- frog - lists.frrouting.org

RPKI process efficiency
by Darshan Kowlaser 25 Nov '24

25 Nov '24

Hello I'm experiencing high CPU usage on my RPKI process which is very odd. To elaborate, I have two vyos boxes that have similar configuration for the edge just handling BGP and OSPF to the core. On one of the routers I have excessively high CPU usage and when checking the processes RPKI sits very high compared to the other router. FRR Version: `*FRRouting 9.1.1 (za-ct-ter-dc-rt-edge-01) on Linux(6.6.43-amd64-vyos).* *Copyright 1996-2005 Kunihiro Ishiguro, et al.configured with: '--build=x86_64-linux-gnu' '--prefix=/usr' '--includedir=${prefix}/include' '--mandir=${prefix}/share/man' '--infodir=${prefix}/share/info' '--sysconfdir=/etc' '--localstatedir=/var' '--disable-option-checking' '--disable-silent-rules' '--libdir=${prefix}/lib/x86_64-linux-gnu' '--libexecdir=${prefix}/lib/x86_64-linux-gnu' '--disable-maintainer-mode' '--localstatedir=/var/run/frr' '--sbindir=/usr/lib/frr' '--sysconfdir=/etc/frr' '--with-vtysh-pager=/usr/bin/pager' '--libdir=/usr/lib/x86_64-linux-gnu/frr' '--with-moduledir=/usr/lib/x86_64-linux-gnu/frr/modules' '--disable-dependency-tracking' '--enable-rpki' '--enable-scripting' '--enable-pim6d' '--with-libpam' '--enable-doc' '--enable-doc-html' '--enable-snmp' '--enable-fpm' '--disable-protobuf' '--disable-zeromq' '--enable-ospfapi' '--enable-bgp-vnc' '--enable-multipath=256' '--enable-user=frr' '--enable-group=frr' '--enable-vty-group=frrvty' '--enable-configfile-mask=0640' '--enable-logfile-mask=0640' 'build_alias=x86_64-linux-gnu' 'PYTHON=python3'* ` Here is my RPKI configuration on the router experiencing high process CPU usage : In Vtysh: `*rpki* * rpki cache cpt-rpki-validator-01.example.xyz <http://cpt-rpki-validator-01.example.xyz> 3323 preference 1 rpki cache cpt-rpki-validator-02.example.xyz <http://cpt-rpki-validator-02.example.xyz> 8282 preference 2* ` In VyOS: `*set protocols rpki cache cpt-rpki-validator-01.example.xyz <http://cpt-rpki-validator-01.example.xyz> port '3323'* * set protocols rpki cache cpt-rpki-validator-01.example.xyz <http://cpt-rpki-validator-01.example.xyz> preference '1' set protocols rpki cache cpt-rpki-validator-02.example.xyz <http://cpt-rpki-validator-02.example.xyz> port '8282' set protocols rpki cache cpt-rpki-validator-02.example.xyz <http://cpt-rpki-validator-02.example.xyz> preference '2'* * set protocols rpki polling-period '3600* ` The only thing different on the other box is that the server preference is inverted. RPKI servers are running routinator and stayRTR, the router with the issue preferences routinator. See below showing that it is the most intensive process on the CPU : [image: image.png] Would be greatly appreciated if anyone could advise.

1 0

FRR as EVPN route reflector
by Erwan David 27 Sep '24

27 Sep '24

Hello, I am using GNS3 FRR appliance (in case it is important), in my GNS3 setting (before going to production) I want to use frr as a route reflector for l2vpn evpn address family. My setting is router bgp 65000 bgp router-id 10.102.33.1 bgp log-neighbor-changes no bgp default ipv4-unicast bgp cluster-id 10.102.33.1 neighbor boucle peer-group neighbor boucle remote-as 65000 neighbor boucle update-source 10.102.33.1 neighbor boucle capability extended-nexthop bgp listen range 10.100.10.0/24 peer-group boucle ! address-family l2vpn evpn neighbor boucle activate neighbor boucle route-reflector-client exit-address-family exit My VTEPs (all in 10.100.10.0/24) establish a session with FRR and send their EVPN routes (types 2 and 3). However, FRR does not send the routes back to the clients What did I miss ? Should I check some kernel modules are present in the alpine linux on which frr runs ? -- Erwan David

1 1

GNS3 appliance with bonding ?
by Erwan David 19 Sep '24

19 Sep '24

Hello, I need to use a GNS3 appliance of FRR (and I cannit give it internet access) with bonding (LACP) on interfaces. The bonding package is not present in the appliance, what are my options ? -- Erwan David

1 0

ipv6 network statement
by Randy Bush 13 Sep '24

13 Sep '24

i assume i have a conf error, but can not see it no prefix is being advertised to ipv6 peer 2001:550:2:1::22 yet a similar template advertises one in v4 r1# show bgp summary IPv4 Unicast Summary: BGP router identifier 198.180.150.121, local AS number 3927 VRF default vrf-id 0 BGP table version 1201106 RIB entries 1736966, using 212 MiB of memory Peers 2, using 48 KiB of memory Neighbor V AS MsgRcvd MsgSent TblVer InQ OutQ Up/Down State/PfxRcd PfxSnt Desc 38.88.248.236 4 174 166936 99 1201106 0 0 01:36:00 940141 1 N/A 192.168.254.10 4 3927 121068 151229 1201106 0 0 01:18:23 634041 753625 N/A Total number of neighbors 2 IPv6 Unicast Summary: BGP router identifier 198.180.150.121, local AS number 3927 VRF default vrf-id 0 BGP table version 304315 RIB entries 381204, using 47 MiB of memory Peers 2, using 48 KiB of memory Neighbor V AS MsgRcvd MsgSent TblVer InQ OutQ Up/Down State/PfxRcd PfxSnt Desc 2001:550:2:1::22 4 174 66286 98 304315 0 0 01:35:55 192933 0 N/A fc00::10 4 3927 66566 55345 304315 0 0 01:28:16 153136 131291 N/A Total number of neighbors 2 and it admits it r1# show ip bgp neighbors 38.88.248.236 advertised-routes BGP table version is 1231961, local router ID is 198.180.150.121, vrf id 0 Default local pref 100, local AS 3927 Status codes: s suppressed, d damped, h history, u unsorted, * valid, > best, = multipath, i internal, r RIB-failure, S Stale, R Removed Nexthop codes: @NNN nexthop's vrf id, < announce-nh-self Origin codes: i - IGP, e - EGP, ? - incomplete RPKI validation codes: V valid, I invalid, N Not found Network Next Hop Metric LocPrf Weight Path *> 198.180.150.0/24 0.0.0.0 0 32768 i Total number of prefixes 1 vs r1# show bgp neighbors 2001:550:2:1::22 advertised-routes r1# [ aside: the cli asymmetry between ipv4 and ipv6 is unkind. ] config snippets ip prefix-list export4 seq 5 permit 198.180.150.0/24 ipv6 prefix-list export6 seq 5 permit 2001:418:8006::/48 ... address-family ipv4 unicast network 198.180.150.0/24 neighbor 38.88.248.236 activate neighbor 38.88.248.236 route-map accept-all in neighbor 38.88.248.236 route-map transit-out4 out neighbor 192.168.254.10 activate exit-address-family ! address-family ipv6 unicast network 2001:418:8006::/48 neighbor 2001:550:2:1::22 activate neighbor 2001:550:2:1::22 route-map accept-all in neighbor 2001:550:2:1::22 route-map transit-out6 out neighbor fc00::10 activate exit-address-family ... route-map transit-out4 permit 20 match ip address prefix-list export4 exit ... route-map transit-out6 permit 20 match ip address prefix-list export6 exit note that only the 2001:418:8006::/64 is on the LAN interface not the /48 r1# show ipv6 route 2001:418:8006::/64 Routing entry for 2001:418:8006::/64 Known via "connected", distance 0, metric 0, best Last update 01:52:13 ago * directly connected, eno3 r1# show ipv6 route 2001:418:8006::/48 % Network not in table similarly 198.180.150.0/24 is not on the LAN, it's a /25 LAN (don't ask) r1# show ip route 198.180.150.0/25 Routing entry for 198.180.150.0/25 Known via "isis", distance 115, metric 12 Last update 01:52:33 ago 198.180.150.120, via eno3 inactive, weight 1 Routing entry for 198.180.150.0/25 Known via "connected", distance 0, metric 0, best Last update 01:53:02 ago * directly connected, eno3 r1# show ip route 198.180.150.0/24 % Network not in table but it is in bgp r1# show ip bgp 198.180.150.0/24 BGP routing table entry for 198.180.150.0/24, version 1 Paths: (2 available, best #1, table default) Advertised to non peer-group peers: 38.88.248.236 192.168.254.10 Local 0.0.0.0 from 0.0.0.0 (198.180.150.121) Origin IGP, metric 0, weight 32768, valid, sourced, local, best (Weight) Last update: Thu Sep 12 21:44:49 2024 Local 192.168.254.10 (metric 11) from 192.168.254.10 (192.168.254.10) Origin IGP, localpref 100, valid, internal Last update: Thu Sep 12 22:13:15 2024 r1# show bgp 2001:418:8006::/48 BGP routing table entry for 2001:418:8006::/48, version 1 Paths: (1 available, best #1, table default) Advertised to non peer-group peers: fc00::10 Local :: from :: (198.180.150.121) Origin IGP, metric 0, weight 32768, valid, sourced, local, best (First path received) Last update: Thu Sep 12 21:44:50 2024 is it that 198.180.150.0/25 is heard via is-is and ibgp and 2001:418:8006::/64 is not? and for sure 174 is hearing the announcement of the 198.180.150.0/24. from route-views BGP routing table entry for 198.180.150.0/24, version 322874892 Paths: (19 available, best #18, table default) Not advertised to any peer Refresh Epoch 1 3257 174 3927 randy

2 2

The feature request that are closed - where to go?
by Konstantin Shalygin 02 Sep '24

02 Sep '24

Hi list, I created a request [1], waited 5 years, then it was closed, but nothing was done. Is there possible don't do that? Because is still actually for us. The current PBR implementation is very limited and woks only for input packets on interface. It may be a secret for some, but the network connections of the Linux host itself are created without an interface. This means that even if you hang the policy on the interface lo - the rule will not work Sep 02 17:46:51 example.com kernel: LINUX OUTPUT IS: IN= OUT=vlan999 SRC=109.202.2.222 DST=1.1.1.1 LEN=73 TOS=0x00 PREC=0x00 TTL=64 ID=13835 PROTO=UDP SPT=41942 DPT=53 LEN=53 UID=973 GID=973 MARK=0xd3 For example: ! interface lo pbr-policy sample exit ! nexthop-group sample nexthop 10.9.0.1 tap0 weight 50 nexthop 10.10.0.1 tap1 weight 50 exit ! pbr-map sample seq 5 match mark 211 set nexthop-group sample exit Thats produces rule: from all fwmark 0xd3 iif lo lookup 10000 proto zebra How-to make this rule actually work * make ability for FRR to omit the iif field (for example, via pbr (pbr-global?) without interface or with special sub-command) * allow to set table_id or prio in pbr-map (for 3rd-party workarounds): * set nexthop-group sample table_id 10 (10010, for the 'pbr table range') * with fixed table_id number we can add the ip rule via custom script (the same rule as FRR created, without iif filed) * allow to set prio filed for the rule in pbr-map (for 3rd-party workarounds): * set nexthop-group sample prio 10010 * this produces: from all fwmark 0xd3 iif lo lookup 10000 prio 10010 proto zebra * now possible to add custom script with rule 'from all fwmark 0xd3 goto 10010' From my point of view, it looks like a very simple fix can significantly expand the capabilities of FRR for the PBR functions Thanks, k [1] https://github.com/FRRouting/frr/issues/3242

2 1

IS-IS on libvirt
by Randy Bush 22 Aug '24

22 Aug '24

among our test environments, we have a libvirt setup. we're having some un-fun with IS-IS interoperation, and trying to isolate the issue. to complicate things, the libvirt has jumbogram veths. the same devices work with real hardwarem, though with 1500 MTUs. anyone been in the libvirt/IS-IS space and have some clues? randy

1 0

new config
by Randy Bush 13 Aug '24

13 Aug '24

i manage/generate router configs centrally and push/expect them out to devices. first time sorting how to do this with frr. my mental model would be to rsync a new `/etc/frr/frr.conf` to the target and ask it to be loaded in some way. but reading the page on `frr-reload.py`, that does not seem to be the expected model. so what is the expected model? do i essentially push to new config to, e.g. `/etc/frr/frr.new` and then run `frr-reload.py --reload /etc/frr/frr.new`, and it will update `/etc/frr/frr.conf`? thanks for clue. randy

2 3

SONiC SRv6 L3VPN
by Hong 1. Zhu (NSB) 10 Aug '24

10 Aug '24

Hello the community, I’m trying to set up a demo of SONiC SRv6 L3VPN with SONiC VMs. I cannot succeed in the final step that is the L3VPN ping tests. I’m writing this email to seek helps. Could you please share your experience if you have built such a demo before? Many thanks in advance. Best regards, Hong Zhu NSB NI Services Care Delivery IP Mobile:+8613808061997 Serving * Driving * Collaborating [cid:image001.png@01DAEAF8.9C03E1A0] 重要提示：本邮件及其附件可能包含受法律保护或限制的信息，或包含Nokia及NSB的机密或重要信息。使用，复制，传播或披露本邮件及其附件中的信息，需要符合双方保密协议的要求。未经授权的上述操作是被严格禁止的。如果您错误地收到此邮件，请立即通知发件人，并将此邮件及其所有副本从您的系统中永久删除。 Important Reminder: This email and its attachments may contain information protected or restricted by law, or contain confidential or important information of Nokia and NSB. The use, reproduction, dissemination or disclosure of the information contained in this email and its attachments is subject to the confidentiality agreement between the parties. Unauthorized operations are strictly prohibited. If you receive this message in error, please notify the sender immediately and permanently delete this message and all copies thereof from your system.

1 1

FRR Release 10.1
by Jafar Al-Gharaibeh 08 Aug '24

08 Aug '24

Dear FRR Community, We are pleased to announce FRR release 10.1. Release notes are available at: https://frrouting.org/release https://github.com/FRRouting/frr/releases Please let us know if you see any issues. Cheers, The FRR Development Team!

1 0

setcommunity clue
by Randy Bush 01 Aug '24

01 Aug '24

it's late and i am correspondingly stupid bgp community-list standard comm-cust4 permit 3970:384 bgp community-list standard comm-cust6 permit 3970:386 bgp community-list standard comm-trans4 permit 3970:394 bgp community-list standard comm-trans6 permit 3970:396 bgp community-list standard comm-bbte permit 3970:174 ! ... ! route-map transit-in4 permit 10 set community comm-trans4 ! route-map transit-in6 permit 10 set community comm-trans6 ! route-map cust-in4 permit 10 set community comm-cust4 ! route-map cust-in6 permit 10 set community comm-cust6 results in % Malformed communities attribute 'comm-trans4' line 56: Failure to communicate[13] to bgpd, line: set community comm-trans4 % Malformed communities attribute 'comm-trans6' line 59: Failure to communicate[13] to bgpd, line: set community comm-trans6 % Malformed communities attribute 'comm-cust4' line 62: Failure to communicate[13] to bgpd, line: set community comm-cust4 % Malformed communities attribute 'comm-cust6' line 65: Failure to communicate[13] to bgpd, line: set community comm-cust6 those diagnstics are on the route-map set stanzas clue bat please randy

4 5