Re: [PATCH net-next] vrf: local route leaking

2019-05-31 Thread David Ahern
On 5/31/19 4:38 AM, George Wilkie wrote: > What are your thoughts on creating a "vrfdefault" for "local" table? >ip link add vrfdefault type vrf table local >ip link set dev vrfdefault up >ip ro add vrf vrfA 10.10.3.0/24 dev vrfdefault >ip ro add 10.10.2.0/24 dev vrfA >ip -6 ro

Re: [PATCH net-next] vrf: local route leaking

2019-05-31 Thread George Wilkie
On Thu, May 30, 2019 at 03:50:09PM -0600, David Ahern wrote: > On 5/30/19 2:52 PM, George Wilkie wrote: > > This doesn't work for me (again, not using namespaces). > > For traffic coming in on vrf-b to a destination on 10.200.2.0, > > I see ARPs going out for the destination on xvrf2/in on xvrf1, >

Re: [PATCH net-next] vrf: local route leaking

2019-05-30 Thread David Ahern
On 5/30/19 2:52 PM, George Wilkie wrote: > This doesn't work for me (again, not using namespaces). > For traffic coming in on vrf-b to a destination on 10.200.2.0, > I see ARPs going out for the destination on xvrf2/in on xvrf1, > but nothing replies to it. Is rp_filter set?

Re: [PATCH net-next] vrf: local route leaking

2019-05-30 Thread George Wilkie
On Wed, May 29, 2019 at 09:29:22PM -0600, David Ahern wrote: > you are correct that use of loopback here for default VRF does not work > -- the lookup code gets confused because it is a forward path (as > opposed to MPLS which is a local input). I found a couple of solutions > that work for default

Re: [PATCH net-next] vrf: local route leaking

2019-05-29 Thread David Ahern
On 5/27/19 2:34 AM, George Wilkie wrote: > On Sat, May 25, 2019 at 09:13:13AM -0600, David Ahern wrote: >>> Using a loopback doesn't work, e.g. if 10.1.1.0/24 was on a global >>> interface: >>>ip ro add vrf vrf-a 10.1.1.0/24 dev lo >> >> That works for MPLS when you exit the LSP and deliver lo

Re: [PATCH net-next] vrf: local route leaking

2019-05-27 Thread George Wilkie
On Sat, May 25, 2019 at 09:13:13AM -0600, David Ahern wrote: > > Using a loopback doesn't work, e.g. if 10.1.1.0/24 was on a global > > interface: > >ip ro add vrf vrf-a 10.1.1.0/24 dev lo > > That works for MPLS when you exit the LSP and deliver locally, so it > should work here as well. I'l

Re: [PATCH net-next] vrf: local route leaking

2019-05-25 Thread David Ahern
On 5/25/19 1:09 AM, George Wilkie wrote: > > That was my initial thought, although it needs a 2nd lookup. > The problem I hit though was I couldn't figure out how to make it work > when leaking from global into a VRF. I couldn't see how to indicate > a lookup in the global table. Is there a way t

Re: [PATCH net-next] vrf: local route leaking

2019-05-25 Thread George Wilkie
On Fri, May 24, 2019 at 02:19:45PM -0600, David Ahern wrote: > I think this codifies the use case: > ip li add vrf-a up type vrf table 1 > ip route add vrf vrf-a unreachable default > ip li add vrf-b up type vrf table 2 > ip route add vrf vrf-b unreachable default > ip ru add pref 32765 f

Re: [PATCH net-next] vrf: local route leaking

2019-05-24 Thread David Ahern
On 5/24/19 2:05 AM, George Wilkie wrote: > If have an interface in vrf A: > > 10.10.2.0/24 dev ens9 proto kernel scope link src 10.10.2.2 > local 10.10.2.2 dev ens9 proto kernel scope host src 10.10.2.2 > > and want to leak it into vrf B, it is not sufficient to leak just > the interface rout

[PATCH net-next] vrf: local route leaking

2019-05-24 Thread George Wilkie
If have an interface in vrf A: 10.10.2.0/24 dev ens9 proto kernel scope link src 10.10.2.2 local 10.10.2.2 dev ens9 proto kernel scope host src 10.10.2.2 and want to leak it into vrf B, it is not sufficient to leak just the interface route: ip route add 10.10.2.0/24 vrf B dev ens9 as traf