# Inter-VRF Routing over VRF Lite

> Конфигурация VRF Lite с утечкой маршрутов между VRF для мультитенантной изоляции сетей в средах Yandex Cloud и VK Cloud.

Source: https://opennix.org/docs/vyos/examples/inter-vrf-routing/


Inter-VRF routing позволяет контролируемый обмен маршрутами между изолированными VRF (Virtual Routing and Forwarding) instances, обеспечивая segmentation с selective connectivity.

## Сценарий использования

### Применимость

- **Multi-Tenant Cloud**: Изоляция клиентов с контролируемым shared services доступом
- **Enterprise Segmentation**: Разделение Production / Development / Testing environments
- **Service Provider**: Carrier VPN с частичным route leaking
- **Security Zones**: DMZ, Internal, Management с выборочным доступом

### Преимущества

1. **Network Isolation**: Полная изоляция routing tables между tenant
2. **Selective Connectivity**: Контролируемый доступ к shared services (DNS, monitoring)
3. **IP Overlap**: Разные VRF могут использовать одинаковые IP ranges
4. **Flexible Policy**: Granular control через route-maps и prefix-lists
5. **Scalability**: Поддержка множества VRF на одном роутере

## Топология сети

### Базовая топология (3 VRF)

```
                    ┌─────────────────────────────────┐
                    │       VyOS Router               │
                    │                                 │
                    │  ┌────────────────────────┐     │
                    │  │   VRF PRODUCTION       │     │
                    │  │   RD: 65000:100        │     │
                    │  │   10.100.0.0/16        │     │
                    │  └──────────┬─────────────┘     │
                    │             │ Route Leak        │
                    │  ┌──────────┴─────────────┐     │
                    │  │   VRF SHARED           │     │
                    │  │   RD: 65000:999        │     │
                    │  │   10.255.0.0/24        │     │
                    │  │   (DNS, NTP, Monitor)  │     │
                    │  └──────────┬─────────────┘     │
                    │             │ Route Leak        │
                    │  ┌──────────┴─────────────┐     │
                    │  │   VRF DEVELOPMENT      │     │
                    │  │   RD: 65000:200        │     │
                    │  │   10.200.0.0/16        │     │
                    │  └────────────────────────┘     │
                    │                                 │
                    │  eth1 ─ PRODUCTION             │
                    │  eth2 ─ DEVELOPMENT            │
                    │  eth3 ─ SHARED                 │
                    └─────────────────────────────────┘
```

### Yandex Cloud Multi-Tenant

```
┌──────────────────────────────────────────┐
│      Yandex Cloud VPC                    │
│                                          │
│  ┌────────────────────────────────────┐  │
│  │       VyOS Gateway                 │  │
│  │                                    │  │
│  │  VRF CUSTOMER-A ◄──┐               │  │
│  │  (10.1.0.0/16)     │               │  │
│  │                    │               │  │
│  │  VRF CUSTOMER-B ◄──┼─► SHARED     │  │
│  │  (10.2.0.0/16)     │    SERVICES  │  │
│  │                    │    (DNS/NTP) │  │
│  │  VRF CUSTOMER-C ◄──┘               │  │
│  │  (10.3.0.0/16)                     │  │
│  └────────────────────────────────────┘  │
│                                          │
│  Customer A Subnet ◄─── eth1            │
│  Customer B Subnet ◄─── eth2            │
│  Customer C Subnet ◄─── eth3            │
│  Shared Services   ◄─── eth4            │
└──────────────────────────────────────────┘
```

## Требования

### Минимальные требования

- VyOS 1.4 (Sagitta) или новее
- Поддержка VRF (FRRouting)
- BGP или static routing для route import/export
- Unique Route Distinguisher (RD) для каждого VRF

### Сетевые параметры (пример)

| VRF | RD | RT Import | RT Export | Networks |
|-----|----|-----------| ----------|----------|
| PRODUCTION | 65000:100 | 65000:100, 65000:999 | 65000:100 | 10.100.0.0/16 |
| DEVELOPMENT | 65000:200 | 65000:200, 65000:999 | 65000:200 | 10.200.0.0/16 |
| SHARED | 65000:999 | 65000:100, 65000:200 | 65000:999 | 10.255.0.0/24 |

## Конфигурация VRF

### Создание VRF instances

```bash
configure

# VRF PRODUCTION
set vrf name PRODUCTION table '100'
set vrf name PRODUCTION description 'Production environment - Customer A'

# VRF DEVELOPMENT
set vrf name DEVELOPMENT table '200'
set vrf name DEVELOPMENT description 'Development environment - Customer B'

# VRF SHARED
set vrf name SHARED table '999'
set vrf name SHARED description 'Shared services - DNS, NTP, Monitoring'

commit
```

### Назначение интерфейсов VRF

```bash
configure

# eth1 - PRODUCTION
set interfaces ethernet eth1 address '10.100.1.1/24'
set interfaces ethernet eth1 description 'PRODUCTION network'
set interfaces ethernet eth1 vrf 'PRODUCTION'

# eth2 - DEVELOPMENT
set interfaces ethernet eth2 address '10.200.1.1/24'
set interfaces ethernet eth2 description 'DEVELOPMENT network'
set interfaces ethernet eth2 vrf 'DEVELOPMENT'

# eth3 - SHARED
set interfaces ethernet eth3 address '10.255.0.1/24'
set interfaces ethernet eth3 description 'SHARED services'
set interfaces ethernet eth3 vrf 'SHARED'

commit
save
```

## Конфигурация BGP для Inter-VRF Routing

### BGP базовая конфигурация

```bash
configure

# BGP AS number
set protocols bgp system-as '65000'
set protocols bgp parameters router-id '192.168.255.1'

commit
```

### VRF PRODUCTION BGP configuration

```bash
configure

# BGP для VRF PRODUCTION
set protocols bgp address-family ipv4-unicast vrf PRODUCTION rd '65000:100'
set protocols bgp address-family ipv4-unicast vrf PRODUCTION route-target export '65000:100'
set protocols bgp address-family ipv4-unicast vrf PRODUCTION route-target import '65000:100'
set protocols bgp address-family ipv4-unicast vrf PRODUCTION route-target import '65000:999'

# Announce PRODUCTION networks
set protocols bgp address-family ipv4-unicast vrf PRODUCTION network '10.100.0.0/16'

# Redistribute connected
set protocols bgp address-family ipv4-unicast vrf PRODUCTION redistribute connected

commit
```

### VRF DEVELOPMENT BGP configuration

```bash
configure

# BGP для VRF DEVELOPMENT
set protocols bgp address-family ipv4-unicast vrf DEVELOPMENT rd '65000:200'
set protocols bgp address-family ipv4-unicast vrf DEVELOPMENT route-target export '65000:200'
set protocols bgp address-family ipv4-unicast vrf DEVELOPMENT route-target import '65000:200'
set protocols bgp address-family ipv4-unicast vrf DEVELOPMENT route-target import '65000:999'

# Announce DEVELOPMENT networks
set protocols bgp address-family ipv4-unicast vrf DEVELOPMENT network '10.200.0.0/16'
set protocols bgp address-family ipv4-unicast vrf DEVELOPMENT redistribute connected

commit
```

### VRF SHARED BGP configuration

```bash
configure

# BGP для VRF SHARED
set protocols bgp address-family ipv4-unicast vrf SHARED rd '65000:999'
set protocols bgp address-family ipv4-unicast vrf SHARED route-target export '65000:999'
set protocols bgp address-family ipv4-unicast vrf SHARED route-target import '65000:100'
set protocols bgp address-family ipv4-unicast vrf SHARED route-target import '65000:200'

# Announce SHARED services
set protocols bgp address-family ipv4-unicast vrf SHARED network '10.255.0.0/24'
set protocols bgp address-family ipv4-unicast vrf SHARED redistribute connected

commit
save
```

### Объяснение Route Targets

**Route Target (RT)** контролирует import/export маршрутов между VRF:

- **PRODUCTION**:
  - Export `65000:100`: Пометить маршруты тегом 65000:100
  - Import `65000:100`: Импортировать маршруты с тегом 65000:100 (свои)
  - Import `65000:999`: Импортировать маршруты из SHARED VRF

- **SHARED**:
  - Export `65000:999`: Пометить shared services маршруты
  - Import `65000:100, 65000:200`: Импортировать от PRODUCTION и DEVELOPMENT

**Результат**: PRODUCTION видит SHARED, но НЕ видит DEVELOPMENT (и наоборот).

## Альтернатива: Static Route Leaking

Если не нужен BGP, можно использовать static routes с VRF:

```bash
configure

# В VRF PRODUCTION: маршрут к SHARED через eth3
set vrf name PRODUCTION protocols static route 10.255.0.0/24 next-hop 10.255.0.1 vrf 'SHARED'

# В VRF SHARED: маршруты обратно к PRODUCTION и DEVELOPMENT
set vrf name SHARED protocols static route 10.100.0.0/16 next-hop 10.100.1.1 vrf 'PRODUCTION'
set vrf name SHARED protocols static route 10.200.0.0/16 next-hop 10.200.1.1 vrf 'DEVELOPMENT'

commit
save
```

**Примечание**: Static route leaking проще, но менее гибкий чем BGP с RT.

## Интеграция с Yandex Cloud

### Сценарий: Multi-Tenant Gateway в Yandex Cloud

```bash
configure

# Management интерфейс
set interfaces ethernet eth0 address dhcp
set interfaces ethernet eth0 description 'Yandex Cloud management'

# Customer A (VRF CUSTOMER-A)
set vrf name CUSTOMER-A table '101'
set vrf name CUSTOMER-A description 'Tenant A - E-commerce'

set interfaces ethernet eth1 address '10.1.1.1/24'
set interfaces ethernet eth1 description 'Customer A subnet'
set interfaces ethernet eth1 vrf 'CUSTOMER-A'

# Customer B (VRF CUSTOMER-B)
set vrf name CUSTOMER-B table '102'
set vrf name CUSTOMER-B description 'Tenant B - Analytics'

set interfaces ethernet eth2 address '10.2.1.1/24'
set interfaces ethernet eth2 description 'Customer B subnet'
set interfaces ethernet eth2 vrf 'CUSTOMER-B'

# Shared Services (DNS, NTP, Yandex Monitoring)
set vrf name SHARED-SERVICES table '999'
set vrf name SHARED-SERVICES description 'Shared: DNS, NTP, Monitoring'

set interfaces ethernet eth4 address '10.255.1.1/24'
set interfaces ethernet eth4 description 'Shared services'
set interfaces ethernet eth4 vrf 'SHARED-SERVICES'

# BGP для route leaking
set protocols bgp system-as '65000'
set protocols bgp parameters router-id '10.255.255.1'

# CUSTOMER-A VRF BGP
set protocols bgp address-family ipv4-unicast vrf CUSTOMER-A rd '65000:101'
set protocols bgp address-family ipv4-unicast vrf CUSTOMER-A route-target export '65000:101'
set protocols bgp address-family ipv4-unicast vrf CUSTOMER-A route-target import '65000:101'
set protocols bgp address-family ipv4-unicast vrf CUSTOMER-A route-target import '65000:999'
set protocols bgp address-family ipv4-unicast vrf CUSTOMER-A redistribute connected

# CUSTOMER-B VRF BGP
set protocols bgp address-family ipv4-unicast vrf CUSTOMER-B rd '65000:102'
set protocols bgp address-family ipv4-unicast vrf CUSTOMER-B route-target export '65000:102'
set protocols bgp address-family ipv4-unicast vrf CUSTOMER-B route-target import '65000:102'
set protocols bgp address-family ipv4-unicast vrf CUSTOMER-B route-target import '65000:999'
set protocols bgp address-family ipv4-unicast vrf CUSTOMER-B redistribute connected

# SHARED-SERVICES VRF BGP
set protocols bgp address-family ipv4-unicast vrf SHARED-SERVICES rd '65000:999'
set protocols bgp address-family ipv4-unicast vrf SHARED-SERVICES route-target export '65000:999'
set protocols bgp address-family ipv4-unicast vrf SHARED-SERVICES route-target import '65000:101'
set protocols bgp address-family ipv4-unicast vrf SHARED-SERVICES route-target import '65000:102'
set protocols bgp address-family ipv4-unicast vrf SHARED-SERVICES redistribute connected

commit
save
```

### Yandex Cloud Firewall между VRF

```bash
configure

# Разрешить только DNS и NTP от customers к shared
set firewall ipv4-name CUSTOMER-TO-SHARED default-action 'drop'
set firewall ipv4-name CUSTOMER-TO-SHARED rule 10 action 'accept'
set firewall ipv4-name CUSTOMER-TO-SHARED rule 10 protocol 'udp'
set firewall ipv4-name CUSTOMER-TO-SHARED rule 10 destination port '53'
set firewall ipv4-name CUSTOMER-TO-SHARED rule 10 description 'Allow DNS'

set firewall ipv4-name CUSTOMER-TO-SHARED rule 20 action 'accept'
set firewall ipv4-name CUSTOMER-TO-SHARED rule 20 protocol 'udp'
set firewall ipv4-name CUSTOMER-TO-SHARED rule 20 destination port '123'
set firewall ipv4-name CUSTOMER-TO-SHARED rule 20 description 'Allow NTP'

# Применить к VRF
set vrf name CUSTOMER-A ip protocol all export 'CUSTOMER-TO-SHARED'
set vrf name CUSTOMER-B ip protocol all export 'CUSTOMER-TO-SHARED'

commit
save
```

## Интеграция с VK Cloud

### Конфигурация для VK Cloud

```bash
configure

# VK Cloud management (OpenStack Neutron)
set interfaces ethernet eth0 address dhcp
set interfaces ethernet eth0 description 'VK Cloud management'

# VRF конфигурация аналогична Yandex Cloud

# Особенности VK Cloud:
# 1. Security Groups вместо VyOS firewall (или комбинация)
# 2. Floating IP только для management
# 3. MTU 1450 для tenant networks

set interfaces ethernet eth1 mtu '1450'
set interfaces ethernet eth2 mtu '1450'
set interfaces ethernet eth4 mtu '1450'

commit
save
```

### VK Cloud Security Groups

Создать Security Groups в VK Cloud Console для каждого tenant:

**Customer-A SG**:
- Allow DNS (UDP 53) to Shared Services subnet
- Allow NTP (UDP 123) to Shared Services subnet
- Deny all other to Shared Services

**Customer-B SG**:
- Allow DNS (UDP 53) to Shared Services subnet
- Allow NTP (UDP 123) to Shared Services subnet
- Deny all other to Shared Services

## Проверка конфигурации

### Проверка VRF

```bash
# Список VRF
show vrf

# Ожидаемый вывод:
# VRF name          table     description
# --------          -----     -----------
# CUSTOMER-A        101       Tenant A - E-commerce
# CUSTOMER-B        102       Tenant B - Analytics
# SHARED-SERVICES   999       Shared: DNS, NTP, Monitoring

# Детали конкретного VRF
show vrf PRODUCTION
```

### Проверка интерфейсов в VRF

```bash
# Интерфейсы по VRF
show interfaces

# IP адреса в конкретном VRF
ip vrf exec PRODUCTION ip addr show

# Routing table конкретного VRF
show ip route vrf PRODUCTION
show ip route vrf SHARED
```

### Проверка BGP VRF

```bash
# BGP summary для всех VRF
show bgp vrf all summary

# BGP routes в конкретном VRF
show bgp vrf PRODUCTION ipv4 unicast
show bgp vrf SHARED ipv4 unicast

# Route Distinguisher и Route Target
vtysh
show bgp vrf all
show bgp ipv4 vpn
exit
```

### Проверка Route Leaking

```bash
# VRF PRODUCTION должен видеть SHARED (10.255.0.0/24)
show ip route vrf PRODUCTION

# Ожидаемый вывод:
# B>* 10.255.0.0/24 [200/0] via 10.255.0.1 (vrf SHARED), 00:10:00

# VRF SHARED должен видеть PRODUCTION и DEVELOPMENT
show ip route vrf SHARED

# Ожидаемый вывод:
# B>* 10.100.0.0/16 [200/0] via 10.100.1.1 (vrf PRODUCTION), 00:10:00
# B>* 10.200.0.0/16 [200/0] via 10.200.1.1 (vrf DEVELOPMENT), 00:10:00
```

### Тест связности между VRF

```bash
# Ping из PRODUCTION VRF к SHARED services
ip vrf exec PRODUCTION ping 10.255.0.10 count 4

# Ping из PRODUCTION к DEVELOPMENT (должно НЕ работать - нет route leak)
ip vrf exec PRODUCTION ping 10.200.1.10 count 4
# Ожидаемый результат: "Network is unreachable"

# Traceroute в другой VRF
ip vrf exec PRODUCTION traceroute 10.255.0.10
```

### DNS Test (если DNS в SHARED VRF)

```bash
# DNS сервер в SHARED VRF: 10.255.0.53

# Test от PRODUCTION VRF
ip vrf exec PRODUCTION nslookup example.com 10.255.0.53
```

## Troubleshooting

### Проблема 1: VRF не видит маршруты из другого VRF

**Симптомы**:
```bash
show ip route vrf PRODUCTION
# Нет маршрутов из SHARED VRF
```

**Причины и решения**:

1. **Неправильный Route Target**:
   ```bash
   # Проверить RT configuration
   vtysh
   show running-config | grep "route-target"

   # PRODUCTION должен импортировать 65000:999
   # SHARED должен экспортировать 65000:999

   # Исправить
   configure
   set protocols bgp address-family ipv4-unicast vrf PRODUCTION route-target import '65000:999'
   commit
   ```

2. **BGP не запущен для VRF**:
   ```bash
   show bgp vrf PRODUCTION summary
   # Должен показать BGP process

   # Если нет, проверить конфигурацию
   show configuration commands | grep "vrf PRODUCTION"
   ```

3. **Нет анонса сетей**:
   ```bash
   vtysh
   show bgp vrf SHARED ipv4 unicast

   # Должны быть маршруты для announce
   # Добавить network statement
   configure
   set protocols bgp address-family ipv4-unicast vrf SHARED network '10.255.0.0/24'
   commit
   ```

### Проблема 2: Интерфейс не назначен VRF

**Симптомы**:
```bash
show interfaces ethernet eth1
# Нет VRF в output
```

**Решение**:
```bash
configure
set interfaces ethernet eth1 vrf 'PRODUCTION'
commit

# ВАЖНО: После назначения VRF интерфейс будет down/up
# Все IP адреса сохраняются
```

### Проблема 3: IP overlap между VRF вызывает проблемы

**Симптомы**:
CUSTOMER-A и CUSTOMER-B используют 10.0.0.0/8, пакеты идут не туда

**Решение**:
Это нормально для VRF, но нужна правильная конфигурация:

```bash
# Проверить что интерфейсы в правильных VRF
show vrf

# Убедиться что routing table номера уникальные
show configuration commands | grep "table"

# Тестировать connectivity ВСЕГДА с указанием VRF
ip vrf exec CUSTOMER-A ping 10.0.0.1
ip vrf exec CUSTOMER-B ping 10.0.0.1
# Разные destination, несмотря на одинаковый IP
```

### Проблема 4: Performance issues

**Симптомы**:
Медленная скорость между VRF

**Причины**:
- Routing через kernel, не hardware offload
- Firewall processing

**Решение**:
```bash
# Проверить firewall rules
show firewall statistics

# Упростить firewall rules
# Использовать connection tracking
set firewall ipv4-name VRF-TO-VRF rule 1 action 'accept'
set firewall ipv4-name VRF-TO-VRF rule 1 state established 'enable'
set firewall ipv4-name VRF-TO-VRF rule 1 state related 'enable'
commit
```

## Best Practices

### 1. VRF Naming Convention

```bash
# Используйте описательные имена
VRF PRODUCTION        # Не VRF-1
VRF CUSTOMER-ACME     # Не VRF-CUST-001
VRF SHARED-SERVICES   # Не VRF-SHARED
```

### 2. Route Distinguisher (RD) Planning

```bash
# Формат: AS:NN
# AS = ваш AS number (или 65000 для private)
# NN = уникальный номер VRF

# Схема нумерации:
# 65000:100-199  = Production VRFs
# 65000:200-299  = Development VRFs
# 65000:300-399  = Testing VRFs
# 65000:900-999  = Shared/Management VRFs
```

### 3. Route Target Design

**Hub-and-Spoke** (наш пример):
```
PRODUCTION → SHARED (import 999)
DEVELOPMENT → SHARED (import 999)
SHARED → ALL (import 100, 200)
```

**Full Mesh** (все VRF видят друг друга):
```
ALL VRF → (import * export *)
```

**Partial Mesh**:
Используйте route-maps для фильтрации конкретных prefix.

### 4. Security между VRF

```bash
# Используйте firewall даже между VRF
set firewall ipv4-name VRF-ISOLATION default-action 'drop'
set firewall ipv4-name VRF-ISOLATION rule 10 action 'accept'
set firewall ipv4-name VRF-ISOLATION rule 10 destination address '10.255.0.53'
set firewall ipv4-name VRF-ISOLATION rule 10 destination port '53'
set firewall ipv4-name VRF-ISOLATION rule 10 protocol 'udp'

# Применить
set vrf name PRODUCTION ip protocol all export 'VRF-ISOLATION'
commit
```

### 5. Logging и Мониторинг

```bash
# BGP logging
vtysh
conf t
log syslog informational
bgp log-neighbor-changes
exit
exit

# Мониторинг VRF routing tables
watch -n 5 'show ip route vrf PRODUCTION; show ip route vrf SHARED'

# BGP VRF monitoring
watch -n 5 'show bgp vrf all summary'
```

### 6. Documentation

Документируйте VRF topology:

```yaml
# /etc/vyos/vrf-topology.yaml
vrf_topology:
  PRODUCTION:
    table: 100
    rd: "65000:100"
    rt_export: "65000:100"
    rt_import: ["65000:100", "65000:999"]
    interfaces: ["eth1"]
    networks: ["10.100.0.0/16"]
    access_to: ["SHARED"]

  SHARED:
    table: 999
    rd: "65000:999"
    rt_export: "65000:999"
    rt_import: ["65000:100", "65000:200"]
    interfaces: ["eth3"]
    networks: ["10.255.0.0/24"]
    services: ["DNS: 10.255.0.53", "NTP: 10.255.0.123"]
```

## Advanced Configuration

### Route-Maps для Selective Filtering

```bash
configure

# Prefix-list: разрешить только DNS server
set policy prefix-list ALLOW-DNS-ONLY rule 10 action 'permit'
set policy prefix-list ALLOW-DNS-ONLY rule 10 prefix '10.255.0.53/32'

# Route-map: применить prefix-list
set policy route-map FILTER-SHARED-IMPORT rule 10 action 'permit'
set policy route-map FILTER-SHARED-IMPORT rule 10 match ip address prefix-list 'ALLOW-DNS-ONLY'

# Применить route-map к BGP import
# (требуется FRR vtysh)
vtysh
conf t
router bgp 65000
address-family ipv4 unicast vrf PRODUCTION
import vrf route-map FILTER-SHARED-IMPORT
exit
exit
exit
exit
```

### VRF с MPLS (для L3VPN)

```bash
# Enable MPLS на интерфейсах
set interfaces ethernet eth0 mpls

# LDP
set protocols mpls ldp interface 'eth0'
set protocols mpls ldp router-id '192.168.255.1'

# BGP VPNv4
vtysh
conf t
router bgp 65000
address-family vpnv4 unicast
neighbor 192.168.255.2 activate
exit
exit
exit
```

## Ссылки

- [VyOS VRF Configuration](https://docs.vyos.io/en/latest/configuration/vrf/index.html)
- [RFC 4364 - BGP/MPLS IP VPNs](https://datatracker.ietf.org/doc/html/rfc4364)
- [RFC 4659 - BGP-MPLS IP VPN Extension for IPv6](https://datatracker.ietf.org/doc/html/rfc4659)
- [FRRouting VRF Documentation](http://docs.frrouting.org/en/latest/vrf.html)
- [Yandex Cloud VPC](https://cloud.yandex.ru/docs/vpc/)
- [VK Cloud Multi-Tenancy](https://mcs.mail.ru/docs/)