0

I have an MX960 configured as a BNG with two VRFs: one for subscriber access and another for Internet access. Some subscribers have static public IP addresses assigned by Radius, and their traffic needs to be forwarded directly to the Internet VRF. I achieve this by using a forwarding-options input filter FBF. In the Internet VRF, I return the subscriber traffic using a static route with next-table.

At the subscribers' endpoints, I can ping 8.8.8.8 without any issues. However, web browsing is not working properly; some websites load while others do not. I have ruled out problems with MTU and TCP-MSS. Additionally, I noticed that the subscribers' Internet access works fine when both subscriber and Internet access are in the global routing instance.

The configuration is some like this:

firewall {
    family inet {
        filter REDIRECT-SUBS-TRAFFIC {
            term NO_REDIRECT {
                from {
                    destination-prefix-list {
                        PL-NO-REDIRECT;
                    }
                }
                then {
                    log;
                    accept;
                }
            }
            term SUBSCRIBERS-TO-INTERNET {
                from {
                    source-prefix-list {
                        PL-SUBSCRIBERS-PUBLIC-POOLS;
                    }
                }
                then {                  
                    log;
                    routing-instance VRF-INTERNET;
                }
            }
            term ACCEPT-ALL {
                then accept;
            }
        }
    }
}

prefix-list PL-SUBSCRIBERS-PUBLIC-POOLS {
    10.10.2.0/24;
}
prefix-list PL-NO-REDIRECT {
    10.99.99.0/30;
    10.145.0.2/32;
    10.245.144.6/32;
}


routing-instances {
    VRF-INTERNET {
        instance-type vrf;
        routing-options {
            static {
                route 0.0.0.0/0 next-hop 10.55.55.1;
                route 10.10.2.0/24 next-table VRF-ACCESS-SUBs.inet.0;
            }
        }
        interface ge-1/1/9.555;
        route-distinguisher 66666:6101;
        vrf-target {
            import target:66666:6101;
            export target:66666:6101;
        }
        vrf-table-label;
    }
    VRF-ACCESS-SUBs {
        instance-type vrf;
        routing-options {
            router-id 10.245.144.6;
        }
        forwarding-options {
            family inet {               
                filter {
                    input REDIRECT-SUBS-TRAFFIC;
                }
            }
        }
        route-distinguisher 66666:6099;
        vrf-target {
            import target:66666:6099;
            export target:66666:6099;
        }
    }
}

Plaese, can anyone explain why internet communication breaks when I use this route leaking between VRFs?

3
  • We are assigning the name of the VRF through Radius but due to design requirements, subscribers' PPPoE access must be in their own VRF. From the subscribers' VRF we decide where to send the traffic through FBF. Subscribers with public IP pass directly to the Internet VRF and subscribers requiring CGNAT pass to a CGNAT VRF. We have a topology like this: ONT-----OLT-----PE------P-------BNG------INTERNET_EDGE We connect the OLT through a Pseudowire Commented May 27 at 15:34
  • I have replicated the problem in a laboratory environment and realized that the problem focuses on the PPPoE access of the subscriber. I have detected that the problem occurs when PPPoE access is in a VRF. When the PPPoE access of the subscriber is in the Global Routing Table this problem does not occur. Does anybody know of any best practices for this type of deployment? Commented May 27 at 22:31
  • I know said you have ruled out MSS/MTU issues, but the fact that you're only seeing the problem on PPPoE subscribers AND it is only affecting some websites sounds exactly like an MSS problem. From one of your subscriber devices, try visiting the MTU Eyechart site: elifulkerson.com/projects/downloads/mtu-eyechart/index.html - and confirm that all the images load. Commented May 31 at 2:36

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.