<div dir="auto"><a href="https://docs.frrouting.org/en/stable-9.1/bfd.html#clicmd-minimum-ttl-1-254" target="_blank" rel="noreferrer">https://docs.frrouting.org/en/stable-9.1/bfd.html#clicmd-minimum-ttl-1-254</a><div dir="auto"><br></div><div dir="auto">Reads frr 9.1 enforces a min ttl of 254 if not otherwise specified.</div><div dir="auto"><br></div><div dir="auto">VyOS 1.3 uses frr 8.5.1 afair.</div><div dir="auto"><br></div><div dir="auto"><a href="https://docs.frrouting.org/en/stable-8.5/bfd.html#clicmd-minimum-ttl-1-254">https://docs.frrouting.org/en/stable-8.5/bfd.html#clicmd-minimum-ttl-1-254</a></div><div dir="auto"><br></div><div dir="auto">You could opt for tweaking the min ttl on the frr side. Seams less intrusive, imo. 🤔</div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Sat, 20 Jan 2024, 17.59 Alexander Zubkov via Bird-users, <<a href="mailto:bird-users@network.cz" target="_blank" rel="noreferrer">bird-users@network.cz</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Hi Lukas,<br>
<br>
Actually I saw support for TTL security in BFD code:<br>
<a href="https://gitlab.nic.cz/labs/bird/-/blob/master/proto/bfd/packets.c#L496" rel="noreferrer noreferrer noreferrer" target="_blank">https://gitlab.nic.cz/labs/bird/-/blob/master/proto/bfd/packets.c#L496</a><br>
<br>
And I see in your config example that you use multihop BFD, but RFC<br>
you refer is talking about single-hop BFD usage. So it does not seem<br>
like a bug here. Maybe the other side does not consider this BFD<br>
sessions multihop and thus applying the TTL security policy?<br>
<br>
Regards,<br>
Alexander<br>
<br>
On Sat, Jan 20, 2024 at 11:18 AM Lukas Haase <<a href="mailto:lukashaase@gmx.at" rel="noreferrer noreferrer" target="_blank">lukashaase@gmx.at</a>> wrote:<br>
><br>
> Hi,<br>
><br>
> After long debugging I finally figured out why Bird's bfd cannot establish a session with FRR (VyOS): Packets are sent with TTL 64. However, according to <a href="https://datatracker.ietf.org/doc/rfc5881/" rel="noreferrer noreferrer noreferrer" target="_blank">https://datatracker.ietf.org/doc/rfc5881/</a>, Section 5: "If BFD authentication is not in use on a session, all BFD Control packets for the session MUST be sent with a Time to Live (TTL) or Hop Limit value of 255".<br>
><br>
> This is the reason why FRR just drops packets received from bird and the session never establishes.<br>
><br>
> As a quick workaround, I could get it working with:<br>
><br>
> sysctl -w net.ipv4.ip_default_ttl="255"<br>
><br>
> However, bird should set TTL appropriately.<br>
><br>
> Is this something that was missed or is there an setting I am missing?<br>
><br>
> Thanks,<br>
> Luke<br>
><br>
><br>
><br>
><br>
><br>
> > Gesendet: Mittwoch, 17. Januar 2024 um 01:24 Uhr<br>
> > Von: "Lukas Haase via Bird-users" <<a href="mailto:bird-users@network.cz" rel="noreferrer noreferrer" target="_blank">bird-users@network.cz</a>><br>
> > An: "Alexander Zubkov" <<a href="mailto:green@qrator.net" rel="noreferrer noreferrer" target="_blank">green@qrator.net</a>><br>
> > Cc: <a href="mailto:bird-users@network.cz" rel="noreferrer noreferrer" target="_blank">bird-users@network.cz</a><br>
> > Betreff: Re: BFD sessions with FFR (VyOS) won't establish<br>
> ><br>
> > Hi Alexander,<br>
> ><br>
> > Thanks. I have tried<br>
> ><br>
> > sysctl -w net.ipv4.ip_local_port_range="49152 65535"<br>
> ><br>
> > but unfortunately no change.<br>
> > What I do not understand is that Interval and Timeout is wrong on the non-working peer:<br>
> ><br>
> > # birdc show bfd sess<br>
> > BIRD 2.0.8 ready.<br>
> > bfd1:<br>
> > IP address Interface State Since Interval Timeout<br>
> > 172.20.215.130 --- Up 2024-01-16 0.100 0.500<br>
> > 172.20.215.131 --- Init 2024-01-16 1.000 10.000<br>
> ><br>
> > Do these parameters need to be identical among peers, similar as with OSPF? Note, they are identical to my knowledge but could there be any implicit setting that causes discrepancy between the peers and would cause a connection being stuck in "Up"? For example, in bird I have "idle tx interval 500 ms" but I could not find a corresponding option in VyOS/FFR.<br>
> ><br>
> > Could you think of any tcpdump/netcat debug?<br>
> ><br>
> > Thanks,<br>
> > Luke<br>
> ><br>
> ><br>
> ><br>
> > > Gesendet: Mittwoch, 17. Januar 2024 um 00:35 Uhr<br>
> > > Von: "Alexander Zubkov" <<a href="mailto:green@qrator.net" rel="noreferrer noreferrer" target="_blank">green@qrator.net</a>><br>
> > > An: "Lukas Haase" <<a href="mailto:lukashaase@gmx.at" rel="noreferrer noreferrer" target="_blank">lukashaase@gmx.at</a>><br>
> > > Cc: <a href="mailto:bird-users@network.cz" rel="noreferrer noreferrer" target="_blank">bird-users@network.cz</a><br>
> > > Betreff: Re: BFD sessions with FFR (VyOS) won't establish<br>
> > ><br>
> > > Hi,<br>
> > ><br>
> > > There were reports here in the list that some BFD peers do not allow<br>
> > > connections from non-standard ports and bird do not choose source port<br>
> > > specifically. So you might need to tune your sysctl like that:<br>
> > ><br>
> > > net.ipv4.ip_local_port_range = 49152 65535<br>
> > ><br>
> > > Not sure if this is the case, but I would try that first.<br>
> > ><br>
> > > Regards,<br>
> > > Alexander<br>
> > ><br>
> > > On Tue, Jan 16, 2024 at 9:15 AM Lukas Haase via Bird-users<br>
> > > <<a href="mailto:bird-users@network.cz" rel="noreferrer noreferrer" target="_blank">bird-users@network.cz</a>> wrote:<br>
> > > ><br>
> > > > Hello,<br>
> > > ><br>
> > > > My BFD session between bird work fine but the ones but the ones to VyOS (which uses FFR) just won't connect:<br>
> > > ><br>
> > > > # birdc show bfd sess<br>
> > > > BIRD 2.0.8 ready.<br>
> > > > bfd1:<br>
> > > > IP address Interface State Since Interval Timeout<br>
> > > > 172.20.215.131 --- Init 10:39:14.183 1.000 10.000<br>
> > > > 172.20.215.130 --- Up 10:42:03.901 0.100 0.500<br>
> > > ><br>
> > > > 172.20.215.131 is here a VyOS box and its FFR config looks like:<br>
> > > ><br>
> > > > !<br>
> > > > bfd<br>
> > > > peer 172.20.215.129 multihop local-address 172.20.215.131<br>
> > > > detect-multiplier 10<br>
> > > > transmit-interval 100<br>
> > > > receive-interval 100<br>
> > > > exit<br>
> > > > !<br>
> > > > exit<br>
> > > > !<br>
> > > > end<br>
> > > ><br>
> > > ><br>
> > > > For reference, my bird config is trivially:<br>
> > > ><br>
> > > > protocol bfd<br>
> > > > {<br>
> > > > interface "local-ibgp" {<br>
> > > > min rx interval 100 ms;<br>
> > > > min tx interval 100 ms;<br>
> > > > idle tx interval 500 ms;<br>
> > > > multiplier 10;<br>
> > > > };<br>
> > > > neighbor 172.20.215.130 local 172.20.215.129 multihop;<br>
> > > > neighbor 172.20.215.131 local 172.20.215.129 multihop;<br>
> > > > }<br>
> > > ><br>
> > > ><br>
> > > > I have turned off firewall. What else could go wrong?<br>
> > > ><br>
> > > ><br>
> > > > Thanks,<br>
> > > > Luke<br>
> > ><br>
> ><br>
> ><br>
<br>
</blockquote></div>