August 2020 - Bird-users

BGP VPNv4 Ext Community Filter
by Hombach, Tobias (external - Project) 17 Aug '20

17 Aug '20

Hi, we use BIRD 2.0.7 BGP VPNv4 and need to filter extended BGP communities on ingress. Config snippet: define PFILTER_RT = [ (rt, 65100, *), (rt, 65101, *), (rt, 65102, *) ]; filter IMPORT_FILTER { bgp_ext_community.filter(PFILTER_RT_MASTER); accept; } protocol bgp 'my-router' from VPN4_S3_TPL_BGP_DEFAULT { vpn4 mpls { import filter IMPORT_FILTER; }; } This is working as expected. We discovered that RO communities are filtered too (not a surprise) and we extended the definition: define PFILTER_RT = [ (rt, 65100, *), (rt, 65101, *), (rt, 65102, *), (ro, 65100, *), (ro, 65101, *), (ro, 65102, *) ]; We dont need to filter strict for RO communities and best would be to allow all. Is there a better way to allow only defined RT and all RO communities? Are there any plans to allow wildcard or range in these definitions? Like: (ro, *, *) or (ro, 100..300, *) Another question: Are other extended community sub types beside RO and RT (as defined in RFC 7153) filtered by function bgp_ext_community.filter() ? Thanks in advance Regards Tobias

1 0

Filters giving odd errors
by Skyler Mäntysaari 15 Aug '20

15 Aug '20

Hi there, I'm using the template from https://github.com/neptune-networks/peering/blob/master/out/router.fqdn.exa… for my filters, and I'm getting argument related errors in logs. What's the issue with those filters? P.S I need to find a guide on how to do bird2 and RPKI as well. Logs: ---------------------------------------------------- 2020-08-13 17:37:47 <ERR> filters, line 360: Argument 1 of instruction FI_CONDITION must be of type T_BOOL, got 0x00 2020-08-13 17:37:47 <ERR> filters, line 360: Argument 1 of instruction FI_CONDITION must be of type T_BOOL, got 0x00 2020-08-13 17:37:47 <ERR> filters, line 360: Argument 1 of instruction FI_CONDITION must be of type T_BOOL, got 0x00 2020-08-13 17:37:47 <ERR> filters, line 360: Argument 1 of instruction FI_CONDITION must be of type T_BOOL, got 0x00 2020-08-13 17:37:47 <ERR> filters, line 360: Argument 1 of instruction FI_CONDITION must be of type T_BOOL, got 0x00 2020-08-13 17:37:47 <ERR> ... ---------------------------------------------------- Bird config, the filter functions: ---------------------------------------------------- # --- Filters (technically functions) --- function default_import() { if bgp_path.len > 32 then reject "AS_PATH len [", bgp_path.len ,"] longer than 32 - REJECTING ", net; if prefix_is_in_global_blacklist() then reject "prefix is in global blacklist - REJECTING ", net; if is_own_prefix() then reject "prefix is our own - REJECTING ", net; if is_own_internal_prefix() then { if !prefix_is_in_global_whitelist() then reject "prefix is our own and internal - REJECTING ", net; } if prefix_is_bogon() then reject "prefix is bogon - REJECTING ", net; if net.type = NET_IP4 then if !is_prefix_length_valid(8, 24) then reject "prefix len [", net.len, "] not in 8-24 - REJECTING ", net; if net.type = NET_IP6 then if !is_prefix_length_valid(12, 56) then reject "prefix len [", net.len, "] not in 12-56 - REJECTING ", net; #perform_rpki_validation(); if route_is_rpki_invalid() then reject "RPKI, route is INVALID - REJECTING ", net; add_region_community(); add_site_community(); honor_graceful_shutdown(); accept; } function peer_import() { scrub_communities_in(); add_peer_community(); default_import(); } function peer_export() { strip_private_asns(); add_global_prepends(); if is_own_prefix() then accept; if route_is_rpki_invalid() then reject "RPKI, route is INVALID - NOT ANNOUNCING ", net; if is_own_internal_prefix() then { if !prefix_is_in_global_whitelist() then reject "prefix is our own and internal - NOT ANNOUNCING ", net; } if net.type = NET_IP4 then if !is_prefix_length_valid(8, 24) then reject "prefix len [", net.len, "] not in 8-24 - REJECTING ", net; if net.type = NET_IP6 then if !is_prefix_length_valid(12, 48) then reject "prefix len [", net.len, "] not in 12-48 - REJECTING ", net; if prefix_is_bogon() then reject "prefix is bogon - NOT ANNOUNCING ", net; if as_path_contains_invalid_asn() then reject "AS_PATH [", bgp_path ,"] contains invalid ASN - REJECTING ", net; if should_not_export_to_site() then reject "NO_EXPORT community in place for site - NOT ANNOUNCING ", net; if should_not_export_to_region() then reject "NO_EXPORT community in place for region - NOT ANNOUNCING ", net; if should_not_export_to_peers() then reject "NO_EXPORT community in place for peers - NOT ANNOUNCING ", net; if prefix_is_in_global_blacklist() then reject "prefix is in global blacklist - REJECTING ", net; if was_learned_from_customer() then accept; reject; } function upstream_import() { scrub_communities_in(); add_upstream_community(); default_import(); } function upstream_export() { strip_private_asns(); add_global_prepends(); if is_own_prefix() then accept; if route_is_rpki_invalid() then reject "RPKI, route is INVALID - NOT ANNOUNCING ", net; if is_own_internal_prefix() then { if !prefix_is_in_global_whitelist() then reject "prefix is our own and internal - NOT ANNOUNCING ", net; } if net.type = NET_IP4 then if !is_prefix_length_valid(8, 24) then reject "prefix len [", net.len, "] not in 8-24 - REJECTING ", net; if net.type = NET_IP6 then if !is_prefix_length_valid(12, 48) then reject "prefix len [", net.len, "] not in 12-48 - REJECTING ", net; if prefix_is_bogon() then reject "prefix is bogon - NOT ANNOUNCING ", net; if as_path_contains_invalid_asn() then reject "AS_PATH [", bgp_path ,"] contains invalid ASN - REJECTING ", net; if should_not_export_to_site() then reject "NO_EXPORT community in place for site - NOT ANNOUNCING ", net; if should_not_export_to_region() then reject "NO_EXPORT community in place for region - NOT ANNOUNCING ", net; if should_not_export_to_upstreams() then reject "NO_EXPORT community in place for upstreams - NOT ANNOUNCING ", net; if prefix_is_in_global_blacklist() then reject "prefix is in global blacklist - REJECTING ", net; if was_learned_from_customer() then accept; reject; } function customer_import() { scrub_communities_in(); add_customer_community(); default_import(); } function customer_export() { strip_private_asns(); add_global_prepends(); if is_own_prefix() then accept; if route_is_rpki_invalid() then reject "RPKI, route is INVALID - NOT ANNOUNCING ", net; if is_own_internal_prefix() then { if !prefix_is_in_global_whitelist() then reject "prefix is our own and internal - NOT ANNOUNCING ", net; } if net.type = NET_IP4 then if !is_prefix_length_valid(8, 24) then reject "prefix len [", net.len, "] not in 8-24 - REJECTING ", net; if net.type = NET_IP6 then if !is_prefix_length_valid(12, 48) then reject "prefix len [", net.len, "] not in 12-48 - REJECTING ", net; if prefix_is_bogon() then reject "prefix is bogon - NOT ANNOUNCING ", net; if as_path_contains_invalid_asn() then reject "AS_PATH [", bgp_path ,"] contains invalid ASN - REJECTING ", net; if should_not_export_to_site() then reject "NO_EXPORT community in place for site - NOT ANNOUNCING ", net; if should_not_export_to_region() then reject "NO_EXPORT community in place for region - NOT ANNOUNCING ", net; if should_not_export_to_customers() then reject "NO_EXPORT community in place for customers - NOT ANNOUNCING ", net; if prefix_is_in_global_blacklist() then reject "prefix is in global blacklist - REJECTING ", net; if was_learned_from_peer() then accept; if was_learned_from_private_peer() then accept; if was_learned_from_upstream() then accept; if was_learned_from_customer() then accept; reject; } function core_import() { if prefix_is_bogon() then reject; if prefix_is_in_global_blacklist() then reject "prefix is in global blacklist - REJECTING ", net; honor_graceful_shutdown(); accept; } function core_export() { if prefix_is_bogon() then reject; if prefix_is_in_global_blacklist() then reject "prefix is in global blacklist - REJECTING ", net; if is_own_prefix() then accept; if is_own_internal_prefix() then accept; if was_learned_from_peer() then accept; if was_learned_from_private_peer() then accept; if was_learned_from_upstream() then accept; if was_learned_from_customer() then accept; reject; } ---------------------------------------------------- -- This email has been checked for viruses by Avast antivirus software. https://www.avast.com/antivirus

4 6

reload fails at static protocol
by Farhad 13 Aug '20

13 Aug '20

Hello, I am trying to change my bird config file and then reload it, but when I try to do *reload all* or *reload in all * reload will fail at static1 and static2, but* reload out all* will be successful. I am not sure what I am missing, your help is much appreciated. I have the below configs: protocol kernel { ipv4 { table v116; export all; }; kernel table 116; } protocol kernel { ipv4 { table v1120; export all; }; kernel table 1120; } protocol bfd { interface "eth1" { min rx interval 20 ms; min tx interval 50 ms; idle tx interval 300 ms; }; } protocol static { ipv4 { table v116; }; route 0.0.0.0/0 via 10.17.3.236 bfd; } protocol static { ipv4 { table v1120; }; route 0.0.0.0/0 via 10.17.3.232 bfd; } Regards, Farhad

2 2

Question about BGP advertisement-interval in BIRD
by Kim Charles 10 Aug '20

10 Aug '20

Hi, I'm currently using BIRD version 1.6.3 and I'm looking for any equivalent in BIRD for FRR BGP advertisement-interval option as below. It would be appreciated if you can help me on this. [no] neighbor PEER advertisement-interval (0-600) Setup the minimum route advertisement interval(mrai) for the peer in question. This number is between 0 and 600 seconds, with the default advertisement interval being 0. Best Regards, Charles -- Charles Kim Stony Brook MS-TM / aSSIST MBA / 7xCCIE#12303 Mobile : +82-10-8918-9777 LinkedIn : https://www.linkedin.com/in/charles-kim-5b50a02b/

1 0

Status of implementing multicast routing
by Blažej Krajňák 06 Aug '20

06 Aug '20

Hello, I was unable to find more details. Is there any plan to implement multicast routing (SSM, DNS support)? Thanks, Blažej

4 5

static route - policy based routing in Bird,
by Farhad 05 Aug '20

05 Aug '20

Hello, I am new to bird, there is something which I don't know how to achieve using bird. Is there a way in which I can forward traffics originated from a specific network to some designated interfaces? protocol kernel { ipv4 { table tabl1; export all; }; kernel table 1; } protocol kernel { ipv4 { table tabl2; export all; }; kernel table 2; } protocol static { ipv4 { table table1; }; route 0.0.0.0/0 via 10.7.3.249 bfd via 10.9.3.251 bfd; } protocol static { ipv4 { table table2; }; route 0.0.0.0/0 via 10.8.3.244 bfd; } In linux i can do something like this: *ip rule add type unicast from 1.0.0.1 table 1* *ip rule add type unicast from 2.0.0.1 table 2* Is there a way these rules can be achieved using filter or Pipe in Bird? I am curious whether this can be done in Bird without depending on 'ip rule' of linux. Regards, Farhad

1 0

Analyzing AS PATH in packets
by Julien Sansonnens 04 Aug '20

04 Aug '20

Dear all, using bird 2.0.7 I'm a bit confused with the output of "show route export". I'm exporting a full table to a downstream. I'm expecting to see my own AS as the first AS in AS PATH but it will not show in "BGP.as_path" If I prepend it, then it appears on the output. I don't know if it's related to display, or if my AS is really not added to the PATH. Perhaps it is added later in the process, before leaving my router ? How can I check this? I tried with "debug", but to my knowledge, it is not possible to display route details. I thought about doing tcpdump, but I haven't found out how to interpret the result correctly and see the AS PATH. Would you have a clue on how to see exactly what is being exported on an interface? thanks a lot Julien

2 1

Bird 2 debugging, connections getting rejected
by Skyler Mäntysaari 03 Aug '20

03 Aug '20

Hello, I'm trying to get IBGP session to work between Bird 2 and FFRouting (EdgeRouter). They are using Wireguard for the link, and I can ping them fine. BGP port is also open on both. What's happening here? Errors I'm getting: -------- 2020-08-03 23:51:56.870 <TRACE> ibgp_tku: Incoming connection from 2001:67c:1104:1a00::1 (port 46843) rejected -------- Full bird config: ---------------------------------------------------------------------------------------------------------------------------------------- # Configure logging #log syslog all; #log "/var/log/bird.log" { debug, trace, info, remote, warning, error, auth, fatal, bug }; log "/var/log/bird.log" all; #log syslog all; debug protocols { events, states }; # Set router ID. It is a unique identification of your router, usually one of # IPv4 addresses of the router. It is recommended to configure it explicitly. router id 45.92.40.5; # Turn on global debugging of all protocols (all messages or just selected classes) #debug protocols all; # debug protocols { events, states }; # Turn on internal watchdog # watchdog warning 5 s; # watchdog timeout 30 s; # You can define your own constants define my_asn = 213021; # define my_addr = 198.51.100.1; # Tables master4 and master6 are defined by default ipv4 table master4; ipv6 table master6; # Define more tables, e.g. for policy routing or as MRIB ipv4 table mrib4; ipv6 table mrib6; # The Device protocol is not a real routing protocol. It does not generate any # routes and it only serves as a module for getting information about network # interfaces from the kernel. It is necessary in almost any configuration. protocol device { scan time 5; } protocol direct DIRECT { ipv4; ipv6; } protocol kernel KERNEL4 { ipv4 { export all; import none; }; } protocol kernel KERNEL6 { ipv6 { export all; import none; }; } protocol static STATIC6 { ipv6; route 2a0b:a700:3::2/128 via 2a07:22c0:c100::; #route 2001:67c:1104:1a00::1 dev wg0; #route 2a01:4f9:2b:f800::2 via 2a07:22c0:c100::; #route 2a01:4f8::/29 via 2001:7f8:33::a105:8299:1; } filter internal_nets_v6 { if net ~ [ 2a0e:b107:6ec::/48,2a0e:8f02:2010::/44,2001:67c:1104::/48 ] then accept; reject; } filter no_export_internal_nets { if net ~ [ 2a0e:b107:6ec::/48,2a0e:8f02:2010::/44,2001:67c:1104::/48 ] then { bgp_community.add((65535:65281)); accept; } reject; } filter internal_route { if net ~ [ 2a07:22c0:c100::/64 ] then reject; accept; } template bgp T_SELF { local 2001:67c:1104:1a00::2 as 213021; ipv6 { import filter internal_nets_v6; export filter internal_route; }; } protocol bgp ibgp_tku from T_SELF { neighbor 2001:67c:1104:1a00::1 as 213021; #neighbor fe80::21b:21ff:febb:5db0%wg0 as 213021; direct; ipv6 { import filter internal_nets_v6; export all; next hop self; }; } protocol bgp ibgp_de from T_SELF { local 2001:67c:1104:1a01::1 as 213021; neighbor 2001:67c:1104:1a01::2 as 213021; direct; ipv6 { import all; export all; next hop self; }; } ---------------------------------------------------------------------------------------------------------------------------------------- EdgeRouter side: ---------------------------------------------------------------------------------------------------------------------------------------- address-family { ipv6-unicast { prefix-list { export ANNOUNCE-THESE } soft-reconfiguration { inbound } } } description "Frankfurt, DE" remote-as 213021 update-source 2001:67c:1104:1a00::1 ----------------------------------------------------------------------------------------------------------------------------------------

1 0

Re: Bird 2.0 Install
by Krish R. [VNP DIGITAL LTD.] 03 Aug '20

03 Aug '20

Hi, I had the same issue on Ubuntu 18.04 LTS. I ran the following commands wget http://archive.ubuntu.com/ubuntu/pool/main/i/init-system-helpers/init-syste… (http://archive.ubuntu.com/ubuntu/pool/main/i/init-system-helpers/init-syste…) dpkg -i init-system-helpers_1.57_all.deb then run apt-get install bird2. Thanks August 3, 2020 10:57 AM, "Jason Kopacko" <jason(a)kopacko.com (mailto:jason@kopacko.com?to=%22Jason%20Kopacko%22%20<jason(a)kopacko.com>)> wrote: It's not simple. I have been trying everything I can find via Google because packages just aren't available or something. root@#####:~# apt-get install bird2 Reading package lists... Done Building dependency tree Reading state information... Done Some packages could not be installed. This may mean that you have requested an impossible situation or if you are using the unstable distribution that some required packages have not yet been created or been moved out of Incoming. The following information may help to resolve the situation: The following packages have unmet dependencies: bird2 : PreDepends: init-system-helpers (>= 1.56~) but 1.51 is to be installed E: Unable to correct problems, you have held broken packages. Sorry if I come off as rude, I just fed up with trying to install this today. Sent from my Verizon Wireless 4G LTE Droid Turbo 2. On Sun, Aug 2, 2020 at 7:50 PM Kr <kr(a)vnpdigital.com (mailto:kr@vnpdigital.com)> wrote: Hi, It is quite simple. You can run apt-get install bird2. If you run into any issues, don’t hesitate to contact me. Cheers. Krish On Aug 3, 2020 at 10:23 am, <Jason Kopacko (mailto:jason@kopacko.com)> wrote: I am beginning to give up. As a very inexperienced Ubuntu user, I am trying to install bird 2.x. But cannot seem to figure out how to use apt-get to install anything above bird 1.6. What am I doing wrong and why is this sooooo hard? Sent from my Verizon Wireless 4G LTE Droid Turbo 2. (https://vnpdigital.com)

2 1

How to pipe ipv6 channel into ipv6 channel or possible alternatives
by Nick Cao 03 Aug '20

03 Aug '20

I'm trying to use babel (namely, with the ipv6 sadr channel) together with bgp, and thus I got route from both channels to be installed into kernel. But the limitation of kernel protocol dictates that I seem to have no choice other than separate the routes into different kernel routing tables, then use ip rules to take them into effect. However I found some interesting discussion in the mailing list (https://bird.network.cz/pipermail/bird-users/2017-May/011277.html) indicating that we can convert (or pipe) ipv6 channel into ipv6 sadr channel, which, sadly still has't made it's way into bird as far as I know. I'd like to ask whether there's some way to mimic that sort of behavior, or is there any alternative to that so that ipv6 sadr channel can play nicely with the ipv6 channel. ---------------------------------------- Nick Cao <nickcao(a)nichi.co>

1 0