IP Prefix on BGP tunnels

[EsseJay]

Hello, 

We are working with IP prefixes and route filters 

we have a single vrf with 2 Established BGP tunnels. On tunnel for internet traffic and the other for mpls traffic

.1  and .9 for mpls and .17 for internet as per the screenshot 

We created a NAT on the T1 connected to the vrf to translate private IPs to public to access the internet

Created  some prefix lists,  internet-out and mpls-out to steer the traffic to either the  internet bgp tunnel and on the mpls bgp tunnel

mpls-out prefix added to BGP tunnel .1 and .9 

internet-out prefix added to bgp tunnel .17

when the prefixes are added, we can access the internet but not the mpls destinations

when we remove the mpls-out prefix on the mpls bgp tunnel .1 and .9 we can access both internet and mpls but doing a packet capture on the host we see that its the translated ip that is going to both the mpls and internet destinations.

The main goal is NOT to advertize the public IPs out the mpls tunnels .1 and .9, but when we put the filters in place it dosent work as expected.

Are our fliters not properly defined?

[EvertAM]

Where did you apply these exactly? 

You'll generally use prefix lists to filter which routes you accept into the routing table, and which prefixes you want to advertise. 

Your screenshots don't have the name on them, but one of them outright denies everything right at the top, so that's a likely culprit. The list will be checked top to bottom and hit on the first match.

Am I understanding correctly that you're trying to force internet traffic through the internet line, and all other traffic through the MPLS?

[EsseJay]

Hello, 

Yes we are trying to force internet traffic through the internet line, and all other traffic through the MPLS

we applied the routes to the BGP tunnles.

0.0.0.0/0 - deny

public IP-deny

any - permit

The list above is added to the MPLS BGP tunnel to not advertize a default route, not advertize public  and advertize any thing else 

--------------------------------------------------------------------------

The list below is added to the internet  BGP to advertize public IPs only and not advertize anythging else  else  

public IP-permit

0.0.0.0/0 - deny

public IP-deny

[EvertAM]

Are you applying these as incoming or outgoing filters?

[EsseJay]

Out filters on the BGP Tunnels 

[EvertAM]

That's probably not gonna work for your goal. The out filter will filter out routes that the T0 advertises to the outside world. Based on your message, you want to apply something like this to the the MPLS peers (incoming):

0.0.0.0/0 Deny
Any          Allow

This will cause the MPLS peers to not accept a default route from the remote side, this in turn will cause the T0 to not install a default route from the MPLS peers in it's routing table. You might additionally want to add some extra rules in there for other public IP's, but that will depend on your environment. 

For this usecase, you don't necessarily need any other filters I believe.

It is best practice to only allow your own public address space on an outgoing BGP filter (even though your ISP should be filtering this as well), and to deny any incoming private subnets from your ISP (again, they should not send this, but if everyone did there job properly, most of us would be out of a job). All of this assumes that you are directly peering to an ISP of course

[EsseJay]

Yes i am directly peering with the ISP.

Thanks, Ill try what you suggested and let you know how it turns out 

[EsseJay · Accepted solution]

So what i did was to streamline the subnets allowed on the mpls-out IP Prefix rule to only required private subnets

Added a NOSNAT to the private IP subnets with a higher priority than the SNAT, this way this way the NOSNAT rule hits first and allows that traffic through without the IP being translated, and that worked.

The liink below helped 

https://blog.zuthof.nl/2022/08/21/using-no-snat-rules-in-cloud-director-and-nsx/ 

Thanks