Using RAdv and trigger routes with multiple interfaces
Hi, I'm trying to set up conditional RA transmission from BIRD 1.3.11 on a firewall pair running Keepalived for HA/failover. My goal is to start emitting RAs on an interface as soon as Keepalived adds an IPv6 address on it, and start suppressing the RAs (i.e., sending with router lifetime=0) as soon as Keepalived removes it. On first look, it would appear that the "trigger" option is exactly what I need. However, I ran into the a problem - it appears to be global for the entire radv protocol instead of being per-interface, and that I cannot seem to work around limitation that by setting up multiple (one per interface) instances of the protocol either. To be more specific, assume that I have two interfaces with the following virtual IPs controlled by Keepalived: vlan100 = 2001:db8:100::1/64 vlan200 = 2001:db8:200::1/64 I would have liked to do something like: protocol radv { interface "vlan100" { trigger 2001:db8:100::/64; # <-- syntax error on this line }; interface "vlan200" { trigger 2001:db8:200::/64; }; } ...but that only gives me a syntax error on the line marked. So I tried the following instead, which also resulted in a syntax error: protocol radv vlan100 { # <-- syntax error on this line interface "vlan100"; trigger 2001:db8:100::/64; } protocol radv vlan200 { interface "vlan200"; trigger 2001:db8:200::/64; } Am I missing something obvious here or is the trigger feature only useful on routers with a single network interface? Best regards, Tore Anderson
On Fri, Nov 29, 2013 at 03:34:25PM +0100, Tore Anderson wrote:
Hi,
On first look, it would appear that the "trigger" option is exactly what I need. However, I ran into the a problem - it appears to be global for the entire radv protocol instead of being per-interface, and that I cannot seem to work around limitation that by setting up multiple (one per interface) instances of the protocol either. ... Am I missing something obvious here or is the trigger feature only useful on routers with a single network interface?
Well, your use case wasn't the one i have in mind for 'trigger' feature. I expected trigger to be like default route. But your use case should work with multiple radv instances.
...but that only gives me a syntax error on the line marked. So I tried the following instead, which also resulted in a syntax error:
protocol radv vlan100 { # <-- syntax error on this line interface "vlan100"; trigger 2001:db8:100::/64; }
This works for me. Perhaps you have some define for symbol vlan100, or some other problem? -- Elen sila lumenn' omentielvo Ondrej 'SanTiago' Zajicek (email: santiago@crfreenet.org) OpenPGP encrypted e-mails preferred (KeyID 0x11DEADC3, wwwkeys.pgp.net) "To err is human -- to blame it on a computer is even more so."
* Ondrej Zajicek
Well, your use case wasn't the one i have in mind for 'trigger' feature. I expected trigger to be like default route. But your use case should work with multiple radv instances.
Indeed it does! My bug was (I think) that I had a hyphen in the protocol instance name. At least it works now, using quotes. Thanks for letting me know it ought to have worked. :-) For future Googlers' reference, here's the config I'm converging on, which seems to work and gives an acceptable fail-over time (30s): protocol radv 'radv-vlan100' { export filter { # Only consider on-link routes, if gw is set we've learned # the route elsewhere (probably from the other firewall # via OSPF) and in that case the RAs should be suppressed if gw = :: then accept; reject; }; trigger 2001:db8:100::/64; rdnss { ns 2001:db8::1; lifetime 2419200; }; interface "vlan100" { max ra interval 5; default lifetime 30; }; } [repeat as necessary] It's a bit more expressive than I would have liked, but I can live with that. It would have been nice if instead of a trigger prefix I could say for example that the trigger is "pulled" if, and only if, there is a prefix to announce in a RA Prefix Information Option (this information must necessarily be available to the radvd protocol, as it by default will automatically include a corresponding PIO if there's a globally scoped address/prefix on the interface). Best regards, Tore Anderson
participants (2)
-
Ondrej Zajicek -
Tore Anderson