideas are much appreciated, this is all a bit confusing though very interesting.

  • The guestshell seems to be using the default VRF as per docs, there is a linux command chvrf to execute commands using a different VRF, apparently. But so far i found nothing that changes the default behaviour Apr 21, 2023 at 10:05

2 Answers 2


Solution 1: Move the guestshell IP address to the VRF

conf t
interface VirtualPortGroup0
 ip unnumbered VRF External-100

By configuring the ip unnumbered command with the VRF name, you associate the guestshell IP address with the External VRF.

Solution 2: Configure VRF leaking

To enable VRF leaking, you need to configure route leaking between the External and Internal VRFs. Here's an example:

conf t
ip route vrf External-100 VirtualPortGroup0
ip route vrf Internal-200 VirtualPortGroup0

These commands leak the guestshell IP route from the External VRF to the Internal VRF and vice versa.

Solution 3: Utilize NAT

To use NAT to enable connectivity between the guestshell and the VRFs, you'll need to configure NAT translation. Here's an example:

conf t
ip access-list extended GUESTSHELL_NAT_ACL
 permit ip host any
ip nat inside source list GUESTSHELL_NAT_ACL interface GigabitEthernet0/0/1 overload vrf External-100

These commands configure NAT translation for traffic originating from the guestshell IP address ( to be translated to the interface IP address of GigabitEthernet0/0/1 in the External VRF.

Note: Ensure that NAT is already configured on your router and adjust the interface name (GigabitEthernet0/0/1) as per your configuration.


For future reference, Cisco TAC provided this example config which worked for me:

! provision dummy lo0 interface

interface loopback0
 ip address

! run connector install script
! assign connector ip as
# tclsh https://binaries.webex.com/ManagedGatewayScriptProdStable/gateway_onboarding.tcl

! after installation remove lo0 interface, and assign same ip on vpg0

no int lo0

interface VirtualPortGroup0
 vrf forwarding XXX
 ip address
 ip nat inside
! add nat on gi2
! provision accesslist and nat rules

interface GigabitEthernet2
 vrf forwarding XXX
 ip address
 ip nat outside

ip access-list standard GSNAT
 10 permit

! disable local http(s) server as we will be doing nat for 443 port
no ip http server
no ip http secure-server

ip nat inside source list GSNAT interface GigabitEthernet2 vrf XXX overload
ip nat inside source static tcp 443 interface GigabitEthernet2 443 vrf XXX

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.