topic Re: In route and out route filter in VMware NSX Discussions

In route and out route filter

MrVmware9423 — Wed, 03 May 2023 05:03:49 GMT

Dear Team,

I'v seen In route and out route filter configured in customer environment, just wanted to know what exactly this option do and also need to know when to select what option? Could some throw some light on this. wh

Thank you in advance

Re: In route and out route filter

ShahabKhan — Wed, 03 May 2023 07:23:11 GMT

Hi,

Well, it depends on what you are trying to achieve. I have used out filter to configure AS-Path prepend for advertised routes & in filter for Local-Preference for learned routes.

Re: In route and out route filter

MrVmware9423 — Wed, 03 May 2023 09:30:21 GMT

Thank you Shahab, could you please explain the same in simple english. Thank you..

Re: In route and out route filter

ShahabKhan — Thu, 04 May 2023 08:55:08 GMT

These filters we use for route manipulation. In my case, I wanted to influence incoming & outgoing traffic so that one datacenter should be active & another standby, therefore, I used AS-Path prepend & local preference. There are other use cases as well, for example, you want to block certain subnets to be advertised to your BGP peer.

Re: In route and out route filter

engyak — Sat, 06 May 2023 16:54:07 GMT

This should be used in all production deployments involving NSX - at a minimum, it prevents NSX from distributing routes that it shouldn't. NSX is a participating member of a larger network and should abide by the "do no harm" standards that other networking gear does.

For example, if a user creates a new segment with an IPv4 address of 10.0.0.1/24 and that prefix is used elsewhere, NSX should either intercept the request (this takes a lot of coding or "contain the damage" by preventing a bogus prefix from propagating to the wider network.

The same can be done inbound if there's a complex routing configuration, but most aren't. At a minimum, I'd recommend having some kind of "sanity check" implemented here to make NSX more reliable.

What I describe above is basically a minimum. This feature is incredibly powerful when trying to manipulate traffic flow, and is worth learning overall.

A fun fact about NSX Edges - they use FRRouting, which requires a prefix-list or route-map to function - so NSX creates an "allow all" entry for you.