May 2018 - frog - lists.frrouting.org

v6 Route Replace semantics
by Donald Sharp 09 Apr '20

09 Apr '20

All - We recently introduced, into master, a new cli switch for zebra on linux `--v6-rr-semantics`. This was allow zebra to take advantage of the linux kernel getting v6 route replace semantics that is coming soon in the 4.18 linux kernel. So if you are on the bleeding edge of linux kernels and FRR you can start to take advantage of this new feature. What are Route Replace semantics you ask? Suppose we have a v6 route with 2 nexthops: S>* 4:6:7::/64 [1/0] via 1:2:3::4, enp0s3, 00:00:02 via 1:2:8::8, enp0s8, 00:00:02 Now suppose we remove a nexthop: robot# conf t robot(config)# no ipv6 route 5:7:9::/78 1:2:8::9 robot(config)# end robot# show ipv6 route [snip] S>* 5:7:9::/78 [1/0] via 1:2:3::4, enp0s3, 00:01:04 Let's look at the netlink notifications for this event: [ROUTE]5:7:9::/78 proto static metric 20 <----------- From creation of the 2x ecmp for 5:7:9::/78 nexthop via 1:2:3::4 dev enp0s3 weight 1 nexthop via 1:2:8::9 dev enp0s8 weight 1 [ROUTE]Deleted 5:7:9::/78 proto static metric 20 <---- We delete the route nexthop via 1:2:3::4 dev enp0s3 weight 1 nexthop via 1:2:8::9 dev enp0s8 weight 1 [ROUTE]5:7:9::/78 via 1:2:3::4 dev enp0s3 proto static metric 20 pref medium <----- We add it back in. In order to get the routes right in the kernel we had to delete the route first and then add it back in. Exposing a small window of packets being dropped while the route is fixed in the fib. Route Replace semantics tells the linux kernel to just replace the nexthops for the route. New packets coming in would immediately start using the new ecmp nexthop group path: [ROUTE]5:7:9::/78 proto static metric 20 nexthop via 1:2:3::4 dev enp0s3 weight 1 nexthop via 1:2:8::9 dev enp0s8 weight 1 [ROUTE]5:7:9::/78 via 1:2:3::4 dev enp0s3 proto static metric 20 pref medium thanks! donald

2 1

received-routes.. doesn't work?
by Mark Kamichoff 02 Sep '18

02 Sep '18

Hi - I'm running various 3.1-dev versions of FRR and noticed that the "show ip bgp nei <peer> received-routes" doesn't seem to work as expected on any of them. Here's an example of the relevant parts of the configuration: ! router bgp 395460 neighbor 169.254.169.254 remote-as 64515 neighbor 169.254.169.254 password <snip> neighbor 169.254.169.254 ebgp-multihop 2 address-family ipv4 unicast neighbor 169.254.169.254 soft-reconfiguration inbound neighbor 169.254.169.254 route-map DENY_ALL in neighbor 169.254.169.254 route-map DENY_ALL out exit-address-family ! route-map DENY_ALL deny 65535 ! orca# show ip bgp neighbors 169.254.169.254 routes orca# show ip bgp neighbors 169.254.169.254 received-routes BGP table version is 0, local router ID is 10.3.4.36 Status codes: s suppressed, d damped, h history, * valid, > best, = multipath, i internal, r RIB-failure, S Stale, R Removed Origin codes: i - IGP, e - EGP, ? - incomplete Network Next Hop Metric LocPrf Weight Path orca# >From tcpdump and other t-shooting I know that there is an IPv4 DFZ being received, but received-routes doesn't show any of the routes that should be in the adj-rib-in. Oddly, if I remove the inbound route-map I see expected prefixes using the "routes" /and/ "received-routes" command. If I put it back, the "received-routes" shows nothing once again. It would almost seem like soft-reconfiguration isn't really enabled, but received-routes should give me an error if it wasn't and the neighbor information confirms that it is: orca# show ip bgp neighbors 169.254.169.254 <snip> For address family: IPv4 Unicast Update group 5, subgroup 5 Packet Queue length 0 Inbound soft reconfiguration allowed <----- <snip> This isn't limited to the IPv4 AF, either. I've got IPv6 peers that echibit the same behavior. Have I found a bug or am I doing something wrong? I'm happy to file a bug report. More info., if it helps: orca# show version FRRouting 3.1-dev (). Copyright 1996-2005 Kunihiro Ishiguro, et al. configured with: '--build=x86_64-linux-gnu' '--prefix=/usr' '--includedir=${prefix}/include' '--mandir=${prefix}/share/man' '--infodir=${prefix}/share/info' '--sysconfdir=/etc' '--localstatedir=/var' '--disable-silent-rules' '--libexecdir=${prefix}/lib/frr' '--disable-maintainer-mode' '--disable-dependency-tracking' '--enable-exampledir=/usr/share/doc/frr/examples/' '--localstatedir=/var/run/frr' '--sbindir=/usr/lib/frr' '--sysconfdir=/etc/frr' '--enable-ospfapi=yes' '--enable-vtysh=yes' '--enable-isisd=yes' '--enable-multipath=256' '--enable-user=frr' '--enable-group=frr' '--enable-vty-group=frrvty' '--enable-configfile-mask=0640' '--enable-logfile-mask=0640' '--enable-werror' '--enable-gcc-rdynamic' '--with-libpam' '--enable-systemd=yes' '--enable-poll=yes' '--enable-cumulus=yes' '--enable-pimd=yes' '--enable-dependency-tracking' '--enable-bgp-vnc=no' 'build_alias=x86_64-linux-gnu' orca# (orca:20:08:PDT)% uname -a Linux orca 4.9.0-3-amd64 #1 SMP Debian 4.9.25-1 (2017-05-02) x86_64 GNU/Linux (the build is from August 26th) Thanks! - Mark -- Mark Kamichoff prox(a)prolixium.com https://www.prolixium.com/

1 1

DMVPN NHRP assitance
by Felipe Arturo Polanco 19 May '18

19 May '18

Hi, I'm having trouble getting DMVPN to work in FRR. I followed this guide: https://wiki.alpinelinux.org/wiki/Dynamic_Multipoint_VPN_(DMVPN)_Phase_3_wi… I installed patched strongswan as per the instruction in the README file: https://github.com/FRRouting/frr/blob/master/nhrpd/README.nhrpd But still I cannot figure out how to establish a connection between a hub and a spoke. There is this error in the logs on both hub and spoke: May 09 23:24:19 FRR01 charon-systemd[107289]: vici initiate 'dmvpn' May 09 23:24:19 FRR01 nhrpd[107823]: VICI: Key 'success'='no' May 09 23:24:19 FRR01 charon-systemd[107289]: unable to resolve %any, initiate aborted May 09 23:24:19 FRR01 nhrpd[107823]: VICI: Key 'errmsg'='establishing CHILD_SA 'dmvpn' failed' May 09 23:24:19 FRR01 charon-systemd[107289]: tried to checkin and delete nonexisting IKE_SA May 09 23:24:19 FRR01 nhrpd[107823]: VICI: strongSwan: establishing CHILD_SA 'dmvpn' failed Spoke: FRR01# sh dmvpn Src Dst Flags SAs Identity 192.168.17.131 192.168.17.135 n 0 FRR01# sh ip nhrp Iface Type Protocol NBMA Flags Identity gre1 local 10.255.255.2 - - interface gre1 ip nhrp holdtime 3600 ip nhrp network-id 1 ip nhrp nhs dynamic nbma 192.168.17.135 ip nhrp registration no-unique ip nhrp shortcut no link-detect tunnel protection vici profile dmvpn tunnel source ens37 ------- Hub: FRR_RR01# sh dmvpn Src Dst Flags SAs Identity FRR_RR01# sh ip nhrp Iface Type Protocol NBMA Flags Identity gre1 local 10.255.255.1 - - interface gre1 ip nhrp holdtime 3600 ip nhrp network-id 1 ip nhrp nhs dynamic nbma 192.168.17.135 ip nhrp redirect ip nhrp registration no-unique ip nhrp shortcut no link-detect tunnel protection vici profile dmvpn tunnel source ens37 --- /etc/swanctl/swanctl.conf [root@FRR_RR01 ~]# cat /etc/swanctl/swanctl.conf connections { dmvpn { version = 2 pull = no mobike = no dpd_delay = 15 dpd_timeout = 30 fragmentation = yes unique = replace rekey_time = 4h reauth_time = 13h proposals = aes256-sha512-ecp384 local { auth = psk id = hub } remote { auth = psk } children { dmvpn { esp_proposals = aes256-sha512-ecp384 local_ts = dynamic[gre] remote_ts = dynamic[gre] inactivity = 90m rekey_time = 100m mode = transport dpd_action = clear reqid = 1 } } } } --- Any idea what could be wrong?

1 2

getting "closing connection to zebra because of an I/O error!"
by Edvinas K 17 May '18

17 May '18

Hello, i'm using Centos 7 and FRR 4.0 and i'm getting "closing connection to zebra because of an I/O error!" when doing something in vtysh terminal. Any ways to prevent this ? Thanks

2 2

features support in FRR 4.0.
by Edvinas K 16 May '18

16 May '18

Hello, can I get a confirmation that these 3 features are supported in FRR 4.0 ? BGP: BGP Custom distance command bgp Maximum-paths OSPFv2: ospf multiple processes Thanks

2 1

OSPFv2 multiple processes
by Edvinas K 16 May '18

16 May '18

Hello, Do FRR 4.0 supports OSPFv2 multiple processes ?

1 0

can't start vtysh
by Edvinas K 15 May '18

15 May '18

Hello, Removed Quagga and Installed FRR on Centos 7. Then trying to start vtysh im getting this kind of error: Exiting: failed to connect to any daemons. Also, when looking status: prod [root@netvpn001prpjay ~]# systemctl status frr ● frr.service - FRRouting (FRR) Loaded: loaded (/usr/lib/systemd/system/frr.service; disabled; vendor preset: disabled) Active: inactive (dead) May 15 17:26:45 netvpn001prpjay systemd[1]: Started FRRouting (FRR). May 15 17:27:02 netvpn001prpjay systemd[1]: Starting FRRouting (FRR)... May 15 17:27:02 netvpn001prpjay frr[5470]: Loading capability module if not yet done. May 15 17:27:02 netvpn001prpjay frr[5470]: Starting FRRouting daemons (prio:10): May 15 17:27:02 netvpn001prpjay frr[5479]: Stopping FRRouting monitor daemon: May 15 17:27:02 netvpn001prpjay frr[5479]: Stopping FRRouting daemons (prio:0): May 15 17:27:02 netvpn001prpjay frr[5479]: Stopping other FRRouting daemons May 15 17:27:02 netvpn001prpjay frr[5479]: Removing remaining .vty files May 15 17:27:02 netvpn001prpjay frr[5479]: Removing all routes made by zebra. May 15 17:27:02 netvpn001prpjay systemd[1]: Started FRRouting (FRR). systemctl start frr seems doesn't help to. Any advices ? Thanks

2 1

Zebra with no kernel routes: any real users?
by Andrey Korolyov 14 May '18

14 May '18

Hi, as frr implements protobuf communication for convenient route side-handling for some time, are there any cases around where OS kernel is not needed anymore for route handling, while bgp reflector/serializer still needs to be used? For example, one may imagine full-view or something like that being pushed to the every compute node to virtual switch which handles actual traffic overlay - in this case, route redistributor such as frr need not to maintain the same full view somewhere outside the reflector application. Would be upstreaming of this case useable for anyone or I`m just projecting special needs for specially-designed software as a generic solution? If not, are there any reasons behind current lack of implementation of no-op zebra? Thanks. [please CC be back, I`m not a persistent frog@ subscriber]

2 1

NS initialization failure 2(No such file or directory)
by Greg 07 May '18

07 May '18

I have a fresh build of frr github; when I run zebra, ospfd, I get the following error # zebra -d 2018/05/04 17:15:17 errors: ZEBRA: NS initialization failure 2(No such file or directory) 2018/05/04 17:15:17 warnings: ZEBRA: Disabling MPLS support (no kernel support) # ospfd -d 2018/05/04 17:15:30 errors: OSPF: NS initialization failure 2(No such file or directory) 1) What is the error "NS initialization failure 2(No such file or directory)" 2) How to enable MPLS support in the kernel 3) Is there start up script for frr like the one available for quagga as quagga.init ( https://github.com/openembedded/meta-openembedded/blob/master/meta-networki… ) Greg

2 1

Re: [FROG] Questions of bgp vrf configuration
by Lou Berger 03 May '18

03 May '18

Hi, An example topology using mpls L3vpns can be found at: https://github.com/FRRouting/topotests/tree/master/bgp_l3vpn_to_bgp_vrf This example uses the following topology (in customize.py) customize.py: Simple FRR/Quagga MPLS L3VPN test topology | +----+----+ | ce1 | | 99.0.0.1| CE Router +----+----+ 192.168.1. | .2 ce1-eth0 | .1 r1-eth4 +---------+ | r1 | | 1.1.1.1 | PE Router +----+----+ | .1 r1-eth0 | ~~~~~~~~~~~~~ ~~ sw0 ~~ ~~ 10.0.1.0/24 ~~ ~~~~~~~~~~~~~ |10.0.1.0/24 | | .2 r2-eth0 +----+----+ | r2 | | 2.2.2.2 | P router +--+---+--+ r2-eth2 .2 | | .2 r2-eth1 ______/ \______ / \ ~~~~~~~~~~~~~ ~~~~~~~~~~~~~ ~~ sw2 ~~ ~~ sw1 ~~ ~~ 10.0.3.0/24 ~~ ~~ 10.0.2.0/24 ~~ ~~~~~~~~~~~~~ ~~~~~~~~~~~~~ | / | \ _________/ | \ / \ r3-eth1 .3 | | .3 r3-eth0 | .4 r4-eth0 +----+--+---+ +----+----+ | r3 | | r4 | r4-eth5 | 3.3.3.3 | | 4.4.4.4 |-------+ PE Routers +-----------+ +---------+ | 192.168.1.1 |r3.eth4 192.168.1.1 | r4-eth4 |192.168.2.1 .2 | ceX-eth0 .2 | | .2 +-----+-----+ +----+-----+ +----+-----+ | ce2 | | ce3 | | ce4 | | 99.0.0.2 | | 99.0.0.3 | | 99.0.0.4 | CE Routers +-----+-----+ +----+-----+ +----+-----+ | | | r1, r3 and r4 all have VRFs configured, e.g., https://github.com/FRRouting/topotests/blob/master/bgp_l3vpn_to_bgp_vrf/r1/… router bgp 5227 vrf r1-cust1 bgp router-id 192.168.1.1 neighbor 192.168.1.2 remote-as 5227 neighbor 192.168.1.2 update-source 192.168.1.1 address-family ipv4 unicast neighbor 192.168.1.2 activate neighbor 192.168.1.2 next-hop-self label vpn export 101 rd vpn export 10:1 rt vpn both 52:100 import vpn export vpn exit-address-family ! The configuration is also documented under https://github.com/FRRouting/frr/blob/master/doc/user/bgp.rst If you find this documentation inadequate, please open an issue and provide feedback. Cheers, Lou On 5/2/2018 9:45 AM, iwanyu at tencent.com (iwanyu(余清炎)) wrote: > Hi， > > As said in the frrouting document，Configuration for vrf exported routes must, at a minimum, specify two parameters：RD and RTLIST. Configuration of route leaking between a unicast VRF RIB and the VPN safi RIB of the default VRF is accomplished via commands in the context of a VRF address-family. > > So, where is the command “rd vpn export AS:NN|IP:nn”, I can’t find it in frrouting, please show me how can I configuration this command, thanks.

1 0