September 2021 - frog - lists.frrouting.org

OSPF: scaling routers in area or areas per se
by Muenz, Michael 12 Nov '21

12 Nov '21

Dear all, I'm currently designing a new network, it has 2 DC's with each having a VPN cluster. Each VPN cluster has a Firewall Cluster behind and it's set up in a circle, so VPN in DC1 has a DCI to VPN in DC2 and a dedicated link to FW in DC1. Same as in DC2 and FW in DC2 has a DCI to FW in DC1. In this circle I'm running area 0.0.0.0 and wherever I add a new interface it's known to the network. Now comes the fun part. We have 100 branches and we use OpenVPN to connect to one of the VPN concentrators with the second as backup. The challenge is, that it shouldn't matter where the branch currently is connected to, BUT, it's only allowed to be connected to one DC to prevent async routing. Technically this is also easy, but I'm not sure which one scales better: - Have only one area 0.0.0.0 also on the branches, so over 100 routers in one area - Have for each branch one area, so over 100 areas having only one router - Running external via BGP and having 100 neighbors with 100 private AS Anyone here experienced regarding scaling this size? Thx! Michael

2 1

ACCESS-LIST FRR Query
by S.M Tanjeen 23 Sep '21

23 Sep '21

Hi, Is there any option to implement/ distribute an access-list in an interface like Cisco. And also is there any option access lists in global domain? -- Regards, S. M. Tanjeen

1 0

Any way to force a local route weight to 0 ?
by Thomas Martin 22 Sep '21

22 Sep '21

Hello, I'm looking for a way to be able to force local routes to a weight of 0 (apart from modifying the source code). To be honest I don't think there is but maybe I missed something. My goal is to use a local route as a backup solution (if BGP is down for example), but to use it only if not sent through BGP. Thanks. Regards, Thomas

2 2

Frrouting log files are kept open after logrotate?
by Cloud Operations 21 Sep '21

21 Sep '21

Hi, I've just noticed an issue on our production servers whilst investigating a BGP problem that FRR doesn't close the (previous) log file when logrotate happens apparently? # lsof -n | grep bgpd ... bgpd_ka 83886 83889 frr 317w REG 8,2 6820199 2490648 /var/log/frr/bgpd.log-20210829 (deleted) bgpd_ka 83886 83889 frr 318w REG 8,2 4972381 2490637 /var/log/frr/bgpd.log-20210830 (deleted) bgpd_ka 83886 83889 frr 319w REG 8,2 5836081 2490654 /var/log/frr/bgpd.log-20210908 (deleted) bgpd_ka 83886 83889 frr 320w REG 8,2 4705731 2490650 /var/log/frr/bgpd.log-20210831 (deleted) bgpd_ka 83886 83889 frr 321w REG 8,2 4873053 2490640 /var/log/frr/bgpd.log-20210901 (deleted) bgpd_ka 83886 83889 frr 322w REG 8,2 3415500 2490625 /var/log/frr/bgpd.log-20210918 (deleted) bgpd_ka 83886 83889 frr 323w REG 8,2 5120763 2490603 /var/log/frr/bgpd.log-20210903 (deleted) bgpd_ka 83886 83889 frr 324w REG 8,2 4928209 2490677 /var/log/frr/bgpd.log-20210904 (deleted) bgpd_ka 83886 83889 frr 325w REG 8,2 6398055 2490614 /var/log/frr/bgpd.log-20210914 (deleted) bgpd_ka 83886 83889 frr 326w REG 8,2 4632644 2490643 /var/log/frr/bgpd.log-20210906 (deleted) bgpd_ka 83886 83889 frr 327w REG 8,2 6893498 2490683 /var/log/frr/bgpd.log-20210910 (deleted) ... Sending a USR1 signal had no effect. This is FRR 7.5.1 on CentOS 7. Can someone else please check and confirm this issue? Thank you! -- Natterbox Limited Registered address: No 1 Croydon, 12-16 Addiscombe Road, Croydon CR0 0XT, UK Company number: 06968249 VAT number: 293 7488 48 This email and any files transmitted with it are confidential, intended solely for the use of the addressee and are not to be used, disseminated, forwarded, printed or copied by any other person. Any views or opinions are solely those of the author and do not necessarily represent those of Natterbox Limited unless specifically stated. If you have received this communication in error, please accept our apologies and promptly inform the sender by email or by telephoning the above number. Please also immediately delete this message and any attachments from your systems. Thank you. The files attached and/or any website linked to this email may contain viruses which could damage your computer, Natterbox Limited cannot accept liability for such damage.

1 0

Route Server Functionality
by Michael H Lambert 15 Sep '21

15 Sep '21

I’m trying to better understand route server functionality on FRR (7.5.1 specifically) and how it differs from quagga. I found the commit in which the legacy quagga special-case code was removed and replaced by the use of add-path. What happens if the route server and the client are unable to negotiate add-path as required? If the legacy code were still in place, I would expect a failover to it in that situation. Since the legacy code is no longer present, is the client required to have properly configured add-path in order to properly talk to the route server? Thanks, Michael

1 0

Basic BGP transit with FRR
by John Antypas 04 Sep '21

04 Sep '21

To all, I've always known what FRR is, and what it can do. I've just never had to do it myself -- I've been lucky enough to have really good WAN admins who just delivered packet to me over an Ethernet cable and I stayed in the kernel where I could only break MY machine, not everyone else's on the Internet. Some poor soul told me I should venture out and let me do this.... God protects the foolish so here I go.... What I'm trying to do: My transit provider has given me a GRE tunnel for my IP blocks and over which I am to do BGP. Specifically (made up IPs, but valid prefixes) - GRE tunnel endpoints 10.1.0.1 (their end) --- 10.1.0.2 (my end). Tunnel works and passes packets - Prefixes: 199.181.204.0/24 2602:805:A000::/44 It seems to me, I need to create an frr file like this? (daemons has bgpd on) --------------------------------------------- version 7.5 frr default traditional hostname esxi password 5System5!zebra enable password 5System5!zebra log syslog traditional ip forward ipv6 forward ip forward service integrated-vtysh-conf router bgp 398319 neighbor V4 peer-group neighbor V4 as THEIR-ASN neighbor 10.1.0.2 peer-group V4 neighbor V6 peer-group neighbor V6 remote-as THEIR-ASN neighbor THEIR-V6-IP address-family ipv4 unicast redistribute connected neighbor V4 route-map IMPORT in neighbor V4 route-map EXPORT out exit-address-family address-family ipv6 unicase redistributee connected neighbor V6 activate neighbor V6 route-map INPORT in neighbor V6 route-map EXPORT out exit-address-family route-map EXPORT deny 100 route-map EXPORT permit 1 match interface lo route-map IMPORT deny 1 line vty --------------------------------- Is this even close? I just want to announce my internal prefixes out to them. Also, I've put this in frr.conf vtysh.conf, etc. and it never seems to be part of the config. Clearing I'm quite worng. Where do I go from here?

1 0