diff options
Diffstat (limited to 'docs/configuration/protocols')
| -rw-r--r-- | docs/configuration/protocols/md-babel.md | 294 | ||||
| -rw-r--r-- | docs/configuration/protocols/md-bfd.md | 259 | ||||
| -rw-r--r-- | docs/configuration/protocols/md-bgp.md | 1683 | ||||
| -rw-r--r-- | docs/configuration/protocols/md-failover.md | 131 | ||||
| -rw-r--r-- | docs/configuration/protocols/md-igmp-proxy.md | 88 | ||||
| -rw-r--r-- | docs/configuration/protocols/md-index.md | 20 | ||||
| -rw-r--r-- | docs/configuration/protocols/md-isis.md | 662 | ||||
| -rw-r--r-- | docs/configuration/protocols/md-mpls.md | 419 | ||||
| -rw-r--r-- | docs/configuration/protocols/md-ospf.md | 1772 | ||||
| -rw-r--r-- | docs/configuration/protocols/md-pim.md | 345 | ||||
| -rw-r--r-- | docs/configuration/protocols/md-pim6.md | 122 | ||||
| -rw-r--r-- | docs/configuration/protocols/md-rip.md | 361 | ||||
| -rw-r--r-- | docs/configuration/protocols/md-rpki.md | 238 | ||||
| -rw-r--r-- | docs/configuration/protocols/md-segment-routing.md | 442 | ||||
| -rw-r--r-- | docs/configuration/protocols/md-static.md | 322 |
15 files changed, 7158 insertions, 0 deletions
diff --git a/docs/configuration/protocols/md-babel.md b/docs/configuration/protocols/md-babel.md new file mode 100644 index 00000000..8bca4a71 --- /dev/null +++ b/docs/configuration/protocols/md-babel.md @@ -0,0 +1,294 @@ +# Babel + +Babel is a modern routing protocol designed to be robust and efficient +both in ordinary wired networks and in wireless mesh networks. +By default, it uses hop-count on wired networks and a variant of ETX +on wireless links, It can be configured to take radio diversity into account +and to automatically compute a link's latency and include it in the metric. +It is defined in `8966`. + +Babel a dual stack protocol. +A single Babel instance is able to perform routing for both IPv4 and IPv6. + +## General Configuration + +VyOS does not have a special command to start the Babel process. +The Babel process starts when the first Babel enabled interface is configured. + +<div class="cfgcmd"> + +set protocols babel interface \<interface\> + +This command specifies a Babel enabled interface by interface name. Both +the sending and receiving of Babel packets will be enabled on the interface +specified in this command. + +</div> + +## Optional Configuration + +<div class="cfgcmd"> + +set protocols babel parameters diversity + +This command enables routing using radio frequency diversity. +This is highly recommended in networks with many wireless nodes. + +> <div class="note"> +> +> <div class="title"> +> +> Note +> +> </div> +> +> If you enable this, you will probably want to +> set diversity-factor and channel below. +> +> </div> + +</div> + +<div class="cfgcmd"> + +set protocols babel parameters diversity-factor \<1-256\> + +This command sets the multiplicative factor used for diversity routing, +in units of 1/256; lower values cause diversity to play a more important role +in route selection. +The default it 256, which means that diversity plays no role in route +selection; you will probably want to set that to 128 or less on nodes +with multiple independent radios. + +</div> + +<div class="cfgcmd"> + +set protocols babel parameters resend-delay \<milliseconds\> + +This command specifies the time in milliseconds after which an 'important' +request or update will be resent. The default is 2000 ms. + +</div> + +<div class="cfgcmd"> + +set protocols babel parameters smoothing-half-life \<seconds\> + +This command specifies the time constant, in seconds, of the smoothing +algorithm used for implementing hysteresis. +Larger values reduce route oscillation at the cost of very slightly increasing +convergence time. The value 0 disables hysteresis, and is suitable for wired +networks. The default is 4 s. + +</div> + +## Interfaces Configuration + +<div class="cfgcmd"> + +set protocols babel interface \<interface\> type \<auto[|wired|](##SUBST##|wired|)wireless\> + +This command sets the interface type: + +**auto** – automatically determines the interface type. +**wired** – enables optimisations for wired interfaces. +**wireless** – disables a number of optimisations that are only correct +on wired interfaces. Specifying wireless is always correct, +but may cause slower convergence and extra routing traffic. + +</div> + +<div class="cfgcmd"> + +set protocols babel interface \<interface\> split-horizon \<default[|disable|](##SUBST##|disable|)enable\> + +This command specifies whether to perform split-horizon on the interface. +Specifying no babel split-horizon is always correct, while babel split-horizon +is an optimisation that should only be used on symmetric +and transitive (wired) networks. + +**default** – enable split-horizon on wired interfaces, and disable +split-horizon on wireless interfaces. +**enable** – enable split-horizon on this interfaces. +**disable** – disable split-horizon on this interfaces. + +</div> + +<div class="cfgcmd"> + +set protocols babel interface \<interface\> hello-interval \<milliseconds\> + +This command specifies the time in milliseconds between two scheduled hellos. +On wired links, Babel notices a link failure within two hello intervals; +on wireless links, the link quality value is reestimated at every hello +interval. +The default is 4000 ms. + +</div> + +<div class="cfgcmd"> + +set protocols babel interface \<interface\> update-interval \<milliseconds\> + +This command specifies the time in milliseconds between two scheduled updates. +Since Babel makes extensive use of triggered updates, +this can be set to fairly high values on links with little packet loss. +The default is 20000 ms. + +</div> + +<div class="cfgcmd"> + +set protocols babel interface \<interface\> rxcost \<1-65534\> + +This command specifies the base receive cost for this interface. +For wireless interfaces, it specifies the multiplier used for computing +the ETX reception cost (default 256); +for wired interfaces, it specifies the cost that will be advertised to +neighbours. + +</div> + +<div class="cfgcmd"> + +set protocols babel interface \<interface\> rtt-decay \<1-256\> + +This command specifies the decay factor for the exponential moving average +of RTT samples, in units of 1/256. +Higher values discard old samples faster. The default is 42. + +</div> + +<div class="cfgcmd"> + +set protocols babel interface \<interface\> rtt-min \<milliseconds\> + +This command specifies the minimum RTT, in milliseconds, +starting from which we increase the cost to a neighbour. +The additional cost is linear in (rtt - rtt-min). The default is 10 ms. + +</div> + +<div class="cfgcmd"> + +set protocols babel interface \<interface\> rtt-max \<milliseconds\> + +This command specifies the maximum RTT, in milliseconds, above which +we don't increase the cost to a neighbour. The default is 120 ms. + +</div> + +<div class="cfgcmd"> + +set protocols babel interface \<interface\> max-rtt-penalty \<milliseconds\> + +This command specifies the maximum cost added to a neighbour because of RTT, +i.e. when the RTT is higher or equal than rtt-max. +The default is 150. +Setting it to 0 effectively disables the use of a RTT-based cost. + +</div> + +<div class="cfgcmd"> + +set protocols babel interface \<interface\> enable-timestamps + +This command enables sending timestamps with each Hello and IHU message +in order to compute RTT values. +It is recommended to enable timestamps on tunnel interfaces. + +</div> + +<div class="cfgcmd"> + +set protocols babel interface \<interface\> channel \<1-254[|interfering|](##SUBST##|interfering|)noninterfering\> + +This command set the channel number that diversity routing uses for this +interface (see diversity option above). + +**1-254** – interfaces with a channel number interfere with +interfering interfaces and interfaces with the same channel number. +**interfering** – interfering interfaces are assumed to interfere with all other channels except +noninterfering channels. +**noninterfering** – noninterfering interfaces are assumed to only interfere +with themselves. + +</div> + +## Redistribution Configuration + +<div class="cfgcmd"> + +set protocols babel redistribute \<ipv4|ipv6\> \<route source\> + +This command redistributes routing information from the given route source +to the Babel process. + +IPv4 route source: bgp, connected, eigrp, isis, kernel, nhrp, ospf, rip, static. + +IPv6 route source: bgp, connected, eigrp, isis, kernel, nhrp, ospfv3, ripng, static. + +</div> + +<div class="cfgcmd"> + +set protocols babel distribute-list \<ipv4[|ipv6\> access-list \<in|](##SUBST##|ipv6> access-list <in|)out\> \<number\> + +This command can be used to filter the Babel routes using access lists. +`in` and `out` this is the direction in which the access +lists are applied. + +</div> + +<div class="cfgcmd"> + +set protocols babel distribute-list \<ipv4[|ipv6\> interface \<interface\> access-list \<in|](##SUBST##|ipv6> interface <interface> access-list <in|)out\> \<number\> + +This command allows you apply access lists to a chosen interface to +filter the Babel routes. + +</div> + +<div class="cfgcmd"> + +set protocols babel distribute-list \<ipv4[|ipv6\> prefix-list \<in|](##SUBST##|ipv6> prefix-list <in|)out\> \<name\> + +This command can be used to filter the Babel routes using prefix lists. +`in` and `out` this is the direction in which the prefix +lists are applied. + +</div> + +<div class="cfgcmd"> + +set protocols babel distribute-list \<ipv4[|ipv6\> interface \<interface\> prefix-list \<in|](##SUBST##|ipv6> interface <interface> prefix-list <in|)out\> \<name\> + +This command allows you apply prefix lists to a chosen interface to +filter the Babel routes. + +</div> + +## Configuration Example + +Simple Babel configuration using 2 nodes and redistributing connected interfaces. + +**Node 1:** + +``` none +set interfaces loopback lo address 10.1.1.1/32 +set interfaces loopback lo address fd12:3456:dead:beef::1/128 +set protocols babel interface eth0 type wired +set protocols babel redistribute ipv4 connected +set protocols babel redistribute ipv6 connected +``` + +**Node 2:** + +``` none +set interfaces loopback lo address 10.2.2.2/32 +set interfaces loopback lo address fd12:3456:beef:dead::2/128 +set protocols babel interface eth0 type wired +set protocols babel redistribute ipv4 connected +set protocols babel redistribute ipv6 connected +``` diff --git a/docs/configuration/protocols/md-bfd.md b/docs/configuration/protocols/md-bfd.md new file mode 100644 index 00000000..58582008 --- /dev/null +++ b/docs/configuration/protocols/md-bfd.md @@ -0,0 +1,259 @@ +lastproofread +2023-01-27 + +# BFD + +`BFD (Bidirectional Forwarding Detection)` is described and extended by +the following RFCs: `5880`, `5881` and `5883`. + +In the age of very fast networks, a second of unreachability may equal millions of lost packets. +The idea behind BFD is to detect very quickly when a peer is down and take action extremely fast. + +BFD sends lots of small UDP packets very quickly to ensures that the peer is still alive. + +This allows avoiding the timers defined in BGP and OSPF protocol to expires. + +## Configure BFD + +<div class="cfgcmd"> + +set protocols bfd peer \<address\> + +Set BFD peer IPv4 address or IPv6 address + +</div> + +<div class="cfgcmd"> + +set protocols bfd peer \<address\> echo-mode + +Enables the echo transmission mode + +</div> + +<div class="cfgcmd"> + +set protocols bfd peer \<address\> multihop + +Allow this BFD peer to not be directly connected + +</div> + +<div class="cfgcmd"> + +set protocols bfd peer \<address\> source +\[address \<address\> | interface \<interface\>\] + +Bind listener to specific interface/address, mandatory for IPv6 + +</div> + +<div class="cfgcmd"> + +set protocols bfd peer \<address\> interval echo-interval \<10-60000\> + +The minimal echo receive transmission interval that this system is +capable of handling + +</div> + +<div class="cfgcmd"> + +set protocols bfd peer \<address\> interval multiplier \<2-255\> + +Remote transmission interval will be multiplied by this value + +</div> + +<div class="cfgcmd"> + +set protocols bfd peer \<address\> interval +\[receive | transmit\] \<10-60000\> + +Interval in milliseconds + +</div> + +<div class="cfgcmd"> + +set protocols bfd peer \<address\> shutdown + +Disable a BFD peer + +</div> + +<div class="cfgcmd"> + +set protocols bfd peer \<address\> minimum-ttl \<1-254\> + +For multi hop sessions only. Configure the minimum expected TTL for an +incoming BFD control packet. + +This feature serves the purpose of thightening the packet validation +requirements to avoid receiving BFD control packets from other sessions. + +</div> + +### Enable BFD in BGP + +<div class="cfgcmd"> + +set protocols bgp neighbor \<neighbor\> bfd + +Enable BFD on a single BGP neighbor + +</div> + +<div class="cfgcmd"> + +set protocols bgp peer-group \<neighbor\> bfd + +Enable BFD on a BGP peer group + +</div> + +### Enable BFD in OSPF + +<div class="cfgcmd"> + +set protocols ospf interface \<interface\> bfd + +Enable BFD for OSPF on an interface + +</div> + +<div class="cfgcmd"> + +set protocols ospfv3 interface \<interface\> bfd + +Enable BFD for OSPFv3 on an interface + +</div> + +### Enable BFD in ISIS + +<div class="cfgcmd"> + +set protocols isis \<name\> interface \<interface\> bfd + +Enable BFD for ISIS on an interface + +</div> + +## Operational Commands + +<div class="opcmd"> + +show bfd peers + +Show all BFD peers + +``` none +BFD Peers: + peer 198.51.100.33 vrf default interface eth4.100 + ID: 4182341893 + Remote ID: 12678929647 + Status: up + Uptime: 1 month(s), 16 hour(s), 29 minute(s), 38 second(s) + Diagnostics: ok + Remote diagnostics: ok + Local timers: + Receive interval: 300ms + Transmission interval: 300ms + Echo transmission interval: 50ms + Remote timers: + Receive interval: 300ms + Transmission interval: 300ms + Echo transmission interval: 0ms + + peer 198.51.100.55 vrf default interface eth4.101 + ID: 4618932327 + Remote ID: 3312345688 + Status: up + Uptime: 20 hour(s), 16 minute(s), 19 second(s) + Diagnostics: ok + Remote diagnostics: ok + Local timers: + Receive interval: 300ms + Transmission interval: 300ms + Echo transmission interval: 50ms + Remote timers: + Receive interval: 300ms + Transmission interval: 300ms + Echo transmission interval: 0ms +``` + +</div> + +## BFD Static Route Monitoring + +A monitored static route conditions the installation to the RIB on the BFD +session running state: when BFD session is up the route is installed to RIB, +but when the BFD session is down it is removed from the RIB. + +### Configuration + +<div class="cfgcmd"> + +set protocols static route \<subnet\> next-hop \<address\> +bfd profile \<profile\> + +Configure a static route for \<subnet\> using gateway \<address\> +and use the gateway address as BFD peer destination address. + +</div> + +<div class="cfgcmd"> + +set protocols static route \<subnet\> next-hop \<address\> +bfd multi-hop source \<address\> profile \<profile\> + +Configure a static route for \<subnet\> using gateway \<address\> +, use source address to indentify the peer when is multi-hop session +and the gateway address as BFD peer destination address. + +</div> + +<div class="cfgcmd"> + +set protocols static route6 \<subnet\> next-hop \<address\> +bfd profile \<profile\> + +Configure a static route for \<subnet\> using gateway \<address\> +and use the gateway address as BFD peer destination address. + +</div> + +<div class="cfgcmd"> + +set protocols static route6 \<subnet\> next-hop \<address\> +bfd multi-hop source \<address\> profile \<profile\> + +Configure a static route for \<subnet\> using gateway \<address\> +, use source address to indentify the peer when is multi-hop session +and the gateway address as BFD peer destination address. + +</div> + +## Operational Commands + +<div class="opcmd"> + +show bfd static routes + +Showing BFD monitored static routes + +``` none +Showing BFD monitored static routes: + + Next hops: + VRF default IPv4 Unicast: + 10.10.13.3/32 peer 192.168.2.3 (status: installed) + 172.16.10.3/32 peer 192.168.10.1 (status: uninstalled) + + VRF default IPv4 Multicast: + + VRF default IPv6 Unicast: +``` + +</div> diff --git a/docs/configuration/protocols/md-bgp.md b/docs/configuration/protocols/md-bgp.md new file mode 100644 index 00000000..b5a91b3f --- /dev/null +++ b/docs/configuration/protocols/md-bgp.md @@ -0,0 +1,1683 @@ +# BGP + +`BGP (Border Gateway Protocol)` is one of the Exterior Gateway Protocols +and the de facto standard interdomain routing protocol. The latest BGP version +is 4. BGP-4 is described in `1771` and updated by `4271`. `2858` +adds multiprotocol support to BGP. + +VyOS makes use of `FRR (Free Range Routing)` and we would like to thank +them for their effort! + +## Basic Concepts + +### Autonomous Systems + +From `1930`: + +> An AS is a connected group of one or more IP prefixes run by one or more +> network operators which has a SINGLE and CLEARLY DEFINED routing policy. + +Each `AS (Autonomous System)` has an identifying number associated with it +called an `ASN (Autonomous System Number)`. This is a two octet value +ranging in value from 1 to 65535. The AS numbers 64512 through 65535 are defined +as private AS numbers. Private AS numbers must not be advertised on the global +Internet. The 2-byte AS number range has been exhausted. 4-byte AS numbers are +specified in `6793`, and provide a pool of 4294967296 AS numbers. + +The `ASN (Autonomous System Number)` is one of the essential elements of +BGP. BGP is a distance vector routing protocol, and the AS-Path framework +provides distance vector metric and loop detection to BGP. + +<div class="cfgcmd"> + +set protocols bgp system-as \<asn\> + +Set local `ASN (Autonomous System Number)` that this router represents. +This is a a mandatory option! + +</div> + +### Address Families + +Multiprotocol extensions enable BGP to carry routing information for multiple +network layer protocols. BGP supports an Address Family Identifier (AFI) for +IPv4 and IPv6. + +### Route Selection + +The route selection process used by FRR's BGP implementation uses the following +decision criterion, starting at the top of the list and going towards the +bottom until one of the factors can be used. + +1. **Weight check** + + Prefer higher local weight routes to lower routes. + +2. **Local preference check** + + Prefer higher local preference routes to lower. + +3. **Local route check** + + Prefer local routes (statics, aggregates, redistributed) to received routes. + +4. **AS path length check** + + Prefer shortest hop-count AS_PATHs. + +5. **Origin check** + + Prefer the lowest origin type route. That is, prefer IGP origin routes to + EGP, to Incomplete routes. + +6. **MED check** + + Where routes with a MED were received from the same AS, prefer the route + with the lowest MED. + +7. **External check** + + Prefer the route received from an external, eBGP peer over routes received + from other types of peers. + +8. **IGP cost check** + + Prefer the route with the lower IGP cost. + +9. **Multi-path check** + + If multi-pathing is enabled, then check whether the routes not yet + distinguished in preference may be considered equal. If + `bgp bestpath as-path multipath-relax` is set, all such routes are + considered equal, otherwise routes received via iBGP with identical AS_PATHs + or routes received from eBGP neighbours in the same AS are considered equal. + +10. **Already-selected external check** + + Where both routes were received from eBGP peers, then prefer the route + which is already selected. Note that this check is not applied if + `bgp bestpath compare-routerid` is configured. This check can + prevent some cases of oscillation. + +11. **Router-ID check** + + Prefer the route with the lowest <span class="title-ref">router-ID</span>. If the route has an + <span class="title-ref">ORIGINATOR_ID</span> attribute, through iBGP reflection, then that router ID is + used, otherwise the <span class="title-ref">router-ID</span> of the peer the route was received from is + used. + +12. **Cluster-List length check** + + The route with the shortest cluster-list length is used. The cluster-list + reflects the iBGP reflection path the route has taken. + +13. **Peer address** + + Prefer the route received from the peer with the higher transport layer + address, as a last-resort tie-breaker. + +### Capability Negotiation + +When adding IPv6 routing information exchange feature to BGP. There were some +proposals. `IETF (Internet Engineering Task Force)` +`IDR (Inter Domain Routing)` adopted a proposal called Multiprotocol +Extension for BGP. The specification is described in `2283`. The protocol +does not define new protocols. It defines new attributes to existing BGP. When +it is used exchanging IPv6 routing information it is called BGP-4+. When it is +used for exchanging multicast routing information it is called MBGP. + +*bgpd* supports Multiprotocol Extension for BGP. So if a remote peer supports +the protocol, *bgpd* can exchange IPv6 and/or multicast routing information. + +Traditional BGP did not have the feature to detect a remote peer's +capabilities, e.g. whether it can handle prefix types other than IPv4 unicast +routes. This was a big problem using Multiprotocol Extension for BGP in an +operational network. `2842` adopted a feature called Capability +Negotiation. *bgpd* use this Capability Negotiation to detect the remote peer's +capabilities. If a peer is only configured as an IPv4 unicast neighbor, *bgpd* +does not send these Capability Negotiation packets (at least not unless other +optional BGP features require capability negotiation). + +By default, FRR will bring up peering with minimal common capability for the +both sides. For example, if the local router has unicast and multicast +capabilities and the remote router only has unicast capability the local router +will establish the connection with unicast only capability. When there are no +common capabilities, FRR sends Unsupported Capability error and then resets the +connection. + +## Configuration + +### BGP Router Configuration + +First of all you must configure BGP router with the `ASN (Autonomous +System Number)`. The AS number is an identifier for the autonomous system. +The BGP protocol uses the AS number for detecting whether the BGP connection +is internal or external. VyOS does not have a special command to start the BGP +process. The BGP process starts when the first neighbor is configured. + +<div class="cfgcmd"> + +set protocols bgp system-as \<asn\> + +Set local autonomous system number that this router represents. This is a +mandatory option! + +</div> + +#### Peers Configuration + +##### Defining Peers + +<div class="cfgcmd"> + +set protocols bgp neighbor \<address|interface\> remote-as +\<nasn\> + +This command creates a new neighbor whose remote-as is \<nasn\>. The neighbor +address can be an IPv4 address or an IPv6 address or an interface to use +for the connection. The command is applicable for peer and peer group. + +</div> + +<div class="cfgcmd"> + +set protocols bgp neighbor \<address|interface\> remote-as +internal + +Create a peer as you would when you specify an ASN, except that if the +peers ASN is different than mine as specified under the `protocols +bgp <asn>` command the connection will be denied. + +</div> + +<div class="cfgcmd"> + +set protocols bgp neighbor \<address|interface\> remote-as +external + +Create a peer as you would when you specify an ASN, except that if the +peers ASN is the same as mine as specified under the `protocols +bgp <asn>` command the connection will be denied. + +</div> + +<div class="cfgcmd"> + +set protocols bgp neighbor \<address|interface\> local-role +\<role\> \[strict\] + +BGP roles are defined in RFC `9234` and provide an easy way to +add route leak prevention, detection and mitigation. The local Role +value is negotiated with the new BGP Role capability which has a +built-in check of the corresponding value. In case of a mismatch the +new OPEN Roles Mismatch Notification \<2, 11\> would be sent. +The correct Role pairs are: + +Provider - Customer + +Peer - Peer + +RS-Server - RS-Client + +If `strict` is set the BGP session won’t become established +until the BGP neighbor sets local Role on its side. This +configuration parameter is defined in RFC `9234` and is used to +enforce the corresponding configuration at your counter-parts side. + +Routes that are sent from provider, rs-server, or the peer local-role +(or if received by customer, rs-client, or the peer local-role) will +be marked with a new Only to Customer (OTC) attribute. + +Routes with this attribute can only be sent to your neighbor if your +local-role is provider or rs-server. Routes with this attribute can +be received only if your local-role is customer or rs-client. + +In case of peer-peer relationship routes can be received only if OTC +value is equal to your neighbor AS number. + +All these rules with OTC will help to detect and mitigate route leaks +and happen automatically if local-role is set. + +</div> + +<div class="cfgcmd"> + +set protocols bgp neighbor \<address|interface\> shutdown + +This command disable the peer or peer group. To reenable the peer use +the delete form of this command. + +</div> + +<div class="cfgcmd"> + +set protocols bgp neighbor \<address|interface\> description +\<text\> + +Set description of the peer or peer group. + +</div> + +<div class="cfgcmd"> + +set protocols bgp neighbor \<address[|interface\> update-source +\<address|](##SUBST##|interface> update-source +<address|)interface\> + +Specify the IPv4 source address to use for the BGP session to this neighbor, +may be specified as either an IPv4 address directly or as an interface name. + +</div> + +##### Capability Negotiation + +<div class="cfgcmd"> + +set protocols bgp neighbor \<address|interface\> capability +dynamic + +This command would allow the dynamic update of capabilities over an +established BGP session. + +</div> + +<div class="cfgcmd"> + +set protocols bgp neighbor \<address|interface\> capability +extended-nexthop + +Allow bgp to negotiate the extended-nexthop capability with it’s peer. +If you are peering over a IPv6 Link-Local address then this capability +is turned on automatically. If you are peering over a IPv6 Global Address +then turning on this command will allow BGP to install IPv4 routes with +IPv6 nexthops if you do not have IPv4 configured on interfaces. + +</div> + +<div class="cfgcmd"> + +set protocols bgp neighbor \<address|interface\> +disable-capability-negotiation + +Suppress sending Capability Negotiation as OPEN message optional +parameter to the peer. This command only affects the peer is +configured other than IPv4 unicast configuration. + +When remote peer does not have capability negotiation feature, +remote peer will not send any capabilities at all. In that case, +bgp configures the peer with configured capabilities. + +You may prefer locally configured capabilities more than the negotiated +capabilities even though remote peer sends capabilities. If the peer is +configured by `override-capability`, VyOS ignores received +capabilities then override negotiated capabilities with configured values. + +Additionally you should keep in mind that this feature fundamentally +disables the ability to use widely deployed BGP features. BGP unnumbered, +hostname support, AS4, Addpath, Route Refresh, ORF, Dynamic Capabilities, +and graceful restart. + +</div> + +<div class="cfgcmd"> + +set protocols bgp neighbor \<address|interface\> +override-capability + +This command allow override the result of Capability Negotiation with +local configuration. Ignore remote peer’s capability value. + +</div> + +<div class="cfgcmd"> + +set protocols bgp neighbor \<address|interface\> +strict-capability-match + +This command forces strictly compare remote capabilities and local +capabilities. If capabilities are different, send Unsupported Capability +error then reset connection. + +You may want to disable sending Capability Negotiation OPEN message +optional parameter to the peer when remote peer does not implement +Capability Negotiation. Please use `disable-capability-negotiation` +command to disable the feature. + +</div> + +##### Peer Parameters + +<div class="cfgcmd"> + +set protocols bgp neighbor \<address[|interface\> address-family +\<ipv4-unicast|](##SUBST##|interface> address-family +<ipv4-unicast|)ipv6-unicast\> allowas-in number \<number\> + +This command accept incoming routes with AS path containing AS +number with the same value as the current system AS. This is +used when you want to use the same AS number in your sites, +but you can’t connect them directly. + +The number parameter (1-10) configures the amount of accepted +occurences of the system AS number in AS path. + +This command is only allowed for eBGP peers. It is not applicable +for peer groups. + +</div> + +<div class="cfgcmd"> + +set protocols bgp neighbor \<address[|interface\> address-family +\<ipv4-unicast|](##SUBST##|interface> address-family +<ipv4-unicast|)ipv6-unicast\> as-override + +This command override AS number of the originating router with +the local AS number. + +Usually this configuration is used in PEs (Provider Edge) to +replace the incoming customer AS number so the connected CE ( +Customer Edge) can use the same AS number as the other customer +sites. This allows customers of the provider network to use the +same AS number across their sites. + +This command is only allowed for eBGP peers. + +</div> + +<div class="cfgcmd"> + +set protocols bgp neighbor \<address[|interface\> address-family +\<ipv4-unicast|](##SUBST##|interface> address-family +<ipv4-unicast|)ipv6-unicast\> attribute-unchanged \<as-path[|med|](##SUBST##|med|)next-hop\> + +This command specifies attributes to be left unchanged for +advertisements sent to a peer or peer group. + +</div> + +<div class="cfgcmd"> + +set protocols bgp neighbor \<address[|interface\> address-family +\<ipv4-unicast|](##SUBST##|interface> address-family +<ipv4-unicast|)ipv6-unicast\> maximum-prefix \<number\> + +This command specifies a maximum number of prefixes we can receive +from a given peer. If this number is exceeded, the BGP session +will be destroyed. The number range is 1 to 4294967295. + +</div> + +<div class="cfgcmd"> + +set protocols bgp neighbor \<address[|interface\> address-family +\<ipv4-unicast|](##SUBST##|interface> address-family +<ipv4-unicast|)ipv6-unicast\> nexthop-self + +This command forces the BGP speaker to report itself as the +next hop for an advertised route it advertised to a neighbor. + +</div> + +<div class="cfgcmd"> + +set protocols bgp neighbor \<address[|interface\> address-family +\<ipv4-unicast|](##SUBST##|interface> address-family +<ipv4-unicast|)ipv6-unicast\> remove-private-as + +This command removes the private ASN of routes that are advertised +to the configured peer. It removes only private ASNs on routes +advertised to EBGP peers. + +If the AS-Path for the route has only private ASNs, the private +ASNs are removed. + +If the AS-Path for the route has a private ASN between public +ASNs, it is assumed that this is a design choice, and the +private ASN is not removed. + +</div> + +<div class="cfgcmd"> + +set protocols bgp neighbor \<address[|interface\> address-family +\<ipv4-unicast|](##SUBST##|interface> address-family +<ipv4-unicast|)ipv6-unicast\> soft-reconfiguration inbound + +Changes in BGP policies require the BGP session to be cleared. Clearing has a +large negative impact on network operations. Soft reconfiguration enables you +to generate inbound updates from a neighbor, change and activate BGP policies +without clearing the BGP session. + +This command specifies that route updates received from this neighbor will be +stored unmodified, regardless of the inbound policy. When inbound soft +reconfiguration is enabled, the stored updates are processed by the new +policy configuration to create new inbound updates. + +<div class="note"> + +<div class="title"> + +Note + +</div> + +Storage of route updates uses memory. If you enable soft +reconfiguration inbound for multiple neighbors, the amount of memory used +can become significant. + +</div> + +</div> + +<div class="cfgcmd"> + +set protocols bgp neighbor \<address[|interface\> address-family +\<ipv4-unicast|](##SUBST##|interface> address-family +<ipv4-unicast|)ipv6-unicast\> weight \<number\> + +This command specifies a default weight value for the neighbor’s +routes. The number range is 1 to 65535. + +</div> + +<div class="cfgcmd"> + +set protocols bgp neighbor \<address|interface\> +advertisement-interval \<seconds\> + +This command specifies the minimum route advertisement interval for +the peer. The interval value is 0 to 600 seconds, with the default +advertisement interval being 0. + +</div> + +<div class="cfgcmd"> + +set protocols bgp neighbor \<address|interface\> +disable-connected-check + +This command allows peerings between directly connected eBGP peers +using loopback addresses without adjusting the default TTL of 1. + +</div> + +<div class="cfgcmd"> + +set protocols bgp neighbor \<address[|interface\> +disable-send-community \<extended|](##SUBST##|interface> +disable-send-community <extended|)standard\> + +This command specifies that the community attribute should not be sent +in route updates to a peer. By default community attribute is sent. + +</div> + +<div class="cfgcmd"> + +set protocols bgp neighbor \<address|interface\> ebgp-multihop +\<number\> + +This command allows sessions to be established with eBGP neighbors +when they are multiple hops away. When the neighbor is not directly +connected and this knob is not enabled, the session will not establish. +The number of hops range is 1 to 255. This command is mutually +exclusive with `ttl-security hops`. + +</div> + +<div class="cfgcmd"> + +set protocols bgp neighbor \<address|interface\> local-as \<asn\> +\[no-prepend\] \[replace-as\] + +Specify an alternate AS for this BGP process when interacting with +the specified peer or peer group. With no modifiers, the specified +local-as is prepended to the received AS_PATH when receiving routing +updates from the peer, and prepended to the outgoing AS_PATH (after +the process local AS) when transmitting local routes to the peer. + +If the `no-prepend` attribute is specified, then the supplied +local-as is not prepended to the received AS_PATH. + +If the `replace-as` attribute is specified, then only the supplied +local-as is prepended to the AS_PATH when transmitting local-route +updates to this peer. + +<div class="note"> + +<div class="title"> + +Note + +</div> + +This command is only allowed for eBGP peers. + +</div> + +</div> + +<div class="cfgcmd"> + +set protocols bgp neighbor \<address|interface\> passive + +Configures the BGP speaker so that it only accepts inbound connections +from, but does not initiate outbound connections to the peer or peer group. + +</div> + +<div class="cfgcmd"> + +set protocols bgp neighbor \<address|interface\> password +\<text\> + +This command specifies a MD5 password to be used with the tcp socket that +is being used to connect to the remote peer. + +</div> + +<div class="cfgcmd"> + +set protocols bgp neighbor \<address|interface\> ttl-security +hops \<number\> + +This command enforces Generalized TTL Security Mechanism (GTSM), +as specified in `5082`. With this command, only neighbors +that are specified number of hops away will be allowed to +become neighbors. The number of hops range is 1 to 254. This +command is mutually exclusive with `ebgp-multihop`. + +</div> + +##### Peer Groups + +Peer groups are used to help improve scaling by generating the same update +information to all members of a peer group. Note that this means that the +routes generated by a member of a peer group will be sent back to that +originating peer with the originator identifier attribute set to indicated +the originating peer. All peers not associated with a specific peer group +are treated as belonging to a default peer group, and will share updates. + +<div class="cfgcmd"> + +set protocols bgp peer-group \<name\> + +This command defines a new peer group. You can specify to the group the same +parameters that you can specify for specific neighbors. + +<div class="note"> + +<div class="title"> + +Note + +</div> + +If you apply a parameter to an individual neighbor IP address, you +override the action defined for a peer group that includes that IP +address. + +</div> + +</div> + +<div class="cfgcmd"> + +set protocols bgp neighbor \<address|interface\> peer-group +\<name\> + +This command bind specific peer to peer group with a given name. + +</div> + +#### Network Advertisement Configuration + +<div class="cfgcmd"> + +set protocols bgp address-family \<ipv4-unicast|ipv6-unicast\> +network \<prefix\> + +This command is used for advertising IPv4 or IPv6 networks. + +<div class="note"> + +<div class="title"> + +Note + +</div> + +By default, the BGP prefix is advertised even if it's not present +in the routing table. This behaviour differs from the implementation of +some vendors. + +</div> + +</div> + +<div class="cfgcmd"> + +set protocols bgp parameters network-import-check + +This configuration modifies the behavior of the network statement. If you +have this configured the underlying network must exist in the routing table. + +</div> + +<div class="cfgcmd"> + +set protocols bgp neighbor \<address[|interface\> address-family +\<ipv4-unicast|](##SUBST##|interface> address-family +<ipv4-unicast|)ipv6-unicast\> default-originate \[route-map \<name\>\] + +By default, VyOS does not advertise a default route (0.0.0.0/0) even if it is +in routing table. When you want to announce default routes to the peer, use +this command. Using optional argument `route-map` you can inject the +default route to given neighbor only if the conditions in the route map are +met. + +</div> + +#### Route Aggregation Configuration + +<div class="cfgcmd"> + +set protocols bgp address-family \<ipv4-unicast|ipv6-unicast\> +aggregate-address \<prefix\> + +This command specifies an aggregate address. The router will also +announce longer-prefixes inside of the aggregate address. + +</div> + +<div class="cfgcmd"> + +set protocols bgp address-family \<ipv4-unicast|ipv6-unicast\> +aggregate-address \<prefix\> as-set + +This command specifies an aggregate address with a mathematical set of +autonomous systems. This command summarizes the AS_PATH attributes of +all the individual routes. + +</div> + +<div class="cfgcmd"> + +set protocols bgp address-family \<ipv4-unicast|ipv6-unicast\> +aggregate-address \<prefix\> summary-only + +This command specifies an aggregate address and provides that +longer-prefixes inside of the aggregate address are suppressed +before sending BGP updates out to peers. + +</div> + +<div class="cfgcmd"> + +set protocols bgp neighbor \<address[|interface\> address-family +\<ipv4-unicast|](##SUBST##|interface> address-family +<ipv4-unicast|)ipv6-unicast\> unsuppress-map \<name\> + +This command applies route-map to selectively unsuppress prefixes +suppressed by summarisation. + +</div> + +#### Redistribution Configuration + +<div class="cfgcmd"> + +set protocols bgp address-family \<ipv4-unicast|ipv6-unicast\> +redistribute \<route source\> + +This command redistributes routing information from the given route source +to the BGP process. There are six modes available for route source: +connected, kernel, ospf, rip, static, table. + +</div> + +<div class="cfgcmd"> + +set protocols bgp address-family \<ipv4-unicast|ipv6-unicast\> +redistribute \<route source\> metric \<number\> + +This command specifies metric (MED) for redistributed routes. The +metric range is 0 to 4294967295. There are six modes available for +route source: connected, kernel, ospf, rip, static, table. + +</div> + +<div class="cfgcmd"> + +set protocols bgp address-family \<ipv4-unicast|ipv6-unicast\> +redistribute \<route source\> route-map \<name\> + +This command allows to use route map to filter redistributed routes. +There are six modes available for route source: connected, kernel, +ospf, rip, static, table. + +</div> + +#### General Configuration + +##### Common parameters + +<div class="cfgcmd"> + +set protocols bgp parameters allow-martian-nexthop + +When a peer receives a martian nexthop as part of the NLRI for a route +permit the nexthop to be used as such, instead of rejecting and resetting +the connection. + +</div> + +<div class="cfgcmd"> + +set protocols bgp parameters router-id \<id\> + +This command specifies the router-ID. If router ID is not specified it will +use the highest interface IP address. + +</div> + +<div class="cfgcmd"> + +set protocols bgp address-family \<ipv4-unicast[|ipv6-unicast\> +maximum-paths \<ebgp|](##SUBST##|ipv6-unicast> +maximum-paths <ebgp|)ibgp\> \<number\> + +This command defines the maximum number of parallel routes that +the BGP can support. In order for BGP to use the second path, the +following attributes have to match: Weight, Local Preference, AS +Path (both AS number and AS path length), Origin code, MED, IGP +metric. Also, the next hop address for each path must be different. + +</div> + +<div class="cfgcmd"> + +set protocols bgp parameters no-hard-administrative-reset + +Do not send Hard Reset CEASE Notification for "Administrative Reset" +events. When set and Graceful Restart Notification capability is exchanged +between the peers, Graceful Restart procedures apply, and routes will be retained. + +</div> + +<div class="cfgcmd"> + +set protocols bgp parameters log-neighbor-changes + +This command enable logging neighbor up/down changes and reset reason. + +</div> + +<div class="cfgcmd"> + +set protocols bgp parameters no-client-to-client-reflection + +This command disables route reflection between route reflector clients. +By default, the clients of a route reflector are not required to be +fully meshed and the routes from a client are reflected to other clients. +However, if the clients are fully meshed, route reflection is not required. +In this case, use the `no-client-to-client-reflection` command +to disable client-to-client reflection. + +</div> + +<div class="cfgcmd"> + +set protocols bgp parameters no-fast-external-failover + +Disable immediate session reset if peer's connected link goes down. + +</div> + +<div class="cfgcmd"> + +set protocols bgp parameters no-ipv6-auto-ra + +By default, FRR sends router advertisement packets when Extended Next Hop is +on or when a connection is established directly using the device name (Unnumbered BGP). +Setting this option prevents FRR from sending router advertisement packets, but could break Unnumbered BGP. + +</div> + +<div class="cfgcmd"> + +set protocols bgp listen range \<prefix\> peer-group \<name\> + +This command is useful if one desires to loosen the requirement for BGP +to have strictly defined neighbors. Specifically what is allowed is for +the local router to listen to a range of IPv4 or IPv6 addresses defined +by a prefix and to accept BGP open messages. When a TCP connection +(and subsequently a BGP open message) from within this range tries to +connect the local router then the local router will respond and connect +with the parameters that are defined within the peer group. One must define +a peer-group for each range that is listed. If no peer-group is defined +then an error will keep you from committing the configuration. + +</div> + +<div class="cfgcmd"> + +set protocols bgp listen limit \<number\> + +This command goes hand in hand with the listen range command to limit the +amount of BGP neighbors that are allowed to connect to the local router. +The limit range is 1 to 5000. + +</div> + +<div class="cfgcmd"> + +set protocols bgp parameters ebgp-requires-policy + +This command changes the eBGP behavior of FRR. By default FRR enables +`8212` functionality which affects how eBGP routes are advertised, +namely no routes are advertised across eBGP sessions without some +sort of egress route-map/policy in place. In VyOS however we have this +RFC functionality disabled by default so that we can preserve backwards +compatibility with older versions of VyOS. With this option one can +enable `8212` functionality to operate. + +</div> + +<div class="cfgcmd"> + +set protocols bgp parameters labeled-unicast \<explicit-null | +ipv4-explicit-null | ipv6-explicit-null\> + +By default, locally advertised prefixes use the implicit-null label to +encode in the outgoing NLRI. + +The following command uses the explicit-null label value for all the +BGP instances. + +</div> + +##### Administrative Distance + +<div class="cfgcmd"> + +set protocols bgp parameters distance global +\<external[|internal|](##SUBST##|internal|)local\> \<distance\> + +This command change distance value of BGP. The arguments are the distance +values for external routes, internal routes and local routes respectively. +The distance range is 1 to 255. + +</div> + +<div class="cfgcmd"> + +set protocols bgp parameters distance prefix \<subnet\> +distance \<distance\> + +This command sets the administrative distance for a particular route. The +distance range is 1 to 255. + +<div class="note"> + +<div class="title"> + +Note + +</div> + +Routes with a distance of 255 are effectively disabled and not +installed into the kernel. + +</div> + +</div> + +##### Timers + +<div class="cfgcmd"> + +set protocols bgp timers holdtime \<seconds\> + +This command specifies hold-time in seconds. The timer range is +4 to 65535. The default value is 180 second. If you set value to 0 +VyOS will not hold routes. + +</div> + +<div class="cfgcmd"> + +set protocols bgp timers keepalive \<seconds\> + +This command specifies keep-alive time in seconds. The timer +can range from 4 to 65535. The default value is 60 second. + +</div> + +##### Route Dampening + +When a route fails, a routing update is sent to withdraw the route from the +network's routing tables. When the route is re-enabled, the change in +availability is also advertised. A route that continually fails and returns +requires a great deal of network traffic to update the network about the +route's status. + +Route dampening wich described in `2439` enables you to identify routes +that repeatedly fail and return. If route dampening is enabled, an unstable +route accumulates penalties each time the route fails and returns. If the +accumulated penalties exceed a threshold, the route is no longer advertised. +This is route suppression. Routes that have been suppressed are re-entered +into the routing table only when the amount of their penalty falls below a +threshold. + +A penalty of 1000 is assessed each time the route fails. When the penalties +reach a predefined threshold (suppress-value), the router stops advertising +the route. + +Once a route is assessed a penalty, the penalty is decreased by half each time +a predefined amount of time elapses (half-life-time). When the accumulated +penalties fall below a predefined threshold (reuse-value), the route is +unsuppressed and added back into the BGP routing table. + +No route is suppressed indefinitely. Maximum-suppress-time defines the maximum +time a route can be suppressed before it is re-advertised. + +<div class="cfgcmd"> + +set protocols bgp parameters dampening +half-life \<minutes\> + +This command defines the amount of time in minutes after +which a penalty is reduced by half. The timer range is +10 to 45 minutes. + +</div> + +<div class="cfgcmd"> + +set protocols bgp parameters dampening +re-use \<seconds\> + +This command defines the accumulated penalty amount at which the +route is re-advertised. The penalty range is 1 to 20000. + +</div> + +<div class="cfgcmd"> + +set protocols bgp parameters dampening +start-suppress-time \<seconds\> + +This command defines the accumulated penalty amount at which the +route is suppressed. The penalty range is 1 to 20000. + +</div> + +<div class="cfgcmd"> + +set protocols bgp parameters dampening +max-suppress-time \<seconds\> + +This command defines the maximum time in minutes that a route is +suppressed. The timer range is 1 to 255 minutes. + +</div> + +#### Route Selection Configuration + +<div class="cfgcmd"> + +set protocols bgp parameters always-compare-med + +This command provides to compare the MED on routes, even when they were +received from different neighbouring ASes. Setting this option makes the +order of preference of routes more defined, and should eliminate MED +induced oscillations. + +</div> + +<div class="cfgcmd"> + +set protocols bgp parameters bestpath as-path confed + +This command specifies that the length of confederation path sets and +sequences should be taken into account during the BGP best path +decision process. + +</div> + +<div class="cfgcmd"> + +set protocols bgp parameters bestpath as-path multipath-relax + +This command specifies that BGP decision process should consider paths +of equal AS_PATH length candidates for multipath computation. Without +the knob, the entire AS_PATH must match for multipath computation. + +</div> + +<div class="cfgcmd"> + +set protocols bgp parameters bestpath as-path ignore + +Ignore AS_PATH length when selecting a route + +</div> + +<div class="cfgcmd"> + +set protocols bgp parameters bestpath compare-routerid + +Ensure that when comparing routes where both are equal on most metrics, +including local-pref, AS_PATH length, IGP cost, MED, that the tie is +broken based on router-ID. + +If this option is enabled, then the already-selected check, where +already selected eBGP routes are preferred, is skipped. + +If a route has an ORIGINATOR_ID attribute because it has been reflected, +that ORIGINATOR_ID will be used. Otherwise, the router-ID of the peer +the route was received from will be used. + +The advantage of this is that the route-selection (at this point) will +be more deterministic. The disadvantage is that a few or even one lowest-ID +router may attract all traffic to otherwise-equal paths because of this +check. It may increase the possibility of MED or IGP oscillation, unless +other measures were taken to avoid these. The exact behaviour will be +sensitive to the iBGP and reflection topology. + +</div> + +<div class="cfgcmd"> + +set protocols bgp parameters bestpath med confed + +This command specifies that BGP considers the MED when comparing routes +originated from different sub-ASs within the confederation to which this +BGP speaker belongs. The default state, where the MED attribute is not +considered. + +</div> + +<div class="cfgcmd"> + +set protocols bgp parameters bestpath med missing-as-worst + +This command specifies that a route with a MED is always considered to be +better than a route without a MED by causing the missing MED attribute to +have a value of infinity. The default state, where the missing MED +attribute is considered to have a value of zero. + +</div> + +<div class="cfgcmd"> + +set protocols bgp parameters default local-pref +\<local-pref value\> + +This command specifies the default local preference value. The local +preference range is 0 to 4294967295. + +</div> + +<div class="cfgcmd"> + +set protocols bgp parameters deterministic-med + +This command provides to compare different MED values that advertised by +neighbours in the same AS for routes selection. When this command is +enabled, routes from the same autonomous system are grouped together, and +the best entries of each group are compared. + +</div> + +<div class="cfgcmd"> + +set protocols bgp address-family ipv4-unicast network +\<prefix\> backdoor + +This command allows the router to prefer route to specified prefix learned +via IGP through backdoor link instead of a route to the same prefix learned +via EBGP. + +</div> + +#### Route Filtering Configuration + +In order to control and modify routing information that is exchanged between +peers you can use route-map, filter-list, prefix-list, distribute-list. + +For inbound updates the order of preference is: + +> - route-map +> - filter-list +> - prefix-list, distribute-list + +For outbound updates the order of preference is: + +> - prefix-list, distribute-list +> - filter-list +> - route-map +> +> <div class="note"> +> +> <div class="title"> +> +> Note +> +> </div> +> +> The attributes `prefix-list` and `distribute-list` +> are mutually exclusive, and only one command (distribute-list or +> prefix-list) can be applied to each inbound or outbound direction for a +> particular neighbor. +> +> </div> + +<div class="cfgcmd"> + +set protocols bgp neighbor \<address[|interface\> address-family +\<ipv4-unicast|](##SUBST##|interface> address-family +<ipv4-unicast|)ipv6-unicast\> distribute-list \<export|import\> \<number\> + +This command applies the access list filters named in \<number\> to the +specified BGP neighbor to restrict the routing information that BGP learns +and/or advertises. The arguments `export` and `import` +specify the direction in which the access list are applied. + +</div> + +<div class="cfgcmd"> + +set protocols bgp neighbor \<address[|interface\> address-family +\<ipv4-unicast|](##SUBST##|interface> address-family +<ipv4-unicast|)ipv6-unicast\> prefix-list \<export|import\> \<name\> + +This command applies the prfefix list filters named in \<name\> to the +specified BGP neighbor to restrict the routing information that BGP learns +and/or advertises. The arguments `export` and `import` +specify the direction in which the prefix list are applied. + +</div> + +<div class="cfgcmd"> + +set protocols bgp neighbor \<address[|interface\> address-family +\<ipv4-unicast|](##SUBST##|interface> address-family +<ipv4-unicast|)ipv6-unicast\> route-map \<export|import\> \<name\> + +This command applies the route map named in \<name\> to the specified BGP +neighbor to control and modify routing information that is exchanged +between peers. The arguments `export` and `import` +specify the direction in which the route map are applied. + +</div> + +<div class="cfgcmd"> + +set protocols bgp neighbor \<address[|interface\> address-family +\<ipv4-unicast|](##SUBST##|interface> address-family +<ipv4-unicast|)ipv6-unicast\> filter-list \<export|import\> \<name\> + +This command applies the AS path access list filters named in \<name\> to the +specified BGP neighbor to restrict the routing information that BGP learns +and/or advertises. The arguments `export` and `import` +specify the direction in which the AS path access list are applied. + +</div> + +<div class="cfgcmd"> + +set protocols bgp neighbor \<address[|interface\> address-family +\<ipv4-unicast|](##SUBST##|interface> address-family +<ipv4-unicast|)ipv6-unicast\> capability orf \<receive|send\> + +This command enables the ORF capability (described in `5291`) on the +local router, and enables ORF capability advertisement to the specified BGP +peer. The `receive` keyword configures a router to advertise ORF +receive capabilities. The `send` keyword configures a router to +advertise ORF send capabilities. To advertise a filter from a sender, you +must create an IP prefix list for the specified BGP peer applied in inbound +derection. + +</div> + +<div class="cfgcmd"> + +set protocols bgp neighbor \<address|interface\> solo + +This command prevents from sending back prefixes learned from the neighbor. + +</div> + +#### BGP Scaling Configuration + +BGP routers connected inside the same AS through BGP belong to an internal BGP +session, or IBGP. In order to prevent routing table loops, IBGP speaker does +not advertise IBGP-learned routes to other IBGP speaker (Split Horizon +mechanism). As such, IBGP requires a full mesh of all peers. For large +networks, this quickly becomes unscalable. + +There are two ways that help us to mitigate the BGPs full-mesh requirement in +a network: + +> - Using BGP route-reflectors +> - Using BGP confederation + +##### Route Reflector Configuration + +Introducing route reflectors removes the need for the full-mesh. When you +configure a route reflector you have to tell the router whether the other IBGP +router is a client or non-client. A client is an IBGP router that the route +reflector will “reflect” routes to, the non-client is just a regular IBGP +neighbor. Route reflectors mechanism is described in `4456` and updated +by `7606`. + +<div class="cfgcmd"> + +set protocols bgp neighbor \<address\> address-family +\<ipv4-unicast|ipv6-unicast\> route-reflector-client + +This command specifies the given neighbor as route reflector client. + +</div> + +<div class="cfgcmd"> + +set protocols bgp parameters cluster-id \<id\> + +This command specifies cluster ID which identifies a collection of route +reflectors and their clients, and is used by route reflectors to avoid +looping. By default cluster ID is set to the BGP router id value, but can be +set to an arbitrary 32-bit value. + +</div> + +##### Confederation Configuration + +A BGP confederation divides our AS into sub-ASes to reduce the number of +required IBGP peerings. Within a sub-AS we still require full-mesh IBGP but +between these sub-ASes we use something that looks like EBGP but behaves like +IBGP (called confederation BGP). Confederation mechanism is described in +`5065` + +<div class="cfgcmd"> + +set protocols bgp parameters confederation identifier +\<asn\> + +This command specifies a BGP confederation identifier. \<asn\> is the number +of the autonomous system that internally includes multiple sub-autonomous +systems (a confederation). + +</div> + +<div class="cfgcmd"> + +set protocols bgp parameters confederation peers \<nsubasn\> + +This command sets other confederations \<nsubasn\> as members of autonomous +system specified by `confederation identifier <asn>`. + +</div> + +## Operational Mode Commands + +### Show + +<div class="opcmd"> + +show bgp \<ip|ipv6\> + +This command displays all entries in BGP routing table. + +</div> + +``` none +BGP table version is 10, local router ID is 10.0.35.3, vrf id 0 +Default local pref 100, local AS 65000 +Status codes: s suppressed, d damped, h history, * valid, > best, = multipath, + i internal, r RIB-failure, S Stale, R Removed +Nexthop codes: @NNN nexthop's vrf id, < announce-nh-self +Origin codes: i - IGP, e - EGP, ? - incomplete + + Network Next Hop Metric LocPrf Weight Path +*> 198.51.100.0/24 10.0.34.4 0 0 65004 i +*> 203.0.113.0/24 10.0.35.5 0 0 65005 i + +Displayed 2 routes and 2 total paths +``` + +<div class="opcmd"> + +show bgp \<ip[|ipv6\> \<address|](##SUBST##|ipv6> <address|)prefix\> + +This command displays information about the particular entry in the BGP +routing table. + +</div> + +``` none +BGP routing table entry for 198.51.100.0/24 +Paths: (1 available, best #1, table default) + Advertised to non peer-group peers: + 10.0.13.1 10.0.23.2 10.0.34.4 10.0.35.5 + 65004 + 10.0.34.4 from 10.0.34.4 (10.0.34.4) + Origin IGP, metric 0, valid, external, best (First path received) + Last update: Wed Jan 6 12:18:53 2021 +``` + +<div class="opcmd"> + +show bgp cidr-only + +This command displays routes with classless interdomain routing (CIDR). + +</div> + +<div class="opcmd"> + +show bgp \<ipv4|ipv6\> community \<value\> + +This command displays routes that belong to specified BGP communities. +Valid value is a community number in the range from 1 to 4294967200, +or AA:NN (autonomous system-community number/2-byte number), no-export, +local-as, or no-advertise. + +</div> + +<div class="opcmd"> + +show bgp \<ipv4|ipv6\> community-list \<name\> + +This command displays routes that are permitted by the BGP +community list. + +</div> + +<div class="opcmd"> + +show bgp \<ipv4|ipv6\> dampening dampened-paths + +This command displays BGP dampened routes. + +</div> + +<div class="opcmd"> + +show bgp \<ipv4|ipv6\> dampening flap-statistics + +This command displays information about flapping BGP routes. + +</div> + +<div class="opcmd"> + +show bgp \<ipv4|ipv6\> filter-list \<name\> + +This command displays BGP routes allowed by the specified AS Path +access list. + +</div> + +<div class="opcmd"> + +show bgp \<ipv4|ipv6\> neighbors \<address\> advertised-routes + +This command displays BGP routes advertised to a neighbor. + +</div> + +<div class="opcmd"> + +show bgp \<ipv4|ipv6\> neighbors \<address\> received-routes + +This command displays BGP routes originating from the specified BGP +neighbor before inbound policy is applied. To use this command inbound +soft reconfiguration must be enabled. + +</div> + +<div class="opcmd"> + +show bgp \<ipv4|ipv6\> neighbors \<address\> routes + +This command displays BGP received-routes that are accepted after filtering. + +</div> + +<div class="opcmd"> + +show bgp \<ipv4|ipv6\> neighbors \<address\> dampened-routes + +This command displays dampened routes received from BGP neighbor. + +</div> + +<div class="opcmd"> + +show bgp \<ipv4|ipv6\> regexp \<text\> + +This command displays information about BGP routes whose AS path +matches the specified regular expression. + +</div> + +<div class="opcmd"> + +show bgp \<ipv4|ipv6\> summary + +This command displays the status of all BGP connections. + +</div> + +``` none +IPv4 Unicast Summary: +BGP router identifier 10.0.35.3, local AS number 65000 vrf-id 0 +BGP table version 11 +RIB entries 5, using 920 bytes of memory +Peers 4, using 82 KiB of memory + +Neighbor V AS MsgRcvd MsgSent TblVer InQ OutQ Up/Down State/PfxRcd +10.0.13.1 4 65000 148 159 0 0 0 02:16:01 0 +10.0.23.2 4 65000 136 143 0 0 0 02:13:21 0 +10.0.34.4 4 65004 161 163 0 0 0 02:16:01 1 +10.0.35.5 4 65005 162 166 0 0 0 02:16:01 1 + +Total number of neighbors 4 +``` + +### Reset + +<div class="opcmd"> + +reset bgp \<ipv4[|ipv6\> \<address\> \[soft \[in|](##SUBST##|ipv6> <address> [soft [in|)out\]\] + +This command resets BGP connections to the specified neighbor IP address. +With argument `soft` this command initiates a soft reset. If +you do not specify the `in` or `out` options, both +inbound and outbound soft reconfiguration are triggered. + +</div> + +<div class="opcmd"> + +reset ip bgp all + +This command resets all BGP connections of given router. + +</div> + +<div class="opcmd"> + +reset bgp \<ipv4|ipv6\> external + +This command resets all external BGP peers of given router. + +</div> + +<div class="opcmd"> + +reset bgp \<ipv4[|ipv6\> peer-group \<name\> \[soft \[in|](##SUBST##|ipv6> peer-group <name> [soft [in|)out\]\] + +This command resets BGP connections to the specified peer group. +With argument `soft` this command initiates a soft reset. If +you do not specify the `in` or `out` options, both +inbound and outbound soft reconfiguration are triggered. + +</div> + +## Examples + +### IPv4 peering + +A simple eBGP configuration: + +**Node 1:** + +``` none +set protocols bgp system-as 65534 +set protocols bgp neighbor 192.168.0.2 ebgp-multihop '2' +set protocols bgp neighbor 192.168.0.2 remote-as '65535' +set protocols bgp neighbor 192.168.0.2 update-source '192.168.0.1' +set protocols bgp neighbor 192.168.0.2 address-family ipv4-unicast +set protocols bgp address-family ipv4-unicast network '172.16.0.0/16' +set protocols bgp parameters router-id '192.168.0.1' +``` + +**Node 2:** + +``` none +set protocols bgp system-as 65535 +set protocols bgp neighbor 192.168.0.1 ebgp-multihop '2' +set protocols bgp neighbor 192.168.0.1 remote-as '65534' +set protocols bgp neighbor 192.168.0.1 update-source '192.168.0.2' +set protocols bgp neighbor 192.168.0.2 address-family ipv4-unicast +set protocols bgp address-family ipv4-unicast network '172.17.0.0/16' +set protocols bgp parameters router-id '192.168.0.2' +``` + +Don't forget, the CIDR declared in the network statement MUST **exist in your +routing table (dynamic or static), the best way to make sure that is true is +creating a static route:** + +**Node 1:** + +``` none +set protocols static route 172.16.0.0/16 blackhole distance '254' +``` + +**Node 2:** + +``` none +set protocols static route 172.17.0.0/16 blackhole distance '254' +``` + +### IPv6 peering + +A simple BGP configuration via IPv6. + +**Node 1:** + +``` none +set protocols bgp system-as 65534 +set protocols bgp neighbor 2001:db8::2 ebgp-multihop '2' +set protocols bgp neighbor 2001:db8::2 remote-as '65535' +set protocols bgp neighbor 2001:db8::2 update-source '2001:db8::1' +set protocols bgp neighbor 2001:db8::2 address-family ipv6-unicast +set protocols bgp address-family ipv6-unicast network '2001:db8:1::/48' +set protocols bgp parameters router-id '10.1.1.1' +``` + +**Node 2:** + +``` none +set protocols bgp system-as 65535 +set protocols bgp neighbor 2001:db8::1 ebgp-multihop '2' +set protocols bgp neighbor 2001:db8::1 remote-as '65534' +set protocols bgp neighbor 2001:db8::1 update-source '2001:db8::2' +set protocols bgp neighbor 2001:db8::1 address-family ipv6-unicast +set protocols bgp address-family ipv6-unicast network '2001:db8:2::/48' +set protocols bgp parameters router-id '10.1.1.2' +``` + +Don't forget, the CIDR declared in the network statement **MUST exist in your +routing table (dynamic or static), the best way to make sure that is true is +creating a static route:** + +**Node 1:** + +``` none +set protocols static route6 2001:db8:1::/48 blackhole distance '254' +``` + +**Node 2:** + +``` none +set protocols static route6 2001:db8:2::/48 blackhole distance '254' +``` + +### Route Filtering + +Route filter can be applied using a route-map: + +**Node1:** + +``` none +set policy prefix-list AS65535-IN rule 10 action 'permit' +set policy prefix-list AS65535-IN rule 10 prefix '172.16.0.0/16' +set policy prefix-list AS65535-OUT rule 10 action 'deny' +set policy prefix-list AS65535-OUT rule 10 prefix '172.16.0.0/16' +set policy prefix-list6 AS65535-IN rule 10 action 'permit' +set policy prefix-list6 AS65535-IN rule 10 prefix '2001:db8:2::/48' +set policy prefix-list6 AS65535-OUT rule 10 action 'deny' +set policy prefix-list6 AS65535-OUT rule 10 prefix '2001:db8:2::/48' + +set policy route-map AS65535-IN rule 10 action 'permit' +set policy route-map AS65535-IN rule 10 match ip address prefix-list 'AS65535-IN' +set policy route-map AS65535-IN rule 10 match ipv6 address prefix-list 'AS65535-IN' +set policy route-map AS65535-IN rule 20 action 'deny' +set policy route-map AS65535-OUT rule 10 action 'deny' +set policy route-map AS65535-OUT rule 10 match ip address prefix-list 'AS65535-OUT' +set policy route-map AS65535-OUT rule 10 match ipv6 address prefix-list 'AS65535-OUT' +set policy route-map AS65535-OUT rule 20 action 'permit' + +set protocols bgp system-as 65534 +set protocols bgp neighbor 2001:db8::2 address-family ipv4-unicast route-map export 'AS65535-OUT' +set protocols bgp neighbor 2001:db8::2 address-family ipv4-unicast route-map import 'AS65535-IN' +set protocols bgp neighbor 2001:db8::2 address-family ipv6-unicast route-map export 'AS65535-OUT' +set protocols bgp neighbor 2001:db8::2 address-family ipv6-unicast route-map import 'AS65535-IN' +``` + +**Node2:** + +``` none +set policy prefix-list AS65534-IN rule 10 action 'permit' +set policy prefix-list AS65534-IN rule 10 prefix '172.17.0.0/16' +set policy prefix-list AS65534-OUT rule 10 action 'deny' +set policy prefix-list AS65534-OUT rule 10 prefix '172.17.0.0/16' +set policy prefix-list6 AS65534-IN rule 10 action 'permit' +set policy prefix-list6 AS65534-IN rule 10 prefix '2001:db8:1::/48' +set policy prefix-list6 AS65534-OUT rule 10 action 'deny' +set policy prefix-list6 AS65534-OUT rule 10 prefix '2001:db8:1::/48' + +set policy route-map AS65534-IN rule 10 action 'permit' +set policy route-map AS65534-IN rule 10 match ip address prefix-list 'AS65534-IN' +set policy route-map AS65534-IN rule 10 match ipv6 address prefix-list 'AS65534-IN' +set policy route-map AS65534-IN rule 20 action 'deny' +set policy route-map AS65534-OUT rule 10 action 'deny' +set policy route-map AS65534-OUT rule 10 match ip address prefix-list 'AS65534-OUT' +set policy route-map AS65534-OUT rule 10 match ipv6 address prefix-list 'AS65534-OUT' +set policy route-map AS65534-OUT rule 20 action 'permit' + +set protocols bgp system-as 65535 +set protocols bgp neighbor 2001:db8::1 address-family ipv4-unicast route-map export 'AS65534-OUT' +set protocols bgp neighbor 2001:db8::1 address-family ipv4-unicast route-map import 'AS65534-IN' +set protocols bgp neighbor 2001:db8::1 address-family ipv6-unicast route-map export 'AS65534-OUT' +set protocols bgp neighbor 2001:db8::1 address-family ipv6-unicast route-map import 'AS65534-IN' +``` + +We could expand on this and also deny link local and multicast in the rule 20 +action deny. diff --git a/docs/configuration/protocols/md-failover.md b/docs/configuration/protocols/md-failover.md new file mode 100644 index 00000000..06ce402d --- /dev/null +++ b/docs/configuration/protocols/md-failover.md @@ -0,0 +1,131 @@ +# Failover + +Failover routes are manually configured routes, but they only install +to the routing table if the health-check target is alive. +If the target is not alive the route is removed from the routing table +until the target becomes available. + +## Failover Routes + +<div class="cfgcmd"> + +set protocols failover route \<subnet\> next-hop \<address\> check +target \<target-address\> + +Configure next-hop <span class="title-ref">\<address\></span> and <span class="title-ref">\<target-address\></span> for an IPv4 static +route. Specify the target +IPv4 address for health checking. + +</div> + +<div class="cfgcmd"> + +set protocols failover route \<subnet\> next-hop \<address\> check +timeout \<timeout\> + +Timeout in seconds between health target checks. + +Range is 1 to 300, default is 10. + +</div> + +<div class="cfgcmd"> + +set protocols failover route \<subnet\> next-hop \<address\> check +type \<protocol\> + +Defines protocols for checking ARP, ICMP, TCP + +Default is `icmp`. + +</div> + +<div class="cfgcmd"> + +set protocols failover route \<subnet\> next-hop \<address\> check +policy \<policy\> + +Policy for checking targets + +</div> + +- `all-available` all checking target addresses must be available to pass + this check + +- `any-available` any of the checking target addresses must be available + to pass this check + + > Default is `any-available`. + +<div class="cfgcmd"> + +set protocols failover route \<subnet\> next-hop \<address\> +interface \<interface\> + +Next-hop interface for the route + +</div> + +<div class="cfgcmd"> + +set protocols failover route \<subnet\> next-hop \<address\> +metric \<metric\> + +Route metric + +Default 1. + +</div> + +## Example + +**One gateway:** + +``` none +set protocols failover route 203.0.113.1/32 next-hop 192.0.2.1 check target '192.0.2.1' +set protocols failover route 203.0.113.1/32 next-hop 192.0.2.1 check timeout '5' +set protocols failover route 203.0.113.1/32 next-hop 192.0.2.1 check type 'icmp' +set protocols failover route 203.0.113.1/32 next-hop 192.0.2.1 interface 'eth0' +set protocols failover route 203.0.113.1/32 next-hop 192.0.2.1 metric '10' +``` + +Show the route + +``` none +vyos@vyos:~$ show ip route 203.0.113.1 + Routing entry for 203.0.113.1/32 + Known via "kernel", distance 0, metric 10, best + Last update 00:00:39 ago + * 192.0.2.1, via eth0 +``` + +**Two gateways and different metrics:** + +``` none +set protocols failover route 203.0.113.1/32 next-hop 192.0.2.1 check target '192.0.2.1' +set protocols failover route 203.0.113.1/32 next-hop 192.0.2.1 check timeout '5' +set protocols failover route 203.0.113.1/32 next-hop 192.0.2.1 check type 'icmp' +set protocols failover route 203.0.113.1/32 next-hop 192.0.2.1 interface 'eth0' +set protocols failover route 203.0.113.1/32 next-hop 192.0.2.1 metric '10' + +set protocols failover route 203.0.113.1/32 next-hop 198.51.100.1 check target '198.51.100.99' +set protocols failover route 203.0.113.1/32 next-hop 198.51.100.1 check timeout '5' +set protocols failover route 203.0.113.1/32 next-hop 198.51.100.1 check type 'icmp' +set protocols failover route 203.0.113.1/32 next-hop 198.51.100.1 interface 'eth2' +set protocols failover route 203.0.113.1/32 next-hop 198.51.100.1 metric '20' +``` + +Show the route + +``` none +vyos@vyos:~$ show ip route 203.0.113.1 +Routing entry for 203.0.113.1/32 + Known via "kernel", distance 0, metric 10, best + Last update 00:08:06 ago + * 192.0.2.1, via eth0 + +Routing entry for 203.0.113.1/32 + Known via "kernel", distance 0, metric 20 + Last update 00:08:14 ago + * 198.51.100.1, via eth2 +``` diff --git a/docs/configuration/protocols/md-igmp-proxy.md b/docs/configuration/protocols/md-igmp-proxy.md new file mode 100644 index 00000000..f35f1747 --- /dev/null +++ b/docs/configuration/protocols/md-igmp-proxy.md @@ -0,0 +1,88 @@ +lastproofread +2023-11-13 + +# IGMP Proxy + +`IGMP (Internet Group Management Protocol)` proxy sends IGMP host messages +on behalf of a connected client. The configuration must define one, and only one +upstream interface, and one or more downstream interfaces. + +## Configuration + +<div class="cfgcmd"> + +set protocols igmp-proxy interface \<interface\> role +\<upstream | downstream\> + +- **upstream:** The upstream network interface is the outgoing interface + which is responsible for communicating to available multicast data sources. + There can only be one upstream interface. +- **downstream:** Downstream network interfaces are the distribution + interfaces to the destination networks, where multicast clients can join + groups and receive multicast data. One or more downstream interfaces must + be configured. + +</div> + +<div class="cfgcmd"> + +set protocols igmp-proxy interface \<interface\> alt-subnet \<network\> + +Defines alternate sources for multicasting and IGMP data. The network address +must be on the following format 'a.b.c.d/n'. By default, the router will +accept data from sources on the same network as configured on an interface. +If the multicast source lies on a remote network, one must define from where +traffic should be accepted. + +This is especially useful for the upstream interface, since the source for +multicast traffic is often from a remote location. + +This option can be supplied multiple times. + +</div> + +<div class="cfgcmd"> + +set protocols igmp-proxy disable-quickleave + +Disables quickleave mode. In this mode the daemon will not send a Leave IGMP +message upstream as soon as it receives a Leave message for any downstream +interface. The daemon will not ask for Membership reports on the downstream +interfaces, and if a report is received the group is not joined again the +upstream. + +If it's vital that the daemon should act exactly like a real multicast client +on the upstream interface, this function should be enabled. + +Enabling this function increases the risk of bandwidth saturation. + +</div> + +<div class="cfgcmd"> + +set protocols igmp-proxy disable + +Disable this service. + +</div> + +### Example + +Interface <span class="title-ref">eth1</span> LAN is behind NAT. In order to subscribe <span class="title-ref">10.0.0.0/23</span> subnet +multicast which is in <span class="title-ref">eth0</span> WAN we need to configure igmp-proxy. + +``` none +set protocols igmp-proxy interface eth0 role upstream +set protocols igmp-proxy interface eth0 alt-subnet 10.0.0.0/23 +set protocols igmp-proxy interface eth1 role downstream +``` + +## Operation + +<div class="opcmd"> + +restart igmp-proxy + +Restart the IGMP proxy process. + +</div> diff --git a/docs/configuration/protocols/md-index.md b/docs/configuration/protocols/md-index.md new file mode 100644 index 00000000..60e20bc9 --- /dev/null +++ b/docs/configuration/protocols/md-index.md @@ -0,0 +1,20 @@ +# Protocols + +<div class="toctree" maxdepth="1" includehidden=""> + +babel +bfd +bgp +failover +igmp-proxy +isis +mpls +segment-routing +ospf +pim +pim6 +rip +rpki +static + +</div> diff --git a/docs/configuration/protocols/md-isis.md b/docs/configuration/protocols/md-isis.md new file mode 100644 index 00000000..8081860a --- /dev/null +++ b/docs/configuration/protocols/md-isis.md @@ -0,0 +1,662 @@ +# IS-IS + +`IS-IS (Intermediate System to Intermediate System)` is a link-state +interior gateway protocol (IGP) which is described in ISO10589, +`1195`, `5308`. IS-IS runs the Dijkstra shortest-path first (SPF) +algorithm to create a database of the network’s topology, and +from that database to determine the best (that is, lowest cost) path to a +destination. The intermediate systems (the name for routers) exchange topology +information with their directly conencted neighbors. IS-IS runs directly on +the data link layer (Layer 2). IS-IS addresses are called +`NETs (Network Entity Titles)` and can be 8 to 20 bytes long, but are +generally 10 bytes long. The tree database that is created with IS-IS is +similar to the one that is created with OSPF in that the paths chosen should +be similar. Comparisons to OSPF are inevitable and often are reasonable ones +to make in regards to the way a network will respond with either IGP. + +## General + +### Configuration + +#### Mandatory Settings + +For IS-IS top operate correctly, one must do the equivalent of a Router ID in +CLNS. This Router ID is called the `NET (Network Entity Title)`. This +must be unique for each and every router that is operating in IS-IS. It also +must not be duplicated otherwise the same issues that occur within OSPF will +occur within IS-IS when it comes to said duplication. + +<div class="cfgcmd"> + +set protocols isis net \<network-entity-title\> + +This commad sets network entity title (NET) provided in ISO format. + +Here is an example `NET (Network Entity Title)` value: + +``` none +49.0001.1921.6800.1002.00 +``` + +The CLNS address consists of the following parts: + +- `AFI (Address family authority identifier)` - `49` The AFI value + 49 is what IS-IS uses for private addressing. +- Area identifier: `0001` IS-IS area number (numberical area `1`) +- System identifier: `1921.6800.1002` - for system idetifiers we recommend + to use IP address or MAC address of the router itself. The way to construct + this is to keep all of the zeroes of the router IP address, and then change + the periods from being every three numbers to every four numbers. The + address that is listed here is `192.168.1.2`, which if expanded will turn + into `192.168.001.002`. Then all one has to do is move the dots to have + four numbers instead of three. This gives us `1921.6800.1002`. +- `NET (Network Entity Title)` selector: `00` Must always be 00. This + setting indicates "this system" or "local system." + +</div> + +<div class="cfgcmd"> + +set protocols isis interface \<interface\> + +This command enables IS-IS on this interface, and allows for +adjacency to occur. Note that the name of IS-IS instance must be +the same as the one used to configure the IS-IS process. + +</div> + +#### IS-IS Global Configuration + +<div class="cfgcmd"> + +set protocols isis dynamic-hostname + +This command enables support for dynamic hostname TLV. Dynamic hostname +mapping determined as described in `2763`, Dynamic Hostname +Exchange Mechanism for IS-IS. + +</div> + +<div class="cfgcmd"> + +set protocols isis level \<level-1[|level-1-2|](##SUBST##|level-1-2|)level-2\> + +This command defines the IS-IS router behavior: + +- **level-1** - Act as a station (Level 1) router only. +- **level-1-2** - Act as a station (Level 1) router and area (Level 2) router. +- **level-2-only** - Act as an area (Level 2) router only. + +</div> + +<div class="cfgcmd"> + +set protocols isis lsp-mtu \<size\> + +This command configures the maximum size of generated +`LSPs (Link State PDUs)`, in bytes. The size range is 128 to 4352. + +</div> + +<div class="cfgcmd"> + +set protocols isis metric-style \<narrow[|transition|](##SUBST##|transition|)wide\> + +This command sets old-style (ISO 10589) or new style packet formats: + +- **narrow** - Use old style of TLVs with narrow metric. +- **transition** - Send and accept both styles of TLVs during transition. +- **wide** - Use new style of TLVs to carry wider metric. + +</div> + +<div class="cfgcmd"> + +set protocols isis purge-originator + +This command enables `6232` purge originator identification. Enable +purge originator identification (POI) by adding the type, length and value +(TLV) with the Intermediate System (IS) identification to the LSPs that do +not contain POI information. If an IS generates a purge, VyOS adds this TLV +with the system ID of the IS to the purge. + +</div> + +<div class="cfgcmd"> + +set protocols isis set-attached-bit + +This command sets ATT bit to 1 in Level1 LSPs. It is described in `3787`. + +</div> + +<div class="cfgcmd"> + +set protocols isis set-overload-bit + +This command sets overload bit to avoid any transit traffic through this +router. It is described in `3787`. + +</div> + +<div class="cfgcmd"> + +set protocols isis name default-information originate \<ipv4|ipv6\> +level-1 + +This command will generate a default-route in L1 database. + +</div> + +<div class="cfgcmd"> + +set protocols isis name default-information originate \<ipv4|ipv6\> +level-2 + +This command will generate a default-route in L2 database. + +</div> + +<div class="cfgcmd"> + +set protocols isis ldp-sync + +This command will enable IGP-LDP synchronization globally for ISIS. This +requires for LDP to be functional. This is described in `5443`. By +default all interfaces operational in IS-IS are enabled for synchronization. +Loopbacks are exempt. + +</div> + +<div class="cfgcmd"> + +set protocols isis ldp-sync holddown \<seconds\> + +This command will change the hold down value globally for IGP-LDP +synchronization during convergence/interface flap events. + +</div> + +#### Interface Configuration + +<div class="cfgcmd"> + +set protocols isis interface \<interface\> circuit-type +\<level-1[|level-1-2|](##SUBST##|level-1-2|)level-2-only\> + +This command specifies circuit type for interface: + +- **level-1** - Level-1 only adjacencies are formed. +- **level-1-2** - Level-1-2 adjacencies are formed +- **level-2-only** - Level-2 only adjacencies are formed + +</div> + +<div class="cfgcmd"> + +set protocols isis interface \<interface\> hello-interval +\<seconds\> + +This command sets hello interval in seconds on a given interface. +The range is 1 to 600. + +</div> + +<div class="cfgcmd"> + +set protocols isis interface \<interface\> hello-multiplier +\<seconds\> + +This command sets multiplier for hello holding time on a given +interface. The range is 2 to 100. + +</div> + +<div class="cfgcmd"> + +set protocols isis interface \<interface\> hello-padding + +This command configures padding on hello packets to accommodate asymmetrical +maximum transfer units (MTUs) from different hosts as described in +`3719`. This helps to prevent a premature adjacency Up state when one +routing devices MTU does not meet the requirements to establish the adjacency. + +</div> + +<div class="cfgcmd"> + +set protocols isis interface \<interface\> metric \<metric\> + +This command set default metric for circuit. + +The metric range is 1 to 16777215 (Max value depend if metric support narrow +or wide value). + +</div> + +<div class="cfgcmd"> + +set protocols isis interface \<interface\> network +point-to-point + +This command specifies network type to Point-to-Point. The default +network type is broadcast. + +</div> + +<div class="cfgcmd"> + +set protocols isis interface \<interface\> passive + +This command configures the passive mode for this interface. + +</div> + +<div class="cfgcmd"> + +set protocols isis interface \<interface\> password +plaintext-password \<text\> + +This command configures the authentication password for the interface. + +</div> + +<div class="cfgcmd"> + +set protocols isis interface \<interface\> priority \<number\> + +This command sets priority for the interface for +`DIS (Designated Intermediate System)` election. The priority +range is 0 to 127. + +</div> + +<div class="cfgcmd"> + +set protocols isis interface \<interface\> psnp-interval +\<number\> + +This command sets PSNP interval in seconds. The interval range is 0 +to 127. + +</div> + +<div class="cfgcmd"> + +set protocols isis interface \<interface\> +no-three-way-handshake + +This command disables Three-Way Handshake for P2P adjacencies which +described in `5303`. Three-Way Handshake is enabled by default. + +</div> + +<div class="cfgcmd"> + +set protocols isis interface \<interface\> ldp-sync disable + +This command disables IGP-LDP sync for this specific interface. + +</div> + +<div class="cfgcmd"> + +set protocols isis interface \<interface\> ldp-sync holddown +\<seconds\> + +This command will change the hold down value for IGP-LDP synchronization +during convergence/interface flap events, but for this interface only. + +</div> + +#### Route Redistribution + +<div class="cfgcmd"> + +set protocols isis redistribute ipv4 \<route source\> level-1 + +This command redistributes routing information from the given route source +into the ISIS database as Level-1. There are six modes available for route +source: bgp, connected, kernel, ospf, rip, static. + +</div> + +<div class="cfgcmd"> + +set protocols isis redistribute ipv4 \<route source\> level-2 + +This command redistributes routing information from the given route source +into the ISIS database as Level-2. There are six modes available for route +source: bgp, connected, kernel, ospf, rip, static. + +</div> + +<div class="cfgcmd"> + +set protocols isis redistribute ipv4 \<route source\> +\<level-1|level-2\> metric \<number\> + +This command specifies metric for redistributed routes from the given route +source. There are six modes available for route source: bgp, connected, +kernel, ospf, rip, static. The metric range is 1 to 16777215. + +</div> + +<div class="cfgcmd"> + +set protocols isis redistribute ipv4 \<route source\> +\<level-1|level-2\> route-map \<name\> + +This command allows to use route map to filter redistributed routes from +the given route source. There are six modes available for route source: +bgp, connected, kernel, ospf, rip, static. + +</div> + +#### Timers + +<div class="cfgcmd"> + +set protocols isis lsp-gen-interval \<seconds\> + +This command sets minimum interval in seconds between regenerating same +LSP. The interval range is 1 to 120. + +</div> + +<div class="cfgcmd"> + +set protocols isis lsp-refresh-interval \<seconds\> + +This command sets LSP refresh interval in seconds. IS-IS generates LSPs +when the state of a link changes. However, to ensure that routing +databases on all routers remain converged, LSPs in stable networks are +generated on a regular basis even though there has been no change to +the state of the links. The interval range is 1 to 65235. The default +value is 900 seconds. + +</div> + +<div class="cfgcmd"> + +set protocols isis max-lsp-lifetime \<seconds\> + +This command sets LSP maximum LSP lifetime in seconds. The interval range +is 350 to 65535. LSPs remain in a database for 1200 seconds by default. +If they are not refreshed by that time, they are deleted. You can change +the LSP refresh interval or the LSP lifetime. The LSP refresh interval +should be less than the LSP lifetime or else LSPs will time out before +they are refreshed. + +</div> + +<div class="cfgcmd"> + +set protocols isis spf-interval \<seconds\> + +This command sets minimum interval between consecutive SPF calculations in +seconds.The interval range is 1 to 120. + +</div> + +<div class="cfgcmd"> + +set protocols isis spf-delay-ietf holddown \<milliseconds\> + +</div> + +<div class="cfgcmd"> + +set protocols isis spf-delay-ietf init-delay +\<milliseconds\> + +</div> + +<div class="cfgcmd"> + +set protocols isis spf-delay-ietf long-delay +\<milliseconds\> + +</div> + +<div class="cfgcmd"> + +set protocols isis spf-delay-ietf short-delay +\<milliseconds\> + +</div> + +<div class="cfgcmd"> + +set protocols isis spf-delay-ietf time-to-learn +\<milliseconds\> + +This commands specifies the Finite State Machine (FSM) intended to +control the timing of the execution of SPF calculations in response +to IGP events. The process described in `8405`. + +</div> + +## Examples + +### Enable IS-IS + +**Node 1:** + +``` none +set interfaces loopback lo address '192.168.255.255/32' +set interfaces ethernet eth1 address '192.0.2.1/24' + +set protocols isis interface eth1 +set protocols isis interface lo +set protocols isis net '49.0001.1921.6825.5255.00' +``` + +**Node 2:** + +``` none +set interfaces ethernet eth1 address '192.0.2.2/24' + +set interfaces loopback lo address '192.168.255.254/32' +set interfaces ethernet eth1 address '192.0.2.2/24' + +set protocols isis interface eth1 +set protocols isis interface lo +set protocols isis net '49.0001.1921.6825.5254.00' +``` + +This gives us the following neighborships, Level 1 and Level 2: + +``` none +Node-1@vyos:~$ show isis neighbor +Area VyOS: + System Id Interface L State Holdtime SNPA + vyos eth1 1 Up 28 0c87.6c09.0001 + vyos eth1 2 Up 28 0c87.6c09.0001 + +Node-2@vyos:~$ show isis neighbor +Area VyOS: + System Id Interface L State Holdtime SNPA + vyos eth1 1 Up 29 0c33.0280.0001 + vyos eth1 2 Up 28 0c33.0280.0001 +``` + +Here's the IP routes that are populated. Just the loopback: + +``` none +Node-1@vyos:~$ show ip route isis +Codes: K - kernel route, C - connected, S - static, R - RIP, + O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP, + T - Table, v - VNC, V - VNC-Direct, A - Babel, F - PBR, + f - OpenFabric, + > - selected route, * - FIB route, q - queued, r - rejected, b - backup + t - trapped, o - offload failure + +I 192.0.2.0/24 [115/20] via 192.0.2.2, eth1 inactive, weight 1, 00:02:22 +I>* 192.168.255.254/32 [115/20] via 192.0.2.2, eth1, weight 1, 00:02:22 + +Node-2@vyos:~$ show ip route isis +Codes: K - kernel route, C - connected, S - static, R - RIP, + O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP, + T - Table, v - VNC, V - VNC-Direct, A - Babel, F - PBR, + f - OpenFabric, + > - selected route, * - FIB route, q - queued, r - rejected, b - backup + t - trapped, o - offload failure + +I 192.0.2.0/24 [115/20] via 192.0.2.1, eth1 inactive, weight 1, 00:02:21 +I>* 192.168.255.255/32 [115/20] via 192.0.2.1, eth1, weight 1, 00:02:21 +``` + +### Enable IS-IS and redistribute routes not natively in IS-IS + +**Node 1:** + +``` none +set interfaces dummy dum0 address '203.0.113.1/24' +set interfaces ethernet eth1 address '192.0.2.1/24' + +set policy prefix-list EXPORT-ISIS rule 10 action 'permit' +set policy prefix-list EXPORT-ISIS rule 10 prefix '203.0.113.0/24' +set policy route-map EXPORT-ISIS rule 10 action 'permit' +set policy route-map EXPORT-ISIS rule 10 match ip address prefix-list 'EXPORT-ISIS' + +set protocols isis interface eth1 +set protocols isis net '49.0001.1921.6800.1002.00' +set protocols isis redistribute ipv4 connected level-2 route-map 'EXPORT-ISIS' +``` + +**Node 2:** + +``` none +set interfaces ethernet eth1 address '192.0.2.2/24' + +set protocols isis interface eth1 +set protocols isis net '49.0001.1921.6800.2002.00' +``` + +Routes on Node 2: + +``` none +Node-2@r2:~$ show ip route isis +Codes: K - kernel route, C - connected, S - static, R - RIP, + O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP, + T - Table, v - VNC, V - VNC-Direct, A - Babel, D - SHARP, + F - PBR, f - OpenFabric, + > - selected route, * - FIB route, q - queued route, r - rejected route + +I 203.0.113.0/24 [115/10] via 192.0.2.1, eth1, 00:03:42 +``` + +### Enable IS-IS and IGP-LDP synchronization + +**Node 1:** + +``` none +set interfaces loopback lo address 192.168.255.255/32 +set interfaces ethernet eth0 address 192.0.2.1/24 + +set protocols isis interface eth0 +set protocols isis interface lo passive +set protocols isis ldp-sync +set protocols isis net 49.0001.1921.6825.5255.00 + +set protocols mpls interface eth0 +set protocols mpls ldp discovery transport-ipv4-address 192.168.255.255 +set protocols mpls ldp interface lo +set protocols mpls ldp interface eth0 +set protocols mpls ldp parameters transport-prefer-ipv4 +set protocols mpls ldp router-id 192.168.255.255 +``` + +This gives us IGP-LDP synchronization for all non-loopback interfaces with +a holddown timer of zero seconds: + +``` none +Node-1@vyos:~$ show isis mpls ldp-sync +eth0 + LDP-IGP Synchronization enabled: yes + holddown timer in seconds: 0 + State: Sync achieved +``` + +### Enable IS-IS with Segment Routing (Experimental) + +**Node 1:** + +``` none +set interfaces loopback lo address '192.168.255.255/32' +set interfaces ethernet eth1 address '192.0.2.1/24' + +set protocols isis interface eth1 +set protocols isis interface lo +set protocols isis net '49.0001.1921.6825.5255.00' +set protocols isis segment-routing global-block high-label-value '599' +set protocols isis segment-routing global-block low-label-value '550' +set protocols isis segment-routing prefix 192.168.255.255/32 index value '1' +set protocols isis segment-routing prefix 192.168.255.255/32 index explicit-null +set protocols mpls interface 'eth1' +``` + +**Node 2:** + +``` none +set interfaces loopback lo address '192.168.255.254/32' +set interfaces ethernet eth1 address '192.0.2.2/24' + +set protocols isis interface eth1 +set protocols isis interface lo +set protocols isis net '49.0001.1921.6825.5254.00' +set protocols isis segment-routing global-block high-label-value '599' +set protocols isis segment-routing global-block low-label-value '550' +set protocols isis segment-routing prefix 192.168.255.254/32 index value '2' +set protocols isis segment-routing prefix 192.168.255.254/32 index explicit-null +set protocols mpls interface 'eth1' +``` + +This gives us MPLS segment routing enabled and labels for far end loopbacks: + +``` none +Node-1@vyos:~$ show mpls table + Inbound Label Type Nexthop Outbound Label + ---------------------------------------------------------------------- + 552 SR (IS-IS) 192.0.2.2 IPv4 Explicit Null <-- Node-2 loopback learned on Node-1 + 15000 SR (IS-IS) 192.0.2.2 implicit-null + 15001 SR (IS-IS) fe80::e87:6cff:fe09:1 implicit-null + 15002 SR (IS-IS) 192.0.2.2 implicit-null + 15003 SR (IS-IS) fe80::e87:6cff:fe09:1 implicit-null + +Node-2@vyos:~$ show mpls table + Inbound Label Type Nexthop Outbound Label + --------------------------------------------------------------------- + 551 SR (IS-IS) 192.0.2.1 IPv4 Explicit Null <-- Node-1 loopback learned on Node-2 + 15000 SR (IS-IS) 192.0.2.1 implicit-null + 15001 SR (IS-IS) fe80::e33:2ff:fe80:1 implicit-null + 15002 SR (IS-IS) 192.0.2.1 implicit-null + 15003 SR (IS-IS) fe80::e33:2ff:fe80:1 implicit-null +``` + +Here is the routing tables showing the MPLS segment routing label operations: + +``` none +Node-1@vyos:~$ show ip route isis +Codes: K - kernel route, C - connected, S - static, R - RIP, + O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP, + T - Table, v - VNC, V - VNC-Direct, A - Babel, F - PBR, + f - OpenFabric, + > - selected route, * - FIB route, q - queued, r - rejected, b - backup + t - trapped, o - offload failure + +I 192.0.2.0/24 [115/20] via 192.0.2.2, eth1 inactive, weight 1, 00:07:48 +I>* 192.168.255.254/32 [115/20] via 192.0.2.2, eth1, label IPv4 Explicit Null, weight 1, 00:03:39 + +Node-2@vyos:~$ show ip route isis +Codes: K - kernel route, C - connected, S - static, R - RIP, + O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP, + T - Table, v - VNC, V - VNC-Direct, A - Babel, F - PBR, + f - OpenFabric, + > - selected route, * - FIB route, q - queued, r - rejected, b - backup + t - trapped, o - offload failure + +I 192.0.2.0/24 [115/20] via 192.0.2.1, eth1 inactive, weight 1, 00:07:46 +I>* 192.168.255.255/32 [115/20] via 192.0.2.1, eth1, label IPv4 Explicit Null, weight 1, 00:03:43 +``` diff --git a/docs/configuration/protocols/md-mpls.md b/docs/configuration/protocols/md-mpls.md new file mode 100644 index 00000000..8b729d8c --- /dev/null +++ b/docs/configuration/protocols/md-mpls.md @@ -0,0 +1,419 @@ +# MPLS + +`MPLS (Multi-Protocol Label Switching)` is a packet forwarding paradigm +which differs from regular IP forwarding. Instead of IP addresses being used to +make the decision on finding the exit interface, a router will instead use an +exact match on a 32 bit/4 byte header called the MPLS label. This label is +inserted between the ethernet (layer 2) header and the IP (layer 3) header. +One can statically or dynamically assign label allocations, but we will focus +on dynamic allocation of labels using some sort of label distribution protocol +(such as the aptly named Label Distribution Protocol / LDP, Resource Reservation +Protocol / RSVP, or Segment Routing through OSPF/ISIS). These protocols allow +for the creation of a unidirectional/unicast path called a labeled switched +path (initialized as LSP) throughout the network that operates very much like +a tunnel through the network. An easy way of thinking about how an MPLS LSP +actually forwards traffic throughout a network is to think of a GRE tunnel. +They are not the same in how they operate, but they are the same in how they +handle the tunneled packet. It would be good to think of MPLS as a tunneling +technology that can be used to transport many different types of packets, to +aid in traffic engineering by allowing one to specify paths throughout the +network (using RSVP or SR), and to generally allow for easier intra/inter +network transport of data packets. + +For more information on how MPLS label switching works, please go visit +[Wikipedia (MPLS)](https://en.wikipedia.org/wiki/Multiprotocol_Label_Switching). + +<div class="note"> + +<div class="title"> + +Note + +</div> + +MPLS support in VyOS is not finished yet, and therefore its +functionality is limited. Currently there is no support for MPLS enabled VPN +services such as L2VPNs and mVPNs. RSVP support is also not present as the +underlying routing stack (FRR) does not implement it. Currently VyOS +implements LDP as described in RFC 5036; other LDP standard are the +following ones: RFC 6720, RFC 6667, RFC 5919, RFC 5561, RFC 7552, RFC 4447. +Because MPLS is already available (FRR also supports RFC 3031). + +</div> + +## Label Distribution Protocol + +The `MPLS (Multi-Protocol Label Switching)` architecture does not assume +a single protocol to create MPLS paths. VyOS supports the Label Distribution +Protocol (LDP) as implemented by FRR, based on `5036`. + +`LDP (Label Distribution Protocol)` is a TCP based MPLS signaling protocol +that distributes labels creating MPLS label switched paths in a dynamic manner. +LDP is not a routing protocol, as it relies on other routing protocols for +forwarding decisions. LDP cannot bootstrap itself, and therefore relies on said +routing protocols for communication with other routers that use LDP. + +In order to allow for LDP on the local router to exchange label advertisements +with other routers, a TCP session will be established between automatically +discovered and statically assigned routers. LDP will try to establish a TCP +session to the **transport address** of other routers. Therefore for LDP to +function properly please make sure the transport address is shown in the +routing table and reachable to traffic at all times. + +It is highly recommended to use the same address for both the LDP router-id and +the discovery transport address, but for VyOS MPLS LDP to work both parameters +must be explicitly set in the configuration. + +Another thing to keep in mind with LDP is that much like BGP, it is a protocol +that runs on top of TCP. It however does not have an ability to do something +like a refresh capability like BGPs route refresh capability. Therefore one +might have to reset the neighbor for a capability change or a configuration +change to work. + +## Configuration Options + +<div class="cfgcmd"> + +set protocols mpls interface \<interface\> + +Use this command to enable MPLS processing on the interface you define. + +</div> + +<div class="cfgcmd"> + +set protocols mpls ldp interface \<interface\> + +Use this command to enable LDP on the interface you define. + +</div> + +<div class="cfgcmd"> + +set protocols mpls ldp router-id \<address\> + +Use this command to configure the IP address used as the LDP router-id of the +local device. + +</div> + +<div class="cfgcmd"> + +set protocols mpls ldp discovery transport-ipv4-address \<address\> + +</div> + +<div class="cfgcmd"> + +set protocols mpls ldp discovery transport-ipv6-address \<address\> + +Use this command to set the IPv4 or IPv6 transport-address used by LDP. + +</div> + +<div class="cfgcmd"> + +set protocols mpls ldp neighbor \<address\> password \<password\> + +Use this command to configure authentication for LDP peers. Set the +IP address of the LDP peer and a password that should be shared in +order to become neighbors. + +</div> + +<div class="cfgcmd"> + +set protocols mpls ldp neighbor \<address\> session-holdtime \<seconds\> + +Use this command to configure a specific session hold time for LDP peers. +Set the IP address of the LDP peer and a session hold time that should be +configured for it. You may have to reset the neighbor for this to work. + +</div> + +<div class="cfgcmd"> + +set protocols mpls ldp neighbor \<address\> ttl-security +\<disable | hop count\> + +Use this command to enable, disable, or specify hop count for TTL security +for LDP peers. By default the value is set to 255 (or max TTL). + +</div> + +<div class="cfgcmd"> + +set protocols mpls ldp discovery hello-ipv4-interval \<seconds\> + +</div> + +<div class="cfgcmd"> + +set protocols mpls ldp discovery hello-ipv4-holdtime \<seconds\> + +</div> + +<div class="cfgcmd"> + +set protocols mpls ldp discovery hello-ipv6-interval \<seconds\> + +</div> + +<div class="cfgcmd"> + +set protocols mpls ldp discovery hello-ipv6-holdtime \<seconds\> + +Use these commands if you would like to set the discovery hello and hold time +parameters. + +</div> + +<div class="cfgcmd"> + +set protocols mpls ldp discovery session-ipv4-holdtime \<seconds\> + +</div> + +<div class="cfgcmd"> + +set protocols mpls ldp discovery session-ipv6-holdtime \<seconds\> + +Use this command if you would like to set the TCP session hold time intervals. + +</div> + +<div class="cfgcmd"> + +set protocols mpls ldp import ipv4 import-filter filter-access-list +\<access list number\> + +</div> + +<div class="cfgcmd"> + +set protocols mpls ldp import ipv6 import-filter filter-access-list6 +\<access list number\> + +Use these commands to control the importing of forwarding equivalence classes +(FECs) for LDP from neighbors. This would be useful for example on only +accepting the labeled routes that are needed and not ones that are not +needed, such as accepting loopback interfaces and rejecting all others. + +</div> + +<div class="cfgcmd"> + +set protocols mpls ldp export ipv4 export-filter filter-access-list +\<access list number\> + +</div> + +<div class="cfgcmd"> + +set protocols mpls ldp export ipv6 export-filter filter-access-list6 +\<access list number\> + +Use these commands to control the exporting of forwarding equivalence classes +(FECs) for LDP to neighbors. This would be useful for example on only +announcing the labeled routes that are needed and not ones that are not +needed, such as announcing loopback interfaces and no others. + +</div> + +<div class="cfgcmd"> + +set protocols mpls ldp export ipv4 explicit-null + +</div> + +<div class="cfgcmd"> + +set protocols mpls ldp export ipv6 explicit-null + +Use this command if you would like for the router to advertise FECs with a +label of 0 for explicit null operations. + +</div> + +<div class="cfgcmd"> + +set protocols mpls ldp allocation ipv4 access-list +\<access list number\> + +</div> + +<div class="cfgcmd"> + +set protocols mpls ldp allocation ipv6 access-list6 +\<access list number\> + +Use this command if you would like to control the local FEC allocations for +LDP. A good example would be for your local router to not allocate a label for +everything. Just a label for what it's useful. A good example would be just a +loopback label. + +</div> + +<div class="cfgcmd"> + +set protocols mpls ldp parameters cisco-interop-tlv + +Use this command to use a Cisco non-compliant format to send and interpret +the Dual-Stack capability TLV for IPv6 LDP communications. This is related to +`7552`. + +</div> + +<div class="cfgcmd"> + +set protocols mpls ldp parameters ordered-control + +Use this command to use ordered label distribution control mode. FRR +by default uses independent label distribution control mode for label +distribution. This is related to `5036`. + +</div> + +<div class="cfgcmd"> + +set protocols mpls ldp parameters transport-prefer-ipv4 + +Use this command to prefer IPv4 for TCP peer transport connection for LDP +when both an IPv4 and IPv6 LDP address are configured on the same interface. + +</div> + +<div class="cfgcmd"> + +set protocols mpls ldp targeted-neighbor ipv4 enable + +</div> + +<div class="cfgcmd"> + +set protocols mpls ldp targeted-neighbor ipv6 enable + +Use this command to enable targeted LDP sessions to the local router. The +router will then respond to any sessions that are trying to connect to it that +are not a link local type of TCP connection. + +</div> + +<div class="cfgcmd"> + +set protocols mpls ldp targeted-neighbor ipv4 address \<address\> + +</div> + +<div class="cfgcmd"> + +set protocols mpls ldp targeted-neighbor ipv6 address \<address\> + +Use this command to enable the local router to try and connect with a targeted +LDP session to another router. + +</div> + +<div class="cfgcmd"> + +set protocols mpls ldp targeted-neighbor ipv4 hello-holdtime +\<seconds\> + +</div> + +<div class="cfgcmd"> + +set protocols mpls ldp targeted-neighbor ipv4 hello-interval +\<seconds\> + +</div> + +<div class="cfgcmd"> + +set protocols mpls ldp targeted-neighbor ipv6 hello-holdtime +\<seconds\> + +</div> + +<div class="cfgcmd"> + +set protocols mpls ldp targeted-neighbor ipv6 hello-interval +\<seconds\> + +Use these commands if you would like to set the discovery hello and hold time +parameters for the targeted LDP neighbors. + +</div> + +### Sample configuration to setup LDP on VyOS + +``` none +set protocols ospf area 0 network '192.168.255.252/32' <--- Routing for loopback +set protocols ospf area 0 network '192.168.0.5/32' <--- Routing for an interface connecting to the network +set protocols ospf parameters router-id '192.168.255.252' <--- Router ID setting for OSPF +set protocols mpls interface 'eth1' <--- Enable MPLS for an interface connecting to network +set protocols mpls ldp discovery transport-ipv4-address '192.168.255.252' <--- Transport address for LDP for TCP sessions to connect to +set protocols mpls ldp interface 'eth1' <--- Enable LDP for an interface connecting to network +set protocols mpls ldp interface 'lo' <--- Enable LDP on loopback for future services connectivity +set protocols mpls ldp router-id '192.168.255.252' <--- Router ID setting for LDP +set interfaces ethernet eth1 address '192.168.0.5/31' <--- Interface IP for connecting to network +set interfaces loopback lo address '192.168.255.252/32' <--- Interface loopback IP for router ID and other uses +``` + +## Operational Mode Commands + +When LDP is working, you will be able to see label information in the outcome +of `show ip route`. Besides that information, there are also specific *show* +commands for LDP: + +### Show + +<div class="opcmd"> + +show mpls ldp binding + +Use this command to see the Label Information Base. + +</div> + +<div class="opcmd"> + +show mpls ldp discovery + +Use this command to see discovery hello information + +</div> + +<div class="opcmd"> + +show mpls ldp interface + +Use this command to see LDP interface information + +</div> + +<div class="opcmd"> + +show mpls ldp neighbor + +Use this command to see LDP neighbor information + +</div> + +<div class="opcmd"> + +show mpls ldp neighbor detail + +Use this command to see detailed LDP neighbor information + +</div> + +### Reset + +<div class="opcmd"> + +reset mpls ldp neighbor \<IPv4 or IPv6 address\> + +Use this command to reset an LDP neighbor/TCP session that is established + +</div> diff --git a/docs/configuration/protocols/md-ospf.md b/docs/configuration/protocols/md-ospf.md new file mode 100644 index 00000000..a70bd840 --- /dev/null +++ b/docs/configuration/protocols/md-ospf.md @@ -0,0 +1,1772 @@ +# OSPF + +`OSPF (Open Shortest Path First)` is a routing protocol for Internet +Protocol (IP) networks. It uses a link state routing (LSR) algorithm and falls +into the group of interior gateway protocols (IGPs), operating within a single +autonomous system (AS). It is defined as OSPF Version 2 in `2328` (1998) +for IPv4. Updates for IPv6 are specified as OSPF Version 3 in `5340` +(2008). OSPF supports the `CIDR (Classless Inter-Domain Routing)` +addressing model. + +OSPF is a widely used IGP in large enterprise networks. + +## OSPFv2 (IPv4) + +### Configuration + +#### General + +VyOS does not have a special command to start the OSPF process. The OSPF process +starts when the first ospf enabled interface is configured. + +<div class="cfgcmd"> + +set protocols ospf area \<number\> network \<A.B.C.D/M\> + +This command specifies the OSPF enabled interface(s). If the interface has +an address from defined range then the command enables OSPF on this +interface so router can provide network information to the other ospf +routers via this interface. + +This command is also used to enable the OSPF process. The area number can be +specified in decimal notation in the range from 0 to 4294967295. Or it +can be specified in dotted decimal notation similar to ip address. + +Prefix length in interface must be equal or bigger (i.e. smaller network) +than prefix length in network statement. For example statement above doesn't +enable ospf on interface with address 192.168.1.1/23, but it does on +interface with address 192.168.1.129/25. + +In some cases it may be more convenient to enable OSPF on a per +interface/subnet +basis `set protocols ospf interface <interface> area <x.x.x.x | x>` + +</div> + +<div class="cfgcmd"> + +set protocols ospf auto-cost reference-bandwidth \<number\> + +This command sets the reference bandwidth for cost calculations, where +bandwidth can be in range from 1 to 4294967, specified in Mbits/s. The +default is 100Mbit/s (i.e. a link of bandwidth 100Mbit/s or higher will +have a cost of 1. Cost of lower bandwidth links will be scaled with +reference to this cost). + +</div> + +<div class="cfgcmd"> + +set protocols ospf parameters router-id \<rid\> + +This command sets the router-ID of the OSPF process. The router-ID may be an +IP address of the router, but need not be – it can be any arbitrary 32bit +number. However it MUST be unique within the entire OSPF domain to the OSPF +speaker – bad things will happen if multiple OSPF speakers are configured +with the same router-ID! + +</div> + +#### Optional + +<div class="cfgcmd"> + +set protocols ospf default-information originate \[always\] +\[metric \<number\>\] \[metric-type \<1|2\>\] \[route-map \<name\>\] + +Originate an AS-External (type-5) LSA describing a default route into all +external-routing capable areas, of the specified metric and metric type. +If the `always` keyword is given then the default is always +advertised, even when there is no default present in the routing table. +The argument `route-map` specifies to advertise the default route +if the route map is satisfied. + +</div> + +<div class="cfgcmd"> + +set protocols ospf distance global \<distance\> + +This command change distance value of OSPF globally. +The distance range is 1 to 255. + +</div> + +<div class="cfgcmd"> + +set protocols ospf distance ospf \<external[|inter-area|](##SUBST##|inter-area|)intra-area\> +\<distance\> + +This command change distance value of OSPF. The arguments are the distance +values for external routes, inter-area routes and intra-area routes +respectively. The distance range is 1 to 255. + +<div class="note"> + +<div class="title"> + +Note + +</div> + +Routes with a distance of 255 are effectively disabled and not +installed into the kernel. + +</div> + +</div> + +<div class="cfgcmd"> + +set protocols ospf log-adjacency-changes \[detail\] + +This command allows to log changes in adjacency. With the optional +`detail` argument, all changes in adjacency status are shown. +Without `detail`, only changes to full or regressions are shown. + +</div> + +<div class="cfgcmd"> + +set protocols ospf max-metric router-lsa +\<administrative[|on-shutdown \<seconds\>|](##SUBST##|on-shutdown <seconds>|)on-startup \<seconds\>\> + +This enables `3137` support, where the OSPF process describes its +transit links in its router-LSA as having infinite distance so that other +routers will avoid calculating transit paths through the router while +still being able to reach networks through the router. + +This support may be enabled administratively (and indefinitely) with the +`administrative` command. It may also be enabled conditionally. +Conditional enabling of max-metric router-lsas can be for a period of +seconds after startup with the `on-startup <seconds>` command +and/or for a period of seconds prior to shutdown with the +`on-shutdown <seconds>` command. The time range is 5 to 86400. + +</div> + +<div class="cfgcmd"> + +set protocols ospf parameters abr-type +\<cisco[|ibm|](##SUBST##|ibm|)shortcut|standard\> + +This command selects ABR model. OSPF router supports four ABR models: + +**cisco** – a router will be considered as ABR if it has several configured +links to the networks in different areas one of which is a backbone area. +Moreover, the link to the backbone area should be active (working). +**ibm** – identical to "cisco" model but in this case a backbone area link +may not be active. +**standard** – router has several active links to different areas. +**shortcut** – identical to "standard" but in this model a router is +allowed to use a connected areas topology without involving a backbone +area for inter-area connections. + +Detailed information about "cisco" and "ibm" models differences can be +found in `3509`. A "shortcut" model allows ABR to create routes +between areas based on the topology of the areas connected to this router +but not using a backbone area in case if non-backbone route will be +cheaper. For more information about "shortcut" model, +see <span class="title-ref">ospf-shortcut-abr-02.txt</span> + +</div> + +<div class="cfgcmd"> + +set protocols ospf parameters rfc1583-compatibility + +`2328`, the successor to `1583`, suggests according to section +G.2 (changes) in section 16.4.1 a change to the path preference algorithm +that prevents possible routing loops that were possible in the old version +of OSPFv2. More specifically it demands that inter-area paths and +intra-area backbone path are now of equal preference but still both +preferred to external paths. + +This command should NOT be set normally. + +</div> + +<div class="cfgcmd"> + +set protocols ospf interface \<interface\> passive \[disable\] + +This command specifies interface as passive. Passive interface advertises +its address, but does not run the OSPF protocol (adjacencies are not formed +and hello packets are not generated). + +The optional <span class="title-ref">disable</span> option allows to exclude interface from passive state. +This command is used if the command `passive-interface default` was +configured. + +</div> + +<div class="cfgcmd"> + +set protocols ospf passive-interface default + +This command specifies all interfaces as passive by default. Because this +command changes the configuration logic to a default passive; therefore, +interfaces where router adjacencies are expected need to be configured +by setting the `passive disable` flag for the specific interface. + +</div> + +<div class="cfgcmd"> + +set protocols ospf maximum-paths \<1-64\> + +Use this command to control the maximum number of equal cost paths to reach +a specific destination. The upper limit may differ if you change the value +of MULTIPATH_NUM during compilation. The default is MULTIPATH_NUM (64). + +</div> + +<div class="cfgcmd"> + +set protocols ospf refresh timers \<seconds\> + +The router automatically updates link-state information with its neighbors. +Only an obsolete information is updated which age has exceeded a specific +threshold. This parameter changes a threshold value, which by default is +1800 seconds (half an hour). The value is applied to the whole OSPF router. +The timer range is 10 to 1800. + +</div> + +<div class="cfgcmd"> + +set protocols ospf timers throttle spf +\<delay[|initial-holdtime|](##SUBST##|initial-holdtime|)max-holdtime\> \<seconds\> + +This command sets the initial delay, the initial-holdtime and the +maximum-holdtime between when SPF is calculated and the event which +triggered the calculation. The times are specified in milliseconds and must +be in the range of 0 to 600000 milliseconds. `delay` sets the +initial SPF schedule delay in milliseconds. The default value is 200 ms. +`initial-holdtime` sets the minimum hold time between two +consecutive SPF calculations. The default value is 1000 ms. +`max-holdtime` sets the maximum wait time between two +consecutive SPF calculations. The default value is 10000 ms. + +</div> + +<div class="cfgcmd"> + +set protocols ospf ldp-sync + +This command will enable IGP-LDP synchronization globally for OSPF. This +requires for LDP to be functional. This is described in `5443`. By +default all interfaces operational in OSPF are enabled for synchronization. +Loopbacks are exempt. + +</div> + +<div class="cfgcmd"> + +set protocols ospf ldp-sync holddown \<seconds\> + +This command will change the hold down value globally for IGP-LDP +synchronization during convergence/interface flap events. + +</div> + +<div class="cfgcmd"> + +set protocols ospf capability opaque + +ospfd supports Opaque LSA `2370` as partial support for MPLS Traffic +Engineering LSAs. The opaque-lsa capability must be enabled in the +configuration. + +An alternate command could be "mpls-te on" (Traffic Engineering) + +<div class="note"> + +<div class="title"> + +Note + +</div> + +FRR offers only partial support for some of the routing +protocol extensions that are used with MPLS-TE; it does not +support a complete RSVP-TE solution. + +</div> + +</div> + +#### Area Configuration + +<div class="cfgcmd"> + +set protocols ospf area \<number\> area-type stub + +This command specifies the area to be a Stub Area. That is, an area where +no router originates routes external to OSPF and hence an area where all +external routes are via the ABR(s). Hence, ABRs for such an area do not +need to pass AS-External LSAs (type-5) or ASBR-Summary LSAs (type-4) into +the area. They need only pass Network-Summary (type-3) LSAs into such an +area, along with a default-route summary. + +</div> + +<div class="cfgcmd"> + +set protocols ospf area \<number\> area-type stub no-summary + +This command specifies the area to be a Totally Stub Area. In addition to +stub area limitations this area type prevents an ABR from injecting +Network-Summary (type-3) LSAs into the specified stub area. Only default +summary route is allowed. + +</div> + +<div class="cfgcmd"> + +set protocols ospf area \<number\> area-type stub default-cost +\<number\> + +This command sets the cost of default-summary LSAs announced to stubby +areas. The cost range is 0 to 16777215. + +</div> + +<div class="cfgcmd"> + +set protocols ospf area \<number\> area-type nssa + +This command specifies the area to be a Not So Stubby Area. External +routing information is imported into an NSSA in Type-7 LSAs. Type-7 LSAs +are similar to Type-5 AS-external LSAs, except that they can only be +flooded into the NSSA. In order to further propagate the NSSA external +information, the Type-7 LSA must be translated to a Type-5 AS-external-LSA +by the NSSA ABR. + +</div> + +<div class="cfgcmd"> + +set protocols ospf area \<number\> area-type nssa no-summary + +This command specifies the area to be a NSSA Totally Stub Area. ABRs for +such an area do not need to pass Network-Summary (type-3) LSAs (except the +default summary route), ASBR-Summary LSAs (type-4) and AS-External LSAs +(type-5) into the area. But Type-7 LSAs that convert to Type-5 at the NSSA +ABR are allowed. + +</div> + +<div class="cfgcmd"> + +set protocols ospf area \<number\> area-type nssa default-cost +\<number\> + +This command sets the default cost of LSAs announced to NSSA areas. +The cost range is 0 to 16777215. + +</div> + +<div class="cfgcmd"> + +set protocols ospf area \<number\> area-type nssa translate +\<always[|candidate|](##SUBST##|candidate|)never\> + +Specifies whether this NSSA border router will unconditionally translate +Type-7 LSAs into Type-5 LSAs. When role is Always, Type-7 LSAs are +translated into Type-5 LSAs regardless of the translator state of other +NSSA border routers. When role is Candidate, this router participates in +the translator election to determine if it will perform the translations +duties. When role is Never, this router will never translate Type-7 LSAs +into Type-5 LSAs. + +</div> + +<div class="cfgcmd"> + +set protocols ospf area \<number\> authentication plaintext-password + +This command specifies that simple password authentication should be used +for the given area. The password must also be configured on a per-interface +basis. + +</div> + +<div class="cfgcmd"> + +set protocols ospf area \<number\> authentication md5 + +This command specify that OSPF packets must be authenticated with MD5 HMACs +within the given area. Keying material must also be configured on a +per-interface basis. + +</div> + +<div class="cfgcmd"> + +set protocols ospf area \<number\> range \<A.B.C.D/M\> \[cost \<number\>\] + +This command summarizes intra area paths from specified area into one +summary-LSA (Type-3) announced to other areas. This command can be used +only in ABR and ONLY router-LSAs (Type-1) and network-LSAs (Type-2) +(i.e. LSAs with scope area) can be summarized. AS-external-LSAs (Type-5) +can’t be summarized - their scope is AS. The optional argument +`cost` specifies the aggregated link metric. The metric range is 0 +to 16777215. + +</div> + +<div class="cfgcmd"> + +set protocols ospf area \<number\> range \<A.B.C.D/M\> not-advertise + +This command instead of summarizing intra area paths filter them - i.e. +intra area paths from this range are not advertised into other areas. +This command makes sense in ABR only. + +</div> + +<div class="cfgcmd"> + +set protocols ospf area \<number\> export-list \<acl_number\> + +Filter Type-3 summary-LSAs announced to other areas originated from +intra- area paths from specified area. +This command makes sense in ABR only. + +</div> + +<div class="cfgcmd"> + +set protocols ospf area \<number\> import-list \<acl_number\> + +Same as export-list, but it applies to paths announced into specified +area as Type-3 summary-LSAs. +This command makes sense in ABR only. + +</div> + +<div class="cfgcmd"> + +set protocols ospf area \<number\> range \<A.B.C.D/M\> substitute +\<E.F.G.H/M\> + +One Type-3 summary-LSA with routing info \<E.F.G.H/M\> is announced into +backbone area if defined area contains at least one intra-area network +(i.e. described with router-LSA or network-LSA) from range \<A.B.C.D/M\>. +This command makes sense in ABR only. + +</div> + +<div class="cfgcmd"> + +set protocols ospf area \<number\> shortcut \<default[|disable|](##SUBST##|disable|)enable\> + +This parameter allows to "shortcut" routes (non-backbone) for inter-area +routes. There are three modes available for routes shortcutting: + +**default** – this area will be used for shortcutting only if ABR does not +have a link to the backbone area or this link was lost. +**enable** – the area will be used for shortcutting every time the route +that goes through it is cheaper. +**disable** – this area is never used by ABR for routes shortcutting. + +</div> + +<div class="cfgcmd"> + +set protocols ospf area \<number\> virtual-link \<A.B.C.D\> + +Provides a backbone area coherence by virtual link establishment. + +In general, OSPF protocol requires a backbone area (area 0) to be coherent +and fully connected. I.e. any backbone area router must have a route to any +other backbone area router. Moreover, every ABR must have a link to +backbone area. However, it is not always possible to have a physical link +to a backbone area. In this case between two ABR (one of them has a link to +the backbone area) in the area (not stub area) a virtual link is organized. + +\<number\> – area identifier through which a virtual link goes. +\<A.B.C.D\> – ABR router-id with which a virtual link is established. Virtual +link must be configured on both routers. + +Formally, a virtual link looks like a point-to-point network connecting two +ABR from one area one of which physically connected to a backbone area. +This pseudo-network is considered to belong to a backbone area. + +</div> + +#### Interface Configuration + +<div class="cfgcmd"> + +set protocols ospf interface \<interface\> area \<x.x.x.x | x\> + +Enable ospf on an interface and set associated area. + +If you have a lot of interfaces, and/or a lot of subnets, then enabling +OSPF via this command may result in a slight performance improvement. + +</div> + +<div class="cfgcmd"> + +set protocols ospf interface \<interface\> authentication +plaintext-password \<text\> + +This command sets OSPF authentication key to a simple password. After +setting, all OSPF packets are authenticated. Key has length up to 8 chars. + +Simple text password authentication is insecure and deprecated in favour of +MD5 HMAC authentication. + +</div> + +<div class="cfgcmd"> + +set protocols ospf interface \<interface\> authentication md5 +key-id \<id\> md5-key \<text\> + +This command specifys that MD5 HMAC authentication must be used on this +interface. It sets OSPF authentication key to a cryptographic password. +Key-id identifies secret key used to create the message digest. This ID +is part of the protocol and must be consistent across routers on a link. +The key can be long up to 16 chars (larger strings will be truncated), +and is associated with the given key-id. + +</div> + +<div class="cfgcmd"> + +set protocols ospf interface \<interface\> bandwidth \<number\> + +This command sets the interface bandwidth for cost calculations, where +bandwidth can be in range from 1 to 100000, specified in Mbits/s. + +</div> + +<div class="cfgcmd"> + +set protocols ospf interface \<interface\> cost \<number\> + +This command sets link cost for the specified interface. The cost value is +set to router-LSA’s metric field and used for SPF calculation. The cost +range is 1 to 65535. + +</div> + +<div class="cfgcmd"> + +set protocols ospf interface \<interface\> dead-interval \<number\> + +Set number of seconds for router Dead Interval timer value used for Wait +Timer and Inactivity Timer. This value must be the same for all routers +attached to a common network. The default value is 40 seconds. The +interval range is 1 to 65535. + +</div> + +<div class="cfgcmd"> + +set protocols ospf interface \<interface\> hello-multiplier \<number\> + +The hello-multiplier specifies how many Hellos to send per second, from 1 +(every second) to 10 (every 100ms). Thus one can have 1s convergence time +for OSPF. If this form is specified, then the hello-interval advertised in +Hello packets is set to 0 and the hello-interval on received Hello packets +is not checked, thus the hello-multiplier need NOT be the same across +multiple routers on a common link. + +</div> + +<div class="cfgcmd"> + +set protocols ospf interface \<interface\> hello-interval \<number\> + +Set number of seconds for Hello Interval timer value. Setting this value, +Hello packet will be sent every timer value seconds on the specified +interface. This value must be the same for all routers attached to a +common network. The default value is 10 seconds. The interval range is 1 +to 65535. + +</div> + +<div class="cfgcmd"> + +set protocols ospf interface \<interface\> bfd + +This command enables `BFD (Bidirectional Forwarding Detection)` on +this OSPF link interface. + +</div> + +<div class="cfgcmd"> + +set protocols ospf interface \<interface\> mtu-ignore + +This command disables check of the MTU value in the OSPF DBD packets. Thus, +use of this command allows the OSPF adjacency to reach the FULL state even +though there is an interface MTU mismatch between two OSPF routers. + +</div> + +<div class="cfgcmd"> + +set protocols ospf interface \<interface\> network \<type\> + +This command allows to specify the distribution type for the network +connected to this interface: + +**broadcast** – broadcast IP addresses distribution. +**non-broadcast** – address distribution in NBMA networks topology. +**point-to-multipoint** – address distribution in point-to-multipoint +networks. +**point-to-point** – address distribution in point-to-point networks. + +</div> + +<div class="cfgcmd"> + +set protocols ospf interface \<interface\> priority \<number\> + +This command sets Router Priority integer value. The router with the +highest priority will be more eligible to become Designated Router. +Setting the value to 0, makes the router ineligible to become +Designated Router. The default value is 1. The interval range is 0 to 255. + +</div> + +<div class="cfgcmd"> + +set protocols ospf interface \<interface\> retransmit-interval +\<number\> + +This command sets number of seconds for RxmtInterval timer value. This +value is used when retransmitting Database Description and Link State +Request packets if acknowledge was not received. The default value is 5 +seconds. The interval range is 3 to 65535. + +</div> + +<div class="cfgcmd"> + +set protocols ospf interface \<interface\> transmit-delay \<number\> + +This command sets number of seconds for InfTransDelay value. It allows to +set and adjust for each interface the delay interval before starting the +synchronizing process of the router's database with all neighbors. The +default value is 1 seconds. The interval range is 3 to 65535. + +</div> + +<div class="cfgcmd"> + +set protocols ospf interface \<interface\> ldp-sync disable + +This command disables IGP-LDP sync for this specific interface. + +</div> + +<div class="cfgcmd"> + +set protocols ospf interface \<interface\> ldp-sync holddown +\<seconds\> + +This command will change the hold down value for IGP-LDP synchronization +during convergence/interface flap events, but for this interface only. + +</div> + +#### External Route Summarisation + +This feature summarises originated external LSAs (Type-5 and Type-7). Summary +Route will be originated on-behalf of all matched external LSAs. + +<div class="cfgcmd"> + +set protocols ospf aggregation timer \<seconds\> + +Configure aggregation delay timer interval. + +Summarisation starts only after this delay timer expiry. + +</div> + +<div class="cfgcmd"> + +set protocols ospf summary-address x.x.x.x/y \[tag (1-4294967295)\] + +This command enable/disables summarisation for the configured address range. + +Tag is the optional parameter. If tag configured Summary route will be +originated with the configured tag. + +</div> + +<div class="cfgcmd"> + +set protocols ospf summary-address x.x.x.x/y no-advertise + +This command to ensure not advertise the summary lsa for the matched +external LSAs. + +</div> + +#### Graceful Restart + +<div class="cfgcmd"> + +set protocols ospf graceful-restart \[grace-period (1-1800)\] + +Configure Graceful Restart `3623` restarting support. When enabled, +the default grace period is 120 seconds. + +To perform a graceful shutdown, the FRR `graceful-restart prepare ip ospf` EXEC-level command needs to be issued before restarting the +ospfd daemon. + +</div> + +<div class="cfgcmd"> + +set protocols ospf graceful-restart helper enable \[router-id A.B.C.D\] + +Configure Graceful Restart `3623` helper support. By default, helper support +is disabled for all neighbours. This config enables/disables helper support +on this router for all neighbours. + +To enable/disable helper support for a specific neighbour, the router-id +(A.B.C.D) has to be specified. + +</div> + +<div class="cfgcmd"> + +set protocols ospf graceful-restart helper no-strict-lsa-checking + +By default <span class="title-ref">strict-lsa-checking</span> is configured then the helper will abort +the Graceful Restart when a LSA change occurs which affects the restarting +router. + +This command disables it. + +</div> + +<div class="cfgcmd"> + +set protocols ospf graceful-restart helper supported-grace-time + +Supports as HELPER for configured grace period. + +</div> + +<div class="cfgcmd"> + +set protocols ospf graceful-restart helper planned-only + +It helps to support as HELPER only for planned restarts. + +By default, it supports both planned and unplanned outages. + +</div> + +#### Manual Neighbor Configuration + +OSPF routing devices normally discover their neighbors dynamically by +listening to the broadcast or multicast hello packets on the network. +Because an NBMA network does not support broadcast (or multicast), the +device cannot discover its neighbors dynamically, so you must configure all +the neighbors statically. + +<div class="cfgcmd"> + +set protocols ospf neighbor \<A.B.C.D\> + +This command specifies the IP address of the neighboring device. + +</div> + +<div class="cfgcmd"> + +set protocols ospf neighbor \<A.B.C.D\> poll-interval \<seconds\> + +This command specifies the length of time, in seconds, before the routing +device sends hello packets out of the interface before it establishes +adjacency with a neighbor. The range is 1 to 65535 seconds. The default +value is 60 seconds. + +</div> + +<div class="cfgcmd"> + +set protocols ospf neighbor \<A.B.C.D\> priority \<number\> + +This command specifies the router priority value of the nonbroadcast +neighbor associated with the IP address specified. The default is 0. +This keyword does not apply to point-to-multipoint interfaces. + +</div> + +#### Redistribution Configuration + +<div class="cfgcmd"> + +set protocols ospf redistribute \<route source\> + +This command redistributes routing information from the given route source +to the OSPF process. There are five modes available for route source: bgp, +connected, kernel, rip, static. + +</div> + +<div class="cfgcmd"> + +set protocols ospf default-metric \<number\> + +This command specifies the default metric value of redistributed routes. +The metric range is 0 to 16777214. + +</div> + +<div class="cfgcmd"> + +set protocols ospf redistribute \<route source\> metric \<number\> + +This command specifies metric for redistributed routes from the given +route source. There are five modes available for route source: bgp, +connected, kernel, rip, static. The metric range is 1 to 16777214. + +</div> + +<div class="cfgcmd"> + +set protocols ospf redistribute \<route source\> metric-type \<1|2\> + +This command specifies metric type for redistributed routes. Difference +between two metric types that metric type 1 is a metric which is +"commensurable" with inner OSPF links. When calculating a metric to the +external destination, the full path metric is calculated as a metric sum +path of a router which had advertised this link plus the link metric. +Thus, a route with the least summary metric will be selected. If external +link is advertised with metric type 2 the path is selected which lies +through the router which advertised this link with the least metric +despite of the fact that internal path to this router is longer (with more +cost). However, if two routers advertised an external link and with metric +type 2 the preference is given to the path which lies through the router +with a shorter internal path. If two different routers advertised two +links to the same external destimation but with different metric type, +metric type 1 is preferred. If type of a metric left undefined the router +will consider these external links to have a default metric type 2. + +</div> + +<div class="cfgcmd"> + +set protocols ospf redistribute \<route source\> route-map \<name\> + +This command allows to use route map to filter redistributed routes from +the given route source. There are five modes available for route source: +bgp, connected, kernel, rip, static. + +</div> + +#### Operational Mode Commands + +<div class="opcmd"> + +show ip ospf neighbor + +This command displays the neighbors status. + +</div> + +``` none +Neighbor ID Pri State Dead Time Address Interface RXmtL RqstL DBsmL +10.0.13.1 1 Full/DR 38.365s 10.0.13.1 eth0:10.0.13.3 0 0 0 +10.0.23.2 1 Full/Backup 39.175s 10.0.23.2 eth1:10.0.23.3 0 0 0 +``` + +<div class="opcmd"> + +show ip ospf neighbor detail + +This command displays the neighbors information in a detailed form, not +just a summary table. + +</div> + +``` none +Neighbor 10.0.13.1, interface address 10.0.13.1 + In the area 0.0.0.0 via interface eth0 + Neighbor priority is 1, State is Full, 5 state changes + Most recent state change statistics: + Progressive change 11m55s ago + DR is 10.0.13.1, BDR is 10.0.13.3 + Options 2 *|-|-|-|-|-|E|- + Dead timer due in 34.854s + Database Summary List 0 + Link State Request List 0 + Link State Retransmission List 0 + Thread Inactivity Timer on + Thread Database Description Retransmision off + Thread Link State Request Retransmission on + Thread Link State Update Retransmission on + +Neighbor 10.0.23.2, interface address 10.0.23.2 + In the area 0.0.0.1 via interface eth1 + Neighbor priority is 1, State is Full, 4 state changes + Most recent state change statistics: + Progressive change 41.193s ago + DR is 10.0.23.3, BDR is 10.0.23.2 + Options 2 *|-|-|-|-|-|E|- + Dead timer due in 35.661s + Database Summary List 0 + Link State Request List 0 + Link State Retransmission List 0 + Thread Inactivity Timer on + Thread Database Description Retransmision off + Thread Link State Request Retransmission on + Thread Link State Update Retransmission on +``` + +<div class="opcmd"> + +show ip ospf neighbor \<A.B.C.D\> + +This command displays the neighbors information in a detailed form for a +neighbor whose IP address is specified. + +</div> + +<div class="opcmd"> + +show ip ospf neighbor \<interface\> + +This command displays the neighbors status for a neighbor on the specified +interface. + +</div> + +<div class="opcmd"> + +show ip ospf interface \[\<interface\>\] + +This command displays state and configuration of OSPF the specified +interface, or all interfaces if no interface is given. + +</div> + +``` none +eth0 is up + ifindex 2, MTU 1500 bytes, BW 4294967295 Mbit <UP,BROADCAST,RUNNING,MULTICAST> + Internet Address 10.0.13.3/24, Broadcast 10.0.13.255, Area 0.0.0.0 + MTU mismatch detection: enabled + Router ID 10.0.23.3, Network Type BROADCAST, Cost: 1 + Transmit Delay is 1 sec, State Backup, Priority 1 + Backup Designated Router (ID) 10.0.23.3, Interface Address 10.0.13.3 + Multicast group memberships: OSPFAllRouters OSPFDesignatedRouters + Timer intervals configured, Hello 10s, Dead 40s, Wait 40s, Retransmit 5 + Hello due in 4.470s + Neighbor Count is 1, Adjacent neighbor count is 1 +eth1 is up + ifindex 3, MTU 1500 bytes, BW 4294967295 Mbit <UP,BROADCAST,RUNNING,MULTICAST> + Internet Address 10.0.23.3/24, Broadcast 10.0.23.255, Area 0.0.0.1 + MTU mismatch detection: enabled + Router ID 10.0.23.3, Network Type BROADCAST, Cost: 1 + Transmit Delay is 1 sec, State DR, Priority 1 + Backup Designated Router (ID) 10.0.23.2, Interface Address 10.0.23.2 + Saved Network-LSA sequence number 0x80000002 + Multicast group memberships: OSPFAllRouters OSPFDesignatedRouters + Timer intervals configured, Hello 10s, Dead 40s, Wait 40s, Retransmit 5 + Hello due in 4.563s + Neighbor Count is 1, Adjacent neighbor count is 1 +``` + +<div class="opcmd"> + +show ip ospf route \[detail\] + +This command displays the OSPF routing table, as determined by the most +recent SPF calculation. With the optional `detail` argument, +each route item's advertiser router and network attribute will be shown. + +</div> + +``` none +============ OSPF network routing table ============ +N IA 10.0.12.0/24 [3] area: 0.0.0.0 + via 10.0.13.3, eth0 +N 10.0.13.0/24 [1] area: 0.0.0.0 + directly attached to eth0 +N IA 10.0.23.0/24 [2] area: 0.0.0.0 + via 10.0.13.3, eth0 +N 10.0.34.0/24 [2] area: 0.0.0.0 + via 10.0.13.3, eth0 + +============ OSPF router routing table ============= +R 10.0.23.3 [1] area: 0.0.0.0, ABR + via 10.0.13.3, eth0 +R 10.0.34.4 [2] area: 0.0.0.0, ASBR + via 10.0.13.3, eth0 + +============ OSPF external routing table =========== +N E2 172.16.0.0/24 [2/20] tag: 0 + via 10.0.13.3, eth0 +``` + +The table consists of following data: + +**OSPF network routing table** – includes a list of acquired routes for all +accessible networks (or aggregated area ranges) of OSPF system. "IA" flag +means that route destination is in the area to which the router is not +connected, i.e. it’s an inter-area path. In square brackets a summary metric +for all links through which a path lies to this network is specified. "via" +prefix defines a router-gateway, i.e. the first router on the way to the +destination (next hop). +**OSPF router routing table** – includes a list of acquired routes to all +accessible ABRs and ASBRs. +**OSPF external routing table** – includes a list of acquired routes that are +external to the OSPF process. "E" flag points to the external link metric type +(E1 – metric type 1, E2 – metric type 2). External link metric is printed in +the "\<metric of the router which advertised the link\>/\<link metric\>" format. + +<div class="opcmd"> + +show ip ospf border-routers + +This command displays a table of paths to area boundary and autonomous +system boundary routers. + +</div> + +<div class="opcmd"> + +show ip ospf database + +This command displays a summary table with a database contents (LSA). + +</div> + +``` none +OSPF Router with ID (10.0.13.1) + + Router Link States (Area 0.0.0.0) + +Link ID ADV Router Age Seq# CkSum Link count +10.0.13.1 10.0.13.1 984 0x80000005 0xd915 1 +10.0.23.3 10.0.23.3 1186 0x80000008 0xfe62 2 +10.0.34.4 10.0.34.4 1063 0x80000004 0x4e3f 1 + + Net Link States (Area 0.0.0.0) + +Link ID ADV Router Age Seq# CkSum +10.0.13.1 10.0.13.1 994 0x80000003 0x30bb +10.0.34.4 10.0.34.4 1188 0x80000001 0x9411 + + Summary Link States (Area 0.0.0.0) + +Link ID ADV Router Age Seq# CkSum Route +10.0.12.0 10.0.23.3 1608 0x80000001 0x6ab6 10.0.12.0/24 +10.0.23.0 10.0.23.3 981 0x80000003 0xe232 10.0.23.0/24 + + AS External Link States + +Link ID ADV Router Age Seq# CkSum Route +172.16.0.0 10.0.34.4 1063 0x80000001 0xc40d E2 172.16.0.0/24 [0x0] +``` + +<div class="opcmd"> + +show ip ospf database \<type\> \[A.B.C.D\] +\[adv-router \<A.B.C.D\>|self-originate\] + +This command displays a database contents for a specific link advertisement +type. + +The type can be the following: +asbr-summary, external, network, nssa-external, opaque-area, opaque-as, +opaque-link, router, summary. + +\[A.B.C.D\] – link-state-id. With this specified the command displays portion +of the network environment that is being described by the advertisement. +The value entered depends on the advertisement’s LS type. It must be +entered in the form of an IP address. + +`adv-router <A.B.C.D>` – router id, which link advertisements need +to be reviewed. + +`self-originate` displays only self-originated LSAs from the local +router. + +</div> + +``` none +OSPF Router with ID (10.0.13.1) + + Router Link States (Area 0.0.0.0) + +LS age: 1213 +Options: 0x2 : *|-|-|-|-|-|E|- +LS Flags: 0x3 +Flags: 0x0 +LS Type: router-LSA +Link State ID: 10.0.13.1 +Advertising Router: 10.0.13.1 +LS Seq Number: 80000009 +Checksum: 0xd119 +Length: 36 + +Number of Links: 1 + +Link connected to: a Transit Network +(Link ID) Designated Router address: 10.0.13.1 +(Link Data) Router Interface address: 10.0.13.1 +Number of TOS metrics: 0 +TOS 0 Metric: 1 +``` + +<div class="opcmd"> + +show ip ospf database max-age + +This command displays LSAs in MaxAge list. + +</div> + +#### Examples + +##### Enable OSPF + +**Node 1** + +``` none +set interfaces loopback lo address 10.1.1.1/32 +set interfaces ethernet eth0 address 192.168.0.1/24 +set protocols ospf area 0 network 192.168.0.0/24 +set protocols ospf area 0 network 10.1.1.1/32 +set protocols ospf parameters router-id 10.1.1.1 +``` + +**Node 2** + +``` none +set interfaces loopback lo address 10.1.1.2/32 +set interfaces ethernet eth0 address 192.168.0.2/24 +set protocols ospf area 0 network 192.168.0.0/24 +set protocols ospf area 0 network 10.1.1.2/32 +set protocols ospf parameters router-id 10.1.1.2 +``` + +Here's the neighbors up: + +``` none +Node-1@vyos:~$ show ip ospf neighbor + +Neighbor ID Pri State Up Time Dead Time Address Interface RXmtL RqstL DBsmL +10.1.1.2 1 Full/DR 3m43s 36.094s 192.168.0.2 eth0:192.168.0.1 0 0 0 + + + +Node-2@vyos:~$ show ip ospf neighbor + +Neighbor ID Pri State Up Time Dead Time Address Interface RXmtL RqstL DBsmL +10.1.1.1 1 Full/Backup 3m47s 31.736s 192.168.0.1 eth0:192.168.0.2 0 0 0 +``` + +Here's the routes: + +``` none +Node-1@vyos:~$ show ip route ospf +Codes: K - kernel route, C - connected, S - static, R - RIP, + O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP, + T - Table, v - VNC, V - VNC-Direct, A - Babel, F - PBR, + f - OpenFabric, + > - selected route, * - FIB route, q - queued, r - rejected, b - backup + t - trapped, o - offload failure + +O 10.1.1.1/32 [110/0] is directly connected, lo, weight 1, 00:00:14 +O>* 10.1.1.2/32 [110/1] via 192.168.0.2, eth0, weight 1, 00:00:07 +O 192.168.0.0/24 [110/1] is directly connected, eth0, weight 1, 00:03:32 + +Node-2@vyos:~$ show ip route ospf +Codes: K - kernel route, C - connected, S - static, R - RIP, + O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP, + T - Table, v - VNC, V - VNC-Direct, A - Babel, F - PBR, + f - OpenFabric, + > - selected route, * - FIB route, q - queued, r - rejected, b - backup + t - trapped, o - offload failure + +O>* 10.1.1.1/32 [110/1] via 192.168.0.1, eth0, weight 1, 00:00:11 +O 10.1.1.2/32 [110/0] is directly connected, lo, weight 1, 00:00:04 +O 192.168.0.0/24 [110/1] is directly connected, eth0, weight 1, 00:03:18 +``` + +##### Enable OSPF with route redistribution of the loopback and default originate: + +**Node 1** + +``` none +set interfaces loopback lo address 10.1.1.1/32 +set protocols ospf area 0 network 192.168.0.0/24 +set protocols ospf default-information originate always +set protocols ospf default-information originate metric 10 +set protocols ospf default-information originate metric-type 2 +set protocols ospf log-adjacency-changes +set protocols ospf parameters router-id 10.1.1.1 +set protocols ospf redistribute connected metric-type 2 +set protocols ospf redistribute connected route-map CONNECT + +set policy route-map CONNECT rule 10 action permit +set policy route-map CONNECT rule 10 match interface lo +``` + +**Node 2** + +``` none +set interfaces loopback lo address 10.2.2.2/32 +set protocols ospf area 0 network 192.168.0.0/24 +set protocols ospf log-adjacency-changes +set protocols ospf parameters router-id 10.2.2.2 +set protocols ospf redistribute connected metric-type 2 +set protocols ospf redistribute connected route-map CONNECT + +set policy route-map CONNECT rule 10 action permit +set policy route-map CONNECT rule 10 match interface lo +``` + +##### Enable OSPF and IGP-LDP synchronization: + +**Node 1:** + +``` none +set interfaces loopback lo address 10.1.1.1/32 +set interfaces ethernet eth0 address 192.168.0.1/24 + +set protocols ospf area 0 network '192.168.0.0/24' +set protocols ospf area 0 network '10.1.1.1/32' +set protocols ospf parameters router-id '10.1.1.1' +set protocols ospf ldp-sync + +set protocols mpls interface eth0 +set protocols mpls ldp discovery transport-ipv4-address 10.1.1.1 +set protocols mpls ldp interface lo +set protocols mpls ldp interface eth0 +set protocols mpls ldp parameters transport-prefer-ipv4 +set protocols mpls ldp router-id 10.1.1.1 +``` + +This gives us IGP-LDP synchronization for all non-loopback interfaces with +a holddown timer of zero seconds: + +``` none +Node-1@vyos:~$ show ip ospf mpls ldp-sync + eth0 + LDP-IGP Synchronization enabled: yes + Holddown timer in seconds: 0 + State: Sync achieved +``` + +##### Enable OSPF with Segment Routing (Experimental): + +**Node 1** + +``` none +set interfaces loopback lo address 10.1.1.1/32 +set interfaces ethernet eth0 address 192.168.0.1/24 + +set protocols ospf area 0 network '192.168.0.0/24' +set protocols ospf area 0 network '10.1.1.1/32' +set protocols ospf parameters opaque-lsa +set protocols ospf parameters router-id '10.1.1.1' +set protocols ospf segment-routing global-block high-label-value '1100' +set protocols ospf segment-routing global-block low-label-value '1000' +set protocols ospf segment-routing prefix 10.1.1.1/32 index explicit-null +set protocols ospf segment-routing prefix 10.1.1.1/32 index value '1' +``` + +**Node 2** + +``` none +set interfaces loopback lo address 10.1.1.2/32 +set interfaces ethernet eth0 address 192.168.0.2/24 + +set protocols ospf area 0 network '192.168.0.0/24' +set protocols ospf area 0 network '10.1.1.2/32' +set protocols ospf parameters opaque-lsa +set protocols ospf parameters router-id '10.1.1.2' +set protocols ospf segment-routing global-block high-label-value '1100' +set protocols ospf segment-routing global-block low-label-value '1000' +set protocols ospf segment-routing prefix 10.1.1.2/32 index explicit-null +set protocols ospf segment-routing prefix 10.1.1.2/32 index value '2' +``` + +This gives us MPLS segment routing enabled and labels for far end loopbacks: + +``` none +Node-1@vyos:~$ show mpls table + Inbound Label Type Nexthop Outbound Label + ----------------------------------------------------------- + 1002 SR (OSPF) 192.168.0.2 IPv4 Explicit Null <-- Node-2 loopback learned on Node-1 + 15000 SR (OSPF) 192.168.0.2 implicit-null + 15001 SR (OSPF) 192.168.0.2 implicit-null + +Node-2@vyos:~$ show mpls table + Inbound Label Type Nexthop Outbound Label + ----------------------------------------------------------- + 1001 SR (OSPF) 192.168.0.1 IPv4 Explicit Null <-- Node-1 loopback learned on Node-2 + 15000 SR (OSPF) 192.168.0.1 implicit-null + 15001 SR (OSPF) 192.168.0.1 implicit-null +``` + +Here is the routing tables showing the MPLS segment routing label operations: + +``` none +Node-1@vyos:~$ show ip route ospf +Codes: K - kernel route, C - connected, S - static, R - RIP, + O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP, + T - Table, v - VNC, V - VNC-Direct, A - Babel, F - PBR, + f - OpenFabric, + > - selected route, * - FIB route, q - queued, r - rejected, b - backup + t - trapped, o - offload failure + +O 10.1.1.1/32 [110/0] is directly connected, lo, weight 1, 00:03:43 +O>* 10.1.1.2/32 [110/1] via 192.168.0.2, eth0, label IPv4 Explicit Null, weight 1, 00:03:32 +O 192.168.0.0/24 [110/1] is directly connected, eth0, weight 1, 00:03:43 + +Node-2@vyos:~$ show ip route ospf +Codes: K - kernel route, C - connected, S - static, R - RIP, + O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP, + T - Table, v - VNC, V - VNC-Direct, A - Babel, F - PBR, + f - OpenFabric, + > - selected route, * - FIB route, q - queued, r - rejected, b - backup + t - trapped, o - offload failure + +O>* 10.1.1.1/32 [110/1] via 192.168.0.1, eth0, label IPv4 Explicit Null, weight 1, 00:03:36 +O 10.1.1.2/32 [110/0] is directly connected, lo, weight 1, 00:03:51 +O 192.168.0.0/24 [110/1] is directly connected, eth0, weight 1, 00:03:51 +``` + +## OSPFv3 (IPv6) + +### Configuration + +#### General + +VyOS does not have a special command to start the OSPFv3 process. The OSPFv3 +process starts when the first ospf enabled interface is configured. + +<div class="cfgcmd"> + +set protocols ospfv3 interface \<interface\> area \<number\> + +This command specifies the OSPFv3 enabled interface. This command is also +used to enable the OSPF process. The area number can be specified in +decimal notation in the range from 0 to 4294967295. Or it can be specified +in dotted decimal notation similar to ip address. + +</div> + +<div class="cfgcmd"> + +set protocols ospfv3 parameters router-id \<rid\> + +This command sets the router-ID of the OSPFv3 process. The router-ID may be +an IP address of the router, but need not be – it can be any arbitrary +32bit number. However it MUST be unique within the entire OSPFv3 domain to +the OSPFv3 speaker – bad things will happen if multiple OSPFv3 speakers are +configured with the same router-ID! + +</div> + +#### Optional + +<div class="cfgcmd"> + +set protocols ospfv3 distance global \<distance\> + +This command change distance value of OSPFv3 globally. +The distance range is 1 to 255. + +</div> + +<div class="cfgcmd"> + +set protocols ospfv3 distance ospfv3 +\<external[|inter-area|](##SUBST##|inter-area|)intra-area\> \<distance\> + +This command change distance value of OSPFv3. The arguments are the +distance values for external routes, inter-area routes and intra-area +routes respectively. The distance range is 1 to 255. + +</div> + +#### Area Configuration + +<div class="cfgcmd"> + +set protocols ospfv3 area \<number\> range \<prefix\> + +This command summarizes intra area paths from specified area into one +Type-3 Inter-Area Prefix LSA announced to other areas. This command can be +used only in ABR. + +</div> + +<div class="cfgcmd"> + +set protocols ospfv3 area \<number\> range \<prefix\> not-advertise + +This command instead of summarizing intra area paths filter them - i.e. +intra area paths from this range are not advertised into other areas. This +command makes sense in ABR only. + +</div> + +#### Interface Configuration + +<div class="cfgcmd"> + +set protocols ospfv3 interface \<interface\> ipv6 cost \<number\> + +This command sets link cost for the specified interface. The cost value is +set to router-LSA’s metric field and used for SPF calculation. The cost +range is 1 to 65535. + +</div> + +<div class="cfgcmd"> + +set protocols ospfv3 interface \<interface\> dead-interval \<number\> + +Set number of seconds for router Dead Interval timer value used for Wait +Timer and Inactivity Timer. This value must be the same for all routers +attached to a common network. The default value is 40 seconds. The +interval range is 1 to 65535. + +</div> + +<div class="cfgcmd"> + +set protocols ospfv3 interface \<interface\> hello-interval +\<number\> + +Set number of seconds for Hello Interval timer value. Setting this value, +Hello packet will be sent every timer value seconds on the specified +interface. This value must be the same for all routers attached to a +common network. The default value is 10 seconds. The interval range is 1 +to 65535. + +</div> + +<div class="cfgcmd"> + +set protocols ospfv3 interface \<interface\> mtu-ignore + +This command disables check of the MTU value in the OSPF DBD packets. +Thus, use of this command allows the OSPF adjacency to reach the FULL +state even though there is an interface MTU mismatch between two OSPF +routers. + +</div> + +<div class="cfgcmd"> + +set protocols ospfv3 interface \<interface\> network \<type\> + +This command allows to specify the distribution type for the network +connected to this interface: + +**broadcast** – broadcast IP addresses distribution. +**point-to-point** – address distribution in point-to-point networks. + +</div> + +<div class="cfgcmd"> + +set protocols ospfv3 interface \<interface\> priority \<number\> + +This command sets Router Priority integer value. The router with the +highest priority will be more eligible to become Designated Router. +Setting the value to 0, makes the router ineligible to become Designated +Router. The default value is 1. The interval range is 0 to 255. + +</div> + +<div class="cfgcmd"> + +set protocols ospfv3 interface \<interface\> passive + +This command specifies interface as passive. Passive interface advertises +its address, but does not run the OSPF protocol (adjacencies are not formed +and hello packets are not generated). + +</div> + +<div class="cfgcmd"> + +set protocols ospfv3 interface \<interface\> retransmit-interval +\<number\> + +This command sets number of seconds for RxmtInterval timer value. This +value is used when retransmitting Database Description and Link State +Request packets if acknowledge was not received. The default value is 5 +seconds. The interval range is 3 to 65535. + +</div> + +<div class="cfgcmd"> + +set protocols ospfv3 interface \<interface\> transmit-delay +\<number\> + +This command sets number of seconds for InfTransDelay value. It allows to +set and adjust for each interface the delay interval before starting the +synchronizing process of the router's database with all neighbors. The +default value is 1 seconds. The interval range is 3 to 65535. + +</div> + +#### Graceful Restart + +<div class="cfgcmd"> + +set protocols ospfv3 graceful-restart \[grace-period (1-1800)\] + +Configure Graceful Restart `3623` restarting support. When enabled, +the default grace period is 120 seconds. + +To perform a graceful shutdown, the FRR `graceful-restart prepare ip ospf` EXEC-level command needs to be issued before restarting the +ospfd daemon. + +</div> + +<div class="cfgcmd"> + +set protocols ospfv3 graceful-restart helper enable \[router-id A.B.C.D\] + +Configure Graceful Restart `3623` helper support. By default, helper support +is disabled for all neighbours. This config enables/disables helper support +on this router for all neighbours. + +To enable/disable helper support for a specific neighbour, the router-id +(A.B.C.D) has to be specified. + +</div> + +<div class="cfgcmd"> + +set protocols ospfv3 graceful-restart helper lsa-check-disable + +By default <span class="title-ref">strict-lsa-checking</span> is configured then the helper will abort +the Graceful Restart when a LSA change occurs which affects the restarting +router. + +This command disables it. + +</div> + +<div class="cfgcmd"> + +set protocols ospfv3 graceful-restart helper supported-grace-time + +Supports as HELPER for configured grace period. + +</div> + +<div class="cfgcmd"> + +set protocols ospfv3 graceful-restart helper planned-only + +It helps to support as HELPER only for planned restarts. + +By default, it supports both planned and unplanned outages. + +</div> + +#### Redistribution Configuration + +<div class="cfgcmd"> + +set protocols ospfv3 redistribute \<route source\> + +This command redistributes routing information from the given route source +to the OSPFv3 process. There are five modes available for route source: +bgp, connected, kernel, ripng, static. + +</div> + +<div class="cfgcmd"> + +set protocols ospf redistribute \<route source\> route-map \<name\> + +This command allows to use route map to filter redistributed routes from +given route source. There are five modes available for route source: bgp, +connected, kernel, ripng, static. + +</div> + +#### Operational Mode Commands + +<div class="opcmd"> + +show ipv6 ospfv3 neighbor + +This command displays the neighbors status. + +</div> + +<div class="opcmd"> + +show ipv6 ospfv3 neighbor detail + +This command displays the neighbors information in a detailed form, not +just a summary table. + +</div> + +<div class="opcmd"> + +show ipv6 ospfv3 neighbor drchoice + +This command displays the neighbor DR choice information. + +</div> + +<div class="opcmd"> + +show ipv6 ospfv3 interface \[prefix\]|\[\<interface\> \[prefix\]\] + +This command displays state and configuration of OSPF the specified +interface, or all interfaces if no interface is given. Whith the argument +`prefix` this command shows connected prefixes to advertise. + +</div> + +<div class="opcmd"> + +show ipv6 ospfv3 route + +This command displays the OSPF routing table, as determined by the most +recent SPF calculation. + +</div> + +<div class="opcmd"> + +show ipv6 ospfv3 border-routers + +This command displays a table of paths to area boundary and autonomous +system boundary routers. + +</div> + +<div class="opcmd"> + +show ipv6 ospfv3 database + +This command displays a summary table with a database contents (LSA). + +</div> + +<div class="opcmd"> + +show ipv6 ospfv3 database \<type\> \[A.B.C.D\] +\[adv-router \<A.B.C.D\>|self-originate\] + +This command displays a database contents for a specific link +advertisement type. + +</div> + +<div class="opcmd"> + +show ipv6 ospfv3 redistribute + +This command displays external information redistributed into OSPFv3 + +</div> + +#### Configuration Example + +A typical configuration using 2 nodes. + +**Node 1:** + +``` none +set protocols ospfv3 interface eth1 area 0.0.0.0 +set protocols ospfv3 area 0.0.0.0 range 2001:db8:1::/64 +set protocols ospfv3 parameters router-id 192.168.1.1 +set protocols ospfv3 redistribute connected +``` + +**Node 2:** + +``` none +set protocols ospfv3 interface eth1 area 0.0.0.0 +set protocols ospfv3 area 0.0.0.0 range 2001:db8:2::/64 +set protocols ospfv3 parameters router-id 192.168.2.1 +set protocols ospfv3 redistribute connected +``` + +**To see the redistributed routes:** + +``` none +show ipv6 ospfv3 redistribute +``` + +<div class="note"> + +<div class="title"> + +Note + +</div> + +You cannot easily redistribute IPv6 routes via OSPFv3 on a +WireGuard interface link. This requires you to configure link-local +addresses manually on the WireGuard interfaces, see `T1483`. + +</div> + +Example configuration for WireGuard interfaces: + +**Node 1** + +``` none +set interfaces wireguard wg01 address 'fe80::216:3eff:fe51:fd8c/64' +set interfaces wireguard wg01 address '192.168.0.1/24' +set interfaces wireguard wg01 peer ospf02 allowed-ips '::/0' +set interfaces wireguard wg01 peer ospf02 allowed-ips '0.0.0.0/0' +set interfaces wireguard wg01 peer ospf02 endpoint '10.1.1.101:12345' +set interfaces wireguard wg01 peer ospf02 pubkey 'ie3...=' +set interfaces wireguard wg01 port '12345' +set protocols ospfv3 parameters router-id 192.168.1.1 +set protocols ospfv3 interface 'wg01' area 0.0.0.0 +set protocols ospfv3 interface 'lo' area 0.0.0.0 +``` + +**Node 2** + +``` none +set interfaces wireguard wg01 address 'fe80::216:3eff:fe0a:7ada/64' +set interfaces wireguard wg01 address '192.168.0.2/24' +set interfaces wireguard wg01 peer ospf01 allowed-ips '::/0' +set interfaces wireguard wg01 peer ospf01 allowed-ips '0.0.0.0/0' +set interfaces wireguard wg01 peer ospf01 endpoint '10.1.1.100:12345' +set interfaces wireguard wg01 peer ospf01 pubkey 'NHI...=' +set interfaces wireguard wg01 port '12345' +set protocols ospfv3 parameters router-id 192.168.1.2 +set protocols ospfv3 interface 'wg01' area 0.0.0.0 +set protocols ospfv3 interface 'lo' area 0.0.0.0 +``` + +**Status** + +``` none +vyos@ospf01:~$ sh ipv6 ospfv3 neighbor +Neighbor ID Pri DeadTime State/IfState Duration I/F[State] +192.168.0.2 1 00:00:37 Full/PointToPoint 00:18:03 wg01[PointToPoint] + +vyos@ospf02# run sh ipv6 ospfv3 neighbor +Neighbor ID Pri DeadTime State/IfState Duration I/F[State] +192.168.0.1 1 00:00:39 Full/PointToPoint 00:19:44 wg01[PointToPoint] +``` diff --git a/docs/configuration/protocols/md-pim.md b/docs/configuration/protocols/md-pim.md new file mode 100644 index 00000000..2f31de95 --- /dev/null +++ b/docs/configuration/protocols/md-pim.md @@ -0,0 +1,345 @@ +lastproofread +2023-11-13 + +# PIM – Protocol Independent Multicast + +VyOS supports `PIM-SM (PIM Sparse Mode)` as well as +`IGMP (Internet Group Management Protocol)` v2 and v3 + +`PIM (Protocol Independent Multicast)` must be configured in every +interface of every participating router. Every router must also have the +location of the Rendevouz Point manually configured. Then, unidirectional +shared trees rooted at the Rendevouz Point will automatically be built +for multicast distribution. + +Traffic from multicast sources will go to the Rendezvous Point, and +receivers will pull it from a shared tree using `IGMP (Internet +Group Management Protocol)`. + +Multicast receivers will talk IGMP to their local router, so, besides +having PIM configured in every router, IGMP must also be configured in +any router where there could be a multicast receiver locally connected. + +VyOS supports both IGMP version 2 and version 3 (which allows +source-specific multicast). + +## PIM-SM - PIM Sparse Mode + +<div class="cfgcmd"> + +set protocols pim ecmp + +If PIM has the a choice of ECMP nexthops for a particular +`RPF (Reverse Path Forwarding)`, PIM will cause S,G flows to be +spread out amongst the nexthops. If this command is not specified then +the first nexthop found will be used. + +</div> + +<div class="cfgcmd"> + +set protocols pim ecmp rebalance + +If PIM is using ECMP and an interface goes down, cause PIM to rebalance all +S,G flows across the remaining nexthops. If this command is not configured +PIM only modifies those S,G flows that were using the interface that went +down. + +</div> + +<div class="cfgcmd"> + +set protocols pim join-prune-interval \<n\> + +Modify the join/prune interval that PIM uses to the new value. Time is +specified in seconds. + +The default time is 60 seconds. + +If you enter a value smaller than 60 seconds be aware that this can and +will affect convergence at scale. + +</div> + +<div class="cfgcmd"> + +set protocols pim keep-alive-timer \<n\> + +Modify the time out value for a S,G flow from 1-65535 seconds. If choosing +a value below 31 seconds be aware that some hardware platforms cannot see +data flowing in better than 30 second chunks. + +</div> + +<div class="cfgcmd"> + +set protocols pim packets \<n\> + +When processing packets from a neighbor process the number of packets +incoming at one time before moving on to the next task. + +The default value is 3 packets. + +This command is only useful at scale when you can possibly have a large +number of PIM control packets flowing. + +</div> + +<div class="cfgcmd"> + +set protocols pim register-accept-list \<prefix-list\> + +When PIM receives a register packet the source of the packet will be compared +to the prefix-list specified, and if a permit is received normal processing +continues. If a deny is returned for the source address of the register packet +a register stop message is sent to the source. + +</div> + +<div class="cfgcmd"> + +set protocols pim register-suppress-time \<n\> + +Modify the time that pim will register suppress a FHR will send register +notifications to the kernel. + +</div> + +<div class="cfgcmd"> + +set protocols pim rp \<address\> group \<group\> + +In order to use PIM, it is necessary to configure a `RP (Rendezvous Point)` +for join messages to be sent to. Currently the only methodology to do this is +via static rendezvous point commands. + +All routers in the PIM network must agree on these values. + +The first ip address is the RP's address and the second value is the matching +prefix of group ranges covered. + +</div> + +<div class="cfgcmd"> + +set protocols pim rp keep-alive-timer \<n\> + +Modify the time out value for a S,G flow from 1-65535 seconds at +`RP (Rendezvous Point)`. The normal keepalive period for the KAT(S,G) +defaults to 210 seconds. However, at the `RP (Rendezvous Point)`, the +keepalive period must be at least the Register_Suppression_Time, or the RP +may time out the (S,G) state before the next Null-Register arrives. +Thus, the KAT(S,G) is set to max(Keepalive_Period, RP_Keepalive_Period) +when a Register-Stop is sent. + +If choosing a value below 31 seconds be aware that some hardware platforms +cannot see data flowing in better than 30 second chunks. + +See `7761#section-4.1` for details. + +</div> + +<div class="cfgcmd"> + +set protocols pim no-v6-secondary + +When sending PIM hello packets tell PIM to not send any v6 secondary +addresses on the interface. This information is used to allow PIM to use v6 +nexthops in it's decision for `RPF (Reverse Path Forwarding)` lookup +if this option is not set (default). + +</div> + +<div class="cfgcmd"> + +set protocols pim spt-switchover infinity-and-beyond \[prefix-list \<list\>\] + +On the last hop router if it is desired to not switch over to the SPT tree +configure this command. + +Optional parameter prefix-list can be use to control which groups to switch or +not switch. If a group is PERMIT as per the prefix-list, then the SPT switchover +does not happen for it and if it is DENY, then the SPT switchover happens. + +</div> + +<div class="cfgcmd"> + +set protocols pim ssm prefix-list \<list\> + +Specify a range of group addresses via a prefix-list that forces PIM to never +do `SSM (Source-Specific Multicast)` over. + +</div> + +### Interface specific commands + +<div class="cfgcmd"> + +set protocols pim interface \<interface\> bfd \[profile \<name\>\] + +Automatically create BFD session for each RIP peer discovered in this +interface. When the BFD session monitor signalize that the link is down +the RIP peer is removed and all the learned routes associated with that +peer are removed. + +If optional profile parameter is used, select a BFD profile for the BFD +sessions created via this interface. + +</div> + +<div class="cfgcmd"> + +set protocols pim interface \<interface\> dr-priority \<n\> + +Set the `DR (Designated Router)` Priority for the interface. +This command is useful to allow the user to influence what node becomes +the DR for a LAN segment. + +</div> + +<div class="cfgcmd"> + +set protocols pim interface \<interface\> hello \<n\> + +Set the PIM hello and hold interval for a interface. + +</div> + +<div class="cfgcmd"> + +set protocols pim interface \<interface\> no-bsm + +Tell PIM that we would not like to use this interface to process +bootstrap messages. + +</div> + +<div class="cfgcmd"> + +set protocols pim interface \<interface\> no-unicast-bsm + +Tell PIM that we would not like to use this interface to process +unicast bootstrap messages. + +</div> + +<div class="cfgcmd"> + +set protocols pim interface \<interface\> passive + +Disable sending and receiving PIM control packets on the interface. + +<div class="cfgcmd"> + +set protocols pim interface \<interface\> source-address \<ip-address\> + +</div> + +If you have multiple addresses configured on a particular interface and would +like PIM to use a specific source address associated with that interface. + +</div> + +## IGMP - Internet Group Management Protocol) + +<div class="cfgcmd"> + +set protocols pim igmp watermark-warning \<n\> + +Configure watermark warning generation for an IGMP group limit. Generates +warning once the configured group limit is reached while adding new groups. + +</div> + +### Interface specific commands + +<div class="cfgcmd"> + +set protocols pim interface \<interface\> igmp +join \<multicast-address\> source-address \<IP-address\> + +Use this command to allow the selected interface to join a multicast +group defining the multicast address you want to join and the source +IP address too. + +</div> + +<div class="cfgcmd"> + +set protocols pim interface \<interface\> igmp +query-interval \<seconds\> + +Use this command to configure in the selected interface the IGMP +host query interval (1-1800) in seconds that PIM will use. + +</div> + +<div class="cfgcmd"> + +set protocols pim interface \<interface\> igmp +query-max-response-time \<n\> + +Use this command to configure in the selected interface the IGMP +query response timeout value (10-250) in deciseconds. If a report is +not returned in the specified time, it will be assumed the (S,G) or +(\*,G) state `7761#section-4.1` has timed out. + +</div> + +<div class="cfgcmd"> + +set protocols pim interface \<interface\> igmp version \<version-number\> + +Use this command to define in the selected interface whether you +choose IGMP version 2 or 3. + +The default value is 3. + +</div> + +#### Example + +In the following example we can see a basic multicast setup: + +<img src="/_static/images/multicast-basic.webp" class="align-center" style="width:90.0%" alt="Network Topology Diagram" /> + +**Router 1** + +``` none +set interfaces ethernet eth2 address '172.16.0.2/24' +set interfaces ethernet eth1 address '100.64.0.1/24' +set protocols ospf area 0 network '172.16.0.0/24' +set protocols ospf area 0 network '100.64.0.0/24' +set protocols igmp interface eth1 +set protocols pim interface eth1 +set protocols pim interface eth2 +set protocols pim rp address 172.16.255.1 group '224.0.0.0/4' +``` + +**Router 3** + +``` none +set interfaces dummy dum0 address '172.16.255.1/24' +set interfaces ethernet eth0 address '172.16.0.1/24' +set interfaces ethernet eth1 address '172.16.1.1/24' +set protocols ospf area 0 network '172.16.0.0/24' +set protocols ospf area 0 network '172.16.255.0/24' +set protocols ospf area 0 network '172.16.1.0/24' +set protocols pim interface dum0 +set protocols pim interface eth0 +set protocols pim interface eth1 +set protocols pim rp address 172.16.255.1 group '224.0.0.0/4' +``` + +**Router 2** + +``` none +set interfaces ethernet eth1 address '10.0.0.1/24' +set interfaces ethernet eth2 address '172.16.1.2/24' +set protocols ospf area 0 network '10.0.0.0/24' +set protocols ospf area 0 network '172.16.1.0/24' +set protocols pim interface eth1 +set protocols pim interface eth2 +set protocols pim rp address 172.16.255.1 group '224.0.0.0/4' +``` diff --git a/docs/configuration/protocols/md-pim6.md b/docs/configuration/protocols/md-pim6.md new file mode 100644 index 00000000..6b3c00fc --- /dev/null +++ b/docs/configuration/protocols/md-pim6.md @@ -0,0 +1,122 @@ +# PIM6 - Protocol Independent Multicast for IPv6 + +VyOS facilitates IPv6 Multicast by supporting **PIMv6** and **MLD**. + +PIMv6 (Protocol Independent Multicast for IPv6) must be configured in every +interface of every participating router. Every router must also have the +location of the Rendevouz Point manually configured. +Then, unidirectional shared trees rooted at the Rendevouz Point will +automatically be built for multicast distribution. + +Traffic from multicast sources will go to the Rendezvous Point, and receivers +will pull it from a shared tree using MLD (Multicast Listener Discovery). + +Multicast receivers will talk MLD to their local router, so, besides having +PIMv6 configured in every router, MLD must also be configured in any router +where there could be a multicast receiver locally connected. + +VyOS supports both MLD version 1 and version 2 +(which allows source-specific multicast). + +## Basic commands + +These are the commands for a basic setup. + +<div class="cfgcmd"> + +set protocols pim6 interface \<interface-name\> + +Use this command to enable PIMv6 in the selected interface so that it +can communicate with PIMv6 neighbors. This command also enables MLD reports +and query on the interface unless `mld disable` is configured. + +</div> + +<div class="cfgcmd"> + +set protocols pim6 interface \<interface-name\> mld disable + +Disable MLD reports and query on the interface. + +</div> + +## Tuning commands + +You can also tune multicast with the following commands. + +<div class="cfgcmd"> + +set protocols pim6 interface \<interface-name\> mld interval \<seconds\> + +Use this command to configure in the selected interface the MLD +host query interval (1-65535) in seconds that PIM will use. +The default value is 125 seconds. + +</div> + +<div class="cfgcmd"> + +set protocols pim6 interface \<interface-name\> mld join \<multicast-address\> + +Use this command to allow the selected interface to join a multicast group. + +</div> + +<div class="cfgcmd"> + +set protocols pim6 interface \<interface-name\> mld join \<multicast-address\> source \<source-address\> + +Use this command to allow the selected interface to join a source-specific multicast +group. + +</div> + +<div class="cfgcmd"> + +set protocols pim6 interface \<interface-name\> mld last-member-query-count \<count\> + +Set the MLD last member query count. The default value is 2. + +</div> + +<div class="cfgcmd"> + +set protocols pim6 interface \<interface-name\> mld last-member-query-interval \<milliseconds\> + +Set the MLD last member query interval in milliseconds (100-6553500). The default value is 1000 milliseconds. + +</div> + +<div class="cfgcmd"> + +set protocols pim6 interface \<interface-name\> mld max-response-time \<milliseconds\> + +Set the MLD query response timeout in milliseconds (100-6553500). The default value is 10000 milliseconds. + +</div> + +<div class="cfgcmd"> + +set protocols pim6 interface \<interface-name\> mld version \<version-number\> + +Set the MLD version used on this interface. The default value is 2. + +</div> + +### Configuration Example + +To enable MLD reports and query on interfaces <span class="title-ref">eth0</span> and \`eth1\`: + +``` none +set protocols pim6 interface eth0 +set protocols pim6 interface eth1 +``` + +The following configuration explicitly joins multicast group <span class="title-ref">ff15::1234</span> on interface <span class="title-ref">eth1</span> +and source-specific multicast group <span class="title-ref">ff15::5678</span> with source address <span class="title-ref">2001:db8::1</span> on interface +\`eth1\`: + +``` none +set protocols pim6 interface eth0 mld join ff15::1234 +set protocols pim6 interface eth1 mld join ff15::5678 source 2001:db8::1 +``` diff --git a/docs/configuration/protocols/md-rip.md b/docs/configuration/protocols/md-rip.md new file mode 100644 index 00000000..1bd580ab --- /dev/null +++ b/docs/configuration/protocols/md-rip.md @@ -0,0 +1,361 @@ +lastproofread +2021-10-04 + +# RIP + +`RIP (Routing Information Protocol)` is a widely deployed interior gateway +protocol. RIP was developed in the 1970s at Xerox Labs as part of the XNS +routing protocol. RIP is a distance-vector protocol and is based on the +Bellman-Ford algorithms. As a distance-vector protocol, RIP router send updates +to its neighbors periodically, thus allowing the convergence to a known +topology. In each update, the distance to any given network will be broadcast +to its neighboring router. + +Supported versions of RIP are: + +> - RIPv1 as described in `1058` +> - RIPv2 as described in `2453` + +## General Configuration + +<div class="cfgcmd"> + +set protocols rip network \<A.B.C.D/M\> + +This command enables RIP and sets the RIP enable interface by NETWORK. +The interfaces which have addresses matching with NETWORK are enabled. + +</div> + +<div class="cfgcmd"> + +set protocols rip interface \<interface\> + +This command specifies a RIP enabled interface by interface name. Both +the sending and receiving of RIP packets will be enabled on the port +specified in this command. + +</div> + +<div class="cfgcmd"> + +set protocols rip neighbor \<A.B.C.D\> + +This command specifies a RIP neighbor. When a neighbor doesn’t understand +multicast, this command is used to specify neighbors. In some cases, not +all routers will be able to understand multicasting, where packets are +sent to a network or a group of addresses. In a situation where a neighbor +cannot process multicast packets, it is necessary to establish a direct +link between routers. + +</div> + +<div class="cfgcmd"> + +set protocols rip passive-interface interface \<interface\> + +This command sets the specified interface to passive mode. On passive mode +interface, all receiving packets are processed as normal and VyOS does not +send either multicast or unicast RIP packets except to RIP neighbors +specified with neighbor command. + +</div> + +<div class="cfgcmd"> + +set protocols rip passive-interface interface default + +This command specifies all interfaces to passive mode. + +</div> + +## Optional Configuration + +<div class="cfgcmd"> + +set protocols rip default-distance \<distance\> + +This command change the distance value of RIP. The distance range is 1 to 255. + +> <div class="note"> +> +> <div class="title"> +> +> Note +> +> </div> +> +> Routes with a distance of 255 are effectively disabled and not +> installed into the kernel. +> +> </div> + +</div> + +<div class="cfgcmd"> + +set protocols rip network-distance \<A.B.C.D/M\> distance \<distance\> + +This command sets default RIP distance to a specified value when the routes +source IP address matches the specified prefix. + +</div> + +<div class="cfgcmd"> + +set protocols rip network-distance \<A.B.C.D/M\> access-list \<name\> + +This command can be used with previous command to sets default RIP distance +to specified value when the route source IP address matches the specified +prefix and the specified access-list. + +</div> + +<div class="cfgcmd"> + +set protocols rip default-information originate + +This command generate a default route into the RIP. + +</div> + +<div class="cfgcmd"> + +set protocols rip distribute-list access-list \<in|out\> \<number\> + +This command can be used to filter the RIP path using access lists. +`in` and `out` this is the direction in which the access +lists are applied. + +</div> + +<div class="cfgcmd"> + +set protocols rip distribute-list interface \<interface\> access-list \<in|out\> \<number\> + +This command allows you apply access lists to a chosen interface to +filter the RIP path. + +</div> + +<div class="cfgcmd"> + +set protocols rip distribute-list prefix-list \<in|out\> \<name\> + +This command can be used to filter the RIP path using prefix lists. +`in` and `out` this is the direction in which the prefix +lists are applied. + +</div> + +<div class="cfgcmd"> + +set protocols rip distribute-list interface \<interface\> prefix-list \<in|out\> \<name\> + +This command allows you apply prefix lists to a chosen interface to +filter the RIP path. + +</div> + +<div class="cfgcmd"> + +set protocols rip route \<A.B.C.D/M\> + +This command is specific to FRR and VyOS. The route command makes a static +route only inside RIP. This command should be used only by advanced users +who are particularly knowledgeable about the RIP protocol. In most cases, +we recommend creating a static route in VyOS and redistributing it in RIP +using `redistribute static`. + +</div> + +<div class="cfgcmd"> + +set protocols rip timers update \<seconds\> + +This command specifies the update timer. Every update timer seconds, the +RIP process is awakened to send an unsolicited response message containing +the complete routing table to all neighboring RIP routers. The time range +is 5 to 2147483647. The default value is 30 seconds. + +</div> + +<div class="cfgcmd"> + +set protocols rip timers timeout \<seconds\> + +This command specifies the timeout timer. Upon expiration of the timeout, +the route is no longer valid; however, it is retained in the routing table +for a short time so that neighbors can be notified that the route has been +dropped. The time range is 5 to 2147483647. The default value is 180 +seconds. + +</div> + +<div class="cfgcmd"> + +set protocols rip timers garbage-collection \<seconds\> + +This command specifies the garbage-collection timer. Upon expiration of +the garbage-collection timer, the route is finally removed from the +routing table. The time range is 5 to 2147483647. The default value is 120 +seconds. + +</div> + +## Redistribution Configuration + +<div class="cfgcmd"> + +set protocols rip redistribute \<route source\> + +This command redistributes routing information from the given route source +into the RIP tables. There are five modes available for route source: bgp, +connected, kernel, ospf, static. + +</div> + +<div class="cfgcmd"> + +set protocols rip redistribute \<route source\> metric \<metric\> + +This command specifies metric for redistributed routes from the given route +source. There are five modes available for route source: bgp, connected, +kernel, ospf, static. The metric range is 1 to 16. + +</div> + +<div class="cfgcmd"> + +set protocols rip redistribute \<route source\> route-map \<name\> + +This command allows to use route map to filter redistributed routes from +the given route source. There are five modes available for route source: +bgp, connected, kernel, ospf, static. + +</div> + +<div class="cfgcmd"> + +set protocols rip default-metric \<metric\> + +This command modifies the default metric (hop count) value for redistributed +routes. The metric range is 1 to 16. The default value is 1. This command +does not affect connected route even if it is redistributed by +`redistribute connected`. To modify connected routes metric +value, please use `redistribute connected metric`. + +</div> + +## Interfaces Configuration + +<div class="cfgcmd"> + +set interfaces \<inttype\> \<intname\> ip rip authentication plaintext-password \<text\> + +This command sets the interface with RIP simple password authentication. +This command also sets authentication string. The string must be shorter +than 16 characters. + +</div> + +<div class="cfgcmd"> + +set interfaces \<inttype\> \<intname\> ip rip authentication md5 \<id\> password \<text\> + +This command sets the interface with RIP MD5 authentication. This command +also sets MD5 Key. The key must be shorter than 16 characters. + +</div> + +<div class="cfgcmd"> + +set interfaces \<inttype\> \<intname\> ip rip split-horizon disable + +This command disables split-horizon on the interface. By default, VyOS does +not advertise RIP routes out the interface over which they were learned +(split horizon).3 + +</div> + +<div class="cfgcmd"> + +set interfaces \<inttype\> \<intname\> ip rip split-horizon poison-reverse + +This command enables poison-reverse on the interface. If both poison reverse +and split horizon are enabled, then VyOS advertises the learned routes +as unreachable over the interface on which the route was learned. + +</div> + +## Operational Mode Commands + +<div class="opcmd"> + +show ip rip + +This command displays RIP routes. + +</div> + +``` none +Codes: R - RIP, C - connected, S - Static, O - OSPF, B - BGP +Sub-codes: + (n) - normal, (s) - static, (d) - default, (r) - redistribute, + (i) - interface + + Network Next Hop Metric From Tag Time +C(i) 10.0.12.0/24 0.0.0.0 1 self 0 +C(i) 10.0.13.0/24 0.0.0.0 1 self 0 +R(n) 10.0.23.0/24 10.0.12.2 2 10.0.12.2 0 02:53 +``` + +<div class="opcmd"> + +show ip rip status + +The command displays current RIP status. It includes RIP timer, filtering, +version, RIP enabled interface and RIP peer information. + +</div> + +``` none +Routing Protocol is "rip" + Sending updates every 30 seconds with +/-50%, next due in 11 seconds + Timeout after 180 seconds, garbage collect after 120 seconds + Outgoing update filter list for all interface is not set + Incoming update filter list for all interface is not set + Default redistribution metric is 1 + Redistributing: + Default version control: send version 2, receive any version + Interface Send Recv Key-chain + eth0 2 1 2 + eth2 2 1 2 + Routing for Networks: + 10.0.12.0/24 + eth0 + Routing Information Sources: + Gateway BadPackets BadRoutes Distance Last Update + 10.0.12.2 0 0 120 00:00:11 + Distance: (default is 120) +``` + +## Configuration Example + +Simple RIP configuration using 2 nodes and redistributing connected interfaces. + +**Node 1:** + +``` none +set interfaces loopback address 10.1.1.1/32 +set protocols rip network 192.168.0.0/24 +set protocols rip redistribute connected +``` + +**Node 2:** + +``` none +set interfaces loopback address 10.2.2.2/32 +set protocols rip network 192.168.0.0/24 +set protocols rip redistribute connected +``` diff --git a/docs/configuration/protocols/md-rpki.md b/docs/configuration/protocols/md-rpki.md new file mode 100644 index 00000000..f41e4d59 --- /dev/null +++ b/docs/configuration/protocols/md-rpki.md @@ -0,0 +1,238 @@ +# RPKI + +> There are two types of Network Admins who deal with BGP, those who have +> created an international incident and/or outage, and those who are lying +> +> -- [tweet by EvilMog](https://twitter.com/Evil_Mog/status/1230924170508169216), 2020-02-21 + +`RPKI (Resource Public Key Infrastructure)` is a framework designed to +secure the Internet routing infrastructure. It associates BGP route +announcements with the correct originating `ASN (Autonomus System +Number)` which BGP routers can then use to check each route against the +corresponding `ROA (Route Origin Authorisation)` for validity. RPKI is +described in `6480`. + +A BGP-speaking router like VyOS can retrieve ROA information from RPKI +"Relying Party software" (often just called an "RPKI server" or "RPKI +validator") by using `RTR (RPKI to Router)` protocol. There are several +open source implementations to choose from, such as NLNetLabs' [Routinator](https://www.nlnetlabs.nl/projects/rpki/routinator/) +(written in Rust), OpenBSD's [rpki-client](https://www.rpki-client.org/) (written in C), and [StayRTR](https://github.com/bgp/stayrtr/) (written +in Go). The RTR protocol is described in `8210`. + +<div class="tip"> + +<div class="title"> + +Tip + +</div> + +If you are new to these routing security technologies then there is an +[excellent guide to RPKI](https://rpki.readthedocs.io/) by NLnet Labs which will get you up to speed +very quickly. Their documentation explains everything from what RPKI is to +deploying it in production. It also has some +[help and operational guidance](https://rpki.readthedocs.io/en/latest/about/help.html) including "What can I do about my route +having an Invalid state?" + +</div> + +## Getting started + +First you will need to deploy an RPKI validator for your routers to use. NLnet +Labs provides a collection of [software](https://rpki.readthedocs.io/en/latest/ops/tools.html#relying-party-software) you can compare and settle on one. +Once your server is running you can start validating announcements. + +Imported prefixes during the validation may have values: + +> valid +> The prefix and ASN that originated it match a signed ROA. These are +> probably trustworthy route announcements. +> +> invalid +> The prefix or prefix length and ASN that originated it doesn't +> match any existing ROA. This could be the result of a prefix hijack, or +> merely a misconfiguration, but should probably be treated as +> untrustworthy route announcements. +> +> notfound +> No ROA exists which covers that prefix. Unfortunately this is the case for +> about 40%-50% of the prefixes which were announced to the `DFZ +> (default-free zone)` at the start of 2024. + +<div class="note"> + +<div class="title"> + +Note + +</div> + +If you are responsible for the global addresses assigned to your +network, please make sure that your prefixes have ROAs associated with them +to avoid being <span class="title-ref">notfound</span> by RPKI. For most ASNs this will involve +publishing ROAs via your `RIR (Regional Internet Registry)` (RIPE +NCC, APNIC, ARIN, LACNIC, or AFRINIC), and is something you are encouraged +to do whenever you plan to announce addresses into the DFZ. + +Particularly large networks may wish to run their own RPKI certificate +authority and publication server instead of publishing ROAs via their RIR. +This is a subject far beyond the scope of VyOS' documentation. Consider +reading about [Krill](https://www.nlnetlabs.nl/projects/rpki/krill/) if this is a rabbit hole you need or especially want +to dive down. + +</div> + +### Features of the Current Implementation + +In a nutshell, the current implementation provides the following features: + +- The BGP router can connect to one or more RPKI cache servers to receive + validated prefix to origin AS mappings. Advanced failover can be implemented + by server sockets with different preference values. +- If no connection to an RPKI cache server can be established after a + pre-defined timeout, the router will process routes without prefix origin + validation. It still will try to establish a connection to an RPKI cache + server in the background. +- By default, enabling RPKI does not change best path selection. In particular, + invalid prefixes will still be considered during best path selection. However, + the router can be configured to ignore all invalid prefixes. +- Route maps can be configured to match a specific RPKI validation state. This + allows the creation of local policies, which handle BGP routes based on the + outcome of the Prefix Origin Validation. +- Updates from the RPKI cache servers are directly applied and path selection is + updated accordingly. (Soft reconfiguration must be enabled for this to work). + +## Configuration + +<div class="cfgcmd"> + +set protocols rpki polling-period \<1-86400\> + +Define the time interval to update the local cache + +The default value is 300 seconds. + +</div> + +<div class="cfgcmd"> + +set protocols rpki expire-interval \<600-172800\> + +Set the number of seconds the router waits until the router +expires the cache. + +The default value is 7200 seconds. + +</div> + +<div class="cfgcmd"> + +set protocols rpki retry-interval \<1-7200\> + +Set the number of seconds the router waits until retrying to connect +to the cache server. + +The default value is 600 seconds. + +</div> + +<div class="cfgcmd"> + +set protocols rpki cache \<address\> port \<port\> + +Defined the IPv4, IPv6 or FQDN and port number of the caching RPKI caching +instance which is used. + +This is a mandatory setting. + +</div> + +<div class="cfgcmd"> + +set protocols rpki cache \<address\> preference \<preference\> + +Multiple RPKI caching instances can be supplied and they need a preference in +which their result sets are used. + +This is a mandatory setting. + +</div> + +### SSH + +Connections to the RPKI caching server can not only be established by TCP using +the RTR protocol but you can also rely on a secure SSH session to the server. +This provides transport integrity and confidentiality and it is a good idea if +your validation software supports it. To enable SSH, first you need to create +an SSH client keypair using `generate ssh client-key /config/auth/id_rsa_rpki`. Once your key is created you can setup the +connection. + +<div class="cfgcmd"> + +set protocols rpki cache \<address\> ssh username \<user\> + +SSH username to establish an SSH connection to the cache server. + +</div> + +<div class="cfgcmd"> + +set protocols rpki cache \<address\> ssh private-key-file \<filepath\> + +Local path that includes the private key file of the router. + +</div> + +<div class="cfgcmd"> + +set protocols rpki cache \<address\> ssh public-key-file \<filepath\> + +Local path that includes the public key file of the router. + +</div> + +<div class="note"> + +<div class="title"> + +Note + +</div> + +When using SSH, private-key-file and public-key-file +are mandatory options. + +</div> + +## Example + +We can build route-maps for import based on these states. Here is a simple +RPKI configuration, where <span class="title-ref">routinator</span> is the RPKI-validating "cache" +server with ip \`192.0.2.1\`: + +``` none +set protocols rpki cache 192.0.2.1 port '3323' +set protocols rpki cache 192.0.2.1 preference '1' +``` + +Here is an example route-map to apply to routes learned at import. In this +filter we reject prefixes with the state <span class="title-ref">invalid</span>, and set a higher +<span class="title-ref">local-preference</span> if the prefix is RPKI <span class="title-ref">valid</span> rather than merely +<span class="title-ref">notfound</span>. + +``` none +set policy route-map ROUTES-IN rule 10 action 'permit' +set policy route-map ROUTES-IN rule 10 match rpki 'valid' +set policy route-map ROUTES-IN rule 10 set local-preference '300' +set policy route-map ROUTES-IN rule 20 action 'permit' +set policy route-map ROUTES-IN rule 20 match rpki 'notfound' +set policy route-map ROUTES-IN rule 20 set local-preference '125' +set policy route-map ROUTES-IN rule 30 action 'deny' +set policy route-map ROUTES-IN rule 30 match rpki 'invalid' +``` + +Once your routers are configured to reject RPKI-invalid prefixes, you can +test whether the configuration is working correctly using Cloudflare's [test](https://isbgpsafeyet.com/) +website. Keep in mind that in order for this to work, you need to have no +default routes or anything else that would still send traffic to RPKI-invalid +destinations. diff --git a/docs/configuration/protocols/md-segment-routing.md b/docs/configuration/protocols/md-segment-routing.md new file mode 100644 index 00000000..24516103 --- /dev/null +++ b/docs/configuration/protocols/md-segment-routing.md @@ -0,0 +1,442 @@ +# Segment Routing + +Segment Routing (SR) is a network architecture that is similar to source-routing +. In this architecture, the ingress router adds a list of segments, known as +SIDs, to the packet as it enters the network. These segments represent different +portions of the network path that the packet will take. + +The SR segments are portions of the network path taken by the packet, and are +called SIDs. At each node, the first SID of the list is read, executed as a +forwarding function, and may be popped to let the next node read the next SID of +the list. The SID list completely determines the path where the packet is +forwarded. + +Segment Routing can be applied to an existing MPLS-based data plane and defines +a control plane network architecture. In MPLS networks, segments are encoded as +MPLS labels and are added at the ingress router. These MPLS labels are then +exchanged and populated by Interior Gateway Protocols (IGPs) like IS-IS or OSPF +which are running on most ISPs. + +<div class="note"> + +<div class="title"> + +Note + +</div> + +Segment routing defines a control plane network architecture and +can be applied to an existing MPLS based dataplane. In the MPLS networks, +segments are encoded as MPLS labels and are imposed at the ingress router. +MPLS labels are exchanged and populated by IGPs like IS-IS.Segment Routing +as per RFC8667 for MPLS dataplane. It supports IPv4, IPv6 and ECMP and has +been tested against Cisco & Juniper routers.however,this deployment is still +EXPERIMENTAL for FRR. + +</div> + +## IS-IS SR Configuration + +Segment routing (SR) is used by the IGP protocols to interconnect network +devices, below configuration shows how to enable SR on IS-IS: + +<div class="note"> + +<div class="title"> + +Note + +</div> + +`Known limitations:` + +No support for level redistribution (L1 to L2 or L2 to L1) + +No support for binding SID + +No support for SRLB + +Only one SRGB and default SPF Algorithm is supported + +</div> + +<div class="cfgcmd"> + +set protocols isis segment-routing global-block high-label-value +\<label-value\> + +Set the Segment Routing Global Block i.e. the label range used by MPLS to +store label in the MPLS FIB for Prefix SID. Note that the block size may +not exceed 65535. + +</div> + +<div class="cfgcmd"> + +set protocols isis segment-routing global-block low-label-value +\<label-value\> + +Set the Segment Routing Global Block i.e. the low label range used by MPLS to +store label in the MPLS FIB for Prefix SID. Note that the block size may +not exceed 65535. + +</div> + +<div class="cfgcmd"> + +set protocols isis segment-routing local-block high-label-value +\<label-value\> + +Set the Segment Routing Local Block i.e. the label range used by MPLS to +store label in the MPLS FIB for Prefix SID. Note that the block size may +not exceed 65535.Segment Routing Local Block, The negative command always +unsets both. + +</div> + +<div class="cfgcmd"> + +set protocols isis segment-routing local-block \<low-label-value +\<label-value\> + +Set the Segment Routing Local Block i.e. the low label range used by MPLS to +store label in the MPLS FIB for Prefix SID. Note that the block size may +not exceed 65535.Segment Routing Local Block, The negative command always +unsets both. + +</div> + +<div class="cfgcmd"> + +set protocols isis segment-routing maximum-label-depth \<1-16\> + +Set the Maximum Stack Depth supported by the router. The value depend of +the MPLS dataplane. + +</div> + +<div class="cfgcmd"> + +set protocols isis segment-routing prefix \<address\> index value +\<0-65535\> + +A segment ID that contains an IP address prefix calculated by an IGP in the +service provider core network. Prefix SIDs are globally unique, this value +indentify it + +</div> + +<div class="cfgcmd"> + +set protocols isis segment-routing prefix \<address\> index +\<no-php-flag | explicit-null| n-flag-clear\> + +this option allows to configure prefix-sid on SR. The ‘no-php-flag’ means NO +Penultimate Hop Popping that allows SR node to request to its neighbor to +not pop the label. The ‘explicit-null’ flag allows SR node to request to its +neighbor to send IP packet with the EXPLICIT-NULL label. The ‘n-flag-clear’ +option can be used to explicitly clear the Node flag that is set by default +for Prefix-SIDs associated to loopback addresses. This option is necessary +to configure Anycast-SIDs. + +</div> + +<div class="opcmd"> + +show isis segment-routing node + +Show detailed information about all learned Segment Routing Nodes + +</div> + +<div class="opcmd"> + +show isis route prefix-sid + +Show detailed information about prefix-sid and label learned + +</div> + +<div class="note"> + +<div class="title"> + +Note + +</div> + +more information related IGP - `routing-isis` + +</div> + +## OSPF SR Configuration + +Segment routing (SR) is used by the IGP protocols to interconnect network +devices, below configuration shows how to enable SR on OSPF: + +<div class="cfgcmd"> + +set protocols ospf parameters opaque-lsa + +Enable the Opaque-LSA capability (rfc2370), necessary to transport label +on IGP + +</div> + +<div class="cfgcmd"> + +set protocols ospf segment-routing global-block high-label-value +\<label-value\> + +Set the Segment Routing Global Block i.e. the label range used by MPLS to +store label in the MPLS FIB for Prefix SID. Note that the block size may +not exceed 65535. + +</div> + +<div class="cfgcmd"> + +set protocols ospf segment-routing global-block low-label-value +\<label-value\> + +Set the Segment Routing Global Block i.e. the low label range used by MPLS to +store label in the MPLS FIB for Prefix SID. Note that the block size may +not exceed 65535. + +</div> + +<div class="cfgcmd"> + +set protocols ospf segment-routing local-block high-label-value +\<label-value\> + +Set the Segment Routing Local Block i.e. the label range used by MPLS to +store label in the MPLS FIB for Prefix SID. Note that the block size may +not exceed 65535.Segment Routing Local Block, The negative command always +unsets both. + +</div> + +<div class="cfgcmd"> + +set protocols ospf segment-routing local-block \<low-label-value +\<label-value\> + +Set the Segment Routing Local Block i.e. the low label range used by MPLS to +store label in the MPLS FIB for Prefix SID. Note that the block size may +not exceed 65535.Segment Routing Local Block, The negative command always +unsets both. + +</div> + +<div class="cfgcmd"> + +set protocols ospf segment-routing maximum-label-depth \<1-16\> + +Set the Maximum Stack Depth supported by the router. The value depend of +the MPLS dataplane. + +</div> + +<div class="cfgcmd"> + +set protocols ospf segment-routing prefix \<address\> index value +\<0-65535\> + +A segment ID that contains an IP address prefix calculated by an IGP in the +service provider core network. Prefix SIDs are globally unique, this value +indentify it + +</div> + +<div class="cfgcmd"> + +set protocols ospf segment-routing prefix \<address\> index +\<no-php-flag | explicit-null| n-flag-clear\> + +this option allows to configure prefix-sid on SR. The ‘no-php-flag’ means NO +Penultimate Hop Popping that allows SR node to request to its neighbor to +not pop the label. The ‘explicit-null’ flag allows SR node to request to its +neighbor to send IP packet with the EXPLICIT-NULL label. The ‘n-flag-clear’ +option can be used to explicitly clear the Node flag that is set by default +for Prefix-SIDs associated to loopback addresses. This option is necessary +to configure Anycast-SIDs. + +</div> + +<div class="note"> + +<div class="title"> + +Note + +</div> + +more information related IGP - `routing-ospf` + +</div> + +## Configuration Example + +we described the configuration SR ISIS / SR OSPF using 2 connected with them to +share label information. + +### Enable IS-IS with Segment Routing (Experimental) + +**Node 1:** + +``` none +set interfaces loopback lo address '192.168.255.255/32' +set interfaces ethernet eth1 address '192.0.2.1/24' + +set protocols isis interface eth1 +set protocols isis interface lo +set protocols isis net '49.0001.1921.6825.5255.00' +set protocols isis segment-routing global-block high-label-value '599' +set protocols isis segment-routing global-block low-label-value '550' +set protocols isis segment-routing prefix 192.168.255.255/32 index value '1' +set protocols isis segment-routing prefix 192.168.255.255/32 index explicit-null +set protocols mpls interface 'eth1' +``` + +**Node 2:** + +``` none +set interfaces loopback lo address '192.168.255.254/32' +set interfaces ethernet eth1 address '192.0.2.2/24' + +set protocols isis interface eth1 +set protocols isis interface lo +set protocols isis net '49.0001.1921.6825.5254.00' +set protocols isis segment-routing global-block high-label-value '599' +set protocols isis segment-routing global-block low-label-value '550' +set protocols isis segment-routing prefix 192.168.255.254/32 index value '2' +set protocols isis segment-routing prefix 192.168.255.254/32 index explicit-null +set protocols mpls interface 'eth1' +``` + +This gives us MPLS segment routing enabled and labels for far end loopbacks: + +``` none +Node-1@vyos:~$ show mpls table + Inbound Label Type Nexthop Outbound Label + ---------------------------------------------------------------------- + 552 SR (IS-IS) 192.0.2.2 IPv4 Explicit Null <-- Node-2 loopback learned on Node-1 + 15000 SR (IS-IS) 192.0.2.2 implicit-null + 15001 SR (IS-IS) fe80::e87:6cff:fe09:1 implicit-null + 15002 SR (IS-IS) 192.0.2.2 implicit-null + 15003 SR (IS-IS) fe80::e87:6cff:fe09:1 implicit-null + +Node-2@vyos:~$ show mpls table + Inbound Label Type Nexthop Outbound Label + --------------------------------------------------------------------- + 551 SR (IS-IS) 192.0.2.1 IPv4 Explicit Null <-- Node-1 loopback learned on Node-2 + 15000 SR (IS-IS) 192.0.2.1 implicit-null + 15001 SR (IS-IS) fe80::e33:2ff:fe80:1 implicit-null + 15002 SR (IS-IS) 192.0.2.1 implicit-null + 15003 SR (IS-IS) fe80::e33:2ff:fe80:1 implicit-null +``` + +Here is the routing tables showing the MPLS segment routing label operations: + +``` none +Node-1@vyos:~$ show ip route isis +Codes: K - kernel route, C - connected, S - static, R - RIP, + O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP, + T - Table, v - VNC, V - VNC-Direct, A - Babel, F - PBR, + f - OpenFabric, + > - selected route, * - FIB route, q - queued, r - rejected, b - backup + t - trapped, o - offload failure + +I 192.0.2.0/24 [115/20] via 192.0.2.2, eth1 inactive, weight 1, 00:07:48 +I>* 192.168.255.254/32 [115/20] via 192.0.2.2, eth1, label IPv4 Explicit Null, weight 1, 00:03:39 + +Node-2@vyos:~$ show ip route isis +Codes: K - kernel route, C - connected, S - static, R - RIP, + O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP, + T - Table, v - VNC, V - VNC-Direct, A - Babel, F - PBR, + f - OpenFabric, + > - selected route, * - FIB route, q - queued, r - rejected, b - backup + t - trapped, o - offload failure + +I 192.0.2.0/24 [115/20] via 192.0.2.1, eth1 inactive, weight 1, 00:07:46 +I>* 192.168.255.255/32 [115/20] via 192.0.2.1, eth1, label IPv4 Explicit Null, weight 1, 00:03:43 +``` + +### Enable OSPF with Segment Routing (Experimental): + +**Node 1** + +``` none +set interfaces loopback lo address 10.1.1.1/32 +set interfaces ethernet eth0 address 192.168.0.1/24 +set protocols ospf area 0 network '192.168.0.0/24' +set protocols ospf area 0 network '10.1.1.1/32' +set protocols ospf parameters opaque-lsa +set protocols ospf parameters router-id '10.1.1.1' +set protocols ospf segment-routing global-block high-label-value '1100' +set protocols ospf segment-routing global-block low-label-value '1000' +set protocols ospf segment-routing prefix 10.1.1.1/32 index explicit-null +set protocols ospf segment-routing prefix 10.1.1.1/32 index value '1' +``` + +**Node 2** + +``` none +set interfaces loopback lo address 10.1.1.2/32 +set interfaces ethernet eth0 address 192.168.0.2/24 +set protocols ospf area 0 network '192.168.0.0/24' +set protocols ospf area 0 network '10.1.1.2/32' +set protocols ospf parameters opaque-lsa +set protocols ospf parameters router-id '10.1.1.2' +set protocols ospf segment-routing global-block high-label-value '1100' +set protocols ospf segment-routing global-block low-label-value '1000' +set protocols ospf segment-routing prefix 10.1.1.2/32 index explicit-null +set protocols ospf segment-routing prefix 10.1.1.2/32 index value '2' +``` + +This gives us MPLS segment routing enabled and labels for far end loopbacks: + +``` none +Node-1@vyos:~$ show mpls table + Inbound Label Type Nexthop Outbound Label + ----------------------------------------------------------- + 1002 SR (OSPF) 192.168.0.2 IPv4 Explicit Null <-- Node-2 loopback learned on Node-1 + 15000 SR (OSPF) 192.168.0.2 implicit-null + 15001 SR (OSPF) 192.168.0.2 implicit-null + +Node-2@vyos:~$ show mpls table + Inbound Label Type Nexthop Outbound Label + ----------------------------------------------------------- + 1001 SR (OSPF) 192.168.0.1 IPv4 Explicit Null <-- Node-1 loopback learned on Node-2 + 15000 SR (OSPF) 192.168.0.1 implicit-null + 15001 SR (OSPF) 192.168.0.1 implicit-null +``` + +Here is the routing tables showing the MPLS segment routing label operations: + +``` none +Node-1@vyos:~$ show ip route ospf +Codes: K - kernel route, C - connected, S - static, R - RIP, + O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP, + T - Table, v - VNC, V - VNC-Direct, A - Babel, F - PBR, + f - OpenFabric, + > - selected route, * - FIB route, q - queued, r - rejected, b - backup + t - trapped, o - offload failure + +O 10.1.1.1/32 [110/0] is directly connected, lo, weight 1, 00:03:43 +O>* 10.1.1.2/32 [110/1] via 192.168.0.2, eth0, label IPv4 Explicit Null, weight 1, 00:03:32 +O 192.168.0.0/24 [110/1] is directly connected, eth0, weight 1, 00:03:43 + +Node-2@vyos:~$ show ip route ospf +Codes: K - kernel route, C - connected, S - static, R - RIP, + O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP, + T - Table, v - VNC, V - VNC-Direct, A - Babel, F - PBR, + f - OpenFabric, + > - selected route, * - FIB route, q - queued, r - rejected, b - backup + t - trapped, o - offload failure + +O>* 10.1.1.1/32 [110/1] via 192.168.0.1, eth0, label IPv4 Explicit Null, weight 1, 00:03:36 +O 10.1.1.2/32 [110/0] is directly connected, lo, weight 1, 00:03:51 +O 192.168.0.0/24 [110/1] is directly connected, eth0, weight 1, 00:03:51 +``` diff --git a/docs/configuration/protocols/md-static.md b/docs/configuration/protocols/md-static.md new file mode 100644 index 00000000..dca76d53 --- /dev/null +++ b/docs/configuration/protocols/md-static.md @@ -0,0 +1,322 @@ +# Static + +Static routes are manually configured routes, which, in general, cannot be +updated dynamically from information VyOS learns about the network topology from +other routing protocols. However, if a link fails, the router will remove +routes, including static routes, from the `RIPB (Routing Information +Base)` that used this interface to reach the next hop. In general, static +routes should only be used for very simple network topologies, or to override +the behavior of a dynamic routing protocol for a small number of routes. The +collection of all routes the router has learned from its configuration or from +its dynamic routing protocols is stored in the RIB. Unicast routes are directly +used to determine the forwarding table used for unicast packet forwarding. + +## Static Routes + +<div class="cfgcmd"> + +set protocols static route \<subnet\> next-hop \<address\> + +Configure next-hop <span class="title-ref">\<address\></span> for an IPv4 static route. Multiple static +routes can be created. + +</div> + +<div class="cfgcmd"> + +set protocols static route \<subnet\> next-hop \<address\> disable + +Disable this IPv4 static route entry. + +</div> + +<div class="cfgcmd"> + +set protocols static route \<subnet\> next-hop \<address\> +distance \<distance\> + +Defines next-hop distance for this route, routes with smaller administrative +distance are elected prior to those with a higher distance. + +Range is 1 to 255, default is 1. + +<div class="note"> + +<div class="title"> + +Note + +</div> + +Routes with a distance of 255 are effectively disabled and not +installed into the kernel. + +</div> + +</div> + +<div class="cfgcmd"> + +set protocols static route6 \<subnet\> next-hop \<address\> + +Configure next-hop <span class="title-ref">\<address\></span> for an IPv6 static route. Multiple static +routes can be created. + +</div> + +<div class="cfgcmd"> + +set protocols static route6 \<subnet\> next-hop \<address\> disable + +Disable this IPv6 static route entry. + +</div> + +<div class="cfgcmd"> + +set protocols static route6 \<subnet\> next-hop \<address\> +distance \<distance\> + +Defines next-hop distance for this route, routes with smaller administrative +distance are elected prior to those with a higher distance. + +Range is 1 to 255, default is 1. + +<div class="note"> + +<div class="title"> + +Note + +</div> + +Routes with a distance of 255 are effectively disabled and not +installed into the kernel. + +</div> + +</div> + +<div class="cfgcmd"> + +set protocols static route6 \<subnet\> next-hop \<address\> segments \<segments\> + +It is possible to specify a static route for ipv6 prefixes using an SRv6 segments +instruction. The <span class="title-ref">/</span> separator can be used to specify multiple segment instructions. + +Example: + +``` none +set protocols static route6 2001:db8:1000::/36 next-hop 2001:db8:201::ffff segments '2001:db8:aaaa::7/2002::4/2002::3/2002::2' +``` + +``` none +vyos@vyos:~$ show ipv6 route +Codes: K - kernel route, C - connected, S - static, R - RIPng, + O - OSPFv3, I - IS-IS, B - BGP, N - NHRP, T - Table, + v - VNC, V - VNC-Direct, A - Babel, F - PBR, + f - OpenFabric, + > - selected route, * - FIB route, q - queued, r - rejected, b - backup + t - trapped, o - offload failure +C>* 2001:db8:201::/64 is directly connected, eth0.201, 00:00:46 +S>* 2001:db8:1000::/36 [1/0] via 2001:db8:201::ffff, eth0.201, seg6 2001:db8:aaaa::7,2002::4,2002::3,2002::2, weight 1, 00:00:08 +``` + +</div> + +### Interface Routes + +<div class="cfgcmd"> + +set protocols static route \<subnet\> interface +\<interface\> + +Allows you to configure the next-hop interface for an interface-based IPv4 +static route. <span class="title-ref">\<interface\></span> will be the next-hop interface where traffic is +routed for the given <span class="title-ref">\<subnet\></span>. + +</div> + +<div class="cfgcmd"> + +set protocols static route \<subnet\> interface +\<interface\> disable + +Disables interface-based IPv4 static route. + +</div> + +<div class="cfgcmd"> + +set protocols static route \<subnet\> interface +\<interface\> distance \<distance\> + +Defines next-hop distance for this route, routes with smaller administrative +distance are elected prior to those with a higher distance. + +Range is 1 to 255, default is 1. + +</div> + +<div class="cfgcmd"> + +set protocols static route6 \<subnet\> interface +\<interface\> + +Allows you to configure the next-hop interface for an interface-based IPv6 +static route. <span class="title-ref">\<interface\></span> will be the next-hop interface where traffic is +routed for the given <span class="title-ref">\<subnet\></span>. + +</div> + +<div class="cfgcmd"> + +set protocols static route6 \<subnet\> interface +\<interface\> disable + +Disables interface-based IPv6 static route. + +</div> + +<div class="cfgcmd"> + +set protocols static route6 \<subnet\> interface +\<interface\> distance \<distance\> + +Defines next-hop distance for this route, routes with smaller administrative +distance are elected prior to those with a higher distance. + +Range is 1 to 255, default is 1. + +</div> + +<div class="cfgcmd"> + +set protocols static route6 \<subnet\> interface +\<interface\> segments \<segments\> + +It is possible to specify a static route for ipv6 prefixes using an SRv6 segments +instruction. The <span class="title-ref">/</span> separator can be used to specify multiple segment instructions. + +Example: + +``` none +set protocols static route6 2001:db8:1000::/36 interface eth0 segments '2001:db8:aaaa::7/2002::4/2002::3/2002::2' +``` + +</div> + +### Blackhole + +<div class="cfgcmd"> + +set protocols static route \<subnet\> blackhole + +Use this command to configure a "black-hole" route on the router. A +black-hole route is a route for which the system silently discard packets +that are matched. This prevents networks leaking out public interfaces, but +it does not prevent them from being used as a more specific route inside your +network. + +</div> + +<div class="cfgcmd"> + +set protocols static route \<subnet\> blackhole distance \<distance\> + +Defines blackhole distance for this route, routes with smaller administrative +distance are elected prior to those with a higher distance. + +</div> + +<div class="cfgcmd"> + +set protocols static route6 \<subnet\> blackhole + +Use this command to configure a "black-hole" route on the router. A +black-hole route is a route for which the system silently discard packets +that are matched. This prevents networks leaking out public interfaces, but +it does not prevent them from being used as a more specific route inside your +network. + +</div> + +<div class="cfgcmd"> + +set protocols static route6 \<subnet\> blackhole distance \<distance\> + +Defines blackhole distance for this route, routes with smaller administrative +distance are elected prior to those with a higher distance. + +</div> + +### Alternate Routing Tables + +TBD + +Alternate routing tables are used with policy based routing by utilizing +`vrf`. + +# ARP + +`ARP (Address Resolution Protocol)` is a communication protocol used for +discovering the link layer address, such as a MAC address, associated with a +given internet layer address, typically an IPv4 address. This mapping is a +critical function in the Internet protocol suite. ARP was defined in 1982 by +`826` which is Internet Standard STD 37. + +In Internet Protocol Version 6 (IPv6) networks, the functionality of ARP is +provided by the Neighbor Discovery Protocol (NDP). + +To manipulate or display [ARP](https://en.wikipedia.org/wiki/Address_Resolution_Protocol) table entries, the following commands are +implemented. + +## Configure + +<div class="cfgcmd"> + +set protocols static arp interface \<interface\> address \<host\> +mac \<mac\> + +This will configure a static ARP entry always resolving <span class="title-ref">\<address\></span> to +<span class="title-ref">\<mac\></span> for interface <span class="title-ref">\<interface\></span>. + +Example: + +``` none +set protocols static arp interface eth0 address 192.0.2.1 mac 01:23:45:67:89:01 +``` + +</div> + +## Operation + +<div class="opcmd"> + +show protocols static arp + +Display all known ARP table entries spanning across all interfaces + +</div> + +``` none +vyos@vyos:~$ show protocols static arp +Address HWtype HWaddress Flags Mask Iface +10.1.1.1 ether 00:53:00:de:23:2e C eth1 +10.1.1.100 ether 00:53:00:de:23:aa CM eth1 +``` + +<div class="opcmd"> + +show protocols static arp interface eth1 + +Display all known ARP table entries on a given interface only (<span class="title-ref">eth1</span>): + +</div> + +``` none +vyos@vyos:~$ show protocols static arp interface eth1 +Address HWtype HWaddress Flags Mask Iface +10.1.1.1 ether 00:53:00:de:23:2e C eth1 +10.1.1.100 ether 00:53:00:de:23:aa CM eth1 +``` |