0

I have a firewall that's in-line of the default gateway for a network. It's a multi-layer filtering beast it handles all the NAT in the network (public and internal 1:1) and the access to DMZs. Routing is handled further inside the network by switches with OSPF.

I made a little diagram to help explain myself, you can skip this by just looking at it, but since it's required for there to be a textual explanation, here we go. :)

A new router is being added. It's insanely more capable than the the firewall for routing/tunneling but as a firewall it's unremarkable at best. It's replacing most routers and because of *things* it has to take the public interface from the firewall, so it will essentially sit at both ends of the firewall.

With policy routing, I can force gateways upstream from the intranet to filter the traffic, but it will eventually will end up creating asymmetric routes on the way back.

VRFs seem ideal for this, except since I'd be routing one VRF to another outside the VRF host and not sure what happens there. I've keep reading contradictory platform-specific things on this, e.g; that VRF tables shouldn't route with one another and "VRF Lite" which implies the opposite but so far I haven't found that explicitly stated. Often these documents use VRF and VRF Lite interchangeably too, only acknowledging it unceremoniously buried deep somewhere else and for me, being new to all of it, it gets confusing. I still need the specifics.

I believe it's less complicated that it's made to be though (hopefully), I'm sure I should be able to figure it out but first I just need a little clarification on one thing; is it okay to daisy chain VRFs?

There a couple of depictions of before and after, before is above the thickest blue segmented line.

Improve this question

1 Answer 1

Reset to default
1

Generally, yes. Each VRF instance acts like a separate router. Using one VRF instance for public-to-firewall routing and another for firewall-to-internal should work.

However, you need to carefully check the router's exact capabilities and limitations, also when software-based operation might kick in (which you likely won't want), as those parameters vary widely across vendors and product lines.

Improve this answer
1
  • Thank you, hunting these tidbits down takes a lot of time. I really appreciate it. I'm learning several platforms at once; VyOS, CHR & Router OS, RHEL/FreeBSD+FRRouting, Ubiquiti, that single serious routing product from TP-Link, etc. basically everything but Cisco. It's a lot more for a beginner but I have something to fall back on were it fail. On the flip side, I just went through OSPF where I learned most platforms with a CLI are eerily similar, even Cisco.
    – Vita
    May 25 at 5:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.