- frog - lists.frrouting.org

Fwd: Help: how to enable RPKI in FRR 5?
by Paco Moreno 17 Jul '18

17 Jul '18

My bad, I forgot to send the response to the list. Also I've seen that in my first mail I misplaced the RPM link. The RPM that I've installed is the same that Martin has said https://github.com/FRRouting/frr/releases/download/frr-5.0.1/frr-5.0.1RPKI-… . ---------- Forwarded message --------- From: Paco Moreno <pc.moreno2099(a)gmail.com> Date: mar., 17 jul. 2018 a las 9:46 Subject: Re: [FROG] Help: how to enable RPKI in FRR 5? To: Martin Winter <mwinter(a)opensourcerouting.org> Hi Martin, thanks for your reply. I do have the RTRlib already, just as you have mentioned here and as is stated at the docs. Also, I've installed the FRR wtih RPKI package; and also I've tried by making the RPM package "manually", including the option "--enable-rpki" (the code that I've downloaded is from the branch master). Just to add more information of the problem, actually (and this is odd) the rpki commands do appear at the vtysh console as available commands: vtysh# find rpki (enable) rpki start (enable) rpki stop (enable) show rpki cache-connection (enable) show rpki cache-server (enable) show rpki prefix-table (config) rpki (config) debug rpki .... But they don't appear at the bgp daemon console whenever I connect via "telnet localhost 2605" and run the same command bgp# find rpki So, what else do you think that might be the problem? I really appreciate your help. Best regards, Francisco Moreno El mar., 17 jul. 2018 a las 9:12, Martin Winter (< mwinter(a)opensourcerouting.org>) escribió: > Paco, > > for RPKI, you need to download the RPKI version of FRR and install the > additional RTRLIB package as well. > > As described on the Github release page: > “For some platforms we publish RPKI enabled packages. Please be aware that > you will need > the RTRLIB package installed as well for the RPKI packages. You can find > the RTRLIB packages > on the NetDEF CI system in the RTRLIB project” > > So in your case (CentOS 7), you would download the FRR with RPKI package: > > https://github.com/FRRouting/frr/releases/download/frr-5.0.1/frr-5.0.1RPKI-… > > and the RTRLIB from > > https://ci1.netdef.org/artifact/RPKI-RTRLIB/shared/build-38/CentOS-7-x86_64… > > Install the RTRLIB first, then the FRR package > > We decided to distribute an extra package as the RTRLIB doesn’t have > official package in the > various distributions (i.e. CentOS 7) and requires a manual install. Tried > to avoid this extra > step for the majority who doesn’t need or want RPKI. > > Regards, > Martin Winter > > On 16 Jul 2018, at 16:01, Paco Moreno wrote: > > Hi there, > > I've been trying to configure FRR 5.0.1 (downloaded from Github releases > https://github.com/FRRouting/frr/releases/download/frr-5.0.1/frr-5.0.1-2018…) > and also 5.1 (manually built as RPM from master branch) to use RPKI. Both > cases in CentOS 7; there's no problem compiling nor executing the service > with the zebra and bgpd daemons active. But when I try to use the rpki > configuration (http://docs.frrouting.org/en/latest/bgp.html#enabling-rpki) > this is not recognized by the application. > > For example, if I place the conf at the bgpd.conf file like the example ( > http://docs.frrouting.org/en/latest/bgp.html#rpki-configuration-example) > nothing happens since the configuration seems to be unrecognized. After > that, I've tried to configure the rpki from the terminal (using "vtysh" or > by "telnet"), like this (multiple forms, probably a little desperate): > bgp# rpki > % [BGP] Unknown command: rpki > bgp# conf term > bgp(config)# rpki > % [BGP] Unknown command: rpki > bgp(config)# router bgp 1 > bgp(config-router)# rpki > % [BGP] Unknown command: rpki > > I don't know if I'm missing something or what to do, could somebody here > help me with this please? > > Best regards, > Francisco Moreno > > _______________________________________________ > frog mailing list > frog(a)lists.frrouting.org > https://lists.frrouting.org/listinfo/frog > >

3 6

Help: how to enable RPKI in FRR 5?
by Paco Moreno 17 Jul '18

17 Jul '18

Hi there, I've been trying to configure FRR 5.0.1 (downloaded from Github releases https://github.com/FRRouting/frr/releases/download/frr-5.0.1/frr-5.0.1-2018…) and also 5.1 (manually built as RPM from master branch) to use RPKI. Both cases in CentOS 7; there's no problem compiling nor executing the service with the zebra and bgpd daemons active. But when I try to use the rpki configuration (http://docs.frrouting.org/en/latest/bgp.html#enabling-rpki) this is not recognized by the application. For example, if I place the conf at the bgpd.conf file like the example ( http://docs.frrouting.org/en/latest/bgp.html#rpki-configuration-example) nothing happens since the configuration seems to be unrecognized. After that, I've tried to configure the rpki from the terminal (using "vtysh" or by "telnet"), like this (multiple forms, probably a little desperate): bgp# rpki % [BGP] Unknown command: rpki bgp# conf term bgp(config)# rpki % [BGP] Unknown command: rpki bgp(config)# router bgp 1 bgp(config-router)# rpki % [BGP] Unknown command: rpki I don't know if I'm missing something or what to do, could somebody here help me with this please? Best regards, Francisco Moreno

3 2

6PE functionality support in FRR
by Thiruvazhiyan Lakshmanan 16 Jul '18

16 Jul '18

Hi, We are looking for using FRR in our VM for BGP 3107 functionality with 6PE support. Basically FRR should peer with peering router with ipv6-label-unicast family and advertise its v6 loopback address with the label value of 2 (Explicit null label) and the next-hop of the route to be set to its v4 loopback address. Does FRR support this currently? Regards, Thiruvazhiyan L ============================================================================================================================ Disclaimer: This message and the information contained herein is proprietary and confidential and subject to the Tech Mahindra policy statement, you may review the policy at http://www.techmahindra.com/Disclaimer.html <http://www.techmahindra.com/Disclaimer.html> externally http://tim.techmahindra.com/tim/disclaimer.html <http://tim.techmahindra.com/tim/disclaimer.html> internally within TechMahindra. ============================================================================================================================

1 0

Please add me to the Slack channel
by Felipe Arturo Polanco 14 Jul '18

14 Jul '18

Hi, Could someone please add me to the slack channel? Thanks.

2 1

BGP state shows NoNeg for IPv4 LU neighbor
by Thiruvazhiyan Lakshmanan 12 Jul '18

12 Jul '18

Hi, I am trying to use FRR in my VM for BGP 3107 functionality. While configuring the BGP neighbor with address family "ipv4 labeled-unicast", the neighbor state shows NoNeg. But the peer side router shows established. I also noticed the routes are learnt in FRR from peer router and installed in the route table. But, I am trying to advertise my VM loopback to the LU neighbor, which is not happening. Can someone help me on this? Below is the VM details, root@ubuntu4-4-VM2:~# uname -r 4.16.18-041618-generic root@ubuntu4-4-VM2:~# lsb_release -a No LSB modules are available. Distributor ID: Ubuntu Description: Ubuntu 16.04.4 LTS Release: 16.04 Codename: xenial root@ubuntu4-4-VM2:~# FRR version: Total number of neighbors 1 ubuntu4-4-VM2# show version FRRouting 5.0 (ubuntu4-4-VM2). Copyright 1996-2005 Kunihiro Ishiguro, et al. configured with: '--build=x86_64-linux-gnu' '--prefix=/usr' '--includedir=${prefix}/include' '--mandir=${prefix}/share/man' '--infodir=${prefix}/share/info' '--sysconfdir=/etc' '--localstatedir=/var' '--disable-silent-rules' '--libexecdir=${prefix}/lib/frr' '--disable-maintainer-mode' '--disable-dependency-tracking' '--enable-exampledir=/usr/share/doc/frr/examples/' '--localstatedir=/var/run/frr' '--sbindir=/usr/lib/frr' '--sysconfdir=/etc/frr' '--disable-snmp' '--enable-ospfapi=yes' '--enable-multipath=256' '--enable-ldpd' '--disable-tcp-zebra' '--enable-fpm' '--enable-user=frr' '--enable-group=frr' '--enable-vty-group=frrvty' '--enable-configfile-mask=0640' '--enable-logfile-mask=0640' '--enable-werror' '--with-libpam' '--enable-systemd=yes' '--enable-poll=yes' '--enable-cumulus=no' '--enable-pimd' '--enable-dependency-tracking' '--enable-bgp-vnc=yes' '--disable-rpki' 'CFLAGS=-g -O2 -fPIE -fstack-protector-strong -Wformat -Werror=format-security' 'CPPFLAGS=-Wdate-time -D_FORTIFY_SOURCE=2' 'CXXFLAGS=-g -O2 -fPIE -fstack-protector-strong -Wformat -Werror=format-security' 'FCFLAGS=-g -O2 -fPIE -fstack-protector-strong' 'FFLAGS=-g -O2 -fPIE -fstack-protector-strong' 'GCJFLAGS=-g -O2 -fPIE -fstack-protector-strong' 'LDFLAGS=-Wl,-Bsymbolic-functions -fPIE -pie -Wl,-z,relro -Wl,-z,now' 'OBJCFLAGS=-g -O2 -fPIE -fstack-protector-strong -Wformat -Werror=format-security' 'OBJCXXFLAGS=-g -O2 -fPIE -fstack-protector-strong -Wformat -Werror=format-security' 'build_alias=x86_64-linux-gnu' ubuntu4-4-VM2# FRR configuration, ubuntu4-4-VM2# sh running-config Building configuration... Current configuration: ! frr version 5.0 frr defaults traditional hostname ubuntu4-4-VM2 log syslog informational no ip forwarding no ipv6 forwarding service integrated-vtysh-config username cumulus nopassword ! interface lo ip address 10.10.100.11/32 label lo:10 ! router bgp 7018 neighbor 10.10.101.1 remote-as 7018 ! address-family ipv4 unicast network 10.0.0.0/8 label-index 3 no neighbor 10.10.101.1 activate exit-address-family ! address-family ipv4 labeled-unicast neighbor 10.10.101.1 activate neighbor 10.10.101.1 next-hop-self neighbor 10.10.101.1 route-map ADV_Lo10 out exit-address-family ! route-map ADV_Lo10 permit 10 match ip address 10.10.100.11/32 match source-protocol connected ! line vty ! end ubuntu4-4-VM2# sh ip bg sum IPv4 Labeled Unicast Summary: BGP router identifier 10.10.100.11, local AS number 7018 vrf-id 0 BGP table version 0 RIB entries 0, using 0 bytes of memory Peers 1, using 20 KiB of memory Neighbor V AS MsgRcvd MsgSent TblVer InQ OutQ Up/Down State/PfxRcd 10.10.101.1 4 7018 9337 8553 0 0 0 2d23h15m NoNeg Total number of neighbors 1 ubuntu4-4-VM2# ubuntu4-4-VM2# show ip bgp ipv4 labeled-unicast neighbors 10.10.101.1 advertised-routes % No such neighbor or address family ubuntu4-4-VM2# show ip bgp ipv4 labeled-unicast neighbors 10.10.101.1 received-routes % No such neighbor or address family ubuntu4-4-VM2# Displayed 26 routes and 26 total paths ubuntu4-4-VM2# sh ip route Codes: K - kernel route, C - connected, S - static, R - RIP, O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP, T - Table, v - VNC, V - VNC-Direct, A - Babel, D - SHARP, F - PBR, > - selected route, * - FIB route K>* 0.0.0.0/0 [0/0] via 135.21.13.161, ens3, 2d23h58m B>* 10.10.100.1/32 [200/0] via 10.10.101.1, bond0.11, label 306384, 2d23h58m B>* 10.10.100.10/32 [200/0] via 10.10.101.1, bond0.11, label 306416, 2d23h58m C>* 10.10.100.11/32 is directly connected, lo, 2d23h58m C>* 10.10.101.0/30 is directly connected, bond0.11, 2d23h58m C>* 10.10.101.32/30 is directly connected, bond0.12, 2d23h58m B>* 10.10.101.36/30 [200/0] via 10.10.101.1, bond0.11, label 306432, 2d23h58m B>* 10.10.101.40/30 [200/0] via 10.10.101.1, bond0.11, label 306368, 2d23h58m B>* 10.10.252.1/32 [200/0] via 10.10.101.1, bond0.11, label 306048, 2d23h58m B>* 10.10.252.2/32 [200/0] via 10.10.101.1, bond0.11, label 306064, 2d23h58m Regards, Thiruvazhiyan L ============================================================================================================================ Disclaimer: This message and the information contained herein is proprietary and confidential and subject to the Tech Mahindra policy statement, you may review the policy at http://www.techmahindra.com/Disclaimer.html <http://www.techmahindra.com/Disclaimer.html> externally http://tim.techmahindra.com/tim/disclaimer.html <http://tim.techmahindra.com/tim/disclaimer.html> internally within TechMahindra. ============================================================================================================================

3 9

EVPN advertise static ARP entry
by Felipe Arturo Polanco 12 Jul '18

12 Jul '18

Hello, Is there a way to make static ARP entries being advertised over EVPN? I have added an static entry in my BGP EVPN speaker but somehow that entry is not being advertised in the EVPN network. Any help is very welcome. Thanks,

2 2

Originating Default EVPN Type-5 Routes with frr
by Martin Mailand 12 Jul '18

12 Jul '18

Hello, I am playing around with FRR and EVPN. My setup is very simple, I have two virtual machines running Linux, which are connected back to back and are called border leaf and normal leaf. I have compiled FRR from git head with the option --enable-cumulus. Type 2,3,5 routes are working in a symmetric routing environment. Now I want to inject a default route from the border leaf, which should be a type 5 route and it should be written down to the vrf of the normal leaf. But the documentation is a bit sparse, according to the cumulus docs it should go into the vrf part of the bgp configuration: —snip— switch(config)# router bgp 650030 vrf vrf1 switch(config-router)# address-family l2vpn evpn switch(config-router-af)# default-originate ipv4 switch(config-router-af)# default-originate ipv6 switch(config-router-af)# exit switch(config-router)# exit switch(config)# exit switch# write memory —snap— source: https://docs.cumulusnetworks.com/display/DOCS/Ethernet+Virtual+Private+Netw… But with this configuration I do not see any default type 5 routes in the RIB. If I put the statements "default-originate ipv(4|6)“ into the main bgp section I get routes in the RIB. But I do not know how to read the RD (as2 0:0) And the two default routes are not in the VRF FIB either. Border leaf RIB: show bgp l2vpn evpn Route Distinguisher: as2 0:0 *> [5]:[0]:[0]:[0.0.0.0] 0.0.0.0 32768 i *> [5]:[0]:[0]:[::] 0.0.0.0 32768 i Normal leaf RIB: Route Distinguisher: as2 0:0 *>i[5]:[0]:[0]:[0.0.0.0] 192.168.0.3 100 0 i *>i[5]:[0]:[0]:[::] 192.168.0.3 100 0 i Any hint would be appreciated to get it up and running. Thanks for your time. Best regards, martin Here the two configs. border leaf: vrf vrf1 vni 8000 ! # VRF1 router bgp 1234 vrf vrf1 ! bgp router-id 192.168.10.3 ! address-family ipv4 unicast redistribute connected exit-address-family ! address-family ipv6 unicast redistribute connected exit-address-family ! address-family l2vpn evpn advertise ipv4 unicast advertise ipv6 unicast # should be here according to the cumulus docs # default-originate ipv4 # default-originate ipv6 exit-address-family ! ## Global router bgp 1234 bgp router-id 192.168.10.3 neighbor 192.168.0.4 remote-as 1234 #redistribute connected route-map loopbacks network 192.168.10.3/32 ! address-family l2vpn evpn neighbor 192.168.0.4 activate advertise-all-vni default-originate ipv4 default-originate ipv6 exit-address-family ! route-map loopbacks permit 10 match interface lo ! Normal leaf: vrf vrf1 vni 8000 ! # VRF1 router bgp 1234 vrf vrf1 ! bgp router-id 192.168.10.4 ! address-family ipv4 unicast redistribute connected exit-address-family ! address-family ipv6 unicast redistribute connected exit-address-family ! address-family l2vpn evpn advertise ipv4 unicast advertise ipv6 unicast exit-address-family ! # Global router bgp 1234 bgp router-id 192.168.10.4 neighbor 192.168.0.3 remote-as 1234 # redistribute connected route-map loopback network 192.168.10.4/32 ! address-family l2vpn evpn neighbor 192.168.0.3 activate advertise-all-vni exit-address-family ! route-map loopbacks permit 10 match interface lo !

2 2

Monitoring BGP Sessios with FRR
by Junior Corazza 12 Jul '18

12 Jul '18

Hi, Someone was able to monitor the BGP sessions of the FRR with Zabbix / Observium If so, how did they do it?

2 1

question
by Daniel Guerri 03 Jul '18

03 Jul '18

Can somebody help me to install FRR on a Ubuntu Server. Has somebody a step by step to do it? Best regards Daniel

3 2

Filter connected routes from being learned ?
by Brandon Applegate 29 Jun '18

29 Jun '18

Hello, I am trying to prevent FRR from picking up a route - let’s call it “mgmt”. These are Ubuntu 16.04 hosts, so I’m using /etc/network/interfaces. I’m using some manual post-up commands to take one of my NICs and put it into the “mgmt” table (already added to /etc/iproute2/rt_tables). This is working as intended. The issue is that FRR is still picking this up as a connected route. I don’t know enough about the innards of FRR, but I’m guessing it’s picking it up from the interface structure in the kernel - as my route table commands have expunged it from the global/default table. So on with my real question - is there a way I can filter this ? I had thought/hoped it would be this: http://docs.frrouting.org/en/latest/zebra.html#zebra-route-filtering Either that doesn’t do what I had hoped - or I’m configuring it wrong. My thought process was to make a PL with a permit matching my mgmt route (10.255.0.0/16) - and a route-map with a deny matching on the PL. Then I would ‘ip protocol connected route-map DENY-MGMT’. I’ve tried this, and restarted FRR, but no matter what - this route keeps finding it’s way back in as “connected”. Any pointers would be greatly appreciated. Thanks. -- Brandon Applegate - CCIE 10273 PGP Key fingerprint: 0641 D285 A36F 533A 73E5 2541 4920 533C C616 703A "For thousands of years men dreamed of pacts with demons. Only now are such things possible."

2 4