How to Configure and Activate a Virtual Router Instance with Hardware, Virtual, VLAN, or Bundled Interfaces

Virtual routers forward traffic like physical routers. Because they are virtual, these routers can be configured and activated on demand without the need of using a separate hardware device. Each virtual router uses its own routing and forwarding table. The routing and forwarding table describes the path between multiple interfaces that packets travel through.

The following example demonstrates how to connect a private network (e.g., a classroom) that gets access to the Internet via a virtual router. The private network will be connected on interface eth2, the Internet to the interface eth3. In this setup, the firewall service will be transparent to the additional virtual router instance only if authenticated users are not defined. All other services are not available to the additional virtual router. For more information on which services are available for additional virtual instances, see Virtual Routing and Forwarding (VRF).

Step 1. Create a Virtual Router Node

1. Go to CONFIGURATION > Configuration Tree > Box.
2. Right-click Network.
3. From the menu, select Lock.
4. (optional) In case the firewall is a CC-managed appliance:
   1. The window for Emergency Override is displayed.
   2. Click OK if you want to override the configuration provided by the Control Center.
5. From the menu, select Create Virtual Router Instance.
6. The window for naming the virtual router is displayed.
7. Enter the name for the virtual router, e.g., VR01.
8. Click OK.
9. In the ribbon bar, click Activate.
10. The Activate Changes window opens.
11. Click Activate.
12. The virtual router node is displayed one hierarchy level below Network.
    

Step 2. Create the Virtual Router and Assign Required Interfaces (Hardware, Virtual, VLAN, and Bundled Interfaces)

Before the creation of a virtual router, all interfaces are assigned to the 'default' router.

1. Go to CONFIGURATION > Configuration Tree > Box > Network.
2. In the left menu, select Virtual Router.
3. Click Lock.
4. In the list, double-click the entry with the interface that you want to assign to the virtual router node, e.g., eth2 to VR01.
5. The Virtual Router Interface Assignment window is displayed.
6. From Virtual Router Name, select your virtual router, e.g., VR01.
   
7. Click OK.
8. (optional) In case you want to assign further interfaces, repeat the previous four steps.
9. Click Send Changes.
10. Click Activate.
    

Step 3. Activate the New Network Configuration

After assigning interfaces to the virtual router, the network must be re-activated with the new interface assignment.

1. Go to CONTROL > Box.
2. In the left menu, click Network to expand the menu.
3. Click Activate new network configuration.
4. The Network Activation window is displayed.
5. Click Failsafe.

Step 4. Configure Network/IP Addresses

The new virtual router needs to know which IP address(es) is/are assigned to which interface(s) and define the network path, e.g., the path from the classroom to the Internet.

1. Go to CONFIGURATION > Configuration Tree > Box.
2. In case your virtual router node is not displayed, click the + to the left of the node Network.
3. Double-click VR Instance [ your virtual router ].

4. The newly created VR instance is displayed showing the state and the ID of the instance.
   

   Do not change the VR Instance ID after clicking Send Changes and Activate!
   If you must change the ID of an active virtual router, you must first delete the active instance and then create a new virtual instance!
   For more information, see How to Delete a Virtual Router Instance and this article.
5. Click Lock.
6. From the left menu, select IP Configuration.
7. In the IPv4 Addresses section, click +.
8. The IPv4 Addresses window opens.
9. Enter the name for the IP address, e.g., VR01-to-Classroom1. The IP Address Configuration window opens.
   • Interface Name – Select the interface that will be managed by the virtual router, e.g., eth2.
   • IP Address – Enter the IP address that must be assigned to the interface, e.g., 192.168.0.1
   • Associated Netmask – Select the size of the netmask from the list, e.g., 24-bit.
   • Responds to Ping – Select yes in case you want the interface to respond to ICMP ping packets.
10. Click OK.
11. Repeat all steps beginning with Step 7 for the IP address that will be connected to the Internet, e.g., VR01-to-INTERNET, eth3, 62.99.0.29.
12. Click Send Changes.
13. Click Activate.
    

Step 5. Configure the Routing Table

Configure all routes according to your needs. In this example, a default route is added to the routing table of VR01.

1. Go to CONFIGURATION > Configuration Tree > Box > Network > VR Instance [ your virtual router ].
2. In the left menu, click Routing.
3. Click Lock.
4. In the IPv4 Routing Table section, click +.
5. The IPv4 Routing Table window is displayed.
6. Enter the name for the new routing table entry, e.g., VR01-to-INTERNET. The window for the Route Configuration is displayed.
   • Target Network Address – Enter the IP address of the destination network, e.g. 0.0.0.0/0
   • Route Type – Select gateway.
   • Gateway – Enter the IP address to the gateway, e.g., 62.99.0.254
7. Click OK.
8. Click Send Changes and Activate.
   

Step 6. Verify the New Network Configuration

1. Go to CONTROL > Network.
2. In the left column, select default to display the network settings for the default router.
   
3. In the left column, select VR01 to display the network setting for the virtual router VR01.
   

Step 7. Create an Access Rule for the Newly Created Virtual Router VR01

To pass traffic from interface eth2 (192.168.0.254/32) to eth3 (62.99.0.29/32), create an access rule and constrain the access rule to the virtual router VR01.

1. Go to CONFIGURATION > Configuration Tree > Assigned Services > NGFW (Firewall) > Forwarding Rules.
2. Click Lock.
3. Click + to add an access rule.
4. For the access rule type, select Pass.
5. Enter a name for the access rule. For a better differentiation between rules that apply to the default router instance and a better overview, it is recommended to prepend a prefix like 'VRF' or 'VR01' to the name of the access rule, e.g., VRF-Classroom-to-INTERNET.
   • Source VR Instance – Select the name of the virtual router instance that you created in Step 1.
   • Destination VR Instance – Select the name of the virtual router instance that you created in Step 1.
   • Source – Enter the IP address of the source network, e.g., 192.168.0.0/24.
   • Service – Select Any.
   • Destination – Enter the IP address for the Internet from the list.
   • Application Policy – In case you have licensed Application Control, you can activate it now.
   • Connection Method – Select Dynamic NAT.
6. Click OK.
7. Click Send Changes and Activate.
   

Step 8. Activate Columns to Display the Traffic Flow Through Your Virtual Router Instance

1. Go to FIREWALL > Live.
2. Right-click on any of the column identifiers of the Live view.
3. From the menu, select Columns -> Src. VR Instance.
4. Right-click on any of the column identifiers of the Live view.
5. From the menu, select Columns -> Dst. VR Instance.
   

Step 9. Verify that Traffic is Flowing from the Source Network to the Internet

Set up a client with an IP address in the source network (e.g., 192.168.0.1) and set the default route on the client to the address of the virtual router, e.g., 192.168.0.254.

1. On your client, open a web browser and go to a website of your choice, e.g., www.nytimes.com
2. Go to FIREWALL > Live.
3. The Live view will display a mix of traffic flowing both through the default router and the virtual router you configured before, e.g., VR01.
   
4. In order to restrict display output only to the URL you entered before, activate a display filter for the virtual router instance by clicking on the filter symbol in any of the lines showing VR01.