June 2018 - frog - lists.frrouting.org

v6 Route Replace semantics
by Donald Sharp 09 Apr '20

09 Apr '20

All - We recently introduced, into master, a new cli switch for zebra on linux `--v6-rr-semantics`. This was allow zebra to take advantage of the linux kernel getting v6 route replace semantics that is coming soon in the 4.18 linux kernel. So if you are on the bleeding edge of linux kernels and FRR you can start to take advantage of this new feature. What are Route Replace semantics you ask? Suppose we have a v6 route with 2 nexthops: S>* 4:6:7::/64 [1/0] via 1:2:3::4, enp0s3, 00:00:02 via 1:2:8::8, enp0s8, 00:00:02 Now suppose we remove a nexthop: robot# conf t robot(config)# no ipv6 route 5:7:9::/78 1:2:8::9 robot(config)# end robot# show ipv6 route [snip] S>* 5:7:9::/78 [1/0] via 1:2:3::4, enp0s3, 00:01:04 Let's look at the netlink notifications for this event: [ROUTE]5:7:9::/78 proto static metric 20 <----------- From creation of the 2x ecmp for 5:7:9::/78 nexthop via 1:2:3::4 dev enp0s3 weight 1 nexthop via 1:2:8::9 dev enp0s8 weight 1 [ROUTE]Deleted 5:7:9::/78 proto static metric 20 <---- We delete the route nexthop via 1:2:3::4 dev enp0s3 weight 1 nexthop via 1:2:8::9 dev enp0s8 weight 1 [ROUTE]5:7:9::/78 via 1:2:3::4 dev enp0s3 proto static metric 20 pref medium <----- We add it back in. In order to get the routes right in the kernel we had to delete the route first and then add it back in. Exposing a small window of packets being dropped while the route is fixed in the fib. Route Replace semantics tells the linux kernel to just replace the nexthops for the route. New packets coming in would immediately start using the new ecmp nexthop group path: [ROUTE]5:7:9::/78 proto static metric 20 nexthop via 1:2:3::4 dev enp0s3 weight 1 nexthop via 1:2:8::9 dev enp0s8 weight 1 [ROUTE]5:7:9::/78 via 1:2:3::4 dev enp0s3 proto static metric 20 pref medium thanks! donald

2 1

FRR on NRL CORE (fyi)
by Phil Wiggins 11 Apr '19

11 Apr '19

If anyone is interested in running FRR in the NRL CORE emulation environment, I have some build scripts for FRR on CORE that I posted at the first link below. Normally CORE runs Quagga, so this script was a hack to shoehorn FRR as a Quagga replacement. These scripts are not part of CORE yet, so are unsupported. People on this list may want to use CORE for FRR experimentation and testing, so you can customize these scripts to suit your own needs. It's best to run this stuff in a VM with no internet connection (after installation) since CORE runs lots of processes as root - a well-known security issue. https://github.com/coreemu/core/issues/170 ( install_frr_for_core.sh) FRR on NRL CORE build script - assumes Ubuntu 16.04.4 clean installation in a VM or physical host: https://gist.github.com/apwiggins/44f3592a61965783372aea5881ed9f7a (core_misc_frr.py ) used by the install script above to install at ./core/misc/frr.py https://gist.github.com/apwiggins/d610c2794c8c0a12a45bfc093fd2e949 (core_services_frr.py) used by the install script above to install at ./core/services/frr.py https://gist.github.com/apwiggins/747a9a14feff2ce3a3b8760406b825a7 https://www.nrl.navy.mil/itd/ncs/products/core The Common Open Research Emulator (CORE) is a tool for emulating networks on one or more machines. You can connect these emulated networks to live networks. CORE consists of a GUI for drawing topologies of lightweight virtual machines, and Python modules for scripting network emulation. Cheers, Phil

2 3

received-routes.. doesn't work?
by Mark Kamichoff 02 Sep '18

02 Sep '18

Hi - I'm running various 3.1-dev versions of FRR and noticed that the "show ip bgp nei <peer> received-routes" doesn't seem to work as expected on any of them. Here's an example of the relevant parts of the configuration: ! router bgp 395460 neighbor 169.254.169.254 remote-as 64515 neighbor 169.254.169.254 password <snip> neighbor 169.254.169.254 ebgp-multihop 2 address-family ipv4 unicast neighbor 169.254.169.254 soft-reconfiguration inbound neighbor 169.254.169.254 route-map DENY_ALL in neighbor 169.254.169.254 route-map DENY_ALL out exit-address-family ! route-map DENY_ALL deny 65535 ! orca# show ip bgp neighbors 169.254.169.254 routes orca# show ip bgp neighbors 169.254.169.254 received-routes BGP table version is 0, local router ID is 10.3.4.36 Status codes: s suppressed, d damped, h history, * valid, > best, = multipath, i internal, r RIB-failure, S Stale, R Removed Origin codes: i - IGP, e - EGP, ? - incomplete Network Next Hop Metric LocPrf Weight Path orca# >From tcpdump and other t-shooting I know that there is an IPv4 DFZ being received, but received-routes doesn't show any of the routes that should be in the adj-rib-in. Oddly, if I remove the inbound route-map I see expected prefixes using the "routes" /and/ "received-routes" command. If I put it back, the "received-routes" shows nothing once again. It would almost seem like soft-reconfiguration isn't really enabled, but received-routes should give me an error if it wasn't and the neighbor information confirms that it is: orca# show ip bgp neighbors 169.254.169.254 <snip> For address family: IPv4 Unicast Update group 5, subgroup 5 Packet Queue length 0 Inbound soft reconfiguration allowed <----- <snip> This isn't limited to the IPv4 AF, either. I've got IPv6 peers that echibit the same behavior. Have I found a bug or am I doing something wrong? I'm happy to file a bug report. More info., if it helps: orca# show version FRRouting 3.1-dev (). Copyright 1996-2005 Kunihiro Ishiguro, et al. configured with: '--build=x86_64-linux-gnu' '--prefix=/usr' '--includedir=${prefix}/include' '--mandir=${prefix}/share/man' '--infodir=${prefix}/share/info' '--sysconfdir=/etc' '--localstatedir=/var' '--disable-silent-rules' '--libexecdir=${prefix}/lib/frr' '--disable-maintainer-mode' '--disable-dependency-tracking' '--enable-exampledir=/usr/share/doc/frr/examples/' '--localstatedir=/var/run/frr' '--sbindir=/usr/lib/frr' '--sysconfdir=/etc/frr' '--enable-ospfapi=yes' '--enable-vtysh=yes' '--enable-isisd=yes' '--enable-multipath=256' '--enable-user=frr' '--enable-group=frr' '--enable-vty-group=frrvty' '--enable-configfile-mask=0640' '--enable-logfile-mask=0640' '--enable-werror' '--enable-gcc-rdynamic' '--with-libpam' '--enable-systemd=yes' '--enable-poll=yes' '--enable-cumulus=yes' '--enable-pimd=yes' '--enable-dependency-tracking' '--enable-bgp-vnc=no' 'build_alias=x86_64-linux-gnu' orca# (orca:20:08:PDT)% uname -a Linux orca 4.9.0-3-amd64 #1 SMP Debian 4.9.25-1 (2017-05-02) x86_64 GNU/Linux (the build is from August 26th) Thanks! - Mark -- Mark Kamichoff prox(a)prolixium.com https://www.prolixium.com/

1 1

Monitoring BGP Sessios with FRR
by Junior Corazza 12 Jul '18

12 Jul '18

Hi, Someone was able to monitor the BGP sessions of the FRR with Zabbix / Observium If so, how did they do it?

2 1

Filter connected routes from being learned ?
by Brandon Applegate 29 Jun '18

29 Jun '18

Hello, I am trying to prevent FRR from picking up a route - let’s call it “mgmt”. These are Ubuntu 16.04 hosts, so I’m using /etc/network/interfaces. I’m using some manual post-up commands to take one of my NICs and put it into the “mgmt” table (already added to /etc/iproute2/rt_tables). This is working as intended. The issue is that FRR is still picking this up as a connected route. I don’t know enough about the innards of FRR, but I’m guessing it’s picking it up from the interface structure in the kernel - as my route table commands have expunged it from the global/default table. So on with my real question - is there a way I can filter this ? I had thought/hoped it would be this: http://docs.frrouting.org/en/latest/zebra.html#zebra-route-filtering Either that doesn’t do what I had hoped - or I’m configuring it wrong. My thought process was to make a PL with a permit matching my mgmt route (10.255.0.0/16) - and a route-map with a deny matching on the PL. Then I would ‘ip protocol connected route-map DENY-MGMT’. I’ve tried this, and restarted FRR, but no matter what - this route keeps finding it’s way back in as “connected”. Any pointers would be greatly appreciated. Thanks. -- Brandon Applegate - CCIE 10273 PGP Key fingerprint: 0641 D285 A36F 533A 73E5 2541 4920 533C C616 703A "For thousands of years men dreamed of pacts with demons. Only now are such things possible."

2 4

Recursive lookup through BGP-LU route
by Carl Baldwin 22 Jun '18

22 Jun '18

Hi, We're experimenting with BGP-LU and frr in our lab. We have two host machines running frr. Each is connected to two TOR switches through their eth0 and eth1 links (four TORs total). Those are connected through another pair of switches. We have configured BGP-LU to distribute MPLS labels over ebpg throughout. Connectivity between loopback addresses on the two hosts works well at this point. Then, I created some namespaces in the hosts and gave them addresses. We use BGP to announce those addresses as /32 routes with the loopback address as the next hop. The route between namespaces on the two machines is recursively resolved so that they push the same MPLS label as the path to the other loopback. This all works well to start off with and we did some iperf runs that showed pretty good results. ECMP was working because the bandwidth was higher than any single link. After some link state changes, we seemed to lose the connection. However, pings between the loopback addresses still worked. After some time, we noticed that the MPLS labels in the routes to the namespace addresses (/32s) were different than the label in the route to the loopback. Since the former routes are resolved recursively using the latter, the labels should always be the same. Could this be a bug in FRR? Shouldn't the routes to the namespaces be invalidated or updated as soon as the route it was based on changed? The traffic between namespaces is getting dropped because the switch doesn't know about the label being pushed by the host. Any insight would be very helpful. Thanks! Carl Baldwin PS Below are a few screen captures that I copied before restarting FRR to get things back. Here are /32 routes received. 10.112.128.1 is the loopback on the other host. The four routes are to four namespaces on the other host. lab1r2u05# show ip bgp neighbor 10.112.97.1 received-routes BGP table version is 0, local router ID is 10.112.128.2 Status codes: s suppressed, d damped, h history, * valid, > best, = multipath, i internal, r RIB-failure, S Stale, R Removed Origin codes: i - IGP, e - EGP, ? - incomplete Network Next Hop Metric LocPrf Weight Path *> 10.224.12.10/32 10.112.128.1 0 4206900001 4206909998 i *> 10.224.12.15/32 10.112.128.1 0 4206900001 4206909998 i *> 10.224.12.70/32 10.112.128.1 0 4206900001 4206909998 i *> 10.224.12.75/32 10.112.128.1 0 4206900001 4206909998 i Total number of prefixes 4 Below is the routing table as it looked when we lost connectivity. Notice that the mpls label for the loopback route is 306592 via eth1 but the label for the four namespace addresses is 306576. root@lab1r2u05:~/ovs-droplets# ip route default via 10.112.2.132 dev eth2 10.112.2.128/25 dev eth2 proto kernel scope link src 10.112.2.145 10.112.128.1 encap mpls 306592 via 10.112.129.9 dev eth1 proto 186 metric 20 10.112.129.8/30 dev eth1 proto kernel scope link src 10.112.129.10 10.112.129.12/30 dev eth0 proto kernel scope link src 10.112.129.14 10.224.12.10 encap mpls 306576 via 10.112.129.9 dev eth1 proto 186 metric 20 10.224.12.15 encap mpls 306576 via 10.112.129.9 dev eth1 proto 186 metric 20 10.224.12.70 encap mpls 306576 via 10.112.129.9 dev eth1 proto 186 metric 20 10.224.12.75 encap mpls 306576 via 10.112.129.9 dev eth1 proto 186 metric 20 10.224.12.20 dev br0 scope link 10.224.12.25 dev br0 scope link 10.224.12.80 dev br0 scope link 10.224.12.85 dev br0 scope link

1 0

how to configure mpls l2 and l3 circuit
by Sanjoy 12 Jun '18

12 Jun '18

Hi, I have faced mpls configuration. Is it possible to configure mpls l2 and l3 cirucit. Regards Sanjoy

1 0

how to configure mpl l2 and l3 circuit
by Sanjoy 12 Jun '18

12 Jun '18

Hi, I have faced mpls configuration. Is is possible to configure mpls l2 and l3 cirucit. Regards Sanjoy

1 0

FRR not adding kernel default route
by Felipe Arturo Polanco 09 Jun '18

09 Jun '18

Hi, I have a strange issue where FRR does not pull the kernel default route into its routing table, it does accept any other static route that is not 0.0.0.0/0 into its table: FRR routing table: FRR03# show ip route Codes: K - kernel route, C - connected, S - static, R - RIP, O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP, T - Table, v - VNC, V - VNC-Direct, A - Babel, D - SHARP, F - PBR, > - selected route, * - FIB route C>* 1.10.1.3/32 is directly connected, lo, 00:58:38 C>* 192.168.17.0/24 is directly connected, ens37, 00:58:38 C>* 192.168.44.0/24 is directly connected, ens33, 00:58:38 Linux routing table: [root@FRR03 ~]# ip route show default via 192.168.44.2 dev ens33 proto static metric 100 192.168.17.0/24 dev ens37 proto kernel scope link src 192.168.17.137 metric 100 192.168.44.0/24 dev ens33 proto kernel scope link src 192.168.44.145 FRR show running output: FRR03# sh run Building configuration... Current configuration: ! frr version 4.1-dev-MyOwnFRRVersion frr defaults traditional hostname FRR03 log syslog ! interface lo ip address 1.10.1.3/32 ! line vty ! end *** Adding static route in Linux *** [root@FRR03 ~]# ip route add 172.16.25.0/24 via 192.168.44.2 [root@FRR03 ~]# vtysh FRR03# show ip route Codes: K - kernel route, C - connected, S - static, R - RIP, O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP, T - Table, v - VNC, V - VNC-Direct, A - Babel, D - SHARP, F - PBR, > - selected route, * - FIB route C>* 1.10.1.3/32 is directly connected, lo, 01:01:15 K>* 172.16.25.0/24 [0/0] via 192.168.44.2, ens33, 00:00:05 C>* 192.168.17.0/24 is directly connected, ens37, 01:01:15 C>* 192.168.44.0/24 is directly connected, ens33, 01:01:15 Due to this issue FRR protocols cannot work correctly eg: BGP cannot peer with a neighbor that is not on a directly connected network or added statically. Does anyone have an idea of what this could be? Thanks,

2 1