March 2021 - frog - lists.frrouting.org

Yocto Recipe for FRR
by Amol Lad 10 Aug '21

10 Aug '21

Hi, Please advise if there is any Yocto recipe for FRRouting? If not, how to go about creating one for FRR? Yocto Recipe for FRR will hugely simplify integrating FRR in Yocto based embedded linux distributions. So please advise if there are any plans to develop this recipe? Thanks Amol ________________________________ The information in this email communication (inclusive of attachments) is confidential to 4RF Limited and the intended recipient(s). If you are not the intended recipient(s), please note that any use, disclosure, distribution or copying of this information or any part thereof is strictly prohibited and that the author accepts no liability for the consequences of any action taken on the basis of the information provided. If you have received this email in error, please notify the sender immediately by return email and then delete all instances of this email from your system. 4RF Limited will not accept responsibility for any consequences associated with the use of this email (including, but not limited to, damages sustained as a result of any viruses and/or any action or lack of action taken in reliance on it).

4 10

Re: [FROG] FRRouting and MPLS (Yakov Sh.)
by Tomás Morales 05 Apr '21

05 Apr '21

Hi all I am trying Yakov blog below to test L3VPN using FRR7.5 and the last PE is not capable to de-encapsulate the labelled traffic and send it to the CE. This is the diagram in my lab: https://github.com/thomarite/linux-mpls-testing/blob/master/lab4-l3vpn/diag… For example CE1 (vrf_cust1 - 192.168.11.102/24) tries to ping CE3 (vrf_cust1 - 192.168.23.102/24) P1 is receiving the traffic with double labels as expected from PE1: 19:28:46.075164 MPLS (label 17, exp 0, ttl 63) (label 80, exp 0, [S], ttl 63) IP 192.168.11.102 > 192.168.23.102: ICMP echo request, id 2296, seq 10, length 64 19:28:47.099199 MPLS (label 17, exp 0, ttl 63) (label 80, exp 0, [S], ttl 63) IP 192.168.11.102 > 192.168.23.102: ICMP echo request, id 2296, seq 11, length 64 PE2 is receiving the traffic on ens8 with just one label after P1 doing PHP: 19:28:46.074437 MPLS (label 80, exp 0, [S], ttl 63) IP 192.168.11.102 > 192.168.23.102: ICMP echo request, id 2296, seq 10, length 64 19:28:47.098555 MPLS (label 80, exp 0, [S], ttl 63) IP 192.168.11.102 > 192.168.23.102: ICMP echo request, id 2296, seq 11, length 64 But then PE2 is not sending anything to CE3. I can't see anything in either end. I have checked iptables in my host just in case but I think PE2 is not sending anything. >From PE2, all routing seems correct: PE2# show mpls table Inbound Label Type Nexthop Outbound Label ----------------------------------------------------- 16 LDP 192.168.77.102 16 17 LDP 192.168.77.102 implicit-null 18 LDP 192.168.77.102 implicit-null 80 BGP vrf_cust1 - 81 BGP vrf_cust2 - PE2# PE2# show bgp summary IPv4 Unicast Summary: BGP router identifier 172.20.5.2, local AS number 65010 vrf-id 0 BGP table version 0 RIB entries 0, using 0 bytes of memory Peers 1, using 21 KiB of memory Neighbor V AS MsgRcvd MsgSent TblVer InQ OutQ Up/Down State/PfxRcd PfxSnt 172.20.5.1 4 65010 101 108 0 0 0 01:35:41 0 0 Total number of neighbors 1 IPv4 VPN Summary: BGP router identifier 172.20.5.2, local AS number 65010 vrf-id 0 BGP table version 0 RIB entries 7, using 1344 bytes of memory Peers 1, using 21 KiB of memory Neighbor V AS MsgRcvd MsgSent TblVer InQ OutQ Up/Down State/PfxRcd PfxSnt 172.20.5.1 4 65010 101 108 0 0 0 01:35:41 2 2 Total number of neighbors 1 PE2# PE2# show ip route vrf vrf_cust1 Codes: K - kernel route, C - connected, S - static, R - RIP, O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP, T - Table, v - VNC, V - VNC-Direct, A - Babel, D - SHARP, F - PBR, f - OpenFabric, > - selected route, * - FIB route, q - queued, r - rejected, b - backup VRF vrf_cust1: B> 192.168.11.0/24 [200/0] via 172.20.5.1 (vrf default) (recursive), label 80, weight 1, 01:35:40 * via 192.168.77.102, ens8 (vrf default), label 16/80, weight 1, 01:35:40 C>* 192.168.23.0/24 is directly connected, ens6, 01:38:19 PE2# PE2# PE2# show isis neighbor Area ISIS: System Id Interface L State Holdtime SNPA P1 ens8 2 Up 28 2020.2020.2020 PE2# vagrant@PE2:~$ ip route default via 192.168.121.1 dev ens5 proto dhcp src 192.168.121.31 metric 1024 172.20.5.1 encap mpls 16 via 192.168.77.102 dev ens8 proto isis metric 20 172.20.5.5 via 192.168.77.102 dev ens8 proto isis metric 20 192.168.66.0/24 via 192.168.77.102 dev ens8 proto isis metric 20 192.168.77.0/24 dev ens8 proto kernel scope link src 192.168.77.101 192.168.121.0/24 dev ens5 proto kernel scope link src 192.168.121.31 192.168.121.1 dev ens5 proto dhcp scope link src 192.168.121.31 metric 1024 vagrant@PE2:~$ vagrant@PE2:~$ ip -4 a 1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000 inet 127.0.0.1/8 scope host lo valid_lft forever preferred_lft forever inet 172.20.5.2/32 scope global lo valid_lft forever preferred_lft forever 2: ens5: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP group default qlen 1000 inet 192.168.121.31/24 brd 192.168.121.255 scope global dynamic ens5 valid_lft 2524sec preferred_lft 2524sec 3: ens6: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast master vrf_cust1 state UP group default qlen 1000 inet 192.168.23.101/24 brd 192.168.23.255 scope global ens6 valid_lft forever preferred_lft forever 4: ens7: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast master vrf_cust2 state UP group default qlen 1000 inet 192.168.24.101/24 brd 192.168.24.255 scope global ens7 valid_lft forever preferred_lft forever 5: ens8: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP group default qlen 1000 inet 192.168.77.101/24 brd 192.168.77.255 scope global ens8 valid_lft forever preferred_lft forever vagrant@PE2:~$ vagrant@PE2:~$ ip -M route 16 as to 16 via inet 192.168.77.102 dev ens8 proto ldp 17 via inet 192.168.77.102 dev ens8 proto ldp 18 via inet 192.168.77.102 dev ens8 proto ldp vagrant@PE2:~$ vagrant@PE2:~$ ip route show table 10 blackhole default 192.168.11.0/24 encap mpls 16/80 via 192.168.77.102 dev ens8 proto bgp metric 20 broadcast 192.168.23.0 dev ens6 proto kernel scope link src 192.168.23.101 192.168.23.0/24 dev ens6 proto kernel scope link src 192.168.23.101 local 192.168.23.101 dev ens6 proto kernel scope host src 192.168.23.101 broadcast 192.168.23.255 dev ens6 proto kernel scope link src 192.168.23.101 vagrant@PE2:~$ vagrant@PE2:~$ ip vrf Name Table ----------------------- vrf_cust1 10 vrf_cust2 20 vagrant@PE2:~$ This is PE2 FRR config: PE2# show running-config Building configuration... Current configuration: ! frr version 7.5 frr defaults traditional hostname PE2 service integrated-vtysh-config ! interface ens8 ip router isis ISIS isis circuit-type level-2-only isis network point-to-point ! interface lo ip router isis ISIS isis passive ! router bgp 65010 neighbor 172.20.5.1 remote-as 65010 neighbor 172.20.5.1 update-source 172.20.5.2 ! address-family ipv4 vpn neighbor 172.20.5.1 activate exit-address-family ! router bgp 65010 vrf vrf_cust1 ! address-family ipv4 unicast redistribute connected label vpn export auto rd vpn export 65010:10 rt vpn both 1:1 export vpn import vpn exit-address-family ! router bgp 65010 vrf vrf_cust2 ! address-family ipv4 unicast redistribute connected label vpn export auto rd vpn export 65010:20 rt vpn both 2:2 export vpn import vpn exit-address-family ! mpls ldp router-id 172.20.5.2 ! address-family ipv4 discovery transport-address 172.20.5.2 ! interface ens8 ! exit-address-family ! ! router isis ISIS net 49.0001.1720.2000.5002.00 ! line vty ! end PE2# This is PE2 sysctl mpls config: root@PE2:/home/vagrant# sysctl -a | grep mpls net.mpls.conf.ens5.input = 0 net.mpls.conf.ens6.input = 0 net.mpls.conf.ens7.input = 0 net.mpls.conf.ens8.input = 1 net.mpls.conf.lo.input = 0 net.mpls.conf.vrf_cust1.input = 0 net.mpls.conf.vrf_cust2.input = 0 net.mpls.default_ttl = 255 net.mpls.ip_ttl_propagate = 1 net.mpls.platform_labels = 100000 root@PE2:/home/vagrant# This is PE1: PE1# PE1# show bgp summary IPv4 Unicast Summary: BGP router identifier 172.20.5.1, local AS number 65010 vrf-id 0 BGP table version 0 RIB entries 0, using 0 bytes of memory Peers 1, using 21 KiB of memory Neighbor V AS MsgRcvd MsgSent TblVer InQ OutQ Up/Down State/PfxRcd PfxSnt 172.20.5.2 4 65010 111 105 0 0 0 01:39:14 0 0 Total number of neighbors 1 IPv4 VPN Summary: BGP router identifier 172.20.5.1, local AS number 65010 vrf-id 0 BGP table version 0 RIB entries 11, using 2112 bytes of memory Peers 1, using 21 KiB of memory Neighbor V AS MsgRcvd MsgSent TblVer InQ OutQ Up/Down State/PfxRcd PfxSnt 172.20.5.2 4 65010 111 105 0 0 0 01:39:14 2 2 Total number of neighbors 1 PE1# PE1# PE1# show mpls table Inbound Label Type Nexthop Outbound Label ----------------------------------------------------- 16 LDP 192.168.66.102 implicit-null 17 LDP 192.168.66.102 implicit-null 18 LDP 192.168.66.102 17 80 BGP vrf_cust1 - 81 BGP vrf_cust2 - PE1# PE1# show ip route vrf all default vrf_cust1 vrf_cust2 PE1# show ip route vrf vrf_cust1 Codes: K - kernel route, C - connected, S - static, R - RIP, O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP, T - Table, v - VNC, V - VNC-Direct, A - Babel, D - SHARP, F - PBR, f - OpenFabric, > - selected route, * - FIB route, q - queued, r - rejected, b - backup VRF vrf_cust1: C>* 192.168.11.0/24 is directly connected, ens6, 01:44:51 B> 192.168.23.0/24 [200/0] via 172.20.5.2 (vrf default) (recursive), label 80, weight 1, 01:39:18 * via 192.168.66.102, ens8 (vrf default), label 17/80, weight 1, 01:39:18 PE1# PE1# show isis neighbor Area ISIS: System Id Interface L State Holdtime SNPA P1 ens8 2 Up 30 2020.2020.2020 PE1# PE1# If I try to ping CE3 to CE1, I see exactly the same behaviour in PE1. Any idea what I am missing? Thanks tomas On Mon, Nov 23, 2020 at 12:00 PM <frog-request(a)lists.frrouting.org> wrote: > > > Date: Mon, 23 Nov 2020 10:27:44 +0000 > From: "Yakov Sh." <yman(a)protonmail.ch> > To: Olivier CALVANO <o.calvano(a)gmail.com> > Cc: "frog(a)lists.frrouting.org" <frog(a)lists.frrouting.org> > Subject: Re: [FROG] FRRouting and MPLS > Message-ID: > <TaX1p13MyS4pDJfNgZ_qra4Lqq-QppV4Gc_JkTUmi9s41lOR7krEd9PBvr1kfX52s03BEhaxOxsaeb_KiIeKoe0QVUUnx-zRhDI72rDSwrM=@ protonmail.ch> > > Content-Type: text/plain; charset="utf-8" > > Hi! > I had not much experience with FRR in production, but I gave it a try some time ago in a lab and was able to build L3VPN service on VMs with kernel VRF support. You can see details in my blog post - http://dvjourney.yman.site/2018/10/26/l3vpn-on-linux/ > For L2VPN, as stated in docs, only OpenBSD supports VPWS/VPLS at the moment. http://docs.frrouting.org/en/latest/overview.html#feature-matrix > > Yakov Sh. > telegram: @darkyman > > ‐‐‐‐‐‐‐ Original Message ‐‐‐‐‐‐‐ > On Monday, November 23, 2020 12:15 PM, Olivier CALVANO < o.calvano(a)gmail.com> wrote: > > > Hello, > > > > I have just installed FRR for the first time on a Linux CentOS 8 distribution. I am therefore just starting out. > > > > I am gradually reading the forums but there is a lot of information. FRR manages without worries the BGP and the ISIS which I use regularly on my cisco routers. > > > > I am now trying to find out if FRR can integrate more deeply into my network, particularly at the MPLS level. as I understood it is in the Kernel that this is done and not in FRR, but is there a way to integrate VRF IP VPN? and the creation of a VLAN type subinterface directly in FRR? > > > > Then last question: Is there an implementation of the Cisco EoMPLS equivalent in FRR? (xconnect encapsultation mpls) > > > > thank you > > Olivier >

1 1

BGP l2vpn evpn : received routes discarded
by Erwan David 30 Mar '21

30 Mar '21

Hello, I have a lab with frr 7.1 and a bgp l2vpn setting which works fine. I try to install it in production on frr 7.5.1, and it does not work and I cannot see why. It seems the received routes are refused by the destination (both sode have a similar configuration. Here is my configuration : address-family l2vpn evpn neighbor EVPN_UNDERLAY activate neighbor EVPN_UNDERLAY soft-reconfiguration inbound advertise-all-vni autort rfc8365-compatible advertise-default-gw advertise-svi-ip exit-address-family My diagnostics are : # show evpn mac vni 64 Number of MACs (local and remote) known for this VNI: 1 Flags: N=sync-neighs, I=local-inactive, P=peer-active, X=peer-proxy MAC Type Flags Intf/Remote ES/VTEP VLAN Seq #'s f2:47:b9:38:5e:d7 local br64 1 0/0 which is the local mac. On bgp side : # show bgp neighbors xx.xx.xx.202 BGP neighbor is xx.xx.xx.202, remote AS ASn, local AS ASn, internal link Description: ot-cog-rtr-border-1 Hostname: ot-rtr-cog-1 Member of peer-group EVPN_UNDERLAY for session parameters BGP version 4, remote router ID Id2, local router ID Id1 BGP state = Established, up for 00:23:20 Last read 00:00:20, Last write 00:00:20 Hold time is 180, keepalive interval is 60 seconds Neighbor capabilities: 4 Byte AS: advertised and received AddPath: L2VPN EVPN: RX advertised L2VPN EVPN and received Route refresh: advertised and received(old & new) Address Family L2VPN EVPN: advertised and received Hostname Capability: advertised (name: ot-rtr-en1-1,domain name: n/a) received (name: ot-rtr-cog-1,domain name: n/a) Graceful Restart Capability: advertised and received Remote Restart timer is 120 seconds Address families by peer: none Graceful restart information: [...] Message statistics: [...] For address family: L2VPN EVPN EVPN_UNDERLAY peer-group member Update group 11, subgroup 10 Packet Queue length 0 Inbound soft reconfiguration allowed NEXT_HOP is propagated unchanged to this neighbor Community attribute sent to this neighbor(all) advertise-all-vni Inbound path policy configured Outbound path policy configured 0 accepted prefixes [...] And # show bgp l2vpn evpn neighbors xxx.xxx.xxx.202 routes No prefixes displayed, 4 exist On the other side, the advertised-routes show 4 routes (3 type 2 and 1 type 3) I tried to put a route-map with only a permit, but no change. So I'm looking for help in finding the error in my settings Thanks.

1 1

Authentication support for OSPFv3
by jagadeesh N 10 Mar '21

10 Mar '21

Hi All, Does FRR have Authentication support for OSPFv3(RFC 4552)? I see a forked repo(https://github.com/opensourcerouting/frr/commits/ospfv3-ipsec) where the code is committed to support the RFC 4552 but i wonder why it's not merged to the main branch yet. Any pointers would be appreciated Regards, Jagadeesh N

2 1

Re: [FROG] Distribution with FRRouting ?
by Quentin Young 08 Mar '21

08 Mar '21

You might be interested in VyOS ________________________________________ From: frog <frog-bounces(a)lists.frrouting.org> on behalf of BSD via frog <frog(a)lists.frrouting.org> Sent: Monday, March 8, 2021 5:12 PM To: Chriztoffer Hansen Cc: FRRouting Operator Group - Users List Subject: Re: [FROG] Distribution with FRRouting ? External email: Use caution opening links or attachments _______________________________________________ frog mailing list frog(a)lists.frrouting.org https://lists.frrouting.org/listinfo/frog

1 0

Re: [FROG] Distribution with FRRouting ?
by Chriztoffer Hansen 08 Mar '21

08 Mar '21

> Otherwise, what I came up with was to split the install of routing (for example on a Debian + FRR) and the firewalling stack. FRRouting + nftables? -- Chriztoffer

2 1

Re: [FROG] Distribution with FRRouting ?
by Jafar Al-Gharaibeh 08 Mar '21

08 Mar '21

FRR + UFW maybe? --Jafar On 3/6/21 12:22 PM, bsd--- via frog wrote: > _______________________________________________ > frog mailing list > frog(a)lists.frrouting.org > https://lists.frrouting.org/listinfo/frog

1 0

Announcing the 7.5.1 release of FRR
by Martin Winter 08 Mar '21

08 Mar '21

All, We are pleased to announce FRR 7.5.1. This is a maintenance release of FRR 7.5 with lots of bug fixes Debian Packaging - https://deb.frrouting.org/ RPM Packaging - https://rpm.frrouting.org/ Snap Packaging - https://snapcraft.io/frr This release contains the following fixes: BABEL Fix connected route leak on change BFD Session lookup was sometimes wrong Memory leak and handling cleanups In some situations handle vrf appropriately when receiving packets BGP Peer Group Inheritance Fixes Dissallow attempt to peer peers reachable via blackholes Send BMP down message when reachability fails Cleanup handling of aggregator data when the AGG AS is 0 Handle `neighbor <peer-group allowas-in` config changes properly Properly parse community and lcommunity values in some circumstances Allow peer-groups to configure `ttl-security hops` Prevent v6 routes with v4 nexthops from being installed Allow `default-originate` to be cleared from a peer group Fix evpn route-map vni filter at origin local routes were using non-default distance Properly track if the nexthop was updated in some circumstances Cleanup `show running` when running bgp with `-e X` values Various Memory leaks in show commands Properly withdraw exported routes when deleting a VRF Avoid resetting ebgp-multihop if peer setting is the same as peer-group Properly encode flowspec rules to zebra in some rare circumstances Generate statistics for routes in bgp when we have exactly 1 route Properly apply route-map for the default-originate command EIGRP Properly set MTU for eigrp packets sent Various memory leaks and using uninited data fixes ISIS When last area address is removed, resign if we were the DR Various memory leaks and using uninited data fixes LDP Various memory leaks and using uninited data fixes NHRP Use onlink routes when prefix == nh Shortcut routes are installed with proper nexthop OSPF Prevent duplicate packet read in multiple vrf situation Fix area removal at interface level Restore Point to MultiPoint interface types Correctly handle MTU change on startup Multi Instance initialization sometimes was not successful NSSA translate-always was not working properly OSPFv3 Don't send hellos on loopback interfaces Handle ECMP better when a sub-path is removed Memory leak and handling fixes Fix Link LSA not updating when router priority is modified Some output from show commands was wrong Intra area remote connected prefixes sometimes not installed PBR Various memory leaks and using uninited data fixes PIM SGRpt prune received during prune didn't override holdtime Various memory leaks and using uninited data fixes STATIC Fix VRF and usage on startup in some instances Tableid was being mishandled in some cases VTYSH Disable bracketed paste in readline. WATCHFRR Various memory leaks and using uninited data fixes ZEBRA Always install blackhole routes using kernel routes instead of nexthops Various memory leaks and using uninited data fixes Dissallow resolution to duplicate nexthops that created infinite nexthops Apply the route-map delay-timer globally Some routes were stuck in Queued state when using the FPM Better handle vrf creation when using namespaces Set NUD_NOARP on sticky mac entries in addtion to NTF_STICKY Allow `set src X` to work on startup FRR Library Fix a variety of memory leaks Fix VRF Creation in some instances RPKI context editing was not properly handled in reload situations routemap code was not properly handling modification of CLI in some instances SNAPCRAFT Update to using rtrlib 0.7.0 Fix passthrough path for Libyang 1.x ALPINE Remove old docker deps

1 0

Distribution with FRRouting ?
by bsd＠todoo.biz 06 Mar '21

06 Mar '21

Hello, We are looking for a solution to implement FRRouting for a routing / firewalling project with Overlay SDN with VxLAN, BGP-EVPN. We were first thinking of using pfSense, but the FreeBSD branch does not seem to have a support for SDN VxLAN overlay… and pfSense is no longer OpenSource ! So my question is the following : is there any packaged FRR that will have both a firewall and the complete FRR + SDN overlay ? Otherwise, what I came up with was to split the install of routing (for exemple on a Debian + FRR) and the firewalling stack. What do you think will be the best FRR + Firewall solution to your knowledge (and Open Source ;-) ? Sincerely yours. --- bsd(a)todoo.biz web: https://www.dynfi.com PGP_ID: 0x1BA3C2FD

1 0

Binding two IP addresses to bgpd
by Matt Riffle 04 Mar '21

04 Mar '21

Apologies if I’m missing something easy here — I think I’ve looked at this for too long. I want my bgpd process to listen to 2 IP addresses — one IPv4 and one IPv6. I cannot find a syntax that allows this to happen. I can listen to one or the other. I really don’t want to run two bgpd processes to accomplish it. (I could let it bind to the default 0.0.0.0 / :: and use a firewall, but, again, I’d rather just bind to the two addresses I need it on, if possible.) Thanks, -Matt

6 6