- frog - lists.frrouting.org

how to control the metric of routes created by frr?
by Anton Gubar'kov 19 Jan '25

19 Jan '25

Dear fellows, I have trouble finding the particular way of increasing the metric of routes created by frr as a result of the running OSPF. My network is built as follows: The virtual backbone is zerotier 10.243/16. Edge routers are connected to it. Also my laptop is connected to the zerotier backbone (via LTE modem) and runs FRR. Routers run Mikrotik RouterOS and I use OSPF to propagate the routes to 192.168 networks to my Laptop1. 10.243/16: router1 -------- router2 ------- Laptop1 | | | | | | | | 192.168.201/24 192.168.210/24 Everything works fine until I connect my laptop to one of the 192.168 networks via Wifi. 10.243/16: router1 -------- router2 ------- Laptop1 | | | | | | | | | | | | 192.168.201/24 192.168.210/24-----+ By default the metric of the route of the connected Wifi adapter is 600, while the routes that are created by frr have a metric of 20. anton@PF16W6Y2 ~ $ route Kernel IP routing table Destination Gateway Genmask Flags Metric Ref Use Iface default router 0.0.0.0 UG 600 0 0 wlan0 10.0.85.2 0.0.0.0 255.255.255.255 UH 0 0 0 outline-tun0 10.243.0.0 0.0.0.0 255.255.0.0 U 0 0 0 ztzlge64hc 192.168.122.0 0.0.0.0 255.255.255.0 U 0 0 0 virbr0 192.168.201.0 PERV1CAP1.vpn 255.255.255.0 UG 20 0 0 ztzlge64hc 192.168.210.0 0.0.0.0 255.255.255.0 U 600 0 0 wlan0 192.168.210.0 SOV1.vpn 255.255.255.0 UG 20 0 0 ztzlge64hc So when I start to pour a lot of data from my laptop to one of the directly connected servers at 192.168.210/24, the traffic goes to zerotier interface first, then to router2 and decrypted there and only after that reaches the server. The CPU util of the router2 jumps to 100% and the speed goes down. Is there a way to increase the metric of routes via ztzlge64hc interface that are created by frr? Zerotier client doesn't offer to configure the metric of its interface and sets it to 0 always. There is a 5-year old feature request to them for this... The frr config I have is trivial: ! frr version 10.1.1-gentoo frr defaults traditional hostname PF16W6Y2 log file /var/log/frr/ospfd.log log syslog informational no ipv6 forwarding service integrated-vtysh-config ! interface ztzlge64hc ip ospf area 10.243.0.0 10.243.169.159 ip ospf cost 1500 exit ! router ospf ospf router-id 10.243.169.159 log-adjacency-changes exit ! end As you can see I tried to increase the cost of the ztzlge64hc interface and it is correctly reflected in the OSPF routes: PF16W6Y2# show ip ospf route ============ OSPF network routing table ============ N 10.243.0.0/16 [1500] area: 10.243.0.0 directly attached to ztzlge64hc N 192.168.201.0/24 [1501] area: 10.243.0.0 via 10.243.130.110, ztzlge64hc N 192.168.210.0/24 [2500] area: 10.243.0.0 via 10.243.86.42, ztzlge64hc ============ OSPF router routing table ============= R 192.168.201.2 [1500] area: 10.243.0.0, ASBR via 10.243.130.110, ztzlge64hc ============ OSPF external routing table =========== It doesn't affect the kernel route metrics however... Thanks for pointing me to the right direction.

1 0

Stop testing and updates for CentOS 7 / RedHat 7
by Martin Winter 09 Jan '25

09 Jan '25

Hi there, I'm planning to stop releasing any new CentOS 7 / RedHat 7 packages and stop the testing for it. - No more CI tests on CentOS 7 - No new packages for CentOS 7 / RedHat 7 (not even minor updates or security fixes) CentOS 7 is EoL for some time. So far, we still used it for build Redhat 7 / CentOS 7 packages, but there is now the time where repositories get removed or moved. As such, I think the work to maintain this in the CI Infrastructure and Release Build is too much and I'm considering abandoning it. This does NOT impact RedHat 8 or RedHat 9. Please reply if this causes any issues to you or have any other reasons why this should be reconsidered. Regards, Martin Winter

1 0

RPKI process efficiency
by Darshan Kowlaser 25 Nov '24

25 Nov '24

Hello I'm experiencing high CPU usage on my RPKI process which is very odd. To elaborate, I have two vyos boxes that have similar configuration for the edge just handling BGP and OSPF to the core. On one of the routers I have excessively high CPU usage and when checking the processes RPKI sits very high compared to the other router. FRR Version: `*FRRouting 9.1.1 (za-ct-ter-dc-rt-edge-01) on Linux(6.6.43-amd64-vyos).* *Copyright 1996-2005 Kunihiro Ishiguro, et al.configured with: '--build=x86_64-linux-gnu' '--prefix=/usr' '--includedir=${prefix}/include' '--mandir=${prefix}/share/man' '--infodir=${prefix}/share/info' '--sysconfdir=/etc' '--localstatedir=/var' '--disable-option-checking' '--disable-silent-rules' '--libdir=${prefix}/lib/x86_64-linux-gnu' '--libexecdir=${prefix}/lib/x86_64-linux-gnu' '--disable-maintainer-mode' '--localstatedir=/var/run/frr' '--sbindir=/usr/lib/frr' '--sysconfdir=/etc/frr' '--with-vtysh-pager=/usr/bin/pager' '--libdir=/usr/lib/x86_64-linux-gnu/frr' '--with-moduledir=/usr/lib/x86_64-linux-gnu/frr/modules' '--disable-dependency-tracking' '--enable-rpki' '--enable-scripting' '--enable-pim6d' '--with-libpam' '--enable-doc' '--enable-doc-html' '--enable-snmp' '--enable-fpm' '--disable-protobuf' '--disable-zeromq' '--enable-ospfapi' '--enable-bgp-vnc' '--enable-multipath=256' '--enable-user=frr' '--enable-group=frr' '--enable-vty-group=frrvty' '--enable-configfile-mask=0640' '--enable-logfile-mask=0640' 'build_alias=x86_64-linux-gnu' 'PYTHON=python3'* ` Here is my RPKI configuration on the router experiencing high process CPU usage : In Vtysh: `*rpki* * rpki cache cpt-rpki-validator-01.example.xyz <http://cpt-rpki-validator-01.example.xyz> 3323 preference 1 rpki cache cpt-rpki-validator-02.example.xyz <http://cpt-rpki-validator-02.example.xyz> 8282 preference 2* ` In VyOS: `*set protocols rpki cache cpt-rpki-validator-01.example.xyz <http://cpt-rpki-validator-01.example.xyz> port '3323'* * set protocols rpki cache cpt-rpki-validator-01.example.xyz <http://cpt-rpki-validator-01.example.xyz> preference '1' set protocols rpki cache cpt-rpki-validator-02.example.xyz <http://cpt-rpki-validator-02.example.xyz> port '8282' set protocols rpki cache cpt-rpki-validator-02.example.xyz <http://cpt-rpki-validator-02.example.xyz> preference '2'* * set protocols rpki polling-period '3600* ` The only thing different on the other box is that the server preference is inverted. RPKI servers are running routinator and stayRTR, the router with the issue preferences routinator. See below showing that it is the most intensive process on the CPU : [image: image.png] Would be greatly appreciated if anyone could advise.

1 0

FRR as EVPN route reflector
by Erwan David 27 Sep '24

27 Sep '24

Hello, I am using GNS3 FRR appliance (in case it is important), in my GNS3 setting (before going to production) I want to use frr as a route reflector for l2vpn evpn address family. My setting is router bgp 65000 bgp router-id 10.102.33.1 bgp log-neighbor-changes no bgp default ipv4-unicast bgp cluster-id 10.102.33.1 neighbor boucle peer-group neighbor boucle remote-as 65000 neighbor boucle update-source 10.102.33.1 neighbor boucle capability extended-nexthop bgp listen range 10.100.10.0/24 peer-group boucle ! address-family l2vpn evpn neighbor boucle activate neighbor boucle route-reflector-client exit-address-family exit My VTEPs (all in 10.100.10.0/24) establish a session with FRR and send their EVPN routes (types 2 and 3). However, FRR does not send the routes back to the clients What did I miss ? Should I check some kernel modules are present in the alpine linux on which frr runs ? -- Erwan David

1 1

GNS3 appliance with bonding ?
by Erwan David 19 Sep '24

19 Sep '24

Hello, I need to use a GNS3 appliance of FRR (and I cannit give it internet access) with bonding (LACP) on interfaces. The bonding package is not present in the appliance, what are my options ? -- Erwan David

1 0

ipv6 network statement
by Randy Bush 12 Sep '24

12 Sep '24

i assume i have a conf error, but can not see it no prefix is being advertised to ipv6 peer 2001:550:2:1::22 yet a similar template advertises one in v4 r1# show bgp summary IPv4 Unicast Summary: BGP router identifier 198.180.150.121, local AS number 3927 VRF default vrf-id 0 BGP table version 1201106 RIB entries 1736966, using 212 MiB of memory Peers 2, using 48 KiB of memory Neighbor V AS MsgRcvd MsgSent TblVer InQ OutQ Up/Down State/PfxRcd PfxSnt Desc 38.88.248.236 4 174 166936 99 1201106 0 0 01:36:00 940141 1 N/A 192.168.254.10 4 3927 121068 151229 1201106 0 0 01:18:23 634041 753625 N/A Total number of neighbors 2 IPv6 Unicast Summary: BGP router identifier 198.180.150.121, local AS number 3927 VRF default vrf-id 0 BGP table version 304315 RIB entries 381204, using 47 MiB of memory Peers 2, using 48 KiB of memory Neighbor V AS MsgRcvd MsgSent TblVer InQ OutQ Up/Down State/PfxRcd PfxSnt Desc 2001:550:2:1::22 4 174 66286 98 304315 0 0 01:35:55 192933 0 N/A fc00::10 4 3927 66566 55345 304315 0 0 01:28:16 153136 131291 N/A Total number of neighbors 2 and it admits it r1# show ip bgp neighbors 38.88.248.236 advertised-routes BGP table version is 1231961, local router ID is 198.180.150.121, vrf id 0 Default local pref 100, local AS 3927 Status codes: s suppressed, d damped, h history, u unsorted, * valid, > best, = multipath, i internal, r RIB-failure, S Stale, R Removed Nexthop codes: @NNN nexthop's vrf id, < announce-nh-self Origin codes: i - IGP, e - EGP, ? - incomplete RPKI validation codes: V valid, I invalid, N Not found Network Next Hop Metric LocPrf Weight Path *> 198.180.150.0/24 0.0.0.0 0 32768 i Total number of prefixes 1 vs r1# show bgp neighbors 2001:550:2:1::22 advertised-routes r1# [ aside: the cli asymmetry between ipv4 and ipv6 is unkind. ] config snippets ip prefix-list export4 seq 5 permit 198.180.150.0/24 ipv6 prefix-list export6 seq 5 permit 2001:418:8006::/48 ... address-family ipv4 unicast network 198.180.150.0/24 neighbor 38.88.248.236 activate neighbor 38.88.248.236 route-map accept-all in neighbor 38.88.248.236 route-map transit-out4 out neighbor 192.168.254.10 activate exit-address-family ! address-family ipv6 unicast network 2001:418:8006::/48 neighbor 2001:550:2:1::22 activate neighbor 2001:550:2:1::22 route-map accept-all in neighbor 2001:550:2:1::22 route-map transit-out6 out neighbor fc00::10 activate exit-address-family ... route-map transit-out4 permit 20 match ip address prefix-list export4 exit ... route-map transit-out6 permit 20 match ip address prefix-list export6 exit note that only the 2001:418:8006::/64 is on the LAN interface not the /48 r1# show ipv6 route 2001:418:8006::/64 Routing entry for 2001:418:8006::/64 Known via "connected", distance 0, metric 0, best Last update 01:52:13 ago * directly connected, eno3 r1# show ipv6 route 2001:418:8006::/48 % Network not in table similarly 198.180.150.0/24 is not on the LAN, it's a /25 LAN (don't ask) r1# show ip route 198.180.150.0/25 Routing entry for 198.180.150.0/25 Known via "isis", distance 115, metric 12 Last update 01:52:33 ago 198.180.150.120, via eno3 inactive, weight 1 Routing entry for 198.180.150.0/25 Known via "connected", distance 0, metric 0, best Last update 01:53:02 ago * directly connected, eno3 r1# show ip route 198.180.150.0/24 % Network not in table but it is in bgp r1# show ip bgp 198.180.150.0/24 BGP routing table entry for 198.180.150.0/24, version 1 Paths: (2 available, best #1, table default) Advertised to non peer-group peers: 38.88.248.236 192.168.254.10 Local 0.0.0.0 from 0.0.0.0 (198.180.150.121) Origin IGP, metric 0, weight 32768, valid, sourced, local, best (Weight) Last update: Thu Sep 12 21:44:49 2024 Local 192.168.254.10 (metric 11) from 192.168.254.10 (192.168.254.10) Origin IGP, localpref 100, valid, internal Last update: Thu Sep 12 22:13:15 2024 r1# show bgp 2001:418:8006::/48 BGP routing table entry for 2001:418:8006::/48, version 1 Paths: (1 available, best #1, table default) Advertised to non peer-group peers: fc00::10 Local :: from :: (198.180.150.121) Origin IGP, metric 0, weight 32768, valid, sourced, local, best (First path received) Last update: Thu Sep 12 21:44:50 2024 is it that 198.180.150.0/25 is heard via is-is and ibgp and 2001:418:8006::/64 is not? and for sure 174 is hearing the announcement of the 198.180.150.0/24. from route-views BGP routing table entry for 198.180.150.0/24, version 322874892 Paths: (19 available, best #18, table default) Not advertised to any peer Refresh Epoch 1 3257 174 3927 randy

2 2

The feature request that are closed - where to go?
by Konstantin Shalygin 02 Sep '24

02 Sep '24

Hi list, I created a request [1], waited 5 years, then it was closed, but nothing was done. Is there possible don't do that? Because is still actually for us. The current PBR implementation is very limited and woks only for input packets on interface. It may be a secret for some, but the network connections of the Linux host itself are created without an interface. This means that even if you hang the policy on the interface lo - the rule will not work Sep 02 17:46:51 example.com kernel: LINUX OUTPUT IS: IN= OUT=vlan999 SRC=109.202.2.222 DST=1.1.1.1 LEN=73 TOS=0x00 PREC=0x00 TTL=64 ID=13835 PROTO=UDP SPT=41942 DPT=53 LEN=53 UID=973 GID=973 MARK=0xd3 For example: ! interface lo pbr-policy sample exit ! nexthop-group sample nexthop 10.9.0.1 tap0 weight 50 nexthop 10.10.0.1 tap1 weight 50 exit ! pbr-map sample seq 5 match mark 211 set nexthop-group sample exit Thats produces rule: from all fwmark 0xd3 iif lo lookup 10000 proto zebra How-to make this rule actually work * make ability for FRR to omit the iif field (for example, via pbr (pbr-global?) without interface or with special sub-command) * allow to set table_id or prio in pbr-map (for 3rd-party workarounds): * set nexthop-group sample table_id 10 (10010, for the 'pbr table range') * with fixed table_id number we can add the ip rule via custom script (the same rule as FRR created, without iif filed) * allow to set prio filed for the rule in pbr-map (for 3rd-party workarounds): * set nexthop-group sample prio 10010 * this produces: from all fwmark 0xd3 iif lo lookup 10000 prio 10010 proto zebra * now possible to add custom script with rule 'from all fwmark 0xd3 goto 10010' From my point of view, it looks like a very simple fix can significantly expand the capabilities of FRR for the PBR functions Thanks, k [1] https://github.com/FRRouting/frr/issues/3242

2 1

IS-IS on libvirt
by Randy Bush 21 Aug '24

21 Aug '24

among our test environments, we have a libvirt setup. we're having some un-fun with IS-IS interoperation, and trying to isolate the issue. to complicate things, the libvirt has jumbogram veths. the same devices work with real hardwarem, though with 1500 MTUs. anyone been in the libvirt/IS-IS space and have some clues? randy

1 0

new config
by Randy Bush 12 Aug '24

12 Aug '24

i manage/generate router configs centrally and push/expect them out to devices. first time sorting how to do this with frr. my mental model would be to rsync a new `/etc/frr/frr.conf` to the target and ask it to be loaded in some way. but reading the page on `frr-reload.py`, that does not seem to be the expected model. so what is the expected model? do i essentially push to new config to, e.g. `/etc/frr/frr.new` and then run `frr-reload.py --reload /etc/frr/frr.new`, and it will update `/etc/frr/frr.conf`? thanks for clue. randy

2 3

SONiC SRv6 L3VPN
by Hong 1. Zhu (NSB) 09 Aug '24

09 Aug '24

Hello the community, I’m trying to set up a demo of SONiC SRv6 L3VPN with SONiC VMs. I cannot succeed in the final step that is the L3VPN ping tests. I’m writing this email to seek helps. Could you please share your experience if you have built such a demo before? Many thanks in advance. Best regards, Hong Zhu NSB NI Services Care Delivery IP Mobile:+8613808061997 Serving * Driving * Collaborating [cid:image001.png@01DAEAF8.9C03E1A0] 重要提示：本邮件及其附件可能包含受法律保护或限制的信息，或包含Nokia及NSB的机密或重要信息。使用，复制，传播或披露本邮件及其附件中的信息，需要符合双方保密协议的要求。未经授权的上述操作是被严格禁止的。如果您错误地收到此邮件，请立即通知发件人，并将此邮件及其所有副本从您的系统中永久删除。 Important Reminder: This email and its attachments may contain information protected or restricted by law, or contain confidential or important information of Nokia and NSB. The use, reproduction, dissemination or disclosure of the information contained in this email and its attachments is subject to the confidentiality agreement between the parties. Unauthorized operations are strictly prohibited. If you receive this message in error, please notify the sender immediately and permanently delete this message and all copies thereof from your system.

1 1