January 2019 - frog - lists.frrouting.org

Tunnel Encap attribute sub-tlv length
by Abel Alejandro 07 Jan '19

07 Jan '19

Hello, I have a eBGP with two transit providers and they both died with the same error, as follows: Jan 7 10:51:59 serveru-1 bgpd[1776]: Tunnel Encap attribute sub-tlv length 48582 exceeds remaining length 28 Jan 7 10:51:59 serveru-1 bgpd[1776]: <IP>: Attribute VNC, parse error Jan 7 10:51:59 serveru-1 bgpd[1776]: bgp_process_packet: BGP UPDATE receipt failed for peer: <IP> It seems both providers sent something frr didnt like, is there a way to avoid a shutdown on this case? serveru-1# show ver FRRouting 6.0 (serveru-1). Copyright 1996-2005 Kunihiro Ishiguro, et al. configured with: '--build=x86_64-linux-gnu' '--prefix=/usr' '--includedir=${prefix}/include' '--mandir=${prefix}/share/man' '--infodir=${prefix}/share/info' '--sysconfdir=/etc' '--localstatedir=/var' '--disable-silent-rules' '--libexecdir=${prefix}/lib/frr' '--disable-maintainer-mode' '--disable-dependency-tracking' '--enable-exampledir=/usr/share/doc/frr/examples/' '--localstatedir=/var/run/frr' '--sbindir=/usr/lib/frr' '--sysconfdir=/etc/frr' '--disable-snmp' '--enable-ospfapi=yes' '--enable-multipath=256' '--enable-ldpd' '--enable-fpm' '--enable-user=frr' '--enable-group=frr' '--enable-vty-group=frrvty' '--enable-configfile-mask=0640' '--enable-logfile-mask=0640' '--enable-werror' '--with-libpam' '--enable-systemd=yes' '--enable-poll=yes' '--enable-cumulus=no' '--enable-pimd' '--enable-dependency-tracking' '--enable-bgp-vnc=yes' '--disable-rpki' '--enable-bfdd' 'CFLAGS=-g -O2 -fdebug-prefix-map=/home/ci/cibuild.6/debwork/frr-6.0=. -fstack-protector-strong -Wformat -Werror=format-security' 'CPPFLAGS=-Wdate-time -D_FORTIFY_SOURCE=2' 'CXXFLAGS=-g -O2 -fdebug-prefix-map=/home/ci/cibuild.6/debwork/frr-6.0=. -fstack-protector-strong -Wformat -Werror=format-security' 'FCFLAGS=-g -O2 -fdebug-prefix-map=/home/ci/cibuild.6/debwork/frr-6.0=. -fstack-protector-strong' 'FFLAGS=-g -O2 -fdebug-prefix-map=/home/ci/cibuild.6/debwork/frr-6.0=. -fstack-protector-strong' 'GCJFLAGS=-g -O2 -fdebug-prefix-map=/home/ci/cibuild.6/debwork/frr-6.0=. -fstack-protector-strong' 'LDFLAGS=-Wl,-z,relro -Wl,-z,now' 'OBJCFLAGS=-g -O2 -fdebug-prefix-map=/home/ci/cibuild.6/debwork/frr-6.0=. -fstack-protector-strong -Wformat -Werror=format-security' 'OBJCXXFLAGS=-g -O2 -fdebug-prefix-map=/home/ci/cibuild.6/debwork/frr-6.0=. -fstack-protector-strong -Wformat -Werror=format-security' 'build_alias=x86_64-linux-gnu' serveru-1#

1 0

BGP Updates -- how often?
by John Antypas 04 Jan '19

04 Jan '19

OK - thanks to this list, I've made some progress, but.... * We've set up a VTI tunnel between the two PFSense boxes -- it works * We have BGP enabled and when both ends are started up, the BGP routes are exchanged and then given to each side's OSPF * Everything works, routing-wise -- things enter the kernel BUT.... * After a while, it seems the receiving side loses the BGP routes -- if A publishes routes to B, B will lose the BGP routes. I have to start both BGP processes again. The processes were running before but I need to get the routes "re-published" * Static routes never go away - they are published all of the time Clearly, I am setting up something wrong. OSPF does a flood every 10 seconds. How often does BGP do its "updates"

2 1

Question
by o1bigtenor 03 Jan '19

03 Jan '19

Greetings I cannot find the question in the 'frog' environment and the web isn't very useful so far - - - - so I'm going to those that live this networking stuff. Cheap routers seem to not work very well. Decent routers aren't cheap? What are the system requirements to use the 'frrouting' universe in the creating of a good quality but still home brew router? (Will something like a 64 bit Raspberry Pi work? How could I achieve 1000 MB network speeds on such a system? Likely more questions later.) If this is not an appropriate place to ask this - - - please do advise! Dee

5 11

Re: [FROG] FRR (5.0) on latest pfSense 2.4.4p1 doesn't insert BGP routes into the kernel
by Muenz, Michael 01 Jan '19

01 Jan '19

Am 01.01.2019 um 13:00 schrieb John Antypas: > Exactly what we had to do. We ended up creating a VTI interface. Once we have the direct interface BGP found direct next tops and was a lot happier > > Sent from my iPad > >> On Jan 1, 2019, at 12:15 AM, Muenz, Michael <m.muenz(a)spam-fetish.org> wrote: >> >>> Am 31.12.2018 um 15:38 schrieb John Antypas: >>> I had not done anything special with the ipsec tunnel, so it probably isn't., WE had assumed since traffic was passed, all was well. We were seeing the BGP updates. We could set up a GRE tunnel between the two sites or GIF (which one would you recommend?) We had thought of that because our first attempt was to use OSPF which didn't traverse the IPSEC link. >> The enc interface in FreeBSD is not a routed device so you have to create a tunnel interface (GRE preferred) or use route-based IPSEC. >> >> >> Michael >> >> FYI

1 0

Re: [FROG] FRR (5.0) on latest pfSense 2.4.4p1 doesn't insert BGP routes into the kernel
by Muenz, Michael 01 Jan '19

01 Jan '19

Am 31.12.2018 um 15:38 schrieb John Antypas: > I had not done anything special with the ipsec tunnel, so it probably > isn't., WE had assumed since traffic was passed, all was well. We > were seeing the BGP updates. We could set up a GRE tunnel between > the two sites or GIF (which one would you recommend?) We had thought > of that because our first attempt was to use OSPF which didn't > traverse the IPSEC link. The enc interface in FreeBSD is not a routed device so you have to create a tunnel interface (GRE preferred) or use route-based IPSEC. Michael

1 0

setup and configuration
by o1bigtenor 01 Jan '19

01 Jan '19

Greetings I'm looking way beyond anything I've ever done before with this so please - - - if its stupid - - - I need to know (just don't hit me too hard - - - grin!) FRRouting looks like a very complete environment (what do I know but its got lots of things to set anyway!). If I purchase something like a sbc set up with say 2 GB of RAM and a 15 GB SDD I'm not sure how I would set things up. Is there a recipe for the noob crowd for what to do? (I'm seeing lots of options for things to ssetup and parameters to set but no having any idea on what to do makes the process more than somewhat intimidating. I'm thinking something like a router set up so that there are vlans separating a couple wired networks, one wireless network and possible another mesh network. I am wanting to be quite tough re: my security and privacy so want to very much reduce crosstalk between the lans.) TIA Dee

2 1