- frog - lists.frrouting.org

pathspace for config files
by Casey Deccio 19 Aug '25

19 Aug '25

Hi all, I'm having trouble getting mgmtd to recognize my -N option for finding my config files: $ sudo /usr/lib/frr/mgmtd -N r1 --log-level=debug --log=stdout 2025/08/13 11:30:17 MGMTD: [T83RR-8SM5G] mgmtd 10.3 starting: vty@2623 2025/08/13 11:30:17 MGMTD: [RQT05-4D0H5][EC 100663319] vty_open_config: failed to open configuration file /etc/frr//zebra.conf: No such file or directory, checking backup 2025/08/13 11:30:17 MGMTD: [VDWX6-W8CNF][EC 100663304] vty_open_config: can't open configuration file [/etc/frr//zebra.conf] 2025/08/13 11:30:17 MGMTD: [RQT05-4D0H5][EC 100663319] vty_open_config: failed to open configuration file /etc/frr//ripd.conf: No such file or directory, checking backup 2025/08/13 11:30:17 MGMTD: [VDWX6-W8CNF][EC 100663304] vty_open_config: can't open configuration file [/etc/frr//ripd.conf] 2025/08/13 11:30:17 MGMTD: [RQT05-4D0H5][EC 100663319] vty_open_config: failed to open configuration file /etc/frr//ripngd.conf: No such file or directory, checking backup 2025/08/13 11:30:17 MGMTD: [VDWX6-W8CNF][EC 100663304] vty_open_config: can't open configuration file [/etc/frr//ripngd.conf] 2025/08/13 11:30:17 MGMTD: [RQT05-4D0H5][EC 100663319] vty_open_config: failed to open configuration file /etc/frr//staticd.conf: No such file or directory, checking backup 2025/08/13 11:30:17 MGMTD: [VDWX6-W8CNF][EC 100663304] vty_open_config: can't open configuration file [/etc/frr//staticd.conf] 2025/08/13 11:30:17 MGMTD: [RQT05-4D0H5][EC 100663319] vty_open_config: failed to open configuration file /etc/frr//mgmtd.conf: No such file or directory, checking backup 2025/08/13 11:30:17 MGMTD: [VDWX6-W8CNF][EC 100663304] vty_open_config: can't open configuration file [/etc/frr//mgmtd.conf] 2025/08/13 11:30:17 MGMTD: [XSARQ-CBJX8] mgmtd: finished reading config files ^C2025/08/13 11:32:03 MGMTD: [J2RAS-MZ95C] Terminating on signal Seems like it should be looking in /etc/frr/r1/ for the config files, not /etc/frr//mgmtd.conf. $ sudo /usr/lib/frr/mgmtd -h | grep pathsp -N, --pathspace Insert prefix into config & socket paths It works for the runtime files, which were created in the correct directory. $ sudo ls -ltra /run/frr/r1/ total 4 drwxr-xr-x 5 frr frr 280 Aug 13 09:33 .. srwx------ 1 frr frr 0 Aug 13 11:30 mgmtd_fe.sock srwxrwx--- 1 frr frrvty 0 Aug 13 11:30 mgmtd.vty -rw-r--r-- 1 frr frr 6 Aug 13 11:30 mgmtd.pid srwx------ 1 frr frr 0 Aug 13 11:30 mgmtd_be.sock drwxr-xr-x 2 frr frr 120 Aug 13 11:30 . Version: $ sudo /usr/lib/frr/mgmtd -v mgmtd version 10.3 Copyright 1996-2005 Kunihiro Ishiguro, et al. configured with: '--build=aarch64-linux-gnu' '--prefix=/usr' '--includedir=${prefix}/include' '--mandir=${prefix}/share/man' '--infodir=${prefix}/share/info' '--sysconfdir=/etc' '--localstatedir=/var' '--disable-option-checking' '--disable-silent-rules' '--libdir=${prefix}/lib/aarch64-linux-gnu' '--runstatedir=/run' '--disable-maintainer-mode' '--sbindir=/usr/lib/frr' '--with-vtysh-pager=/usr/bin/pager' '--libdir=/usr/lib/aarch64-linux-gnu/frr' '--with-moduledir=/usr/lib/aarch64-linux-gnu/frr/modules' '--disable-dependency-tracking' '--enable-rpki' '--enable-scripting' '--enable-pim6d' '--with-libpam' '--enable-doc' '--enable-doc-html' '--enable-snmp' '--enable-fpm' '--disable-protobuf' '--disable-zeromq' '--enable-ospfapi' '--enable-bgp-vnc' '--enable-multipath=256' '--enable-user=frr' '--enable-group=frr' '--enable-vty-group=frrvty' '--enable-configfile-mask=0640' '--enable-logfile-mask=0640' 'build_alias=aarch64-linux-gnu' 'LIBS= -latomic' 'PYTHON=python3' $ dpkg --list | grep frr ii frr 10.3-3 arm64 FRRouting Internet routing protocol suite ii frr-pythontools 10.3-3 all FRRouting Internet routing protocol suite (reload support) Thanks, Casey

1 2

classic config has reachability issues
by Randy Bush 14 Aug '25

14 Aug '25

Debian 12 FRR 10.4.1 BGP and IS-IS with VRRP, i.e. old skool isp style when both routers are up, some LAN hosts are not reachable from WAN, others are; no pattern i can see. but all are reachable from within LAN. `systemctl stop frr.service` on r0, and everything is fine, i.e. reachable from WAN (well, r0 isn't unless those gateways are uncommented). i suspect vrrp issues, but have no real basis to do so. i have checked the /25 netmask everywhere. but i am sure i am doing something wrongly. clue bat appreciated. randy --- NTT Cogent | | +--------+--------+ +--------+--------+ | | | | | r0 | | r1 | | | | | +--------+--------+ +--------+--------+ | | Primary Primary & & VRRP VRRP | LAN/25 | ----------+--------------------------------------+---------- `/etc/network/interfaces` look like auto lo iface lo inet loopback # IS-IS loopback for iBGP peering auto lo:0 iface lo:0 inet static address 192.168.254.10/32 iface lo:0 inet6 static address fc00::10/128 # LAN auto eno1 iface eno1 inet static address 198.180.150.120/25 dns-nameservers 127.0.0.1 198.180.150.8 dns-search rg.net iface eno1 inet6 static address 2001:418:8006::120/64 iface eno1 vrrp 6 198.180.150.126/25 2001:418:8006::126/64 # WAN auto eno4 iface eno4 inet static address 129.250.10.158/30 # gateway 129.250.10.157 iface eno4 inet6 static address 2001:418:8000:5000::1a/126 # gateway 2001:418:8000:5000::19 IS-IS and BGP converge happily frr configs frr version 10.4.1 frr defaults traditional hostname r0.iad.rg.net log syslog informational service password-encryption service integrated-vtysh-config ! ip prefix-list export4 seq 5 permit 198.180.150.0/24 ! ipv6 prefix-list export6 seq 5 permit 2001:418:8006::/48 ! route-map accept-all permit 10 exit ! route-map deny-all deny 10 exit ! route-map transit-in4 permit 10 set community 3927:2914 exit ! route-map transit-in6 permit 10 set community 3927:386 exit ! route-map cust-in4 permit 10 set community 3927:374 exit ! route-map cust-in6 permit 10 set community 3927:376 exit ! route-map transit-out4 deny 10 match ip address prefix-list export4 exit ! route-map transit-out4 permit 20 match community comm-cust4 exit ! route-map transit-out6 deny 10 match ipv6 address prefix-list export6 exit ! route-map transit-out6 permit 20 match community comm-cust6 exit ! password 8 foo enable password 8 bar ! interface eno1 description RGnet LAN ip router isis p1 ipv6 router isis p1 isis circuit-type level-2-only vrrp 6 version 3 vrrp 6 priority 90 vrrp 6 ip 198.180.150.126 vrrp 6 ipv6 2001:418:8006::126 exit ! interface eno4 description NTT ip router isis p1 ipv6 router isis p1 isis circuit-type level-2-only isis passive exit ! interface lo ip router isis p1 ipv6 router isis p1 isis circuit-type level-2-only isis passive exit ! router bgp 3927 bgp router-id 198.180.150.120 no bgp default ipv4-unicast no bgp network import-check neighbor 129.250.10.157 remote-as 2914 neighbor 129.250.10.157 password feen neighbor 192.168.254.11 remote-as 3927 neighbor 192.168.254.11 password foon neighbor 192.168.254.11 update-source 192.168.254.10 neighbor 2001:418:8000:5000::19 remote-as 2914 neighbor 2001:418:8000:5000::19 password feen neighbor fc00::11 remote-as 3927 neighbor fc00::11 password foon neighbor fc00::11 update-source fc00::10 ! address-family ipv4 unicast network 198.180.150.0/24 neighbor 129.250.10.157 activate neighbor 129.250.10.157 route-map transit-in4 in neighbor 129.250.10.157 route-map transit-out4 out neighbor 192.168.254.11 activate neighbor 192.168.254.11 route-map accept-all in neighbor 192.168.254.11 route-map accept-all out exit-address-family ! address-family ipv6 unicast network 2001:418:8006::/48 neighbor 2001:418:8000:5000::19 activate neighbor 2001:418:8000:5000::19 route-map transit-in6 in neighbor 2001:418:8000:5000::19 route-map transit-out6 out neighbor fc00::11 activate exit-address-family exit ! router isis p1 net 47.0001.1921.6825.4010.00 exit ! bgp community-list standard comm-cust4 seq 5 permit 3927:374 bgp community-list standard comm-cust6 seq 5 permit 3927:376 bgp community-list standard comm-trans4 seq 5 permit 3927:384 bgp community-list standard comm-trans6 seq 5 permit 3927:386 ! end -30-

1 3

OSPF Adjacency Behavior with BFD Shutdown State
by Jagadeesh Banavara 23 Jul '25

23 Jul '25

Hi, I’ve observed a behavior and wanted to check if there’s a recommended approach or configuration to address it. When a BFD profile transitions to the shutdown state (admin down), it correctly brings down the OSPF adjacency. However, after a few seconds, the adjacency is re-established—even though the BFD session remains down. In contrast, BGP has a ‘strict' mode that prevents session establishment until the BFD session is up. Is there a similar mechanism or means available in FRR to keep OSPF down as long as the associated BFD session is in the down state? Any guidance or suggestions would be greatly appreciated. Thanks, Jagadeesh

1 0

BGPD advertises IPv4 prefixes when only IPv6 peer is up
by Richard Klingler 22 Jul '25

22 Jul '25

Good afternoon (o; New to FRR running two VM Debian 12 instances with FRR 10.4.0 for testing BGP setups. On each side I have v4 and v6 peers configured, but v4 is in admin shut state. But I see IPv4 prefix being advertised over the v6 BGP session. Is that a normal behaviour in FRR? thanks in advance richard

2 2

Fwd: Request to Join FRRouting Community Workspace
by Selvamani Ramasamy 30 Jun '25

30 Jun '25

Hi, I am not sure about how to contact the workspace administrator at FRRouting. for an invitation. Hence, sending the request to this e-mail list. It will be great if you do the needful for below request. Regards, Selva ---------- Forwarded message --------- From: Selvamani Ramasamy <selva(a)nexthop.ai> Date: Sat, Jun 28, 2025 at 4:13 PM Subject: Request to Join FRRouting Community Workspace To: <frr(a)lists.frrouting.org> Dear FRR Community Maintainers, I am Selva, currently working for nexthop.ai (https://nexthop.ai - a company mainly focussing on building AI infrastructure), and we are interested in contributing to the FRRouting project. I noticed that my company is not listed on the FRR community sign-in page. Could you kindly guide me on how to receive an invitation to the FRRouting community workspace or Slack (if available)? We are keen to collaborate and discuss ideas. Looking forward to your response. Best regards, Selva [https://www.linkedin.com/in/selvamani-ramasamy-3a53139/]

1 0

Fwd: Request to Join FRRouting Community Workspace
by Selvamani Ramasamy 30 Jun '25

30 Jun '25

Hi, I am not sure about the e-mail contact for this request. It will be great if you do the needful for below request. Regards, Selva ---------- Forwarded message --------- From: Selvamani Ramasamy <selva(a)nexthop.ai> Date: Sat, Jun 28, 2025 at 4:13 PM Subject: Request to Join FRRouting Community Workspace To: <frr(a)lists.frrouting.org> Dear FRR Community Maintainers, I am Selva, currently working for nexthop.ai (https://nexthop.ai - a company mainly focussing on building AI infrastructure), and we are interested in contributing to the FRRouting project. I noticed that my company is not listed on the FRR community sign-in page. Could you kindly guide me on how to receive an invitation to the FRRouting community workspace or Slack (if available)? We are keen to collaborate and discuss ideas. Looking forward to your response. Best regards, Selva [https://www.linkedin.com/in/selvamani-ramasamy-3a53139/]

1 0

Issue with BFD/BGP Session Recovery on FRR 10.3 and Arista Router
by Julien Cosmao 26 Jun '25

26 Jun '25

Hi everyone, I have a setup with a BFD/BGP session between an FRR instance (version 10.3) and an Arista router. Generally, everything works well, and routes are learned correctly between the devices. However, during failure testing, specifically when the Arista device is reloaded, issues arise. In this scenario, the BGP and BFD sessions fail to establish properly. The FRR instance sends BFD packets (UDP 3784) to the peer while the Arista device attempts to establish a BGP session. FRR bgp state stay in Idle. >From the documentation, it seems that FRR operates like BFD strict mode ? refusing to establish BGP before the BFD session is up. Here is the relevant documentation link: https://docs.frrouting.org/en/latest/bfd.html#clicmd-neighbor-A.B.C.D-X-X-X… Here is a sample of my FRR conf: frr version 10.3 frr defaults traditional ! hostname frr1 ! ! Setup logging log daemon bgpd file /var/log/frr/bgpd.log debugging log daemon bfdd file /var/log/frr/bfdd.log debugging ! debug bgp updates debug bgp neighbor-events debug bgp keepalives debug bgp bfd debug bfd distributed debug bfd peer debug bfd network router bgp 64512 bgp router-id 192.168.0.5 no bgp default ipv4-unicast neighbor PG_EDGE_V4 peer-group neighbor PG_EDGE_V4 remote-as 64534 neighbor PG_EDGE_V4 bfd neighbor PG_EDGE_V4 bfd profile edge neighbor 192.168.0.1 peer-group PG_EDGE_V4 neighbor 192.168.0.2 peer-group PG_EDGE_V4 ! address-family ipv4 unicast neighbor PG_EDGE_V4 activate neighbor PG_EDGE_V4 addpath-tx-all-paths neighbor PG_EDGE_V4 soft-reconfiguration inbound exit-address-family ! ! bfd profile edge detect-multiplier 8 transmit-interval 500 receive-interval 500 exit ! peer 192.168.0.1 profile edge exit ! peer 192.168.0.2 profile edge exit ! ! exit ! end The only way I have found to recover the sessions is to disable and then re-enable BFD on the router BGP configuration: configure terminal router bgp 64512 no neighbor PG_EDGE_V4 bfd no neighbor PG_EDGE_V4 bfd profile edge do clear bgp external neighbor PG_EDGE_V4 bfd neighbor PG_EDGE_V4 bfd profile edge Has anyone encountered a similar issue or have suggestions on how to resolve this? Thank you in advance for your help. Regards, Julien

1 0

Help with Key Chain encryption
by Patel, Rajen L. 12 Jun '25

12 Jun '25

I am running FRR 7.3 for RHEL 8 and implementing a key chain as follows: key chain ospf-1 key 1 key-string <MyPassword> cryptographic-algorithm hmac-sha-384 When I issue the 'cryptographic-algorithm hmac-sha-384' command, I get an error 'Validation'. If I use 256, it accepts the command but both 384 and 512 fail. How can I fix this? Thanks Rajen Patel

1 0

OSFP Bug in pfSense 2.8.0
by Mark Tinka 12 Jun '25

12 Jun '25

If anyone comes across OSPF failing to start after rebooting into pfSense 2.8.0, here you go: https://forum.netgate.com/topic/197642/2-8-0-ospf-route-propagation-fails-a… Worked well for me. Mark.

1 0

Re: [FROG] RPKI process efficiency
by Celsa Sanchez 20 May '25

20 May '25

Hi, I'm also experiencing high CPU usage after enabling RPKI validation in FRR. I'm running version 9.0.1 on Ubuntu 20.04.6 LTS. Additionally, I'm having trouble stopping the RPKI validation using `vtysh`. Is there any known issue with this version, or recommended steps to properly reset or disable RPKI? Any suggestions would be appreciated. Best regards, Celsa Sánchez El lun, 25 nov 2024 a las 5:43, Darshan Kowlaser via frog (< frog(a)lists.frrouting.org>) escribió: > > > > ---------- Forwarded message ---------- > From: Darshan Kowlaser <darshan(a)darshankowlaser.com> > To: frog(a)lists.frrouting.org > Cc: > Bcc: > Date: Mon, 25 Nov 2024 10:22:11 +0200 > Subject: RPKI process efficiency > Hello > > I'm experiencing high CPU usage on my RPKI process which is very odd. To > elaborate, I have two vyos boxes that have similar configuration for the > edge just handling BGP and OSPF to the core. On one of the routers I have > excessively high CPU usage and when checking the processes RPKI sits very > high compared to the other router. > > FRR Version: > `*FRRouting 9.1.1 (za-ct-ter-dc-rt-edge-01) on Linux(6.6.43-amd64-vyos).* > > > *Copyright 1996-2005 Kunihiro Ishiguro, et al.configured with: > '--build=x86_64-linux-gnu' '--prefix=/usr' '--includedir=${prefix}/include' > '--mandir=${prefix}/share/man' '--infodir=${prefix}/share/info' > '--sysconfdir=/etc' '--localstatedir=/var' '--disable-option-checking' > '--disable-silent-rules' '--libdir=${prefix}/lib/x86_64-linux-gnu' > '--libexecdir=${prefix}/lib/x86_64-linux-gnu' '--disable-maintainer-mode' > '--localstatedir=/var/run/frr' '--sbindir=/usr/lib/frr' > '--sysconfdir=/etc/frr' '--with-vtysh-pager=/usr/bin/pager' > '--libdir=/usr/lib/x86_64-linux-gnu/frr' > '--with-moduledir=/usr/lib/x86_64-linux-gnu/frr/modules' > '--disable-dependency-tracking' '--enable-rpki' '--enable-scripting' > '--enable-pim6d' '--with-libpam' '--enable-doc' '--enable-doc-html' > '--enable-snmp' '--enable-fpm' '--disable-protobuf' '--disable-zeromq' > '--enable-ospfapi' '--enable-bgp-vnc' '--enable-multipath=256' > '--enable-user=frr' '--enable-group=frr' '--enable-vty-group=frrvty' > '--enable-configfile-mask=0640' '--enable-logfile-mask=0640' > 'build_alias=x86_64-linux-gnu' 'PYTHON=python3'* > ` > > Here is my RPKI configuration on the router experiencing high process CPU > usage : > > In Vtysh: > `*rpki* > > * rpki cache cpt-rpki-validator-01.example.xyz > <http://cpt-rpki-validator-01.example.xyz> 3323 preference 1 rpki cache > cpt-rpki-validator-02.example.xyz > <http://cpt-rpki-validator-02.example.xyz> 8282 preference 2* > ` > > In VyOS: > `*set protocols rpki cache cpt-rpki-validator-01.example.xyz > <http://cpt-rpki-validator-01.example.xyz> port '3323'* > > > > * set protocols rpki cache cpt-rpki-validator-01.example.xyz > <http://cpt-rpki-validator-01.example.xyz> preference '1' set protocols > rpki cache cpt-rpki-validator-02.example.xyz > <http://cpt-rpki-validator-02.example.xyz> port '8282' set protocols rpki > cache cpt-rpki-validator-02.example.xyz > <http://cpt-rpki-validator-02.example.xyz> preference '2'* > * set protocols rpki polling-period '3600* > ` > > The only thing different on the other box is that the server preference is > inverted. RPKI servers are running routinator and stayRTR, the router with > the issue preferences routinator. See below showing that it is the most > intensive process on the CPU : > > [image: image.png] > > Would be greatly appreciated if anyone could advise. > > > > ---------- Forwarded message ---------- > From: Darshan Kowlaser via frog <frog(a)lists.frrouting.org> > To: frog(a)lists.frrouting.org > Cc: > Bcc: > Date: Mon, 25 Nov 2024 10:22:11 +0200 > Subject: [FROG] RPKI process efficiency > _______________________________________________ > frog mailing list > frog(a)lists.frrouting.org > https://lists.frrouting.org/listinfo/frog >

2 2