- frog - lists.frrouting.org

OSPF over GRE over IPSec
by Volodymyr Litovka 11 Mar '22

11 Mar '22

Hi colleagues, can anybody help me with an issue in the following configuration. There is GRE over IPSec in transport mode between Linux (Ubuntu 20.04) and two other boxes - Cisco (virtual XE v17.07.01) and Mikrotik (CHR v6). Pings are there, so IPSec policies, addresses, connectivity is ok, but OSPF (I'm using FRR 8.1) do not work. On the linux side, tcpdump shows that it sends hellos in this interface, but both Cisco and CHR see nothing: # tcpdump -i gre1 -v [ ... ] 15:34:49.132222 IP (tos 0xc0, ttl 1, id 15017, offset 0, flags [none], proto OSPF (89), length 68) my_linux > ospf-all.mcast.net: OSPFv2, Hello, length 48 Router-ID x.x.x.x, Backbone Area, Authentication Type: none (0) Options [External] Hello Timer 10s, Dead Timer 40s, Mask 255.255.255.252, Priority 1 Neighbor List: 100.100.8.1 Cisco: Mar 11 15:31:33.522: OSPF-1 HELLO Tu8: Send hello to 224.0.0.5 area 0 from 100.99.0.65 Mar 11 15:31:42.586: OSPF-1 HELLO Tu8: Send hello to 224.0.0.5 area 0 from 100.99.0.65 Mar 11 15:31:51.641: OSPF-1 HELLO Tu8: Send hello to 224.0.0.5 area 0 from 100.99.0.65 Mikrotik (using packet sniffer) also see nothing on input. Definitely, the issue is on Linux side but I can't realize, where exactly. Linux side (mtu is same, multicast switched on): 6: gre1@NONE: <POINTOPOINT,MULTICAST,NOARP,UP,LOWER_UP> mtu 1400 qdisc noqueue state UNKNOWN group default qlen 1000 link/gre x.x.x.x peer x.x.x.y inet 100.99.0.66/30 brd 100.99.0.67 scope global gre1 valid_lft forever preferred_lft forever vtysh#sh run [ ... ] interface gre1 ip ospf cost 5 ip ospf mtu-ignore vtysh#sh ip ospf interface gre1 gre1 is up ifindex 6, MTU 1400 bytes, BW 0 Mbit <UP,POINTOPOINT,RUNNING,NOARP,MULTICAST> Internet Address 100.99.0.66/30, Broadcast 100.99.0.67, Area 0.0.0.0 MTU mismatch detection: disabled Router ID x.x.x.x, Network Type POINTOPOINT, Cost: 5 Transmit Delay is 1 sec, State Point-To-Point, Priority 1 No backup designated router on this network Multicast group memberships: OSPFAllRouters Timer intervals configured, Hello 10s, Dead 40s, Wait 40s, Retransmit 5 Hello due in 8.701s Neighbor Count is 1, Adjacent neighbor count is 0 vtysh#sh ip ospf neigh Neighbor ID Pri State Dead Time Address Interface RXmtL RqstL DBsmL 100.100.8.1 1 Init/DROther 37.960s 100.99.0.65 gre1:100.99.0.66 0 0 0 host# ip maddress [ ... ] 6: gre1 inet 224.0.0.5 inet 224.0.0.1 What I miss in the Linux configuration? Cisco configuration is for reference: interface Tunnel8 description HZF ip address 100.99.0.65 255.255.255.252 ip mtu 1400 ip ospf network point-to-point ip ospf cost 5 tunnel source GigabitEthernet1 tunnel destination x.x.x.x Tunnel8 is up, line protocol is up Internet Address 100.99.0.65/30, Interface ID 20, Area 0 Attached via Network Statement Process ID 1, Router ID 100.100.8.1, Network Type POINT_TO_POINT, Cost: 5 Topology-MTID Cost Disabled Shutdown Topology Name 0 5 no no Base Transmit Delay is 1 sec, State POINT_TO_POINT Timer intervals configured, Hello 10, Dead 40, Wait 40, Retransmit 5 oob-resync timeout 40 Hello due in 00:00:04 Supports Link-local Signaling (LLS) Cisco NSF helper support enabled IETF NSF helper support enabled Can not be protected by per-prefix Loop-Free FastReroute Can be used for per-prefix Loop-Free FastReroute repair paths Not Protected by per-prefix TI-LFA Index 1/8/8, flood queue length 0 Next 0x0(0)/0x0(0)/0x0(0) Last flood scan length is 1, maximum is 38 Last flood scan time is 0 msec, maximum is 1 msec Neighbor Count is 0, Adjacent neighbor count is 0 Suppress hello for 0 neighbor(s) Thank you for any recommendations. -- Volodymyr Litovka "Vision without Execution is Hallucination." -- Thomas Edison

2 2

Yocto recipe for FRR
by mohammad 27 Feb '22

27 Feb '22

Hi Sorry if this is a duplicate mail. But I couldn't find any reference for FRR recipe in Yocto build system. All I have found are suggestions to modify quagga recipe and an old mail with recipe for FRR 5.0 but unfortunately I couldn't access it Regards

1 0

GRPC support for BGP, OSPF, RIP and OSPFV3 daemons
by jagadeesh N 22 Feb '22

22 Feb '22

Hi All, I wanted to understand the current status and future plans for FRR GRPC Northbound support. I followed the developer guide to get the taste of grpc and looking at the frr test code i was able to do basic static configuration and fetch the configuration using get APIs. But when I tried the same thing on BGP I didn't get any configuration as response(although I configured bgp using VTYSH and also enabled GRPC on bgpd). Due to lack of clarity from the documentation I skimmed through the code, as per my understanding not all the daemons contain the code to support GET and SET APIs as of now. Is my understanding correct? Please point me to any development branch where GRPC support work is going on. Thanks in advance, Jagadeesh N

1 0

Re: [FROG] subscribe
by Abdelmuhaimen Seaudi 17 Feb '22

17 Feb '22

Hello I would like to know if I can setup an EoMPLS PseudoWire using FRR. And, if it is not fully supported, is there a workaround using FRR ? I will be using Debian 11 as my Linux Distro, Kernel version 4.15.x Thanks for any information about the topic Abdelmuhaimen Seaudi, CCIE # 25265 Email: aseaudi(a)gmail.com Skype: aseaudi LinkedIn: www.linkedin.com/in/aseaudi Telephone: +2012 84644 733 >

2 2

Re: [FROG] What can cause State/PfxRcd "(Policy)" in frr 7.5.1?
by Brandon Jackson 31 Jan '22

31 Jan '22

bgp ebgp-requires-policy FRR now REQUIRES that you define a filter for RFC8212. https://docs.frrouting.org/en/latest/bgp.html#clicmd-bgp-ebgp-requires-poli… ---------------------------------- Brandon Jackson bjackson(a)napshome.net On Mon, Jan 31, 2022 at 9:34 AM Peter Olsson via frog < frog(a)lists.frrouting.org> wrote: > > > > ---------- Forwarded message ---------- > From: Peter Olsson <list-frog(a)jyborn.se> > To: frog(a)lists.frrouting.org > Cc: > Bcc: > Date: Mon, 31 Jan 2022 15:03:34 +0100 > Subject: What can cause State/PfxRcd "(Policy)" in frr 7.5.1? > Hello! > > I am converting a working quagga configuration into an frr configuration, > since quagga seems abandoned these days. > > I run frr 7.5.1-1.1 in debian 11.2. > > Most peers work fine, but a couple of critical ones get this State which I > haven't seen before: > Neighbor V AS MsgRcvd MsgSent TblVer InQ OutQ Up/Down > State/PfxRcd PfxSnt > x.x.x.57 4 yyyy 165 6 0 0 0 00:01:07 > (Policy) 9 > x.x.x.77 4 zzzzz 10 4 0 0 0 00:01:07 > (Policy) 0 > > I'm trying to understand what this means, but haven't found anything so > far. > > The only interesting thing I can see is that the affected peers are using > a private AS number on either itself or the other side. > Could that cause the "(Policy)" State? > > Thanks! > > Peter Olsson > > > > > ---------- Forwarded message ---------- > From: Peter Olsson via frog <frog(a)lists.frrouting.org> > To: frog(a)lists.frrouting.org > Cc: > Bcc: > Date: Mon, 31 Jan 2022 15:03:34 +0100 > Subject: [FROG] What can cause State/PfxRcd "(Policy)" in frr 7.5.1? > _______________________________________________ > frog mailing list > frog(a)lists.frrouting.org > https://lists.frrouting.org/listinfo/frog >

1 0

What can cause State/PfxRcd "(Policy)" in frr 7.5.1?
by Peter Olsson 31 Jan '22

31 Jan '22

Hello! I am converting a working quagga configuration into an frr configuration, since quagga seems abandoned these days. I run frr 7.5.1-1.1 in debian 11.2. Most peers work fine, but a couple of critical ones get this State which I haven't seen before: Neighbor V AS MsgRcvd MsgSent TblVer InQ OutQ Up/Down State/PfxRcd PfxSnt x.x.x.57 4 yyyy 165 6 0 0 0 00:01:07 (Policy) 9 x.x.x.77 4 zzzzz 10 4 0 0 0 00:01:07 (Policy) 0 I'm trying to understand what this means, but haven't found anything so far. The only interesting thing I can see is that the affected peers are using a private AS number on either itself or the other side. Could that cause the "(Policy)" State? Thanks! Peter Olsson

1 0

VPLS not working on Ubuntu 18 VM
by abdelmuhaimen.seaudi＠orange.com 19 Jan '22

19 Jan '22

Hello, I followed the tutorial, and configured 2 Ubuntu 18 VMs with frr OSPF + LDP + L2VPN VPLS. Routing table is OK on the VMs, pseudowires created OK and UP. I cannot see bridge br0 or interface mpw0, if I do “ifconfig” on the linux vm. I tried pinging over the VPLS, but the frames coming from the host are not encapsulated in MPLS. Is there a specific Linux setup necessary to enable the dataplane forwarding to work ? Thanks Abdel-Muhaimen Seaudi Orange Innovation Egypt Email: abdelmuhaimen.seaudi(a)orange.com Mobile: +2012 84644 733 _________________________________________________________________________________________________________________________ Ce message et ses pieces jointes peuvent contenir des informations confidentielles ou privilegiees et ne doivent donc pas etre diffuses, exploites ou copies sans autorisation. Si vous avez recu ce message par erreur, veuillez le signaler a l'expediteur et le detruire ainsi que les pieces jointes. Les messages electroniques etant susceptibles d'alteration, Orange decline toute responsabilite si ce message a ete altere, deforme ou falsifie. Merci. This message and its attachments may contain confidential or privileged information that may be protected by law; they should not be distributed, used or copied without authorisation. If you have received this email in error, please notify the sender and delete this message and its attachments. As emails may be altered, Orange is not liable for messages that have been modified, changed or falsified. Thank you.

3 5

EoMPLS with FRR
by abdelmuhaimen.seaudi＠orange.com 14 Jan '22

14 Jan '22

Hello I would like to know if I can setup an EoMPLS PseudoWire using FRR. And, if it is not fully supported, is there a workaround using FRR ? My linux: Linux sonic 5.10.0-8-2-amd64 #1 SMP Debian 5.10.46-4 (2021-08-03) x86_64 GNU/Linux. Thanks for any information about the topic Abdel-Muhaimen Seaudi Orange Innovation Egypt Email: abdelmuhaimen.seaudi(a)orange.com Mobile: +2012 84644 733 _________________________________________________________________________________________________________________________ Ce message et ses pieces jointes peuvent contenir des informations confidentielles ou privilegiees et ne doivent donc pas etre diffuses, exploites ou copies sans autorisation. Si vous avez recu ce message par erreur, veuillez le signaler a l'expediteur et le detruire ainsi que les pieces jointes. Les messages electroniques etant susceptibles d'alteration, Orange decline toute responsabilite si ce message a ete altere, deforme ou falsifie. Merci. This message and its attachments may contain confidential or privileged information that may be protected by law; they should not be distributed, used or copied without authorisation. If you have received this email in error, please notify the sender and delete this message and its attachments. As emails may be altered, Orange is not liable for messages that have been modified, changed or falsified. Thank you.

1 0

About eliminating duplicate BFD peer session
by 吴昌容 08 Jan '22

08 Jan '22

Dear FRR community members, I am a user of FRR and I am now using it to build a small-scale experiment network. I ran into a problem regarding the interaction between BFD and BGP in the recent days. My BGP configuration specifies BFD dependencies for BGP neighbors using "neighbor X.X.X.X bfd". And the FRR will create some BFD peer sessions (marked as dynamic in FRR) immediately when it reads the BGP configuration. Then after FRR reads the BFD configuration, it seems that FRR will deregister the previous "dynamic" peer sessions and register those peer sessions (marked as configured) specified in the BFD configuration. I learn this from the debugging log and such mechanisms work in most cases. But in some situations, it does not work. Specifically, the FRR will have two duplicate BFD peer sessions for the same peer at last. I found that restarting FRR can solve the problem. Yet, I wonder whether there is a more elegant solution. The example configuration of the problematic peer is as follows: router #1, with IP address 10.3.0.1 *router bgp 1 no bgp ebgp-requires-policy neighbor 10.0.0.2 remote-as 2 neighbor 10.0.0.2 bfd neighbor 10.1.0.2 remote-as 3 neighbor 10.1.0.2 bfd neighbor 10.4.0.1 remote-as 1 neighbor 10.4.0.1 bfd neighbor 10.4.0.1 update-source 10.3.0.1 neighbor 10.5.0.1 remote-as 1 neighbor 10.5.0.1 bfd neighbor 10.5.0.1 update-source 10.3.0.1 ! address-family ipv4 unicast network 10.0.0.0/24 <http://10.0.0.0/24> network 10.1.0.0/24 <http://10.1.0.0/24> network 10.3.0.0/24 <http://10.3.0.0/24> network 10.4.0.0/24 <http://10.4.0.0/24> network 10.5.0.0/24 <http://10.5.0.0/24> network 10.12.0.0/24 <http://10.12.0.0/24> network 10.13.0.0/24 <http://10.13.0.0/24> network 10.18.0.0/24 <http://10.18.0.0/24> exit-address-familyexitbfd peer 10.0.0.2 transmit-interval 100 receive-interval 100 exit ! peer 10.1.0.2 transmit-interval 100 receive-interval 100 exit ! peer 10.4.0.1 multihop local-address 10.3.0.1 transmit-interval 100 receive-interval 100 exit ! peer 10.5.0.1 multihop local-address 10.3.0.1 transmit-interval 100 receive-interval 100 exit !exit* router #2, with IP address 10.5.0.1 *router bgp 1 no bgp ebgp-requires-policy neighbor 10.3.0.1 remote-as 1 neighbor 10.3.0.1 bfd neighbor 10.3.0.1 update-source 10.5.0.1exitbfd peer 10.3.0.1 multihop local-address 10.5.0.1 transmit-interval 100 receive-interval 100 exit !exit* The router #1 get two duplicate BFD peer sessions as follows: (the interface s0-eth2 has the IP address 10.3.0.1) *peer 10.5.0.1 local-address 10.3.0.1 vrf default interface s0-eth2 ID: 2040029068 Remote ID: 0 Active mode Status: down Downtime: 11 minute(s), 51 second(s) Diagnostics: ok Remote diagnostics: ok Peer Type: dynamic Local timers: Detect-multiplier: 3 Receive interval: 300ms Transmission interval: 300ms Echo receive interval: 50ms Echo transmission interval: disabled Remote timers: Detect-multiplier: 3 Receive interval: 1000ms Transmission interval: 1000ms Echo receive interval: disabled* * peer 10.5.0.1 multihop local-address 10.3.0.1 vrf default ID: 1516906735 Remote ID: 2466577291 Active mode Minimum TTL: 254 Status: up Uptime: 11 minute(s), 51 second(s) Diagnostics: ok Remote diagnostics: ok Peer Type: configured Local timers: Detect-multiplier: 3 Receive interval: 100ms Transmission interval: 100ms Echo receive interval: 50ms Echo transmission interval: disabled Remote timers: Detect-multiplier: 3 Receive interval: 100ms Transmission interval: 100ms Echo receive interval: 50ms* Can anyone give me a hint of a clean solution? Thanks! Changrong Wu

1 0

kernel route redistribution via OSPF
by HOSTAK Peter 20 Dec '21

20 Dec '21

Hi all, I have a question regarding redistribution of kernel routes with specific metric via OSPF6. I have a very simple OSPF6 router definition: interface eth0 ipv6 ospf6 area 0 exit ! router ospf6 ospf6 router-id 8.8.8.81 redistribute kernel exit and I would like to redistribute the following sample kernel (static) routes: ATN-DC-FRR-01# show ipv6 route kernel K>* fca0:ffff::2/128 [0/50] via fc00::4, eth0, 3d23h32m K>* fca0:ffff::3/128 [0/100] via fc00::4, eth0, 00:00:03 The problem is not to redistribute them via OSPF6 to another OSPF6 neighbor but to either redistribute them with the same OSPF metric (e.g. 50 or 100 as in my example above) or somehow set it using route maps (I have finite number of metrics to set). Q1: Is it expected that the kernel route metric is ignored and default OSPF metric "20" is set instead? (it is a feature or a bug?) I've also tried to set the metrics using route maps. Yes, it is possible to set it but there is no way to match "original" kernel route metric ("match metric XY" matches everything) and set it as OSPF metric. Q2: What kind of metric "match metric" matches? In documentation I found only "matches the specified metric". Is it only an "IGP" metric (BGP, OSPF...) and kernel route metric is ignored? "match metric 100" matches routes with any metric so I guess it is ignored. In reality I have multiple kernel routes (static routes) which need to be assigned into pre-defined groups (finite number) and this assignment needs to be propagated somehow via OSPF to another OSPF neighbours (cisco boxes). Only usable parameter for such an assignment is a metric since there is no "tag" in "iproute" (I also tried "weight" which is not visible for FRR). So, the idea is the following: all the routes with metric e.g. 10 will be part of the group 1 and will get OSPF metric 10 and so on. Since it is group of kernel routes which have nothing in common (apart of group assignment), I can't use e.g. source IP or next-hop IP as matching criterion, but I need something more generic (like a tag) which I can use to label them. Do you guys have an idea how to achieve it? Thank you in advance. Best regards Peter

1 0