Cisco IOS - how can I make the guestshell be reachable via VRF?

Question

I am currently trying to set up a cloud application on the guestshell of an ISR4331. It installs a connector that needs to have connectivity to the internet. I assume the issue is not specific to what kind of application it is, but just generically about using the guestshell, or rather any virtual container within an iOS system.

The router has an external and internal VRF - the IP of the guestshell is in the subnet of the external interface on the external VRF. The problem seems to be that this connector (which installs itself via prebuilt script) creates a VirtualPortGroup that shares the IP of the physical interface, but the config that it sets up does not seem to be VRF-aware.

So currently i have:

• VRF External on Gig0/0/1 with ip .250.33
• VRF Internal on Gig0/0/0 with ip .251.33
• a VPG with ip unnumbered Gig0/0/1
• a guestshell with ip .250.36

The connector set up a static route to the guestshell ip, but it created it in the default VRF, pointing to the VPG. I cant move this route to the VRF, because a static route in a VRF needs an IP or a point-to-point interface as a next hop. Putting the VPG itself into the VRF did not help either.

Here are the current ip routes:

Gateway of last resort is not set
      
10.0.0.0/32 is subnetted, 1 subnets
S        10.192.250.36 is directly connected, VirtualPortGroup0

Here are the routes of the External VRF:

Gateway of last resort is 10.192.250.1 to network 0.0.0.0

S*    0.0.0.0/0 [1/0] via 10.192.250.1
      10.0.0.0/8 is variably subnetted, 2 subnets, 2 masks
C        10.192.250.0/24 is directly connected, GigabitEthernet0/0/1
L        10.192.250.33/32 is directly connected, GigabitEthernet0/0/1

Here are the interface and guestshell configs:

interface VirtualPortGroup0
 ip unnumbered GigabitEthernet0/0/1
!
interface GigabitEthernet0/0/0
 description *** INSIDE  ***
 vrf forwarding Internal-200
 ip address 10.192.251.33 255.255.255.0
 no ip redirects
 no ip unreachables
 no ip proxy-arp
 negotiation auto
 no cdp enable
!
interface GigabitEthernet0/0/1
 description *** EXTERNAL  ***
 vrf forwarding External-100
 ip address 10.192.250.33 255.255.255.0
 no ip redirects
 no ip unreachables
 no ip proxy-arp
 media-type rj45
 negotiation auto

app-hosting appid guestshell
 app-vnic gateway0 virtualportgroup 0 guest-interface 0
  guest-ipaddress 10.192.250.36 netmask 255.255.255.0
 app-default-gateway 10.192.250.33 guest-interface 0

My expectation would be that i somehow have to make the guestshell "VRF-aware", so it shows up as a local route in the External VRF. But it does not seem like this is possible, so im afraid i will probably need a more complex solution - i saw that there are ways to work around this with a NAT or with leaking routes, but i am not primarily a networker so this a little too much for me.

Also, a limitation of the application is that the IP of the guestshell HAS to be on the same subnet as the external interface.

Currently it seems like the guestshell is completely detached - i cant ping it either with or without a VRF:

ping vrf External-100 10.192.250.36
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.192.250.36, timeout is 2 seconds:
.....
Success rate is 0 percent (0/5)

ping 10.192.250.36
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.192.250.36, timeout is 2 seconds:
.....
Success rate is 0 percent (0/5)

I cant ping anything from inside the guestshell either:

guestshell run ping 10.192.250.33
PING 10.192.250.33 (10.192.250.33) 56(84) bytes of data.
From 10.192.250.33 icmp_seq=1 Destination Host Unreachable
From 10.192.250.33 icmp_seq=2 Destination Host Unreachable
From 10.192.250.33 icmp_seq=3 Destination Host Unreachable
From 10.192.250.33 icmp_seq=4 Destination Host Unreachable
^C
--- 10.192.250.33 ping statistics ---
4 packets transmitted, 0 received, +4 errors, 100% packet loss, time 3108ms

Sadly the Cisco guide i am using does not mention VRFs at all, so i dont know if that is even possible. Any ideas are much appreciated, this is all a bit confusing though very interesting.

Answer 1

Solution 1: Move the guestshell IP address to the VRF

conf t
interface VirtualPortGroup0
 ip unnumbered VRF External-100
end

By configuring the ip unnumbered command with the VRF name, you associate the guestshell IP address with the External VRF.

Solution 2: Configure VRF leaking

To enable VRF leaking, you need to configure route leaking between the External and Internal VRFs. Here's an example:

conf t
ip route vrf External-100 10.192.250.36 255.255.255.255 VirtualPortGroup0
ip route vrf Internal-200 10.192.250.36 255.255.255.255 VirtualPortGroup0
end

These commands leak the guestshell IP route from the External VRF to the Internal VRF and vice versa.

Solution 3: Utilize NAT

To use NAT to enable connectivity between the guestshell and the VRFs, you'll need to configure NAT translation. Here's an example:

conf t
ip access-list extended GUESTSHELL_NAT_ACL
 permit ip host 10.192.250.36 any
!
ip nat inside source list GUESTSHELL_NAT_ACL interface GigabitEthernet0/0/1 overload vrf External-100
end

These commands configure NAT translation for traffic originating from the guestshell IP address (10.192.250.36) to be translated to the interface IP address of GigabitEthernet0/0/1 in the External VRF.

Note: Ensure that NAT is already configured on your router and adjust the interface name (GigabitEthernet0/0/1) as per your configuration.

Answer 2

For future reference, Cisco TAC provided this example config which worked for me:

! provision dummy lo0 interface

interface loopback0
 ip address 192.168.35.1 255.255.255.0


! run connector install script
! assign connector ip as 192.168.35.2
# tclsh https://binaries.webex.com/ManagedGatewayScriptProdStable/gateway_onboarding.tcl


! after installation remove lo0 interface, and assign same ip on vpg0

no int lo0

interface VirtualPortGroup0
 vrf forwarding XXX
 ip address 192.168.35.1 255.255.255.0
 ip nat inside
 
 
! add nat on gi2
! provision accesslist and nat rules

interface GigabitEthernet2
 vrf forwarding XXX
 ip address 10.48.53.163 255.255.254.0
 ip nat outside

ip access-list standard GSNAT
 10 permit 192.168.35.0 0.0.0.255


! disable local http(s) server as we will be doing nat for 443 port
no ip http server
no ip http secure-server

ip nat inside source list GSNAT interface GigabitEthernet2 vrf XXX overload
ip nat inside source static tcp 192.168.35.2 443 interface GigabitEthernet2 443 vrf XXX