We’ve noticed that there is an unexpected issue when trying to perform an ssh/scp from vyos to other destination when being routed through VRF.
In our scenario we have vyos with eth0 in network_A, with vrf for management. We’ve also have 2 other interfaces for lan/wan. We want to ssh/scp from vyos management to other server in network_B, for that we’ve configured a static route. We can ping the other host, and performing a tcpdump we capture the SYN and SYN ACK packets, but after that, the vyos sends a RESET and is not possible to establish the connection.
Is there a kind of bug for this situation regarding VRF and handshake? It seems that there is no routing issue at all…
here more details regarding configuration:
set interfaces ethernet eth0 vrf 'management' set protocols static route DESTINATION_IP next-hop VRF_GATEWAY next-hop-vrf 'management' set protocols vrf management static route 0.0.0.0/0 next-hop VRF_GATEWAY set service ssh vrf 'management' set vrf name management table '1'
and the tcpdump performed in vyos eth0:
10:37:54.429608 IP VYOS_VRF_IP.36294 > DESTINATION_IP.22: Flags [S], seq 3067936304, win 64240, options [mss 1460,sackOK,TS val 2474142607 ecr 0,nop,wscale 7], length 0 10:37:54.463050 IP DESTINATION_IP.22 > VYOS_VRF_IP.36294: Flags [S.], seq 1420136728, ack 3067936305, win 28960, options [mss 1460,sackOK,TS val 1310452683 ecr 2474142607,nop,wscale 7], length 0 10:37:54.463076 IP VYOS_VRF_IP.36294 > DESTINATION_IP.22: Flags [R], seq 3067936305, win 0, length 0
Many thanks and regards