- Bird-users - Mailing Lists

How to set another next-hop
by Titov Stas 20 Apr '18

20 Apr '18

Guys, I have some troble with change next-hop. I've got ipv6 prefixes in ISP_ISP2 table from rr bgp peer: bird> show route table ISP_ISP2 2a01:230:2:41::a16/128 unreachable [bgp2 2018-04-17 from 2a01:230:3:1::3] * (101/-) [i] 2a01:230:2:41::a17/128 unreachable [bgp2 2018-04-17 from 2a01:230:3:1::3] * (101/-) [i] ... and export in kernel table 11 [root@nvkvm-3 ~]# ip -6 route show table 11 | more unreachable 2a01:230:2:41::2 dev lo proto bird metric 1024 error -113 unreachable 2a01:230:2:41::3 dev lo proto bird metric 1024 error -113 unreachable 2a01:230:2:41::4 dev lo proto bird metric 1024 error -113 unreachable 2a01:230:2:41::6 dev lo proto bird metric 1024 error -113 How I can make their reachable via my gw: 2a01:230:2:53::9? I tried export filter nh_in; filter nh_in { if ( net ~ [ 2a01:230:2:41::/64+ ] ) then { gw = 2a01:230:2:53::9; accept; } } but it make not help me.

1 0

Bird BGP in VRF
by Ticlea Alexandru 20 Apr '18

20 Apr '18

Hello BGP is able to run in a vrf using a specific table? I have this config (snippet) protocol bgp bgp_private { vrf "vrf-private"; ipv4 { igp table vrf_private; #export where proto = "adv_my_private"; #export filter { if net ~[ 10.1.10.0/24+ ] then accept; reject;} ; #import all; export all; next hop self; }; debug { states, routes, filters, interfaces, events, packets }; local as 64418; neighbor a.b.c.d as 64418; direct; } It seems to advertise routes from master4 (global), instead of vrf_private; I see this in tcpdump at ' Updated routes:' field

2 1

Debian packages for BIRD v2?
by Pascal Mathis 20 Apr '18

20 Apr '18

Hello, I would like to ask if there is already any estimated date when official Debian packages for BIRD v2 can be expected? The official release announcement only said that official packages will follow soon™. Generally speaking the BIRD debian repository seems quite outdated, as it does not even support "stretch" yet? Should this repository actually be no longer used or are there any plans to keep it up2date? Just wanted to ask before I start making my own inofficial Debian packages as a temporary solution. Thanks in advance for any feedback! Best regards, Pascal Mathis -- Pascal Mathis https://www.pascalmathis.com - mail(a)pascalmathis.com GPG Fingerprint - 59E3 E751 4F49 A5D2 B16A 2AE5 059E 62FF 0142 2B89

2 1

bgp local preference from static protocol
by Milen Bogunski 19 Apr '18

19 Apr '18

Hello, trying to preset local preference for originated route on static protocol like this protocol static mynetwork { import all; route 10.1.1.0/24 reject { bgp_local_pref = 200; }; } on BGP peer configuration i'm using following export filter export filter { if proto = "mynetwork" then { accept; } reject; }; in routing table everything seems fine, bgp.local_pref from static protocol is set bird> show route all for 10.1.1.0/24 10.1.1.0/24 unreachable [mynetwork 11:13:34] * (200) Type: static unicast univ BGP.local_pref: 200 but on exported route BGP.local_pref is 100 bird> show route all export peer2 10.1.1.0/24 unreachable [mynetwork 11:13:34] * (200) Type: static unicast univ BGP.origin: IGP BGP.as_path: 65001 BGP.local_pref: 100 ---- if i set local preference on bgp peer export filter, like this - it is OK if proto = "mynetwork" then { if net = 10.1.1.0/24 then bgp_local_pref = 200; accept; } reject; }; bird> show route all export peer2 10.1.1.0/24 unreachable [mynetwork 11:13:34] * (200) Type: static unicast univ BGP.origin: IGP BGP.as_path: 65001 BGP.local_pref: 200 my question is, is there any way to use bgp_local_pref from static protocol when originate routes, without touching neighbor export filter? Thanks in advance

2 1

Route based VPN in Linux
by Kaushal Shriyan 18 Apr '18

18 Apr '18

Hi, I have setup libreswan IPSec VPN tunnel using route based VPN through VTI interface. Please find the below configurations. *IPSec VPN Tunnel Server 1 ( IP :- 172.31.1.54)* > [root@ip-172-31-1-54 log]# cat /etc/ipsec.d/vtiipsecrouted.conf > conn routed-vpn > left=172.31.1.54 > right=172.31.15.8 > authby=secret > #leftsubnet=0.0.0.0/0 > #rightsubnet=0.0.0.0/0 > auto=add > # route-based VPN requires marking and an interface > mark=5/0xffffffff > vti-interface=vti01 > # do not setup routing because we don't want to send 0.0.0.0/0 over > the tunnel > vti-routing=no > # If you run a subnet with BGP (bird) daemon over IPsec, you can > configure the VTI interface > leftvti=10.0.1.1/24 > [root@ip-172-31-1-54 log]# ip a > 1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN qlen 1 > link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00 > inet 127.0.0.1/8 scope host lo > valid_lft forever preferred_lft forever > 2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 9001 qdisc mq state UP > qlen 1000 > link/ether 02:2f:90:d6:66:6a brd ff:ff:ff:ff:ff:ff > inet 172.31.1.54/20 brd 172.31.15.255 scope global dynamic eth0 > valid_lft 2763sec preferred_lft 2763sec > 3: ip_vti0@NONE: <NOARP> mtu 1480 qdisc noop state DOWN qlen 1 > link/ipip 0.0.0.0 brd 0.0.0.0 > 10: vti01@NONE: <POINTOPOINT,NOARP,UP,LOWER_UP> mtu 8981 qdisc noqueue > state UNKNOWN qlen 1 > > *link/ipip 172.31.1.54 peer 172.31.15.8* *inet 10.0.1.1/24 > <http://10.0.1.1/24>* scope global vti01 > valid_lft forever preferred_lft forever > [root@ip-172-31-1-54 log]#ps aux | grep ipsec > root 7903 0.0 0.0 204880 7692 ? Ssl 07:10 0:00 > /usr/libexec/ipsec/pluto --leak-detective --config /etc/ipsec.conf --nofork > > [root@ip-172-31-1-54 log]# ip xfrm policy > src 172.31.1.54/32 dst 172.31.15.8/32 > dir out priority 2080 ptype main > mark 5/0xffffffff > tmpl src 172.31.1.54 dst 172.31.15.8 > proto esp reqid 16393 mode tunnel > src 172.31.15.8/32 dst 172.31.1.54/32 > dir fwd priority 2080 ptype main > mark 5/0xffffffff > tmpl src 172.31.15.8 dst 172.31.1.54 > proto esp reqid 16393 mode tunnel > src 172.31.15.8/32 dst 172.31.1.54/32 > dir in priority 2080 ptype main > mark 5/0xffffffff > tmpl src 172.31.15.8 dst 172.31.1.54 > proto esp reqid 16393 mode tunnel > [root@ip-172-31-1-54 log]# > [root@ip-172-31-1-54 log]# ip route list > default via 172.31.0.1 dev eth0 > 10.0.1.0/24 dev vti01 proto kernel scope link src 10.0.1.1 > 172.31.0.0/20 dev eth0 proto kernel scope link src 172.31.1.54 > [root@ip-172-31-1-54 log]# > [root@ip-172-31-1-54 log]# service bird status > Redirecting to /bin/systemctl status bird.service > ● bird.service - BIRD Internet Routing Daemon > Loaded: loaded (/usr/lib/systemd/system/bird.service; enabled; vendor > preset: disabled) > Active: active (running) since Thu 2018-04-12 07:11:00 UTC; 40min ago > Process: 7963 ExecStart=/usr/sbin/bird (code=exited, status=0/SUCCESS) > Main PID: 7964 (bird) > CGroup: /system.slice/bird.service > └─7964 /usr/sbin/bird > Apr 12 07:11:00 ip-172-31-1-54.ap-southeast-1.compute.internal > systemd[1]: Starting BIRD Internet Routing Daemon... > Apr 12 07:11:00 ip-172-31-1-54.ap-southeast-1.compute.internal > bird[7964]: Started > Apr 12 07:11:00 ip-172-31-1-54.ap-southeast-1.compute.internal > systemd[1]: Started BIRD Internet Routing Daemon. > Apr 12 07:34:16 ip-172-31-1-54.ap-southeast-1.compute.internal > bird[7964]: KIF: Received address message for unknown interface 10 > [root@ip-172-31-1-54 log]# > [root@ip-172-31-1-54 log]# birdc > BIRD 1.6.4 ready. > bird> show status > BIRD 1.6.4 > Router ID is 10.0.1.1 > Current server time is 2018-04-12 07:28:42 > Last reboot on 2018-04-12 07:10:59 > Last reconfiguration on 2018-04-12 07:10:59 > Daemon is up and running > bird> show interfaces > lo up (index=1) > MultiAccess AdminUp LinkUp Loopback Ignored MTU=65536 > 127.0.0.1/8 (Primary, scope host) > eth0 up (index=2) > MultiAccess Broadcast Multicast AdminUp LinkUp MTU=9001 > 172.31.1.54/20 (Primary, scope site) > ip_vti0 DOWN (index=3) > MultiAccess AdminDown LinkDown MTU=1480 > vti01 up (index=10) > PtP Multicast AdminUp LinkUp MTU=8981 > 10.0.1.1/24 (Primary, scope site) > bird> show protocols > name proto table state since info > kernel1 Kernel master up 07:11:00 > device1 Device master up 07:11:00 > testbgp BGP master start 07:11:00 Idle > bird> show protocols all > name proto table state since info > kernel1 Kernel master up 07:10:59 > Preference: 10 > Input filter: ACCEPT > Output filter: ACCEPT > Routes: 1 imported, 0 exported, 1 preferred > Route change stats: received rejected filtered ignored > accepted > Import updates: 1 0 0 0 > 1 > Import withdraws: 0 0 --- 0 > 0 > Export updates: 1 1 0 --- > 0 > Export withdraws: 0 --- --- --- > 0 > device1 Device master up 07:10:59 > Preference: 240 > Input filter: ACCEPT > Output filter: REJECT > Routes: 0 imported, 0 exported, 0 preferred > Route change stats: received rejected filtered ignored > accepted > Import updates: 0 0 0 0 > 0 > Import withdraws: 0 0 --- 0 > 0 > Export updates: 0 0 0 --- > 0 > Export withdraws: 0 --- --- --- > 0 > testbgp BGP master start 07:10:59 Idle > Preference: 160 > Input filter: ACCEPT > Output filter: (unnamed) > Routes: 0 imported, 0 exported, 0 preferred > Route change stats: received rejected filtered ignored > accepted > Import updates: 0 0 0 0 > 0 > Import withdraws: 0 0 --- 0 > 0 > Export updates: 0 0 0 --- > 0 > Export withdraws: 0 --- --- --- > 0 > BGP state: Idle > Neighbor address: 10.1.2.2 > Neighbor AS: 65003 > bird> > > *IPSec VPN Tunnel Server 2 ( IP :- 172.31.15.8)* > [root@ip-172-31-15-8 ~]# cat /etc/ipsec.d/vtiipsecrouted.conf > conn routed-vpn > left=172.31.15.8 > right=172.31.1.54 > authby=secret > #leftsubnet=0.0.0.0/0 > #rightsubnet=0.0.0.0/0 > auto=add > # route-based VPN requires marking and an interface > mark=5/0xffffffff > vti-interface=vti01 > # do not setup routing because we don't want to send 0.0.0.0/0 over > the tunnel > vti-routing=no > # If you run a subnet with BGP (quagga) daemons over IPsec, you can > configure the VTI interface > leftvti=10.0.1.1/24 > [root@ip-172-31-15-8 ~]# > [root@ip-172-31-15-8 ~]# ps aux | grep ipsec > root 6483 0.0 0.0 204880 7684 ? Ssl 07:36 0:00 > /usr/libexec/ipsec/pluto --leak-detective --config /etc/ipsec.conf --nofork > [root@ip-172-31-15-8 ~]# ip a > 1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN qlen 1 > link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00 > inet 127.0.0.1/8 scope host lo > valid_lft forever preferred_lft forever > 2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 9001 qdisc mq state UP > qlen 1000 > link/ether 02:87:cf:47:b5:5e brd ff:ff:ff:ff:ff:ff > inet 172.31.15.8/20 brd 172.31.15.255 scope global dynamic eth0 > valid_lft 3063sec preferred_lft 3063sec > 3: ip_vti0@NONE: <NOARP> mtu 1480 qdisc noop state DOWN qlen 1 > link/ipip 0.0.0.0 brd 0.0.0.0 > 7: vti01@NONE: <POINTOPOINT,NOARP,UP,LOWER_UP> mtu 8981 qdisc noqueue > state UNKNOWN qlen 1 > > *link/ipip 172.31.15.8 peer 172.31.1.54* *inet 10.0.1.1/24 > <http://10.0.1.1/24>* scope global vti01 > valid_lft forever preferred_lft forever > [root@ip-172-31-15-8 ~]# > [root@ip-172-31-15-8 ~]# ip xfrm policy > src 172.31.15.8/32 dst 172.31.1.54/32 > dir out priority 2080 ptype main > mark 5/0xffffffff > tmpl src 172.31.15.8 dst 172.31.1.54 > proto esp reqid 16393 mode tunnel > src 172.31.1.54/32 dst 172.31.15.8/32 > dir fwd priority 2080 ptype main > mark 5/0xffffffff > tmpl src 172.31.1.54 dst 172.31.15.8 > proto esp reqid 16393 mode tunnel > src 172.31.1.54/32 dst 172.31.15.8/32 > dir in priority 2080 ptype main > mark 5/0xffffffff > tmpl src 172.31.1.54 dst 172.31.15.8 > proto esp reqid 16393 mode tunnel > [root@ip-172-31-15-8 ~]# > [root@ip-172-31-15-8 ~]# ip route list > default via 172.31.0.1 dev eth0 > 10.0.1.0/24 dev vti01 proto kernel scope link src 10.0.1.1 > 172.31.0.0/20 dev eth0 proto kernel scope link src 172.31.15.8 > [root@ip-172-31-15-8 ~]# > > [root@ip-172-31-15-8 ~]# service bird status > Redirecting to /bin/systemctl status bird.service > ● bird.service - BIRD Internet Routing Daemon > Loaded: loaded (/usr/lib/systemd/system/bird.service; enabled; vendor > preset: disabled) > Active: active (running) since Thu 2018-04-12 07:48:44 UTC; 18s ago > Process: 6659 ExecStart=/usr/sbin/bird (code=exited, status=0/SUCCESS) > Main PID: 6660 (bird) > CGroup: /system.slice/bird.service > └─6660 /usr/sbin/bird > Apr 12 07:48:44 ip-172-31-15-8.ap-southeast-1.compute.internal > systemd[1]: Starting BIRD Internet Routing Daemon... > Apr 12 07:48:44 ip-172-31-15-8.ap-southeast-1.compute.internal > systemd[1]: Started BIRD Internet Routing Daemon. > Apr 12 07:48:44 ip-172-31-15-8.ap-southeast-1.compute.internal > bird[6660]: Started > [root@ip-172-31-15-8 ~]# birdc > BIRD 1.6.4 ready. > bird> show status > BIRD 1.6.4 > Router ID is 10.0.1.2 > Current server time is 2018-04-12 07:49:13 > Last reboot on 2018-04-12 07:48:43 > Last reconfiguration on 2018-04-12 07:48:43 > Daemon is up and running > bird> show interfaces > lo up (index=1) > MultiAccess AdminUp LinkUp Loopback Ignored MTU=65536 > 127.0.0.1/8 (Primary, scope host) > eth0 up (index=2) > MultiAccess Broadcast Multicast AdminUp LinkUp MTU=9001 > 172.31.15.8/20 (Primary, scope site) > ip_vti0 DOWN (index=3) > MultiAccess AdminDown LinkDown MTU=1480 > vti01 up (index=7) > PtP Multicast AdminUp LinkUp MTU=8981 > 10.0.1.1/24 (Primary, scope site) > bird> show protocols > name proto table state since info > kernel1 Kernel master up 07:48:43 > device1 Device master up 07:48:43 > testbgp BGP master start 07:48:43 Idle > bird> show protocols all > name proto table state since info > kernel1 Kernel master up 07:48:44 > Preference: 10 > Input filter: ACCEPT > Output filter: ACCEPT > Routes: 1 imported, 0 exported, 1 preferred > Route change stats: received rejected filtered ignored > accepted > Import updates: 1 0 0 0 > 1 > Import withdraws: 0 0 --- 0 > 0 > Export updates: 1 1 0 --- > 0 > Export withdraws: 0 --- --- --- > 0 > device1 Device master up 07:48:44 > Preference: 240 > Input filter: ACCEPT > Output filter: REJECT > Routes: 0 imported, 0 exported, 0 preferred > Route change stats: received rejected filtered ignored > accepted > Import updates: 0 0 0 0 > 0 > Import withdraws: 0 0 --- 0 > 0 > Export updates: 0 0 0 --- > 0 > Export withdraws: 0 --- --- --- > 0 > testbgp BGP master start 07:48:44 Idle > Preference: 160 > Input filter: ACCEPT > Output filter: (unnamed) > Routes: 0 imported, 0 exported, 0 preferred > Route change stats: received rejected filtered ignored > accepted > Import updates: 0 0 0 0 > 0 > Import withdraws: 0 0 --- 0 > 0 > Export updates: 0 0 0 --- > 0 > Export withdraws: 0 --- --- --- > 0 > BGP state: Idle > Neighbor address: 10.1.2.2 > Neighbor AS: 65003 > bird> > [root@ip-172-31-15-8 ~]# Please let me know if the above configurations are correct and is the right approach to setup redundant route based VPN using VTI. I have couple of followup questions like how do i test failover between the two IPSec VPN servers using VTI and how do i test BIRD Daemon using BGP as i have configured BIRD on both the servers for the network architecture shown in https://i.imgur.com/dLFovre.png Thanks in Advance and your help will be really appreciated. I look forward to hearing from you. Best Regards, Kaushal

2 2

Re: VTI route not set
by Alexander Velkov 18 Apr '18

18 Apr '18

Hi Ruben, thank you very much for the answer! Ah, you are right. This is one of the constraints in bird that I don't fully understand. I have two types of routes - device and gateway ones. - in case I have a route to a gateway then the route should not be set if I have no IP connectivity to reach the gateway - in case I have a device route then why should I need an IP, I have the 'check link' option that could check if the interface is really UP and RUNNING and set the route accordingly Cheers Alexander Velkov On Wed, Apr 18, 2018 at 2:26 PM, Alexander Velkov <alvel85(a)googlemail.com> wrote: > Hi Ruben, > > thank you very much for the answer! > > Ah, you are right. > This is one of the constraints in bird that I don't fully understand. > I have two types of routes - device and gateway ones. > - in case I have a route to a gateway then the route should not be set > if I have no IP connectivity to reach the gateway > - in case I have a device route then why should I need an IP, I have the > 'check link' option that could check if the interface is really UP and > RUNNING and set the route accordingly > > Cheers > Alexander Velkov > > On Wed, Apr 18, 2018 at 9:58 AM, Ruben Laban <r.laban%2Blists(a)ism.nl> wrote: > >> Hi Alexander, >> >> On 17/04/2018 18:01, Alexander Velkov wrote: >> >>> This route is never set unless I configure an IP address on the VTI >>> interface. If I repeat the same steps and use Quagga instead of Bird then >>> route is set. >>> >> >> An interface without IP assigned is marked as "down" as far as bird's >> concerned. Pretty sure that's the reason behind this behavior. >> >> Regards, >> Ruben >> >> >

2 2

Bird 1.5 and 1.6 memory leak
by Willy Goiffon 18 Apr '18

18 Apr '18

Hello, I installed different version of bird on Ubuntu 16.04 (namely, 1.5.0, 1.6.3, 1.6.4). After leaving the daemon running for ~1 hour, the memory used by the host is over 8Gib. However, when running `birdc show memory`, I get the following: BIRD memory usage Routing tables: 21 kB Route attributes: 11 kB ROA tables: 192 B Protocols: 22 kB Total: 102 kB My config is pretty basic (edited, see attached) as we have 2 BGP protocols using 2 ASN (one public, one private), each exporting the routes learnt from the other. The leak seems to be related to the traffic going through the server, as the memory of the host remains still when there is no traffic going on. It is triggered by bird though, because I don't have the leak when the routes are configured statically and bird is shut down. The weird thing about this is that the memory is not used by the bird process itself. It's shown as used memory by the host, but no process is actually using this memory. I know that it's leaking because of bird though because it's the only process installed and running on this host. Has anyone ever encountered such a behavior, or can see an issue in my configuration? Thanks in advance for your help -- Willy

6 7

VTI route not set
by Alexander Velkov 18 Apr '18

18 Apr '18

Hello, I configure a VTI interface with 'ip link add vti0 type vti local aa.bb.cc.dd remote aa.bb.cc.de' # bird --version BIRD version 1.6.4 # ifconfig vti0 vti0 Link encap:UNSPEC HWaddr C0-A8-03-03-00-00-00-00-00-00-00-00-00-00-00-00 inet6 addr: fe80::5efe:c0a8:303/64 Scope:Link UP POINTOPOINT RUNNING NOARP MULTICAST MTU:1364 Metric:1 RX packets:0 errors:0 dropped:0 overruns:0 frame:0 TX packets:3 errors:1 dropped:0 overruns:0 carrier:1 collisions:0 txqueuelen:1000 RX bytes:0 (0.0 B) TX bytes:252 (252.0 B) I configure bird with a static device route through that interface: ... protocol device { scan time 10; # Scan interfaces every 10 seconds } protocol direct testD { interface "*"; } protocol static testS{ route 10.20.0.0/24 via "vti0"; } ... This route is never set unless I configure an IP address on the VTI interface. If I repeat the same steps and use Quagga instead of Bird then route is set. Am I missing something in the configuration? Best regards Alexander Velkov

2 1

BGP attribute ext-next-hop
by Arvin Gan 18 Apr '18

18 Apr '18

Hi all, The version of my bird is 2.0.0, I found the source code of bird can support the attribute ext_next_hop for BGP, and this attribute is also parsed in cf-parse.y, but cannot found in user's guide document. Does anyone know what configuration is coherent with the attribute ext_next_hop? Is the attribute ext_next_hop fully supported in version 2.0.0 ? Thanks Arvin

2 9

does bird 2.0 support administrative distance for routing protocol
by Derek Pan 16 Apr '18

16 Apr '18

Hi All, I want to implement the AD (administrative distance) function like cisco by using bird 2.0.0 but I have no idea. does anyone know how to configure it? Many thanks in advance. Best regards, Derek Pan ADVA Shenzhen

2 2