September 2020 - frog - lists.frrouting.org

Redistributing routes in EIGRP and route-map
by Amol Lad 22 Sep '20

22 Sep '20

Hi, We can redistribute routes in EIGRP using "redistribute" command. For example, from FRR documentation: redistribute bgp metric (1-4294967295) (0-4294967295) (0-255) (1-255) (1-65535) redistribute bgp redistributes routing information from bgp route entries into the EIGRP tables. Is there a way to filter these routes using a route-map as done in other protocols such as BGP? I'm using release 7.4 and don't see route-map option. Please advise. Thanks Amol

2 1

Regarding FRR Pim Protocol Function
by Pankaj Garbyal 18 Sep '20

18 Sep '20

Hello Sir/Madam, I am using FRRRouting Release 5.1 for PIM Protocol support in my Switch. But I find that PIM Protocol is not acknowledging the multicast packets coming towards it. When i compared the same with FRR installed in Linux PC, i found that a new interface named "pimreg" is enabled by FRR but the same is not happening in FRR of my switch. Kindly provide me help to get the pimreg interface option in my switch through FRR. also provide some information on the role of "pimreg" to run the PIM Protocol at FRR. Attached here my quagga build file for your reference. Thank you in advance for your support. Regards, Pankaj Garbyal Mobile: +91-9873987203

2 1

[Help Wanted] The route was not advertised to any peer
by Wei-Yu Chen 18 Sep '20

18 Sep '20

Hello FRR communities, I’m working on the following topology, it’s a simple experimental environment to learn how to configure route service with FRR. H1 - R1 - R2 - H2 Here is the IP information: H1: 192.168.10.1/24 H2: 192.168.20.1/24 R1: 192.168.10.254/24 & 192.168.30.1/24 R2: 192.168.20.254/24 & 192.168.30.2/24 And for the R1 and R2 was in separate AS, configuration as below: R1: router bgp 7675 bgp router-id 192.168.30.1 neighbor 192.168.30.2 remote-as 7676 ! address-family ipv4 unicast network 192.168.10.0/24 exit-address-family R2: router bgp 7676 bgp router-id 192.168.30.2 neighbor 192.168.30.1 remote-as 7675 ! address-family ipv4 unicast network 192.168.20.0/24 exit-address-family --- However, R1 didn’t get the “192.168.20.0/24” route, and R2 didn’t get the “192.168.10.0/24” route. So I decided to dig the debug info deeper. Here is some information I got: R1 # show ip route K>* 0.0.0.0/0 [0/0] via <my_public_gw>, enp8s0, 01:07:41 C>* <my_public_ip>/26 is directly connected, enp8s0, 01:07:41 K>* 192.168.10.0/24 [0/0] is directly connected, veth2, 00:23:10 C>* 192.168.30.0/24 is directly connected, veth0, 00:40:32 R1 # show ip bgp 192.168.10.0 BGP routing table entry for 192.168.10.0/24 Paths: (1 available, best #1, table default) Not advertised to any peer Local 0.0.0.0 from 0.0.0.0 (192.168.30.1) Origin IGP, metric 0, weight 32768, valid, sourced, local, best (First path received) Last update: Thu Sep 17 06:30:46 2020 >>> R2 # show ip route C>* 192.168.20.0/24 is directly connected, veth1000, 00:41:39 C>* 192.168.30.0/24 is directly connected, veth1, 00:41:41 R2 # show ip bgp 192.168.20.0/24 BGP routing table entry for 192.168.20.0/24 Paths: (1 available, best #1, table default) Not advertised to any peer Local 0.0.0.0 from 0.0.0.0 (192.168.30.2) Origin IGP, metric 0, weight 32768, valid, sourced, local, best (First path received) Last update: Thu Sep 17 06:57:55 2020 ///// What I noticed is the “Not advertised to any peer”, and I can’t figure out why. Appreciated to any help and advise, please let me know if you need further information. Thank you guys. --- Best regards, Wei-Yu Chen

3 2

"show bgp" command behaviour
by Amol Lad 14 Sep '20

14 Sep '20

Hi, I'm using FRR 7.4 and observed that "show bgp" does not show any prefixes but "show bgp ipv4" does show the prefixes. Is this expected behaviour? Thanks Amol FRR(config-router)# do show bgp No BGP prefixes displayed, 0 exist FRR(config-router)# do show bgp ipv4 BGP table version is 2, local router ID is 172.16.1.106, vrf id 0 Default local pref 100, local AS 1 Status codes: s suppressed, d damped, h history, * valid, > best, = multipath, i internal, r RIB-failure, S Stale, R Removed Nexthop codes: @NNN nexthop's vrf id, < announce-nh-self Origin codes: i - IGP, e - EGP, ? - incomplete Network Next Hop Metric LocPrf Weight Path *> 1.1.1.0/24 0.0.0.0 0 32768 i *> 2.2.2.0/24 172.16.1.107 0 0 2 i

2 1

dmvpn with NHRPD & Strongswan
by Rami Meiran 14 Sep '20

14 Sep '20

Hello all, I tried to implement DMVPN with Quagga nhrpd & Strongswan. The nhrp doesn't work. I have followed the NHRP & DMVPN document from: http://docs.frrouting.org/en/latest/nhrpd.html I have used the patch from: https://gitlab.alpinelinux.org/alpine/aports/-/tree/master/main/strongswan Following are some details: 1. The NHRPD create an ipsec connection that seems to be working well. (ipsec statusall report of an established connection) 2. The nhrp registration request is sent inside the secure channel. Is that correct behavior? 3. On the spoke I get frequent messages of: 2020/09/13 09:03:39 NHRP: Send Registration-Request(3) 20.20.20.12 -> 20.20.20.12 2020/09/13 09:03:41 NHRP: NHS: Register 20.20.20.12 -> 20.20.20.12 (timeout 4) 4. I get the follow show status on the spoke: SF1v# show ip nhrp nhs Iface FQDN NBMA Protocol gre1 30.30.30.11 30.30.30.11 (unspec) SF1v# show ip nhrp cache Iface Type Protocol NBMA Flags Identity gre1 local 20.20.20.12 - - SF1v# show dmvpn Src Dst Flags SAs Identity 30.30.30.12 30.30.30.11 n 1 30.30.30.11 5. I get the follow show status on the HUB: SF1v# show ip nhrp nhs Iface FQDN NBMA Protocol gre1 30.30.30.11 - (unspec) SF1v# show ip nhrp cache Iface Type Protocol NBMA Flags Identity gre1 local 20.20.20.11 - - SF1v# show dmvpn Src Dst Flags SAs Identity 30.30.30.11 30.30.30.12 1 30.30.30.12 ================================================= 6. HUB configuration: ================================================= #=============== IPSEC CONFIGURATION ================= echo " "> /etc/ipsec.conf echo "config setup ">> /etc/ipsec.conf echo "conn dmvpn">> /etc/ipsec.conf echo " authby=secret ">> /etc/ipsec.conf echo " auto=add ">> /etc/ipsec.conf echo " keyexchange=ikev2 ">> /etc/ipsec.conf echo " ike=aes256-aes256-sha256-modp2048 ">> /etc/ipsec.conf echo " esp=aes256-aes256-sha256-modp2048 ">> /etc/ipsec.conf echo " dpdaction=clear ">> /etc/ipsec.conf echo " dpddelay=300s ">> /etc/ipsec.conf echo " left=%any ">> /etc/ipsec.conf echo " leftid=%any ">> /etc/ipsec.conf echo " right=%any ">> /etc/ipsec.conf echo " rightid=%any ">> /etc/ipsec.conf echo " leftprotoport=gre ">> /etc/ipsec.conf echo " rightprotoport=gre ">> /etc/ipsec.conf echo " type=transport ">> /etc/ipsec.conf echo " keyingtries=%forever ">> /etc/ipsec.conf echo "# ipsec.secrets - strongSwan IPsec secrets file" > /etc/ipsec.secrets echo "%any : PSK \"rami\"" >> /etc/ipsec.secrets ipsec rereadall ipsec start #=============== clean config ================= rm /opt/smartswitch/etc/quagga/nhrpd0.conf #=============== interface config ================= ip link add name eth4.20 link eth4 type vlan id 20 ip address add 30.30.30.11/255.255.255.0 dev eth4.20 ip link set dev eth4.20 up ip tunnel add gre1 mode gre key 42 dev eth4.20 ttl 64 ip addr add 20.20.20.11/32 dev gre1 ip link set gre1 up iptables -A FORWARD -i gre1 -o gre1 -m hashlimit --hashlimit-upto 4/minute --hashlimit-burst 1 --hashlimit-mode srcip,dstip --hashlimit-srcmask 24 --hashlimit-dstmask 24 --hashlimit-name loglimit-0 -j NFLOG --nflog-group 1 touch /opt/smartswitch/etc/quagga/nhrpd0.conf nhrpd -f /opt/smartswitch/etc/quagga/nhrpd0.conf -i /var/run/nhrpd0.pid -P 3000 start & # Quagga nhrp config on HUB vtysh configure terminal log syslog debug nhrp common nhrp nflog-group 1 interface gre1 description DMVPN Tunnel Interface ip address 20.20.20.11/32 ip nhrp network-id 1 ip nhrp redirect ip nhrp registration no-unique ip nhrp shortcut # no link-detect tunnel protection vici profile dmvpn tunnel source eth4.20 router bgp 65000 bgp router-id 20.20.20.11 no bgp ebgp-requires-policy neighbor SPOKES peer-group neighbor SPOKES disable-connected-check neighbor 20.20.20.12 remote-as 65001 neighbor 20.20.20.12 peer-group SPOKES address-family ipv4 unicast network 11.11.11.11/24 redistribute nhrp exit-address-family end exit ================================================= 7. SPOKE configuration: ================================================= #=============== IPSEC CONFIGURATION ================= echo " "> /etc/ipsec.conf echo "config setup ">> /etc/ipsec.conf echo "conn dmvpn">> /etc/ipsec.conf echo " authby=secret ">> /etc/ipsec.conf echo " auto=add ">> /etc/ipsec.conf echo " keyexchange=ikev2 ">> /etc/ipsec.conf echo " ike=aes256-aes256-sha256-modp2048 ">> /etc/ipsec.conf echo " esp=aes256-aes256-sha256-modp2048 ">> /etc/ipsec.conf echo " dpdaction=clear ">> /etc/ipsec.conf echo " dpddelay=300s ">> /etc/ipsec.conf echo " left=%any ">> /etc/ipsec.conf echo " leftid=%any ">> /etc/ipsec.conf echo " right=%any ">> /etc/ipsec.conf echo " rightid=%any ">> /etc/ipsec.conf echo " leftprotoport=gre ">> /etc/ipsec.conf echo " rightprotoport=gre ">> /etc/ipsec.conf echo " type=transport ">> /etc/ipsec.conf echo " keyingtries=%forever ">> /etc/ipsec.conf echo "# ipsec.secrets - strongSwan IPsec secrets file" > /etc/ipsec.secrets echo "%any : PSK \"rami\"" >> /etc/ipsec.secrets ipsec rereadall ipsec start #=============== clean config ================= rm /opt/smartswitch/etc/quagga/nhrpd0.conf #=============== interface config ================= ip link add name eth4.20 link eth4 type vlan id 20 ip address add 30.30.30.12/255.255.255.0 dev eth4.20 ip link set dev eth4.20 up ip tunnel add gre1 mode gre key 42 dev eth4.20 ttl 64 ip addr add 20.20.20.12/32 dev gre1 ip link set gre1 up touch /opt/smartswitch/etc/quagga/nhrpd0.conf nhrpd -f /opt/smartswitch/etc/quagga/nhrpd0.conf -i /var/run/nhrpd0.pid -P 3000 start & # quagga nhrp config on spoke vtysh configure terminal log syslog debug nhrp common nhrp nflog-group 1 interface gre1 description DMVPN Tunnel Interface #config of HUB GRE IP ip address 20.20.20.12/32 ip nhrp network-id 1 ip nhrp nhs dynamic nbma 30.30.30.11 ip nhrp redirect ip nhrp registration no-unique ip nhrp shortcut no link-detect tunnel protection vici profile dmvpn tunnel source eth4.20 router bgp 65001 bgp router-id 20.20.20.12 no bgp ebgp-requires-policy neighbor 20.20.20.11 remote-as 65000 neighbor 20.20.20.11 disable-connected-check address-family ipv4 unicast network 12.12.12.12/24 exit-address-family end exit ================================================= 8. Ipsec status on HUB # ipsec statusall Status of IKE charon daemon (strongSwan 5.8.4, Linux 4.19.125, armv7l): uptime: 33 minutes, since Sep 13 09:28:12 2020 malloc: sbrk 778240, mmap 0, used 355704, free 422536 worker threads: 11 of 16 idle, 5/0/0/0 working, job queue: 0/0/0/0, scheduled: 3 loaded plugins: charon pkcs11 aes des rc2 sha2 sha1 md5 random nonce x509 revocation constraints pubkey pkcs1 pkcs7 pkcs8 pkcs12 pgp dnskey sshkey pem openssl fips-prf curve25519 xcbc cmac hmac drbg curl attr kernel-netlink resolve socket-default stroke vici updown xauth-generic led counters Listening IP addresses: 10.10.10.11 11.11.11.11 30.30.30.11 20.20.20.11 Connections: dmvpn: %any...%any IKEv2, dpddelay=300s dmvpn: local: uses pre-shared key authentication dmvpn: remote: uses pre-shared key authentication dmvpn: child: dynamic[gre] === dynamic[gre] TRANSPORT, dpdaction=clear Security Associations (1 up, 0 connecting): dmvpn[1]: ESTABLISHED 32 minutes ago, 30.30.30.11[30.30.30.11]...30.30.30.12[30.30.30.12] dmvpn[1]: IKEv2 SPIs: 942411e640760acf_i c5c66aa6073921f8_r*, pre-shared key reauthentication in 2 hours dmvpn[1]: IKE proposal: AES_CBC_256/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/MODP_2048 dmvpn{1}: INSTALLED, TRANSPORT, reqid 1, ESP SPIs: c33ae7b3_i cd79d565_o dmvpn{1}: AES_CBC_256/HMAC_SHA2_256_128, 9600 bytes_i, 0 bytes_o, rekeying in 13 minutes dmvpn{1}: 30.30.30.11/32[gre] === 30.30.30.12/32[gre] ================================================= ================================================= 8. Ipsec status on spoke: / # ipsec statusall Status of IKE charon daemon (strongSwan 5.8.4, Linux 4.19.125, armv7l): uptime: 32 minutes, since Sep 13 09:28:20 2020 malloc: sbrk 778240, mmap 0, used 357808, free 420432 worker threads: 11 of 16 idle, 5/0/0/0 working, job queue: 0/0/0/0, scheduled: 4 loaded plugins: charon pkcs11 aes des rc2 sha2 sha1 md5 random nonce x509 revocation constraints pubkey pkcs1 pkcs7 pkcs8 pkcs12 pgp dnskey sshkey pem openssl fips-prf curve25519 xcbc cmac hmac drbg curl attr kernel-netlink resolve socket-default stroke vici updown xauth-generic led counters Listening IP addresses: 10.10.10.12 12.12.12.12 30.30.30.12 20.20.20.12 Connections: dmvpn: %any...%any IKEv2, dpddelay=300s dmvpn: local: uses pre-shared key authentication dmvpn: remote: uses pre-shared key authentication dmvpn: child: dynamic[gre] === dynamic[gre] TRANSPORT, dpdaction=clear Security Associations (1 up, 0 connecting): dmvpn[1]: ESTABLISHED 31 minutes ago, 30.30.30.12[30.30.30.12]...30.30.30.11[30.30.30.11] dmvpn[1]: IKEv2 SPIs: 942411e640760acf_i* c5c66aa6073921f8_r, pre-shared key reauthentication in 2 hours dmvpn[1]: IKE proposal: AES_CBC_256/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/MODP_2048 dmvpn{1}: INSTALLED, TRANSPORT, reqid 1, ESP SPIs: cd79d565_i c33ae7b3_o dmvpn{1}: AES_CBC_256/HMAC_SHA2_256_128, 0 bytes_i, 9100 bytes_o (91 pkts, 64s ago), rekeying in 12 minutes dmvpn{1}: 30.30.30.12/32[gre] === 30.30.30.11/32[gre] ================================================= Any help would be much appreciated. Best regards, Rami

1 0

FRR query for BGP router
by Richard Milla 10 Sep '20

10 Sep '20

Hi, I am new to FRR and I would like to know what I need to install a router with FRR (only BGP) that supports 2M routes and + 10Gbps of data traffic. What do you recommend to use? does it work smoothly compared to a traditional router? Thanks for the help Atte Richard Milla T.

2 2

BGP NBR password
by hongal 08 Sep '20

08 Sep '20

Hi Folks, Starting FRR 7.2 we are seeing one issue with bgp neighbor command. e.g R1 ---------------------------------------R2. (md5 password) (no password configured) R1 router bgp 64707 bgp router-id 199.1.1.2 neighbor 100.17.6.1 remote-as 64708 neighbor 100.17.6.1 password ****** R2 router bgp 64708 bgp router-id 199.1.1.3 neighbor 100.17.6.2 remote-as 64707 I do see BGP NBR come up with this configuration, even though password is not configured on the other side(R2). R1 starts sending TCP syn packet with Tcp options(md5). R2 acks without md5 option.(as password is not configured) R1 drops md5 option and continue with TCP handshake , TCP is established without md5. This will continue towards BGP NBR UP. Would like to know if this is new behavior added or a bug. Note that, 1 if I configure password both side, it works ok, I see md5 option is exchanged. 2 If I mis-configure password value either side, it fails, which is expected. Thanks Thippanna

2 5

TUN interface for OpenVPN traffic
by Jan Hugo Prins | BetterBe 07 Sep '20

07 Sep '20

Hello everyone, I'm currently trying to move my OpenVPN users from TAP devices to TUN devices because Apple states that they will disable TAP in the near future. I have it working for IPv4 just fine, but IPv6 gives me a little OSPF6 issue. The tun0 interface has the following state, even when people are connected: tun0 is up, type POINTOPOINT Interface ID: 42 Internet Address: inet : 172.31.8.1/32 inet6: 2a02:b70:0:2::1/64 Instance ID 0, Interface MTU 1500 (autodetect: 1500) MTU mismatch detection: disabled Area ID 0.0.0.0, Cost 10 State Down, Transmit Delay 1 sec, Priority 1 Timer intervals configured: Hello 10, Dead 40, Retransmit 5 DR: 0.0.0.0 BDR: 0.0.0.0 Number of I/F scoped LSAs is 0 0 Pending LSAs for LSUpdate in Time 00:00:00 [thread off] 0 Pending LSAs for LSAck in Time 00:00:00 [thread off] I think the "State Down" is the root cause for the routes to this interface not showing up on other routers, which results in IPv6 traffic failing completely. Could someone tell me if this is intentionally, or that I have some potential config error? If I need to share my whole configuration, let me know, my hope is that it is something simple related to TUN interfaces / POINTTOPOINT interfaces. interface tun0 ipv6 address 2a02:b70:0:2::1/64 ipv6 nd suppress-ra ipv6 ospf6 mtu-ignore ipv6 ospf6 network point-to-point no link-detect router ospf6 interface tun0 area 0.0.0.0 ipv6 route 2a02:b70:0:2::/64 tun0 -- Kind regards Jan Hugo Prins /DevOps Engineer/ <https://betterbe.com> Auke Vleerstraat 140 E 7547 AN Enschede CC no. 08097527 <https://www.kvk.nl/orderstraat/product-kiezen/?kvknummer=080975270000> *T* +31 (0) 53 48 00 694 <tel:+31534800694> *E* jprins(a)betterbe.com <mailto:jprins@betterbe.com> *M* +31 (0)6 263 58 951 <tel:+31 (0)6 263 58 951> www.betterbe.com <https://www.betterbe.com> BetterBe accepts no liability for the content of this email, or for the consequences of any actions taken on the basis of the information provided, unless that information is subsequently confirmed in writing. If you are not the intended recipient you are notified that disclosing, copying, distributing or taking any action in reliance on the contents of this information is strictly prohibited.

1 0