- Bird-users - Mailing Lists

Setting MED (?) for a specific BGP route
by Michal Ludvig 07 Apr '12

07 Apr '12

Hi guys I've got a network with two BGP routers (60.234.a.b and 121.98.a.b) with a single upstream ISP for both. I also have an OSPF setup between the routers. Both runing Bird 1.3.4. Each router has a "local" directly attached DMZ subnet (60.234.x.224/28 and 121.98.x.208/28) and exports that to BGP. It also receives the other router's DMZ address through OSPF and re-exports that to BGP as well. I'm not very familiar with BGP but it seems to work pretty well. From outside the traffic to DMZ 60 goes straight to router 60 and the traffic to DMZ 121 goes straight to router 121. Now I moved part of the 60 subnet (one /32 for now) to the 121 DMZ and here's what the routers export: router 60 birdc> show route export bgp_orcon 60.234.x.224/28 dev eth1 [direct1 Mar13] * (240) 60.234.x.236/32 via 172.31.253.2 on tunO2Oorc4 [ospf_eit Mar16] * E2 (150/10/10000) [121.98.a.b] 121.98.x.208/28 via 172.31.253.2 on tunO2Oorc4 [ospf_eit Mar13] * E2 (150/10/10000) [121.98.a.b] router 121 birdc> show route export bgp_orcon 60.234.x.224/28 via 172.31.253.1 on tunO2Oorc4 [ospf_eit Mar13] * E2 (150/10/10000) [60.234.a.b] 60.234.x.236/32 via 121.98.x.221 on vlan121 [kernel1 Mar20] * (10) 121.98.x.208/28 dev vlan121 [direct1 Mar13] * (240) The ISP is happy to accept /32's from us but for some reason traceroute to 60.234.x.236/32 still goes to the router 60 instead of router 121. The ISP suggested to alter MED or prepend our ASN once again to the /32 announcements on the router 60 to give precedence to the router 121. I tried prepending the ASN on router 60 with: export filter { if source = RTS_OSPF then { bgp_path.prepend(64526); } [...] } But that didn't make any difference. Now I've got these questions: 1. How do I alter MED for a specific route on one of the routers? 2. How can I get more details about the exported routes? Like the MED, BGP path, etc? Just to make sure my filters do what I want them to do. Thanks for any pointers! Michal

2 4

v1.3.7 incorrectly tagged in git repository
by Henrique de Moraes Holschuh 05 Apr '12

05 Apr '12

tag v1.3.7 should have been applied to commit 16fc65acc536d3788efe4c0554a2f52699fedc7f "Minor correction". (at least, that's what matches the 1.3.7 tarball). Instead, the tag was applied to HEAD, so it has a few more commits than what is shipped in version 1.3.7. -- "One disk to rule them all, One disk to find them. One disk to bring them all and in the darkness grind them. In the Land of Redmond where the shadows lie." -- The Silicon Valley Tarot Henrique Holschuh

2 1

ML discards some messages?
by Alexander V. Chernikov 02 Apr '12

02 Apr '12

Hello list! What is appropriate mail address to send messages to? From previous postings I see (sorted by popularity DESC): * bird-users(a)network.cz * bird-users(a)trubka.network.cz * bird-users(a)atrey.karlin.mff.cuni.cz * bird-users(a)bird.network.cz I send messages mostly to @network.cz domain and _sometimes_ they are silently discarded somewhere: 12:54 [0] bibibi# grep -A2 1SERey-000O5t-0U /var/log/exim/mainlog 2012-04-02 00:46:00 1SERey-000O5t-0U <= melifaro(a)ipfw.ru H=v6.mpls.in (ws.su29.net) [2a02:978:2::5] P=esmtpsa X=TLSv1:CAMELLIA256-SHA:256 A=cram:melifaro@ipfw.ru S=1724 id%3D4F78BE7E.9020206(a)ipfw.ru 2012-04-02 00:46:00 1SERey-000O5t-0U mamlas.feela.net [2001:1ab0:7e1e:d150::2:100] Connection refused 2012-04-02 00:46:00 1SERey-000O5t-0U mamlas.feela.net [217.31.57.209] Connection refused 2012-04-02 00:46:09 1SERey-000O5t-0U => bird-users(a)network.cz R=dnslookup T=remote_smtp H=trubka.network.cz [2001:1568:b::145] X=TLSv1:DHE-RSA-AES256-SHA:256 2012-04-02 00:46:09 1SERey-000O5t-0U Completed Unfortunately, remote SMTP answer was not logged but I suppose 'Completed' without any previous error means that '250 OK' has been received. However, I can't see this message neither in my 2 different mailboxes nor in "unofficial ML archive" at http://marc.info/?l=bird-users Am I missing something? -- WBR, Alexander

2 1

Criating a static route in a filter or function.
by Kalil de A. Carvalho 29 Mar '12

29 Mar '12

Hello all. It is possible create a static route in a filter or function? If yes, could anyone gave me a example? Best regards. -- Kalil de A. Carvalho CCNA

1 0

Implementing RTBH filtering / BGP tagging
by Gregg Berkholtz 28 Mar '12

28 Mar '12

In working to streamline our utilization of each upstream's RTBH filtering mechanisms (e.g. http://www.he.net/adm/blackhole.html ), I'm having a heck of a time configuring BIRD to "mirror" Cisco product behaviors. Here's the Cisco Way (where X.X.X.X is the ip to blackhole): conf t ip route X.X.X.X 255.255.255.255 Null0 router bgp YourAS network X.X.X.X mask 255.255.255.255 route-map blackhole route-map blackhole permit 10 set community 6939:666 end What I believe needs to happen w/ BIRD, and the Linux Kernel route tables: 1) Create and maintain a non-default Linux kernel route table, to accomplish blackholing at our gateways (working great). Also wanting to have BIRD to monitor this non-default route table, and :666 tag+announce upstream any /32 entries within our 199.127.224.0/22. 2) BIRD imports the non-default kernel route table (seems to be working ok). 3) For each "protocol bgp *Upstream*", use an export filter to identify and tag relevant "blackhole" route entries with a specific RTBH community (e.g. 6939:666)...this is what I'm struggling with. While snippets are below, our entire bird.conf (minus comments) can be found at: http://pastebin.com/xE1AxtGe Here's my breakdown of what seems to be happening: 1) Create/edit/update the non-default kernel route table (works great, the Linux kernel/route config drops this traffic without issue): "... ~$ sudo ip rule add from all table 10 priority 10; sudo ip route add blackhole 199.127.225.73/32 table 10; ..... ~$ sudo ip route show table 10 |wc -l 456 ~$ sudo ip rule 0: from all lookup local 10: from all lookup 10 ..." 2) Read the non-default kernel route table (from bird.conf): "... table blackroutes; protocol kernel blackhole { table blackroutes; kernel table 10; scan time 10; learn; import all; export all; } ..." BIRD seems to import the non-default kernel table without issue: "... ~$ sudo birdc show protocols all |grep blackhole -C 10 blackhole Kernel blackroutes up Mar17 Preference: 10 Input filter: ACCEPT Output filter: ACCEPT Routes: 454 imported, 0 exported, 454 preferred Route change stats: received rejected filtered ignored accepted Import updates: 1363 0 0 0 1363 Import withdraws: 909 0 --- 0 909 Export updates: 1363 1363 0 --- 0 Export withdraws: 909 --- --- --- 0 ~$ sudo ip route show table 10 |wc -l 456 ..." BTW: the bulk of our "blacklist" entries come from http://www.spamhaus.org/drop/drop.lasso, although we only want to tag+announce what we control (e.g. /32's within 199.127.224.0/22). 3) Can't seem to figure out correct tagging method/commands (from bird.conf): "... filter bgp_out_he { if (proto = "blackhole" ) then { bgp_community = -empty-; bgp_community.add((6939,666)); } if net ~ [65.49.94.0/24] then accept; if net ~ [199.127.224.0/22] then accept; reject; } ... protocol bgp HE { local as 14613; source address 65.19.175.14; neighbor 65.19.175.13 as 6939; import all; ... export filter bgp_out_he; } ..." Am I missing something obvious? Going about this the wrong way? Thanks greatly for any help, Gregg Berkholtz

4 5

Distributing default route dynamically through OSPF / passive interfaces
by Thomas York 28 Mar '12

28 Mar '12

I am looking to replace Quagga with Bird for our OSPF deployment. Currently, we have all of our plants with PtP links (either through PtP T1s or OpenVPN links). We use static routes to get the tunnels and such up, then distribute routes (including a default route) via OSPF (using costs to designate a primary interface). This works great currently. However, Quagga has terrible OSPFv3 support (especially with distributing a default route) so I'm looking to move to Bird. I have two VMs configured with 2 dummy interfaces per (to simulate two routers-on-a-stick). One of the routers has a default route set on one of its dummy interface (router1, dummy0). I have routes being distributed back and forth without issue. However, I can't seem to get router1 to distribute its default route to router2. Below are some IPs and sample configs. My other issue is that there isn't a passive directive for OSPF (at least, according to the documentation). I would like to prevent the accepting/broadcasting of OSPF data on the dummy interfaces. Is there an easy way to do this without firewalling? Thanks! IPs - http://pastebin.com/iA7z5mhP Bird.conf for router1 - http://pastebin.com/xDCvsARL Bird.conf for router2 - http://pastebin.com/nxxSREef --Thomas York

2 1

One router - Two ASN
by Miłosz Oller 27 Mar '12

27 Mar '12

Hi How can I run two asn on one router? Example: ISP1 | --------------- | AS1 - AS2 | --------------- | ISP2 ISP1 is connected to AS1, ISP2 is connected to AS2. How can I configure connection AS1-AS2 with bgp protocol on localhost (neighbor ip and source address)? -- Miłosz

5 9

Probe neighbor
by Kalil de A. Carvalho 27 Mar '12

27 Mar '12

Hello list. I'm new BIRD user and I'm going to test at company where I work. I know the BGP has the ability to test if neighbor is working or not. But I want to make a filter or function to detect if the neighbor is up or down and this test it's running all time. Anyone has ideia if is possible. If yes, could tell me who can I do that? Thanks a lot.

1 0

Show inverted filter result
by Matej Vadnjal 26 Mar '12

26 Mar '12

Hi list. Is there an easy way to list routes that do NOT match filter? I can do "show route filter f_myfilter" to list routes that would match filter. I'm hoping for something like "show route filter !f_myfilter" to list routes that would be rejected. I'd like to display routes rejected in a pipe protocol between two routing tables so I still have all routes that are rejected by filter in BIRD. Kind regards Matej Vadnjal Arnes

4 7

feature request: move some symbol classes to their own namespaces
by Henrique de Moraes Holschuh 26 Mar '12

26 Mar '12

Would it be possible to create separate namespaces for routing table, protocol and template symbols? Or maybe one for routing table symbols and another for both protocol and template symbols? Currently, everything is in the same namespace, so you cannot have a numeric constant and a routing table with the same name, etc. -- "One disk to rule them all, One disk to find them. One disk to bring them all and in the darkness grind them. In the Land of Redmond where the shadows lie." -- The Silicon Valley Tarot Henrique Holschuh

1 0