September 2017 - Bird-users

Adding more then one bgp community at once
by Борис Коваленко 05 May '23

05 May '23

Hello! Is this possible to add many communites at once? bgp_community.add([(1,1), (1,2)]) is wrong "Setting clist attribute to non-clist value" Regards, Boris -- С уважением, Борис Коваленко

4 5

manipulating the best path, eBGP, MED?
by Thomas＠PhaseHosting 14 Apr '18

14 Apr '18

Supp, I implemented bird in our Private cloud running proxmox to distribute our public address with eBGP to our serverhost. Through iBGP and a ucarp interface i have a HA gateway, the problem is that our host receives the routes but there are multiple entry points to our subnet ( the proxmox hosts). This makes that a diffrent in & out route doenst work. through following link: https://supportforums.cisco.com/document/126691/understanding-bgp-best-path… I learned that my hosts selects its route based on age ( the bird with the first connection is chosen). Can i send a multi-exit discriminator with my eBGP connection to my host? I googled but could find 2 answers that did't change anything: # your default gateway IP below here protocol bgp eBGP { import none; export where proto = "static_packet"; local as 65000; neighbor 10.80.x.x as 65530; password "SECRET"; #med metric 10; #default bgp_med 10; } (offcourse i tried both without # and waited till export) Or is there an other way to make sure that our host routes always to the first server and so on. -- Thomas Valgaeren thomas(a)phasehosting.io +32477915307

6 8

RE: Bird redundant routers with same AS on same location and prefix delegation to lower router
by Gelderman, Richard 26 Oct '17

26 Oct '17

Hi Andrew, As I am new to Bird I can not find a good example how to create a RR cluster with two routers R1 + R2. Do you have experience with a RR cluster with multiple routers? My biggest question is acquily how to config the sessions between R1 + R2 as clustermembers without creating a loop. Regards, Richard Van: Andrew [mailto:nitr0@seti.kr.ua] Verzonden: donderdag 7 september 2017 16:55 Aan: Gelderman, Richard <r.gelderman(a)rtvoost.nl> Onderwerp: Re: Bird redundant routers with same AS on same location and prefix delegation to lower router You may redistribute all routes between R1 and R2 using RR (both received from R3 and received from uplinks), and redistribute just default to R3 using separate table (with static default and routes peering to main table). On 07.09.2017 17:38, Gelderman, Richard wrote: Hi Adrew, I thought about this option, I don't want to pass a full BGP table towards R3. In other words R1 + R2 should be used for routing for all routes and R3 should only route net A and net B and must route through to reach other networks. Regards, Richard Van: Bird-users [mailto:bird-users-bounces@network.cz] Namens Andrew Verzonden: donderdag 7 september 2017 15:06 Aan: bird-users(a)network.cz<mailto:bird-users@network.cz> Onderwerp: Re: Bird redundant routers with same AS on same location and prefix delegation to lower router Hi. You should configure R1 and R2 as route reflectors. On 07.09.2017 14:17, Gelderman, Richard wrote: I am trying to achieve a redundant routing setup with two routers with the same ASN who do prefix delegation to a lower router. The setup is the following: AS1000 ISP1 ISP2 AS2000 | | | | AS10000 R1 ======== R2 AS10000 prefix /22 \ iBGP / prefix /22 \ / \ / \ / R3 AS65000 / \ / \ net A net B prefix /24 prefix /24 Does anybody has experience with this kind of setup? Regards, Richard

4 4

Decode BGP Shutdown Communication messages (RFC 8203)
by Job Snijders 28 Sep '17

28 Sep '17

Hi all, Here is a patch to decode received BGP shutdown communication messages as specified in RFC 8203. In the following example scenario I'm sending a shutdown communication with openbgpd: $ bgpctl neighbor 94.142.241.204 down "TICKET-2331 we are upgrading, back in 30 min" request processed And can subsequently observe the message via logging and via 'show protocols all': job@irime:~/source/bird$ sudo ./bird -s test.sock -d -c bird2.conf bird: Started bird: bgp1: Received: Administrative shutdown: "TICKET-2331 we are upgrading, back in 30 min" job@irime:~/source/bird$ sudo ./birdc -s test.sock show protocols all .... BGP state: Active Neighbor address: 165.254.255.26 Neighbor AS: 15562 Connect delay: 3/5 Last error: Received: Administrative shutdown Message: "TICKET-2331 we are upgrading, back in 30 min" As for the remaining RFC 8203 work: I could use some help with _sending_ bgp shutdown communication messages. It is not clear to me where I should hook the message into the config/cli infrastructure. Ideally you can do things like: $ birdc disable bgp1 "hi, we will upgrade to bird 1.6.4" or via the configuration (also during reconfigure): protocol bgp { disabled "shutdown due to maintenance ticket 2424"; description "My BGP uplink"; local 94.142.241.204 as 65000; neighbor 165.254.255.26 as 15562; } Thoughts? Kind regards, Job --- proto/bgp/bgp.c | 13 ++++++++++ proto/bgp/bgp.h | 2 ++ proto/bgp/packets.c | 73 ++++++++++++++++++++++++++++++++++------------------- 3 files changed, 62 insertions(+), 26 deletions(-) diff --git a/proto/bgp/bgp.c b/proto/bgp/bgp.c index f706e76..551b156 100644 --- a/proto/bgp/bgp.c +++ b/proto/bgp/bgp.c @@ -1487,6 +1487,16 @@ bgp_last_errmsg(struct bgp_proto *p) } static const char * +bgp_last_shutmsg(struct bgp_proto *p) +{ + unsigned len; + char *buf = calloc (128, sizeof (char)); + len = p->last_received_shutmsg[0]; + bsnprintf(buf, len, "%s", p->last_received_shutmsg+1); + return(buf); +} + +static const char * bgp_state_dsc(struct bgp_proto *p) { if (p->p.proto_state == PS_DOWN) @@ -1580,7 +1590,10 @@ bgp_show_proto_info(struct proto *P) { const char *err1 = bgp_err_classes[p->last_error_class]; const char *err2 = bgp_last_errmsg(p); + const char *msg = bgp_last_shutmsg(p); cli_msg(-1006, " Last error: %s%s", err1, err2); + if (p->last_received_shutmsg[0] > 0) + cli_msg(-1006, " Message: \"%s\"", msg); } } diff --git a/proto/bgp/bgp.h b/proto/bgp/bgp.h index e47a0eb..d958716 100644 --- a/proto/bgp/bgp.h +++ b/proto/bgp/bgp.h @@ -157,6 +157,8 @@ struct bgp_proto { u8 last_error_class; /* Error class of last error */ u32 last_error_code; /* Error code of last error. BGP protocol errors are encoded as (bgp_err_code << 16 | bgp_err_subcode) */ + byte last_received_shutmsg[129]; /* RFC 8203 */ + #ifdef IPV6 byte *mp_reach_start, *mp_unreach_start; /* Multiprotocol BGP attribute notes */ unsigned mp_reach_len, mp_unreach_len; diff --git a/proto/bgp/packets.c b/proto/bgp/packets.c index ab87bdc..1a021dd 100644 --- a/proto/bgp/packets.c +++ b/proto/bgp/packets.c @@ -1460,9 +1460,9 @@ static struct { { 5, 3, "Unexpected message in Established state" }, { 6, 0, "Cease" }, /* Subcodes are according to [RFC4486] */ { 6, 1, "Maximum number of prefixes reached" }, - { 6, 2, "Administrative shutdown" }, + { 6, 2, "Administrative shutdown" }, /* RFC 8203 can follow */ { 6, 3, "Peer de-configured" }, - { 6, 4, "Administrative reset" }, + { 6, 4, "Administrative reset" }, /* RFC 8203 can follow */ { 6, 5, "Connection rejected" }, { 6, 6, "Other configuration change" }, { 6, 7, "Connection collision resolution" }, @@ -1497,35 +1497,56 @@ bgp_error_dsc(unsigned code, unsigned subcode) void bgp_log_error(struct bgp_proto *p, u8 class, char *msg, unsigned code, unsigned subcode, byte *data, unsigned len) { - const byte *name; - byte *t, argbuf[36]; - unsigned i; + const byte *name; + byte *t, argbuf[256]; + unsigned i; + unsigned shutdown_comm_length; - /* Don't report Cease messages generated by myself */ - if (code == 6 && class == BE_BGP_TX) - return; + /* Don't report Cease messages generated by myself */ + if (code == 6 && class == BE_BGP_TX) + return; + + name = bgp_error_dsc(code, subcode); + t = argbuf; + memset(p->last_received_shutmsg, 0, 129); // clear old RFC 8203 messages - name = bgp_error_dsc(code, subcode); - t = argbuf; - if (len) + if (len) { - *t++ = ':'; - *t++ = ' '; + *t++ = ':'; + *t++ = ' '; - if ((code == 2) && (subcode == 2) && ((len == 2) || (len == 4))) - { - /* Bad peer AS - we would like to print the AS */ - t += bsprintf(t, "%d", (len == 2) ? get_u16(data) : get_u32(data)); - goto done; - } - if (len > 16) - len = 16; - for (i=0; i<len; i++) - t += bsprintf(t, "%02x", data[i]); + if ((code == 2) && (subcode == 2) && ((len == 2) || (len == 4))) + { + /* Bad peer AS - we would like to print the AS */ + t += bsprintf(t, "%d", (len == 2) ? get_u16(data) : get_u32(data)); + goto done; + } + /* RFC 8203 */ + if ((code == 6) && ((subcode == 2 || subcode == 4)) && (len <= 129)) + { + shutdown_comm_length = data[0]; + if ((shutdown_comm_length <= 128) && (len == shutdown_comm_length + 1)) + { + t += bsprintf(t, "\""); + for (i=1; i<len; i++) + t += bsprintf(t, "%c", data[i]); + t += bsprintf(t, "\""); + memcpy(p->last_received_shutmsg, data, shutdown_comm_length + 1); + goto done; + } + } + else + { + if (len > 16) + len = 16; + for (i=0; i<len; i++) + t += bsprintf(t, "%02x", data[i]); + } } - done: - *t = 0; - log(L_REMOTE "%s: %s: %s%s", p->p.name, msg, name, argbuf); + + done: + *t = 0; + log(L_REMOTE "%s: %s: %s%s", p->p.name, msg, name, argbuf); } static void

4 7

BGP connection between two peers
by Александра Урошевска 27 Sep '17

27 Sep '17

Hi I want to make BGP bettwen two peers. I have made this configuration and I don't know what is wrong. Command show route, shows nothing. How can I check If it works? Do you have some remarks on the configuration files? What do I need to do? Please, any remark is welcomed. RS o------------------------------------------------------------------o IXP1 AS 900 AS 100 Loopback 10.9.9/32 Loopback 10.1.1.1/32 GATEWAY 10.0.0.9/24 GATEWAY 10.0.0.1/24 Two virtual machines RS and IXP1. I have install BIRD 1.6.3 on a Ubuntu 16.04 LTS on a VM Oracle Box and I want to accomplish BGP connection. RS log syslog all; router id 10.9.9.9; protocol device { scan time 10; } protocol kernel { export all; scan time 15; } protocol bgp peer1 { import all; export all; local as 900; neighbor 10.0.0.1 as 100; } IXP1 log syslog all; router id 10.1.1.1; protocol device { scan time 10; } protocol kernel { export all; scan time 15; } protocol bgp peer9 { import all; export all; local as 100; neighbor 10.0.0.9 as 900; } Thank you for your help. Aleksandra

3 3

Re: MTU mismatch with nbr
by Derek Andrew 25 Sep '17

25 Sep '17

I think there may be a bug in our Fortigate. It has the ability to disable the MTU check in IPv4 so I could get IPv4 up, but no joy on IPv6. Anyway, thank you, I have my answer. The way to solve this is to do the correct thing. d On Sun, Sep 24, 2017 at 10:01 AM, Ondrej Zajicek <santiago(a)crfreenet.org> wrote: > On Thu, Sep 21, 2017 at 11:08:47AM -0600, Derek Andrew wrote: > > We are running BIRD and BIRD6 to manage our BFD and OSPF relationship on > > our DNS servers. > > > > We moved the DNS servers onto a Fortigate firewall. I was able to get the > > BIRD daemon running, but BIRD6 is complaining about an MTU mismatch with > > the neighbour. > > > > Is there any way to tell BIRD to ignore the MTU? The OSPF status is > showing > > the neighbour is in the Exchange state. > > No, checking MTU is required by OSPF standard. Why do you have > inconsistent MTU? Also, it should be noticed by both IPv4 and IPv6 > versions. > > -- > Elen sila lumenn' omentielvo > > Ondrej 'Santiago' Zajicek (email: santiago(a)crfreenet.org) > OpenPGP encrypted e-mails preferred (KeyID 0x11DEADC3, wwwkeys.pgp.net) > "To err is human -- to blame it on a computer is even more so." > -- Copyright 2017 Derek Andrew (excluding quotations) +1 306 966 4808 Communication and Network Services Information and Communications Technology Infrastructure Services *University of Saskatchewan*Peterson 120; 54 Innovation Boulevard Saskatoon,Saskatchewan,Canada. S7N 2V3 Timezone GMT-6 Typed but not read.

1 0

MTU mismatch with nbr
by Derek Andrew 24 Sep '17

24 Sep '17

We are running BIRD and BIRD6 to manage our BFD and OSPF relationship on our DNS servers. We moved the DNS servers onto a Fortigate firewall. I was able to get the BIRD daemon running, but BIRD6 is complaining about an MTU mismatch with the neighbour. Is there any way to tell BIRD to ignore the MTU? The OSPF status is showing the neighbour is in the Exchange state. Thanks. d -- Copyright 2017 Derek Andrew (excluding quotations) +1 306 966 4808 Communication and Network Services Information and Communications Technology Infrastructure Services *University of Saskatchewan*Peterson 120; 54 Innovation Boulevard Saskatoon,Saskatchewan,Canada. S7N 2V3 Timezone GMT-6 Typed but not read.

2 1

Static routing
by Александра Урошевска 24 Sep '17

24 Sep '17

Hi all bird users, I have started with fresh configuration of BIRD. And I want to use a default routing table with static routing. Is there any template for configuration of protocol static, protocol kernel, protocol direct? Thank you very much. Kind regards, Aleksandra

2 1

Agregator protocol
by Luk 21 Sep '17

21 Sep '17

Hi, I'm trying to use aggregator protocol (patch from Alexander Chernikov). Can someone explain if I can use this patch to aggregate routes to upstream providers ? My goal is to not use "route x.x.x.x/xy reject;" syntax to announce routes to the internet, but rather use aggregation, which will be used only if there will be one or more more-specific-route within particular prefix from iBGP session. -- Regards, Luk

1 0

TCP md5 authentication failures for almost on all the server's BGP peering
by Harish Shetty 21 Sep '17

21 Sep '17

Hi All I am using bird-1.4.5-1.el6, we are getting alerted for TCP md5 authentication failures for almost on all the server's BGP peering with switches. Error we are seeing as mentioned below. Jul 17 17:15:29 lca1-s1-csw02.nw.linkedin.com 2017 Jul 17 17:15:29 UTC: %NETSTACK-3-TCP_MD5_AUTH_FAILURE: netstack [3617] MD5_DIGEST_INVALID:Dropping packets from src:x.x.x.x.34987,dst:y.y.y.yy.179 Jul 17 07:24:28 lca1-e1-csw01-lo0.nw.linkedin.com 2017 Jul 17 07:24:28 UTC: %NETSTACK-3-TCP_MD5_AUTH_FAILURE: netstack [3640] MD5_DIGEST_INVALID:Dropping packets from src:yyyy.yyyy.yyyy.35088,dst:xxxx.xxxx.xxx.179 lca1-s1-csw01.nw.linkedin.com 2017 Jul 17 05:01:25 UTC: %NETSTACK-3-TCP_MD5_AUTH_FAILURE: netstack [3617] MD5_DIGEST_INVALID:Dropping packets from src:x.x.x.xx.55220,dst:1y.y.y.yy.179 we have raised a Case with Cisco and they are saying possible cause would be " If received packet has got modified in transit, so hash computed at origin is not matching at the destination". Does anyone have seen this type of error before? Is bird causing something to corrupt the packet? Any solution / way to check and confirm everything fine at bird is appreciated. Regards Harish Shetty

3 2