I am currently trying to set up a cloud application on the guestshell of an ISR4331. It installs a connector that needs to have connectivity to the internet. I assume the issue is not specific to what kind of application it is, but just generically about using the guestshell, or rather any virtual container within an iOS system.
The router has an external and internal VRF - the IP of the guestshell is in the subnet of the external interface on the external VRF. The problem seems to be that this connector (which installs itself via prebuilt script) creates a VirtualPortGroup that shares the IP of the physical interface, but the config that it sets up does not seem to be VRF-aware.
So currently i have:
- VRF External on Gig0/0/1 with ip .250.33
- VRF Internal on Gig0/0/0 with ip .251.33
- a VPG with ip unnumbered Gig0/0/1
- a guestshell with ip .250.36
The connector set up a static route to the guestshell ip, but it created it in the default VRF, pointing to the VPG. I cant move this route to the VRF, because a static route in a VRF needs an IP or a point-to-point interface as a next hop. Putting the VPG itself into the VRF did not help either.
Here are the current ip routes:
Gateway of last resort is not set 10.0.0.0/32 is subnetted, 1 subnets S 10.192.250.36 is directly connected, VirtualPortGroup0
Here are the routes of the External VRF:
Gateway of last resort is 10.192.250.1 to network 0.0.0.0 S* 0.0.0.0/0 [1/0] via 10.192.250.1 10.0.0.0/8 is variably subnetted, 2 subnets, 2 masks C 10.192.250.0/24 is directly connected, GigabitEthernet0/0/1 L 10.192.250.33/32 is directly connected, GigabitEthernet0/0/1
Here are the interface and guestshell configs:
interface VirtualPortGroup0 ip unnumbered GigabitEthernet0/0/1 ! interface GigabitEthernet0/0/0 description *** INSIDE *** vrf forwarding Internal-200 ip address 10.192.251.33 255.255.255.0 no ip redirects no ip unreachables no ip proxy-arp negotiation auto no cdp enable ! interface GigabitEthernet0/0/1 description *** EXTERNAL *** vrf forwarding External-100 ip address 10.192.250.33 255.255.255.0 no ip redirects no ip unreachables no ip proxy-arp media-type rj45 negotiation auto
app-hosting appid guestshell app-vnic gateway0 virtualportgroup 0 guest-interface 0 guest-ipaddress 10.192.250.36 netmask 255.255.255.0 app-default-gateway 10.192.250.33 guest-interface 0
My expectation would be that i somehow have to make the guestshell "VRF-aware", so it shows up as a local route in the External VRF. But it does not seem like this is possible, so im afraid i will probably need a more complex solution - i saw that there are ways to work around this with a NAT or with leaking routes, but i am not primarily a networker so this a little too much for me.
Also, a limitation of the application is that the IP of the guestshell HAS to be on the same subnet as the external interface.
Currently it seems like the guestshell is completely detached - i cant ping it either with or without a VRF:
ping vrf External-100 10.192.250.36 Type escape sequence to abort. Sending 5, 100-byte ICMP Echos to 10.192.250.36, timeout is 2 seconds: ..... Success rate is 0 percent (0/5)
ping 10.192.250.36 Type escape sequence to abort. Sending 5, 100-byte ICMP Echos to 10.192.250.36, timeout is 2 seconds: ..... Success rate is 0 percent (0/5)
I cant ping anything from inside the guestshell either:
guestshell run ping 10.192.250.33 PING 10.192.250.33 (10.192.250.33) 56(84) bytes of data. From 10.192.250.33 icmp_seq=1 Destination Host Unreachable From 10.192.250.33 icmp_seq=2 Destination Host Unreachable From 10.192.250.33 icmp_seq=3 Destination Host Unreachable From 10.192.250.33 icmp_seq=4 Destination Host Unreachable ^C --- 10.192.250.33 ping statistics --- 4 packets transmitted, 0 received, +4 errors, 100% packet loss, time 3108ms
Sadly the Cisco guide i am using does not mention VRFs at all, so i dont know if that is even possible. Any ideas are much appreciated, this is all a bit confusing though very interesting.