So i have read through other posts about the status of VRF in the beta, but what I don't understand if the big change in the way it is setup.
Previously, you would create the vrf, add routing mark, multiple interfaces, and other info. In the beta, you have to add interfaces to a list, which takes way more steps than it should, then add the list ot a vrf. Just seems so kludgy for something that previously worked quite well and was a lot more logical for the setup.
Also, in the previous version when you went to the routes table, there was info on which routing mark the addresses were in. The beta lacks being able to tell which vrf and address is in.
I understand this is all still under development, just trying to understand what direction this is taking.
Re: v7 Beta and VRF config changes
Interface list was added to address issue with large amount of dynamically created interface issue.
v7 routes has routing table parameter, so you can determine to which table route belongs the same way as in ROS v6.
v7 routes has routing table parameter, so you can determine to which table route belongs the same way as in ROS v6.
Code: Select all
[admin@arm-bgp] /ip/route> print det where dst-address=192.168.123.0/24
Flags: D - dynamic; X - disabled, I - inactive, A - active;
c - connect, s - static, r - rip, b - bgp, o - ospf, d - dhcp, v - vpn, m - modem,
y - copy;
H - hw-offloaded; + - ecmp
0 As dst-address=192.168.123.0/24 routing-table=test pref-src="" gateway=""
blackhole immediate-gw="" distance=1 scope=250 target-scope=10
suppress-hw-offload=no
Re: v7 Beta and VRF config changes
So maybe this is a Wireguard issue, I have no idea.
Scenario is that I have the Mikrotik sitting behind a cable router which does NAT for me, so everything on the Mikrotik is straight routing and no NAT.
I have the WAN interface set with 10.1.10.2/24 and the gateway is 10.1.10.1 and is, of course, in the "main" table by default.
I setup a Wireguard interface which has an IP of 100.64.101.6/30 and the other end is 100.64.101.5/30 for routing purposes as the provider routes a public /29 to me. Everything for the Wireguard interface is in the "main" table on initial setup and the Wireguard interface is up.
So I then add a new vrf and routing-table called "vrf_fr2", create a vlan on one of my internal ports, ether2, and put this vlan in a list which is then assigned to the vrf_fr2. I cannot get any traffic in or out of the /29 and have tried with and without a static route of 0.0.0.0 assigned to the vrf_fr2 table with a gateway of the 100.64.101.5 which is the provider side of the Wireguard tunnel.
I have also tried putting the Wirguard interface itself in the same vrf and table with no luck.
I have this same setup working in version 6, although with a ppp/l2tp tunnel, and it worked perfectly.
Here is what the relevant portion of my config look like right now:
What I don't understand is that in version 6 in the webfig using the additional vrf, I see two default routes. One for the main and one for the vrf. In version 7 beta3, I am only seeing the default route of the main table.
Scenario is that I have the Mikrotik sitting behind a cable router which does NAT for me, so everything on the Mikrotik is straight routing and no NAT.
I have the WAN interface set with 10.1.10.2/24 and the gateway is 10.1.10.1 and is, of course, in the "main" table by default.
I setup a Wireguard interface which has an IP of 100.64.101.6/30 and the other end is 100.64.101.5/30 for routing purposes as the provider routes a public /29 to me. Everything for the Wireguard interface is in the "main" table on initial setup and the Wireguard interface is up.
So I then add a new vrf and routing-table called "vrf_fr2", create a vlan on one of my internal ports, ether2, and put this vlan in a list which is then assigned to the vrf_fr2. I cannot get any traffic in or out of the /29 and have tried with and without a static route of 0.0.0.0 assigned to the vrf_fr2 table with a gateway of the 100.64.101.5 which is the provider side of the Wireguard tunnel.
I have also tried putting the Wirguard interface itself in the same vrf and table with no luck.
I have this same setup working in version 6, although with a ppp/l2tp tunnel, and it worked perfectly.
Here is what the relevant portion of my config look like right now:
Code: Select all
/interface wireguard
add listen-port=41195 mtu=1420 name=wg01 private-key="*******"
/interface wireguard peers
add allowed-address=0.0.0.0/0 endpoint-address=23.152.224.18 endpoint-port=41195 interface=wg01 persistent-keepalive=1m public-key="******"
/interface vlan
add interface=ether2 name=LAN1 vlan-id=100
add interface=ether2 name=VLAN_1002 vlan-id=1002
/interface list
add name=WAN
add name=LAN
add name=other
add name=Other
add name=Wireguard2
/interface list member
add interface=LAN1 list=LAN
add interface=ether1 list=WAN
add interface=VLAN_1002 list=Wireguard2
/ip vrf
add list=all name=main
add list=Wireguard2 name=vrf_fr2
/ip route
add disabled=no distance=1 dst-address=0.0.0.0 gateway=10.1.10.1 pref-src="" routing-table=main scope=30 suppress-hw-offload=no target-scope=10
add disabled=no distance=1 dst-address=0.0.0.0 gateway=100.64.101.5 pref-src="" routing-table=vrf_fr2 scope=30 suppress-hw-offload=no target-scope=10 <----- This has been setup in multiple ways trying GW as interface name and provider side IP
/routing/table/print detail
Flags: D - dynamic; X - disabled, I - invalid; U - used
0 D name="main" fib
1 D name="vrf_fr2" fib
ip/route/print detail
Flags: D - dynamic; X - disabled, I - inactive, A - active; c - connect, s - static, r - rip, b - bgp, o - ospf, d - dhcp, v - vpn, m - modem, y - copy; H - hw-offloaded; + - ecmp
0 As dst-address=0.0.0.0 routing-table=main pref-src="" gateway=10.1.10.1 immediate-gw=10.1.10.1%ether1 distance=1 scope=30 target-scope=10 suppress-hw-offload=no
DAc dst-address=10.1.10.0/24 routing-table=main gateway=ether1 immediate-gw=ether1 distance=0 scope=10 suppress-hw-offload=no local-address=10.1.10.2%ether1
DAc dst-address=23.152.224.112/29 routing-table=main gateway=VLAN_1002 immediate-gw=VLAN_1002 distance=0 scope=10 suppress-hw-offload=no local-address=23.152.224.113%VLAN_1002
DAc dst-address=100.64.101.4/30 routing-table=main gateway=wg01 immediate-gw=wg01 distance=0 scope=10 suppress-hw-offload=no local-address=100.64.101.6%wg01
DAc dst-address=192.168.1.0/24 routing-table=main gateway=LAN1 immediate-gw=LAN1 distance=0 scope=10 suppress-hw-offload=no local-address=192.168.1.2%LAN1
1 As dst-address=0.0.0.0 routing-table=vrf_fr2 pref-src=0.0.0.0 gateway=100.64.101.5 immediate-gw=100.64.101.5%wg01 distance=1 scope=30 target-scope=10 suppress-hw-offload=no
Re: v7 Beta and VRF config changes
Ok, so actually looking closer at the routing table, even though I have a vrf setup and a list associated which has the /29 interface in it, the route table still has that interface and /29 in the "main" table and not the vrf_fr2 table.
Since it is dynamic, how do I change that??
Code: Select all
DAc dst-address=23.152.224.112/29 routing-table=main gateway=VLAN_1002 immediate-gw=VLAN_1002 distance=0 scope=10 suppress-hw-offload=no local-address=23.152.224.113%VLAN_1002
Re: v7 Beta and VRF config changes
Wireguard has a problem that cannot specify an SRC IP. Therefore, no matter what VRF is assigned the wireguard interface will still apply based on the main routing table.
I hope this will be implemented in the future.
I hope this will be implemented in the future.
Who is online
Users browsing this forum: No registered users and 9 guests