From b8b3044d3c3515d91de0f44785bfd965174867df Mon Sep 17 00:00:00 2001 From: Yuriy Andamasov Date: Wed, 6 May 2026 21:50:08 +0300 Subject: feat: flip swap mechanism on sagitta — MD as primary, RST as override MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Mirror of #1899 (current) and #1900 (circinus) for sagitta. Same logic, same scripts, per-branch file set. Changes: - Rename docs/**/md-.md to docs/**/.md (drop md- prefix) for all 210 stems previously listed in docs/_swap.txt - Rename docs/**/.rst to docs/**/rst-.rst (add rst- prefix) for the same 210 stems - Repurpose docs/_swap.txt as docs/_rst_overrides.txt; initially empty - conf.py exclude_patterns flipped: rst-*.rst excluded by default - conf.py runtime-artifact references updated to _rst_override_state.json and _md_exclude.txt - scripts/swap_sources.py imported from current (post-#1899 rewrite, with inverted rename direction) - scripts/import_myst.py and tests/test_import_myst.py deleted (obsolete) - tests/test_swap_sources.py imported from current (post-#1899 rewrite) Side-effect: fixes the same 404 on /en/1.4/ View page source links that #1899 fixed for /en/rolling/ and #1900 fixed for /en/1.5/. Per-branch differences vs #1899: - sagitta has 210 stems vs current's 254 (sagitta has no vpp pages and fewer current-only features; cli + installation/cloud/aws are still RST-only on sagitta pending the title-level fix follow-up) - otherwise the script/conf.py/test changes are byte-identical with current Generated by robots https://vyos.io --- docs/configuration/protocols/babel.md | 245 +++ docs/configuration/protocols/babel.rst | 210 --- docs/configuration/protocols/bfd.md | 205 +++ docs/configuration/protocols/bfd.rst | 199 --- docs/configuration/protocols/bgp.md | 1435 ++++++++++++++++++ docs/configuration/protocols/bgp.rst | 1274 ---------------- docs/configuration/protocols/failover.md | 120 ++ docs/configuration/protocols/failover.rst | 114 -- docs/configuration/protocols/igmp-proxy.md | 79 + docs/configuration/protocols/igmp-proxy.rst | 77 - docs/configuration/protocols/index.md | 22 + docs/configuration/protocols/index.rst | 22 - docs/configuration/protocols/isis.md | 596 ++++++++ docs/configuration/protocols/isis.rst | 547 ------- docs/configuration/protocols/md-babel.md | 245 --- docs/configuration/protocols/md-bfd.md | 205 --- docs/configuration/protocols/md-bgp.md | 1435 ------------------ docs/configuration/protocols/md-failover.md | 120 -- docs/configuration/protocols/md-igmp-proxy.md | 79 - docs/configuration/protocols/md-index.md | 22 - docs/configuration/protocols/md-isis.md | 596 -------- docs/configuration/protocols/md-mpls.md | 285 ---- docs/configuration/protocols/md-ospf.md | 1560 -------------------- docs/configuration/protocols/md-pim.md | 304 ---- docs/configuration/protocols/md-pim6.md | 100 -- docs/configuration/protocols/md-rip.md | 294 ---- docs/configuration/protocols/md-rpki.md | 210 --- docs/configuration/protocols/md-segment-routing.md | 359 ----- docs/configuration/protocols/md-static.md | 268 ---- docs/configuration/protocols/mpls.md | 285 ++++ docs/configuration/protocols/mpls.rst | 259 ---- docs/configuration/protocols/ospf.md | 1560 ++++++++++++++++++++ docs/configuration/protocols/ospf.rst | 1391 ----------------- docs/configuration/protocols/pim.md | 304 ++++ docs/configuration/protocols/pim.rst | 266 ---- docs/configuration/protocols/pim6.md | 100 ++ docs/configuration/protocols/pim6.rst | 94 -- docs/configuration/protocols/rip.md | 294 ++++ docs/configuration/protocols/rip.rst | 257 ---- docs/configuration/protocols/rpki.md | 210 +++ docs/configuration/protocols/rpki.rst | 211 --- docs/configuration/protocols/rst-babel.rst | 210 +++ docs/configuration/protocols/rst-bfd.rst | 199 +++ docs/configuration/protocols/rst-bgp.rst | 1274 ++++++++++++++++ docs/configuration/protocols/rst-failover.rst | 114 ++ docs/configuration/protocols/rst-igmp-proxy.rst | 77 + docs/configuration/protocols/rst-index.rst | 22 + docs/configuration/protocols/rst-isis.rst | 547 +++++++ docs/configuration/protocols/rst-mpls.rst | 259 ++++ docs/configuration/protocols/rst-ospf.rst | 1391 +++++++++++++++++ docs/configuration/protocols/rst-pim.rst | 266 ++++ docs/configuration/protocols/rst-pim6.rst | 94 ++ docs/configuration/protocols/rst-rip.rst | 257 ++++ docs/configuration/protocols/rst-rpki.rst | 211 +++ .../protocols/rst-segment-routing.rst | 357 +++++ docs/configuration/protocols/rst-static.rst | 242 +++ docs/configuration/protocols/segment-routing.md | 359 +++++ docs/configuration/protocols/segment-routing.rst | 357 ----- docs/configuration/protocols/static.md | 268 ++++ docs/configuration/protocols/static.rst | 242 --- 60 files changed, 11602 insertions(+), 11602 deletions(-) create mode 100644 docs/configuration/protocols/babel.md delete mode 100644 docs/configuration/protocols/babel.rst create mode 100644 docs/configuration/protocols/bfd.md delete mode 100644 docs/configuration/protocols/bfd.rst create mode 100644 docs/configuration/protocols/bgp.md delete mode 100644 docs/configuration/protocols/bgp.rst create mode 100644 docs/configuration/protocols/failover.md delete mode 100644 docs/configuration/protocols/failover.rst create mode 100644 docs/configuration/protocols/igmp-proxy.md delete mode 100644 docs/configuration/protocols/igmp-proxy.rst create mode 100644 docs/configuration/protocols/index.md delete mode 100644 docs/configuration/protocols/index.rst create mode 100644 docs/configuration/protocols/isis.md delete mode 100644 docs/configuration/protocols/isis.rst delete mode 100644 docs/configuration/protocols/md-babel.md delete mode 100644 docs/configuration/protocols/md-bfd.md delete mode 100644 docs/configuration/protocols/md-bgp.md delete mode 100644 docs/configuration/protocols/md-failover.md delete mode 100644 docs/configuration/protocols/md-igmp-proxy.md delete mode 100644 docs/configuration/protocols/md-index.md delete mode 100644 docs/configuration/protocols/md-isis.md delete mode 100644 docs/configuration/protocols/md-mpls.md delete mode 100644 docs/configuration/protocols/md-ospf.md delete mode 100644 docs/configuration/protocols/md-pim.md delete mode 100644 docs/configuration/protocols/md-pim6.md delete mode 100644 docs/configuration/protocols/md-rip.md delete mode 100644 docs/configuration/protocols/md-rpki.md delete mode 100644 docs/configuration/protocols/md-segment-routing.md delete mode 100644 docs/configuration/protocols/md-static.md create mode 100644 docs/configuration/protocols/mpls.md delete mode 100644 docs/configuration/protocols/mpls.rst create mode 100644 docs/configuration/protocols/ospf.md delete mode 100644 docs/configuration/protocols/ospf.rst create mode 100644 docs/configuration/protocols/pim.md delete mode 100644 docs/configuration/protocols/pim.rst create mode 100644 docs/configuration/protocols/pim6.md delete mode 100644 docs/configuration/protocols/pim6.rst create mode 100644 docs/configuration/protocols/rip.md delete mode 100644 docs/configuration/protocols/rip.rst create mode 100644 docs/configuration/protocols/rpki.md delete mode 100644 docs/configuration/protocols/rpki.rst create mode 100644 docs/configuration/protocols/rst-babel.rst create mode 100644 docs/configuration/protocols/rst-bfd.rst create mode 100644 docs/configuration/protocols/rst-bgp.rst create mode 100644 docs/configuration/protocols/rst-failover.rst create mode 100644 docs/configuration/protocols/rst-igmp-proxy.rst create mode 100644 docs/configuration/protocols/rst-index.rst create mode 100644 docs/configuration/protocols/rst-isis.rst create mode 100644 docs/configuration/protocols/rst-mpls.rst create mode 100644 docs/configuration/protocols/rst-ospf.rst create mode 100644 docs/configuration/protocols/rst-pim.rst create mode 100644 docs/configuration/protocols/rst-pim6.rst create mode 100644 docs/configuration/protocols/rst-rip.rst create mode 100644 docs/configuration/protocols/rst-rpki.rst create mode 100644 docs/configuration/protocols/rst-segment-routing.rst create mode 100644 docs/configuration/protocols/rst-static.rst create mode 100644 docs/configuration/protocols/segment-routing.md delete mode 100644 docs/configuration/protocols/segment-routing.rst create mode 100644 docs/configuration/protocols/static.md delete mode 100644 docs/configuration/protocols/static.rst (limited to 'docs/configuration/protocols') diff --git a/docs/configuration/protocols/babel.md b/docs/configuration/protocols/babel.md new file mode 100644 index 00000000..b169e861 --- /dev/null +++ b/docs/configuration/protocols/babel.md @@ -0,0 +1,245 @@ +(babel)= + +# Babel + +Babel is a modern routing protocol designed to be robust and efficient +both in ordinary wired networks and in wireless mesh networks. +By default, it uses hop-count on wired networks and a variant of ETX +on wireless links, It can be configured to take radio diversity into account +and to automatically compute a link's latency and include it in the metric. +It is defined in {rfc}`8966`. + +Babel a dual stack protocol. +A single Babel instance is able to perform routing for both IPv4 and IPv6. + +## General Configuration + +VyOS does not have a special command to start the Babel process. +The Babel process starts when the first Babel enabled interface is configured. + +```{eval-rst} +.. cfgcmd:: set protocols babel interface + + This command specifies a Babel enabled interface by interface name. Both + the sending and receiving of Babel packets will be enabled on the interface + specified in this command. +``` + +## Optional Configuration + +```{eval-rst} +.. cfgcmd:: set protocols babel parameters diversity + + This command enables routing using radio frequency diversity. + This is highly recommended in networks with many wireless nodes. + + .. note:: If you enable this, you will probably want to + set diversity-factor and channel below. +``` + +```{eval-rst} +.. cfgcmd:: set protocols babel parameters diversity-factor <1-256> + + This command sets the multiplicative factor used for diversity routing, + in units of 1/256; lower values cause diversity to play a more important role + in route selection. + The default it 256, which means that diversity plays no role in route + selection; you will probably want to set that to 128 or less on nodes + with multiple independent radios. +``` + +```{eval-rst} +.. cfgcmd:: set protocols babel parameters resend-delay + + This command specifies the time in milliseconds after which an 'important' + request or update will be resent. The default is 2000 ms. +``` + +```{eval-rst} +.. cfgcmd:: set protocols babel parameters smoothing-half-life + + This command specifies the time constant, in seconds, of the smoothing + algorithm used for implementing hysteresis. + Larger values reduce route oscillation at the cost of very slightly increasing + convergence time. The value 0 disables hysteresis, and is suitable for wired + networks. The default is 4 s. +``` + +## Interfaces Configuration + +```{eval-rst} +.. cfgcmd:: set protocols babel interface type + + This command sets the interface type: + + **auto** – automatically determines the interface type. + **wired** – enables optimisations for wired interfaces. + **wireless** – disables a number of optimisations that are only correct + on wired interfaces. Specifying wireless is always correct, + but may cause slower convergence and extra routing traffic. +``` + +```{eval-rst} +.. cfgcmd:: set protocols babel interface split-horizon + + This command specifies whether to perform split-horizon on the interface. + Specifying no babel split-horizon is always correct, while babel split-horizon + is an optimisation that should only be used on symmetric + and transitive (wired) networks. + + **default** – enable split-horizon on wired interfaces, and disable + split-horizon on wireless interfaces. + **enable** – enable split-horizon on this interfaces. + **disable** – disable split-horizon on this interfaces. +``` + +```{eval-rst} +.. cfgcmd:: set protocols babel interface hello-interval + + This command specifies the time in milliseconds between two scheduled hellos. + On wired links, Babel notices a link failure within two hello intervals; + on wireless links, the link quality value is reestimated at every hello + interval. + The default is 4000 ms. +``` + +```{eval-rst} +.. cfgcmd:: set protocols babel interface update-interval + + This command specifies the time in milliseconds between two scheduled updates. + Since Babel makes extensive use of triggered updates, + this can be set to fairly high values on links with little packet loss. + The default is 20000 ms. +``` + +```{eval-rst} +.. cfgcmd:: set protocols babel interface rxcost <1-65534> + + This command specifies the base receive cost for this interface. + For wireless interfaces, it specifies the multiplier used for computing + the ETX reception cost (default 256); + for wired interfaces, it specifies the cost that will be advertised to + neighbours. +``` + +```{eval-rst} +.. cfgcmd:: set protocols babel interface rtt-decay <1-256> + + This command specifies the decay factor for the exponential moving average + of RTT samples, in units of 1/256. + Higher values discard old samples faster. The default is 42. +``` + +```{eval-rst} +.. cfgcmd:: set protocols babel interface rtt-min + + This command specifies the minimum RTT, in milliseconds, + starting from which we increase the cost to a neighbour. + The additional cost is linear in (rtt - rtt-min). The default is 10 ms. +``` + +```{eval-rst} +.. cfgcmd:: set protocols babel interface rtt-max + + This command specifies the maximum RTT, in milliseconds, above which + we don't increase the cost to a neighbour. The default is 120 ms. + +``` + +```{eval-rst} +.. cfgcmd:: set protocols babel interface max-rtt-penalty + + This command specifies the maximum cost added to a neighbour because of RTT, + i.e. when the RTT is higher or equal than rtt-max. + The default is 150. + Setting it to 0 effectively disables the use of a RTT-based cost. +``` + +```{eval-rst} +.. cfgcmd:: set protocols babel interface enable-timestamps + + This command enables sending timestamps with each Hello and IHU message + in order to compute RTT values. + It is recommended to enable timestamps on tunnel interfaces. +``` + +```{eval-rst} +.. cfgcmd:: set protocols babel interface channel <1-254|interfering|noninterfering> + + This command set the channel number that diversity routing uses for this + interface (see diversity option above). + + **1-254** – interfaces with a channel number interfere with + interfering interfaces and interfaces with the same channel number. + **interfering** – interfering interfaces are assumed to interfere with all other channels except + noninterfering channels. + **noninterfering** – noninterfering interfaces are assumed to only interfere + with themselves. +``` + +## Redistribution Configuration + +```{eval-rst} +.. cfgcmd:: set protocols babel redistribute + + This command redistributes routing information from the given route source + to the Babel process. + + IPv4 route source: bgp, connected, eigrp, isis, kernel, nhrp, ospf, rip, static. + + IPv6 route source: bgp, connected, eigrp, isis, kernel, nhrp, ospfv3, ripng, static. +``` + +```{eval-rst} +.. cfgcmd:: set protocols babel distribute-list access-list + + This command can be used to filter the Babel routes using access lists. + {cfgcmd}`in` and {cfgcmd}`out` this is the direction in which the access + lists are applied. +``` + +```{eval-rst} +.. cfgcmd:: set protocols babel distribute-list interface access-list + + This command allows you apply access lists to a chosen interface to + filter the Babel routes. +``` + +```{eval-rst} +.. cfgcmd:: set protocols babel distribute-list prefix-list + + This command can be used to filter the Babel routes using prefix lists. + {cfgcmd}`in` and {cfgcmd}`out` this is the direction in which the prefix + lists are applied. +``` + +```{eval-rst} +.. cfgcmd:: set protocols babel distribute-list interface prefix-list + + This command allows you apply prefix lists to a chosen interface to + filter the Babel routes. +``` + +## Configuration Example + +Simple Babel configuration using 2 nodes and redistributing connected interfaces. + +**Node 1:** + +```none +set interfaces loopback lo address 10.1.1.1/32 +set interfaces loopback lo address fd12:3456:dead:beef::1/128 +set protocols babel interface eth0 type wired +set protocols babel redistribute ipv4 connected +set protocols babel redistribute ipv6 connected +``` + +**Node 2:** + +```none +set interfaces loopback lo address 10.2.2.2/32 +set interfaces loopback lo address fd12:3456:beef:dead::2/128 +set protocols babel interface eth0 type wired +set protocols babel redistribute ipv4 connected +set protocols babel redistribute ipv6 connected +``` diff --git a/docs/configuration/protocols/babel.rst b/docs/configuration/protocols/babel.rst deleted file mode 100644 index 07d1bc86..00000000 --- a/docs/configuration/protocols/babel.rst +++ /dev/null @@ -1,210 +0,0 @@ -.. _babel: - -##### -Babel -##### - -Babel is a modern routing protocol designed to be robust and efficient -both in ordinary wired networks and in wireless mesh networks. -By default, it uses hop-count on wired networks and a variant of ETX -on wireless links, It can be configured to take radio diversity into account -and to automatically compute a link's latency and include it in the metric. -It is defined in :rfc:`8966`. - -Babel a dual stack protocol. -A single Babel instance is able to perform routing for both IPv4 and IPv6. - -General Configuration ---------------------- - -VyOS does not have a special command to start the Babel process. -The Babel process starts when the first Babel enabled interface is configured. - -.. cfgcmd:: set protocols babel interface - - This command specifies a Babel enabled interface by interface name. Both - the sending and receiving of Babel packets will be enabled on the interface - specified in this command. - -Optional Configuration ----------------------- - -.. cfgcmd:: set protocols babel parameters diversity - - This command enables routing using radio frequency diversity. - This is highly recommended in networks with many wireless nodes. - - .. note:: If you enable this, you will probably want to - set diversity-factor and channel below. - -.. cfgcmd:: set protocols babel parameters diversity-factor <1-256> - - This command sets the multiplicative factor used for diversity routing, - in units of 1/256; lower values cause diversity to play a more important role - in route selection. - The default it 256, which means that diversity plays no role in route - selection; you will probably want to set that to 128 or less on nodes - with multiple independent radios. - -.. cfgcmd:: set protocols babel parameters resend-delay - - This command specifies the time in milliseconds after which an 'important' - request or update will be resent. The default is 2000 ms. - -.. cfgcmd:: set protocols babel parameters smoothing-half-life - - This command specifies the time constant, in seconds, of the smoothing - algorithm used for implementing hysteresis. - Larger values reduce route oscillation at the cost of very slightly increasing - convergence time. The value 0 disables hysteresis, and is suitable for wired - networks. The default is 4 s. - -Interfaces Configuration ------------------------- - -.. cfgcmd:: set protocols babel interface type - - This command sets the interface type: - - **auto** – automatically determines the interface type. - **wired** – enables optimisations for wired interfaces. - **wireless** – disables a number of optimisations that are only correct - on wired interfaces. Specifying wireless is always correct, - but may cause slower convergence and extra routing traffic. - -.. cfgcmd:: set protocols babel interface split-horizon - - This command specifies whether to perform split-horizon on the interface. - Specifying no babel split-horizon is always correct, while babel split-horizon - is an optimisation that should only be used on symmetric - and transitive (wired) networks. - - **default** – enable split-horizon on wired interfaces, and disable - split-horizon on wireless interfaces. - **enable** – enable split-horizon on this interfaces. - **disable** – disable split-horizon on this interfaces. - -.. cfgcmd:: set protocols babel interface hello-interval - - This command specifies the time in milliseconds between two scheduled hellos. - On wired links, Babel notices a link failure within two hello intervals; - on wireless links, the link quality value is reestimated at every hello - interval. - The default is 4000 ms. - -.. cfgcmd:: set protocols babel interface update-interval - - This command specifies the time in milliseconds between two scheduled updates. - Since Babel makes extensive use of triggered updates, - this can be set to fairly high values on links with little packet loss. - The default is 20000 ms. - -.. cfgcmd:: set protocols babel interface rxcost <1-65534> - - This command specifies the base receive cost for this interface. - For wireless interfaces, it specifies the multiplier used for computing - the ETX reception cost (default 256); - for wired interfaces, it specifies the cost that will be advertised to - neighbours. - -.. cfgcmd:: set protocols babel interface rtt-decay <1-256> - - This command specifies the decay factor for the exponential moving average - of RTT samples, in units of 1/256. - Higher values discard old samples faster. The default is 42. - -.. cfgcmd:: set protocols babel interface rtt-min - - This command specifies the minimum RTT, in milliseconds, - starting from which we increase the cost to a neighbour. - The additional cost is linear in (rtt - rtt-min). The default is 10 ms. - -.. cfgcmd:: set protocols babel interface rtt-max - - This command specifies the maximum RTT, in milliseconds, above which - we don't increase the cost to a neighbour. The default is 120 ms. - - -.. cfgcmd:: set protocols babel interface max-rtt-penalty - - This command specifies the maximum cost added to a neighbour because of RTT, - i.e. when the RTT is higher or equal than rtt-max. - The default is 150. - Setting it to 0 effectively disables the use of a RTT-based cost. - -.. cfgcmd:: set protocols babel interface enable-timestamps - - This command enables sending timestamps with each Hello and IHU message - in order to compute RTT values. - It is recommended to enable timestamps on tunnel interfaces. - -.. cfgcmd:: set protocols babel interface channel <1-254|interfering|noninterfering> - - This command set the channel number that diversity routing uses for this - interface (see diversity option above). - - **1-254** – interfaces with a channel number interfere with - interfering interfaces and interfaces with the same channel number. - **interfering** – interfering interfaces are assumed to interfere with all other channels except - noninterfering channels. - **noninterfering** – noninterfering interfaces are assumed to only interfere - with themselves. - -Redistribution Configuration ----------------------------- - -.. cfgcmd:: set protocols babel redistribute - - This command redistributes routing information from the given route source - to the Babel process. - - IPv4 route source: bgp, connected, eigrp, isis, kernel, nhrp, ospf, rip, static. - - IPv6 route source: bgp, connected, eigrp, isis, kernel, nhrp, ospfv3, ripng, static. - -.. cfgcmd:: set protocols babel distribute-list access-list - - This command can be used to filter the Babel routes using access lists. - :cfgcmd:`in` and :cfgcmd:`out` this is the direction in which the access - lists are applied. - -.. cfgcmd:: set protocols babel distribute-list interface access-list - - This command allows you apply access lists to a chosen interface to - filter the Babel routes. - -.. cfgcmd:: set protocols babel distribute-list prefix-list - - This command can be used to filter the Babel routes using prefix lists. - :cfgcmd:`in` and :cfgcmd:`out` this is the direction in which the prefix - lists are applied. - -.. cfgcmd:: set protocols babel distribute-list interface prefix-list - - This command allows you apply prefix lists to a chosen interface to - filter the Babel routes. - -Configuration Example ---------------------- - -Simple Babel configuration using 2 nodes and redistributing connected interfaces. - -**Node 1:** - -.. code-block:: none - - set interfaces loopback lo address 10.1.1.1/32 - set interfaces loopback lo address fd12:3456:dead:beef::1/128 - set protocols babel interface eth0 type wired - set protocols babel redistribute ipv4 connected - set protocols babel redistribute ipv6 connected - -**Node 2:** - -.. code-block:: none - - set interfaces loopback lo address 10.2.2.2/32 - set interfaces loopback lo address fd12:3456:beef:dead::2/128 - set protocols babel interface eth0 type wired - set protocols babel redistribute ipv4 connected - set protocols babel redistribute ipv6 connected diff --git a/docs/configuration/protocols/bfd.md b/docs/configuration/protocols/bfd.md new file mode 100644 index 00000000..13623e03 --- /dev/null +++ b/docs/configuration/protocols/bfd.md @@ -0,0 +1,205 @@ +--- +lastproofread: '2023-01-27' +--- + +```{include} /_include/need_improvement.txt +``` + +(routing-bfd)= + +# BFD + +{abbr}`BFD (Bidirectional Forwarding Detection)` is described and extended by +the following RFCs: {rfc}`5880`, {rfc}`5881` and {rfc}`5883`. + +In the age of very fast networks, a second of unreachability may equal millions of lost packets. +The idea behind BFD is to detect very quickly when a peer is down and take action extremely fast. + +BFD sends lots of small UDP packets very quickly to ensures that the peer is still alive. + +This allows avoiding the timers defined in BGP and OSPF protocol to expires. + +## Configure BFD + +```{cfgcmd} set protocols bfd peer \ + +Set BFD peer IPv4 address or IPv6 address +``` + +```{cfgcmd} set protocols bfd peer \ echo-mode + +Enables the echo transmission mode +``` + +```{cfgcmd} set protocols bfd peer \ multihop + +Allow this BFD peer to not be directly connected +``` + +```{cfgcmd} set protocols bfd peer \ source [address \ | interface \] + +Bind listener to specific interface/address, mandatory for IPv6 +``` + +```{cfgcmd} set protocols bfd peer \ interval echo-interval \<10-60000\> + +The minimal echo receive transmission interval that this system is +capable of handling +``` + +```{cfgcmd} set protocols bfd peer \ interval multiplier \<2-255\> + +Remote transmission interval will be multiplied by this value +``` + +```{cfgcmd} set protocols bfd peer \ interval [receive | transmit] \<10-60000\> + +Interval in milliseconds +``` + +```{cfgcmd} set protocols bfd peer \ shutdown + +Disable a BFD peer +``` + +```{cfgcmd} set protocols bfd peer \ minimum-ttl \<1-254\> + +For multi hop sessions only. Configure the minimum expected TTL for an +incoming BFD control packet. + +This feature serves the purpose of thightening the packet validation +requirements to avoid receiving BFD control packets from other sessions. +``` + +### Enable BFD in BGP + +```{cfgcmd} set protocols bgp neighbor \ bfd + +Enable BFD on a single BGP neighbor +``` + +```{cfgcmd} set protocols bgp peer-group \ bfd + +Enable BFD on a BGP peer group +``` + +### Enable BFD in OSPF + +```{cfgcmd} set protocols ospf interface \ bfd + + Enable BFD for OSPF on an interface + +``` + +```{cfgcmd} set protocols ospfv3 interface \ bfd + +Enable BFD for OSPFv3 on an interface +``` + +### Enable BFD in ISIS + +```{cfgcmd} set protocols isis \ interface \ bfd + +Enable BFD for ISIS on an interface + +``` + +## Operational Commands + +```{opcmd} show bfd peers + + Show all BFD peers + + :::{code-block} none + BFD Peers: + peer 198.51.100.33 vrf default interface eth4.100 + ID: 4182341893 + Remote ID: 12678929647 + Status: up + Uptime: 1 month(s), 16 hour(s), 29 minute(s), 38 second(s) + Diagnostics: ok + Remote diagnostics: ok + Local timers: + Receive interval: 300ms + Transmission interval: 300ms + Echo transmission interval: 50ms + Remote timers: + Receive interval: 300ms + Transmission interval: 300ms + Echo transmission interval: 0ms + + peer 198.51.100.55 vrf default interface eth4.101 + ID: 4618932327 + Remote ID: 3312345688 + Status: up + Uptime: 20 hour(s), 16 minute(s), 19 second(s) + Diagnostics: ok + Remote diagnostics: ok + Local timers: + Receive interval: 300ms + Transmission interval: 300ms + Echo transmission interval: 50ms + Remote timers: + Receive interval: 300ms + Transmission interval: 300ms + Echo transmission interval: 0ms + ::: +``` + +## BFD Static Route Monitoring + + +A monitored static route conditions the installation to the RIB on the BFD +session running state: when BFD session is up the route is installed to RIB, +but when the BFD session is down it is removed from the RIB. + + +### Configuration + +```{cfgcmd} set protocols static route \ next-hop \ bfd profile \ + +Configure a static route for \ using gateway \ +and use the gateway address as BFD peer destination address. +``` + +```{cfgcmd} set protocols static route \ next-hop \ bfd multi-hop source \ profile \ + +Configure a static route for \ using gateway \, +use source address to identify the peer when is multi-hop session +and the gateway address as BFD peer destination address. +``` + +```{cfgcmd} set protocols static route6 \ next-hop \ bfd profile \ + +Configure a static route for \ using gateway \ +and use the gateway address as BFD peer destination address. +``` + +```{cfgcmd} set protocols static route6 \ next-hop \ bfd multi-hop source \ profile \ + +Configure a static route for \ using gateway \, +use source address to identify the peer when is multi-hop session +and the gateway address as BFD peer destination address. +``` + +(bfd-operational-commands)= + +## Operational Commands + +```{opcmd} show bfd static routes + +Showing BFD monitored static routes + +:::{code-block} none +Showing BFD monitored static routes: + + Next hops: + VRF default IPv4 Unicast: + 10.10.13.3/32 peer 192.168.2.3 (status: installed) + 172.16.10.3/32 peer 192.168.10.1 (status: uninstalled) + + VRF default IPv4 Multicast: + + VRF default IPv6 Unicast: +::: +``` \ No newline at end of file diff --git a/docs/configuration/protocols/bfd.rst b/docs/configuration/protocols/bfd.rst deleted file mode 100644 index 30876efc..00000000 --- a/docs/configuration/protocols/bfd.rst +++ /dev/null @@ -1,199 +0,0 @@ -:lastproofread: 2023-01-27 - -.. include:: /_include/need_improvement.txt - -.. _routing-bfd: - -### -BFD -### - -:abbr:`BFD (Bidirectional Forwarding Detection)` is described and extended by -the following RFCs: :rfc:`5880`, :rfc:`5881` and :rfc:`5883`. - -In the age of very fast networks, a second of unreachability may equal millions of lost packets. -The idea behind BFD is to detect very quickly when a peer is down and take action extremely fast. - -BFD sends lots of small UDP packets very quickly to ensures that the peer is still alive. - -This allows avoiding the timers defined in BGP and OSPF protocol to expires. - -Configure BFD -============= - -.. cfgcmd:: set protocols bfd peer
- - Set BFD peer IPv4 address or IPv6 address - -.. cfgcmd:: set protocols bfd peer
echo-mode - - Enables the echo transmission mode - -.. cfgcmd:: set protocols bfd peer
multihop - - Allow this BFD peer to not be directly connected - -.. cfgcmd:: set protocols bfd peer
source - [address
| interface ] - - Bind listener to specific interface/address, mandatory for IPv6 - -.. cfgcmd:: set protocols bfd peer
interval echo-interval <10-60000> - - The minimal echo receive transmission interval that this system is - capable of handling - -.. cfgcmd:: set protocols bfd peer
interval multiplier <2-255> - - Remote transmission interval will be multiplied by this value - -.. cfgcmd:: set protocols bfd peer
interval - [receive | transmit] <10-60000> - - Interval in milliseconds - -.. cfgcmd:: set protocols bfd peer
shutdown - - Disable a BFD peer - -.. cfgcmd:: set protocols bfd peer
minimum-ttl <1-254> - - For multi hop sessions only. Configure the minimum expected TTL for an - incoming BFD control packet. - - This feature serves the purpose of thightening the packet validation - requirements to avoid receiving BFD control packets from other sessions. - -Enable BFD in BGP ------------------ - -.. cfgcmd:: set protocols bgp neighbor bfd - - Enable BFD on a single BGP neighbor - -.. cfgcmd:: set protocols bgp peer-group bfd - - Enable BFD on a BGP peer group - - -Enable BFD in OSPF ------------------- - -.. cfgcmd:: set protocols ospf interface bfd - - Enable BFD for OSPF on an interface - -.. cfgcmd:: set protocols ospfv3 interface bfd - - Enable BFD for OSPFv3 on an interface - - -Enable BFD in ISIS ------------------- - -.. cfgcmd:: set protocols isis interface bfd - - Enable BFD for ISIS on an interface - - - -Operational Commands -==================== - -.. opcmd:: show bfd peers - - Show all BFD peers - - .. code-block:: none - - BFD Peers: - peer 198.51.100.33 vrf default interface eth4.100 - ID: 4182341893 - Remote ID: 12678929647 - Status: up - Uptime: 1 month(s), 16 hour(s), 29 minute(s), 38 second(s) - Diagnostics: ok - Remote diagnostics: ok - Local timers: - Receive interval: 300ms - Transmission interval: 300ms - Echo transmission interval: 50ms - Remote timers: - Receive interval: 300ms - Transmission interval: 300ms - Echo transmission interval: 0ms - - peer 198.51.100.55 vrf default interface eth4.101 - ID: 4618932327 - Remote ID: 3312345688 - Status: up - Uptime: 20 hour(s), 16 minute(s), 19 second(s) - Diagnostics: ok - Remote diagnostics: ok - Local timers: - Receive interval: 300ms - Transmission interval: 300ms - Echo transmission interval: 50ms - Remote timers: - Receive interval: 300ms - Transmission interval: 300ms - Echo transmission interval: 0ms - -BFD Static Route Monitoring -=========================== - -A monitored static route conditions the installation to the RIB on the BFD -session running state: when BFD session is up the route is installed to RIB, -but when the BFD session is down it is removed from the RIB. - -Configuration -------------- - -.. cfgcmd:: set protocols static route next-hop
- bfd profile - - Configure a static route for using gateway
- and use the gateway address as BFD peer destination address. - -.. cfgcmd:: set protocols static route next-hop
- bfd multi-hop source
profile - - Configure a static route for using gateway
- , use source address to indentify the peer when is multi-hop session - and the gateway address as BFD peer destination address. - -.. cfgcmd:: set protocols static route6 next-hop
- bfd profile - - Configure a static route for using gateway
- and use the gateway address as BFD peer destination address. - -.. cfgcmd:: set protocols static route6 next-hop
- bfd multi-hop source
profile - - Configure a static route for using gateway
- , use source address to indentify the peer when is multi-hop session - and the gateway address as BFD peer destination address. - - -.. _BFD Operational Commands: - -Operational Commands -==================== - -.. opcmd:: show bfd static routes - - Showing BFD monitored static routes - - .. code-block:: none - - Showing BFD monitored static routes: - - Next hops: - VRF default IPv4 Unicast: - 10.10.13.3/32 peer 192.168.2.3 (status: installed) - 172.16.10.3/32 peer 192.168.10.1 (status: uninstalled) - - VRF default IPv4 Multicast: - - VRF default IPv6 Unicast: diff --git a/docs/configuration/protocols/bgp.md b/docs/configuration/protocols/bgp.md new file mode 100644 index 00000000..c8f77a6a --- /dev/null +++ b/docs/configuration/protocols/bgp.md @@ -0,0 +1,1435 @@ +(routing-bgp)= + +# BGP + +{abbr}`BGP (Border Gateway Protocol)` is one of the Exterior Gateway Protocols +and the de facto standard interdomain routing protocol. The latest BGP version +is 4. BGP-4 is described in {rfc}`1771` and updated by {rfc}`4271`. {rfc}`2858` +adds multiprotocol support to BGP. + +VyOS makes use of {abbr}`FRR (Free Range Routing)` and we would like to thank +them for their effort! + +## Basic Concepts + +(bgp-autonomous-systems)= + +### Autonomous Systems + +From {rfc}`1930`: + +> An AS is a connected group of one or more IP prefixes run by one or more +> network operators which has a SINGLE and CLEARLY DEFINED routing policy. + +Each {abbr}`AS (Autonomous System)` has an identifying number associated with it +called an {abbr}`ASN (Autonomous System Number)`. This is a two octet value +ranging in value from 1 to 65535. The AS numbers 64512 through 65535 are defined +as private AS numbers. Private AS numbers must not be advertised on the global +Internet. The 2-byte AS number range has been exhausted. 4-byte AS numbers are +specified in {rfc}`6793`, and provide a pool of 4294967296 AS numbers. + +The {abbr}`ASN (Autonomous System Number)` is one of the essential elements of +BGP. BGP is a distance vector routing protocol, and the AS-Path framework +provides distance vector metric and loop detection to BGP. + +```{eval-rst} +.. cfgcmd:: set protocols bgp system-as + + Set local {abbr}`ASN (Autonomous System Number)` that this router represents. + This is a a mandatory option! +``` + +(bgp-address-families)= + +### Address Families + +Multiprotocol extensions enable BGP to carry routing information for multiple +network layer protocols. BGP supports an Address Family Identifier (AFI) for +IPv4 and IPv6. + +(bgp-route-selection)= + +### Route Selection + +The route selection process used by FRR's BGP implementation uses the following +decision criterion, starting at the top of the list and going towards the +bottom until one of the factors can be used. + +01. **Weight check** + + Prefer higher local weight routes to lower routes. + +02. **Local preference check** + + Prefer higher local preference routes to lower. + +03. **Local route check** + + Prefer local routes (statics, aggregates, redistributed) to received routes. + +04. **AS path length check** + + Prefer shortest hop-count AS_PATHs. + +05. **Origin check** + + Prefer the lowest origin type route. That is, prefer IGP origin routes to + EGP, to Incomplete routes. + +06. **MED check** + + Where routes with a MED were received from the same AS, prefer the route + with the lowest MED. + +07. **External check** + + Prefer the route received from an external, eBGP peer over routes received + from other types of peers. + +08. **IGP cost check** + + Prefer the route with the lower IGP cost. + +09. **Multi-path check** + + If multi-pathing is enabled, then check whether the routes not yet + distinguished in preference may be considered equal. If + {cfgcmd}`bgp bestpath as-path multipath-relax` is set, all such routes are + considered equal, otherwise routes received via iBGP with identical AS_PATHs + or routes received from eBGP neighbours in the same AS are considered equal. + +10. **Already-selected external check** + + Where both routes were received from eBGP peers, then prefer the route + which is already selected. Note that this check is not applied if + {cfgcmd}`bgp bestpath compare-routerid` is configured. This check can + prevent some cases of oscillation. + +11. **Router-ID check** + + Prefer the route with the lowest `router-ID`. If the route has an + `ORIGINATOR_ID` attribute, through iBGP reflection, then that router ID is + used, otherwise the `router-ID` of the peer the route was received from is + used. + +12. **Cluster-List length check** + + The route with the shortest cluster-list length is used. The cluster-list + reflects the iBGP reflection path the route has taken. + +13. **Peer address** + + Prefer the route received from the peer with the higher transport layer + address, as a last-resort tie-breaker. + +(bgp-capability-negotiation)= + +### Capability Negotiation + +When adding IPv6 routing information exchange feature to BGP. There were some +proposals. {abbr}`IETF (Internet Engineering Task Force)` +{abbr}`IDR (Inter Domain Routing)` adopted a proposal called Multiprotocol +Extension for BGP. The specification is described in {rfc}`2283`. The protocol +does not define new protocols. It defines new attributes to existing BGP. When +it is used exchanging IPv6 routing information it is called BGP-4+. When it is +used for exchanging multicast routing information it is called MBGP. + +*bgpd* supports Multiprotocol Extension for BGP. So if a remote peer supports +the protocol, *bgpd* can exchange IPv6 and/or multicast routing information. + +Traditional BGP did not have the feature to detect a remote peer's +capabilities, e.g. whether it can handle prefix types other than IPv4 unicast +routes. This was a big problem using Multiprotocol Extension for BGP in an +operational network. {rfc}`2842` adopted a feature called Capability +Negotiation. *bgpd* use this Capability Negotiation to detect the remote peer's +capabilities. If a peer is only configured as an IPv4 unicast neighbor, *bgpd* +does not send these Capability Negotiation packets (at least not unless other +optional BGP features require capability negotiation). + +By default, FRR will bring up peering with minimal common capability for the +both sides. For example, if the local router has unicast and multicast +capabilities and the remote router only has unicast capability the local router +will establish the connection with unicast only capability. When there are no +common capabilities, FRR sends Unsupported Capability error and then resets the +connection. + +## Configuration + +(bgp-router-configuration)= + +### BGP Router Configuration + +First of all you must configure BGP router with the {abbr}`ASN (Autonomous +System Number)`. The AS number is an identifier for the autonomous system. +The BGP protocol uses the AS number for detecting whether the BGP connection +is internal or external. VyOS does not have a special command to start the BGP +process. The BGP process starts when the first neighbor is configured. + +```{eval-rst} +.. cfgcmd:: set protocols bgp system-as + + Set local autonomous system number that this router represents. This is a + mandatory option! +``` + +#### Peers Configuration + +##### Defining Peers + +```{eval-rst} +.. cfgcmd:: set protocols bgp neighbor remote-as + + + This command creates a new neighbor whose remote-as is . The neighbor + address can be an IPv4 address or an IPv6 address or an interface to use + for the connection. The command is applicable for peer and peer group. +``` + +```{eval-rst} +.. cfgcmd:: set protocols bgp neighbor remote-as + internal + + Create a peer as you would when you specify an ASN, except that if the + peers ASN is different than mine as specified under the {cfgcmd}`protocols + bgp ` command the connection will be denied. +``` + +```{eval-rst} +.. cfgcmd:: set protocols bgp neighbor remote-as + external + + Create a peer as you would when you specify an ASN, except that if the + peers ASN is the same as mine as specified under the {cfgcmd}`protocols + bgp ` command the connection will be denied. +``` + +```{eval-rst} +.. cfgcmd:: set protocols bgp neighbor local-role + [strict] + + BGP roles are defined in RFC {rfc}`9234` and provide an easy way to + add route leak prevention, detection and mitigation. The local Role + value is negotiated with the new BGP Role capability which has a + built-in check of the corresponding value. In case of a mismatch the + new OPEN Roles Mismatch Notification <2, 11> would be sent. + The correct Role pairs are: + + Provider - Customer + + Peer - Peer + + RS-Server - RS-Client + + If {cfgcmd}`strict` is set the BGP session won’t become established + until the BGP neighbor sets local Role on its side. This + configuration parameter is defined in RFC {rfc}`9234` and is used to + enforce the corresponding configuration at your counter-parts side. + + Routes that are sent from provider, rs-server, or the peer local-role + (or if received by customer, rs-client, or the peer local-role) will + be marked with a new Only to Customer (OTC) attribute. + + Routes with this attribute can only be sent to your neighbor if your + local-role is provider or rs-server. Routes with this attribute can + be received only if your local-role is customer or rs-client. + + In case of peer-peer relationship routes can be received only if OTC + value is equal to your neighbor AS number. + + All these rules with OTC will help to detect and mitigate route leaks + and happen automatically if local-role is set. +``` + +```{eval-rst} +.. cfgcmd:: set protocols bgp neighbor shutdown + + This command disable the peer or peer group. To reenable the peer use + the delete form of this command. +``` + +```{eval-rst} +.. cfgcmd:: set protocols bgp neighbor description + + + Set description of the peer or peer group. +``` + +```{eval-rst} +.. cfgcmd:: set protocols bgp neighbor update-source + + + Specify the IPv4 source address to use for the BGP session to this neighbor, + may be specified as either an IPv4 address directly or as an interface name. +``` + +(bgp-capability-negotiation-1)= + +##### Capability Negotiation + +```{eval-rst} +.. cfgcmd:: set protocols bgp neighbor capability + dynamic + + This command would allow the dynamic update of capabilities over an + established BGP session. +``` + +```{eval-rst} +.. cfgcmd:: set protocols bgp neighbor capability + extended-nexthop + + Allow bgp to negotiate the extended-nexthop capability with it’s peer. + If you are peering over a IPv6 Link-Local address then this capability + is turned on automatically. If you are peering over a IPv6 Global Address + then turning on this command will allow BGP to install IPv4 routes with + IPv6 nexthops if you do not have IPv4 configured on interfaces. +``` + +```{eval-rst} +.. cfgcmd:: set protocols bgp neighbor + disable-capability-negotiation + + Suppress sending Capability Negotiation as OPEN message optional + parameter to the peer. This command only affects the peer is + configured other than IPv4 unicast configuration. + + When remote peer does not have capability negotiation feature, + remote peer will not send any capabilities at all. In that case, + bgp configures the peer with configured capabilities. + + You may prefer locally configured capabilities more than the negotiated + capabilities even though remote peer sends capabilities. If the peer is + configured by {cfgcmd}`override-capability`, VyOS ignores received + capabilities then override negotiated capabilities with configured values. + + Additionally you should keep in mind that this feature fundamentally + disables the ability to use widely deployed BGP features. BGP unnumbered, + hostname support, AS4, Addpath, Route Refresh, ORF, Dynamic Capabilities, + and graceful restart. +``` + +```{eval-rst} +.. cfgcmd:: set protocols bgp neighbor + override-capability + + This command allow override the result of Capability Negotiation with + local configuration. Ignore remote peer’s capability value. +``` + +```{eval-rst} +.. cfgcmd:: set protocols bgp neighbor + strict-capability-match + + This command forces strictly compare remote capabilities and local + capabilities. If capabilities are different, send Unsupported Capability + error then reset connection. + + You may want to disable sending Capability Negotiation OPEN message + optional parameter to the peer when remote peer does not implement + Capability Negotiation. Please use {cfgcmd}`disable-capability-negotiation` + command to disable the feature. + +``` + +##### Peer Parameters + +```{eval-rst} +.. cfgcmd:: set protocols bgp neighbor address-family + allowas-in number + + This command accept incoming routes with AS path containing AS + number with the same value as the current system AS. This is + used when you want to use the same AS number in your sites, + but you can’t connect them directly. + + The number parameter (1-10) configures the amount of accepted + occurences of the system AS number in AS path. + + This command is only allowed for eBGP peers. It is not applicable + for peer groups. +``` + +```{eval-rst} +.. cfgcmd:: set protocols bgp neighbor address-family + as-override + + This command override AS number of the originating router with + the local AS number. + + Usually this configuration is used in PEs (Provider Edge) to + replace the incoming customer AS number so the connected CE ( + Customer Edge) can use the same AS number as the other customer + sites. This allows customers of the provider network to use the + same AS number across their sites. + + This command is only allowed for eBGP peers. +``` + +```{eval-rst} +.. cfgcmd:: set protocols bgp neighbor address-family + attribute-unchanged + + This command specifies attributes to be left unchanged for + advertisements sent to a peer or peer group. +``` + +```{eval-rst} +.. cfgcmd:: set protocols bgp neighbor address-family + maximum-prefix + + This command specifies a maximum number of prefixes we can receive + from a given peer. If this number is exceeded, the BGP session + will be destroyed. The number range is 1 to 4294967295. +``` + +```{eval-rst} +.. cfgcmd:: set protocols bgp neighbor address-family + nexthop-self + + This command forces the BGP speaker to report itself as the + next hop for an advertised route it advertised to a neighbor. +``` + +```{eval-rst} +.. cfgcmd:: set protocols bgp neighbor address-family + remove-private-as + + This command removes the private ASN of routes that are advertised + to the configured peer. It removes only private ASNs on routes + advertised to EBGP peers. + + If the AS-Path for the route has only private ASNs, the private + ASNs are removed. + + If the AS-Path for the route has a private ASN between public + ASNs, it is assumed that this is a design choice, and the + private ASN is not removed. +``` + +```{eval-rst} +.. cfgcmd:: set protocols bgp neighbor address-family + soft-reconfiguration inbound + + Changes in BGP policies require the BGP session to be cleared. Clearing has a + large negative impact on network operations. Soft reconfiguration enables you + to generate inbound updates from a neighbor, change and activate BGP policies + without clearing the BGP session. + + This command specifies that route updates received from this neighbor will be + stored unmodified, regardless of the inbound policy. When inbound soft + reconfiguration is enabled, the stored updates are processed by the new + policy configuration to create new inbound updates. + + .. note:: Storage of route updates uses memory. If you enable soft + reconfiguration inbound for multiple neighbors, the amount of memory used + can become significant. +``` + +```{eval-rst} +.. cfgcmd:: set protocols bgp neighbor address-family + weight + + This command specifies a default weight value for the neighbor’s + routes. The number range is 1 to 65535. +``` + +```{eval-rst} +.. cfgcmd:: set protocols bgp neighbor + advertisement-interval + + This command specifies the minimum route advertisement interval for + the peer. The interval value is 0 to 600 seconds, with the default + advertisement interval being 0. +``` + +```{eval-rst} +.. cfgcmd:: set protocols bgp neighbor + disable-connected-check + + This command allows peerings between directly connected eBGP peers + using loopback addresses without adjusting the default TTL of 1. +``` + +```{eval-rst} +.. cfgcmd:: set protocols bgp neighbor + disable-send-community + + This command specifies that the community attribute should not be sent + in route updates to a peer. By default community attribute is sent. +``` + +```{eval-rst} +.. cfgcmd:: set protocols bgp neighbor ebgp-multihop + + + This command allows sessions to be established with eBGP neighbors + when they are multiple hops away. When the neighbor is not directly + connected and this knob is not enabled, the session will not establish. + The number of hops range is 1 to 255. This command is mutually + exclusive with {cfgcmd}`ttl-security hops`. +``` + +```{eval-rst} +.. cfgcmd:: set protocols bgp neighbor local-as + [no-prepend] [replace-as] + + Specify an alternate AS for this BGP process when interacting with + the specified peer or peer group. With no modifiers, the specified + local-as is prepended to the received AS_PATH when receiving routing + updates from the peer, and prepended to the outgoing AS_PATH (after + the process local AS) when transmitting local routes to the peer. + + If the {cfgcmd}`no-prepend` attribute is specified, then the supplied + local-as is not prepended to the received AS_PATH. + + If the {cfgcmd}`replace-as` attribute is specified, then only the supplied + local-as is prepended to the AS_PATH when transmitting local-route + updates to this peer. + + .. note:: This command is only allowed for eBGP peers. +``` + +```{eval-rst} +.. cfgcmd:: set protocols bgp neighbor passive + + Configures the BGP speaker so that it only accepts inbound connections + from, but does not initiate outbound connections to the peer or peer group. +``` + +```{eval-rst} +.. cfgcmd:: set protocols bgp neighbor password + + + This command specifies a MD5 password to be used with the tcp socket that + is being used to connect to the remote peer. +``` + +```{eval-rst} +.. cfgcmd:: set protocols bgp neighbor ttl-security + hops + + This command enforces Generalized TTL Security Mechanism (GTSM), + as specified in {rfc}`5082`. With this command, only neighbors + that are specified number of hops away will be allowed to + become neighbors. The number of hops range is 1 to 254. This + command is mutually exclusive with {cfgcmd}`ebgp-multihop`. + +``` + +##### Peer Groups + +Peer groups are used to help improve scaling by generating the same update +information to all members of a peer group. Note that this means that the +routes generated by a member of a peer group will be sent back to that +originating peer with the originator identifier attribute set to indicated +the originating peer. All peers not associated with a specific peer group +are treated as belonging to a default peer group, and will share updates. + +```{eval-rst} +.. cfgcmd:: set protocols bgp peer-group + + This command defines a new peer group. You can specify to the group the same + parameters that you can specify for specific neighbors. + + .. note:: If you apply a parameter to an individual neighbor IP address, you + override the action defined for a peer group that includes that IP + address. +``` + +```{eval-rst} +.. cfgcmd:: set protocols bgp neighbor peer-group + + + This command bind specific peer to peer group with a given name. + +``` + +#### Network Advertisement Configuration + +```{eval-rst} +.. cfgcmd:: set protocols bgp address-family + network + + This command is used for advertising IPv4 or IPv6 networks. + + .. note:: By default, the BGP prefix is advertised even if it's not present + in the routing table. This behaviour differs from the implementation of + some vendors. +``` + +```{eval-rst} +.. cfgcmd:: set protocols bgp parameters network-import-check + + This configuration modifies the behavior of the network statement. If you + have this configured the underlying network must exist in the routing table. +``` + +```{eval-rst} +.. cfgcmd:: set protocols bgp neighbor address-family + default-originate [route-map ] + + By default, VyOS does not advertise a default route (0.0.0.0/0) even if it is + in routing table. When you want to announce default routes to the peer, use + this command. Using optional argument {cfgcmd}`route-map` you can inject the + default route to given neighbor only if the conditions in the route map are + met. + +``` + +#### Route Aggregation Configuration + +```{eval-rst} +.. cfgcmd:: set protocols bgp address-family + aggregate-address + + This command specifies an aggregate address. The router will also + announce longer-prefixes inside of the aggregate address. +``` + +```{eval-rst} +.. cfgcmd:: set protocols bgp address-family + aggregate-address as-set + + This command specifies an aggregate address with a mathematical set of + autonomous systems. This command summarizes the AS_PATH attributes of + all the individual routes. +``` + +```{eval-rst} +.. cfgcmd:: set protocols bgp address-family + aggregate-address summary-only + + This command specifies an aggregate address and provides that + longer-prefixes inside of the aggregate address are suppressed + before sending BGP updates out to peers. +``` + +```{eval-rst} +.. cfgcmd:: set protocols bgp neighbor address-family + unsuppress-map + + This command applies route-map to selectively unsuppress prefixes + suppressed by summarisation. + +``` + +#### Redistribution Configuration + +```{eval-rst} +.. cfgcmd:: set protocols bgp address-family + redistribute + + This command redistributes routing information from the given route source + to the BGP process. There are six modes available for route source: + connected, kernel, ospf, rip, static, table. +``` + +```{eval-rst} +.. cfgcmd:: set protocols bgp address-family + redistribute metric + + This command specifies metric (MED) for redistributed routes. The + metric range is 0 to 4294967295. There are six modes available for + route source: connected, kernel, ospf, rip, static, table. +``` + +```{eval-rst} +.. cfgcmd:: set protocols bgp address-family + redistribute route-map + + This command allows to use route map to filter redistributed routes. + There are six modes available for route source: connected, kernel, + ospf, rip, static, table. + +``` + +#### General Configuration + +##### Common parameters + +```{eval-rst} +.. cfgcmd:: set protocols bgp parameters allow-martian-nexthop + + When a peer receives a martian nexthop as part of the NLRI for a route + permit the nexthop to be used as such, instead of rejecting and resetting + the connection. +``` + +```{eval-rst} +.. cfgcmd:: set protocols bgp parameters router-id + + This command specifies the router-ID. If router ID is not specified it will + use the highest interface IP address. +``` + +```{eval-rst} +.. cfgcmd:: set protocols bgp address-family + maximum-paths + + This command defines the maximum number of parallel routes that + the BGP can support. In order for BGP to use the second path, the + following attributes have to match: Weight, Local Preference, AS + Path (both AS number and AS path length), Origin code, MED, IGP + metric. Also, the next hop address for each path must be different. +``` + +```{eval-rst} +.. cfgcmd:: set protocols bgp parameters no-hard-administrative-reset + + Do not send Hard Reset CEASE Notification for "Administrative Reset" + events. When set and Graceful Restart Notification capability is exchanged + between the peers, Graceful Restart procedures apply, and routes will be retained. +``` + +```{eval-rst} +.. cfgcmd:: set protocols bgp parameters log-neighbor-changes + + This command enable logging neighbor up/down changes and reset reason. +``` + +```{eval-rst} +.. cfgcmd:: set protocols bgp parameters no-client-to-client-reflection + + This command disables route reflection between route reflector clients. + By default, the clients of a route reflector are not required to be + fully meshed and the routes from a client are reflected to other clients. + However, if the clients are fully meshed, route reflection is not required. + In this case, use the {cfgcmd}`no-client-to-client-reflection` command + to disable client-to-client reflection. +``` + +```{eval-rst} +.. cfgcmd:: set protocols bgp parameters no-fast-external-failover + + Disable immediate session reset if peer's connected link goes down. +``` + +```{eval-rst} +.. cfgcmd:: set protocols bgp parameters no-ipv6-auto-ra + + By default, FRR sends router advertisement packets when Extended Next Hop is + on or when a connection is established directly using the device name (Unnumbered BGP). + Setting this option prevents FRR from sending router advertisement packets, but could break Unnumbered BGP. +``` + +```{eval-rst} +.. cfgcmd:: set protocols bgp listen range peer-group + + This command is useful if one desires to loosen the requirement for BGP + to have strictly defined neighbors. Specifically what is allowed is for + the local router to listen to a range of IPv4 or IPv6 addresses defined + by a prefix and to accept BGP open messages. When a TCP connection + (and subsequently a BGP open message) from within this range tries to + connect the local router then the local router will respond and connect + with the parameters that are defined within the peer group. One must define + a peer-group for each range that is listed. If no peer-group is defined + then an error will keep you from committing the configuration. +``` + +```{eval-rst} +.. cfgcmd:: set protocols bgp listen limit + + This command goes hand in hand with the listen range command to limit the + amount of BGP neighbors that are allowed to connect to the local router. + The limit range is 1 to 5000. +``` + +```{eval-rst} +.. cfgcmd:: set protocols bgp parameters ebgp-requires-policy + + This command changes the eBGP behavior of FRR. By default FRR enables + {rfc}`8212` functionality which affects how eBGP routes are advertised, + namely no routes are advertised across eBGP sessions without some + sort of egress route-map/policy in place. In VyOS however we have this + RFC functionality disabled by default so that we can preserve backwards + compatibility with older versions of VyOS. With this option one can + enable {rfc}`8212` functionality to operate. +``` + +```{eval-rst} +.. cfgcmd:: set protocols bgp parameters labeled-unicast + + By default, locally advertised prefixes use the implicit-null label to + encode in the outgoing NLRI. + + The following command uses the explicit-null label value for all the + BGP instances. + +``` + +##### Administrative Distance + +```{eval-rst} +.. cfgcmd:: set protocols bgp parameters distance global + + + This command change distance value of BGP. The arguments are the distance + values for external routes, internal routes and local routes respectively. + The distance range is 1 to 255. +``` + +```{eval-rst} +.. cfgcmd:: set protocols bgp parameters distance prefix + distance + + This command sets the administrative distance for a particular route. The + distance range is 1 to 255. + + .. note:: Routes with a distance of 255 are effectively disabled and not + installed into the kernel. + +``` + +##### Timers + +```{eval-rst} +.. cfgcmd:: set protocols bgp timers holdtime + + This command specifies hold-time in seconds. The timer range is + 4 to 65535. The default value is 180 second. If you set value to 0 + VyOS will not hold routes. +``` + +```{eval-rst} +.. cfgcmd:: set protocols bgp timers keepalive + + This command specifies keep-alive time in seconds. The timer + can range from 4 to 65535. The default value is 60 second. + +``` + +##### Route Dampening + +When a route fails, a routing update is sent to withdraw the route from the +network's routing tables. When the route is re-enabled, the change in +availability is also advertised. A route that continually fails and returns +requires a great deal of network traffic to update the network about the +route's status. + +Route dampening wich described in {rfc}`2439` enables you to identify routes +that repeatedly fail and return. If route dampening is enabled, an unstable +route accumulates penalties each time the route fails and returns. If the +accumulated penalties exceed a threshold, the route is no longer advertised. +This is route suppression. Routes that have been suppressed are re-entered +into the routing table only when the amount of their penalty falls below a +threshold. + +A penalty of 1000 is assessed each time the route fails. When the penalties +reach a predefined threshold (suppress-value), the router stops advertising +the route. + +Once a route is assessed a penalty, the penalty is decreased by half each time +a predefined amount of time elapses (half-life-time). When the accumulated +penalties fall below a predefined threshold (reuse-value), the route is +unsuppressed and added back into the BGP routing table. + +No route is suppressed indefinitely. Maximum-suppress-time defines the maximum +time a route can be suppressed before it is re-advertised. + +```{eval-rst} +.. cfgcmd:: set protocols bgp parameters dampening + half-life + + This command defines the amount of time in minutes after + which a penalty is reduced by half. The timer range is + 10 to 45 minutes. +``` + +```{eval-rst} +.. cfgcmd:: set protocols bgp parameters dampening + re-use + + This command defines the accumulated penalty amount at which the + route is re-advertised. The penalty range is 1 to 20000. +``` + +```{eval-rst} +.. cfgcmd:: set protocols bgp parameters dampening + start-suppress-time + + This command defines the accumulated penalty amount at which the + route is suppressed. The penalty range is 1 to 20000. +``` + +```{eval-rst} +.. cfgcmd:: set protocols bgp parameters dampening + max-suppress-time + + This command defines the maximum time in minutes that a route is + suppressed. The timer range is 1 to 255 minutes. + +``` + +#### Route Selection Configuration + +```{eval-rst} +.. cfgcmd:: set protocols bgp parameters always-compare-med + + This command provides to compare the MED on routes, even when they were + received from different neighbouring ASes. Setting this option makes the + order of preference of routes more defined, and should eliminate MED + induced oscillations. +``` + +```{eval-rst} +.. cfgcmd:: set protocols bgp parameters bestpath as-path confed + + This command specifies that the length of confederation path sets and + sequences should be taken into account during the BGP best path + decision process. +``` + +```{eval-rst} +.. cfgcmd:: set protocols bgp parameters bestpath as-path multipath-relax + + This command specifies that BGP decision process should consider paths + of equal AS_PATH length candidates for multipath computation. Without + the knob, the entire AS_PATH must match for multipath computation. +``` + +```{eval-rst} +.. cfgcmd:: set protocols bgp parameters bestpath as-path ignore + + Ignore AS_PATH length when selecting a route +``` + +```{eval-rst} +.. cfgcmd:: set protocols bgp parameters bestpath compare-routerid + + Ensure that when comparing routes where both are equal on most metrics, + including local-pref, AS_PATH length, IGP cost, MED, that the tie is + broken based on router-ID. + + If this option is enabled, then the already-selected check, where + already selected eBGP routes are preferred, is skipped. + + If a route has an ORIGINATOR_ID attribute because it has been reflected, + that ORIGINATOR_ID will be used. Otherwise, the router-ID of the peer + the route was received from will be used. + + The advantage of this is that the route-selection (at this point) will + be more deterministic. The disadvantage is that a few or even one lowest-ID + router may attract all traffic to otherwise-equal paths because of this + check. It may increase the possibility of MED or IGP oscillation, unless + other measures were taken to avoid these. The exact behaviour will be + sensitive to the iBGP and reflection topology. +``` + +```{eval-rst} +.. cfgcmd:: set protocols bgp parameters bestpath med confed + + This command specifies that BGP considers the MED when comparing routes + originated from different sub-ASs within the confederation to which this + BGP speaker belongs. The default state, where the MED attribute is not + considered. +``` + +```{eval-rst} +.. cfgcmd:: set protocols bgp parameters bestpath med missing-as-worst + + This command specifies that a route with a MED is always considered to be + better than a route without a MED by causing the missing MED attribute to + have a value of infinity. The default state, where the missing MED + attribute is considered to have a value of zero. +``` + +```{eval-rst} +.. cfgcmd:: set protocols bgp parameters default local-pref + + + This command specifies the default local preference value. The local + preference range is 0 to 4294967295. +``` + +```{eval-rst} +.. cfgcmd:: set protocols bgp parameters deterministic-med + + This command provides to compare different MED values that advertised by + neighbours in the same AS for routes selection. When this command is + enabled, routes from the same autonomous system are grouped together, and + the best entries of each group are compared. +``` + +```{eval-rst} +.. cfgcmd:: set protocols bgp address-family ipv4-unicast network + backdoor + + This command allows the router to prefer route to specified prefix learned + via IGP through backdoor link instead of a route to the same prefix learned + via EBGP. + +``` + +#### Route Filtering Configuration + +In order to control and modify routing information that is exchanged between +peers you can use route-map, filter-list, prefix-list, distribute-list. + +For inbound updates the order of preference is: + +> - route-map +> - filter-list +> - prefix-list, distribute-list + +For outbound updates the order of preference is: + +> - prefix-list, distribute-list +> - filter-list +> - route-map +> +> :::{note} +> The attributes {cfgcmd}`prefix-list` and {cfgcmd}`distribute-list` +> are mutually exclusive, and only one command (distribute-list or +> prefix-list) can be applied to each inbound or outbound direction for a +> particular neighbor. +> ::: + +```{eval-rst} +.. cfgcmd:: set protocols bgp neighbor address-family + distribute-list + + This command applies the access list filters named in to the + specified BGP neighbor to restrict the routing information that BGP learns + and/or advertises. The arguments {cfgcmd}`export` and {cfgcmd}`import` + specify the direction in which the access list are applied. +``` + +```{eval-rst} +.. cfgcmd:: set protocols bgp neighbor address-family + prefix-list + + This command applies the prfefix list filters named in to the + specified BGP neighbor to restrict the routing information that BGP learns + and/or advertises. The arguments {cfgcmd}`export` and {cfgcmd}`import` + specify the direction in which the prefix list are applied. +``` + +```{eval-rst} +.. cfgcmd:: set protocols bgp neighbor address-family + route-map + + This command applies the route map named in to the specified BGP + neighbor to control and modify routing information that is exchanged + between peers. The arguments {cfgcmd}`export` and {cfgcmd}`import` + specify the direction in which the route map are applied. +``` + +```{eval-rst} +.. cfgcmd:: set protocols bgp neighbor address-family + filter-list + + This command applies the AS path access list filters named in to the + specified BGP neighbor to restrict the routing information that BGP learns + and/or advertises. The arguments {cfgcmd}`export` and {cfgcmd}`import` + specify the direction in which the AS path access list are applied. +``` + +```{eval-rst} +.. cfgcmd:: set protocols bgp neighbor address-family + capability orf + + This command enables the ORF capability (described in {rfc}`5291`) on the + local router, and enables ORF capability advertisement to the specified BGP + peer. The {cfgcmd}`receive` keyword configures a router to advertise ORF + receive capabilities. The {cfgcmd}`send` keyword configures a router to + advertise ORF send capabilities. To advertise a filter from a sender, you + must create an IP prefix list for the specified BGP peer applied in inbound + derection. +``` + +```{eval-rst} +.. cfgcmd:: set protocols bgp neighbor solo + + This command prevents from sending back prefixes learned from the neighbor. +``` + +#### BGP Scaling Configuration + +BGP routers connected inside the same AS through BGP belong to an internal BGP +session, or IBGP. In order to prevent routing table loops, IBGP speaker does +not advertise IBGP-learned routes to other IBGP speaker (Split Horizon +mechanism). As such, IBGP requires a full mesh of all peers. For large +networks, this quickly becomes unscalable. + +There are two ways that help us to mitigate the BGPs full-mesh requirement in +a network: + +> - Using BGP route-reflectors +> - Using BGP confederation + +##### Route Reflector Configuration + +Introducing route reflectors removes the need for the full-mesh. When you +configure a route reflector you have to tell the router whether the other IBGP +router is a client or non-client. A client is an IBGP router that the route +reflector will “reflect” routes to, the non-client is just a regular IBGP +neighbor. Route reflectors mechanism is described in {rfc}`4456` and updated +by {rfc}`7606`. + +```{eval-rst} +.. cfgcmd:: set protocols bgp neighbor
address-family + route-reflector-client + + This command specifies the given neighbor as route reflector client. +``` + +```{eval-rst} +.. cfgcmd:: set protocols bgp parameters cluster-id + + This command specifies cluster ID which identifies a collection of route + reflectors and their clients, and is used by route reflectors to avoid + looping. By default cluster ID is set to the BGP router id value, but can be + set to an arbitrary 32-bit value. + +``` + +##### Confederation Configuration + +A BGP confederation divides our AS into sub-ASes to reduce the number of +required IBGP peerings. Within a sub-AS we still require full-mesh IBGP but +between these sub-ASes we use something that looks like EBGP but behaves like +IBGP (called confederation BGP). Confederation mechanism is described in +{rfc}`5065` + +```{eval-rst} +.. cfgcmd:: set protocols bgp parameters confederation identifier + + + This command specifies a BGP confederation identifier. is the number + of the autonomous system that internally includes multiple sub-autonomous + systems (a confederation). +``` + +```{eval-rst} +.. cfgcmd:: set protocols bgp parameters confederation peers + + This command sets other confederations as members of autonomous + system specified by {cfgcmd}`confederation identifier `. + +``` + +## Operational Mode Commands + +### Show + +```{eval-rst} +.. opcmd:: show bgp + + This command displays all entries in BGP routing table. +``` + +```none +BGP table version is 10, local router ID is 10.0.35.3, vrf id 0 +Default local pref 100, local AS 65000 +Status codes: s suppressed, d damped, h history, * valid, > best, = multipath, + i internal, r RIB-failure, S Stale, R Removed +Nexthop codes: @NNN nexthop's vrf id, < announce-nh-self +Origin codes: i - IGP, e - EGP, ? - incomplete + + Network Next Hop Metric LocPrf Weight Path +*> 198.51.100.0/24 10.0.34.4 0 0 65004 i +*> 203.0.113.0/24 10.0.35.5 0 0 65005 i + +Displayed 2 routes and 2 total paths +``` + +```{eval-rst} +.. opcmd:: show bgp + + This command displays information about the particular entry in the BGP + routing table. +``` + +```none +BGP routing table entry for 198.51.100.0/24 +Paths: (1 available, best #1, table default) + Advertised to non peer-group peers: + 10.0.13.1 10.0.23.2 10.0.34.4 10.0.35.5 + 65004 + 10.0.34.4 from 10.0.34.4 (10.0.34.4) + Origin IGP, metric 0, valid, external, best (First path received) + Last update: Wed Jan 6 12:18:53 2021 +``` + +```{eval-rst} +.. opcmd:: show bgp cidr-only + + This command displays routes with classless interdomain routing (CIDR). +``` + +```{eval-rst} +.. opcmd:: show bgp community + + This command displays routes that belong to specified BGP communities. + Valid value is a community number in the range from 1 to 4294967200, + or AA:NN (autonomous system-community number/2-byte number), no-export, + local-as, or no-advertise. +``` + +```{eval-rst} +.. opcmd:: show bgp community-list + + This command displays routes that are permitted by the BGP + community list. +``` + +```{eval-rst} +.. opcmd:: show bgp dampening dampened-paths + + This command displays BGP dampened routes. +``` + +```{eval-rst} +.. opcmd:: show bgp dampening flap-statistics + + This command displays information about flapping BGP routes. +``` + +```{eval-rst} +.. opcmd:: show bgp filter-list + + This command displays BGP routes allowed by the specified AS Path + access list. +``` + +```{eval-rst} +.. opcmd:: show bgp neighbors
advertised-routes + + This command displays BGP routes advertised to a neighbor. +``` + +```{eval-rst} +.. opcmd:: show bgp neighbors
received-routes + + This command displays BGP routes originating from the specified BGP + neighbor before inbound policy is applied. To use this command inbound + soft reconfiguration must be enabled. +``` + +```{eval-rst} +.. opcmd:: show bgp neighbors
routes + + This command displays BGP received-routes that are accepted after filtering. +``` + +```{eval-rst} +.. opcmd:: show bgp neighbors
dampened-routes + + This command displays dampened routes received from BGP neighbor. +``` + +```{eval-rst} +.. opcmd:: show bgp regexp + + This command displays information about BGP routes whose AS path + matches the specified regular expression. +``` + +```{eval-rst} +.. opcmd:: show bgp summary + + This command displays the status of all BGP connections. +``` + +```none +IPv4 Unicast Summary: +BGP router identifier 10.0.35.3, local AS number 65000 vrf-id 0 +BGP table version 11 +RIB entries 5, using 920 bytes of memory +Peers 4, using 82 KiB of memory + +Neighbor V AS MsgRcvd MsgSent TblVer InQ OutQ Up/Down State/PfxRcd +10.0.13.1 4 65000 148 159 0 0 0 02:16:01 0 +10.0.23.2 4 65000 136 143 0 0 0 02:13:21 0 +10.0.34.4 4 65004 161 163 0 0 0 02:16:01 1 +10.0.35.5 4 65005 162 166 0 0 0 02:16:01 1 + +Total number of neighbors 4 +``` + +### Reset + +```{eval-rst} +.. opcmd:: reset bgp
[soft [in|out]] + + This command resets BGP connections to the specified neighbor IP address. + With argument {cfgcmd}`soft` this command initiates a soft reset. If + you do not specify the {cfgcmd}`in` or {cfgcmd}`out` options, both + inbound and outbound soft reconfiguration are triggered. +``` + +```{eval-rst} +.. opcmd:: reset ip bgp all + + This command resets all BGP connections of given router. +``` + +```{eval-rst} +.. opcmd:: reset bgp external + + This command resets all external BGP peers of given router. +``` + +```{eval-rst} +.. opcmd:: reset bgp peer-group [soft [in|out]] + + This command resets BGP connections to the specified peer group. + With argument {cfgcmd}`soft` this command initiates a soft reset. If + you do not specify the {cfgcmd}`in` or {cfgcmd}`out` options, both + inbound and outbound soft reconfiguration are triggered. + +``` + +## Examples + +### IPv4 peering + +A simple eBGP configuration: + +**Node 1:** + +```none +set protocols bgp system-as 65534 +set protocols bgp neighbor 192.168.0.2 ebgp-multihop '2' +set protocols bgp neighbor 192.168.0.2 remote-as '65535' +set protocols bgp neighbor 192.168.0.2 update-source '192.168.0.1' +set protocols bgp neighbor 192.168.0.2 address-family ipv4-unicast +set protocols bgp address-family ipv4-unicast network '172.16.0.0/16' +set protocols bgp parameters router-id '192.168.0.1' +``` + +**Node 2:** + +```none +set protocols bgp system-as 65535 +set protocols bgp neighbor 192.168.0.1 ebgp-multihop '2' +set protocols bgp neighbor 192.168.0.1 remote-as '65534' +set protocols bgp neighbor 192.168.0.1 update-source '192.168.0.2' +set protocols bgp neighbor 192.168.0.2 address-family ipv4-unicast +set protocols bgp address-family ipv4-unicast network '172.17.0.0/16' +set protocols bgp parameters router-id '192.168.0.2' +``` + +Don't forget, the CIDR declared in the network statement MUST **exist in your +routing table (dynamic or static), the best way to make sure that is true is +creating a static route:** + +**Node 1:** + +```none +set protocols static route 172.16.0.0/16 blackhole distance '254' +``` + +**Node 2:** + +```none +set protocols static route 172.17.0.0/16 blackhole distance '254' +``` + +### IPv6 peering + +A simple BGP configuration via IPv6. + +**Node 1:** + +```none +set protocols bgp system-as 65534 +set protocols bgp neighbor 2001:db8::2 ebgp-multihop '2' +set protocols bgp neighbor 2001:db8::2 remote-as '65535' +set protocols bgp neighbor 2001:db8::2 update-source '2001:db8::1' +set protocols bgp neighbor 2001:db8::2 address-family ipv6-unicast +set protocols bgp address-family ipv6-unicast network '2001:db8:1::/48' +set protocols bgp parameters router-id '10.1.1.1' +``` + +**Node 2:** + +```none +set protocols bgp system-as 65535 +set protocols bgp neighbor 2001:db8::1 ebgp-multihop '2' +set protocols bgp neighbor 2001:db8::1 remote-as '65534' +set protocols bgp neighbor 2001:db8::1 update-source '2001:db8::2' +set protocols bgp neighbor 2001:db8::1 address-family ipv6-unicast +set protocols bgp address-family ipv6-unicast network '2001:db8:2::/48' +set protocols bgp parameters router-id '10.1.1.2' +``` + +Don't forget, the CIDR declared in the network statement **MUST exist in your +routing table (dynamic or static), the best way to make sure that is true is +creating a static route:** + +**Node 1:** + +```none +set protocols static route6 2001:db8:1::/48 blackhole distance '254' +``` + +**Node 2:** + +```none +set protocols static route6 2001:db8:2::/48 blackhole distance '254' +``` + +### Route Filtering + +Route filter can be applied using a route-map: + +**Node1:** + +```none +set policy prefix-list AS65535-IN rule 10 action 'permit' +set policy prefix-list AS65535-IN rule 10 prefix '172.16.0.0/16' +set policy prefix-list AS65535-OUT rule 10 action 'deny' +set policy prefix-list AS65535-OUT rule 10 prefix '172.16.0.0/16' +set policy prefix-list6 AS65535-IN rule 10 action 'permit' +set policy prefix-list6 AS65535-IN rule 10 prefix '2001:db8:2::/48' +set policy prefix-list6 AS65535-OUT rule 10 action 'deny' +set policy prefix-list6 AS65535-OUT rule 10 prefix '2001:db8:2::/48' + +set policy route-map AS65535-IN rule 10 action 'permit' +set policy route-map AS65535-IN rule 10 match ip address prefix-list 'AS65535-IN' +set policy route-map AS65535-IN rule 10 match ipv6 address prefix-list 'AS65535-IN' +set policy route-map AS65535-IN rule 20 action 'deny' +set policy route-map AS65535-OUT rule 10 action 'deny' +set policy route-map AS65535-OUT rule 10 match ip address prefix-list 'AS65535-OUT' +set policy route-map AS65535-OUT rule 10 match ipv6 address prefix-list 'AS65535-OUT' +set policy route-map AS65535-OUT rule 20 action 'permit' + +set protocols bgp system-as 65534 +set protocols bgp neighbor 2001:db8::2 address-family ipv4-unicast route-map export 'AS65535-OUT' +set protocols bgp neighbor 2001:db8::2 address-family ipv4-unicast route-map import 'AS65535-IN' +set protocols bgp neighbor 2001:db8::2 address-family ipv6-unicast route-map export 'AS65535-OUT' +set protocols bgp neighbor 2001:db8::2 address-family ipv6-unicast route-map import 'AS65535-IN' +``` + +**Node2:** + +```none +set policy prefix-list AS65534-IN rule 10 action 'permit' +set policy prefix-list AS65534-IN rule 10 prefix '172.17.0.0/16' +set policy prefix-list AS65534-OUT rule 10 action 'deny' +set policy prefix-list AS65534-OUT rule 10 prefix '172.17.0.0/16' +set policy prefix-list6 AS65534-IN rule 10 action 'permit' +set policy prefix-list6 AS65534-IN rule 10 prefix '2001:db8:1::/48' +set policy prefix-list6 AS65534-OUT rule 10 action 'deny' +set policy prefix-list6 AS65534-OUT rule 10 prefix '2001:db8:1::/48' + +set policy route-map AS65534-IN rule 10 action 'permit' +set policy route-map AS65534-IN rule 10 match ip address prefix-list 'AS65534-IN' +set policy route-map AS65534-IN rule 10 match ipv6 address prefix-list 'AS65534-IN' +set policy route-map AS65534-IN rule 20 action 'deny' +set policy route-map AS65534-OUT rule 10 action 'deny' +set policy route-map AS65534-OUT rule 10 match ip address prefix-list 'AS65534-OUT' +set policy route-map AS65534-OUT rule 10 match ipv6 address prefix-list 'AS65534-OUT' +set policy route-map AS65534-OUT rule 20 action 'permit' + +set protocols bgp system-as 65535 +set protocols bgp neighbor 2001:db8::1 address-family ipv4-unicast route-map export 'AS65534-OUT' +set protocols bgp neighbor 2001:db8::1 address-family ipv4-unicast route-map import 'AS65534-IN' +set protocols bgp neighbor 2001:db8::1 address-family ipv6-unicast route-map export 'AS65534-OUT' +set protocols bgp neighbor 2001:db8::1 address-family ipv6-unicast route-map import 'AS65534-IN' +``` + +We could expand on this and also deny link local and multicast in the rule 20 +action deny. diff --git a/docs/configuration/protocols/bgp.rst b/docs/configuration/protocols/bgp.rst deleted file mode 100644 index 6d93bcc4..00000000 --- a/docs/configuration/protocols/bgp.rst +++ /dev/null @@ -1,1274 +0,0 @@ -.. _routing-bgp: - -### -BGP -### - -:abbr:`BGP (Border Gateway Protocol)` is one of the Exterior Gateway Protocols -and the de facto standard interdomain routing protocol. The latest BGP version -is 4. BGP-4 is described in :rfc:`1771` and updated by :rfc:`4271`. :rfc:`2858` -adds multiprotocol support to BGP. - -VyOS makes use of :abbr:`FRR (Free Range Routing)` and we would like to thank -them for their effort! - -************** -Basic Concepts -************** - -.. _bgp-autonomous-systems: - -Autonomous Systems -================== - -From :rfc:`1930`: - - An AS is a connected group of one or more IP prefixes run by one or more - network operators which has a SINGLE and CLEARLY DEFINED routing policy. - -Each :abbr:`AS (Autonomous System)` has an identifying number associated with it -called an :abbr:`ASN (Autonomous System Number)`. This is a two octet value -ranging in value from 1 to 65535. The AS numbers 64512 through 65535 are defined -as private AS numbers. Private AS numbers must not be advertised on the global -Internet. The 2-byte AS number range has been exhausted. 4-byte AS numbers are -specified in :rfc:`6793`, and provide a pool of 4294967296 AS numbers. - -The :abbr:`ASN (Autonomous System Number)` is one of the essential elements of -BGP. BGP is a distance vector routing protocol, and the AS-Path framework -provides distance vector metric and loop detection to BGP. - -.. cfgcmd:: set protocols bgp system-as - - Set local :abbr:`ASN (Autonomous System Number)` that this router represents. - This is a a mandatory option! - -.. _bgp-address-families: - -Address Families -================ - -Multiprotocol extensions enable BGP to carry routing information for multiple -network layer protocols. BGP supports an Address Family Identifier (AFI) for -IPv4 and IPv6. - -.. _bgp-route-selection: - -Route Selection -=============== - -The route selection process used by FRR's BGP implementation uses the following -decision criterion, starting at the top of the list and going towards the -bottom until one of the factors can be used. - -1. **Weight check** - - Prefer higher local weight routes to lower routes. - -2. **Local preference check** - - Prefer higher local preference routes to lower. - -3. **Local route check** - - Prefer local routes (statics, aggregates, redistributed) to received routes. - -4. **AS path length check** - - Prefer shortest hop-count AS_PATHs. - -5. **Origin check** - - Prefer the lowest origin type route. That is, prefer IGP origin routes to - EGP, to Incomplete routes. - -6. **MED check** - - Where routes with a MED were received from the same AS, prefer the route - with the lowest MED. - -7. **External check** - - Prefer the route received from an external, eBGP peer over routes received - from other types of peers. - -8. **IGP cost check** - - Prefer the route with the lower IGP cost. - -9. **Multi-path check** - - If multi-pathing is enabled, then check whether the routes not yet - distinguished in preference may be considered equal. If - :cfgcmd:`bgp bestpath as-path multipath-relax` is set, all such routes are - considered equal, otherwise routes received via iBGP with identical AS_PATHs - or routes received from eBGP neighbours in the same AS are considered equal. - -10. **Already-selected external check** - - Where both routes were received from eBGP peers, then prefer the route - which is already selected. Note that this check is not applied if - :cfgcmd:`bgp bestpath compare-routerid` is configured. This check can - prevent some cases of oscillation. - -11. **Router-ID check** - - Prefer the route with the lowest `router-ID`. If the route has an - `ORIGINATOR_ID` attribute, through iBGP reflection, then that router ID is - used, otherwise the `router-ID` of the peer the route was received from is - used. - -12. **Cluster-List length check** - - The route with the shortest cluster-list length is used. The cluster-list - reflects the iBGP reflection path the route has taken. - -13. **Peer address** - - Prefer the route received from the peer with the higher transport layer - address, as a last-resort tie-breaker. - -.. _bgp-capability-negotiation: - -Capability Negotiation -====================== - -When adding IPv6 routing information exchange feature to BGP. There were some -proposals. :abbr:`IETF (Internet Engineering Task Force)` -:abbr:`IDR (Inter Domain Routing)` adopted a proposal called Multiprotocol -Extension for BGP. The specification is described in :rfc:`2283`. The protocol -does not define new protocols. It defines new attributes to existing BGP. When -it is used exchanging IPv6 routing information it is called BGP-4+. When it is -used for exchanging multicast routing information it is called MBGP. - -*bgpd* supports Multiprotocol Extension for BGP. So if a remote peer supports -the protocol, *bgpd* can exchange IPv6 and/or multicast routing information. - -Traditional BGP did not have the feature to detect a remote peer's -capabilities, e.g. whether it can handle prefix types other than IPv4 unicast -routes. This was a big problem using Multiprotocol Extension for BGP in an -operational network. :rfc:`2842` adopted a feature called Capability -Negotiation. *bgpd* use this Capability Negotiation to detect the remote peer's -capabilities. If a peer is only configured as an IPv4 unicast neighbor, *bgpd* -does not send these Capability Negotiation packets (at least not unless other -optional BGP features require capability negotiation). - -By default, FRR will bring up peering with minimal common capability for the -both sides. For example, if the local router has unicast and multicast -capabilities and the remote router only has unicast capability the local router -will establish the connection with unicast only capability. When there are no -common capabilities, FRR sends Unsupported Capability error and then resets the -connection. - -************* -Configuration -************* - -.. _bgp-router-configuration: - -BGP Router Configuration -======================== - -First of all you must configure BGP router with the :abbr:`ASN (Autonomous -System Number)`. The AS number is an identifier for the autonomous system. -The BGP protocol uses the AS number for detecting whether the BGP connection -is internal or external. VyOS does not have a special command to start the BGP -process. The BGP process starts when the first neighbor is configured. - -.. cfgcmd:: set protocols bgp system-as - - Set local autonomous system number that this router represents. This is a - mandatory option! - -Peers Configuration -------------------- - -Defining Peers -^^^^^^^^^^^^^^ - -.. cfgcmd:: set protocols bgp neighbor remote-as - - - This command creates a new neighbor whose remote-as is . The neighbor - address can be an IPv4 address or an IPv6 address or an interface to use - for the connection. The command is applicable for peer and peer group. - -.. cfgcmd:: set protocols bgp neighbor remote-as - internal - - Create a peer as you would when you specify an ASN, except that if the - peers ASN is different than mine as specified under the :cfgcmd:`protocols - bgp ` command the connection will be denied. - -.. cfgcmd:: set protocols bgp neighbor remote-as - external - - Create a peer as you would when you specify an ASN, except that if the - peers ASN is the same as mine as specified under the :cfgcmd:`protocols - bgp ` command the connection will be denied. - -.. cfgcmd:: set protocols bgp neighbor local-role - [strict] - - BGP roles are defined in RFC :rfc:`9234` and provide an easy way to - add route leak prevention, detection and mitigation. The local Role - value is negotiated with the new BGP Role capability which has a - built-in check of the corresponding value. In case of a mismatch the - new OPEN Roles Mismatch Notification <2, 11> would be sent. - The correct Role pairs are: - - Provider - Customer - - Peer - Peer - - RS-Server - RS-Client - - If :cfgcmd:`strict` is set the BGP session won’t become established - until the BGP neighbor sets local Role on its side. This - configuration parameter is defined in RFC :rfc:`9234` and is used to - enforce the corresponding configuration at your counter-parts side. - - Routes that are sent from provider, rs-server, or the peer local-role - (or if received by customer, rs-client, or the peer local-role) will - be marked with a new Only to Customer (OTC) attribute. - - Routes with this attribute can only be sent to your neighbor if your - local-role is provider or rs-server. Routes with this attribute can - be received only if your local-role is customer or rs-client. - - In case of peer-peer relationship routes can be received only if OTC - value is equal to your neighbor AS number. - - All these rules with OTC will help to detect and mitigate route leaks - and happen automatically if local-role is set. - -.. cfgcmd:: set protocols bgp neighbor shutdown - - This command disable the peer or peer group. To reenable the peer use - the delete form of this command. - -.. cfgcmd:: set protocols bgp neighbor description - - - Set description of the peer or peer group. - -.. cfgcmd:: set protocols bgp neighbor update-source - - - Specify the IPv4 source address to use for the BGP session to this neighbor, - may be specified as either an IPv4 address directly or as an interface name. - -.. _bgp_capability_negotiation: - -Capability Negotiation -^^^^^^^^^^^^^^^^^^^^^^ - -.. cfgcmd:: set protocols bgp neighbor capability - dynamic - - This command would allow the dynamic update of capabilities over an - established BGP session. - -.. cfgcmd:: set protocols bgp neighbor capability - extended-nexthop - - Allow bgp to negotiate the extended-nexthop capability with it’s peer. - If you are peering over a IPv6 Link-Local address then this capability - is turned on automatically. If you are peering over a IPv6 Global Address - then turning on this command will allow BGP to install IPv4 routes with - IPv6 nexthops if you do not have IPv4 configured on interfaces. - -.. cfgcmd:: set protocols bgp neighbor - disable-capability-negotiation - - Suppress sending Capability Negotiation as OPEN message optional - parameter to the peer. This command only affects the peer is - configured other than IPv4 unicast configuration. - - When remote peer does not have capability negotiation feature, - remote peer will not send any capabilities at all. In that case, - bgp configures the peer with configured capabilities. - - You may prefer locally configured capabilities more than the negotiated - capabilities even though remote peer sends capabilities. If the peer is - configured by :cfgcmd:`override-capability`, VyOS ignores received - capabilities then override negotiated capabilities with configured values. - - Additionally you should keep in mind that this feature fundamentally - disables the ability to use widely deployed BGP features. BGP unnumbered, - hostname support, AS4, Addpath, Route Refresh, ORF, Dynamic Capabilities, - and graceful restart. - -.. cfgcmd:: set protocols bgp neighbor - override-capability - - This command allow override the result of Capability Negotiation with - local configuration. Ignore remote peer’s capability value. - -.. cfgcmd:: set protocols bgp neighbor - strict-capability-match - - This command forces strictly compare remote capabilities and local - capabilities. If capabilities are different, send Unsupported Capability - error then reset connection. - - You may want to disable sending Capability Negotiation OPEN message - optional parameter to the peer when remote peer does not implement - Capability Negotiation. Please use :cfgcmd:`disable-capability-negotiation` - command to disable the feature. - - -Peer Parameters -^^^^^^^^^^^^^^^ - -.. cfgcmd:: set protocols bgp neighbor address-family - allowas-in number - - This command accept incoming routes with AS path containing AS - number with the same value as the current system AS. This is - used when you want to use the same AS number in your sites, - but you can’t connect them directly. - - The number parameter (1-10) configures the amount of accepted - occurences of the system AS number in AS path. - - This command is only allowed for eBGP peers. It is not applicable - for peer groups. - -.. cfgcmd:: set protocols bgp neighbor address-family - as-override - - This command override AS number of the originating router with - the local AS number. - - Usually this configuration is used in PEs (Provider Edge) to - replace the incoming customer AS number so the connected CE ( - Customer Edge) can use the same AS number as the other customer - sites. This allows customers of the provider network to use the - same AS number across their sites. - - This command is only allowed for eBGP peers. - -.. cfgcmd:: set protocols bgp neighbor address-family - attribute-unchanged - - This command specifies attributes to be left unchanged for - advertisements sent to a peer or peer group. - -.. cfgcmd:: set protocols bgp neighbor address-family - maximum-prefix - - This command specifies a maximum number of prefixes we can receive - from a given peer. If this number is exceeded, the BGP session - will be destroyed. The number range is 1 to 4294967295. - -.. cfgcmd:: set protocols bgp neighbor address-family - nexthop-self - - This command forces the BGP speaker to report itself as the - next hop for an advertised route it advertised to a neighbor. - -.. cfgcmd:: set protocols bgp neighbor address-family - remove-private-as - - This command removes the private ASN of routes that are advertised - to the configured peer. It removes only private ASNs on routes - advertised to EBGP peers. - - If the AS-Path for the route has only private ASNs, the private - ASNs are removed. - - If the AS-Path for the route has a private ASN between public - ASNs, it is assumed that this is a design choice, and the - private ASN is not removed. - -.. cfgcmd:: set protocols bgp neighbor address-family - soft-reconfiguration inbound - - Changes in BGP policies require the BGP session to be cleared. Clearing has a - large negative impact on network operations. Soft reconfiguration enables you - to generate inbound updates from a neighbor, change and activate BGP policies - without clearing the BGP session. - - This command specifies that route updates received from this neighbor will be - stored unmodified, regardless of the inbound policy. When inbound soft - reconfiguration is enabled, the stored updates are processed by the new - policy configuration to create new inbound updates. - - .. note:: Storage of route updates uses memory. If you enable soft - reconfiguration inbound for multiple neighbors, the amount of memory used - can become significant. - -.. cfgcmd:: set protocols bgp neighbor address-family - weight - - This command specifies a default weight value for the neighbor’s - routes. The number range is 1 to 65535. - -.. cfgcmd:: set protocols bgp neighbor - advertisement-interval - - This command specifies the minimum route advertisement interval for - the peer. The interval value is 0 to 600 seconds, with the default - advertisement interval being 0. - -.. cfgcmd:: set protocols bgp neighbor - disable-connected-check - - This command allows peerings between directly connected eBGP peers - using loopback addresses without adjusting the default TTL of 1. - -.. cfgcmd:: set protocols bgp neighbor - disable-send-community - - This command specifies that the community attribute should not be sent - in route updates to a peer. By default community attribute is sent. - -.. cfgcmd:: set protocols bgp neighbor ebgp-multihop - - - This command allows sessions to be established with eBGP neighbors - when they are multiple hops away. When the neighbor is not directly - connected and this knob is not enabled, the session will not establish. - The number of hops range is 1 to 255. This command is mutually - exclusive with :cfgcmd:`ttl-security hops`. - -.. cfgcmd:: set protocols bgp neighbor local-as - [no-prepend] [replace-as] - - Specify an alternate AS for this BGP process when interacting with - the specified peer or peer group. With no modifiers, the specified - local-as is prepended to the received AS_PATH when receiving routing - updates from the peer, and prepended to the outgoing AS_PATH (after - the process local AS) when transmitting local routes to the peer. - - If the :cfgcmd:`no-prepend` attribute is specified, then the supplied - local-as is not prepended to the received AS_PATH. - - If the :cfgcmd:`replace-as` attribute is specified, then only the supplied - local-as is prepended to the AS_PATH when transmitting local-route - updates to this peer. - - .. note:: This command is only allowed for eBGP peers. - -.. cfgcmd:: set protocols bgp neighbor passive - - Configures the BGP speaker so that it only accepts inbound connections - from, but does not initiate outbound connections to the peer or peer group. - -.. cfgcmd:: set protocols bgp neighbor password - - - This command specifies a MD5 password to be used with the tcp socket that - is being used to connect to the remote peer. - -.. cfgcmd:: set protocols bgp neighbor ttl-security - hops - - This command enforces Generalized TTL Security Mechanism (GTSM), - as specified in :rfc:`5082`. With this command, only neighbors - that are specified number of hops away will be allowed to - become neighbors. The number of hops range is 1 to 254. This - command is mutually exclusive with :cfgcmd:`ebgp-multihop`. - - -Peer Groups -^^^^^^^^^^^ - -Peer groups are used to help improve scaling by generating the same update -information to all members of a peer group. Note that this means that the -routes generated by a member of a peer group will be sent back to that -originating peer with the originator identifier attribute set to indicated -the originating peer. All peers not associated with a specific peer group -are treated as belonging to a default peer group, and will share updates. - -.. cfgcmd:: set protocols bgp peer-group - - This command defines a new peer group. You can specify to the group the same - parameters that you can specify for specific neighbors. - - .. note:: If you apply a parameter to an individual neighbor IP address, you - override the action defined for a peer group that includes that IP - address. - -.. cfgcmd:: set protocols bgp neighbor peer-group - - - This command bind specific peer to peer group with a given name. - - -Network Advertisement Configuration ------------------------------------ - -.. cfgcmd:: set protocols bgp address-family - network - - This command is used for advertising IPv4 or IPv6 networks. - - .. note:: By default, the BGP prefix is advertised even if it's not present - in the routing table. This behaviour differs from the implementation of - some vendors. - -.. cfgcmd:: set protocols bgp parameters network-import-check - - This configuration modifies the behavior of the network statement. If you - have this configured the underlying network must exist in the routing table. - -.. cfgcmd:: set protocols bgp neighbor address-family - default-originate [route-map ] - - By default, VyOS does not advertise a default route (0.0.0.0/0) even if it is - in routing table. When you want to announce default routes to the peer, use - this command. Using optional argument :cfgcmd:`route-map` you can inject the - default route to given neighbor only if the conditions in the route map are - met. - - -Route Aggregation Configuration -------------------------------- - -.. cfgcmd:: set protocols bgp address-family - aggregate-address - - This command specifies an aggregate address. The router will also - announce longer-prefixes inside of the aggregate address. - -.. cfgcmd:: set protocols bgp address-family - aggregate-address as-set - - This command specifies an aggregate address with a mathematical set of - autonomous systems. This command summarizes the AS_PATH attributes of - all the individual routes. - -.. cfgcmd:: set protocols bgp address-family - aggregate-address summary-only - - This command specifies an aggregate address and provides that - longer-prefixes inside of the aggregate address are suppressed - before sending BGP updates out to peers. - -.. cfgcmd:: set protocols bgp neighbor address-family - unsuppress-map - - This command applies route-map to selectively unsuppress prefixes - suppressed by summarisation. - - -Redistribution Configuration ----------------------------- - -.. cfgcmd:: set protocols bgp address-family - redistribute - - This command redistributes routing information from the given route source - to the BGP process. There are six modes available for route source: - connected, kernel, ospf, rip, static, table. - -.. cfgcmd:: set protocols bgp address-family - redistribute metric - - This command specifies metric (MED) for redistributed routes. The - metric range is 0 to 4294967295. There are six modes available for - route source: connected, kernel, ospf, rip, static, table. - -.. cfgcmd:: set protocols bgp address-family - redistribute route-map - - This command allows to use route map to filter redistributed routes. - There are six modes available for route source: connected, kernel, - ospf, rip, static, table. - - -General Configuration ---------------------- - -Common parameters -^^^^^^^^^^^^^^^^^ - -.. cfgcmd:: set protocols bgp parameters allow-martian-nexthop - - When a peer receives a martian nexthop as part of the NLRI for a route - permit the nexthop to be used as such, instead of rejecting and resetting - the connection. - -.. cfgcmd:: set protocols bgp parameters router-id - - This command specifies the router-ID. If router ID is not specified it will - use the highest interface IP address. - -.. cfgcmd:: set protocols bgp address-family - maximum-paths - - This command defines the maximum number of parallel routes that - the BGP can support. In order for BGP to use the second path, the - following attributes have to match: Weight, Local Preference, AS - Path (both AS number and AS path length), Origin code, MED, IGP - metric. Also, the next hop address for each path must be different. - -.. cfgcmd:: set protocols bgp parameters no-hard-administrative-reset - - Do not send Hard Reset CEASE Notification for "Administrative Reset" - events. When set and Graceful Restart Notification capability is exchanged - between the peers, Graceful Restart procedures apply, and routes will be retained. - -.. cfgcmd:: set protocols bgp parameters log-neighbor-changes - - This command enable logging neighbor up/down changes and reset reason. - -.. cfgcmd:: set protocols bgp parameters no-client-to-client-reflection - - This command disables route reflection between route reflector clients. - By default, the clients of a route reflector are not required to be - fully meshed and the routes from a client are reflected to other clients. - However, if the clients are fully meshed, route reflection is not required. - In this case, use the :cfgcmd:`no-client-to-client-reflection` command - to disable client-to-client reflection. - -.. cfgcmd:: set protocols bgp parameters no-fast-external-failover - - Disable immediate session reset if peer's connected link goes down. - -.. cfgcmd:: set protocols bgp parameters no-ipv6-auto-ra - - By default, FRR sends router advertisement packets when Extended Next Hop is - on or when a connection is established directly using the device name (Unnumbered BGP). - Setting this option prevents FRR from sending router advertisement packets, but could break Unnumbered BGP. - -.. cfgcmd:: set protocols bgp listen range peer-group - - This command is useful if one desires to loosen the requirement for BGP - to have strictly defined neighbors. Specifically what is allowed is for - the local router to listen to a range of IPv4 or IPv6 addresses defined - by a prefix and to accept BGP open messages. When a TCP connection - (and subsequently a BGP open message) from within this range tries to - connect the local router then the local router will respond and connect - with the parameters that are defined within the peer group. One must define - a peer-group for each range that is listed. If no peer-group is defined - then an error will keep you from committing the configuration. - -.. cfgcmd:: set protocols bgp listen limit - - This command goes hand in hand with the listen range command to limit the - amount of BGP neighbors that are allowed to connect to the local router. - The limit range is 1 to 5000. - -.. cfgcmd:: set protocols bgp parameters ebgp-requires-policy - - This command changes the eBGP behavior of FRR. By default FRR enables - :rfc:`8212` functionality which affects how eBGP routes are advertised, - namely no routes are advertised across eBGP sessions without some - sort of egress route-map/policy in place. In VyOS however we have this - RFC functionality disabled by default so that we can preserve backwards - compatibility with older versions of VyOS. With this option one can - enable :rfc:`8212` functionality to operate. - -.. cfgcmd:: set protocols bgp parameters labeled-unicast - - By default, locally advertised prefixes use the implicit-null label to - encode in the outgoing NLRI. - - The following command uses the explicit-null label value for all the - BGP instances. - - -Administrative Distance -^^^^^^^^^^^^^^^^^^^^^^^ - -.. cfgcmd:: set protocols bgp parameters distance global - - - This command change distance value of BGP. The arguments are the distance - values for external routes, internal routes and local routes respectively. - The distance range is 1 to 255. - -.. cfgcmd:: set protocols bgp parameters distance prefix - distance - - This command sets the administrative distance for a particular route. The - distance range is 1 to 255. - - .. note:: Routes with a distance of 255 are effectively disabled and not - installed into the kernel. - - -Timers -^^^^^^ - -.. cfgcmd:: set protocols bgp timers holdtime - - This command specifies hold-time in seconds. The timer range is - 4 to 65535. The default value is 180 second. If you set value to 0 - VyOS will not hold routes. - -.. cfgcmd:: set protocols bgp timers keepalive - - This command specifies keep-alive time in seconds. The timer - can range from 4 to 65535. The default value is 60 second. - - -Route Dampening -^^^^^^^^^^^^^^^ - -When a route fails, a routing update is sent to withdraw the route from the -network's routing tables. When the route is re-enabled, the change in -availability is also advertised. A route that continually fails and returns -requires a great deal of network traffic to update the network about the -route's status. - -Route dampening wich described in :rfc:`2439` enables you to identify routes -that repeatedly fail and return. If route dampening is enabled, an unstable -route accumulates penalties each time the route fails and returns. If the -accumulated penalties exceed a threshold, the route is no longer advertised. -This is route suppression. Routes that have been suppressed are re-entered -into the routing table only when the amount of their penalty falls below a -threshold. - -A penalty of 1000 is assessed each time the route fails. When the penalties -reach a predefined threshold (suppress-value), the router stops advertising -the route. - -Once a route is assessed a penalty, the penalty is decreased by half each time -a predefined amount of time elapses (half-life-time). When the accumulated -penalties fall below a predefined threshold (reuse-value), the route is -unsuppressed and added back into the BGP routing table. - -No route is suppressed indefinitely. Maximum-suppress-time defines the maximum -time a route can be suppressed before it is re-advertised. - -.. cfgcmd:: set protocols bgp parameters dampening - half-life - - This command defines the amount of time in minutes after - which a penalty is reduced by half. The timer range is - 10 to 45 minutes. - -.. cfgcmd:: set protocols bgp parameters dampening - re-use - - This command defines the accumulated penalty amount at which the - route is re-advertised. The penalty range is 1 to 20000. - -.. cfgcmd:: set protocols bgp parameters dampening - start-suppress-time - - This command defines the accumulated penalty amount at which the - route is suppressed. The penalty range is 1 to 20000. - -.. cfgcmd:: set protocols bgp parameters dampening - max-suppress-time - - This command defines the maximum time in minutes that a route is - suppressed. The timer range is 1 to 255 minutes. - - -Route Selection Configuration ------------------------------ - -.. cfgcmd:: set protocols bgp parameters always-compare-med - - This command provides to compare the MED on routes, even when they were - received from different neighbouring ASes. Setting this option makes the - order of preference of routes more defined, and should eliminate MED - induced oscillations. - -.. cfgcmd:: set protocols bgp parameters bestpath as-path confed - - This command specifies that the length of confederation path sets and - sequences should be taken into account during the BGP best path - decision process. - -.. cfgcmd:: set protocols bgp parameters bestpath as-path multipath-relax - - This command specifies that BGP decision process should consider paths - of equal AS_PATH length candidates for multipath computation. Without - the knob, the entire AS_PATH must match for multipath computation. - -.. cfgcmd:: set protocols bgp parameters bestpath as-path ignore - - Ignore AS_PATH length when selecting a route - -.. cfgcmd:: set protocols bgp parameters bestpath compare-routerid - - Ensure that when comparing routes where both are equal on most metrics, - including local-pref, AS_PATH length, IGP cost, MED, that the tie is - broken based on router-ID. - - If this option is enabled, then the already-selected check, where - already selected eBGP routes are preferred, is skipped. - - If a route has an ORIGINATOR_ID attribute because it has been reflected, - that ORIGINATOR_ID will be used. Otherwise, the router-ID of the peer - the route was received from will be used. - - The advantage of this is that the route-selection (at this point) will - be more deterministic. The disadvantage is that a few or even one lowest-ID - router may attract all traffic to otherwise-equal paths because of this - check. It may increase the possibility of MED or IGP oscillation, unless - other measures were taken to avoid these. The exact behaviour will be - sensitive to the iBGP and reflection topology. - -.. cfgcmd:: set protocols bgp parameters bestpath med confed - - This command specifies that BGP considers the MED when comparing routes - originated from different sub-ASs within the confederation to which this - BGP speaker belongs. The default state, where the MED attribute is not - considered. - -.. cfgcmd:: set protocols bgp parameters bestpath med missing-as-worst - - This command specifies that a route with a MED is always considered to be - better than a route without a MED by causing the missing MED attribute to - have a value of infinity. The default state, where the missing MED - attribute is considered to have a value of zero. - -.. cfgcmd:: set protocols bgp parameters default local-pref - - - This command specifies the default local preference value. The local - preference range is 0 to 4294967295. - -.. cfgcmd:: set protocols bgp parameters deterministic-med - - This command provides to compare different MED values that advertised by - neighbours in the same AS for routes selection. When this command is - enabled, routes from the same autonomous system are grouped together, and - the best entries of each group are compared. - -.. cfgcmd:: set protocols bgp address-family ipv4-unicast network - backdoor - - This command allows the router to prefer route to specified prefix learned - via IGP through backdoor link instead of a route to the same prefix learned - via EBGP. - - -Route Filtering Configuration ------------------------------ - -In order to control and modify routing information that is exchanged between -peers you can use route-map, filter-list, prefix-list, distribute-list. - -For inbound updates the order of preference is: - - - route-map - - filter-list - - prefix-list, distribute-list - -For outbound updates the order of preference is: - - - prefix-list, distribute-list - - filter-list - - route-map - - .. note:: The attributes :cfgcmd:`prefix-list` and :cfgcmd:`distribute-list` - are mutually exclusive, and only one command (distribute-list or - prefix-list) can be applied to each inbound or outbound direction for a - particular neighbor. - -.. cfgcmd:: set protocols bgp neighbor address-family - distribute-list - - This command applies the access list filters named in to the - specified BGP neighbor to restrict the routing information that BGP learns - and/or advertises. The arguments :cfgcmd:`export` and :cfgcmd:`import` - specify the direction in which the access list are applied. - -.. cfgcmd:: set protocols bgp neighbor address-family - prefix-list - - This command applies the prfefix list filters named in to the - specified BGP neighbor to restrict the routing information that BGP learns - and/or advertises. The arguments :cfgcmd:`export` and :cfgcmd:`import` - specify the direction in which the prefix list are applied. - -.. cfgcmd:: set protocols bgp neighbor address-family - route-map - - This command applies the route map named in to the specified BGP - neighbor to control and modify routing information that is exchanged - between peers. The arguments :cfgcmd:`export` and :cfgcmd:`import` - specify the direction in which the route map are applied. - -.. cfgcmd:: set protocols bgp neighbor address-family - filter-list - - This command applies the AS path access list filters named in to the - specified BGP neighbor to restrict the routing information that BGP learns - and/or advertises. The arguments :cfgcmd:`export` and :cfgcmd:`import` - specify the direction in which the AS path access list are applied. - -.. cfgcmd:: set protocols bgp neighbor address-family - capability orf - - This command enables the ORF capability (described in :rfc:`5291`) on the - local router, and enables ORF capability advertisement to the specified BGP - peer. The :cfgcmd:`receive` keyword configures a router to advertise ORF - receive capabilities. The :cfgcmd:`send` keyword configures a router to - advertise ORF send capabilities. To advertise a filter from a sender, you - must create an IP prefix list for the specified BGP peer applied in inbound - derection. - -.. cfgcmd:: set protocols bgp neighbor solo - - This command prevents from sending back prefixes learned from the neighbor. - -BGP Scaling Configuration -------------------------- - -BGP routers connected inside the same AS through BGP belong to an internal BGP -session, or IBGP. In order to prevent routing table loops, IBGP speaker does -not advertise IBGP-learned routes to other IBGP speaker (Split Horizon -mechanism). As such, IBGP requires a full mesh of all peers. For large -networks, this quickly becomes unscalable. - -There are two ways that help us to mitigate the BGPs full-mesh requirement in -a network: - - - Using BGP route-reflectors - - Using BGP confederation - - -Route Reflector Configuration -^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ - -Introducing route reflectors removes the need for the full-mesh. When you -configure a route reflector you have to tell the router whether the other IBGP -router is a client or non-client. A client is an IBGP router that the route -reflector will “reflect” routes to, the non-client is just a regular IBGP -neighbor. Route reflectors mechanism is described in :rfc:`4456` and updated -by :rfc:`7606`. - -.. cfgcmd:: set protocols bgp neighbor
address-family - route-reflector-client - - This command specifies the given neighbor as route reflector client. - -.. cfgcmd:: set protocols bgp parameters cluster-id - - This command specifies cluster ID which identifies a collection of route - reflectors and their clients, and is used by route reflectors to avoid - looping. By default cluster ID is set to the BGP router id value, but can be - set to an arbitrary 32-bit value. - - -Confederation Configuration -^^^^^^^^^^^^^^^^^^^^^^^^^^^ - -A BGP confederation divides our AS into sub-ASes to reduce the number of -required IBGP peerings. Within a sub-AS we still require full-mesh IBGP but -between these sub-ASes we use something that looks like EBGP but behaves like -IBGP (called confederation BGP). Confederation mechanism is described in -:rfc:`5065` - -.. cfgcmd:: set protocols bgp parameters confederation identifier - - - This command specifies a BGP confederation identifier. is the number - of the autonomous system that internally includes multiple sub-autonomous - systems (a confederation). - -.. cfgcmd:: set protocols bgp parameters confederation peers - - This command sets other confederations as members of autonomous - system specified by :cfgcmd:`confederation identifier `. - - -************************* -Operational Mode Commands -************************* - -Show -==== - -.. opcmd:: show bgp - - This command displays all entries in BGP routing table. - -.. code-block:: none - - BGP table version is 10, local router ID is 10.0.35.3, vrf id 0 - Default local pref 100, local AS 65000 - Status codes: s suppressed, d damped, h history, * valid, > best, = multipath, - i internal, r RIB-failure, S Stale, R Removed - Nexthop codes: @NNN nexthop's vrf id, < announce-nh-self - Origin codes: i - IGP, e - EGP, ? - incomplete - - Network Next Hop Metric LocPrf Weight Path - *> 198.51.100.0/24 10.0.34.4 0 0 65004 i - *> 203.0.113.0/24 10.0.35.5 0 0 65005 i - - Displayed 2 routes and 2 total paths - -.. opcmd:: show bgp - - This command displays information about the particular entry in the BGP - routing table. - -.. code-block:: none - - BGP routing table entry for 198.51.100.0/24 - Paths: (1 available, best #1, table default) - Advertised to non peer-group peers: - 10.0.13.1 10.0.23.2 10.0.34.4 10.0.35.5 - 65004 - 10.0.34.4 from 10.0.34.4 (10.0.34.4) - Origin IGP, metric 0, valid, external, best (First path received) - Last update: Wed Jan 6 12:18:53 2021 - -.. opcmd:: show bgp cidr-only - - This command displays routes with classless interdomain routing (CIDR). - -.. opcmd:: show bgp community - - This command displays routes that belong to specified BGP communities. - Valid value is a community number in the range from 1 to 4294967200, - or AA:NN (autonomous system-community number/2-byte number), no-export, - local-as, or no-advertise. - -.. opcmd:: show bgp community-list - - This command displays routes that are permitted by the BGP - community list. - -.. opcmd:: show bgp dampening dampened-paths - - This command displays BGP dampened routes. - -.. opcmd:: show bgp dampening flap-statistics - - This command displays information about flapping BGP routes. - -.. opcmd:: show bgp filter-list - - This command displays BGP routes allowed by the specified AS Path - access list. - -.. opcmd:: show bgp neighbors
advertised-routes - - This command displays BGP routes advertised to a neighbor. - -.. opcmd:: show bgp neighbors
received-routes - - This command displays BGP routes originating from the specified BGP - neighbor before inbound policy is applied. To use this command inbound - soft reconfiguration must be enabled. - -.. opcmd:: show bgp neighbors
routes - - This command displays BGP received-routes that are accepted after filtering. - -.. opcmd:: show bgp neighbors
dampened-routes - - This command displays dampened routes received from BGP neighbor. - -.. opcmd:: show bgp regexp - - This command displays information about BGP routes whose AS path - matches the specified regular expression. - -.. opcmd:: show bgp summary - - This command displays the status of all BGP connections. - -.. code-block:: none - - IPv4 Unicast Summary: - BGP router identifier 10.0.35.3, local AS number 65000 vrf-id 0 - BGP table version 11 - RIB entries 5, using 920 bytes of memory - Peers 4, using 82 KiB of memory - - Neighbor V AS MsgRcvd MsgSent TblVer InQ OutQ Up/Down State/PfxRcd - 10.0.13.1 4 65000 148 159 0 0 0 02:16:01 0 - 10.0.23.2 4 65000 136 143 0 0 0 02:13:21 0 - 10.0.34.4 4 65004 161 163 0 0 0 02:16:01 1 - 10.0.35.5 4 65005 162 166 0 0 0 02:16:01 1 - - Total number of neighbors 4 - -Reset -===== - -.. opcmd:: reset bgp
[soft [in|out]] - - This command resets BGP connections to the specified neighbor IP address. - With argument :cfgcmd:`soft` this command initiates a soft reset. If - you do not specify the :cfgcmd:`in` or :cfgcmd:`out` options, both - inbound and outbound soft reconfiguration are triggered. - -.. opcmd:: reset ip bgp all - - This command resets all BGP connections of given router. - -.. opcmd:: reset bgp external - - This command resets all external BGP peers of given router. - -.. opcmd:: reset bgp peer-group [soft [in|out]] - - This command resets BGP connections to the specified peer group. - With argument :cfgcmd:`soft` this command initiates a soft reset. If - you do not specify the :cfgcmd:`in` or :cfgcmd:`out` options, both - inbound and outbound soft reconfiguration are triggered. - - -******** -Examples -******** - -IPv4 peering -============ - -A simple eBGP configuration: - -**Node 1:** - -.. code-block:: none - - set protocols bgp system-as 65534 - set protocols bgp neighbor 192.168.0.2 ebgp-multihop '2' - set protocols bgp neighbor 192.168.0.2 remote-as '65535' - set protocols bgp neighbor 192.168.0.2 update-source '192.168.0.1' - set protocols bgp neighbor 192.168.0.2 address-family ipv4-unicast - set protocols bgp address-family ipv4-unicast network '172.16.0.0/16' - set protocols bgp parameters router-id '192.168.0.1' - -**Node 2:** - -.. code-block:: none - - set protocols bgp system-as 65535 - set protocols bgp neighbor 192.168.0.1 ebgp-multihop '2' - set protocols bgp neighbor 192.168.0.1 remote-as '65534' - set protocols bgp neighbor 192.168.0.1 update-source '192.168.0.2' - set protocols bgp neighbor 192.168.0.2 address-family ipv4-unicast - set protocols bgp address-family ipv4-unicast network '172.17.0.0/16' - set protocols bgp parameters router-id '192.168.0.2' - - -Don't forget, the CIDR declared in the network statement MUST **exist in your -routing table (dynamic or static), the best way to make sure that is true is -creating a static route:** - -**Node 1:** - -.. code-block:: none - - set protocols static route 172.16.0.0/16 blackhole distance '254' - -**Node 2:** - -.. code-block:: none - - set protocols static route 172.17.0.0/16 blackhole distance '254' - - -IPv6 peering -============ - -A simple BGP configuration via IPv6. - -**Node 1:** - -.. code-block:: none - - set protocols bgp system-as 65534 - set protocols bgp neighbor 2001:db8::2 ebgp-multihop '2' - set protocols bgp neighbor 2001:db8::2 remote-as '65535' - set protocols bgp neighbor 2001:db8::2 update-source '2001:db8::1' - set protocols bgp neighbor 2001:db8::2 address-family ipv6-unicast - set protocols bgp address-family ipv6-unicast network '2001:db8:1::/48' - set protocols bgp parameters router-id '10.1.1.1' - -**Node 2:** - -.. code-block:: none - - set protocols bgp system-as 65535 - set protocols bgp neighbor 2001:db8::1 ebgp-multihop '2' - set protocols bgp neighbor 2001:db8::1 remote-as '65534' - set protocols bgp neighbor 2001:db8::1 update-source '2001:db8::2' - set protocols bgp neighbor 2001:db8::1 address-family ipv6-unicast - set protocols bgp address-family ipv6-unicast network '2001:db8:2::/48' - set protocols bgp parameters router-id '10.1.1.2' - -Don't forget, the CIDR declared in the network statement **MUST exist in your -routing table (dynamic or static), the best way to make sure that is true is -creating a static route:** - -**Node 1:** - -.. code-block:: none - - set protocols static route6 2001:db8:1::/48 blackhole distance '254' - -**Node 2:** - -.. code-block:: none - - set protocols static route6 2001:db8:2::/48 blackhole distance '254' - -Route Filtering -=============== - -Route filter can be applied using a route-map: - -**Node1:** - -.. code-block:: none - - set policy prefix-list AS65535-IN rule 10 action 'permit' - set policy prefix-list AS65535-IN rule 10 prefix '172.16.0.0/16' - set policy prefix-list AS65535-OUT rule 10 action 'deny' - set policy prefix-list AS65535-OUT rule 10 prefix '172.16.0.0/16' - set policy prefix-list6 AS65535-IN rule 10 action 'permit' - set policy prefix-list6 AS65535-IN rule 10 prefix '2001:db8:2::/48' - set policy prefix-list6 AS65535-OUT rule 10 action 'deny' - set policy prefix-list6 AS65535-OUT rule 10 prefix '2001:db8:2::/48' - - set policy route-map AS65535-IN rule 10 action 'permit' - set policy route-map AS65535-IN rule 10 match ip address prefix-list 'AS65535-IN' - set policy route-map AS65535-IN rule 10 match ipv6 address prefix-list 'AS65535-IN' - set policy route-map AS65535-IN rule 20 action 'deny' - set policy route-map AS65535-OUT rule 10 action 'deny' - set policy route-map AS65535-OUT rule 10 match ip address prefix-list 'AS65535-OUT' - set policy route-map AS65535-OUT rule 10 match ipv6 address prefix-list 'AS65535-OUT' - set policy route-map AS65535-OUT rule 20 action 'permit' - - set protocols bgp system-as 65534 - set protocols bgp neighbor 2001:db8::2 address-family ipv4-unicast route-map export 'AS65535-OUT' - set protocols bgp neighbor 2001:db8::2 address-family ipv4-unicast route-map import 'AS65535-IN' - set protocols bgp neighbor 2001:db8::2 address-family ipv6-unicast route-map export 'AS65535-OUT' - set protocols bgp neighbor 2001:db8::2 address-family ipv6-unicast route-map import 'AS65535-IN' - -**Node2:** - -.. code-block:: none - - set policy prefix-list AS65534-IN rule 10 action 'permit' - set policy prefix-list AS65534-IN rule 10 prefix '172.17.0.0/16' - set policy prefix-list AS65534-OUT rule 10 action 'deny' - set policy prefix-list AS65534-OUT rule 10 prefix '172.17.0.0/16' - set policy prefix-list6 AS65534-IN rule 10 action 'permit' - set policy prefix-list6 AS65534-IN rule 10 prefix '2001:db8:1::/48' - set policy prefix-list6 AS65534-OUT rule 10 action 'deny' - set policy prefix-list6 AS65534-OUT rule 10 prefix '2001:db8:1::/48' - - set policy route-map AS65534-IN rule 10 action 'permit' - set policy route-map AS65534-IN rule 10 match ip address prefix-list 'AS65534-IN' - set policy route-map AS65534-IN rule 10 match ipv6 address prefix-list 'AS65534-IN' - set policy route-map AS65534-IN rule 20 action 'deny' - set policy route-map AS65534-OUT rule 10 action 'deny' - set policy route-map AS65534-OUT rule 10 match ip address prefix-list 'AS65534-OUT' - set policy route-map AS65534-OUT rule 10 match ipv6 address prefix-list 'AS65534-OUT' - set policy route-map AS65534-OUT rule 20 action 'permit' - - set protocols bgp system-as 65535 - set protocols bgp neighbor 2001:db8::1 address-family ipv4-unicast route-map export 'AS65534-OUT' - set protocols bgp neighbor 2001:db8::1 address-family ipv4-unicast route-map import 'AS65534-IN' - set protocols bgp neighbor 2001:db8::1 address-family ipv6-unicast route-map export 'AS65534-OUT' - set protocols bgp neighbor 2001:db8::1 address-family ipv6-unicast route-map import 'AS65534-IN' - -We could expand on this and also deny link local and multicast in the rule 20 -action deny. diff --git a/docs/configuration/protocols/failover.md b/docs/configuration/protocols/failover.md new file mode 100644 index 00000000..45c3e449 --- /dev/null +++ b/docs/configuration/protocols/failover.md @@ -0,0 +1,120 @@ +# Failover + +Failover routes are manually configured routes, but they only install +to the routing table if the health-check target is alive. +If the target is not alive the route is removed from the routing table +until the target becomes available. + +## Failover Routes + +```{eval-rst} +.. cfgcmd:: set protocols failover route next-hop
check + target + + Configure next-hop `
` and `` for an IPv4 static + route. Specify the target + IPv4 address for health checking. +``` + +```{eval-rst} +.. cfgcmd:: set protocols failover route next-hop
check + timeout + + Timeout in seconds between health target checks. + + Range is 1 to 300, default is 10. +``` + +```{eval-rst} +.. cfgcmd:: set protocols failover route next-hop
check + type + + Defines protocols for checking ARP, ICMP, TCP + + Default is ``icmp``. +``` + +```{eval-rst} +.. cfgcmd:: set protocols failover route next-hop
check + policy + + Policy for checking targets +``` + +- `all-available` all checking target addresses must be available to pass + this check + +- `any-available` any of the checking target addresses must be available + to pass this check + + > Default is `any-available`. + +```{eval-rst} +.. cfgcmd:: set protocols failover route next-hop
+ interface + + Next-hop interface for the route +``` + +```{eval-rst} +.. cfgcmd:: set protocols failover route next-hop
+ metric + + Route metric + + Default 1. + +``` + +## Example + +**One gateway:** + +```none +set protocols failover route 203.0.113.1/32 next-hop 192.0.2.1 check target '192.0.2.1' +set protocols failover route 203.0.113.1/32 next-hop 192.0.2.1 check timeout '5' +set protocols failover route 203.0.113.1/32 next-hop 192.0.2.1 check type 'icmp' +set protocols failover route 203.0.113.1/32 next-hop 192.0.2.1 interface 'eth0' +set protocols failover route 203.0.113.1/32 next-hop 192.0.2.1 metric '10' +``` + +Show the route + +```none +vyos@vyos:~$ show ip route 203.0.113.1 + Routing entry for 203.0.113.1/32 + Known via "kernel", distance 0, metric 10, best + Last update 00:00:39 ago + * 192.0.2.1, via eth0 +``` + +**Two gateways and different metrics:** + +```none +set protocols failover route 203.0.113.1/32 next-hop 192.0.2.1 check target '192.0.2.1' +set protocols failover route 203.0.113.1/32 next-hop 192.0.2.1 check timeout '5' +set protocols failover route 203.0.113.1/32 next-hop 192.0.2.1 check type 'icmp' +set protocols failover route 203.0.113.1/32 next-hop 192.0.2.1 interface 'eth0' +set protocols failover route 203.0.113.1/32 next-hop 192.0.2.1 metric '10' + +set protocols failover route 203.0.113.1/32 next-hop 198.51.100.1 check target '198.51.100.99' +set protocols failover route 203.0.113.1/32 next-hop 198.51.100.1 check timeout '5' +set protocols failover route 203.0.113.1/32 next-hop 198.51.100.1 check type 'icmp' +set protocols failover route 203.0.113.1/32 next-hop 198.51.100.1 interface 'eth2' +set protocols failover route 203.0.113.1/32 next-hop 198.51.100.1 metric '20' +``` + +Show the route + +```none +vyos@vyos:~$ show ip route 203.0.113.1 +Routing entry for 203.0.113.1/32 + Known via "kernel", distance 0, metric 10, best + Last update 00:08:06 ago + * 192.0.2.1, via eth0 + +Routing entry for 203.0.113.1/32 + Known via "kernel", distance 0, metric 20 + Last update 00:08:14 ago + * 198.51.100.1, via eth2 +``` diff --git a/docs/configuration/protocols/failover.rst b/docs/configuration/protocols/failover.rst deleted file mode 100644 index 8088e104..00000000 --- a/docs/configuration/protocols/failover.rst +++ /dev/null @@ -1,114 +0,0 @@ -######## -Failover -######## - -Failover routes are manually configured routes, but they only install -to the routing table if the health-check target is alive. -If the target is not alive the route is removed from the routing table -until the target becomes available. - -*************** -Failover Routes -*************** - -.. cfgcmd:: set protocols failover route next-hop
check - target - - Configure next-hop `
` and `` for an IPv4 static - route. Specify the target - IPv4 address for health checking. - -.. cfgcmd:: set protocols failover route next-hop
check - timeout - - Timeout in seconds between health target checks. - - Range is 1 to 300, default is 10. - -.. cfgcmd:: set protocols failover route next-hop
check - type - - Defines protocols for checking ARP, ICMP, TCP - - Default is ``icmp``. - -.. cfgcmd:: set protocols failover route next-hop
check - policy - - Policy for checking targets - -* ``all-available`` all checking target addresses must be available to pass - this check - -* ``any-available`` any of the checking target addresses must be available - to pass this check - - Default is ``any-available``. - -.. cfgcmd:: set protocols failover route next-hop
- interface - - Next-hop interface for the route - -.. cfgcmd:: set protocols failover route next-hop
- metric - - Route metric - - Default 1. - - -******* -Example -******* - -**One gateway:** - -.. code-block:: none - - set protocols failover route 203.0.113.1/32 next-hop 192.0.2.1 check target '192.0.2.1' - set protocols failover route 203.0.113.1/32 next-hop 192.0.2.1 check timeout '5' - set protocols failover route 203.0.113.1/32 next-hop 192.0.2.1 check type 'icmp' - set protocols failover route 203.0.113.1/32 next-hop 192.0.2.1 interface 'eth0' - set protocols failover route 203.0.113.1/32 next-hop 192.0.2.1 metric '10' - -Show the route - -.. code-block:: none - - vyos@vyos:~$ show ip route 203.0.113.1 - Routing entry for 203.0.113.1/32 - Known via "kernel", distance 0, metric 10, best - Last update 00:00:39 ago - * 192.0.2.1, via eth0 - -**Two gateways and different metrics:** - -.. code-block:: none - - set protocols failover route 203.0.113.1/32 next-hop 192.0.2.1 check target '192.0.2.1' - set protocols failover route 203.0.113.1/32 next-hop 192.0.2.1 check timeout '5' - set protocols failover route 203.0.113.1/32 next-hop 192.0.2.1 check type 'icmp' - set protocols failover route 203.0.113.1/32 next-hop 192.0.2.1 interface 'eth0' - set protocols failover route 203.0.113.1/32 next-hop 192.0.2.1 metric '10' - - set protocols failover route 203.0.113.1/32 next-hop 198.51.100.1 check target '198.51.100.99' - set protocols failover route 203.0.113.1/32 next-hop 198.51.100.1 check timeout '5' - set protocols failover route 203.0.113.1/32 next-hop 198.51.100.1 check type 'icmp' - set protocols failover route 203.0.113.1/32 next-hop 198.51.100.1 interface 'eth2' - set protocols failover route 203.0.113.1/32 next-hop 198.51.100.1 metric '20' - -Show the route - -.. code-block:: none - - vyos@vyos:~$ show ip route 203.0.113.1 - Routing entry for 203.0.113.1/32 - Known via "kernel", distance 0, metric 10, best - Last update 00:08:06 ago - * 192.0.2.1, via eth0 - - Routing entry for 203.0.113.1/32 - Known via "kernel", distance 0, metric 20 - Last update 00:08:14 ago - * 198.51.100.1, via eth2 diff --git a/docs/configuration/protocols/igmp-proxy.md b/docs/configuration/protocols/igmp-proxy.md new file mode 100644 index 00000000..961f921b --- /dev/null +++ b/docs/configuration/protocols/igmp-proxy.md @@ -0,0 +1,79 @@ +--- +lastproofread: '2023-11-13' +--- + +(igmp-proxy)= + +# IGMP Proxy + +{abbr}`IGMP (Internet Group Management Protocol)` proxy sends IGMP host messages +on behalf of a connected client. The configuration must define one, and only one +upstream interface, and one or more downstream interfaces. + +## Configuration + +```{cfgcmd} set protocols igmp-proxy interface \ role \ + +* **upstream:** The upstream network interface is the outgoing interface +which is responsible for communicating to available multicast data sources. +There can only be one upstream interface. + +* **downstream:** Downstream network interfaces are the distribution +interfaces to the destination networks, where multicast clients can join +groups and receive multicast data. One or more downstream interfaces must +be configured. +``` + +```{cfgcmd} set protocols igmp-proxy interface \ alt-subnet \ + +Defines alternate sources for multicasting and IGMP data. The network address +must be on the following format 'a.b.c.d/n'. By default, the router will +accept data from sources on the same network as configured on an interface. +If the multicast source lies on a remote network, one must define from where +traffic should be accepted. + +This is especially useful for the upstream interface, since the source for +multicast traffic is often from a remote location. + +This option can be supplied multiple times. +``` + +```{cfgcmd} set protocols igmp-proxy disable-quickleave + +Disables quickleave mode. In this mode the daemon will not send a Leave IGMP +message upstream as soon as it receives a Leave message for any downstream +interface. The daemon will not ask for Membership reports on the downstream +interfaces, and if a report is received the group is not joined again the +upstream. + +If it's vital that the daemon should act exactly like a real multicast client +on the upstream interface, this function should be enabled. + +Enabling this function increases the risk of bandwidth saturation. +``` + +```{cfgcmd} set protocols igmp-proxy disable + +Disable this service. +``` + +(igmp-proxy-example)= + +### Example + +Interface eth1 LAN is behind NAT. In order to subscribe 10.0.0.0/23 subnet +multicast which is in eth0 WAN we need to configure igmp-proxy. + +```none +set protocols igmp-proxy interface eth0 role upstream +set protocols igmp-proxy interface eth0 alt-subnet 10.0.0.0/23 +set protocols igmp-proxy interface eth1 role downstream +``` + + +## Operation + +```{opcmd} restart igmp-proxy + +Restart the IGMP proxy process. +``` \ No newline at end of file diff --git a/docs/configuration/protocols/igmp-proxy.rst b/docs/configuration/protocols/igmp-proxy.rst deleted file mode 100644 index f62a289e..00000000 --- a/docs/configuration/protocols/igmp-proxy.rst +++ /dev/null @@ -1,77 +0,0 @@ -:lastproofread: 2023-11-13 - -.. _igmp_proxy: - -########## -IGMP Proxy -########## - -:abbr:`IGMP (Internet Group Management Protocol)` proxy sends IGMP host messages -on behalf of a connected client. The configuration must define one, and only one -upstream interface, and one or more downstream interfaces. - -Configuration -============= - -.. cfgcmd:: set protocols igmp-proxy interface role - - - * **upstream:** The upstream network interface is the outgoing interface - which is responsible for communicating to available multicast data sources. - There can only be one upstream interface. - - * **downstream:** Downstream network interfaces are the distribution - interfaces to the destination networks, where multicast clients can join - groups and receive multicast data. One or more downstream interfaces must - be configured. - -.. cfgcmd:: set protocols igmp-proxy interface alt-subnet - - Defines alternate sources for multicasting and IGMP data. The network address - must be on the following format 'a.b.c.d/n'. By default, the router will - accept data from sources on the same network as configured on an interface. - If the multicast source lies on a remote network, one must define from where - traffic should be accepted. - - This is especially useful for the upstream interface, since the source for - multicast traffic is often from a remote location. - - This option can be supplied multiple times. - -.. cfgcmd:: set protocols igmp-proxy disable-quickleave - - Disables quickleave mode. In this mode the daemon will not send a Leave IGMP - message upstream as soon as it receives a Leave message for any downstream - interface. The daemon will not ask for Membership reports on the downstream - interfaces, and if a report is received the group is not joined again the - upstream. - - If it's vital that the daemon should act exactly like a real multicast client - on the upstream interface, this function should be enabled. - - Enabling this function increases the risk of bandwidth saturation. - -.. cfgcmd:: set protocols igmp-proxy disable - - Disable this service. - -.. _igmp:proxy_example: - -Example -------- - -Interface `eth1` LAN is behind NAT. In order to subscribe `10.0.0.0/23` subnet -multicast which is in `eth0` WAN we need to configure igmp-proxy. - -.. code-block:: none - - set protocols igmp-proxy interface eth0 role upstream - set protocols igmp-proxy interface eth0 alt-subnet 10.0.0.0/23 - set protocols igmp-proxy interface eth1 role downstream - -Operation -========= - -.. opcmd:: restart igmp-proxy - - Restart the IGMP proxy process. diff --git a/docs/configuration/protocols/index.md b/docs/configuration/protocols/index.md new file mode 100644 index 00000000..418e49af --- /dev/null +++ b/docs/configuration/protocols/index.md @@ -0,0 +1,22 @@ +# Protocols + +```{eval-rst} +.. toctree:: + :maxdepth: 1 + :includehidden: + + babel + bfd + bgp + failover + igmp-proxy + isis + mpls + segment-routing + ospf + pim + pim6 + rip + rpki + static +``` diff --git a/docs/configuration/protocols/index.rst b/docs/configuration/protocols/index.rst deleted file mode 100644 index ea217d3c..00000000 --- a/docs/configuration/protocols/index.rst +++ /dev/null @@ -1,22 +0,0 @@ -######### -Protocols -######### - -.. toctree:: - :maxdepth: 1 - :includehidden: - - babel - bfd - bgp - failover - igmp-proxy - isis - mpls - segment-routing - ospf - pim - pim6 - rip - rpki - static diff --git a/docs/configuration/protocols/isis.md b/docs/configuration/protocols/isis.md new file mode 100644 index 00000000..07ffd827 --- /dev/null +++ b/docs/configuration/protocols/isis.md @@ -0,0 +1,596 @@ +```{include} /_include/need_improvement.txt +``` + +(routing-isis)= + +# IS-IS + +{abbr}`IS-IS (Intermediate System to Intermediate System)` is a link-state +interior gateway protocol (IGP) which is described in ISO10589, +{rfc}`1195`, {rfc}`5308`. IS-IS runs the Dijkstra shortest-path first (SPF) +algorithm to create a database of the network’s topology, and +from that database to determine the best (that is, lowest cost) path to a +destination. The intermediate systems (the name for routers) exchange topology +information with their directly conencted neighbors. IS-IS runs directly on +the data link layer (Layer 2). IS-IS addresses are called +{abbr}`NETs (Network Entity Titles)` and can be 8 to 20 bytes long, but are +generally 10 bytes long. The tree database that is created with IS-IS is +similar to the one that is created with OSPF in that the paths chosen should +be similar. Comparisons to OSPF are inevitable and often are reasonable ones +to make in regards to the way a network will respond with either IGP. + +## General + +### Configuration + +#### Mandatory Settings + +For IS-IS top operate correctly, one must do the equivalent of a Router ID in +CLNS. This Router ID is called the {abbr}`NET (Network Entity Title)`. This +must be unique for each and every router that is operating in IS-IS. It also +must not be duplicated otherwise the same issues that occur within OSPF will +occur within IS-IS when it comes to said duplication. + +```{eval-rst} +.. cfgcmd:: set protocols isis net + + This commad sets network entity title (NET) provided in ISO format. + + Here is an example {abbr}`NET (Network Entity Title)` value: + + .. code-block:: none + + 49.0001.1921.6800.1002.00 + + The CLNS address consists of the following parts: + + * {abbr}`AFI (Address family authority identifier)` - ``49`` The AFI value + 49 is what IS-IS uses for private addressing. + + * Area identifier: ``0001`` IS-IS area number (numberical area ``1``) + + * System identifier: ``1921.6800.1002`` - for system idetifiers we recommend + to use IP address or MAC address of the router itself. The way to construct + this is to keep all of the zeroes of the router IP address, and then change + the periods from being every three numbers to every four numbers. The + address that is listed here is ``192.168.1.2``, which if expanded will turn + into ``192.168.001.002``. Then all one has to do is move the dots to have + four numbers instead of three. This gives us ``1921.6800.1002``. + + * {abbr}`NET (Network Entity Title)` selector: ``00`` Must always be 00. This + setting indicates "this system" or "local system." +``` + +```{eval-rst} +.. cfgcmd:: set protocols isis interface + + This command enables IS-IS on this interface, and allows for + adjacency to occur. Note that the name of IS-IS instance must be + the same as the one used to configure the IS-IS process. +``` + +#### IS-IS Global Configuration + +```{eval-rst} +.. cfgcmd:: set protocols isis dynamic-hostname + + This command enables support for dynamic hostname TLV. Dynamic hostname + mapping determined as described in {rfc}`2763`, Dynamic Hostname + Exchange Mechanism for IS-IS. +``` + +```{eval-rst} +.. cfgcmd:: set protocols isis level + + This command defines the IS-IS router behavior: + + * **level-1** - Act as a station (Level 1) router only. + * **level-1-2** - Act as a station (Level 1) router and area (Level 2) router. + * **level-2-only** - Act as an area (Level 2) router only. +``` + +```{eval-rst} +.. cfgcmd:: set protocols isis lsp-mtu + + This command configures the maximum size of generated + {abbr}`LSPs (Link State PDUs)`, in bytes. The size range is 128 to 4352. +``` + +```{eval-rst} +.. cfgcmd:: set protocols isis metric-style + + This command sets old-style (ISO 10589) or new style packet formats: + + * **narrow** - Use old style of TLVs with narrow metric. + * **transition** - Send and accept both styles of TLVs during transition. + * **wide** - Use new style of TLVs to carry wider metric. +``` + +```{eval-rst} +.. cfgcmd:: set protocols isis purge-originator + + This command enables {rfc}`6232` purge originator identification. Enable + purge originator identification (POI) by adding the type, length and value + (TLV) with the Intermediate System (IS) identification to the LSPs that do + not contain POI information. If an IS generates a purge, VyOS adds this TLV + with the system ID of the IS to the purge. +``` + +```{eval-rst} +.. cfgcmd:: set protocols isis set-attached-bit + + This command sets ATT bit to 1 in Level1 LSPs. It is described in {rfc}`3787`. +``` + +```{eval-rst} +.. cfgcmd:: set protocols isis set-overload-bit + + This command sets overload bit to avoid any transit traffic through this + router. It is described in {rfc}`3787`. +``` + +```{eval-rst} +.. cfgcmd:: set protocols isis name default-information originate + level-1 + + This command will generate a default-route in L1 database. +``` + +```{eval-rst} +.. cfgcmd:: set protocols isis name default-information originate + level-2 + + This command will generate a default-route in L2 database. + +``` + +```{eval-rst} +.. cfgcmd:: set protocols isis ldp-sync + + This command will enable IGP-LDP synchronization globally for ISIS. This + requires for LDP to be functional. This is described in {rfc}`5443`. By + default all interfaces operational in IS-IS are enabled for synchronization. + Loopbacks are exempt. +``` + +```{eval-rst} +.. cfgcmd:: set protocols isis ldp-sync holddown + + This command will change the hold down value globally for IGP-LDP + synchronization during convergence/interface flap events. + +``` + +#### Interface Configuration + +```{eval-rst} +.. cfgcmd:: set protocols isis interface circuit-type + + + This command specifies circuit type for interface: + + * **level-1** - Level-1 only adjacencies are formed. + * **level-1-2** - Level-1-2 adjacencies are formed + * **level-2-only** - Level-2 only adjacencies are formed +``` + +```{eval-rst} +.. cfgcmd:: set protocols isis interface hello-interval + + + This command sets hello interval in seconds on a given interface. + The range is 1 to 600. +``` + +```{eval-rst} +.. cfgcmd:: set protocols isis interface hello-multiplier + + + This command sets multiplier for hello holding time on a given + interface. The range is 2 to 100. +``` + +```{eval-rst} +.. cfgcmd:: set protocols isis interface hello-padding + + This command configures padding on hello packets to accommodate asymmetrical + maximum transfer units (MTUs) from different hosts as described in + {rfc}`3719`. This helps to prevent a premature adjacency Up state when one + routing devices MTU does not meet the requirements to establish the adjacency. +``` + +```{eval-rst} +.. cfgcmd:: set protocols isis interface metric + + This command set default metric for circuit. + + The metric range is 1 to 16777215 (Max value depend if metric support narrow + or wide value). +``` + +```{eval-rst} +.. cfgcmd:: set protocols isis interface network + point-to-point + + This command specifies network type to Point-to-Point. The default + network type is broadcast. +``` + +```{eval-rst} +.. cfgcmd:: set protocols isis interface passive + + This command configures the passive mode for this interface. +``` + +```{eval-rst} +.. cfgcmd:: set protocols isis interface password + plaintext-password + + This command configures the authentication password for the interface. +``` + +```{eval-rst} +.. cfgcmd:: set protocols isis interface priority + + This command sets priority for the interface for + {abbr}`DIS (Designated Intermediate System)` election. The priority + range is 0 to 127. +``` + +```{eval-rst} +.. cfgcmd:: set protocols isis interface psnp-interval + + + This command sets PSNP interval in seconds. The interval range is 0 + to 127. +``` + +```{eval-rst} +.. cfgcmd:: set protocols isis interface + no-three-way-handshake + + This command disables Three-Way Handshake for P2P adjacencies which + described in {rfc}`5303`. Three-Way Handshake is enabled by default. +``` + +```{eval-rst} +.. cfgcmd:: set protocols isis interface ldp-sync disable + + This command disables IGP-LDP sync for this specific interface. +``` + +```{eval-rst} +.. cfgcmd:: set protocols isis interface ldp-sync holddown + + + This command will change the hold down value for IGP-LDP synchronization + during convergence/interface flap events, but for this interface only. +``` + +#### Route Redistribution + +```{eval-rst} +.. cfgcmd:: set protocols isis redistribute ipv4 level-1 + + This command redistributes routing information from the given route source + into the ISIS database as Level-1. There are six modes available for route + source: bgp, connected, kernel, ospf, rip, static. +``` + +```{eval-rst} +.. cfgcmd:: set protocols isis redistribute ipv4 level-2 + + This command redistributes routing information from the given route source + into the ISIS database as Level-2. There are six modes available for route + source: bgp, connected, kernel, ospf, rip, static. +``` + +```{eval-rst} +.. cfgcmd:: set protocols isis redistribute ipv4 + metric + + This command specifies metric for redistributed routes from the given route + source. There are six modes available for route source: bgp, connected, + kernel, ospf, rip, static. The metric range is 1 to 16777215. +``` + +```{eval-rst} +.. cfgcmd:: set protocols isis redistribute ipv4 + route-map + + This command allows to use route map to filter redistributed routes from + the given route source. There are six modes available for route source: + bgp, connected, kernel, ospf, rip, static. + +``` + +#### Timers + +```{eval-rst} +.. cfgcmd:: set protocols isis lsp-gen-interval + + This command sets minimum interval in seconds between regenerating same + LSP. The interval range is 1 to 120. +``` + +```{eval-rst} +.. cfgcmd:: set protocols isis lsp-refresh-interval + + This command sets LSP refresh interval in seconds. IS-IS generates LSPs + when the state of a link changes. However, to ensure that routing + databases on all routers remain converged, LSPs in stable networks are + generated on a regular basis even though there has been no change to + the state of the links. The interval range is 1 to 65235. The default + value is 900 seconds. +``` + +```{eval-rst} +.. cfgcmd:: set protocols isis max-lsp-lifetime + + This command sets LSP maximum LSP lifetime in seconds. The interval range + is 350 to 65535. LSPs remain in a database for 1200 seconds by default. + If they are not refreshed by that time, they are deleted. You can change + the LSP refresh interval or the LSP lifetime. The LSP refresh interval + should be less than the LSP lifetime or else LSPs will time out before + they are refreshed. +``` + +```{eval-rst} +.. cfgcmd:: set protocols isis spf-interval + + This command sets minimum interval between consecutive SPF calculations in + seconds.The interval range is 1 to 120. +``` + +```{eval-rst} +.. cfgcmd:: set protocols isis spf-delay-ietf holddown +``` + +```{eval-rst} +.. cfgcmd:: set protocols isis spf-delay-ietf init-delay + +``` + +```{eval-rst} +.. cfgcmd:: set protocols isis spf-delay-ietf long-delay + +``` + +```{eval-rst} +.. cfgcmd:: set protocols isis spf-delay-ietf short-delay + +``` + +```{eval-rst} +.. cfgcmd:: set protocols isis spf-delay-ietf time-to-learn + + + This commands specifies the Finite State Machine (FSM) intended to + control the timing of the execution of SPF calculations in response + to IGP events. The process described in {rfc}`8405`. + +``` + +## Examples + +### Enable IS-IS + +**Node 1:** + +```none +set interfaces loopback lo address '192.168.255.255/32' +set interfaces ethernet eth1 address '192.0.2.1/24' + +set protocols isis interface eth1 +set protocols isis interface lo +set protocols isis net '49.0001.1921.6825.5255.00' +``` + +**Node 2:** + +```none +set interfaces ethernet eth1 address '192.0.2.2/24' + +set interfaces loopback lo address '192.168.255.254/32' +set interfaces ethernet eth1 address '192.0.2.2/24' + +set protocols isis interface eth1 +set protocols isis interface lo +set protocols isis net '49.0001.1921.6825.5254.00' +``` + +This gives us the following neighborships, Level 1 and Level 2: + +```none +Node-1@vyos:~$ show isis neighbor +Area VyOS: + System Id Interface L State Holdtime SNPA + vyos eth1 1 Up 28 0c87.6c09.0001 + vyos eth1 2 Up 28 0c87.6c09.0001 + +Node-2@vyos:~$ show isis neighbor +Area VyOS: + System Id Interface L State Holdtime SNPA + vyos eth1 1 Up 29 0c33.0280.0001 + vyos eth1 2 Up 28 0c33.0280.0001 +``` + +Here's the IP routes that are populated. Just the loopback: + +```none +Node-1@vyos:~$ show ip route isis +Codes: K - kernel route, C - connected, S - static, R - RIP, + O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP, + T - Table, v - VNC, V - VNC-Direct, A - Babel, F - PBR, + f - OpenFabric, + > - selected route, * - FIB route, q - queued, r - rejected, b - backup + t - trapped, o - offload failure + +I 192.0.2.0/24 [115/20] via 192.0.2.2, eth1 inactive, weight 1, 00:02:22 +I>* 192.168.255.254/32 [115/20] via 192.0.2.2, eth1, weight 1, 00:02:22 + +Node-2@vyos:~$ show ip route isis +Codes: K - kernel route, C - connected, S - static, R - RIP, + O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP, + T - Table, v - VNC, V - VNC-Direct, A - Babel, F - PBR, + f - OpenFabric, + > - selected route, * - FIB route, q - queued, r - rejected, b - backup + t - trapped, o - offload failure + +I 192.0.2.0/24 [115/20] via 192.0.2.1, eth1 inactive, weight 1, 00:02:21 +I>* 192.168.255.255/32 [115/20] via 192.0.2.1, eth1, weight 1, 00:02:21 +``` + +### Enable IS-IS and redistribute routes not natively in IS-IS + +**Node 1:** + +```none +set interfaces dummy dum0 address '203.0.113.1/24' +set interfaces ethernet eth1 address '192.0.2.1/24' + +set policy prefix-list EXPORT-ISIS rule 10 action 'permit' +set policy prefix-list EXPORT-ISIS rule 10 prefix '203.0.113.0/24' +set policy route-map EXPORT-ISIS rule 10 action 'permit' +set policy route-map EXPORT-ISIS rule 10 match ip address prefix-list 'EXPORT-ISIS' + +set protocols isis interface eth1 +set protocols isis net '49.0001.1921.6800.1002.00' +set protocols isis redistribute ipv4 connected level-2 route-map 'EXPORT-ISIS' +``` + +**Node 2:** + +```none +set interfaces ethernet eth1 address '192.0.2.2/24' + +set protocols isis interface eth1 +set protocols isis net '49.0001.1921.6800.2002.00' +``` + +Routes on Node 2: + +```none +Node-2@r2:~$ show ip route isis +Codes: K - kernel route, C - connected, S - static, R - RIP, + O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP, + T - Table, v - VNC, V - VNC-Direct, A - Babel, D - SHARP, + F - PBR, f - OpenFabric, + > - selected route, * - FIB route, q - queued route, r - rejected route + +I 203.0.113.0/24 [115/10] via 192.0.2.1, eth1, 00:03:42 +``` + +### Enable IS-IS and IGP-LDP synchronization + +**Node 1:** + +```none +set interfaces loopback lo address 192.168.255.255/32 +set interfaces ethernet eth0 address 192.0.2.1/24 + +set protocols isis interface eth0 +set protocols isis interface lo passive +set protocols isis ldp-sync +set protocols isis net 49.0001.1921.6825.5255.00 + +set protocols mpls interface eth0 +set protocols mpls ldp discovery transport-ipv4-address 192.168.255.255 +set protocols mpls ldp interface lo +set protocols mpls ldp interface eth0 +set protocols mpls ldp parameters transport-prefer-ipv4 +set protocols mpls ldp router-id 192.168.255.255 +``` + +This gives us IGP-LDP synchronization for all non-loopback interfaces with +a holddown timer of zero seconds: + +```none +Node-1@vyos:~$ show isis mpls ldp-sync +eth0 + LDP-IGP Synchronization enabled: yes + holddown timer in seconds: 0 + State: Sync achieved +``` + +### Enable IS-IS with Segment Routing (Experimental) + +**Node 1:** + +```none +set interfaces loopback lo address '192.168.255.255/32' +set interfaces ethernet eth1 address '192.0.2.1/24' + +set protocols isis interface eth1 +set protocols isis interface lo +set protocols isis net '49.0001.1921.6825.5255.00' +set protocols isis segment-routing global-block high-label-value '599' +set protocols isis segment-routing global-block low-label-value '550' +set protocols isis segment-routing prefix 192.168.255.255/32 index value '1' +set protocols isis segment-routing prefix 192.168.255.255/32 index explicit-null +set protocols mpls interface 'eth1' +``` + +**Node 2:** + +```none +set interfaces loopback lo address '192.168.255.254/32' +set interfaces ethernet eth1 address '192.0.2.2/24' + +set protocols isis interface eth1 +set protocols isis interface lo +set protocols isis net '49.0001.1921.6825.5254.00' +set protocols isis segment-routing global-block high-label-value '599' +set protocols isis segment-routing global-block low-label-value '550' +set protocols isis segment-routing prefix 192.168.255.254/32 index value '2' +set protocols isis segment-routing prefix 192.168.255.254/32 index explicit-null +set protocols mpls interface 'eth1' +``` + +This gives us MPLS segment routing enabled and labels for far end loopbacks: + +```none +Node-1@vyos:~$ show mpls table + Inbound Label Type Nexthop Outbound Label + ---------------------------------------------------------------------- + 552 SR (IS-IS) 192.0.2.2 IPv4 Explicit Null <-- Node-2 loopback learned on Node-1 + 15000 SR (IS-IS) 192.0.2.2 implicit-null + 15001 SR (IS-IS) fe80::e87:6cff:fe09:1 implicit-null + 15002 SR (IS-IS) 192.0.2.2 implicit-null + 15003 SR (IS-IS) fe80::e87:6cff:fe09:1 implicit-null + +Node-2@vyos:~$ show mpls table + Inbound Label Type Nexthop Outbound Label + --------------------------------------------------------------------- + 551 SR (IS-IS) 192.0.2.1 IPv4 Explicit Null <-- Node-1 loopback learned on Node-2 + 15000 SR (IS-IS) 192.0.2.1 implicit-null + 15001 SR (IS-IS) fe80::e33:2ff:fe80:1 implicit-null + 15002 SR (IS-IS) 192.0.2.1 implicit-null + 15003 SR (IS-IS) fe80::e33:2ff:fe80:1 implicit-null +``` + +Here is the routing tables showing the MPLS segment routing label operations: + +```none +Node-1@vyos:~$ show ip route isis +Codes: K - kernel route, C - connected, S - static, R - RIP, + O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP, + T - Table, v - VNC, V - VNC-Direct, A - Babel, F - PBR, + f - OpenFabric, + > - selected route, * - FIB route, q - queued, r - rejected, b - backup + t - trapped, o - offload failure + +I 192.0.2.0/24 [115/20] via 192.0.2.2, eth1 inactive, weight 1, 00:07:48 +I>* 192.168.255.254/32 [115/20] via 192.0.2.2, eth1, label IPv4 Explicit Null, weight 1, 00:03:39 + +Node-2@vyos:~$ show ip route isis +Codes: K - kernel route, C - connected, S - static, R - RIP, + O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP, + T - Table, v - VNC, V - VNC-Direct, A - Babel, F - PBR, + f - OpenFabric, + > - selected route, * - FIB route, q - queued, r - rejected, b - backup + t - trapped, o - offload failure + +I 192.0.2.0/24 [115/20] via 192.0.2.1, eth1 inactive, weight 1, 00:07:46 +I>* 192.168.255.255/32 [115/20] via 192.0.2.1, eth1, label IPv4 Explicit Null, weight 1, 00:03:43 +``` diff --git a/docs/configuration/protocols/isis.rst b/docs/configuration/protocols/isis.rst deleted file mode 100644 index 18a7c166..00000000 --- a/docs/configuration/protocols/isis.rst +++ /dev/null @@ -1,547 +0,0 @@ -.. include:: /_include/need_improvement.txt - -.. _routing-isis: - -##### -IS-IS -##### - -:abbr:`IS-IS (Intermediate System to Intermediate System)` is a link-state -interior gateway protocol (IGP) which is described in ISO10589, -:rfc:`1195`, :rfc:`5308`. IS-IS runs the Dijkstra shortest-path first (SPF) -algorithm to create a database of the network’s topology, and -from that database to determine the best (that is, lowest cost) path to a -destination. The intermediate systems (the name for routers) exchange topology -information with their directly conencted neighbors. IS-IS runs directly on -the data link layer (Layer 2). IS-IS addresses are called -:abbr:`NETs (Network Entity Titles)` and can be 8 to 20 bytes long, but are -generally 10 bytes long. The tree database that is created with IS-IS is -similar to the one that is created with OSPF in that the paths chosen should -be similar. Comparisons to OSPF are inevitable and often are reasonable ones -to make in regards to the way a network will respond with either IGP. - -******* -General -******* - -Configuration -============= - -Mandatory Settings ------------------- - -For IS-IS top operate correctly, one must do the equivalent of a Router ID in -CLNS. This Router ID is called the :abbr:`NET (Network Entity Title)`. This -must be unique for each and every router that is operating in IS-IS. It also -must not be duplicated otherwise the same issues that occur within OSPF will -occur within IS-IS when it comes to said duplication. - - -.. cfgcmd:: set protocols isis net - - This commad sets network entity title (NET) provided in ISO format. - - Here is an example :abbr:`NET (Network Entity Title)` value: - - .. code-block:: none - - 49.0001.1921.6800.1002.00 - - The CLNS address consists of the following parts: - - * :abbr:`AFI (Address family authority identifier)` - ``49`` The AFI value - 49 is what IS-IS uses for private addressing. - - * Area identifier: ``0001`` IS-IS area number (numberical area ``1``) - - * System identifier: ``1921.6800.1002`` - for system idetifiers we recommend - to use IP address or MAC address of the router itself. The way to construct - this is to keep all of the zeroes of the router IP address, and then change - the periods from being every three numbers to every four numbers. The - address that is listed here is ``192.168.1.2``, which if expanded will turn - into ``192.168.001.002``. Then all one has to do is move the dots to have - four numbers instead of three. This gives us ``1921.6800.1002``. - - * :abbr:`NET (Network Entity Title)` selector: ``00`` Must always be 00. This - setting indicates "this system" or "local system." - -.. cfgcmd:: set protocols isis interface - - This command enables IS-IS on this interface, and allows for - adjacency to occur. Note that the name of IS-IS instance must be - the same as the one used to configure the IS-IS process. - -IS-IS Global Configuration --------------------------- - -.. cfgcmd:: set protocols isis dynamic-hostname - - This command enables support for dynamic hostname TLV. Dynamic hostname - mapping determined as described in :rfc:`2763`, Dynamic Hostname - Exchange Mechanism for IS-IS. - -.. cfgcmd:: set protocols isis level - - This command defines the IS-IS router behavior: - - * **level-1** - Act as a station (Level 1) router only. - * **level-1-2** - Act as a station (Level 1) router and area (Level 2) router. - * **level-2-only** - Act as an area (Level 2) router only. - -.. cfgcmd:: set protocols isis lsp-mtu - - This command configures the maximum size of generated - :abbr:`LSPs (Link State PDUs)`, in bytes. The size range is 128 to 4352. - -.. cfgcmd:: set protocols isis metric-style - - This command sets old-style (ISO 10589) or new style packet formats: - - * **narrow** - Use old style of TLVs with narrow metric. - * **transition** - Send and accept both styles of TLVs during transition. - * **wide** - Use new style of TLVs to carry wider metric. - -.. cfgcmd:: set protocols isis purge-originator - - This command enables :rfc:`6232` purge originator identification. Enable - purge originator identification (POI) by adding the type, length and value - (TLV) with the Intermediate System (IS) identification to the LSPs that do - not contain POI information. If an IS generates a purge, VyOS adds this TLV - with the system ID of the IS to the purge. - -.. cfgcmd:: set protocols isis set-attached-bit - - This command sets ATT bit to 1 in Level1 LSPs. It is described in :rfc:`3787`. - -.. cfgcmd:: set protocols isis set-overload-bit - - This command sets overload bit to avoid any transit traffic through this - router. It is described in :rfc:`3787`. - -.. cfgcmd:: set protocols isis name default-information originate - level-1 - - This command will generate a default-route in L1 database. - -.. cfgcmd:: set protocols isis name default-information originate - level-2 - - This command will generate a default-route in L2 database. - - -.. cfgcmd:: set protocols isis ldp-sync - - This command will enable IGP-LDP synchronization globally for ISIS. This - requires for LDP to be functional. This is described in :rfc:`5443`. By - default all interfaces operational in IS-IS are enabled for synchronization. - Loopbacks are exempt. - -.. cfgcmd:: set protocols isis ldp-sync holddown - - This command will change the hold down value globally for IGP-LDP - synchronization during convergence/interface flap events. - - -Interface Configuration ------------------------ - -.. cfgcmd:: set protocols isis interface circuit-type - - - This command specifies circuit type for interface: - - * **level-1** - Level-1 only adjacencies are formed. - * **level-1-2** - Level-1-2 adjacencies are formed - * **level-2-only** - Level-2 only adjacencies are formed - -.. cfgcmd:: set protocols isis interface hello-interval - - - This command sets hello interval in seconds on a given interface. - The range is 1 to 600. - -.. cfgcmd:: set protocols isis interface hello-multiplier - - - This command sets multiplier for hello holding time on a given - interface. The range is 2 to 100. - -.. cfgcmd:: set protocols isis interface hello-padding - - This command configures padding on hello packets to accommodate asymmetrical - maximum transfer units (MTUs) from different hosts as described in - :rfc:`3719`. This helps to prevent a premature adjacency Up state when one - routing devices MTU does not meet the requirements to establish the adjacency. - -.. cfgcmd:: set protocols isis interface metric - - This command set default metric for circuit. - - The metric range is 1 to 16777215 (Max value depend if metric support narrow - or wide value). - -.. cfgcmd:: set protocols isis interface network - point-to-point - - This command specifies network type to Point-to-Point. The default - network type is broadcast. - -.. cfgcmd:: set protocols isis interface passive - - This command configures the passive mode for this interface. - -.. cfgcmd:: set protocols isis interface password - plaintext-password - - This command configures the authentication password for the interface. - -.. cfgcmd:: set protocols isis interface priority - - This command sets priority for the interface for - :abbr:`DIS (Designated Intermediate System)` election. The priority - range is 0 to 127. - -.. cfgcmd:: set protocols isis interface psnp-interval - - - This command sets PSNP interval in seconds. The interval range is 0 - to 127. - -.. cfgcmd:: set protocols isis interface - no-three-way-handshake - - This command disables Three-Way Handshake for P2P adjacencies which - described in :rfc:`5303`. Three-Way Handshake is enabled by default. - -.. cfgcmd:: set protocols isis interface ldp-sync disable - - This command disables IGP-LDP sync for this specific interface. - -.. cfgcmd:: set protocols isis interface ldp-sync holddown - - - This command will change the hold down value for IGP-LDP synchronization - during convergence/interface flap events, but for this interface only. - -Route Redistribution --------------------- - -.. cfgcmd:: set protocols isis redistribute ipv4 level-1 - - This command redistributes routing information from the given route source - into the ISIS database as Level-1. There are six modes available for route - source: bgp, connected, kernel, ospf, rip, static. - -.. cfgcmd:: set protocols isis redistribute ipv4 level-2 - - This command redistributes routing information from the given route source - into the ISIS database as Level-2. There are six modes available for route - source: bgp, connected, kernel, ospf, rip, static. - -.. cfgcmd:: set protocols isis redistribute ipv4 - metric - - This command specifies metric for redistributed routes from the given route - source. There are six modes available for route source: bgp, connected, - kernel, ospf, rip, static. The metric range is 1 to 16777215. - -.. cfgcmd:: set protocols isis redistribute ipv4 - route-map - - This command allows to use route map to filter redistributed routes from - the given route source. There are six modes available for route source: - bgp, connected, kernel, ospf, rip, static. - - -Timers ------- - -.. cfgcmd:: set protocols isis lsp-gen-interval - - This command sets minimum interval in seconds between regenerating same - LSP. The interval range is 1 to 120. - -.. cfgcmd:: set protocols isis lsp-refresh-interval - - This command sets LSP refresh interval in seconds. IS-IS generates LSPs - when the state of a link changes. However, to ensure that routing - databases on all routers remain converged, LSPs in stable networks are - generated on a regular basis even though there has been no change to - the state of the links. The interval range is 1 to 65235. The default - value is 900 seconds. - -.. cfgcmd:: set protocols isis max-lsp-lifetime - - This command sets LSP maximum LSP lifetime in seconds. The interval range - is 350 to 65535. LSPs remain in a database for 1200 seconds by default. - If they are not refreshed by that time, they are deleted. You can change - the LSP refresh interval or the LSP lifetime. The LSP refresh interval - should be less than the LSP lifetime or else LSPs will time out before - they are refreshed. - -.. cfgcmd:: set protocols isis spf-interval - - This command sets minimum interval between consecutive SPF calculations in - seconds.The interval range is 1 to 120. - -.. cfgcmd:: set protocols isis spf-delay-ietf holddown - -.. cfgcmd:: set protocols isis spf-delay-ietf init-delay - - -.. cfgcmd:: set protocols isis spf-delay-ietf long-delay - - -.. cfgcmd:: set protocols isis spf-delay-ietf short-delay - - -.. cfgcmd:: set protocols isis spf-delay-ietf time-to-learn - - - This commands specifies the Finite State Machine (FSM) intended to - control the timing of the execution of SPF calculations in response - to IGP events. The process described in :rfc:`8405`. - - -******** -Examples -******** - -Enable IS-IS -============ - -**Node 1:** - -.. code-block:: none - - set interfaces loopback lo address '192.168.255.255/32' - set interfaces ethernet eth1 address '192.0.2.1/24' - - set protocols isis interface eth1 - set protocols isis interface lo - set protocols isis net '49.0001.1921.6825.5255.00' - -**Node 2:** - -.. code-block:: none - - set interfaces ethernet eth1 address '192.0.2.2/24' - - set interfaces loopback lo address '192.168.255.254/32' - set interfaces ethernet eth1 address '192.0.2.2/24' - - set protocols isis interface eth1 - set protocols isis interface lo - set protocols isis net '49.0001.1921.6825.5254.00' - - - -This gives us the following neighborships, Level 1 and Level 2: - -.. code-block:: none - - Node-1@vyos:~$ show isis neighbor - Area VyOS: - System Id Interface L State Holdtime SNPA - vyos eth1 1 Up 28 0c87.6c09.0001 - vyos eth1 2 Up 28 0c87.6c09.0001 - - Node-2@vyos:~$ show isis neighbor - Area VyOS: - System Id Interface L State Holdtime SNPA - vyos eth1 1 Up 29 0c33.0280.0001 - vyos eth1 2 Up 28 0c33.0280.0001 - - - -Here's the IP routes that are populated. Just the loopback: - -.. code-block:: none - - Node-1@vyos:~$ show ip route isis - Codes: K - kernel route, C - connected, S - static, R - RIP, - O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP, - T - Table, v - VNC, V - VNC-Direct, A - Babel, F - PBR, - f - OpenFabric, - > - selected route, * - FIB route, q - queued, r - rejected, b - backup - t - trapped, o - offload failure - - I 192.0.2.0/24 [115/20] via 192.0.2.2, eth1 inactive, weight 1, 00:02:22 - I>* 192.168.255.254/32 [115/20] via 192.0.2.2, eth1, weight 1, 00:02:22 - - Node-2@vyos:~$ show ip route isis - Codes: K - kernel route, C - connected, S - static, R - RIP, - O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP, - T - Table, v - VNC, V - VNC-Direct, A - Babel, F - PBR, - f - OpenFabric, - > - selected route, * - FIB route, q - queued, r - rejected, b - backup - t - trapped, o - offload failure - - I 192.0.2.0/24 [115/20] via 192.0.2.1, eth1 inactive, weight 1, 00:02:21 - I>* 192.168.255.255/32 [115/20] via 192.0.2.1, eth1, weight 1, 00:02:21 - - - -Enable IS-IS and redistribute routes not natively in IS-IS -========================================================== - -**Node 1:** - -.. code-block:: none - - set interfaces dummy dum0 address '203.0.113.1/24' - set interfaces ethernet eth1 address '192.0.2.1/24' - - set policy prefix-list EXPORT-ISIS rule 10 action 'permit' - set policy prefix-list EXPORT-ISIS rule 10 prefix '203.0.113.0/24' - set policy route-map EXPORT-ISIS rule 10 action 'permit' - set policy route-map EXPORT-ISIS rule 10 match ip address prefix-list 'EXPORT-ISIS' - - set protocols isis interface eth1 - set protocols isis net '49.0001.1921.6800.1002.00' - set protocols isis redistribute ipv4 connected level-2 route-map 'EXPORT-ISIS' - -**Node 2:** - -.. code-block:: none - - set interfaces ethernet eth1 address '192.0.2.2/24' - - set protocols isis interface eth1 - set protocols isis net '49.0001.1921.6800.2002.00' - -Routes on Node 2: - -.. code-block:: none - - Node-2@r2:~$ show ip route isis - Codes: K - kernel route, C - connected, S - static, R - RIP, - O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP, - T - Table, v - VNC, V - VNC-Direct, A - Babel, D - SHARP, - F - PBR, f - OpenFabric, - > - selected route, * - FIB route, q - queued route, r - rejected route - - I 203.0.113.0/24 [115/10] via 192.0.2.1, eth1, 00:03:42 - -Enable IS-IS and IGP-LDP synchronization -======================================== - -**Node 1:** - -.. code-block:: none - - set interfaces loopback lo address 192.168.255.255/32 - set interfaces ethernet eth0 address 192.0.2.1/24 - - set protocols isis interface eth0 - set protocols isis interface lo passive - set protocols isis ldp-sync - set protocols isis net 49.0001.1921.6825.5255.00 - - set protocols mpls interface eth0 - set protocols mpls ldp discovery transport-ipv4-address 192.168.255.255 - set protocols mpls ldp interface lo - set protocols mpls ldp interface eth0 - set protocols mpls ldp parameters transport-prefer-ipv4 - set protocols mpls ldp router-id 192.168.255.255 - - -This gives us IGP-LDP synchronization for all non-loopback interfaces with -a holddown timer of zero seconds: - - -.. code-block:: none - - Node-1@vyos:~$ show isis mpls ldp-sync - eth0 - LDP-IGP Synchronization enabled: yes - holddown timer in seconds: 0 - State: Sync achieved - - - - -Enable IS-IS with Segment Routing (Experimental) -================================================ - -**Node 1:** - -.. code-block:: none - - set interfaces loopback lo address '192.168.255.255/32' - set interfaces ethernet eth1 address '192.0.2.1/24' - - set protocols isis interface eth1 - set protocols isis interface lo - set protocols isis net '49.0001.1921.6825.5255.00' - set protocols isis segment-routing global-block high-label-value '599' - set protocols isis segment-routing global-block low-label-value '550' - set protocols isis segment-routing prefix 192.168.255.255/32 index value '1' - set protocols isis segment-routing prefix 192.168.255.255/32 index explicit-null - set protocols mpls interface 'eth1' - -**Node 2:** - -.. code-block:: none - - set interfaces loopback lo address '192.168.255.254/32' - set interfaces ethernet eth1 address '192.0.2.2/24' - - set protocols isis interface eth1 - set protocols isis interface lo - set protocols isis net '49.0001.1921.6825.5254.00' - set protocols isis segment-routing global-block high-label-value '599' - set protocols isis segment-routing global-block low-label-value '550' - set protocols isis segment-routing prefix 192.168.255.254/32 index value '2' - set protocols isis segment-routing prefix 192.168.255.254/32 index explicit-null - set protocols mpls interface 'eth1' - - - -This gives us MPLS segment routing enabled and labels for far end loopbacks: - -.. code-block:: none - - Node-1@vyos:~$ show mpls table - Inbound Label Type Nexthop Outbound Label - ---------------------------------------------------------------------- - 552 SR (IS-IS) 192.0.2.2 IPv4 Explicit Null <-- Node-2 loopback learned on Node-1 - 15000 SR (IS-IS) 192.0.2.2 implicit-null - 15001 SR (IS-IS) fe80::e87:6cff:fe09:1 implicit-null - 15002 SR (IS-IS) 192.0.2.2 implicit-null - 15003 SR (IS-IS) fe80::e87:6cff:fe09:1 implicit-null - - Node-2@vyos:~$ show mpls table - Inbound Label Type Nexthop Outbound Label - --------------------------------------------------------------------- - 551 SR (IS-IS) 192.0.2.1 IPv4 Explicit Null <-- Node-1 loopback learned on Node-2 - 15000 SR (IS-IS) 192.0.2.1 implicit-null - 15001 SR (IS-IS) fe80::e33:2ff:fe80:1 implicit-null - 15002 SR (IS-IS) 192.0.2.1 implicit-null - 15003 SR (IS-IS) fe80::e33:2ff:fe80:1 implicit-null - -Here is the routing tables showing the MPLS segment routing label operations: - -.. code-block:: none - - Node-1@vyos:~$ show ip route isis - Codes: K - kernel route, C - connected, S - static, R - RIP, - O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP, - T - Table, v - VNC, V - VNC-Direct, A - Babel, F - PBR, - f - OpenFabric, - > - selected route, * - FIB route, q - queued, r - rejected, b - backup - t - trapped, o - offload failure - - I 192.0.2.0/24 [115/20] via 192.0.2.2, eth1 inactive, weight 1, 00:07:48 - I>* 192.168.255.254/32 [115/20] via 192.0.2.2, eth1, label IPv4 Explicit Null, weight 1, 00:03:39 - - Node-2@vyos:~$ show ip route isis - Codes: K - kernel route, C - connected, S - static, R - RIP, - O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP, - T - Table, v - VNC, V - VNC-Direct, A - Babel, F - PBR, - f - OpenFabric, - > - selected route, * - FIB route, q - queued, r - rejected, b - backup - t - trapped, o - offload failure - - I 192.0.2.0/24 [115/20] via 192.0.2.1, eth1 inactive, weight 1, 00:07:46 - I>* 192.168.255.255/32 [115/20] via 192.0.2.1, eth1, label IPv4 Explicit Null, weight 1, 00:03:43 diff --git a/docs/configuration/protocols/md-babel.md b/docs/configuration/protocols/md-babel.md deleted file mode 100644 index b169e861..00000000 --- a/docs/configuration/protocols/md-babel.md +++ /dev/null @@ -1,245 +0,0 @@ -(babel)= - -# Babel - -Babel is a modern routing protocol designed to be robust and efficient -both in ordinary wired networks and in wireless mesh networks. -By default, it uses hop-count on wired networks and a variant of ETX -on wireless links, It can be configured to take radio diversity into account -and to automatically compute a link's latency and include it in the metric. -It is defined in {rfc}`8966`. - -Babel a dual stack protocol. -A single Babel instance is able to perform routing for both IPv4 and IPv6. - -## General Configuration - -VyOS does not have a special command to start the Babel process. -The Babel process starts when the first Babel enabled interface is configured. - -```{eval-rst} -.. cfgcmd:: set protocols babel interface - - This command specifies a Babel enabled interface by interface name. Both - the sending and receiving of Babel packets will be enabled on the interface - specified in this command. -``` - -## Optional Configuration - -```{eval-rst} -.. cfgcmd:: set protocols babel parameters diversity - - This command enables routing using radio frequency diversity. - This is highly recommended in networks with many wireless nodes. - - .. note:: If you enable this, you will probably want to - set diversity-factor and channel below. -``` - -```{eval-rst} -.. cfgcmd:: set protocols babel parameters diversity-factor <1-256> - - This command sets the multiplicative factor used for diversity routing, - in units of 1/256; lower values cause diversity to play a more important role - in route selection. - The default it 256, which means that diversity plays no role in route - selection; you will probably want to set that to 128 or less on nodes - with multiple independent radios. -``` - -```{eval-rst} -.. cfgcmd:: set protocols babel parameters resend-delay - - This command specifies the time in milliseconds after which an 'important' - request or update will be resent. The default is 2000 ms. -``` - -```{eval-rst} -.. cfgcmd:: set protocols babel parameters smoothing-half-life - - This command specifies the time constant, in seconds, of the smoothing - algorithm used for implementing hysteresis. - Larger values reduce route oscillation at the cost of very slightly increasing - convergence time. The value 0 disables hysteresis, and is suitable for wired - networks. The default is 4 s. -``` - -## Interfaces Configuration - -```{eval-rst} -.. cfgcmd:: set protocols babel interface type - - This command sets the interface type: - - **auto** – automatically determines the interface type. - **wired** – enables optimisations for wired interfaces. - **wireless** – disables a number of optimisations that are only correct - on wired interfaces. Specifying wireless is always correct, - but may cause slower convergence and extra routing traffic. -``` - -```{eval-rst} -.. cfgcmd:: set protocols babel interface split-horizon - - This command specifies whether to perform split-horizon on the interface. - Specifying no babel split-horizon is always correct, while babel split-horizon - is an optimisation that should only be used on symmetric - and transitive (wired) networks. - - **default** – enable split-horizon on wired interfaces, and disable - split-horizon on wireless interfaces. - **enable** – enable split-horizon on this interfaces. - **disable** – disable split-horizon on this interfaces. -``` - -```{eval-rst} -.. cfgcmd:: set protocols babel interface hello-interval - - This command specifies the time in milliseconds between two scheduled hellos. - On wired links, Babel notices a link failure within two hello intervals; - on wireless links, the link quality value is reestimated at every hello - interval. - The default is 4000 ms. -``` - -```{eval-rst} -.. cfgcmd:: set protocols babel interface update-interval - - This command specifies the time in milliseconds between two scheduled updates. - Since Babel makes extensive use of triggered updates, - this can be set to fairly high values on links with little packet loss. - The default is 20000 ms. -``` - -```{eval-rst} -.. cfgcmd:: set protocols babel interface rxcost <1-65534> - - This command specifies the base receive cost for this interface. - For wireless interfaces, it specifies the multiplier used for computing - the ETX reception cost (default 256); - for wired interfaces, it specifies the cost that will be advertised to - neighbours. -``` - -```{eval-rst} -.. cfgcmd:: set protocols babel interface rtt-decay <1-256> - - This command specifies the decay factor for the exponential moving average - of RTT samples, in units of 1/256. - Higher values discard old samples faster. The default is 42. -``` - -```{eval-rst} -.. cfgcmd:: set protocols babel interface rtt-min - - This command specifies the minimum RTT, in milliseconds, - starting from which we increase the cost to a neighbour. - The additional cost is linear in (rtt - rtt-min). The default is 10 ms. -``` - -```{eval-rst} -.. cfgcmd:: set protocols babel interface rtt-max - - This command specifies the maximum RTT, in milliseconds, above which - we don't increase the cost to a neighbour. The default is 120 ms. - -``` - -```{eval-rst} -.. cfgcmd:: set protocols babel interface max-rtt-penalty - - This command specifies the maximum cost added to a neighbour because of RTT, - i.e. when the RTT is higher or equal than rtt-max. - The default is 150. - Setting it to 0 effectively disables the use of a RTT-based cost. -``` - -```{eval-rst} -.. cfgcmd:: set protocols babel interface enable-timestamps - - This command enables sending timestamps with each Hello and IHU message - in order to compute RTT values. - It is recommended to enable timestamps on tunnel interfaces. -``` - -```{eval-rst} -.. cfgcmd:: set protocols babel interface channel <1-254|interfering|noninterfering> - - This command set the channel number that diversity routing uses for this - interface (see diversity option above). - - **1-254** – interfaces with a channel number interfere with - interfering interfaces and interfaces with the same channel number. - **interfering** – interfering interfaces are assumed to interfere with all other channels except - noninterfering channels. - **noninterfering** – noninterfering interfaces are assumed to only interfere - with themselves. -``` - -## Redistribution Configuration - -```{eval-rst} -.. cfgcmd:: set protocols babel redistribute - - This command redistributes routing information from the given route source - to the Babel process. - - IPv4 route source: bgp, connected, eigrp, isis, kernel, nhrp, ospf, rip, static. - - IPv6 route source: bgp, connected, eigrp, isis, kernel, nhrp, ospfv3, ripng, static. -``` - -```{eval-rst} -.. cfgcmd:: set protocols babel distribute-list access-list - - This command can be used to filter the Babel routes using access lists. - {cfgcmd}`in` and {cfgcmd}`out` this is the direction in which the access - lists are applied. -``` - -```{eval-rst} -.. cfgcmd:: set protocols babel distribute-list interface access-list - - This command allows you apply access lists to a chosen interface to - filter the Babel routes. -``` - -```{eval-rst} -.. cfgcmd:: set protocols babel distribute-list prefix-list - - This command can be used to filter the Babel routes using prefix lists. - {cfgcmd}`in` and {cfgcmd}`out` this is the direction in which the prefix - lists are applied. -``` - -```{eval-rst} -.. cfgcmd:: set protocols babel distribute-list interface prefix-list - - This command allows you apply prefix lists to a chosen interface to - filter the Babel routes. -``` - -## Configuration Example - -Simple Babel configuration using 2 nodes and redistributing connected interfaces. - -**Node 1:** - -```none -set interfaces loopback lo address 10.1.1.1/32 -set interfaces loopback lo address fd12:3456:dead:beef::1/128 -set protocols babel interface eth0 type wired -set protocols babel redistribute ipv4 connected -set protocols babel redistribute ipv6 connected -``` - -**Node 2:** - -```none -set interfaces loopback lo address 10.2.2.2/32 -set interfaces loopback lo address fd12:3456:beef:dead::2/128 -set protocols babel interface eth0 type wired -set protocols babel redistribute ipv4 connected -set protocols babel redistribute ipv6 connected -``` diff --git a/docs/configuration/protocols/md-bfd.md b/docs/configuration/protocols/md-bfd.md deleted file mode 100644 index 13623e03..00000000 --- a/docs/configuration/protocols/md-bfd.md +++ /dev/null @@ -1,205 +0,0 @@ ---- -lastproofread: '2023-01-27' ---- - -```{include} /_include/need_improvement.txt -``` - -(routing-bfd)= - -# BFD - -{abbr}`BFD (Bidirectional Forwarding Detection)` is described and extended by -the following RFCs: {rfc}`5880`, {rfc}`5881` and {rfc}`5883`. - -In the age of very fast networks, a second of unreachability may equal millions of lost packets. -The idea behind BFD is to detect very quickly when a peer is down and take action extremely fast. - -BFD sends lots of small UDP packets very quickly to ensures that the peer is still alive. - -This allows avoiding the timers defined in BGP and OSPF protocol to expires. - -## Configure BFD - -```{cfgcmd} set protocols bfd peer \ - -Set BFD peer IPv4 address or IPv6 address -``` - -```{cfgcmd} set protocols bfd peer \ echo-mode - -Enables the echo transmission mode -``` - -```{cfgcmd} set protocols bfd peer \ multihop - -Allow this BFD peer to not be directly connected -``` - -```{cfgcmd} set protocols bfd peer \ source [address \ | interface \] - -Bind listener to specific interface/address, mandatory for IPv6 -``` - -```{cfgcmd} set protocols bfd peer \ interval echo-interval \<10-60000\> - -The minimal echo receive transmission interval that this system is -capable of handling -``` - -```{cfgcmd} set protocols bfd peer \ interval multiplier \<2-255\> - -Remote transmission interval will be multiplied by this value -``` - -```{cfgcmd} set protocols bfd peer \ interval [receive | transmit] \<10-60000\> - -Interval in milliseconds -``` - -```{cfgcmd} set protocols bfd peer \ shutdown - -Disable a BFD peer -``` - -```{cfgcmd} set protocols bfd peer \ minimum-ttl \<1-254\> - -For multi hop sessions only. Configure the minimum expected TTL for an -incoming BFD control packet. - -This feature serves the purpose of thightening the packet validation -requirements to avoid receiving BFD control packets from other sessions. -``` - -### Enable BFD in BGP - -```{cfgcmd} set protocols bgp neighbor \ bfd - -Enable BFD on a single BGP neighbor -``` - -```{cfgcmd} set protocols bgp peer-group \ bfd - -Enable BFD on a BGP peer group -``` - -### Enable BFD in OSPF - -```{cfgcmd} set protocols ospf interface \ bfd - - Enable BFD for OSPF on an interface - -``` - -```{cfgcmd} set protocols ospfv3 interface \ bfd - -Enable BFD for OSPFv3 on an interface -``` - -### Enable BFD in ISIS - -```{cfgcmd} set protocols isis \ interface \ bfd - -Enable BFD for ISIS on an interface - -``` - -## Operational Commands - -```{opcmd} show bfd peers - - Show all BFD peers - - :::{code-block} none - BFD Peers: - peer 198.51.100.33 vrf default interface eth4.100 - ID: 4182341893 - Remote ID: 12678929647 - Status: up - Uptime: 1 month(s), 16 hour(s), 29 minute(s), 38 second(s) - Diagnostics: ok - Remote diagnostics: ok - Local timers: - Receive interval: 300ms - Transmission interval: 300ms - Echo transmission interval: 50ms - Remote timers: - Receive interval: 300ms - Transmission interval: 300ms - Echo transmission interval: 0ms - - peer 198.51.100.55 vrf default interface eth4.101 - ID: 4618932327 - Remote ID: 3312345688 - Status: up - Uptime: 20 hour(s), 16 minute(s), 19 second(s) - Diagnostics: ok - Remote diagnostics: ok - Local timers: - Receive interval: 300ms - Transmission interval: 300ms - Echo transmission interval: 50ms - Remote timers: - Receive interval: 300ms - Transmission interval: 300ms - Echo transmission interval: 0ms - ::: -``` - -## BFD Static Route Monitoring - - -A monitored static route conditions the installation to the RIB on the BFD -session running state: when BFD session is up the route is installed to RIB, -but when the BFD session is down it is removed from the RIB. - - -### Configuration - -```{cfgcmd} set protocols static route \ next-hop \ bfd profile \ - -Configure a static route for \ using gateway \ -and use the gateway address as BFD peer destination address. -``` - -```{cfgcmd} set protocols static route \ next-hop \ bfd multi-hop source \ profile \ - -Configure a static route for \ using gateway \, -use source address to identify the peer when is multi-hop session -and the gateway address as BFD peer destination address. -``` - -```{cfgcmd} set protocols static route6 \ next-hop \ bfd profile \ - -Configure a static route for \ using gateway \ -and use the gateway address as BFD peer destination address. -``` - -```{cfgcmd} set protocols static route6 \ next-hop \ bfd multi-hop source \ profile \ - -Configure a static route for \ using gateway \, -use source address to identify the peer when is multi-hop session -and the gateway address as BFD peer destination address. -``` - -(bfd-operational-commands)= - -## Operational Commands - -```{opcmd} show bfd static routes - -Showing BFD monitored static routes - -:::{code-block} none -Showing BFD monitored static routes: - - Next hops: - VRF default IPv4 Unicast: - 10.10.13.3/32 peer 192.168.2.3 (status: installed) - 172.16.10.3/32 peer 192.168.10.1 (status: uninstalled) - - VRF default IPv4 Multicast: - - VRF default IPv6 Unicast: -::: -``` \ No newline at end of file diff --git a/docs/configuration/protocols/md-bgp.md b/docs/configuration/protocols/md-bgp.md deleted file mode 100644 index c8f77a6a..00000000 --- a/docs/configuration/protocols/md-bgp.md +++ /dev/null @@ -1,1435 +0,0 @@ -(routing-bgp)= - -# BGP - -{abbr}`BGP (Border Gateway Protocol)` is one of the Exterior Gateway Protocols -and the de facto standard interdomain routing protocol. The latest BGP version -is 4. BGP-4 is described in {rfc}`1771` and updated by {rfc}`4271`. {rfc}`2858` -adds multiprotocol support to BGP. - -VyOS makes use of {abbr}`FRR (Free Range Routing)` and we would like to thank -them for their effort! - -## Basic Concepts - -(bgp-autonomous-systems)= - -### Autonomous Systems - -From {rfc}`1930`: - -> An AS is a connected group of one or more IP prefixes run by one or more -> network operators which has a SINGLE and CLEARLY DEFINED routing policy. - -Each {abbr}`AS (Autonomous System)` has an identifying number associated with it -called an {abbr}`ASN (Autonomous System Number)`. This is a two octet value -ranging in value from 1 to 65535. The AS numbers 64512 through 65535 are defined -as private AS numbers. Private AS numbers must not be advertised on the global -Internet. The 2-byte AS number range has been exhausted. 4-byte AS numbers are -specified in {rfc}`6793`, and provide a pool of 4294967296 AS numbers. - -The {abbr}`ASN (Autonomous System Number)` is one of the essential elements of -BGP. BGP is a distance vector routing protocol, and the AS-Path framework -provides distance vector metric and loop detection to BGP. - -```{eval-rst} -.. cfgcmd:: set protocols bgp system-as - - Set local {abbr}`ASN (Autonomous System Number)` that this router represents. - This is a a mandatory option! -``` - -(bgp-address-families)= - -### Address Families - -Multiprotocol extensions enable BGP to carry routing information for multiple -network layer protocols. BGP supports an Address Family Identifier (AFI) for -IPv4 and IPv6. - -(bgp-route-selection)= - -### Route Selection - -The route selection process used by FRR's BGP implementation uses the following -decision criterion, starting at the top of the list and going towards the -bottom until one of the factors can be used. - -01. **Weight check** - - Prefer higher local weight routes to lower routes. - -02. **Local preference check** - - Prefer higher local preference routes to lower. - -03. **Local route check** - - Prefer local routes (statics, aggregates, redistributed) to received routes. - -04. **AS path length check** - - Prefer shortest hop-count AS_PATHs. - -05. **Origin check** - - Prefer the lowest origin type route. That is, prefer IGP origin routes to - EGP, to Incomplete routes. - -06. **MED check** - - Where routes with a MED were received from the same AS, prefer the route - with the lowest MED. - -07. **External check** - - Prefer the route received from an external, eBGP peer over routes received - from other types of peers. - -08. **IGP cost check** - - Prefer the route with the lower IGP cost. - -09. **Multi-path check** - - If multi-pathing is enabled, then check whether the routes not yet - distinguished in preference may be considered equal. If - {cfgcmd}`bgp bestpath as-path multipath-relax` is set, all such routes are - considered equal, otherwise routes received via iBGP with identical AS_PATHs - or routes received from eBGP neighbours in the same AS are considered equal. - -10. **Already-selected external check** - - Where both routes were received from eBGP peers, then prefer the route - which is already selected. Note that this check is not applied if - {cfgcmd}`bgp bestpath compare-routerid` is configured. This check can - prevent some cases of oscillation. - -11. **Router-ID check** - - Prefer the route with the lowest `router-ID`. If the route has an - `ORIGINATOR_ID` attribute, through iBGP reflection, then that router ID is - used, otherwise the `router-ID` of the peer the route was received from is - used. - -12. **Cluster-List length check** - - The route with the shortest cluster-list length is used. The cluster-list - reflects the iBGP reflection path the route has taken. - -13. **Peer address** - - Prefer the route received from the peer with the higher transport layer - address, as a last-resort tie-breaker. - -(bgp-capability-negotiation)= - -### Capability Negotiation - -When adding IPv6 routing information exchange feature to BGP. There were some -proposals. {abbr}`IETF (Internet Engineering Task Force)` -{abbr}`IDR (Inter Domain Routing)` adopted a proposal called Multiprotocol -Extension for BGP. The specification is described in {rfc}`2283`. The protocol -does not define new protocols. It defines new attributes to existing BGP. When -it is used exchanging IPv6 routing information it is called BGP-4+. When it is -used for exchanging multicast routing information it is called MBGP. - -*bgpd* supports Multiprotocol Extension for BGP. So if a remote peer supports -the protocol, *bgpd* can exchange IPv6 and/or multicast routing information. - -Traditional BGP did not have the feature to detect a remote peer's -capabilities, e.g. whether it can handle prefix types other than IPv4 unicast -routes. This was a big problem using Multiprotocol Extension for BGP in an -operational network. {rfc}`2842` adopted a feature called Capability -Negotiation. *bgpd* use this Capability Negotiation to detect the remote peer's -capabilities. If a peer is only configured as an IPv4 unicast neighbor, *bgpd* -does not send these Capability Negotiation packets (at least not unless other -optional BGP features require capability negotiation). - -By default, FRR will bring up peering with minimal common capability for the -both sides. For example, if the local router has unicast and multicast -capabilities and the remote router only has unicast capability the local router -will establish the connection with unicast only capability. When there are no -common capabilities, FRR sends Unsupported Capability error and then resets the -connection. - -## Configuration - -(bgp-router-configuration)= - -### BGP Router Configuration - -First of all you must configure BGP router with the {abbr}`ASN (Autonomous -System Number)`. The AS number is an identifier for the autonomous system. -The BGP protocol uses the AS number for detecting whether the BGP connection -is internal or external. VyOS does not have a special command to start the BGP -process. The BGP process starts when the first neighbor is configured. - -```{eval-rst} -.. cfgcmd:: set protocols bgp system-as - - Set local autonomous system number that this router represents. This is a - mandatory option! -``` - -#### Peers Configuration - -##### Defining Peers - -```{eval-rst} -.. cfgcmd:: set protocols bgp neighbor remote-as - - - This command creates a new neighbor whose remote-as is . The neighbor - address can be an IPv4 address or an IPv6 address or an interface to use - for the connection. The command is applicable for peer and peer group. -``` - -```{eval-rst} -.. cfgcmd:: set protocols bgp neighbor remote-as - internal - - Create a peer as you would when you specify an ASN, except that if the - peers ASN is different than mine as specified under the {cfgcmd}`protocols - bgp ` command the connection will be denied. -``` - -```{eval-rst} -.. cfgcmd:: set protocols bgp neighbor remote-as - external - - Create a peer as you would when you specify an ASN, except that if the - peers ASN is the same as mine as specified under the {cfgcmd}`protocols - bgp ` command the connection will be denied. -``` - -```{eval-rst} -.. cfgcmd:: set protocols bgp neighbor local-role - [strict] - - BGP roles are defined in RFC {rfc}`9234` and provide an easy way to - add route leak prevention, detection and mitigation. The local Role - value is negotiated with the new BGP Role capability which has a - built-in check of the corresponding value. In case of a mismatch the - new OPEN Roles Mismatch Notification <2, 11> would be sent. - The correct Role pairs are: - - Provider - Customer - - Peer - Peer - - RS-Server - RS-Client - - If {cfgcmd}`strict` is set the BGP session won’t become established - until the BGP neighbor sets local Role on its side. This - configuration parameter is defined in RFC {rfc}`9234` and is used to - enforce the corresponding configuration at your counter-parts side. - - Routes that are sent from provider, rs-server, or the peer local-role - (or if received by customer, rs-client, or the peer local-role) will - be marked with a new Only to Customer (OTC) attribute. - - Routes with this attribute can only be sent to your neighbor if your - local-role is provider or rs-server. Routes with this attribute can - be received only if your local-role is customer or rs-client. - - In case of peer-peer relationship routes can be received only if OTC - value is equal to your neighbor AS number. - - All these rules with OTC will help to detect and mitigate route leaks - and happen automatically if local-role is set. -``` - -```{eval-rst} -.. cfgcmd:: set protocols bgp neighbor shutdown - - This command disable the peer or peer group. To reenable the peer use - the delete form of this command. -``` - -```{eval-rst} -.. cfgcmd:: set protocols bgp neighbor description - - - Set description of the peer or peer group. -``` - -```{eval-rst} -.. cfgcmd:: set protocols bgp neighbor update-source - - - Specify the IPv4 source address to use for the BGP session to this neighbor, - may be specified as either an IPv4 address directly or as an interface name. -``` - -(bgp-capability-negotiation-1)= - -##### Capability Negotiation - -```{eval-rst} -.. cfgcmd:: set protocols bgp neighbor capability - dynamic - - This command would allow the dynamic update of capabilities over an - established BGP session. -``` - -```{eval-rst} -.. cfgcmd:: set protocols bgp neighbor capability - extended-nexthop - - Allow bgp to negotiate the extended-nexthop capability with it’s peer. - If you are peering over a IPv6 Link-Local address then this capability - is turned on automatically. If you are peering over a IPv6 Global Address - then turning on this command will allow BGP to install IPv4 routes with - IPv6 nexthops if you do not have IPv4 configured on interfaces. -``` - -```{eval-rst} -.. cfgcmd:: set protocols bgp neighbor - disable-capability-negotiation - - Suppress sending Capability Negotiation as OPEN message optional - parameter to the peer. This command only affects the peer is - configured other than IPv4 unicast configuration. - - When remote peer does not have capability negotiation feature, - remote peer will not send any capabilities at all. In that case, - bgp configures the peer with configured capabilities. - - You may prefer locally configured capabilities more than the negotiated - capabilities even though remote peer sends capabilities. If the peer is - configured by {cfgcmd}`override-capability`, VyOS ignores received - capabilities then override negotiated capabilities with configured values. - - Additionally you should keep in mind that this feature fundamentally - disables the ability to use widely deployed BGP features. BGP unnumbered, - hostname support, AS4, Addpath, Route Refresh, ORF, Dynamic Capabilities, - and graceful restart. -``` - -```{eval-rst} -.. cfgcmd:: set protocols bgp neighbor - override-capability - - This command allow override the result of Capability Negotiation with - local configuration. Ignore remote peer’s capability value. -``` - -```{eval-rst} -.. cfgcmd:: set protocols bgp neighbor - strict-capability-match - - This command forces strictly compare remote capabilities and local - capabilities. If capabilities are different, send Unsupported Capability - error then reset connection. - - You may want to disable sending Capability Negotiation OPEN message - optional parameter to the peer when remote peer does not implement - Capability Negotiation. Please use {cfgcmd}`disable-capability-negotiation` - command to disable the feature. - -``` - -##### Peer Parameters - -```{eval-rst} -.. cfgcmd:: set protocols bgp neighbor address-family - allowas-in number - - This command accept incoming routes with AS path containing AS - number with the same value as the current system AS. This is - used when you want to use the same AS number in your sites, - but you can’t connect them directly. - - The number parameter (1-10) configures the amount of accepted - occurences of the system AS number in AS path. - - This command is only allowed for eBGP peers. It is not applicable - for peer groups. -``` - -```{eval-rst} -.. cfgcmd:: set protocols bgp neighbor address-family - as-override - - This command override AS number of the originating router with - the local AS number. - - Usually this configuration is used in PEs (Provider Edge) to - replace the incoming customer AS number so the connected CE ( - Customer Edge) can use the same AS number as the other customer - sites. This allows customers of the provider network to use the - same AS number across their sites. - - This command is only allowed for eBGP peers. -``` - -```{eval-rst} -.. cfgcmd:: set protocols bgp neighbor address-family - attribute-unchanged - - This command specifies attributes to be left unchanged for - advertisements sent to a peer or peer group. -``` - -```{eval-rst} -.. cfgcmd:: set protocols bgp neighbor address-family - maximum-prefix - - This command specifies a maximum number of prefixes we can receive - from a given peer. If this number is exceeded, the BGP session - will be destroyed. The number range is 1 to 4294967295. -``` - -```{eval-rst} -.. cfgcmd:: set protocols bgp neighbor address-family - nexthop-self - - This command forces the BGP speaker to report itself as the - next hop for an advertised route it advertised to a neighbor. -``` - -```{eval-rst} -.. cfgcmd:: set protocols bgp neighbor address-family - remove-private-as - - This command removes the private ASN of routes that are advertised - to the configured peer. It removes only private ASNs on routes - advertised to EBGP peers. - - If the AS-Path for the route has only private ASNs, the private - ASNs are removed. - - If the AS-Path for the route has a private ASN between public - ASNs, it is assumed that this is a design choice, and the - private ASN is not removed. -``` - -```{eval-rst} -.. cfgcmd:: set protocols bgp neighbor address-family - soft-reconfiguration inbound - - Changes in BGP policies require the BGP session to be cleared. Clearing has a - large negative impact on network operations. Soft reconfiguration enables you - to generate inbound updates from a neighbor, change and activate BGP policies - without clearing the BGP session. - - This command specifies that route updates received from this neighbor will be - stored unmodified, regardless of the inbound policy. When inbound soft - reconfiguration is enabled, the stored updates are processed by the new - policy configuration to create new inbound updates. - - .. note:: Storage of route updates uses memory. If you enable soft - reconfiguration inbound for multiple neighbors, the amount of memory used - can become significant. -``` - -```{eval-rst} -.. cfgcmd:: set protocols bgp neighbor address-family - weight - - This command specifies a default weight value for the neighbor’s - routes. The number range is 1 to 65535. -``` - -```{eval-rst} -.. cfgcmd:: set protocols bgp neighbor - advertisement-interval - - This command specifies the minimum route advertisement interval for - the peer. The interval value is 0 to 600 seconds, with the default - advertisement interval being 0. -``` - -```{eval-rst} -.. cfgcmd:: set protocols bgp neighbor - disable-connected-check - - This command allows peerings between directly connected eBGP peers - using loopback addresses without adjusting the default TTL of 1. -``` - -```{eval-rst} -.. cfgcmd:: set protocols bgp neighbor - disable-send-community - - This command specifies that the community attribute should not be sent - in route updates to a peer. By default community attribute is sent. -``` - -```{eval-rst} -.. cfgcmd:: set protocols bgp neighbor ebgp-multihop - - - This command allows sessions to be established with eBGP neighbors - when they are multiple hops away. When the neighbor is not directly - connected and this knob is not enabled, the session will not establish. - The number of hops range is 1 to 255. This command is mutually - exclusive with {cfgcmd}`ttl-security hops`. -``` - -```{eval-rst} -.. cfgcmd:: set protocols bgp neighbor local-as - [no-prepend] [replace-as] - - Specify an alternate AS for this BGP process when interacting with - the specified peer or peer group. With no modifiers, the specified - local-as is prepended to the received AS_PATH when receiving routing - updates from the peer, and prepended to the outgoing AS_PATH (after - the process local AS) when transmitting local routes to the peer. - - If the {cfgcmd}`no-prepend` attribute is specified, then the supplied - local-as is not prepended to the received AS_PATH. - - If the {cfgcmd}`replace-as` attribute is specified, then only the supplied - local-as is prepended to the AS_PATH when transmitting local-route - updates to this peer. - - .. note:: This command is only allowed for eBGP peers. -``` - -```{eval-rst} -.. cfgcmd:: set protocols bgp neighbor passive - - Configures the BGP speaker so that it only accepts inbound connections - from, but does not initiate outbound connections to the peer or peer group. -``` - -```{eval-rst} -.. cfgcmd:: set protocols bgp neighbor password - - - This command specifies a MD5 password to be used with the tcp socket that - is being used to connect to the remote peer. -``` - -```{eval-rst} -.. cfgcmd:: set protocols bgp neighbor ttl-security - hops - - This command enforces Generalized TTL Security Mechanism (GTSM), - as specified in {rfc}`5082`. With this command, only neighbors - that are specified number of hops away will be allowed to - become neighbors. The number of hops range is 1 to 254. This - command is mutually exclusive with {cfgcmd}`ebgp-multihop`. - -``` - -##### Peer Groups - -Peer groups are used to help improve scaling by generating the same update -information to all members of a peer group. Note that this means that the -routes generated by a member of a peer group will be sent back to that -originating peer with the originator identifier attribute set to indicated -the originating peer. All peers not associated with a specific peer group -are treated as belonging to a default peer group, and will share updates. - -```{eval-rst} -.. cfgcmd:: set protocols bgp peer-group - - This command defines a new peer group. You can specify to the group the same - parameters that you can specify for specific neighbors. - - .. note:: If you apply a parameter to an individual neighbor IP address, you - override the action defined for a peer group that includes that IP - address. -``` - -```{eval-rst} -.. cfgcmd:: set protocols bgp neighbor peer-group - - - This command bind specific peer to peer group with a given name. - -``` - -#### Network Advertisement Configuration - -```{eval-rst} -.. cfgcmd:: set protocols bgp address-family - network - - This command is used for advertising IPv4 or IPv6 networks. - - .. note:: By default, the BGP prefix is advertised even if it's not present - in the routing table. This behaviour differs from the implementation of - some vendors. -``` - -```{eval-rst} -.. cfgcmd:: set protocols bgp parameters network-import-check - - This configuration modifies the behavior of the network statement. If you - have this configured the underlying network must exist in the routing table. -``` - -```{eval-rst} -.. cfgcmd:: set protocols bgp neighbor address-family - default-originate [route-map ] - - By default, VyOS does not advertise a default route (0.0.0.0/0) even if it is - in routing table. When you want to announce default routes to the peer, use - this command. Using optional argument {cfgcmd}`route-map` you can inject the - default route to given neighbor only if the conditions in the route map are - met. - -``` - -#### Route Aggregation Configuration - -```{eval-rst} -.. cfgcmd:: set protocols bgp address-family - aggregate-address - - This command specifies an aggregate address. The router will also - announce longer-prefixes inside of the aggregate address. -``` - -```{eval-rst} -.. cfgcmd:: set protocols bgp address-family - aggregate-address as-set - - This command specifies an aggregate address with a mathematical set of - autonomous systems. This command summarizes the AS_PATH attributes of - all the individual routes. -``` - -```{eval-rst} -.. cfgcmd:: set protocols bgp address-family - aggregate-address summary-only - - This command specifies an aggregate address and provides that - longer-prefixes inside of the aggregate address are suppressed - before sending BGP updates out to peers. -``` - -```{eval-rst} -.. cfgcmd:: set protocols bgp neighbor address-family - unsuppress-map - - This command applies route-map to selectively unsuppress prefixes - suppressed by summarisation. - -``` - -#### Redistribution Configuration - -```{eval-rst} -.. cfgcmd:: set protocols bgp address-family - redistribute - - This command redistributes routing information from the given route source - to the BGP process. There are six modes available for route source: - connected, kernel, ospf, rip, static, table. -``` - -```{eval-rst} -.. cfgcmd:: set protocols bgp address-family - redistribute metric - - This command specifies metric (MED) for redistributed routes. The - metric range is 0 to 4294967295. There are six modes available for - route source: connected, kernel, ospf, rip, static, table. -``` - -```{eval-rst} -.. cfgcmd:: set protocols bgp address-family - redistribute route-map - - This command allows to use route map to filter redistributed routes. - There are six modes available for route source: connected, kernel, - ospf, rip, static, table. - -``` - -#### General Configuration - -##### Common parameters - -```{eval-rst} -.. cfgcmd:: set protocols bgp parameters allow-martian-nexthop - - When a peer receives a martian nexthop as part of the NLRI for a route - permit the nexthop to be used as such, instead of rejecting and resetting - the connection. -``` - -```{eval-rst} -.. cfgcmd:: set protocols bgp parameters router-id - - This command specifies the router-ID. If router ID is not specified it will - use the highest interface IP address. -``` - -```{eval-rst} -.. cfgcmd:: set protocols bgp address-family - maximum-paths - - This command defines the maximum number of parallel routes that - the BGP can support. In order for BGP to use the second path, the - following attributes have to match: Weight, Local Preference, AS - Path (both AS number and AS path length), Origin code, MED, IGP - metric. Also, the next hop address for each path must be different. -``` - -```{eval-rst} -.. cfgcmd:: set protocols bgp parameters no-hard-administrative-reset - - Do not send Hard Reset CEASE Notification for "Administrative Reset" - events. When set and Graceful Restart Notification capability is exchanged - between the peers, Graceful Restart procedures apply, and routes will be retained. -``` - -```{eval-rst} -.. cfgcmd:: set protocols bgp parameters log-neighbor-changes - - This command enable logging neighbor up/down changes and reset reason. -``` - -```{eval-rst} -.. cfgcmd:: set protocols bgp parameters no-client-to-client-reflection - - This command disables route reflection between route reflector clients. - By default, the clients of a route reflector are not required to be - fully meshed and the routes from a client are reflected to other clients. - However, if the clients are fully meshed, route reflection is not required. - In this case, use the {cfgcmd}`no-client-to-client-reflection` command - to disable client-to-client reflection. -``` - -```{eval-rst} -.. cfgcmd:: set protocols bgp parameters no-fast-external-failover - - Disable immediate session reset if peer's connected link goes down. -``` - -```{eval-rst} -.. cfgcmd:: set protocols bgp parameters no-ipv6-auto-ra - - By default, FRR sends router advertisement packets when Extended Next Hop is - on or when a connection is established directly using the device name (Unnumbered BGP). - Setting this option prevents FRR from sending router advertisement packets, but could break Unnumbered BGP. -``` - -```{eval-rst} -.. cfgcmd:: set protocols bgp listen range peer-group - - This command is useful if one desires to loosen the requirement for BGP - to have strictly defined neighbors. Specifically what is allowed is for - the local router to listen to a range of IPv4 or IPv6 addresses defined - by a prefix and to accept BGP open messages. When a TCP connection - (and subsequently a BGP open message) from within this range tries to - connect the local router then the local router will respond and connect - with the parameters that are defined within the peer group. One must define - a peer-group for each range that is listed. If no peer-group is defined - then an error will keep you from committing the configuration. -``` - -```{eval-rst} -.. cfgcmd:: set protocols bgp listen limit - - This command goes hand in hand with the listen range command to limit the - amount of BGP neighbors that are allowed to connect to the local router. - The limit range is 1 to 5000. -``` - -```{eval-rst} -.. cfgcmd:: set protocols bgp parameters ebgp-requires-policy - - This command changes the eBGP behavior of FRR. By default FRR enables - {rfc}`8212` functionality which affects how eBGP routes are advertised, - namely no routes are advertised across eBGP sessions without some - sort of egress route-map/policy in place. In VyOS however we have this - RFC functionality disabled by default so that we can preserve backwards - compatibility with older versions of VyOS. With this option one can - enable {rfc}`8212` functionality to operate. -``` - -```{eval-rst} -.. cfgcmd:: set protocols bgp parameters labeled-unicast - - By default, locally advertised prefixes use the implicit-null label to - encode in the outgoing NLRI. - - The following command uses the explicit-null label value for all the - BGP instances. - -``` - -##### Administrative Distance - -```{eval-rst} -.. cfgcmd:: set protocols bgp parameters distance global - - - This command change distance value of BGP. The arguments are the distance - values for external routes, internal routes and local routes respectively. - The distance range is 1 to 255. -``` - -```{eval-rst} -.. cfgcmd:: set protocols bgp parameters distance prefix - distance - - This command sets the administrative distance for a particular route. The - distance range is 1 to 255. - - .. note:: Routes with a distance of 255 are effectively disabled and not - installed into the kernel. - -``` - -##### Timers - -```{eval-rst} -.. cfgcmd:: set protocols bgp timers holdtime - - This command specifies hold-time in seconds. The timer range is - 4 to 65535. The default value is 180 second. If you set value to 0 - VyOS will not hold routes. -``` - -```{eval-rst} -.. cfgcmd:: set protocols bgp timers keepalive - - This command specifies keep-alive time in seconds. The timer - can range from 4 to 65535. The default value is 60 second. - -``` - -##### Route Dampening - -When a route fails, a routing update is sent to withdraw the route from the -network's routing tables. When the route is re-enabled, the change in -availability is also advertised. A route that continually fails and returns -requires a great deal of network traffic to update the network about the -route's status. - -Route dampening wich described in {rfc}`2439` enables you to identify routes -that repeatedly fail and return. If route dampening is enabled, an unstable -route accumulates penalties each time the route fails and returns. If the -accumulated penalties exceed a threshold, the route is no longer advertised. -This is route suppression. Routes that have been suppressed are re-entered -into the routing table only when the amount of their penalty falls below a -threshold. - -A penalty of 1000 is assessed each time the route fails. When the penalties -reach a predefined threshold (suppress-value), the router stops advertising -the route. - -Once a route is assessed a penalty, the penalty is decreased by half each time -a predefined amount of time elapses (half-life-time). When the accumulated -penalties fall below a predefined threshold (reuse-value), the route is -unsuppressed and added back into the BGP routing table. - -No route is suppressed indefinitely. Maximum-suppress-time defines the maximum -time a route can be suppressed before it is re-advertised. - -```{eval-rst} -.. cfgcmd:: set protocols bgp parameters dampening - half-life - - This command defines the amount of time in minutes after - which a penalty is reduced by half. The timer range is - 10 to 45 minutes. -``` - -```{eval-rst} -.. cfgcmd:: set protocols bgp parameters dampening - re-use - - This command defines the accumulated penalty amount at which the - route is re-advertised. The penalty range is 1 to 20000. -``` - -```{eval-rst} -.. cfgcmd:: set protocols bgp parameters dampening - start-suppress-time - - This command defines the accumulated penalty amount at which the - route is suppressed. The penalty range is 1 to 20000. -``` - -```{eval-rst} -.. cfgcmd:: set protocols bgp parameters dampening - max-suppress-time - - This command defines the maximum time in minutes that a route is - suppressed. The timer range is 1 to 255 minutes. - -``` - -#### Route Selection Configuration - -```{eval-rst} -.. cfgcmd:: set protocols bgp parameters always-compare-med - - This command provides to compare the MED on routes, even when they were - received from different neighbouring ASes. Setting this option makes the - order of preference of routes more defined, and should eliminate MED - induced oscillations. -``` - -```{eval-rst} -.. cfgcmd:: set protocols bgp parameters bestpath as-path confed - - This command specifies that the length of confederation path sets and - sequences should be taken into account during the BGP best path - decision process. -``` - -```{eval-rst} -.. cfgcmd:: set protocols bgp parameters bestpath as-path multipath-relax - - This command specifies that BGP decision process should consider paths - of equal AS_PATH length candidates for multipath computation. Without - the knob, the entire AS_PATH must match for multipath computation. -``` - -```{eval-rst} -.. cfgcmd:: set protocols bgp parameters bestpath as-path ignore - - Ignore AS_PATH length when selecting a route -``` - -```{eval-rst} -.. cfgcmd:: set protocols bgp parameters bestpath compare-routerid - - Ensure that when comparing routes where both are equal on most metrics, - including local-pref, AS_PATH length, IGP cost, MED, that the tie is - broken based on router-ID. - - If this option is enabled, then the already-selected check, where - already selected eBGP routes are preferred, is skipped. - - If a route has an ORIGINATOR_ID attribute because it has been reflected, - that ORIGINATOR_ID will be used. Otherwise, the router-ID of the peer - the route was received from will be used. - - The advantage of this is that the route-selection (at this point) will - be more deterministic. The disadvantage is that a few or even one lowest-ID - router may attract all traffic to otherwise-equal paths because of this - check. It may increase the possibility of MED or IGP oscillation, unless - other measures were taken to avoid these. The exact behaviour will be - sensitive to the iBGP and reflection topology. -``` - -```{eval-rst} -.. cfgcmd:: set protocols bgp parameters bestpath med confed - - This command specifies that BGP considers the MED when comparing routes - originated from different sub-ASs within the confederation to which this - BGP speaker belongs. The default state, where the MED attribute is not - considered. -``` - -```{eval-rst} -.. cfgcmd:: set protocols bgp parameters bestpath med missing-as-worst - - This command specifies that a route with a MED is always considered to be - better than a route without a MED by causing the missing MED attribute to - have a value of infinity. The default state, where the missing MED - attribute is considered to have a value of zero. -``` - -```{eval-rst} -.. cfgcmd:: set protocols bgp parameters default local-pref - - - This command specifies the default local preference value. The local - preference range is 0 to 4294967295. -``` - -```{eval-rst} -.. cfgcmd:: set protocols bgp parameters deterministic-med - - This command provides to compare different MED values that advertised by - neighbours in the same AS for routes selection. When this command is - enabled, routes from the same autonomous system are grouped together, and - the best entries of each group are compared. -``` - -```{eval-rst} -.. cfgcmd:: set protocols bgp address-family ipv4-unicast network - backdoor - - This command allows the router to prefer route to specified prefix learned - via IGP through backdoor link instead of a route to the same prefix learned - via EBGP. - -``` - -#### Route Filtering Configuration - -In order to control and modify routing information that is exchanged between -peers you can use route-map, filter-list, prefix-list, distribute-list. - -For inbound updates the order of preference is: - -> - route-map -> - filter-list -> - prefix-list, distribute-list - -For outbound updates the order of preference is: - -> - prefix-list, distribute-list -> - filter-list -> - route-map -> -> :::{note} -> The attributes {cfgcmd}`prefix-list` and {cfgcmd}`distribute-list` -> are mutually exclusive, and only one command (distribute-list or -> prefix-list) can be applied to each inbound or outbound direction for a -> particular neighbor. -> ::: - -```{eval-rst} -.. cfgcmd:: set protocols bgp neighbor address-family - distribute-list - - This command applies the access list filters named in to the - specified BGP neighbor to restrict the routing information that BGP learns - and/or advertises. The arguments {cfgcmd}`export` and {cfgcmd}`import` - specify the direction in which the access list are applied. -``` - -```{eval-rst} -.. cfgcmd:: set protocols bgp neighbor address-family - prefix-list - - This command applies the prfefix list filters named in to the - specified BGP neighbor to restrict the routing information that BGP learns - and/or advertises. The arguments {cfgcmd}`export` and {cfgcmd}`import` - specify the direction in which the prefix list are applied. -``` - -```{eval-rst} -.. cfgcmd:: set protocols bgp neighbor address-family - route-map - - This command applies the route map named in to the specified BGP - neighbor to control and modify routing information that is exchanged - between peers. The arguments {cfgcmd}`export` and {cfgcmd}`import` - specify the direction in which the route map are applied. -``` - -```{eval-rst} -.. cfgcmd:: set protocols bgp neighbor address-family - filter-list - - This command applies the AS path access list filters named in to the - specified BGP neighbor to restrict the routing information that BGP learns - and/or advertises. The arguments {cfgcmd}`export` and {cfgcmd}`import` - specify the direction in which the AS path access list are applied. -``` - -```{eval-rst} -.. cfgcmd:: set protocols bgp neighbor address-family - capability orf - - This command enables the ORF capability (described in {rfc}`5291`) on the - local router, and enables ORF capability advertisement to the specified BGP - peer. The {cfgcmd}`receive` keyword configures a router to advertise ORF - receive capabilities. The {cfgcmd}`send` keyword configures a router to - advertise ORF send capabilities. To advertise a filter from a sender, you - must create an IP prefix list for the specified BGP peer applied in inbound - derection. -``` - -```{eval-rst} -.. cfgcmd:: set protocols bgp neighbor solo - - This command prevents from sending back prefixes learned from the neighbor. -``` - -#### BGP Scaling Configuration - -BGP routers connected inside the same AS through BGP belong to an internal BGP -session, or IBGP. In order to prevent routing table loops, IBGP speaker does -not advertise IBGP-learned routes to other IBGP speaker (Split Horizon -mechanism). As such, IBGP requires a full mesh of all peers. For large -networks, this quickly becomes unscalable. - -There are two ways that help us to mitigate the BGPs full-mesh requirement in -a network: - -> - Using BGP route-reflectors -> - Using BGP confederation - -##### Route Reflector Configuration - -Introducing route reflectors removes the need for the full-mesh. When you -configure a route reflector you have to tell the router whether the other IBGP -router is a client or non-client. A client is an IBGP router that the route -reflector will “reflect” routes to, the non-client is just a regular IBGP -neighbor. Route reflectors mechanism is described in {rfc}`4456` and updated -by {rfc}`7606`. - -```{eval-rst} -.. cfgcmd:: set protocols bgp neighbor
address-family - route-reflector-client - - This command specifies the given neighbor as route reflector client. -``` - -```{eval-rst} -.. cfgcmd:: set protocols bgp parameters cluster-id - - This command specifies cluster ID which identifies a collection of route - reflectors and their clients, and is used by route reflectors to avoid - looping. By default cluster ID is set to the BGP router id value, but can be - set to an arbitrary 32-bit value. - -``` - -##### Confederation Configuration - -A BGP confederation divides our AS into sub-ASes to reduce the number of -required IBGP peerings. Within a sub-AS we still require full-mesh IBGP but -between these sub-ASes we use something that looks like EBGP but behaves like -IBGP (called confederation BGP). Confederation mechanism is described in -{rfc}`5065` - -```{eval-rst} -.. cfgcmd:: set protocols bgp parameters confederation identifier - - - This command specifies a BGP confederation identifier. is the number - of the autonomous system that internally includes multiple sub-autonomous - systems (a confederation). -``` - -```{eval-rst} -.. cfgcmd:: set protocols bgp parameters confederation peers - - This command sets other confederations as members of autonomous - system specified by {cfgcmd}`confederation identifier `. - -``` - -## Operational Mode Commands - -### Show - -```{eval-rst} -.. opcmd:: show bgp - - This command displays all entries in BGP routing table. -``` - -```none -BGP table version is 10, local router ID is 10.0.35.3, vrf id 0 -Default local pref 100, local AS 65000 -Status codes: s suppressed, d damped, h history, * valid, > best, = multipath, - i internal, r RIB-failure, S Stale, R Removed -Nexthop codes: @NNN nexthop's vrf id, < announce-nh-self -Origin codes: i - IGP, e - EGP, ? - incomplete - - Network Next Hop Metric LocPrf Weight Path -*> 198.51.100.0/24 10.0.34.4 0 0 65004 i -*> 203.0.113.0/24 10.0.35.5 0 0 65005 i - -Displayed 2 routes and 2 total paths -``` - -```{eval-rst} -.. opcmd:: show bgp - - This command displays information about the particular entry in the BGP - routing table. -``` - -```none -BGP routing table entry for 198.51.100.0/24 -Paths: (1 available, best #1, table default) - Advertised to non peer-group peers: - 10.0.13.1 10.0.23.2 10.0.34.4 10.0.35.5 - 65004 - 10.0.34.4 from 10.0.34.4 (10.0.34.4) - Origin IGP, metric 0, valid, external, best (First path received) - Last update: Wed Jan 6 12:18:53 2021 -``` - -```{eval-rst} -.. opcmd:: show bgp cidr-only - - This command displays routes with classless interdomain routing (CIDR). -``` - -```{eval-rst} -.. opcmd:: show bgp community - - This command displays routes that belong to specified BGP communities. - Valid value is a community number in the range from 1 to 4294967200, - or AA:NN (autonomous system-community number/2-byte number), no-export, - local-as, or no-advertise. -``` - -```{eval-rst} -.. opcmd:: show bgp community-list - - This command displays routes that are permitted by the BGP - community list. -``` - -```{eval-rst} -.. opcmd:: show bgp dampening dampened-paths - - This command displays BGP dampened routes. -``` - -```{eval-rst} -.. opcmd:: show bgp dampening flap-statistics - - This command displays information about flapping BGP routes. -``` - -```{eval-rst} -.. opcmd:: show bgp filter-list - - This command displays BGP routes allowed by the specified AS Path - access list. -``` - -```{eval-rst} -.. opcmd:: show bgp neighbors
advertised-routes - - This command displays BGP routes advertised to a neighbor. -``` - -```{eval-rst} -.. opcmd:: show bgp neighbors
received-routes - - This command displays BGP routes originating from the specified BGP - neighbor before inbound policy is applied. To use this command inbound - soft reconfiguration must be enabled. -``` - -```{eval-rst} -.. opcmd:: show bgp neighbors
routes - - This command displays BGP received-routes that are accepted after filtering. -``` - -```{eval-rst} -.. opcmd:: show bgp neighbors
dampened-routes - - This command displays dampened routes received from BGP neighbor. -``` - -```{eval-rst} -.. opcmd:: show bgp regexp - - This command displays information about BGP routes whose AS path - matches the specified regular expression. -``` - -```{eval-rst} -.. opcmd:: show bgp summary - - This command displays the status of all BGP connections. -``` - -```none -IPv4 Unicast Summary: -BGP router identifier 10.0.35.3, local AS number 65000 vrf-id 0 -BGP table version 11 -RIB entries 5, using 920 bytes of memory -Peers 4, using 82 KiB of memory - -Neighbor V AS MsgRcvd MsgSent TblVer InQ OutQ Up/Down State/PfxRcd -10.0.13.1 4 65000 148 159 0 0 0 02:16:01 0 -10.0.23.2 4 65000 136 143 0 0 0 02:13:21 0 -10.0.34.4 4 65004 161 163 0 0 0 02:16:01 1 -10.0.35.5 4 65005 162 166 0 0 0 02:16:01 1 - -Total number of neighbors 4 -``` - -### Reset - -```{eval-rst} -.. opcmd:: reset bgp
[soft [in|out]] - - This command resets BGP connections to the specified neighbor IP address. - With argument {cfgcmd}`soft` this command initiates a soft reset. If - you do not specify the {cfgcmd}`in` or {cfgcmd}`out` options, both - inbound and outbound soft reconfiguration are triggered. -``` - -```{eval-rst} -.. opcmd:: reset ip bgp all - - This command resets all BGP connections of given router. -``` - -```{eval-rst} -.. opcmd:: reset bgp external - - This command resets all external BGP peers of given router. -``` - -```{eval-rst} -.. opcmd:: reset bgp peer-group [soft [in|out]] - - This command resets BGP connections to the specified peer group. - With argument {cfgcmd}`soft` this command initiates a soft reset. If - you do not specify the {cfgcmd}`in` or {cfgcmd}`out` options, both - inbound and outbound soft reconfiguration are triggered. - -``` - -## Examples - -### IPv4 peering - -A simple eBGP configuration: - -**Node 1:** - -```none -set protocols bgp system-as 65534 -set protocols bgp neighbor 192.168.0.2 ebgp-multihop '2' -set protocols bgp neighbor 192.168.0.2 remote-as '65535' -set protocols bgp neighbor 192.168.0.2 update-source '192.168.0.1' -set protocols bgp neighbor 192.168.0.2 address-family ipv4-unicast -set protocols bgp address-family ipv4-unicast network '172.16.0.0/16' -set protocols bgp parameters router-id '192.168.0.1' -``` - -**Node 2:** - -```none -set protocols bgp system-as 65535 -set protocols bgp neighbor 192.168.0.1 ebgp-multihop '2' -set protocols bgp neighbor 192.168.0.1 remote-as '65534' -set protocols bgp neighbor 192.168.0.1 update-source '192.168.0.2' -set protocols bgp neighbor 192.168.0.2 address-family ipv4-unicast -set protocols bgp address-family ipv4-unicast network '172.17.0.0/16' -set protocols bgp parameters router-id '192.168.0.2' -``` - -Don't forget, the CIDR declared in the network statement MUST **exist in your -routing table (dynamic or static), the best way to make sure that is true is -creating a static route:** - -**Node 1:** - -```none -set protocols static route 172.16.0.0/16 blackhole distance '254' -``` - -**Node 2:** - -```none -set protocols static route 172.17.0.0/16 blackhole distance '254' -``` - -### IPv6 peering - -A simple BGP configuration via IPv6. - -**Node 1:** - -```none -set protocols bgp system-as 65534 -set protocols bgp neighbor 2001:db8::2 ebgp-multihop '2' -set protocols bgp neighbor 2001:db8::2 remote-as '65535' -set protocols bgp neighbor 2001:db8::2 update-source '2001:db8::1' -set protocols bgp neighbor 2001:db8::2 address-family ipv6-unicast -set protocols bgp address-family ipv6-unicast network '2001:db8:1::/48' -set protocols bgp parameters router-id '10.1.1.1' -``` - -**Node 2:** - -```none -set protocols bgp system-as 65535 -set protocols bgp neighbor 2001:db8::1 ebgp-multihop '2' -set protocols bgp neighbor 2001:db8::1 remote-as '65534' -set protocols bgp neighbor 2001:db8::1 update-source '2001:db8::2' -set protocols bgp neighbor 2001:db8::1 address-family ipv6-unicast -set protocols bgp address-family ipv6-unicast network '2001:db8:2::/48' -set protocols bgp parameters router-id '10.1.1.2' -``` - -Don't forget, the CIDR declared in the network statement **MUST exist in your -routing table (dynamic or static), the best way to make sure that is true is -creating a static route:** - -**Node 1:** - -```none -set protocols static route6 2001:db8:1::/48 blackhole distance '254' -``` - -**Node 2:** - -```none -set protocols static route6 2001:db8:2::/48 blackhole distance '254' -``` - -### Route Filtering - -Route filter can be applied using a route-map: - -**Node1:** - -```none -set policy prefix-list AS65535-IN rule 10 action 'permit' -set policy prefix-list AS65535-IN rule 10 prefix '172.16.0.0/16' -set policy prefix-list AS65535-OUT rule 10 action 'deny' -set policy prefix-list AS65535-OUT rule 10 prefix '172.16.0.0/16' -set policy prefix-list6 AS65535-IN rule 10 action 'permit' -set policy prefix-list6 AS65535-IN rule 10 prefix '2001:db8:2::/48' -set policy prefix-list6 AS65535-OUT rule 10 action 'deny' -set policy prefix-list6 AS65535-OUT rule 10 prefix '2001:db8:2::/48' - -set policy route-map AS65535-IN rule 10 action 'permit' -set policy route-map AS65535-IN rule 10 match ip address prefix-list 'AS65535-IN' -set policy route-map AS65535-IN rule 10 match ipv6 address prefix-list 'AS65535-IN' -set policy route-map AS65535-IN rule 20 action 'deny' -set policy route-map AS65535-OUT rule 10 action 'deny' -set policy route-map AS65535-OUT rule 10 match ip address prefix-list 'AS65535-OUT' -set policy route-map AS65535-OUT rule 10 match ipv6 address prefix-list 'AS65535-OUT' -set policy route-map AS65535-OUT rule 20 action 'permit' - -set protocols bgp system-as 65534 -set protocols bgp neighbor 2001:db8::2 address-family ipv4-unicast route-map export 'AS65535-OUT' -set protocols bgp neighbor 2001:db8::2 address-family ipv4-unicast route-map import 'AS65535-IN' -set protocols bgp neighbor 2001:db8::2 address-family ipv6-unicast route-map export 'AS65535-OUT' -set protocols bgp neighbor 2001:db8::2 address-family ipv6-unicast route-map import 'AS65535-IN' -``` - -**Node2:** - -```none -set policy prefix-list AS65534-IN rule 10 action 'permit' -set policy prefix-list AS65534-IN rule 10 prefix '172.17.0.0/16' -set policy prefix-list AS65534-OUT rule 10 action 'deny' -set policy prefix-list AS65534-OUT rule 10 prefix '172.17.0.0/16' -set policy prefix-list6 AS65534-IN rule 10 action 'permit' -set policy prefix-list6 AS65534-IN rule 10 prefix '2001:db8:1::/48' -set policy prefix-list6 AS65534-OUT rule 10 action 'deny' -set policy prefix-list6 AS65534-OUT rule 10 prefix '2001:db8:1::/48' - -set policy route-map AS65534-IN rule 10 action 'permit' -set policy route-map AS65534-IN rule 10 match ip address prefix-list 'AS65534-IN' -set policy route-map AS65534-IN rule 10 match ipv6 address prefix-list 'AS65534-IN' -set policy route-map AS65534-IN rule 20 action 'deny' -set policy route-map AS65534-OUT rule 10 action 'deny' -set policy route-map AS65534-OUT rule 10 match ip address prefix-list 'AS65534-OUT' -set policy route-map AS65534-OUT rule 10 match ipv6 address prefix-list 'AS65534-OUT' -set policy route-map AS65534-OUT rule 20 action 'permit' - -set protocols bgp system-as 65535 -set protocols bgp neighbor 2001:db8::1 address-family ipv4-unicast route-map export 'AS65534-OUT' -set protocols bgp neighbor 2001:db8::1 address-family ipv4-unicast route-map import 'AS65534-IN' -set protocols bgp neighbor 2001:db8::1 address-family ipv6-unicast route-map export 'AS65534-OUT' -set protocols bgp neighbor 2001:db8::1 address-family ipv6-unicast route-map import 'AS65534-IN' -``` - -We could expand on this and also deny link local and multicast in the rule 20 -action deny. diff --git a/docs/configuration/protocols/md-failover.md b/docs/configuration/protocols/md-failover.md deleted file mode 100644 index 45c3e449..00000000 --- a/docs/configuration/protocols/md-failover.md +++ /dev/null @@ -1,120 +0,0 @@ -# Failover - -Failover routes are manually configured routes, but they only install -to the routing table if the health-check target is alive. -If the target is not alive the route is removed from the routing table -until the target becomes available. - -## Failover Routes - -```{eval-rst} -.. cfgcmd:: set protocols failover route next-hop
check - target - - Configure next-hop `
` and `` for an IPv4 static - route. Specify the target - IPv4 address for health checking. -``` - -```{eval-rst} -.. cfgcmd:: set protocols failover route next-hop
check - timeout - - Timeout in seconds between health target checks. - - Range is 1 to 300, default is 10. -``` - -```{eval-rst} -.. cfgcmd:: set protocols failover route next-hop
check - type - - Defines protocols for checking ARP, ICMP, TCP - - Default is ``icmp``. -``` - -```{eval-rst} -.. cfgcmd:: set protocols failover route next-hop
check - policy - - Policy for checking targets -``` - -- `all-available` all checking target addresses must be available to pass - this check - -- `any-available` any of the checking target addresses must be available - to pass this check - - > Default is `any-available`. - -```{eval-rst} -.. cfgcmd:: set protocols failover route next-hop
- interface - - Next-hop interface for the route -``` - -```{eval-rst} -.. cfgcmd:: set protocols failover route next-hop
- metric - - Route metric - - Default 1. - -``` - -## Example - -**One gateway:** - -```none -set protocols failover route 203.0.113.1/32 next-hop 192.0.2.1 check target '192.0.2.1' -set protocols failover route 203.0.113.1/32 next-hop 192.0.2.1 check timeout '5' -set protocols failover route 203.0.113.1/32 next-hop 192.0.2.1 check type 'icmp' -set protocols failover route 203.0.113.1/32 next-hop 192.0.2.1 interface 'eth0' -set protocols failover route 203.0.113.1/32 next-hop 192.0.2.1 metric '10' -``` - -Show the route - -```none -vyos@vyos:~$ show ip route 203.0.113.1 - Routing entry for 203.0.113.1/32 - Known via "kernel", distance 0, metric 10, best - Last update 00:00:39 ago - * 192.0.2.1, via eth0 -``` - -**Two gateways and different metrics:** - -```none -set protocols failover route 203.0.113.1/32 next-hop 192.0.2.1 check target '192.0.2.1' -set protocols failover route 203.0.113.1/32 next-hop 192.0.2.1 check timeout '5' -set protocols failover route 203.0.113.1/32 next-hop 192.0.2.1 check type 'icmp' -set protocols failover route 203.0.113.1/32 next-hop 192.0.2.1 interface 'eth0' -set protocols failover route 203.0.113.1/32 next-hop 192.0.2.1 metric '10' - -set protocols failover route 203.0.113.1/32 next-hop 198.51.100.1 check target '198.51.100.99' -set protocols failover route 203.0.113.1/32 next-hop 198.51.100.1 check timeout '5' -set protocols failover route 203.0.113.1/32 next-hop 198.51.100.1 check type 'icmp' -set protocols failover route 203.0.113.1/32 next-hop 198.51.100.1 interface 'eth2' -set protocols failover route 203.0.113.1/32 next-hop 198.51.100.1 metric '20' -``` - -Show the route - -```none -vyos@vyos:~$ show ip route 203.0.113.1 -Routing entry for 203.0.113.1/32 - Known via "kernel", distance 0, metric 10, best - Last update 00:08:06 ago - * 192.0.2.1, via eth0 - -Routing entry for 203.0.113.1/32 - Known via "kernel", distance 0, metric 20 - Last update 00:08:14 ago - * 198.51.100.1, via eth2 -``` diff --git a/docs/configuration/protocols/md-igmp-proxy.md b/docs/configuration/protocols/md-igmp-proxy.md deleted file mode 100644 index 961f921b..00000000 --- a/docs/configuration/protocols/md-igmp-proxy.md +++ /dev/null @@ -1,79 +0,0 @@ ---- -lastproofread: '2023-11-13' ---- - -(igmp-proxy)= - -# IGMP Proxy - -{abbr}`IGMP (Internet Group Management Protocol)` proxy sends IGMP host messages -on behalf of a connected client. The configuration must define one, and only one -upstream interface, and one or more downstream interfaces. - -## Configuration - -```{cfgcmd} set protocols igmp-proxy interface \ role \ - -* **upstream:** The upstream network interface is the outgoing interface -which is responsible for communicating to available multicast data sources. -There can only be one upstream interface. - -* **downstream:** Downstream network interfaces are the distribution -interfaces to the destination networks, where multicast clients can join -groups and receive multicast data. One or more downstream interfaces must -be configured. -``` - -```{cfgcmd} set protocols igmp-proxy interface \ alt-subnet \ - -Defines alternate sources for multicasting and IGMP data. The network address -must be on the following format 'a.b.c.d/n'. By default, the router will -accept data from sources on the same network as configured on an interface. -If the multicast source lies on a remote network, one must define from where -traffic should be accepted. - -This is especially useful for the upstream interface, since the source for -multicast traffic is often from a remote location. - -This option can be supplied multiple times. -``` - -```{cfgcmd} set protocols igmp-proxy disable-quickleave - -Disables quickleave mode. In this mode the daemon will not send a Leave IGMP -message upstream as soon as it receives a Leave message for any downstream -interface. The daemon will not ask for Membership reports on the downstream -interfaces, and if a report is received the group is not joined again the -upstream. - -If it's vital that the daemon should act exactly like a real multicast client -on the upstream interface, this function should be enabled. - -Enabling this function increases the risk of bandwidth saturation. -``` - -```{cfgcmd} set protocols igmp-proxy disable - -Disable this service. -``` - -(igmp-proxy-example)= - -### Example - -Interface eth1 LAN is behind NAT. In order to subscribe 10.0.0.0/23 subnet -multicast which is in eth0 WAN we need to configure igmp-proxy. - -```none -set protocols igmp-proxy interface eth0 role upstream -set protocols igmp-proxy interface eth0 alt-subnet 10.0.0.0/23 -set protocols igmp-proxy interface eth1 role downstream -``` - - -## Operation - -```{opcmd} restart igmp-proxy - -Restart the IGMP proxy process. -``` \ No newline at end of file diff --git a/docs/configuration/protocols/md-index.md b/docs/configuration/protocols/md-index.md deleted file mode 100644 index 418e49af..00000000 --- a/docs/configuration/protocols/md-index.md +++ /dev/null @@ -1,22 +0,0 @@ -# Protocols - -```{eval-rst} -.. toctree:: - :maxdepth: 1 - :includehidden: - - babel - bfd - bgp - failover - igmp-proxy - isis - mpls - segment-routing - ospf - pim - pim6 - rip - rpki - static -``` diff --git a/docs/configuration/protocols/md-isis.md b/docs/configuration/protocols/md-isis.md deleted file mode 100644 index 07ffd827..00000000 --- a/docs/configuration/protocols/md-isis.md +++ /dev/null @@ -1,596 +0,0 @@ -```{include} /_include/need_improvement.txt -``` - -(routing-isis)= - -# IS-IS - -{abbr}`IS-IS (Intermediate System to Intermediate System)` is a link-state -interior gateway protocol (IGP) which is described in ISO10589, -{rfc}`1195`, {rfc}`5308`. IS-IS runs the Dijkstra shortest-path first (SPF) -algorithm to create a database of the network’s topology, and -from that database to determine the best (that is, lowest cost) path to a -destination. The intermediate systems (the name for routers) exchange topology -information with their directly conencted neighbors. IS-IS runs directly on -the data link layer (Layer 2). IS-IS addresses are called -{abbr}`NETs (Network Entity Titles)` and can be 8 to 20 bytes long, but are -generally 10 bytes long. The tree database that is created with IS-IS is -similar to the one that is created with OSPF in that the paths chosen should -be similar. Comparisons to OSPF are inevitable and often are reasonable ones -to make in regards to the way a network will respond with either IGP. - -## General - -### Configuration - -#### Mandatory Settings - -For IS-IS top operate correctly, one must do the equivalent of a Router ID in -CLNS. This Router ID is called the {abbr}`NET (Network Entity Title)`. This -must be unique for each and every router that is operating in IS-IS. It also -must not be duplicated otherwise the same issues that occur within OSPF will -occur within IS-IS when it comes to said duplication. - -```{eval-rst} -.. cfgcmd:: set protocols isis net - - This commad sets network entity title (NET) provided in ISO format. - - Here is an example {abbr}`NET (Network Entity Title)` value: - - .. code-block:: none - - 49.0001.1921.6800.1002.00 - - The CLNS address consists of the following parts: - - * {abbr}`AFI (Address family authority identifier)` - ``49`` The AFI value - 49 is what IS-IS uses for private addressing. - - * Area identifier: ``0001`` IS-IS area number (numberical area ``1``) - - * System identifier: ``1921.6800.1002`` - for system idetifiers we recommend - to use IP address or MAC address of the router itself. The way to construct - this is to keep all of the zeroes of the router IP address, and then change - the periods from being every three numbers to every four numbers. The - address that is listed here is ``192.168.1.2``, which if expanded will turn - into ``192.168.001.002``. Then all one has to do is move the dots to have - four numbers instead of three. This gives us ``1921.6800.1002``. - - * {abbr}`NET (Network Entity Title)` selector: ``00`` Must always be 00. This - setting indicates "this system" or "local system." -``` - -```{eval-rst} -.. cfgcmd:: set protocols isis interface - - This command enables IS-IS on this interface, and allows for - adjacency to occur. Note that the name of IS-IS instance must be - the same as the one used to configure the IS-IS process. -``` - -#### IS-IS Global Configuration - -```{eval-rst} -.. cfgcmd:: set protocols isis dynamic-hostname - - This command enables support for dynamic hostname TLV. Dynamic hostname - mapping determined as described in {rfc}`2763`, Dynamic Hostname - Exchange Mechanism for IS-IS. -``` - -```{eval-rst} -.. cfgcmd:: set protocols isis level - - This command defines the IS-IS router behavior: - - * **level-1** - Act as a station (Level 1) router only. - * **level-1-2** - Act as a station (Level 1) router and area (Level 2) router. - * **level-2-only** - Act as an area (Level 2) router only. -``` - -```{eval-rst} -.. cfgcmd:: set protocols isis lsp-mtu - - This command configures the maximum size of generated - {abbr}`LSPs (Link State PDUs)`, in bytes. The size range is 128 to 4352. -``` - -```{eval-rst} -.. cfgcmd:: set protocols isis metric-style - - This command sets old-style (ISO 10589) or new style packet formats: - - * **narrow** - Use old style of TLVs with narrow metric. - * **transition** - Send and accept both styles of TLVs during transition. - * **wide** - Use new style of TLVs to carry wider metric. -``` - -```{eval-rst} -.. cfgcmd:: set protocols isis purge-originator - - This command enables {rfc}`6232` purge originator identification. Enable - purge originator identification (POI) by adding the type, length and value - (TLV) with the Intermediate System (IS) identification to the LSPs that do - not contain POI information. If an IS generates a purge, VyOS adds this TLV - with the system ID of the IS to the purge. -``` - -```{eval-rst} -.. cfgcmd:: set protocols isis set-attached-bit - - This command sets ATT bit to 1 in Level1 LSPs. It is described in {rfc}`3787`. -``` - -```{eval-rst} -.. cfgcmd:: set protocols isis set-overload-bit - - This command sets overload bit to avoid any transit traffic through this - router. It is described in {rfc}`3787`. -``` - -```{eval-rst} -.. cfgcmd:: set protocols isis name default-information originate - level-1 - - This command will generate a default-route in L1 database. -``` - -```{eval-rst} -.. cfgcmd:: set protocols isis name default-information originate - level-2 - - This command will generate a default-route in L2 database. - -``` - -```{eval-rst} -.. cfgcmd:: set protocols isis ldp-sync - - This command will enable IGP-LDP synchronization globally for ISIS. This - requires for LDP to be functional. This is described in {rfc}`5443`. By - default all interfaces operational in IS-IS are enabled for synchronization. - Loopbacks are exempt. -``` - -```{eval-rst} -.. cfgcmd:: set protocols isis ldp-sync holddown - - This command will change the hold down value globally for IGP-LDP - synchronization during convergence/interface flap events. - -``` - -#### Interface Configuration - -```{eval-rst} -.. cfgcmd:: set protocols isis interface circuit-type - - - This command specifies circuit type for interface: - - * **level-1** - Level-1 only adjacencies are formed. - * **level-1-2** - Level-1-2 adjacencies are formed - * **level-2-only** - Level-2 only adjacencies are formed -``` - -```{eval-rst} -.. cfgcmd:: set protocols isis interface hello-interval - - - This command sets hello interval in seconds on a given interface. - The range is 1 to 600. -``` - -```{eval-rst} -.. cfgcmd:: set protocols isis interface hello-multiplier - - - This command sets multiplier for hello holding time on a given - interface. The range is 2 to 100. -``` - -```{eval-rst} -.. cfgcmd:: set protocols isis interface hello-padding - - This command configures padding on hello packets to accommodate asymmetrical - maximum transfer units (MTUs) from different hosts as described in - {rfc}`3719`. This helps to prevent a premature adjacency Up state when one - routing devices MTU does not meet the requirements to establish the adjacency. -``` - -```{eval-rst} -.. cfgcmd:: set protocols isis interface metric - - This command set default metric for circuit. - - The metric range is 1 to 16777215 (Max value depend if metric support narrow - or wide value). -``` - -```{eval-rst} -.. cfgcmd:: set protocols isis interface network - point-to-point - - This command specifies network type to Point-to-Point. The default - network type is broadcast. -``` - -```{eval-rst} -.. cfgcmd:: set protocols isis interface passive - - This command configures the passive mode for this interface. -``` - -```{eval-rst} -.. cfgcmd:: set protocols isis interface password - plaintext-password - - This command configures the authentication password for the interface. -``` - -```{eval-rst} -.. cfgcmd:: set protocols isis interface priority - - This command sets priority for the interface for - {abbr}`DIS (Designated Intermediate System)` election. The priority - range is 0 to 127. -``` - -```{eval-rst} -.. cfgcmd:: set protocols isis interface psnp-interval - - - This command sets PSNP interval in seconds. The interval range is 0 - to 127. -``` - -```{eval-rst} -.. cfgcmd:: set protocols isis interface - no-three-way-handshake - - This command disables Three-Way Handshake for P2P adjacencies which - described in {rfc}`5303`. Three-Way Handshake is enabled by default. -``` - -```{eval-rst} -.. cfgcmd:: set protocols isis interface ldp-sync disable - - This command disables IGP-LDP sync for this specific interface. -``` - -```{eval-rst} -.. cfgcmd:: set protocols isis interface ldp-sync holddown - - - This command will change the hold down value for IGP-LDP synchronization - during convergence/interface flap events, but for this interface only. -``` - -#### Route Redistribution - -```{eval-rst} -.. cfgcmd:: set protocols isis redistribute ipv4 level-1 - - This command redistributes routing information from the given route source - into the ISIS database as Level-1. There are six modes available for route - source: bgp, connected, kernel, ospf, rip, static. -``` - -```{eval-rst} -.. cfgcmd:: set protocols isis redistribute ipv4 level-2 - - This command redistributes routing information from the given route source - into the ISIS database as Level-2. There are six modes available for route - source: bgp, connected, kernel, ospf, rip, static. -``` - -```{eval-rst} -.. cfgcmd:: set protocols isis redistribute ipv4 - metric - - This command specifies metric for redistributed routes from the given route - source. There are six modes available for route source: bgp, connected, - kernel, ospf, rip, static. The metric range is 1 to 16777215. -``` - -```{eval-rst} -.. cfgcmd:: set protocols isis redistribute ipv4 - route-map - - This command allows to use route map to filter redistributed routes from - the given route source. There are six modes available for route source: - bgp, connected, kernel, ospf, rip, static. - -``` - -#### Timers - -```{eval-rst} -.. cfgcmd:: set protocols isis lsp-gen-interval - - This command sets minimum interval in seconds between regenerating same - LSP. The interval range is 1 to 120. -``` - -```{eval-rst} -.. cfgcmd:: set protocols isis lsp-refresh-interval - - This command sets LSP refresh interval in seconds. IS-IS generates LSPs - when the state of a link changes. However, to ensure that routing - databases on all routers remain converged, LSPs in stable networks are - generated on a regular basis even though there has been no change to - the state of the links. The interval range is 1 to 65235. The default - value is 900 seconds. -``` - -```{eval-rst} -.. cfgcmd:: set protocols isis max-lsp-lifetime - - This command sets LSP maximum LSP lifetime in seconds. The interval range - is 350 to 65535. LSPs remain in a database for 1200 seconds by default. - If they are not refreshed by that time, they are deleted. You can change - the LSP refresh interval or the LSP lifetime. The LSP refresh interval - should be less than the LSP lifetime or else LSPs will time out before - they are refreshed. -``` - -```{eval-rst} -.. cfgcmd:: set protocols isis spf-interval - - This command sets minimum interval between consecutive SPF calculations in - seconds.The interval range is 1 to 120. -``` - -```{eval-rst} -.. cfgcmd:: set protocols isis spf-delay-ietf holddown -``` - -```{eval-rst} -.. cfgcmd:: set protocols isis spf-delay-ietf init-delay - -``` - -```{eval-rst} -.. cfgcmd:: set protocols isis spf-delay-ietf long-delay - -``` - -```{eval-rst} -.. cfgcmd:: set protocols isis spf-delay-ietf short-delay - -``` - -```{eval-rst} -.. cfgcmd:: set protocols isis spf-delay-ietf time-to-learn - - - This commands specifies the Finite State Machine (FSM) intended to - control the timing of the execution of SPF calculations in response - to IGP events. The process described in {rfc}`8405`. - -``` - -## Examples - -### Enable IS-IS - -**Node 1:** - -```none -set interfaces loopback lo address '192.168.255.255/32' -set interfaces ethernet eth1 address '192.0.2.1/24' - -set protocols isis interface eth1 -set protocols isis interface lo -set protocols isis net '49.0001.1921.6825.5255.00' -``` - -**Node 2:** - -```none -set interfaces ethernet eth1 address '192.0.2.2/24' - -set interfaces loopback lo address '192.168.255.254/32' -set interfaces ethernet eth1 address '192.0.2.2/24' - -set protocols isis interface eth1 -set protocols isis interface lo -set protocols isis net '49.0001.1921.6825.5254.00' -``` - -This gives us the following neighborships, Level 1 and Level 2: - -```none -Node-1@vyos:~$ show isis neighbor -Area VyOS: - System Id Interface L State Holdtime SNPA - vyos eth1 1 Up 28 0c87.6c09.0001 - vyos eth1 2 Up 28 0c87.6c09.0001 - -Node-2@vyos:~$ show isis neighbor -Area VyOS: - System Id Interface L State Holdtime SNPA - vyos eth1 1 Up 29 0c33.0280.0001 - vyos eth1 2 Up 28 0c33.0280.0001 -``` - -Here's the IP routes that are populated. Just the loopback: - -```none -Node-1@vyos:~$ show ip route isis -Codes: K - kernel route, C - connected, S - static, R - RIP, - O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP, - T - Table, v - VNC, V - VNC-Direct, A - Babel, F - PBR, - f - OpenFabric, - > - selected route, * - FIB route, q - queued, r - rejected, b - backup - t - trapped, o - offload failure - -I 192.0.2.0/24 [115/20] via 192.0.2.2, eth1 inactive, weight 1, 00:02:22 -I>* 192.168.255.254/32 [115/20] via 192.0.2.2, eth1, weight 1, 00:02:22 - -Node-2@vyos:~$ show ip route isis -Codes: K - kernel route, C - connected, S - static, R - RIP, - O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP, - T - Table, v - VNC, V - VNC-Direct, A - Babel, F - PBR, - f - OpenFabric, - > - selected route, * - FIB route, q - queued, r - rejected, b - backup - t - trapped, o - offload failure - -I 192.0.2.0/24 [115/20] via 192.0.2.1, eth1 inactive, weight 1, 00:02:21 -I>* 192.168.255.255/32 [115/20] via 192.0.2.1, eth1, weight 1, 00:02:21 -``` - -### Enable IS-IS and redistribute routes not natively in IS-IS - -**Node 1:** - -```none -set interfaces dummy dum0 address '203.0.113.1/24' -set interfaces ethernet eth1 address '192.0.2.1/24' - -set policy prefix-list EXPORT-ISIS rule 10 action 'permit' -set policy prefix-list EXPORT-ISIS rule 10 prefix '203.0.113.0/24' -set policy route-map EXPORT-ISIS rule 10 action 'permit' -set policy route-map EXPORT-ISIS rule 10 match ip address prefix-list 'EXPORT-ISIS' - -set protocols isis interface eth1 -set protocols isis net '49.0001.1921.6800.1002.00' -set protocols isis redistribute ipv4 connected level-2 route-map 'EXPORT-ISIS' -``` - -**Node 2:** - -```none -set interfaces ethernet eth1 address '192.0.2.2/24' - -set protocols isis interface eth1 -set protocols isis net '49.0001.1921.6800.2002.00' -``` - -Routes on Node 2: - -```none -Node-2@r2:~$ show ip route isis -Codes: K - kernel route, C - connected, S - static, R - RIP, - O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP, - T - Table, v - VNC, V - VNC-Direct, A - Babel, D - SHARP, - F - PBR, f - OpenFabric, - > - selected route, * - FIB route, q - queued route, r - rejected route - -I 203.0.113.0/24 [115/10] via 192.0.2.1, eth1, 00:03:42 -``` - -### Enable IS-IS and IGP-LDP synchronization - -**Node 1:** - -```none -set interfaces loopback lo address 192.168.255.255/32 -set interfaces ethernet eth0 address 192.0.2.1/24 - -set protocols isis interface eth0 -set protocols isis interface lo passive -set protocols isis ldp-sync -set protocols isis net 49.0001.1921.6825.5255.00 - -set protocols mpls interface eth0 -set protocols mpls ldp discovery transport-ipv4-address 192.168.255.255 -set protocols mpls ldp interface lo -set protocols mpls ldp interface eth0 -set protocols mpls ldp parameters transport-prefer-ipv4 -set protocols mpls ldp router-id 192.168.255.255 -``` - -This gives us IGP-LDP synchronization for all non-loopback interfaces with -a holddown timer of zero seconds: - -```none -Node-1@vyos:~$ show isis mpls ldp-sync -eth0 - LDP-IGP Synchronization enabled: yes - holddown timer in seconds: 0 - State: Sync achieved -``` - -### Enable IS-IS with Segment Routing (Experimental) - -**Node 1:** - -```none -set interfaces loopback lo address '192.168.255.255/32' -set interfaces ethernet eth1 address '192.0.2.1/24' - -set protocols isis interface eth1 -set protocols isis interface lo -set protocols isis net '49.0001.1921.6825.5255.00' -set protocols isis segment-routing global-block high-label-value '599' -set protocols isis segment-routing global-block low-label-value '550' -set protocols isis segment-routing prefix 192.168.255.255/32 index value '1' -set protocols isis segment-routing prefix 192.168.255.255/32 index explicit-null -set protocols mpls interface 'eth1' -``` - -**Node 2:** - -```none -set interfaces loopback lo address '192.168.255.254/32' -set interfaces ethernet eth1 address '192.0.2.2/24' - -set protocols isis interface eth1 -set protocols isis interface lo -set protocols isis net '49.0001.1921.6825.5254.00' -set protocols isis segment-routing global-block high-label-value '599' -set protocols isis segment-routing global-block low-label-value '550' -set protocols isis segment-routing prefix 192.168.255.254/32 index value '2' -set protocols isis segment-routing prefix 192.168.255.254/32 index explicit-null -set protocols mpls interface 'eth1' -``` - -This gives us MPLS segment routing enabled and labels for far end loopbacks: - -```none -Node-1@vyos:~$ show mpls table - Inbound Label Type Nexthop Outbound Label - ---------------------------------------------------------------------- - 552 SR (IS-IS) 192.0.2.2 IPv4 Explicit Null <-- Node-2 loopback learned on Node-1 - 15000 SR (IS-IS) 192.0.2.2 implicit-null - 15001 SR (IS-IS) fe80::e87:6cff:fe09:1 implicit-null - 15002 SR (IS-IS) 192.0.2.2 implicit-null - 15003 SR (IS-IS) fe80::e87:6cff:fe09:1 implicit-null - -Node-2@vyos:~$ show mpls table - Inbound Label Type Nexthop Outbound Label - --------------------------------------------------------------------- - 551 SR (IS-IS) 192.0.2.1 IPv4 Explicit Null <-- Node-1 loopback learned on Node-2 - 15000 SR (IS-IS) 192.0.2.1 implicit-null - 15001 SR (IS-IS) fe80::e33:2ff:fe80:1 implicit-null - 15002 SR (IS-IS) 192.0.2.1 implicit-null - 15003 SR (IS-IS) fe80::e33:2ff:fe80:1 implicit-null -``` - -Here is the routing tables showing the MPLS segment routing label operations: - -```none -Node-1@vyos:~$ show ip route isis -Codes: K - kernel route, C - connected, S - static, R - RIP, - O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP, - T - Table, v - VNC, V - VNC-Direct, A - Babel, F - PBR, - f - OpenFabric, - > - selected route, * - FIB route, q - queued, r - rejected, b - backup - t - trapped, o - offload failure - -I 192.0.2.0/24 [115/20] via 192.0.2.2, eth1 inactive, weight 1, 00:07:48 -I>* 192.168.255.254/32 [115/20] via 192.0.2.2, eth1, label IPv4 Explicit Null, weight 1, 00:03:39 - -Node-2@vyos:~$ show ip route isis -Codes: K - kernel route, C - connected, S - static, R - RIP, - O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP, - T - Table, v - VNC, V - VNC-Direct, A - Babel, F - PBR, - f - OpenFabric, - > - selected route, * - FIB route, q - queued, r - rejected, b - backup - t - trapped, o - offload failure - -I 192.0.2.0/24 [115/20] via 192.0.2.1, eth1 inactive, weight 1, 00:07:46 -I>* 192.168.255.255/32 [115/20] via 192.0.2.1, eth1, label IPv4 Explicit Null, weight 1, 00:03:43 -``` diff --git a/docs/configuration/protocols/md-mpls.md b/docs/configuration/protocols/md-mpls.md deleted file mode 100644 index 71b14be2..00000000 --- a/docs/configuration/protocols/md-mpls.md +++ /dev/null @@ -1,285 +0,0 @@ -(mpls)= - -# MPLS - -{abbr}`MPLS (Multi-Protocol Label Switching)` is a packet forwarding paradigm -which differs from regular IP forwarding. Instead of IP addresses being used to -make the decision on finding the exit interface, a router will instead use an -exact match on a 32 bit/4 byte header called the MPLS label. This label is -inserted between the ethernet (layer 2) header and the IP (layer 3) header. -One can statically or dynamically assign label allocations, but we will focus -on dynamic allocation of labels using some sort of label distribution protocol -(such as the aptly named Label Distribution Protocol / LDP, Resource Reservation -Protocol / RSVP, or Segment Routing through OSPF/ISIS). These protocols allow -for the creation of a unidirectional/unicast path called a labeled switched -path (initialized as LSP) throughout the network that operates very much like -a tunnel through the network. An easy way of thinking about how an MPLS LSP -actually forwards traffic throughout a network is to think of a GRE tunnel. -They are not the same in how they operate, but they are the same in how they -handle the tunneled packet. It would be good to think of MPLS as a tunneling -technology that can be used to transport many different types of packets, to -aid in traffic engineering by allowing one to specify paths throughout the -network (using RSVP or SR), and to generally allow for easier intra/inter -network transport of data packets. - -For more information on how MPLS label switching works, please go visit -[Wikipedia (MPLS)]. - -:::{note} -MPLS support in VyOS is not finished yet, and therefore its -functionality is limited. Currently there is no support for MPLS enabled VPN -services such as L2VPNs and mVPNs. RSVP support is also not present as the -underlying routing stack (FRR) does not implement it. Currently VyOS -implements LDP as described in RFC 5036; other LDP standard are the -following ones: RFC 6720, RFC 6667, RFC 5919, RFC 5561, RFC 7552, RFC 4447. -Because MPLS is already available (FRR also supports RFC 3031). -::: - -## Label Distribution Protocol - -The {abbr}`MPLS (Multi-Protocol Label Switching)` architecture does not assume -a single protocol to create MPLS paths. VyOS supports the Label Distribution -Protocol (LDP) as implemented by FRR, based on {rfc}`5036`. - -{abbr}`LDP (Label Distribution Protocol)` is a TCP based MPLS signaling protocol -that distributes labels creating MPLS label switched paths in a dynamic manner. -LDP is not a routing protocol, as it relies on other routing protocols for -forwarding decisions. LDP cannot bootstrap itself, and therefore relies on said -routing protocols for communication with other routers that use LDP. - -In order to allow for LDP on the local router to exchange label advertisements -with other routers, a TCP session will be established between automatically -discovered and statically assigned routers. LDP will try to establish a TCP -session to the **transport address** of other routers. Therefore for LDP to -function properly please make sure the transport address is shown in the -routing table and reachable to traffic at all times. - -It is highly recommended to use the same address for both the LDP router-id and -the discovery transport address, but for VyOS MPLS LDP to work both parameters -must be explicitly set in the configuration. - -Another thing to keep in mind with LDP is that much like BGP, it is a protocol -that runs on top of TCP. It however does not have an ability to do something -like a refresh capability like BGPs route refresh capability. Therefore one -might have to reset the neighbor for a capability change or a configuration -change to work. - -## Configuration Options - -```{cfgcmd} set protocols mpls interface \ - -Use this command to enable MPLS processing on the interface you define. -``` - - -```{cfgcmd} set protocols mpls ldp interface \ - -Use this command to enable LDP on the interface you define. -``` - - -```{cfgcmd} set protocols mpls ldp router-id \ - -Use this command to configure the IP address used as the LDP router-id of the -local device. -``` - - -```{cfgcmd} set protocols mpls ldp discovery transport-ipv4-address \ - -``` -```{cfgcmd} set protocols mpls ldp discovery transport-ipv6-address \ - -Use this command to set the IPv4 or IPv6 transport-address used by LDP. -``` - -```{cfgcmd} set protocols mpls ldp neighbor \ password \ - -Use this command to configure authentication for LDP peers. Set the -IP address of the LDP peer and a password that should be shared in -order to become neighbors. -``` - -```{cfgcmd} set protocols mpls ldp neighbor \ session-holdtime \ - -Use this command to configure a specific session hold time for LDP peers. -Set the IP address of the LDP peer and a session hold time that should be -configured for it. You may have to reset the neighbor for this to work. -``` - -```{cfgcmd} set protocols mpls ldp neighbor \ ttl-security \ - -Use this command to enable, disable, or specify hop count for TTL security -for LDP peers. By default the value is set to 255 (or max TTL). -``` - -```{eval-rst} -.. cfgcmd:: set protocols mpls ldp discovery hello-ipv4-interval -.. cfgcmd:: set protocols mpls ldp discovery hello-ipv4-holdtime -.. cfgcmd:: set protocols mpls ldp discovery hello-ipv6-interval -.. cfgcmd:: set protocols mpls ldp discovery hello-ipv6-holdtime - - Use these commands if you would like to set the discovery hello and hold time - parameters. -``` - -```{eval-rst} -.. cfgcmd:: set protocols mpls ldp discovery session-ipv4-holdtime -.. cfgcmd:: set protocols mpls ldp discovery session-ipv6-holdtime - - Use this command if you would like to set the TCP session hold time intervals. -``` - -```{eval-rst} -.. cfgcmd:: set protocols mpls ldp import ipv4 import-filter filter-access-list - -.. cfgcmd:: set protocols mpls ldp import ipv6 import-filter filter-access-list6 - - - Use these commands to control the importing of forwarding equivalence classes - (FECs) for LDP from neighbors. This would be useful for example on only - accepting the labeled routes that are needed and not ones that are not - needed, such as accepting loopback interfaces and rejecting all others. -``` - -```{eval-rst} -.. cfgcmd:: set protocols mpls ldp export ipv4 export-filter filter-access-list - -.. cfgcmd:: set protocols mpls ldp export ipv6 export-filter filter-access-list6 - - - Use these commands to control the exporting of forwarding equivalence classes - (FECs) for LDP to neighbors. This would be useful for example on only - announcing the labeled routes that are needed and not ones that are not - needed, such as announcing loopback interfaces and no others. -``` - -```{eval-rst} -.. cfgcmd:: set protocols mpls ldp export ipv4 explicit-null -.. cfgcmd:: set protocols mpls ldp export ipv6 explicit-null - - Use this command if you would like for the router to advertise FECs with a - label of 0 for explicit null operations. -``` - -```{eval-rst} -.. cfgcmd:: set protocols mpls ldp allocation ipv4 access-list -.. cfgcmd:: set protocols mpls ldp allocation ipv6 access-list6 - - Use this command if you would like to control the local FEC allocations for - LDP. A good example would be for your local router to not allocate a label for - everything. Just a label for what it's useful. A good example would be just a - loopback label. -``` - -```{cfgcmd} set protocols mpls ldp parameters cisco-interop-tlv - -Use this command to use a Cisco non-compliant format to send and interpret -the Dual-Stack capability TLV for IPv6 LDP communications. This is related to -{rfc}`7552`. -``` - -```{cfgcmd} set protocols mpls ldp parameters ordered-control - -Use this command to use ordered label distribution control mode. FRR -by default uses independent label distribution control mode for label -distribution. This is related to {rfc}`5036`. -``` - -```{cfgcmd} set protocols mpls ldp parameters transport-prefer-ipv4 - -Use this command to prefer IPv4 for TCP peer transport connection for LDP -when both an IPv4 and IPv6 LDP address are configured on the same interface. -``` - -```{cfgcmd} set protocols mpls ldp targeted-neighbor ipv4 enable -``` - -```{cfgcmd} set protocols mpls ldp targeted-neighbor ipv6 enable - -Use this command to enable targeted LDP sessions to the local router. The -router will then respond to any sessions that are trying to connect to it that -are not a link local type of TCP connection. -``` - -```{cfgcmd} set protocols mpls ldp targeted-neighbor ipv4 address \ -``` - -```{cfgcmd} set protocols mpls ldp targeted-neighbor ipv6 address \ - -Use this command to enable the local router to try and connect with a targeted -LDP session to another router. -``` - -```{cfgcmd} set protocols mpls ldp targeted-neighbor ipv4 hello-holdtime \ -``` - -```{cfgcmd} set protocols mpls ldp targeted-neighbor ipv4 hello-interval \ -``` - -```{cfgcmd} set protocols mpls ldp targeted-neighbor ipv6 hello-holdtime \ -``` - -```{cfgcmd} set protocols mpls ldp targeted-neighbor ipv6 hello-interval \ - -Use these commands if you would like to set the discovery hello and hold time -parameters for the targeted LDP neighbors. -``` - -### Sample configuration to setup LDP on VyOS - -```none -set protocols ospf area 0 network '192.168.255.252/32' <--- Routing for loopback -set protocols ospf area 0 network '192.168.0.5/32' <--- Routing for an interface connecting to the network -set protocols ospf parameters router-id '192.168.255.252' <--- Router ID setting for OSPF -set protocols mpls interface 'eth1' <--- Enable MPLS for an interface connecting to network -set protocols mpls ldp discovery transport-ipv4-address '192.168.255.252' <--- Transport address for LDP for TCP sessions to connect to -set protocols mpls ldp interface 'eth1' <--- Enable LDP for an interface connecting to network -set protocols mpls ldp interface 'lo' <--- Enable LDP on loopback for future services connectivity -set protocols mpls ldp router-id '192.168.255.252' <--- Router ID setting for LDP -set interfaces ethernet eth1 address '192.168.0.5/31' <--- Interface IP for connecting to network -set interfaces loopback lo address '192.168.255.252/32' <--- Interface loopback IP for router ID and other uses -``` - -## Operational Mode Commands - -When LDP is working, you will be able to see label information in the outcome -of `show ip route`. Besides that information, there are also specific *show* -commands for LDP: - -### Show - -```{opcmd} show mpls ldp binding - -Use this command to see the Label Information Base. - -``` - -```{opcmd} show mpls ldp discovery - -Use this command to see discovery hello information -``` - -```{opcmd} show mpls ldp interface - -Use this command to see LDP interface information -``` - -```{opcmd} show mpls ldp neighbor - -Use this command to see LDP neighbor information -``` - -```{opcmd} show mpls ldp neighbor detail - -Use this command to see detailed LDP neighbor information -``` - -### Reset - -```{opcmd} reset mpls ldp neighbor \ - -Use this command to reset an LDP neighbor/TCP session that is established -``` - -[wikipedia (mpls)]: diff --git a/docs/configuration/protocols/md-ospf.md b/docs/configuration/protocols/md-ospf.md deleted file mode 100644 index adc62520..00000000 --- a/docs/configuration/protocols/md-ospf.md +++ /dev/null @@ -1,1560 +0,0 @@ -(routing-ospf)= - -# OSPF - -{abbr}`OSPF (Open Shortest Path First)` is a routing protocol for Internet -Protocol (IP) networks. It uses a link state routing (LSR) algorithm and falls -into the group of interior gateway protocols (IGPs), operating within a single -autonomous system (AS). It is defined as OSPF Version 2 in {rfc}`2328` (1998) -for IPv4. Updates for IPv6 are specified as OSPF Version 3 in {rfc}`5340` -(2008). OSPF supports the {abbr}`CIDR (Classless Inter-Domain Routing)` -addressing model. - -OSPF is a widely used IGP in large enterprise networks. - -## OSPFv2 (IPv4) - -### Configuration - -#### General - -VyOS does not have a special command to start the OSPF process. The OSPF process -starts when the first ospf enabled interface is configured. - -```{eval-rst} -.. cfgcmd:: set protocols ospf area network - - This command specifies the OSPF enabled interface(s). If the interface has - an address from defined range then the command enables OSPF on this - interface so router can provide network information to the other ospf - routers via this interface. - - This command is also used to enable the OSPF process. The area number can be - specified in decimal notation in the range from 0 to 4294967295. Or it - can be specified in dotted decimal notation similar to ip address. - - Prefix length in interface must be equal or bigger (i.e. smaller network) - than prefix length in network statement. For example statement above doesn't - enable ospf on interface with address 192.168.1.1/23, but it does on - interface with address 192.168.1.129/25. - - In some cases it may be more convenient to enable OSPF on a per - interface/subnet - basis {cfgcmd}`set protocols ospf interface area ` -``` - -```{eval-rst} -.. cfgcmd:: set protocols ospf auto-cost reference-bandwidth - - This command sets the reference bandwidth for cost calculations, where - bandwidth can be in range from 1 to 4294967, specified in Mbits/s. The - default is 100Mbit/s (i.e. a link of bandwidth 100Mbit/s or higher will - have a cost of 1. Cost of lower bandwidth links will be scaled with - reference to this cost). -``` - -```{eval-rst} -.. cfgcmd:: set protocols ospf parameters router-id - - This command sets the router-ID of the OSPF process. The router-ID may be an - IP address of the router, but need not be – it can be any arbitrary 32bit - number. However it MUST be unique within the entire OSPF domain to the OSPF - speaker – bad things will happen if multiple OSPF speakers are configured - with the same router-ID! - -``` - -#### Optional - -```{eval-rst} -.. cfgcmd:: set protocols ospf default-information originate [always] - [metric ] [metric-type <1|2>] [route-map ] - - Originate an AS-External (type-5) LSA describing a default route into all - external-routing capable areas, of the specified metric and metric type. - If the {cfgcmd}`always` keyword is given then the default is always - advertised, even when there is no default present in the routing table. - The argument {cfgcmd}`route-map` specifies to advertise the default route - if the route map is satisfied. -``` - -```{eval-rst} -.. cfgcmd:: set protocols ospf distance global - - This command change distance value of OSPF globally. - The distance range is 1 to 255. -``` - -```{eval-rst} -.. cfgcmd:: set protocols ospf distance ospf - - - This command change distance value of OSPF. The arguments are the distance - values for external routes, inter-area routes and intra-area routes - respectively. The distance range is 1 to 255. - - .. note:: Routes with a distance of 255 are effectively disabled and not - installed into the kernel. -``` - -```{eval-rst} -.. cfgcmd:: set protocols ospf log-adjacency-changes [detail] - - This command allows to log changes in adjacency. With the optional - {cfgcmd}`detail` argument, all changes in adjacency status are shown. - Without {cfgcmd}`detail`, only changes to full or regressions are shown. -``` - -```{eval-rst} -.. cfgcmd:: set protocols ospf max-metric router-lsa - |on-startup > - - This enables {rfc}`3137` support, where the OSPF process describes its - transit links in its router-LSA as having infinite distance so that other - routers will avoid calculating transit paths through the router while - still being able to reach networks through the router. - - This support may be enabled administratively (and indefinitely) with the - {cfgcmd}`administrative` command. It may also be enabled conditionally. - Conditional enabling of max-metric router-lsas can be for a period of - seconds after startup with the {cfgcmd}`on-startup ` command - and/or for a period of seconds prior to shutdown with the - {cfgcmd}`on-shutdown ` command. The time range is 5 to 86400. -``` - -```{eval-rst} -.. cfgcmd:: set protocols ospf parameters abr-type - - - This command selects ABR model. OSPF router supports four ABR models: - - **cisco** – a router will be considered as ABR if it has several configured - links to the networks in different areas one of which is a backbone area. - Moreover, the link to the backbone area should be active (working). - **ibm** – identical to "cisco" model but in this case a backbone area link - may not be active. - **standard** – router has several active links to different areas. - **shortcut** – identical to "standard" but in this model a router is - allowed to use a connected areas topology without involving a backbone - area for inter-area connections. - - Detailed information about "cisco" and "ibm" models differences can be - found in {rfc}`3509`. A "shortcut" model allows ABR to create routes - between areas based on the topology of the areas connected to this router - but not using a backbone area in case if non-backbone route will be - cheaper. For more information about "shortcut" model, - see :t:`ospf-shortcut-abr-02.txt` -``` - -```{eval-rst} -.. cfgcmd:: set protocols ospf parameters rfc1583-compatibility - - {rfc}`2328`, the successor to {rfc}`1583`, suggests according to section - G.2 (changes) in section 16.4.1 a change to the path preference algorithm - that prevents possible routing loops that were possible in the old version - of OSPFv2. More specifically it demands that inter-area paths and - intra-area backbone path are now of equal preference but still both - preferred to external paths. - - This command should NOT be set normally. -``` - -```{eval-rst} -.. cfgcmd:: set protocols ospf interface passive [disable] - - This command specifies interface as passive. Passive interface advertises - its address, but does not run the OSPF protocol (adjacencies are not formed - and hello packets are not generated). - - The optional `disable` option allows to exclude interface from passive state. - This command is used if the command {cfgcmd}`passive-interface default` was - configured. -``` - -```{eval-rst} -.. cfgcmd:: set protocols ospf passive-interface default - - This command specifies all interfaces as passive by default. Because this - command changes the configuration logic to a default passive; therefore, - interfaces where router adjacencies are expected need to be configured - by setting the {cfgcmd}`passive disable` flag for the specific interface. -``` - -```{eval-rst} -.. cfgcmd:: set protocols ospf maximum-paths <1-64> - - Use this command to control the maximum number of equal cost paths to reach - a specific destination. The upper limit may differ if you change the value - of MULTIPATH_NUM during compilation. The default is MULTIPATH_NUM (64). -``` - -```{eval-rst} -.. cfgcmd:: set protocols ospf refresh timers - - The router automatically updates link-state information with its neighbors. - Only an obsolete information is updated which age has exceeded a specific - threshold. This parameter changes a threshold value, which by default is - 1800 seconds (half an hour). The value is applied to the whole OSPF router. - The timer range is 10 to 1800. -``` - -```{eval-rst} -.. cfgcmd:: set protocols ospf timers throttle spf - - - This command sets the initial delay, the initial-holdtime and the - maximum-holdtime between when SPF is calculated and the event which - triggered the calculation. The times are specified in milliseconds and must - be in the range of 0 to 600000 milliseconds. {cfgcmd}`delay` sets the - initial SPF schedule delay in milliseconds. The default value is 200 ms. - {cfgcmd}`initial-holdtime` sets the minimum hold time between two - consecutive SPF calculations. The default value is 1000 ms. - {cfgcmd}`max-holdtime` sets the maximum wait time between two - consecutive SPF calculations. The default value is 10000 ms. -``` - -```{eval-rst} -.. cfgcmd:: set protocols ospf ldp-sync - - This command will enable IGP-LDP synchronization globally for OSPF. This - requires for LDP to be functional. This is described in {rfc}`5443`. By - default all interfaces operational in OSPF are enabled for synchronization. - Loopbacks are exempt. -``` - -```{eval-rst} -.. cfgcmd:: set protocols ospf ldp-sync holddown - - This command will change the hold down value globally for IGP-LDP - synchronization during convergence/interface flap events. -``` - -```{eval-rst} -.. cfgcmd:: set protocols ospf capability opaque - - ospfd supports Opaque LSA {rfc}`2370` as partial support for MPLS Traffic - Engineering LSAs. The opaque-lsa capability must be enabled in the - configuration. - - An alternate command could be "mpls-te on" (Traffic Engineering) - - .. note:: FRR offers only partial support for some of the routing - protocol extensions that are used with MPLS-TE; it does not - support a complete RSVP-TE solution. -``` - -#### Area Configuration - -```{eval-rst} -.. cfgcmd:: set protocols ospf area area-type stub - - This command specifies the area to be a Stub Area. That is, an area where - no router originates routes external to OSPF and hence an area where all - external routes are via the ABR(s). Hence, ABRs for such an area do not - need to pass AS-External LSAs (type-5) or ASBR-Summary LSAs (type-4) into - the area. They need only pass Network-Summary (type-3) LSAs into such an - area, along with a default-route summary. -``` - -```{eval-rst} -.. cfgcmd:: set protocols ospf area area-type stub no-summary - - This command specifies the area to be a Totally Stub Area. In addition to - stub area limitations this area type prevents an ABR from injecting - Network-Summary (type-3) LSAs into the specified stub area. Only default - summary route is allowed. -``` - -```{eval-rst} -.. cfgcmd:: set protocols ospf area area-type stub default-cost - - - This command sets the cost of default-summary LSAs announced to stubby - areas. The cost range is 0 to 16777215. -``` - -```{eval-rst} -.. cfgcmd:: set protocols ospf area area-type nssa - - This command specifies the area to be a Not So Stubby Area. External - routing information is imported into an NSSA in Type-7 LSAs. Type-7 LSAs - are similar to Type-5 AS-external LSAs, except that they can only be - flooded into the NSSA. In order to further propagate the NSSA external - information, the Type-7 LSA must be translated to a Type-5 AS-external-LSA - by the NSSA ABR. -``` - -```{eval-rst} -.. cfgcmd:: set protocols ospf area area-type nssa no-summary - - This command specifies the area to be a NSSA Totally Stub Area. ABRs for - such an area do not need to pass Network-Summary (type-3) LSAs (except the - default summary route), ASBR-Summary LSAs (type-4) and AS-External LSAs - (type-5) into the area. But Type-7 LSAs that convert to Type-5 at the NSSA - ABR are allowed. -``` - -```{eval-rst} -.. cfgcmd:: set protocols ospf area area-type nssa default-cost - - - This command sets the default cost of LSAs announced to NSSA areas. - The cost range is 0 to 16777215. -``` - -```{eval-rst} -.. cfgcmd:: set protocols ospf area area-type nssa translate - - - Specifies whether this NSSA border router will unconditionally translate - Type-7 LSAs into Type-5 LSAs. When role is Always, Type-7 LSAs are - translated into Type-5 LSAs regardless of the translator state of other - NSSA border routers. When role is Candidate, this router participates in - the translator election to determine if it will perform the translations - duties. When role is Never, this router will never translate Type-7 LSAs - into Type-5 LSAs. -``` - -```{eval-rst} -.. cfgcmd:: set protocols ospf area authentication plaintext-password - - This command specifies that simple password authentication should be used - for the given area. The password must also be configured on a per-interface - basis. -``` - -```{eval-rst} -.. cfgcmd:: set protocols ospf area authentication md5 - - This command specify that OSPF packets must be authenticated with MD5 HMACs - within the given area. Keying material must also be configured on a - per-interface basis. -``` - -```{eval-rst} -.. cfgcmd:: set protocols ospf area range [cost ] - - This command summarizes intra area paths from specified area into one - summary-LSA (Type-3) announced to other areas. This command can be used - only in ABR and ONLY router-LSAs (Type-1) and network-LSAs (Type-2) - (i.e. LSAs with scope area) can be summarized. AS-external-LSAs (Type-5) - can’t be summarized - their scope is AS. The optional argument - {cfgcmd}`cost` specifies the aggregated link metric. The metric range is 0 - to 16777215. -``` - -```{eval-rst} -.. cfgcmd:: set protocols ospf area range not-advertise - - This command instead of summarizing intra area paths filter them - i.e. - intra area paths from this range are not advertised into other areas. - This command makes sense in ABR only. -``` - -```{eval-rst} -.. cfgcmd:: set protocols ospf area export-list - - Filter Type-3 summary-LSAs announced to other areas originated from - intra- area paths from specified area. - This command makes sense in ABR only. -``` - -```{eval-rst} -.. cfgcmd:: set protocols ospf area import-list - - Same as export-list, but it applies to paths announced into specified - area as Type-3 summary-LSAs. - This command makes sense in ABR only. -``` - -```{eval-rst} -.. cfgcmd:: set protocols ospf area range substitute - - - One Type-3 summary-LSA with routing info is announced into - backbone area if defined area contains at least one intra-area network - (i.e. described with router-LSA or network-LSA) from range . - This command makes sense in ABR only. -``` - -```{eval-rst} -.. cfgcmd:: set protocols ospf area shortcut - - This parameter allows to "shortcut" routes (non-backbone) for inter-area - routes. There are three modes available for routes shortcutting: - - **default** – this area will be used for shortcutting only if ABR does not - have a link to the backbone area or this link was lost. - **enable** – the area will be used for shortcutting every time the route - that goes through it is cheaper. - **disable** – this area is never used by ABR for routes shortcutting. -``` - -```{eval-rst} -.. cfgcmd:: set protocols ospf area virtual-link - - Provides a backbone area coherence by virtual link establishment. - - In general, OSPF protocol requires a backbone area (area 0) to be coherent - and fully connected. I.e. any backbone area router must have a route to any - other backbone area router. Moreover, every ABR must have a link to - backbone area. However, it is not always possible to have a physical link - to a backbone area. In this case between two ABR (one of them has a link to - the backbone area) in the area (not stub area) a virtual link is organized. - - – area identifier through which a virtual link goes. - – ABR router-id with which a virtual link is established. Virtual - link must be configured on both routers. - - Formally, a virtual link looks like a point-to-point network connecting two - ABR from one area one of which physically connected to a backbone area. - This pseudo-network is considered to belong to a backbone area. - -``` - -#### Interface Configuration - -```{eval-rst} -.. cfgcmd:: set protocols ospf interface area - - Enable ospf on an interface and set associated area. - - If you have a lot of interfaces, and/or a lot of subnets, then enabling - OSPF via this command may result in a slight performance improvement. -``` - -```{eval-rst} -.. cfgcmd:: set protocols ospf interface authentication - plaintext-password - - This command sets OSPF authentication key to a simple password. After - setting, all OSPF packets are authenticated. Key has length up to 8 chars. - - Simple text password authentication is insecure and deprecated in favour of - MD5 HMAC authentication. -``` - -```{eval-rst} -.. cfgcmd:: set protocols ospf interface authentication md5 - key-id md5-key - - This command specifys that MD5 HMAC authentication must be used on this - interface. It sets OSPF authentication key to a cryptographic password. - Key-id identifies secret key used to create the message digest. This ID - is part of the protocol and must be consistent across routers on a link. - The key can be long up to 16 chars (larger strings will be truncated), - and is associated with the given key-id. -``` - -```{eval-rst} -.. cfgcmd:: set protocols ospf interface bandwidth - - This command sets the interface bandwidth for cost calculations, where - bandwidth can be in range from 1 to 100000, specified in Mbits/s. -``` - -```{eval-rst} -.. cfgcmd:: set protocols ospf interface cost - - This command sets link cost for the specified interface. The cost value is - set to router-LSA’s metric field and used for SPF calculation. The cost - range is 1 to 65535. -``` - -```{eval-rst} -.. cfgcmd:: set protocols ospf interface dead-interval - - Set number of seconds for router Dead Interval timer value used for Wait - Timer and Inactivity Timer. This value must be the same for all routers - attached to a common network. The default value is 40 seconds. The - interval range is 1 to 65535. -``` - -```{eval-rst} -.. cfgcmd:: set protocols ospf interface hello-multiplier - - The hello-multiplier specifies how many Hellos to send per second, from 1 - (every second) to 10 (every 100ms). Thus one can have 1s convergence time - for OSPF. If this form is specified, then the hello-interval advertised in - Hello packets is set to 0 and the hello-interval on received Hello packets - is not checked, thus the hello-multiplier need NOT be the same across - multiple routers on a common link. -``` - -```{eval-rst} -.. cfgcmd:: set protocols ospf interface hello-interval - - Set number of seconds for Hello Interval timer value. Setting this value, - Hello packet will be sent every timer value seconds on the specified - interface. This value must be the same for all routers attached to a - common network. The default value is 10 seconds. The interval range is 1 - to 65535. -``` - -```{eval-rst} -.. cfgcmd:: set protocols ospf interface bfd - - This command enables {abbr}`BFD (Bidirectional Forwarding Detection)` on - this OSPF link interface. -``` - -```{eval-rst} -.. cfgcmd:: set protocols ospf interface mtu-ignore - - This command disables check of the MTU value in the OSPF DBD packets. Thus, - use of this command allows the OSPF adjacency to reach the FULL state even - though there is an interface MTU mismatch between two OSPF routers. -``` - -```{eval-rst} -.. cfgcmd:: set protocols ospf interface network - - This command allows to specify the distribution type for the network - connected to this interface: - - **broadcast** – broadcast IP addresses distribution. - **non-broadcast** – address distribution in NBMA networks topology. - **point-to-multipoint** – address distribution in point-to-multipoint - networks. - **point-to-point** – address distribution in point-to-point networks. -``` - -```{eval-rst} -.. cfgcmd:: set protocols ospf interface priority - - This command sets Router Priority integer value. The router with the - highest priority will be more eligible to become Designated Router. - Setting the value to 0, makes the router ineligible to become - Designated Router. The default value is 1. The interval range is 0 to 255. -``` - -```{eval-rst} -.. cfgcmd:: set protocols ospf interface retransmit-interval - - - This command sets number of seconds for RxmtInterval timer value. This - value is used when retransmitting Database Description and Link State - Request packets if acknowledge was not received. The default value is 5 - seconds. The interval range is 3 to 65535. -``` - -```{eval-rst} -.. cfgcmd:: set protocols ospf interface transmit-delay - - This command sets number of seconds for InfTransDelay value. It allows to - set and adjust for each interface the delay interval before starting the - synchronizing process of the router's database with all neighbors. The - default value is 1 seconds. The interval range is 3 to 65535. -``` - -```{eval-rst} -.. cfgcmd:: set protocols ospf interface ldp-sync disable - - This command disables IGP-LDP sync for this specific interface. -``` - -```{eval-rst} -.. cfgcmd:: set protocols ospf interface ldp-sync holddown - - - This command will change the hold down value for IGP-LDP synchronization - during convergence/interface flap events, but for this interface only. -``` - -#### External Route Summarisation - -This feature summarises originated external LSAs (Type-5 and Type-7). Summary -Route will be originated on-behalf of all matched external LSAs. - -```{eval-rst} -.. cfgcmd:: set protocols ospf aggregation timer - - Configure aggregation delay timer interval. - - Summarisation starts only after this delay timer expiry. -``` - -```{eval-rst} -.. cfgcmd:: set protocols ospf summary-address x.x.x.x/y [tag (1-4294967295)] - - This command enable/disables summarisation for the configured address range. - - Tag is the optional parameter. If tag configured Summary route will be - originated with the configured tag. -``` - -```{eval-rst} -.. cfgcmd:: set protocols ospf summary-address x.x.x.x/y no-advertise - - This command to ensure not advertise the summary lsa for the matched - external LSAs. -``` - -#### Graceful Restart - -```{eval-rst} -.. cfgcmd:: set protocols ospf graceful-restart [grace-period (1-1800)] - - Configure Graceful Restart {rfc}`3623` restarting support. When enabled, - the default grace period is 120 seconds. - - To perform a graceful shutdown, the FRR ``graceful-restart prepare ip - ospf`` EXEC-level command needs to be issued before restarting the - ospfd daemon. -``` - -```{eval-rst} -.. cfgcmd:: set protocols ospf graceful-restart helper enable [router-id A.B.C.D] - - Configure Graceful Restart {rfc}`3623` helper support. By default, helper support - is disabled for all neighbours. This config enables/disables helper support - on this router for all neighbours. - - To enable/disable helper support for a specific neighbour, the router-id - (A.B.C.D) has to be specified. -``` - -```{eval-rst} -.. cfgcmd:: set protocols ospf graceful-restart helper no-strict-lsa-checking - - By default `strict-lsa-checking` is configured then the helper will abort - the Graceful Restart when a LSA change occurs which affects the restarting - router. - - This command disables it. -``` - -```{eval-rst} -.. cfgcmd:: set protocols ospf graceful-restart helper supported-grace-time - - Supports as HELPER for configured grace period. -``` - -```{eval-rst} -.. cfgcmd:: set protocols ospf graceful-restart helper planned-only - - It helps to support as HELPER only for planned restarts. - - By default, it supports both planned and unplanned outages. -``` - -#### Manual Neighbor Configuration - -OSPF routing devices normally discover their neighbors dynamically by -listening to the broadcast or multicast hello packets on the network. -Because an NBMA network does not support broadcast (or multicast), the -device cannot discover its neighbors dynamically, so you must configure all -the neighbors statically. - -```{eval-rst} -.. cfgcmd:: set protocols ospf neighbor - - This command specifies the IP address of the neighboring device. -``` - -```{eval-rst} -.. cfgcmd:: set protocols ospf neighbor poll-interval - - This command specifies the length of time, in seconds, before the routing - device sends hello packets out of the interface before it establishes - adjacency with a neighbor. The range is 1 to 65535 seconds. The default - value is 60 seconds. -``` - -```{eval-rst} -.. cfgcmd:: set protocols ospf neighbor priority - - This command specifies the router priority value of the nonbroadcast - neighbor associated with the IP address specified. The default is 0. - This keyword does not apply to point-to-multipoint interfaces. - -``` - -#### Redistribution Configuration - -```{eval-rst} -.. cfgcmd:: set protocols ospf redistribute - - This command redistributes routing information from the given route source - to the OSPF process. There are five modes available for route source: bgp, - connected, kernel, rip, static. -``` - -```{eval-rst} -.. cfgcmd:: set protocols ospf default-metric - - This command specifies the default metric value of redistributed routes. - The metric range is 0 to 16777214. -``` - -```{eval-rst} -.. cfgcmd:: set protocols ospf redistribute metric - - This command specifies metric for redistributed routes from the given - route source. There are five modes available for route source: bgp, - connected, kernel, rip, static. The metric range is 1 to 16777214. -``` - -```{eval-rst} -.. cfgcmd:: set protocols ospf redistribute metric-type <1|2> - - This command specifies metric type for redistributed routes. Difference - between two metric types that metric type 1 is a metric which is - "commensurable" with inner OSPF links. When calculating a metric to the - external destination, the full path metric is calculated as a metric sum - path of a router which had advertised this link plus the link metric. - Thus, a route with the least summary metric will be selected. If external - link is advertised with metric type 2 the path is selected which lies - through the router which advertised this link with the least metric - despite of the fact that internal path to this router is longer (with more - cost). However, if two routers advertised an external link and with metric - type 2 the preference is given to the path which lies through the router - with a shorter internal path. If two different routers advertised two - links to the same external destimation but with different metric type, - metric type 1 is preferred. If type of a metric left undefined the router - will consider these external links to have a default metric type 2. -``` - -```{eval-rst} -.. cfgcmd:: set protocols ospf redistribute route-map - - This command allows to use route map to filter redistributed routes from - the given route source. There are five modes available for route source: - bgp, connected, kernel, rip, static. - -``` - -#### Operational Mode Commands - -```{eval-rst} -.. opcmd:: show ip ospf neighbor - - This command displays the neighbors status. -``` - -```none -Neighbor ID Pri State Dead Time Address Interface RXmtL RqstL DBsmL -10.0.13.1 1 Full/DR 38.365s 10.0.13.1 eth0:10.0.13.3 0 0 0 -10.0.23.2 1 Full/Backup 39.175s 10.0.23.2 eth1:10.0.23.3 0 0 0 -``` - -```{eval-rst} -.. opcmd:: show ip ospf neighbor detail - - This command displays the neighbors information in a detailed form, not - just a summary table. -``` - -```none - Neighbor 10.0.13.1, interface address 10.0.13.1 - In the area 0.0.0.0 via interface eth0 - Neighbor priority is 1, State is Full, 5 state changes - Most recent state change statistics: - Progressive change 11m55s ago - DR is 10.0.13.1, BDR is 10.0.13.3 - Options 2 *|-|-|-|-|-|E|- - Dead timer due in 34.854s - Database Summary List 0 - Link State Request List 0 - Link State Retransmission List 0 - Thread Inactivity Timer on - Thread Database Description Retransmision off - Thread Link State Request Retransmission on - Thread Link State Update Retransmission on - -Neighbor 10.0.23.2, interface address 10.0.23.2 - In the area 0.0.0.1 via interface eth1 - Neighbor priority is 1, State is Full, 4 state changes - Most recent state change statistics: - Progressive change 41.193s ago - DR is 10.0.23.3, BDR is 10.0.23.2 - Options 2 *|-|-|-|-|-|E|- - Dead timer due in 35.661s - Database Summary List 0 - Link State Request List 0 - Link State Retransmission List 0 - Thread Inactivity Timer on - Thread Database Description Retransmision off - Thread Link State Request Retransmission on - Thread Link State Update Retransmission on -``` - -```{eval-rst} -.. opcmd:: show ip ospf neighbor - - This command displays the neighbors information in a detailed form for a - neighbor whose IP address is specified. -``` - -```{eval-rst} -.. opcmd:: show ip ospf neighbor - - This command displays the neighbors status for a neighbor on the specified - interface. -``` - -```{eval-rst} -.. opcmd:: show ip ospf interface [] - - This command displays state and configuration of OSPF the specified - interface, or all interfaces if no interface is given. -``` - -```none -eth0 is up - ifindex 2, MTU 1500 bytes, BW 4294967295 Mbit - Internet Address 10.0.13.3/24, Broadcast 10.0.13.255, Area 0.0.0.0 - MTU mismatch detection: enabled - Router ID 10.0.23.3, Network Type BROADCAST, Cost: 1 - Transmit Delay is 1 sec, State Backup, Priority 1 - Backup Designated Router (ID) 10.0.23.3, Interface Address 10.0.13.3 - Multicast group memberships: OSPFAllRouters OSPFDesignatedRouters - Timer intervals configured, Hello 10s, Dead 40s, Wait 40s, Retransmit 5 - Hello due in 4.470s - Neighbor Count is 1, Adjacent neighbor count is 1 -eth1 is up - ifindex 3, MTU 1500 bytes, BW 4294967295 Mbit - Internet Address 10.0.23.3/24, Broadcast 10.0.23.255, Area 0.0.0.1 - MTU mismatch detection: enabled - Router ID 10.0.23.3, Network Type BROADCAST, Cost: 1 - Transmit Delay is 1 sec, State DR, Priority 1 - Backup Designated Router (ID) 10.0.23.2, Interface Address 10.0.23.2 - Saved Network-LSA sequence number 0x80000002 - Multicast group memberships: OSPFAllRouters OSPFDesignatedRouters - Timer intervals configured, Hello 10s, Dead 40s, Wait 40s, Retransmit 5 - Hello due in 4.563s - Neighbor Count is 1, Adjacent neighbor count is 1 -``` - -```{eval-rst} -.. opcmd:: show ip ospf route [detail] - - This command displays the OSPF routing table, as determined by the most - recent SPF calculation. With the optional {cfgcmd}`detail` argument, - each route item's advertiser router and network attribute will be shown. -``` - -```none -============ OSPF network routing table ============ -N IA 10.0.12.0/24 [3] area: 0.0.0.0 - via 10.0.13.3, eth0 -N 10.0.13.0/24 [1] area: 0.0.0.0 - directly attached to eth0 -N IA 10.0.23.0/24 [2] area: 0.0.0.0 - via 10.0.13.3, eth0 -N 10.0.34.0/24 [2] area: 0.0.0.0 - via 10.0.13.3, eth0 - -============ OSPF router routing table ============= -R 10.0.23.3 [1] area: 0.0.0.0, ABR - via 10.0.13.3, eth0 -R 10.0.34.4 [2] area: 0.0.0.0, ASBR - via 10.0.13.3, eth0 - -============ OSPF external routing table =========== -N E2 172.16.0.0/24 [2/20] tag: 0 - via 10.0.13.3, eth0 -``` - -The table consists of following data: - -**OSPF network routing table** – includes a list of acquired routes for all -accessible networks (or aggregated area ranges) of OSPF system. "IA" flag -means that route destination is in the area to which the router is not -connected, i.e. it’s an inter-area path. In square brackets a summary metric -for all links through which a path lies to this network is specified. "via" -prefix defines a router-gateway, i.e. the first router on the way to the -destination (next hop). -**OSPF router routing table** – includes a list of acquired routes to all -accessible ABRs and ASBRs. -**OSPF external routing table** – includes a list of acquired routes that are -external to the OSPF process. "E" flag points to the external link metric type -(E1 – metric type 1, E2 – metric type 2). External link metric is printed in -the "\/\" format. - -```{eval-rst} -.. opcmd:: show ip ospf border-routers - - This command displays a table of paths to area boundary and autonomous - system boundary routers. -``` - -```{eval-rst} -.. opcmd:: show ip ospf database - - This command displays a summary table with a database contents (LSA). -``` - -```none - OSPF Router with ID (10.0.13.1) - - Router Link States (Area 0.0.0.0) - -Link ID ADV Router Age Seq# CkSum Link count -10.0.13.1 10.0.13.1 984 0x80000005 0xd915 1 -10.0.23.3 10.0.23.3 1186 0x80000008 0xfe62 2 -10.0.34.4 10.0.34.4 1063 0x80000004 0x4e3f 1 - - Net Link States (Area 0.0.0.0) - -Link ID ADV Router Age Seq# CkSum -10.0.13.1 10.0.13.1 994 0x80000003 0x30bb -10.0.34.4 10.0.34.4 1188 0x80000001 0x9411 - - Summary Link States (Area 0.0.0.0) - -Link ID ADV Router Age Seq# CkSum Route -10.0.12.0 10.0.23.3 1608 0x80000001 0x6ab6 10.0.12.0/24 -10.0.23.0 10.0.23.3 981 0x80000003 0xe232 10.0.23.0/24 - - AS External Link States - -Link ID ADV Router Age Seq# CkSum Route -172.16.0.0 10.0.34.4 1063 0x80000001 0xc40d E2 172.16.0.0/24 [0x0] -``` - -```{eval-rst} -.. opcmd:: show ip ospf database [A.B.C.D] - [adv-router |self-originate] - - This command displays a database contents for a specific link advertisement - type. - - The type can be the following: - asbr-summary, external, network, nssa-external, opaque-area, opaque-as, - opaque-link, router, summary. - - [A.B.C.D] – link-state-id. With this specified the command displays portion - of the network environment that is being described by the advertisement. - The value entered depends on the advertisement’s LS type. It must be - entered in the form of an IP address. - - {cfgcmd}`adv-router ` – router id, which link advertisements need - to be reviewed. - - {cfgcmd}`self-originate` displays only self-originated LSAs from the local - router. -``` - -```none - OSPF Router with ID (10.0.13.1) - - Router Link States (Area 0.0.0.0) - -LS age: 1213 -Options: 0x2 : *|-|-|-|-|-|E|- -LS Flags: 0x3 -Flags: 0x0 -LS Type: router-LSA -Link State ID: 10.0.13.1 -Advertising Router: 10.0.13.1 -LS Seq Number: 80000009 -Checksum: 0xd119 -Length: 36 - - Number of Links: 1 - - Link connected to: a Transit Network - (Link ID) Designated Router address: 10.0.13.1 - (Link Data) Router Interface address: 10.0.13.1 - Number of TOS metrics: 0 - TOS 0 Metric: 1 -``` - -```{eval-rst} -.. opcmd:: show ip ospf database max-age - - This command displays LSAs in MaxAge list. - -``` - -#### Examples - -##### Enable OSPF - -**Node 1** - -```none -set interfaces loopback lo address 10.1.1.1/32 -set interfaces ethernet eth0 address 192.168.0.1/24 -set protocols ospf area 0 network 192.168.0.0/24 -set protocols ospf area 0 network 10.1.1.1/32 -set protocols ospf parameters router-id 10.1.1.1 -``` - -**Node 2** - -```none -set interfaces loopback lo address 10.1.1.2/32 -set interfaces ethernet eth0 address 192.168.0.2/24 -set protocols ospf area 0 network 192.168.0.0/24 -set protocols ospf area 0 network 10.1.1.2/32 -set protocols ospf parameters router-id 10.1.1.2 -``` - -Here's the neighbors up: - -```none -Node-1@vyos:~$ show ip ospf neighbor - -Neighbor ID Pri State Up Time Dead Time Address Interface RXmtL RqstL DBsmL -10.1.1.2 1 Full/DR 3m43s 36.094s 192.168.0.2 eth0:192.168.0.1 0 0 0 - - - -Node-2@vyos:~$ show ip ospf neighbor - -Neighbor ID Pri State Up Time Dead Time Address Interface RXmtL RqstL DBsmL -10.1.1.1 1 Full/Backup 3m47s 31.736s 192.168.0.1 eth0:192.168.0.2 0 0 0 -``` - -Here's the routes: - -```none -Node-1@vyos:~$ show ip route ospf -Codes: K - kernel route, C - connected, S - static, R - RIP, - O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP, - T - Table, v - VNC, V - VNC-Direct, A - Babel, F - PBR, - f - OpenFabric, - > - selected route, * - FIB route, q - queued, r - rejected, b - backup - t - trapped, o - offload failure - -O 10.1.1.1/32 [110/0] is directly connected, lo, weight 1, 00:00:14 -O>* 10.1.1.2/32 [110/1] via 192.168.0.2, eth0, weight 1, 00:00:07 -O 192.168.0.0/24 [110/1] is directly connected, eth0, weight 1, 00:03:32 - -Node-2@vyos:~$ show ip route ospf -Codes: K - kernel route, C - connected, S - static, R - RIP, - O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP, - T - Table, v - VNC, V - VNC-Direct, A - Babel, F - PBR, - f - OpenFabric, - > - selected route, * - FIB route, q - queued, r - rejected, b - backup - t - trapped, o - offload failure - -O>* 10.1.1.1/32 [110/1] via 192.168.0.1, eth0, weight 1, 00:00:11 -O 10.1.1.2/32 [110/0] is directly connected, lo, weight 1, 00:00:04 -O 192.168.0.0/24 [110/1] is directly connected, eth0, weight 1, 00:03:18 -``` - -##### Enable OSPF with route redistribution of the loopback and default originate: - -**Node 1** - -```none -set interfaces loopback lo address 10.1.1.1/32 -set protocols ospf area 0 network 192.168.0.0/24 -set protocols ospf default-information originate always -set protocols ospf default-information originate metric 10 -set protocols ospf default-information originate metric-type 2 -set protocols ospf log-adjacency-changes -set protocols ospf parameters router-id 10.1.1.1 -set protocols ospf redistribute connected metric-type 2 -set protocols ospf redistribute connected route-map CONNECT - -set policy route-map CONNECT rule 10 action permit -set policy route-map CONNECT rule 10 match interface lo -``` - -**Node 2** - -```none -set interfaces loopback lo address 10.2.2.2/32 -set protocols ospf area 0 network 192.168.0.0/24 -set protocols ospf log-adjacency-changes -set protocols ospf parameters router-id 10.2.2.2 -set protocols ospf redistribute connected metric-type 2 -set protocols ospf redistribute connected route-map CONNECT - -set policy route-map CONNECT rule 10 action permit -set policy route-map CONNECT rule 10 match interface lo -``` - -##### Enable OSPF and IGP-LDP synchronization: - -**Node 1:** - -```none -set interfaces loopback lo address 10.1.1.1/32 -set interfaces ethernet eth0 address 192.168.0.1/24 - -set protocols ospf area 0 network '192.168.0.0/24' -set protocols ospf area 0 network '10.1.1.1/32' -set protocols ospf parameters router-id '10.1.1.1' -set protocols ospf ldp-sync - -set protocols mpls interface eth0 -set protocols mpls ldp discovery transport-ipv4-address 10.1.1.1 -set protocols mpls ldp interface lo -set protocols mpls ldp interface eth0 -set protocols mpls ldp parameters transport-prefer-ipv4 -set protocols mpls ldp router-id 10.1.1.1 -``` - -This gives us IGP-LDP synchronization for all non-loopback interfaces with -a holddown timer of zero seconds: - -```none -Node-1@vyos:~$ show ip ospf mpls ldp-sync - eth0 - LDP-IGP Synchronization enabled: yes - Holddown timer in seconds: 0 - State: Sync achieved -``` - -##### Enable OSPF with Segment Routing (Experimental): - -**Node 1** - -```none -set interfaces loopback lo address 10.1.1.1/32 -set interfaces ethernet eth0 address 192.168.0.1/24 - -set protocols ospf area 0 network '192.168.0.0/24' -set protocols ospf area 0 network '10.1.1.1/32' -set protocols ospf parameters opaque-lsa -set protocols ospf parameters router-id '10.1.1.1' -set protocols ospf segment-routing global-block high-label-value '1100' -set protocols ospf segment-routing global-block low-label-value '1000' -set protocols ospf segment-routing prefix 10.1.1.1/32 index explicit-null -set protocols ospf segment-routing prefix 10.1.1.1/32 index value '1' -``` - -**Node 2** - -```none -set interfaces loopback lo address 10.1.1.2/32 -set interfaces ethernet eth0 address 192.168.0.2/24 - -set protocols ospf area 0 network '192.168.0.0/24' -set protocols ospf area 0 network '10.1.1.2/32' -set protocols ospf parameters opaque-lsa -set protocols ospf parameters router-id '10.1.1.2' -set protocols ospf segment-routing global-block high-label-value '1100' -set protocols ospf segment-routing global-block low-label-value '1000' -set protocols ospf segment-routing prefix 10.1.1.2/32 index explicit-null -set protocols ospf segment-routing prefix 10.1.1.2/32 index value '2' -``` - -This gives us MPLS segment routing enabled and labels for far end loopbacks: - -```none -Node-1@vyos:~$ show mpls table - Inbound Label Type Nexthop Outbound Label - ----------------------------------------------------------- - 1002 SR (OSPF) 192.168.0.2 IPv4 Explicit Null <-- Node-2 loopback learned on Node-1 - 15000 SR (OSPF) 192.168.0.2 implicit-null - 15001 SR (OSPF) 192.168.0.2 implicit-null - -Node-2@vyos:~$ show mpls table - Inbound Label Type Nexthop Outbound Label - ----------------------------------------------------------- - 1001 SR (OSPF) 192.168.0.1 IPv4 Explicit Null <-- Node-1 loopback learned on Node-2 - 15000 SR (OSPF) 192.168.0.1 implicit-null - 15001 SR (OSPF) 192.168.0.1 implicit-null -``` - -Here is the routing tables showing the MPLS segment routing label operations: - -```none -Node-1@vyos:~$ show ip route ospf -Codes: K - kernel route, C - connected, S - static, R - RIP, - O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP, - T - Table, v - VNC, V - VNC-Direct, A - Babel, F - PBR, - f - OpenFabric, - > - selected route, * - FIB route, q - queued, r - rejected, b - backup - t - trapped, o - offload failure - -O 10.1.1.1/32 [110/0] is directly connected, lo, weight 1, 00:03:43 -O>* 10.1.1.2/32 [110/1] via 192.168.0.2, eth0, label IPv4 Explicit Null, weight 1, 00:03:32 -O 192.168.0.0/24 [110/1] is directly connected, eth0, weight 1, 00:03:43 - -Node-2@vyos:~$ show ip route ospf -Codes: K - kernel route, C - connected, S - static, R - RIP, - O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP, - T - Table, v - VNC, V - VNC-Direct, A - Babel, F - PBR, - f - OpenFabric, - > - selected route, * - FIB route, q - queued, r - rejected, b - backup - t - trapped, o - offload failure - -O>* 10.1.1.1/32 [110/1] via 192.168.0.1, eth0, label IPv4 Explicit Null, weight 1, 00:03:36 -O 10.1.1.2/32 [110/0] is directly connected, lo, weight 1, 00:03:51 -O 192.168.0.0/24 [110/1] is directly connected, eth0, weight 1, 00:03:51 -``` - -(routing-ospfv3)= - -## OSPFv3 (IPv6) - -(ospf-v3-configuration)= - -### Configuration - -(ospf-v3-general)= - -#### General - -VyOS does not have a special command to start the OSPFv3 process. The OSPFv3 -process starts when the first ospf enabled interface is configured. - -```{eval-rst} -.. cfgcmd:: set protocols ospfv3 interface area - - This command specifies the OSPFv3 enabled interface. This command is also - used to enable the OSPF process. The area number can be specified in - decimal notation in the range from 0 to 4294967295. Or it can be specified - in dotted decimal notation similar to ip address. -``` - -```{eval-rst} -.. cfgcmd:: set protocols ospfv3 parameters router-id - - This command sets the router-ID of the OSPFv3 process. The router-ID may be - an IP address of the router, but need not be – it can be any arbitrary - 32bit number. However it MUST be unique within the entire OSPFv3 domain to - the OSPFv3 speaker – bad things will happen if multiple OSPFv3 speakers are - configured with the same router-ID! - -``` - -(ospf-v3-optional)= - -#### Optional - -```{eval-rst} -.. cfgcmd:: set protocols ospfv3 distance global - - This command change distance value of OSPFv3 globally. - The distance range is 1 to 255. -``` - -```{eval-rst} -.. cfgcmd:: set protocols ospfv3 distance ospfv3 - - - This command change distance value of OSPFv3. The arguments are the - distance values for external routes, inter-area routes and intra-area - routes respectively. The distance range is 1 to 255. -``` - -(ospf-v3-area-configuration)= - -#### Area Configuration - -```{eval-rst} -.. cfgcmd:: set protocols ospfv3 area range - - This command summarizes intra area paths from specified area into one - Type-3 Inter-Area Prefix LSA announced to other areas. This command can be - used only in ABR. -``` - -```{eval-rst} -.. cfgcmd:: set protocols ospfv3 area range not-advertise - - This command instead of summarizing intra area paths filter them - i.e. - intra area paths from this range are not advertised into other areas. This - command makes sense in ABR only. -``` - -(ospf-v3-interface-config)= - -#### Interface Configuration - -```{eval-rst} -.. cfgcmd:: set protocols ospfv3 interface ipv6 cost - - This command sets link cost for the specified interface. The cost value is - set to router-LSA’s metric field and used for SPF calculation. The cost - range is 1 to 65535. -``` - -```{eval-rst} -.. cfgcmd:: set protocols ospfv3 interface dead-interval - - Set number of seconds for router Dead Interval timer value used for Wait - Timer and Inactivity Timer. This value must be the same for all routers - attached to a common network. The default value is 40 seconds. The - interval range is 1 to 65535. -``` - -```{eval-rst} -.. cfgcmd:: set protocols ospfv3 interface hello-interval - - - Set number of seconds for Hello Interval timer value. Setting this value, - Hello packet will be sent every timer value seconds on the specified - interface. This value must be the same for all routers attached to a - common network. The default value is 10 seconds. The interval range is 1 - to 65535. -``` - -```{eval-rst} -.. cfgcmd:: set protocols ospfv3 interface mtu-ignore - - This command disables check of the MTU value in the OSPF DBD packets. - Thus, use of this command allows the OSPF adjacency to reach the FULL - state even though there is an interface MTU mismatch between two OSPF - routers. -``` - -```{eval-rst} -.. cfgcmd:: set protocols ospfv3 interface network - - This command allows to specify the distribution type for the network - connected to this interface: - - **broadcast** – broadcast IP addresses distribution. - **point-to-point** – address distribution in point-to-point networks. -``` - -```{eval-rst} -.. cfgcmd:: set protocols ospfv3 interface priority - - This command sets Router Priority integer value. The router with the - highest priority will be more eligible to become Designated Router. - Setting the value to 0, makes the router ineligible to become Designated - Router. The default value is 1. The interval range is 0 to 255. -``` - -```{eval-rst} -.. cfgcmd:: set protocols ospfv3 interface passive - - This command specifies interface as passive. Passive interface advertises - its address, but does not run the OSPF protocol (adjacencies are not formed - and hello packets are not generated). -``` - -```{eval-rst} -.. cfgcmd:: set protocols ospfv3 interface retransmit-interval - - - This command sets number of seconds for RxmtInterval timer value. This - value is used when retransmitting Database Description and Link State - Request packets if acknowledge was not received. The default value is 5 - seconds. The interval range is 3 to 65535. -``` - -```{eval-rst} -.. cfgcmd:: set protocols ospfv3 interface transmit-delay - - - This command sets number of seconds for InfTransDelay value. It allows to - set and adjust for each interface the delay interval before starting the - synchronizing process of the router's database with all neighbors. The - default value is 1 seconds. The interval range is 3 to 65535. -``` - -(ospf-v3-graceful-restart)= - -#### Graceful Restart - -```{eval-rst} -.. cfgcmd:: set protocols ospfv3 graceful-restart [grace-period (1-1800)] - - Configure Graceful Restart {rfc}`3623` restarting support. When enabled, - the default grace period is 120 seconds. - - To perform a graceful shutdown, the FRR ``graceful-restart prepare ip - ospf`` EXEC-level command needs to be issued before restarting the - ospfd daemon. -``` - -```{eval-rst} -.. cfgcmd:: set protocols ospfv3 graceful-restart helper enable [router-id A.B.C.D] - - Configure Graceful Restart {rfc}`3623` helper support. By default, helper support - is disabled for all neighbours. This config enables/disables helper support - on this router for all neighbours. - - To enable/disable helper support for a specific neighbour, the router-id - (A.B.C.D) has to be specified. -``` - -```{eval-rst} -.. cfgcmd:: set protocols ospfv3 graceful-restart helper lsa-check-disable - - By default `strict-lsa-checking` is configured then the helper will abort - the Graceful Restart when a LSA change occurs which affects the restarting - router. - - This command disables it. -``` - -```{eval-rst} -.. cfgcmd:: set protocols ospfv3 graceful-restart helper supported-grace-time - - Supports as HELPER for configured grace period. -``` - -```{eval-rst} -.. cfgcmd:: set protocols ospfv3 graceful-restart helper planned-only - - It helps to support as HELPER only for planned restarts. - - By default, it supports both planned and unplanned outages. -``` - -(ospf-v3-redistribution-config)= - -#### Redistribution Configuration - -```{eval-rst} -.. cfgcmd:: set protocols ospfv3 redistribute - - This command redistributes routing information from the given route source - to the OSPFv3 process. There are five modes available for route source: - bgp, connected, kernel, ripng, static. -``` - -```{eval-rst} -.. cfgcmd:: set protocols ospf redistribute route-map - - This command allows to use route map to filter redistributed routes from - given route source. There are five modes available for route source: bgp, - connected, kernel, ripng, static. -``` - -(ospf-v3-op-cmd)= - -#### Operational Mode Commands - -```{eval-rst} -.. opcmd:: show ipv6 ospfv3 neighbor - - This command displays the neighbors status. -``` - -```{eval-rst} -.. opcmd:: show ipv6 ospfv3 neighbor detail - - This command displays the neighbors information in a detailed form, not - just a summary table. -``` - -```{eval-rst} -.. opcmd:: show ipv6 ospfv3 neighbor drchoice - - This command displays the neighbor DR choice information. -``` - -```{eval-rst} -.. opcmd:: show ipv6 ospfv3 interface [prefix]|[ [prefix]] - - This command displays state and configuration of OSPF the specified - interface, or all interfaces if no interface is given. Whith the argument - {cfgcmd}`prefix` this command shows connected prefixes to advertise. -``` - -```{eval-rst} -.. opcmd:: show ipv6 ospfv3 route - - This command displays the OSPF routing table, as determined by the most - recent SPF calculation. -``` - -```{eval-rst} -.. opcmd:: show ipv6 ospfv3 border-routers - - This command displays a table of paths to area boundary and autonomous - system boundary routers. -``` - -```{eval-rst} -.. opcmd:: show ipv6 ospfv3 database - - This command displays a summary table with a database contents (LSA). -``` - -```{eval-rst} -.. opcmd:: show ipv6 ospfv3 database [A.B.C.D] - [adv-router |self-originate] - - This command displays a database contents for a specific link - advertisement type. -``` - -```{eval-rst} -.. opcmd:: show ipv6 ospfv3 redistribute - - This command displays external information redistributed into OSPFv3 -``` - -(ospf-v3-config-example)= - -#### Configuration Example - -A typical configuration using 2 nodes. - -**Node 1:** - -```none -set protocols ospfv3 interface eth1 area 0.0.0.0 -set protocols ospfv3 area 0.0.0.0 range 2001:db8:1::/64 -set protocols ospfv3 parameters router-id 192.168.1.1 -set protocols ospfv3 redistribute connected -``` - -**Node 2:** - -```none -set protocols ospfv3 interface eth1 area 0.0.0.0 -set protocols ospfv3 area 0.0.0.0 range 2001:db8:2::/64 -set protocols ospfv3 parameters router-id 192.168.2.1 -set protocols ospfv3 redistribute connected -``` - -**To see the redistributed routes:** - -```none -show ipv6 ospfv3 redistribute -``` - -:::{note} -You cannot easily redistribute IPv6 routes via OSPFv3 on a -WireGuard interface link. This requires you to configure link-local -addresses manually on the WireGuard interfaces, see {vytask}`T1483`. -::: - -Example configuration for WireGuard interfaces: - -**Node 1** - -```none -set interfaces wireguard wg01 address 'fe80::216:3eff:fe51:fd8c/64' -set interfaces wireguard wg01 address '192.168.0.1/24' -set interfaces wireguard wg01 peer ospf02 allowed-ips '::/0' -set interfaces wireguard wg01 peer ospf02 allowed-ips '0.0.0.0/0' -set interfaces wireguard wg01 peer ospf02 endpoint '10.1.1.101:12345' -set interfaces wireguard wg01 peer ospf02 pubkey 'ie3...=' -set interfaces wireguard wg01 port '12345' -set protocols ospfv3 parameters router-id 192.168.1.1 -set protocols ospfv3 interface 'wg01' area 0.0.0.0 -set protocols ospfv3 interface 'lo' area 0.0.0.0 -``` - -**Node 2** - -```none -set interfaces wireguard wg01 address 'fe80::216:3eff:fe0a:7ada/64' -set interfaces wireguard wg01 address '192.168.0.2/24' -set interfaces wireguard wg01 peer ospf01 allowed-ips '::/0' -set interfaces wireguard wg01 peer ospf01 allowed-ips '0.0.0.0/0' -set interfaces wireguard wg01 peer ospf01 endpoint '10.1.1.100:12345' -set interfaces wireguard wg01 peer ospf01 pubkey 'NHI...=' -set interfaces wireguard wg01 port '12345' -set protocols ospfv3 parameters router-id 192.168.1.2 -set protocols ospfv3 interface 'wg01' area 0.0.0.0 -set protocols ospfv3 interface 'lo' area 0.0.0.0 -``` - -**Status** - -```none -vyos@ospf01:~$ sh ipv6 ospfv3 neighbor -Neighbor ID Pri DeadTime State/IfState Duration I/F[State] -192.168.0.2 1 00:00:37 Full/PointToPoint 00:18:03 wg01[PointToPoint] - -vyos@ospf02# run sh ipv6 ospfv3 neighbor -Neighbor ID Pri DeadTime State/IfState Duration I/F[State] -192.168.0.1 1 00:00:39 Full/PointToPoint 00:19:44 wg01[PointToPoint] -``` diff --git a/docs/configuration/protocols/md-pim.md b/docs/configuration/protocols/md-pim.md deleted file mode 100644 index 1768be72..00000000 --- a/docs/configuration/protocols/md-pim.md +++ /dev/null @@ -1,304 +0,0 @@ ---- -lastproofread: '2023-11-13' ---- - -(pim)= - -# PIM – Protocol Independent Multicast - -VyOS supports {abbr}`PIM-SM (PIM Sparse Mode)` as well as -{abbr}`IGMP (Internet Group Management Protocol)` v2 and v3 - -{abbr}`PIM (Protocol Independent Multicast)` must be configured in every -interface of every participating router. Every router must also have the -location of the Rendevouz Point manually configured. Then, unidirectional -shared trees rooted at the Rendevouz Point will automatically be built -for multicast distribution. - -Traffic from multicast sources will go to the Rendezvous Point, and -receivers will pull it from a shared tree using {abbr}`IGMP (Internet -Group Management Protocol)`. - -Multicast receivers will talk IGMP to their local router, so, besides -having PIM configured in every router, IGMP must also be configured in -any router where there could be a multicast receiver locally connected. - -VyOS supports both IGMP version 2 and version 3 (which allows -source-specific multicast). - -## PIM-SM - PIM Sparse Mode - -```{eval-rst} -.. cfgcmd:: set protocols pim ecmp - - If PIM has the a choice of ECMP nexthops for a particular - {abbr}`RPF (Reverse Path Forwarding)`, PIM will cause S,G flows to be - spread out amongst the nexthops. If this command is not specified then - the first nexthop found will be used. -``` - -```{eval-rst} -.. cfgcmd:: set protocols pim ecmp rebalance - - If PIM is using ECMP and an interface goes down, cause PIM to rebalance all - S,G flows across the remaining nexthops. If this command is not configured - PIM only modifies those S,G flows that were using the interface that went - down. -``` - -```{eval-rst} -.. cfgcmd:: set protocols pim join-prune-interval - - Modify the join/prune interval that PIM uses to the new value. Time is - specified in seconds. - - The default time is 60 seconds. - - If you enter a value smaller than 60 seconds be aware that this can and - will affect convergence at scale. -``` - -```{eval-rst} -.. cfgcmd:: set protocols pim keep-alive-timer - - Modify the time out value for a S,G flow from 1-65535 seconds. If choosing - a value below 31 seconds be aware that some hardware platforms cannot see - data flowing in better than 30 second chunks. -``` - -```{eval-rst} -.. cfgcmd:: set protocols pim packets - - When processing packets from a neighbor process the number of packets - incoming at one time before moving on to the next task. - - The default value is 3 packets. - - This command is only useful at scale when you can possibly have a large - number of PIM control packets flowing. -``` - -```{eval-rst} -.. cfgcmd:: set protocols pim register-accept-list - - When PIM receives a register packet the source of the packet will be compared - to the prefix-list specified, and if a permit is received normal processing - continues. If a deny is returned for the source address of the register packet - a register stop message is sent to the source. -``` - -```{eval-rst} -.. cfgcmd:: set protocols pim register-suppress-time - - Modify the time that pim will register suppress a FHR will send register - notifications to the kernel. -``` - -```{eval-rst} -.. cfgcmd:: set protocols pim rp
group - - In order to use PIM, it is necessary to configure a {abbr}`RP (Rendezvous Point)` - for join messages to be sent to. Currently the only methodology to do this is - via static rendezvous point commands. - - All routers in the PIM network must agree on these values. - - The first ip address is the RP's address and the second value is the matching - prefix of group ranges covered. -``` - -```{eval-rst} -.. cfgcmd:: set protocols pim rp keep-alive-timer - - Modify the time out value for a S,G flow from 1-65535 seconds at - {abbr}`RP (Rendezvous Point)`. The normal keepalive period for the KAT(S,G) - defaults to 210 seconds. However, at the {abbr}`RP (Rendezvous Point)`, the - keepalive period must be at least the Register_Suppression_Time, or the RP - may time out the (S,G) state before the next Null-Register arrives. - Thus, the KAT(S,G) is set to max(Keepalive_Period, RP_Keepalive_Period) - when a Register-Stop is sent. - - If choosing a value below 31 seconds be aware that some hardware platforms - cannot see data flowing in better than 30 second chunks. - - See {rfc}`7761#section-4.1` for details. -``` - -```{eval-rst} -.. cfgcmd:: set protocols pim no-v6-secondary - - When sending PIM hello packets tell PIM to not send any v6 secondary - addresses on the interface. This information is used to allow PIM to use v6 - nexthops in it's decision for {abbr}`RPF (Reverse Path Forwarding)` lookup - if this option is not set (default). -``` - -```{eval-rst} -.. cfgcmd:: set protocols pim spt-switchover infinity-and-beyond [prefix-list ] - - On the last hop router if it is desired to not switch over to the SPT tree - configure this command. - - Optional parameter prefix-list can be use to control which groups to switch or - not switch. If a group is PERMIT as per the prefix-list, then the SPT switchover - does not happen for it and if it is DENY, then the SPT switchover happens. -``` - -```{eval-rst} -.. cfgcmd:: set protocols pim ssm prefix-list - - Specify a range of group addresses via a prefix-list that forces PIM to never - do {abbr}`SSM (Source-Specific Multicast)` over. -``` - -### Interface specific commands - -```{eval-rst} -.. cfgcmd:: set protocols pim interface bfd [profile ] - - Automatically create BFD session for each RIP peer discovered in this - interface. When the BFD session monitor signalize that the link is down - the RIP peer is removed and all the learned routes associated with that - peer are removed. - - If optional profile parameter is used, select a BFD profile for the BFD - sessions created via this interface. -``` - -```{eval-rst} -.. cfgcmd:: set protocols pim interface dr-priority - - Set the {abbr}`DR (Designated Router)` Priority for the interface. - This command is useful to allow the user to influence what node becomes - the DR for a LAN segment. -``` - -```{eval-rst} -.. cfgcmd:: set protocols pim interface hello - - Set the PIM hello and hold interval for a interface. -``` - -```{eval-rst} -.. cfgcmd:: set protocols pim interface no-bsm - - Tell PIM that we would not like to use this interface to process - bootstrap messages. -``` - -```{eval-rst} -.. cfgcmd:: set protocols pim interface no-unicast-bsm - - Tell PIM that we would not like to use this interface to process - unicast bootstrap messages. -``` - -```{eval-rst} -.. cfgcmd:: set protocols pim interface passive - - Disable sending and receiving PIM control packets on the interface. - - .. cfgcmd:: set protocols pim interface source-address - - If you have multiple addresses configured on a particular interface and would - like PIM to use a specific source address associated with that interface. -``` - -## IGMP - Internet Group Management Protocol) - -```{eval-rst} -.. cfgcmd:: set protocols pim igmp watermark-warning - - Configure watermark warning generation for an IGMP group limit. Generates - warning once the configured group limit is reached while adding new groups. -``` - -(pim-igmp-interface-commands)= - -### Interface specific commands - -```{eval-rst} -.. cfgcmd:: set protocols pim interface igmp - join source-address - - Use this command to allow the selected interface to join a multicast - group defining the multicast address you want to join and the source - IP address too. -``` - -```{eval-rst} -.. cfgcmd:: set protocols pim interface igmp - query-interval - - Use this command to configure in the selected interface the IGMP - host query interval (1-1800) in seconds that PIM will use. -``` - -```{eval-rst} -.. cfgcmd:: set protocols pim interface igmp - query-max-response-time - - Use this command to configure in the selected interface the IGMP - query response timeout value (10-250) in deciseconds. If a report is - not returned in the specified time, it will be assumed the (S,G) or - (\*,G) state {rfc}`7761#section-4.1` has timed out. -``` - -```{eval-rst} -.. cfgcmd:: set protocols pim interface igmp version - - Use this command to define in the selected interface whether you - choose IGMP version 2 or 3. - - The default value is 3. -``` - -#### Example - -In the following example we can see a basic multicast setup: - -```{image} /_static/images/multicast-basic.png -:align: center -:alt: Network Topology Diagram -:width: 90% -``` - -**Router 1** - -```none -set interfaces ethernet eth2 address '172.16.0.2/24' -set interfaces ethernet eth1 address '100.64.0.1/24' -set protocols ospf area 0 network '172.16.0.0/24' -set protocols ospf area 0 network '100.64.0.0/24' -set protocols igmp interface eth1 -set protocols pim interface eth1 -set protocols pim interface eth2 -set protocols pim rp address 172.16.255.1 group '224.0.0.0/4' -``` - -**Router 3** - -```none -set interfaces dummy dum0 address '172.16.255.1/24' -set interfaces ethernet eth0 address '172.16.0.1/24' -set interfaces ethernet eth1 address '172.16.1.1/24' -set protocols ospf area 0 network '172.16.0.0/24' -set protocols ospf area 0 network '172.16.255.0/24' -set protocols ospf area 0 network '172.16.1.0/24' -set protocols pim interface dum0 -set protocols pim interface eth0 -set protocols pim interface eth1 -set protocols pim rp address 172.16.255.1 group '224.0.0.0/4' -``` - -**Router 2** - -```none -set interfaces ethernet eth1 address '10.0.0.1/24' -set interfaces ethernet eth2 address '172.16.1.2/24' -set protocols ospf area 0 network '10.0.0.0/24' -set protocols ospf area 0 network '172.16.1.0/24' -set protocols pim interface eth1 -set protocols pim interface eth2 -set protocols pim rp address 172.16.255.1 group '224.0.0.0/4' -``` diff --git a/docs/configuration/protocols/md-pim6.md b/docs/configuration/protocols/md-pim6.md deleted file mode 100644 index 707ae606..00000000 --- a/docs/configuration/protocols/md-pim6.md +++ /dev/null @@ -1,100 +0,0 @@ -(pim6)= - -# PIM6 - Protocol Independent Multicast for IPv6 - -VyOS facilitates IPv6 Multicast by supporting **PIMv6** and **MLD**. - -PIMv6 (Protocol Independent Multicast for IPv6) must be configured in every -interface of every participating router. Every router must also have the -location of the Rendevouz Point manually configured. -Then, unidirectional shared trees rooted at the Rendevouz Point will -automatically be built for multicast distribution. - -Traffic from multicast sources will go to the Rendezvous Point, and receivers -will pull it from a shared tree using MLD (Multicast Listener Discovery). - -Multicast receivers will talk MLD to their local router, so, besides having -PIMv6 configured in every router, MLD must also be configured in any router -where there could be a multicast receiver locally connected. - -VyOS supports both MLD version 1 and version 2 -(which allows source-specific multicast). - -## Basic commands - -These are the commands for a basic setup. - -```{cfgcmd} set protocols pim6 interface \ - - Use this command to enable PIMv6 in the selected interface so that it - can communicate with PIMv6 neighbors. This command also enables MLD reports - and query on the interface unless {cfgcmd}`mld disable` is configured. -``` - - -```{cfgcmd} set protocols pim6 interface \ mld disable - -Disable MLD reports and query on the interface. -``` - - -## Tuning commands - -You can also tune multicast with the following commands. - -```{cfgcmd} set protocols pim6 interface \ mld interval \ - -Use this command to configure in the selected interface the MLD -host query interval (1-65535) in seconds that PIM will use. -The default value is 125 seconds. -``` - -```{cfgcmd} set protocols pim6 interface \ mld join \ - -Use this command to allow the selected interface to join a multicast group. -``` - -```{cfgcmd} set protocols pim6 interface \ mld join \ source \ - -Use this command to allow the selected interface to join a source-specific multicast -group. -``` - -```{cfgcmd} set protocols pim6 interface \ mld last-member-query-count \ - -Set the MLD last member query count. The default value is 2. -``` - -```{cfgcmd} set protocols pim6 interface \ mld last-member-query-interval \ - -Set the MLD last member query interval in milliseconds (100-6553500). The default value is 1000 milliseconds. -``` - -```{cfgcmd} set protocols pim6 interface \ mld max-response-time \ - -Set the MLD query response timeout in milliseconds (100-6553500). The default value is 10000 milliseconds. -``` - -```{cfgcmd} set protocols pim6 interface \ mld version \ - -Set the MLD version used on this interface. The default value is 2. -``` - - -### Configuration Example - -To enable MLD reports and query on interfaces `eth0` and `eth1`: - -```none -set protocols pim6 interface eth0 -set protocols pim6 interface eth1 -``` - -The following configuration explicitly joins multicast group `ff15::1234` on interface `eth1` -and source-specific multicast group `ff15::5678` with source address `2001:db8::1` on interface -`eth1`: - -```none -set protocols pim6 interface eth0 mld join ff15::1234 -set protocols pim6 interface eth1 mld join ff15::5678 source 2001:db8::1 -``` diff --git a/docs/configuration/protocols/md-rip.md b/docs/configuration/protocols/md-rip.md deleted file mode 100644 index 684337d6..00000000 --- a/docs/configuration/protocols/md-rip.md +++ /dev/null @@ -1,294 +0,0 @@ ---- -lastproofread: '2021-10-04' ---- - -(rip)= - -# RIP - -{abbr}`RIP (Routing Information Protocol)` is a widely deployed interior gateway -protocol. RIP was developed in the 1970s at Xerox Labs as part of the XNS -routing protocol. RIP is a distance-vector protocol and is based on the -Bellman-Ford algorithms. As a distance-vector protocol, RIP router send updates -to its neighbors periodically, thus allowing the convergence to a known -topology. In each update, the distance to any given network will be broadcast -to its neighboring router. - -Supported versions of RIP are: - -> - RIPv1 as described in {rfc}`1058` -> - RIPv2 as described in {rfc}`2453` - -## General Configuration - -```{cfgcmd} set protocols rip network \ - -This command enables RIP and sets the RIP enable interface by NETWORK. -The interfaces which have addresses matching with NETWORK are enabled. -``` - - -```{cfgcmd} set protocols rip interface \ - -This command specifies a RIP enabled interface by interface name. Both -the sending and receiving of RIP packets will be enabled on the port -specified in this command. -``` - - -```{cfgcmd} set protocols rip neighbor \ - -This command specifies a RIP neighbor. When a neighbor doesn’t understand -multicast, this command is used to specify neighbors. In some cases, not -all routers will be able to understand multicasting, where packets are -sent to a network or a group of addresses. In a situation where a neighbor -cannot process multicast packets, it is necessary to establish a direct -link between routers. -``` - - -```{cfgcmd} set protocols rip passive-interface interface \ - -This command sets the specified interface to passive mode. On passive mode -interface, all receiving packets are processed as normal and VyOS does not -send either multicast or unicast RIP packets except to RIP neighbors -specified with neighbor command. -``` - - -```{cfgcmd} set protocols rip passive-interface interface default - -This command specifies all interfaces to passive mode. -``` - -## Optional Configuration - -```{cfgcmd} set protocols rip default-distance \ - -This command change the distance value of RIP. The distance range is 1 to 255. - -> :::{note} -> Routes with a distance of 255 are effectively disabled and not -> installed into the kernel. -> ::: -``` - - -```{cfgcmd} set protocols rip network-distance \ distance \ - -This command sets default RIP distance to a specified value when the routes -source IP address matches the specified prefix. -``` - - -```{cfgcmd} set protocols rip network-distance \ access-list \ - -This command can be used with previous command to sets default RIP distance -to specified value when the route source IP address matches the specified -prefix and the specified access-list. -``` - - -```{cfgcmd} set protocols rip default-information originate - -This command generate a default route into the RIP. -``` - - -```{cfgcmd} set protocols rip distribute-list access-list \ \ - -This command can be used to filter the RIP path using access lists. -{cfgcmd}`in` and {cfgcmd}`out` this is the direction in which the access -lists are applied. -``` - - -```{cfgcmd} set protocols rip distribute-list interface \ access-list \ \ - -This command allows you apply access lists to a chosen interface to -filter the RIP path. -``` - - -```{cfgcmd} set protocols rip distribute-list prefix-list \ \ - -This command can be used to filter the RIP path using prefix lists. -{cfgcmd}`in` and {cfgcmd}`out` this is the direction in which the prefix -lists are applied. -``` - - -```{cfgcmd} set protocols rip distribute-list interface \ prefix-list \ \ - -This command allows you apply prefix lists to a chosen interface to -filter the RIP path. -``` - - -```{cfgcmd} set protocols rip route \ - -This command is specific to FRR and VyOS. The route command makes a static -route only inside RIP. This command should be used only by advanced users -who are particularly knowledgeable about the RIP protocol. In most cases, -we recommend creating a static route in VyOS and redistributing it in RIP -using {cfgcmd}`redistribute static`. -``` - - -```{cfgcmd} set protocols rip timers update \ - -This command specifies the update timer. Every update timer seconds, the -RIP process is awakened to send an unsolicited response message containing -the complete routing table to all neighboring RIP routers. The time range -is 5 to 2147483647. The default value is 30 seconds. -``` - - -```{cfgcmd} set protocols rip timers timeout \ - -This command specifies the timeout timer. Upon expiration of the timeout, -the route is no longer valid; however, it is retained in the routing table -for a short time so that neighbors can be notified that the route has been -dropped. The time range is 5 to 2147483647. The default value is 180 -seconds. -``` - - -```{cfgcmd} set protocols rip timers garbage-collection \ - -This command specifies the garbage-collection timer. Upon expiration of -the garbage-collection timer, the route is finally removed from the -routing table. The time range is 5 to 2147483647. The default value is 120 -seconds. -``` - -## Redistribution Configuration - -```{cfgcmd} set protocols rip redistribute \ - -This command redistributes routing information from the given route source -into the RIP tables. There are five modes available for route source: bgp, -connected, kernel, ospf, static. -``` - - -```{cfgcmd} set protocols rip redistribute \ metric \ - -This command specifies metric for redistributed routes from the given route -source. There are five modes available for route source: bgp, connected, -kernel, ospf, static. The metric range is 1 to 16. -``` - - -```{cfgcmd} set protocols rip redistribute \ route-map \ - -This command allows to use route map to filter redistributed routes from -the given route source. There are five modes available for route source: -bgp, connected, kernel, ospf, static. -``` - - -```{cfgcmd} set protocols rip default-metric \ - -This command modifies the default metric (hop count) value for redistributed -routes. The metric range is 1 to 16. The default value is 1. This command -does not affect connected route even if it is redistributed by -{cfgcmd}`redistribute connected`. To modify connected routes metric -value, please use {cfgcmd}`redistribute connected metric`. -``` - -## Interfaces Configuration - -```{cfgcmd} set interfaces \ \ ip rip authentication plaintext-password \ - -This command sets the interface with RIP simple password authentication. -This command also sets authentication string. The string must be shorter -than 16 characters. -``` - - -```{cfgcmd} set interfaces \ \ ip rip authentication md5 \ password \ - -This command sets the interface with RIP MD5 authentication. This command -also sets MD5 Key. The key must be shorter than 16 characters. -``` - - -```{cfgcmd} set interfaces \ \ ip rip split-horizon disable - -This command disables split-horizon on the interface. By default, VyOS does -not advertise RIP routes out the interface over which they were learned -(split horizon).3 -``` - - -```{cfgcmd} set interfaces \ \ ip rip split-horizon poison-reverse - -This command enables poison-reverse on the interface. If both poison reverse -and split horizon are enabled, then VyOS advertises the learned routes -as unreachable over the interface on which the route was learned. -``` - -## Operational Mode Commands - -```{opcmd} show ip rip - -This command displays RIP routes. -``` -```none -Codes: R - RIP, C - connected, S - Static, O - OSPF, B - BGP -Sub-codes: - (n) - normal, (s) - static, (d) - default, (r) - redistribute, - (i) - interface - - Network Next Hop Metric From Tag Time -C(i) 10.0.12.0/24 0.0.0.0 1 self 0 -C(i) 10.0.13.0/24 0.0.0.0 1 self 0 -R(n) 10.0.23.0/24 10.0.12.2 2 10.0.12.2 0 02:53 -``` - -```{opcmd} show ip rip status - -The command displays current RIP status. It includes RIP timer, filtering, -version, RIP enabled interface and RIP peer information. -``` -```none -Routing Protocol is "rip" - Sending updates every 30 seconds with +/-50%, next due in 11 seconds - Timeout after 180 seconds, garbage collect after 120 seconds - Outgoing update filter list for all interface is not set - Incoming update filter list for all interface is not set - Default redistribution metric is 1 - Redistributing: - Default version control: send version 2, receive any version - Interface Send Recv Key-chain - eth0 2 1 2 - eth2 2 1 2 - Routing for Networks: - 10.0.12.0/24 - eth0 - Routing Information Sources: - Gateway BadPackets BadRoutes Distance Last Update - 10.0.12.2 0 0 120 00:00:11 - Distance: (default is 120) -``` - -## Configuration Example - -Simple RIP configuration using 2 nodes and redistributing connected interfaces. - -**Node 1:** - -```none -set interfaces loopback address 10.1.1.1/32 -set protocols rip network 192.168.0.0/24 -set protocols rip redistribute connected -``` - -**Node 2:** - -```none -set interfaces loopback address 10.2.2.2/32 -set protocols rip network 192.168.0.0/24 -set protocols rip redistribute connected -``` diff --git a/docs/configuration/protocols/md-rpki.md b/docs/configuration/protocols/md-rpki.md deleted file mode 100644 index 1f4cf5bf..00000000 --- a/docs/configuration/protocols/md-rpki.md +++ /dev/null @@ -1,210 +0,0 @@ -(rpki)= - -# RPKI - -:::{pull-quote} - -There are two types of Network Admins who deal with BGP, those who have -created an international incident and/or outage, and those who are lying - --- [tweet by EvilMog](https://twitter.com/Evil_Mog/status/1230924170508169216), 2020-02-21 -::: - -{abbr}`RPKI (Resource Public Key Infrastructure)` is a framework designed to -secure the Internet routing infrastructure. It associates BGP route -announcements with the correct originating {abbr}`ASN (Autonomus System -Number)` which BGP routers can then use to check each route against the -corresponding {abbr}`ROA (Route Origin Authorisation)` for validity. RPKI is -described in {rfc}`6480`. - -A BGP-speaking router like VyOS can retrieve ROA information from RPKI -"Relying Party software" (often just called an "RPKI server" or "RPKI -validator") by using {abbr}`RTR (RPKI to Router)` protocol. There are several -open source implementations to choose from, such as NLNetLabs' [Routinator] -(written in Rust), OpenBSD's [rpki-client] (written in C), and [StayRTR] (written -in Go). The RTR protocol is described in {rfc}`8210`. - -:::{tip} -If you are new to these routing security technologies then there is an -[excellent guide to RPKI] by NLnet Labs which will get you up to speed -very quickly. Their documentation explains everything from what RPKI is to -deploying it in production. It also has some -[help and operational guidance] including "What can I do about my route -having an Invalid state?" -::: - -## Getting started - -First you will need to deploy an RPKI validator for your routers to use. NLnet -Labs provides a collection of [software] you can compare and settle on one. -Once your server is running you can start validating announcements. - -Imported prefixes during the validation may have values: - -> valid -> -> : The prefix and ASN that originated it match a signed ROA. These are -> probably trustworthy route announcements. -> -> invalid -> -> : The prefix or prefix length and ASN that originated it doesn't -> match any existing ROA. This could be the result of a prefix hijack, or -> merely a misconfiguration, but should probably be treated as -> untrustworthy route announcements. -> -> notfound -> -> : No ROA exists which covers that prefix. Unfortunately this is the case for -> about 40%-50% of the prefixes which were announced to the {abbr}`DFZ -> (default-free zone)` at the start of 2024. - -:::{note} -If you are responsible for the global addresses assigned to your -network, please make sure that your prefixes have ROAs associated with them -to avoid being `notfound` by RPKI. For most ASNs this will involve -publishing ROAs via your {abbr}`RIR (Regional Internet Registry)` (RIPE -NCC, APNIC, ARIN, LACNIC, or AFRINIC), and is something you are encouraged -to do whenever you plan to announce addresses into the DFZ. - -Particularly large networks may wish to run their own RPKI certificate -authority and publication server instead of publishing ROAs via their RIR. -This is a subject far beyond the scope of VyOS' documentation. Consider -reading about [Krill] if this is a rabbit hole you need or especially want -to dive down. -::: - -### Features of the Current Implementation - -In a nutshell, the current implementation provides the following features: - -- The BGP router can connect to one or more RPKI cache servers to receive - validated prefix to origin AS mappings. Advanced failover can be implemented - by server sockets with different preference values. -- If no connection to an RPKI cache server can be established after a - pre-defined timeout, the router will process routes without prefix origin - validation. It still will try to establish a connection to an RPKI cache - server in the background. -- By default, enabling RPKI does not change best path selection. In particular, - invalid prefixes will still be considered during best path selection. However, - the router can be configured to ignore all invalid prefixes. -- Route maps can be configured to match a specific RPKI validation state. This - allows the creation of local policies, which handle BGP routes based on the - outcome of the Prefix Origin Validation. -- Updates from the RPKI cache servers are directly applied and path selection is - updated accordingly. (Soft reconfiguration must be enabled for this to work). - -## Configuration - -```{cfgcmd} set protocols rpki polling-period \<1-86400\> - -Define the time interval to update the local cache - -The default value is 300 seconds. -``` - -```{cfgcmd} set protocols rpki expire-interval \<600-172800\> - -Set the number of seconds the router waits until the router -expires the cache. - -The default value is 7200 seconds. -``` - -```{cfgcmd} set protocols rpki retry-interval \<1-7200\> - -Set the number of seconds the router waits until retrying to connect -to the cache server. - -The default value is 600 seconds. -``` - -```{cfgcmd} set protocols rpki cache \ port \ - -Defined the IPv4, IPv6 or FQDN and port number of the caching RPKI caching -instance which is used. - -This is a mandatory setting. -``` - -```{cfgcmd} set protocols rpki cache \ preference \ - -Multiple RPKI caching instances can be supplied and they need a preference in -which their result sets are used. - -This is a mandatory setting. -``` - - -### SSH - -Connections to the RPKI caching server can not only be established by TCP using -the RTR protocol but you can also rely on a secure SSH session to the server. -This provides transport integrity and confidentiality and it is a good idea if -your validation software supports it. To enable SSH, first you need to create -an SSH client keypair using `generate ssh client-key -/config/auth/id_rsa_rpki`. Once your key is created you can setup the -connection. - -```{cfgcmd} set protocols rpki cache \ ssh username \ - -SSH username to establish an SSH connection to the cache server. -``` - -```{cfgcmd} set protocols rpki cache \ ssh private-key-file \ - -Local path that includes the private key file of the router. -``` - -```{cfgcmd} set protocols rpki cache \ ssh public-key-file \ - -Local path that includes the public key file of the router. -``` - -:::{note} -When using SSH, private-key-file and public-key-file -are mandatory options. -::: - -## Example - -We can build route-maps for import based on these states. Here is a simple -RPKI configuration, where `routinator` is the RPKI-validating "cache" -server with ip `192.0.2.1`: - -```none -set protocols rpki cache 192.0.2.1 port '3323' -set protocols rpki cache 192.0.2.1 preference '1' -``` - -Here is an example route-map to apply to routes learned at import. In this -filter we reject prefixes with the state `invalid`, and set a higher -`local-preference` if the prefix is RPKI `valid` rather than merely -`notfound`. - -```none -set policy route-map ROUTES-IN rule 10 action 'permit' -set policy route-map ROUTES-IN rule 10 match rpki 'valid' -set policy route-map ROUTES-IN rule 10 set local-preference '300' -set policy route-map ROUTES-IN rule 20 action 'permit' -set policy route-map ROUTES-IN rule 20 match rpki 'notfound' -set policy route-map ROUTES-IN rule 20 set local-preference '125' -set policy route-map ROUTES-IN rule 30 action 'deny' -set policy route-map ROUTES-IN rule 30 match rpki 'invalid' -``` - -Once your routers are configured to reject RPKI-invalid prefixes, you can -test whether the configuration is working correctly using Cloudflare's [test] -website. Keep in mind that in order for this to work, you need to have no -default routes or anything else that would still send traffic to RPKI-invalid -destinations. - -[excellent guide to rpki]: https://rpki.readthedocs.io/ -[help and operational guidance]: https://rpki.readthedocs.io/en/latest/about/help.html -[krill]: https://www.nlnetlabs.nl/projects/rpki/krill/ -[routinator]: https://www.nlnetlabs.nl/projects/rpki/routinator/ -[rpki-client]: https://www.rpki-client.org/ -[software]: https://rpki.readthedocs.io/en/latest/ops/tools.html#relying-party-software -[stayrtr]: https://github.com/bgp/stayrtr/ -[test]: https://isbgpsafeyet.com/ -[tweet by evilmog]: diff --git a/docs/configuration/protocols/md-segment-routing.md b/docs/configuration/protocols/md-segment-routing.md deleted file mode 100644 index af47d343..00000000 --- a/docs/configuration/protocols/md-segment-routing.md +++ /dev/null @@ -1,359 +0,0 @@ -(segment-routing)= - -# Segment Routing - -Segment Routing (SR) is a network architecture that is similar to source-routing -. In this architecture, the ingress router adds a list of segments, known as -SIDs, to the packet as it enters the network. These segments represent different -portions of the network path that the packet will take. - -The SR segments are portions of the network path taken by the packet, and are -called SIDs. At each node, the first SID of the list is read, executed as a -forwarding function, and may be popped to let the next node read the next SID of -the list. The SID list completely determines the path where the packet is -forwarded. - -Segment Routing can be applied to an existing MPLS-based data plane and defines -a control plane network architecture. In MPLS networks, segments are encoded as -MPLS labels and are added at the ingress router. These MPLS labels are then -exchanged and populated by Interior Gateway Protocols (IGPs) like IS-IS or OSPF -which are running on most ISPs. - -:::{note} -Segment routing defines a control plane network architecture and -can be applied to an existing MPLS based dataplane. In the MPLS networks, -segments are encoded as MPLS labels and are imposed at the ingress router. -MPLS labels are exchanged and populated by IGPs like IS-IS.Segment Routing -as per RFC8667 for MPLS dataplane. It supports IPv4, IPv6 and ECMP and has -been tested against Cisco & Juniper routers.however,this deployment is still -EXPERIMENTAL for FRR. -::: - -## IS-IS SR Configuration - -Segment routing (SR) is used by the IGP protocols to interconnect network -devices, below configuration shows how to enable SR on IS-IS: - -:::{note} -``Known limitations:`` - -No support for level redistribution (L1 to L2 or L2 to L1) - -No support for binding SID - -No support for SRLB - -Only one SRGB and default SPF Algorithm is supported -::: - -```{cfgcmd} set protocols isis segment-routing global-block high-label-value \ - -Set the Segment Routing Global Block i.e. the label range used by MPLS to -store label in the MPLS FIB for Prefix SID. Note that the block size may -not exceed 65535. -``` - - -```{cfgcmd} set protocols isis segment-routing global-block low-label-value \ - -Set the Segment Routing Global Block i.e. the low label range used by MPLS to -store label in the MPLS FIB for Prefix SID. Note that the block size may -not exceed 65535. -``` - - -```{cfgcmd} set protocols isis segment-routing local-block high-label-value \ - -Set the Segment Routing Local Block i.e. the label range used by MPLS to -store label in the MPLS FIB for Prefix SID. Note that the block size may -not exceed 65535.Segment Routing Local Block, The negative command always -unsets both. -``` - - -```{cfgcmd} set protocols isis segment-routing local-block \ - -Set the Segment Routing Local Block i.e. the low label range used by MPLS to -store label in the MPLS FIB for Prefix SID. Note that the block size may -not exceed 65535.Segment Routing Local Block, The negative command always -unsets both. -``` - - -```{cfgcmd} set protocols isis segment-routing maximum-label-depth \<1-16\> - -Set the Maximum Stack Depth supported by the router. The value depend of -the MPLS dataplane. -``` - - -```{cfgcmd} set protocols isis segment-routing prefix \ index value \<0-65535\> - -A segment ID that contains an IP address prefix calculated by an IGP in the -service provider core network. Prefix SIDs are globally unique, this value -identify it -``` - - -```{cfgcmd} set protocols isis segment-routing prefix \ index \ - -this option allows to configure prefix-sid on SR. The ‘no-php-flag’ means NO -Penultimate Hop Popping that allows SR node to request to its neighbor to -not pop the label. The ‘explicit-null’ flag allows SR node to request to its -neighbor to send IP packet with the EXPLICIT-NULL label. The ‘n-flag-clear’ -option can be used to explicitly clear the Node flag that is set by default -for Prefix-SIDs associated to loopback addresses. This option is necessary -to configure Anycast-SIDs. -``` - -```{opcmd} show isis segment-routing node - - Show detailed information about all learned Segment Routing Nodes -``` - - -```{opcmd} show isis route prefix-sid - -Show detailed information about prefix-sid and label learned -``` - -:::{note} -more information related IGP - {ref}`routing-isis` -::: - - -## OSPF SR Configuration - - -Segment routing (SR) is used by the IGP protocols to interconnect network -devices, below configuration shows how to enable SR on OSPF: - -```{cfgcmd} set protocols ospf parameters opaque-lsa - -Enable the Opaque-LSA capability (rfc2370), necessary to transport label -on IGP -``` - -```{cfgcmd} set protocols ospf segment-routing global-block high-label-value \ - -Set the Segment Routing Global Block i.e. the label range used by MPLS to -store label in the MPLS FIB for Prefix SID. Note that the block size may -not exceed 65535. -``` - -```{cfgcmd} set protocols ospf segment-routing global-block low-label-value \ - -Set the Segment Routing Global Block i.e. the low label range used by MPLS to -store label in the MPLS FIB for Prefix SID. Note that the block size may -not exceed 65535. -``` - -```{cfgcmd} set protocols ospf segment-routing local-block high-label-value \ - -Set the Segment Routing Local Block i.e. the label range used by MPLS to -store label in the MPLS FIB for Prefix SID. Note that the block size may -not exceed 65535.Segment Routing Local Block, The negative command always -unsets both. -``` - -```{cfgcmd} set protocols ospf segment-routing local-block \ - -Set the Segment Routing Local Block i.e. the low label range used by MPLS to -store label in the MPLS FIB for Prefix SID. Note that the block size may -not exceed 65535.Segment Routing Local Block, The negative command always -unsets both. -``` - -```{cfgcmd} set protocols ospf segment-routing maximum-label-depth \<1-16\> - -Set the Maximum Stack Depth supported by the router. The value depend of -the MPLS dataplane. -``` - -```{cfgcmd} set protocols ospf segment-routing prefix \ index value \<0-65535\> - -A segment ID that contains an IP address prefix calculated by an IGP in the -service provider core network. Prefix SIDs are globally unique, this value -identify it -``` - -```{cfgcmd} set protocols ospf segment-routing prefix \ index \ - -this option allows to configure prefix-sid on SR. The ‘no-php-flag’ means NO -Penultimate Hop Popping that allows SR node to request to its neighbor to -not pop the label. The ‘explicit-null’ flag allows SR node to request to its -neighbor to send IP packet with the EXPLICIT-NULL label. The ‘n-flag-clear’ -option can be used to explicitly clear the Node flag that is set by default -for Prefix-SIDs associated to loopback addresses. This option is necessary -to configure Anycast-SIDs. -``` - -:::{note} -more information related IGP - {ref}`routing-ospf` -::: - -## Configuration Example - -we described the configuration SR ISIS / SR OSPF using 2 connected with them to -share label information. - -### Enable IS-IS with Segment Routing (Experimental) - -**Node 1:** - -```none -set interfaces loopback lo address '192.168.255.255/32' -set interfaces ethernet eth1 address '192.0.2.1/24' - -set protocols isis interface eth1 -set protocols isis interface lo -set protocols isis net '49.0001.1921.6825.5255.00' -set protocols isis segment-routing global-block high-label-value '599' -set protocols isis segment-routing global-block low-label-value '550' -set protocols isis segment-routing prefix 192.168.255.255/32 index value '1' -set protocols isis segment-routing prefix 192.168.255.255/32 index explicit-null -set protocols mpls interface 'eth1' -``` - -**Node 2:** - -```none -set interfaces loopback lo address '192.168.255.254/32' -set interfaces ethernet eth1 address '192.0.2.2/24' - -set protocols isis interface eth1 -set protocols isis interface lo -set protocols isis net '49.0001.1921.6825.5254.00' -set protocols isis segment-routing global-block high-label-value '599' -set protocols isis segment-routing global-block low-label-value '550' -set protocols isis segment-routing prefix 192.168.255.254/32 index value '2' -set protocols isis segment-routing prefix 192.168.255.254/32 index explicit-null -set protocols mpls interface 'eth1' -``` - -This gives us MPLS segment routing enabled and labels for far end loopbacks: - -```none -Node-1@vyos:~$ show mpls table - Inbound Label Type Nexthop Outbound Label - ---------------------------------------------------------------------- - 552 SR (IS-IS) 192.0.2.2 IPv4 Explicit Null <-- Node-2 loopback learned on Node-1 - 15000 SR (IS-IS) 192.0.2.2 implicit-null - 15001 SR (IS-IS) fe80::e87:6cff:fe09:1 implicit-null - 15002 SR (IS-IS) 192.0.2.2 implicit-null - 15003 SR (IS-IS) fe80::e87:6cff:fe09:1 implicit-null - -Node-2@vyos:~$ show mpls table - Inbound Label Type Nexthop Outbound Label - --------------------------------------------------------------------- - 551 SR (IS-IS) 192.0.2.1 IPv4 Explicit Null <-- Node-1 loopback learned on Node-2 - 15000 SR (IS-IS) 192.0.2.1 implicit-null - 15001 SR (IS-IS) fe80::e33:2ff:fe80:1 implicit-null - 15002 SR (IS-IS) 192.0.2.1 implicit-null - 15003 SR (IS-IS) fe80::e33:2ff:fe80:1 implicit-null -``` - -Here is the routing tables showing the MPLS segment routing label operations: - -```none -Node-1@vyos:~$ show ip route isis -Codes: K - kernel route, C - connected, S - static, R - RIP, - O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP, - T - Table, v - VNC, V - VNC-Direct, A - Babel, F - PBR, - f - OpenFabric, - > - selected route, * - FIB route, q - queued, r - rejected, b - backup - t - trapped, o - offload failure - -I 192.0.2.0/24 [115/20] via 192.0.2.2, eth1 inactive, weight 1, 00:07:48 -I>* 192.168.255.254/32 [115/20] via 192.0.2.2, eth1, label IPv4 Explicit Null, weight 1, 00:03:39 - -Node-2@vyos:~$ show ip route isis -Codes: K - kernel route, C - connected, S - static, R - RIP, - O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP, - T - Table, v - VNC, V - VNC-Direct, A - Babel, F - PBR, - f - OpenFabric, - > - selected route, * - FIB route, q - queued, r - rejected, b - backup - t - trapped, o - offload failure - -I 192.0.2.0/24 [115/20] via 192.0.2.1, eth1 inactive, weight 1, 00:07:46 -I>* 192.168.255.255/32 [115/20] via 192.0.2.1, eth1, label IPv4 Explicit Null, weight 1, 00:03:43 -``` - - -### Enable OSPF with Segment Routing (Experimental): - -**Node 1** - -```none -set interfaces loopback lo address 10.1.1.1/32 -set interfaces ethernet eth0 address 192.168.0.1/24 -set protocols ospf area 0 network '192.168.0.0/24' -set protocols ospf area 0 network '10.1.1.1/32' -set protocols ospf parameters opaque-lsa -set protocols ospf parameters router-id '10.1.1.1' -set protocols ospf segment-routing global-block high-label-value '1100' -set protocols ospf segment-routing global-block low-label-value '1000' -set protocols ospf segment-routing prefix 10.1.1.1/32 index explicit-null -set protocols ospf segment-routing prefix 10.1.1.1/32 index value '1' -``` - -**Node 2** - -```none -set interfaces loopback lo address 10.1.1.2/32 -set interfaces ethernet eth0 address 192.168.0.2/24 -set protocols ospf area 0 network '192.168.0.0/24' -set protocols ospf area 0 network '10.1.1.2/32' -set protocols ospf parameters opaque-lsa -set protocols ospf parameters router-id '10.1.1.2' -set protocols ospf segment-routing global-block high-label-value '1100' -set protocols ospf segment-routing global-block low-label-value '1000' -set protocols ospf segment-routing prefix 10.1.1.2/32 index explicit-null -set protocols ospf segment-routing prefix 10.1.1.2/32 index value '2' -``` - -This gives us MPLS segment routing enabled and labels for far end loopbacks: - -```none -Node-1@vyos:~$ show mpls table - Inbound Label Type Nexthop Outbound Label - ----------------------------------------------------------- - 1002 SR (OSPF) 192.168.0.2 IPv4 Explicit Null <-- Node-2 loopback learned on Node-1 - 15000 SR (OSPF) 192.168.0.2 implicit-null - 15001 SR (OSPF) 192.168.0.2 implicit-null - -Node-2@vyos:~$ show mpls table - Inbound Label Type Nexthop Outbound Label - ----------------------------------------------------------- - 1001 SR (OSPF) 192.168.0.1 IPv4 Explicit Null <-- Node-1 loopback learned on Node-2 - 15000 SR (OSPF) 192.168.0.1 implicit-null - 15001 SR (OSPF) 192.168.0.1 implicit-null -``` - -Here is the routing tables showing the MPLS segment routing label operations: - -```none -Node-1@vyos:~$ show ip route ospf -Codes: K - kernel route, C - connected, S - static, R - RIP, - O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP, - T - Table, v - VNC, V - VNC-Direct, A - Babel, F - PBR, - f - OpenFabric, - > - selected route, * - FIB route, q - queued, r - rejected, b - backup - t - trapped, o - offload failure - -O 10.1.1.1/32 [110/0] is directly connected, lo, weight 1, 00:03:43 -O>* 10.1.1.2/32 [110/1] via 192.168.0.2, eth0, label IPv4 Explicit Null, weight 1, 00:03:32 -O 192.168.0.0/24 [110/1] is directly connected, eth0, weight 1, 00:03:43 - -Node-2@vyos:~$ show ip route ospf -Codes: K - kernel route, C - connected, S - static, R - RIP, - O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP, - T - Table, v - VNC, V - VNC-Direct, A - Babel, F - PBR, - f - OpenFabric, - > - selected route, * - FIB route, q - queued, r - rejected, b - backup - t - trapped, o - offload failure - -O>* 10.1.1.1/32 [110/1] via 192.168.0.1, eth0, label IPv4 Explicit Null, weight 1, 00:03:36 -O 10.1.1.2/32 [110/0] is directly connected, lo, weight 1, 00:03:51 -O 192.168.0.0/24 [110/1] is directly connected, eth0, weight 1, 00:03:51 -``` diff --git a/docs/configuration/protocols/md-static.md b/docs/configuration/protocols/md-static.md deleted file mode 100644 index fca17a6c..00000000 --- a/docs/configuration/protocols/md-static.md +++ /dev/null @@ -1,268 +0,0 @@ -(routing-static)= - -# Static - -Static routes are manually configured routes, which, in general, cannot be -updated dynamically from information VyOS learns about the network topology from -other routing protocols. However, if a link fails, the router will remove -routes, including static routes, from the {abbr}`RIPB (Routing Information -Base)` that used this interface to reach the next hop. In general, static -routes should only be used for very simple network topologies, or to override -the behavior of a dynamic routing protocol for a small number of routes. The -collection of all routes the router has learned from its configuration or from -its dynamic routing protocols is stored in the RIB. Unicast routes are directly -used to determine the forwarding table used for unicast packet forwarding. - -## Static Routes - -```{eval-rst} -.. cfgcmd:: set protocols static route next-hop
- - Configure next-hop `
` for an IPv4 static route. Multiple static - routes can be created. -``` - -```{eval-rst} -.. cfgcmd:: set protocols static route next-hop
disable - - Disable this IPv4 static route entry. -``` - -```{eval-rst} -.. cfgcmd:: set protocols static route next-hop
- distance - - Defines next-hop distance for this route, routes with smaller administrative - distance are elected prior to those with a higher distance. - - Range is 1 to 255, default is 1. - - .. note:: Routes with a distance of 255 are effectively disabled and not - installed into the kernel. -``` - -```{eval-rst} -.. cfgcmd:: set protocols static route6 next-hop
- - Configure next-hop `
` for an IPv6 static route. Multiple static - routes can be created. -``` - -```{eval-rst} -.. cfgcmd:: set protocols static route6 next-hop
disable - - Disable this IPv6 static route entry. -``` - -```{eval-rst} -.. cfgcmd:: set protocols static route6 next-hop
- distance - - Defines next-hop distance for this route, routes with smaller administrative - distance are elected prior to those with a higher distance. - - Range is 1 to 255, default is 1. - - .. note:: Routes with a distance of 255 are effectively disabled and not - installed into the kernel. -``` - -```{eval-rst} -.. cfgcmd:: set protocols static route6 next-hop
segments - - It is possible to specify a static route for ipv6 prefixes using an SRv6 segments - instruction. The `/` separator can be used to specify multiple segment instructions. - - Example: - - .. code-block:: none - - set protocols static route6 2001:db8:1000::/36 next-hop 2001:db8:201::ffff segments '2001:db8:aaaa::7/2002::4/2002::3/2002::2' - - .. code-block:: none - - vyos@vyos:~$ show ipv6 route - Codes: K - kernel route, C - connected, S - static, R - RIPng, - O - OSPFv3, I - IS-IS, B - BGP, N - NHRP, T - Table, - v - VNC, V - VNC-Direct, A - Babel, F - PBR, - f - OpenFabric, - > - selected route, * - FIB route, q - queued, r - rejected, b - backup - t - trapped, o - offload failure - C>* 2001:db8:201::/64 is directly connected, eth0.201, 00:00:46 - S>* 2001:db8:1000::/36 [1/0] via 2001:db8:201::ffff, eth0.201, seg6 2001:db8:aaaa::7,2002::4,2002::3,2002::2, weight 1, 00:00:08 - -``` - -### Interface Routes - -```{eval-rst} -.. cfgcmd:: set protocols static route interface - - - Allows you to configure the next-hop interface for an interface-based IPv4 - static route. `` will be the next-hop interface where traffic is - routed for the given ``. -``` - -```{eval-rst} -.. cfgcmd:: set protocols static route interface - disable - - Disables interface-based IPv4 static route. -``` - -```{eval-rst} -.. cfgcmd:: set protocols static route interface - distance - - Defines next-hop distance for this route, routes with smaller administrative - distance are elected prior to those with a higher distance. - - Range is 1 to 255, default is 1. -``` - -```{eval-rst} -.. cfgcmd:: set protocols static route6 interface - - - Allows you to configure the next-hop interface for an interface-based IPv6 - static route. `` will be the next-hop interface where traffic is - routed for the given ``. -``` - -```{eval-rst} -.. cfgcmd:: set protocols static route6 interface - disable - - Disables interface-based IPv6 static route. -``` - -```{eval-rst} -.. cfgcmd:: set protocols static route6 interface - distance - - Defines next-hop distance for this route, routes with smaller administrative - distance are elected prior to those with a higher distance. - - Range is 1 to 255, default is 1. -``` - -```{eval-rst} -.. cfgcmd:: set protocols static route6 interface - segments - - It is possible to specify a static route for ipv6 prefixes using an SRv6 segments - instruction. The `/` separator can be used to specify multiple segment instructions. - - Example: - - .. code-block:: none - - set protocols static route6 2001:db8:1000::/36 interface eth0 segments '2001:db8:aaaa::7/2002::4/2002::3/2002::2' -``` - -### Blackhole - -```{eval-rst} -.. cfgcmd:: set protocols static route blackhole - - Use this command to configure a "black-hole" route on the router. A - black-hole route is a route for which the system silently discard packets - that are matched. This prevents networks leaking out public interfaces, but - it does not prevent them from being used as a more specific route inside your - network. -``` - -```{eval-rst} -.. cfgcmd:: set protocols static route blackhole distance - - Defines blackhole distance for this route, routes with smaller administrative - distance are elected prior to those with a higher distance. -``` - -```{eval-rst} -.. cfgcmd:: set protocols static route6 blackhole - - Use this command to configure a "black-hole" route on the router. A - black-hole route is a route for which the system silently discard packets - that are matched. This prevents networks leaking out public interfaces, but - it does not prevent them from being used as a more specific route inside your - network. -``` - -```{eval-rst} -.. cfgcmd:: set protocols static route6 blackhole distance - - Defines blackhole distance for this route, routes with smaller administrative - distance are elected prior to those with a higher distance. -``` - -### Alternate Routing Tables - -TBD - -Alternate routing tables are used with policy based routing by utilizing -{ref}`vrf`. - -(routing-arp)= - -# ARP - -{abbr}`ARP (Address Resolution Protocol)` is a communication protocol used for -discovering the link layer address, such as a MAC address, associated with a -given internet layer address, typically an IPv4 address. This mapping is a -critical function in the Internet protocol suite. ARP was defined in 1982 by -{rfc}`826` which is Internet Standard STD 37. - -In Internet Protocol Version 6 (IPv6) networks, the functionality of ARP is -provided by the Neighbor Discovery Protocol (NDP). - -To manipulate or display [ARP] table entries, the following commands are -implemented. - -## Configure - -```{eval-rst} -.. cfgcmd:: set protocols static arp interface address - mac - - This will configure a static ARP entry always resolving `
` to - `` for interface ``. - - Example: - - .. code-block:: none - - set protocols static arp interface eth0 address 192.0.2.1 mac 01:23:45:67:89:01 - -``` - -## Operation - -```{eval-rst} -.. opcmd:: show protocols static arp - - Display all known ARP table entries spanning across all interfaces -``` - -```none -vyos@vyos:~$ show protocols static arp -Address HWtype HWaddress Flags Mask Iface -10.1.1.1 ether 00:53:00:de:23:2e C eth1 -10.1.1.100 ether 00:53:00:de:23:aa CM eth1 -``` - -```{eval-rst} -.. opcmd:: show protocols static arp interface eth1 - - Display all known ARP table entries on a given interface only (`eth1`): -``` - -```none -vyos@vyos:~$ show protocols static arp interface eth1 -Address HWtype HWaddress Flags Mask Iface -10.1.1.1 ether 00:53:00:de:23:2e C eth1 -10.1.1.100 ether 00:53:00:de:23:aa CM eth1 -``` - -[arp]: https://en.wikipedia.org/wiki/Address_Resolution_Protocol diff --git a/docs/configuration/protocols/mpls.md b/docs/configuration/protocols/mpls.md new file mode 100644 index 00000000..71b14be2 --- /dev/null +++ b/docs/configuration/protocols/mpls.md @@ -0,0 +1,285 @@ +(mpls)= + +# MPLS + +{abbr}`MPLS (Multi-Protocol Label Switching)` is a packet forwarding paradigm +which differs from regular IP forwarding. Instead of IP addresses being used to +make the decision on finding the exit interface, a router will instead use an +exact match on a 32 bit/4 byte header called the MPLS label. This label is +inserted between the ethernet (layer 2) header and the IP (layer 3) header. +One can statically or dynamically assign label allocations, but we will focus +on dynamic allocation of labels using some sort of label distribution protocol +(such as the aptly named Label Distribution Protocol / LDP, Resource Reservation +Protocol / RSVP, or Segment Routing through OSPF/ISIS). These protocols allow +for the creation of a unidirectional/unicast path called a labeled switched +path (initialized as LSP) throughout the network that operates very much like +a tunnel through the network. An easy way of thinking about how an MPLS LSP +actually forwards traffic throughout a network is to think of a GRE tunnel. +They are not the same in how they operate, but they are the same in how they +handle the tunneled packet. It would be good to think of MPLS as a tunneling +technology that can be used to transport many different types of packets, to +aid in traffic engineering by allowing one to specify paths throughout the +network (using RSVP or SR), and to generally allow for easier intra/inter +network transport of data packets. + +For more information on how MPLS label switching works, please go visit +[Wikipedia (MPLS)]. + +:::{note} +MPLS support in VyOS is not finished yet, and therefore its +functionality is limited. Currently there is no support for MPLS enabled VPN +services such as L2VPNs and mVPNs. RSVP support is also not present as the +underlying routing stack (FRR) does not implement it. Currently VyOS +implements LDP as described in RFC 5036; other LDP standard are the +following ones: RFC 6720, RFC 6667, RFC 5919, RFC 5561, RFC 7552, RFC 4447. +Because MPLS is already available (FRR also supports RFC 3031). +::: + +## Label Distribution Protocol + +The {abbr}`MPLS (Multi-Protocol Label Switching)` architecture does not assume +a single protocol to create MPLS paths. VyOS supports the Label Distribution +Protocol (LDP) as implemented by FRR, based on {rfc}`5036`. + +{abbr}`LDP (Label Distribution Protocol)` is a TCP based MPLS signaling protocol +that distributes labels creating MPLS label switched paths in a dynamic manner. +LDP is not a routing protocol, as it relies on other routing protocols for +forwarding decisions. LDP cannot bootstrap itself, and therefore relies on said +routing protocols for communication with other routers that use LDP. + +In order to allow for LDP on the local router to exchange label advertisements +with other routers, a TCP session will be established between automatically +discovered and statically assigned routers. LDP will try to establish a TCP +session to the **transport address** of other routers. Therefore for LDP to +function properly please make sure the transport address is shown in the +routing table and reachable to traffic at all times. + +It is highly recommended to use the same address for both the LDP router-id and +the discovery transport address, but for VyOS MPLS LDP to work both parameters +must be explicitly set in the configuration. + +Another thing to keep in mind with LDP is that much like BGP, it is a protocol +that runs on top of TCP. It however does not have an ability to do something +like a refresh capability like BGPs route refresh capability. Therefore one +might have to reset the neighbor for a capability change or a configuration +change to work. + +## Configuration Options + +```{cfgcmd} set protocols mpls interface \ + +Use this command to enable MPLS processing on the interface you define. +``` + + +```{cfgcmd} set protocols mpls ldp interface \ + +Use this command to enable LDP on the interface you define. +``` + + +```{cfgcmd} set protocols mpls ldp router-id \ + +Use this command to configure the IP address used as the LDP router-id of the +local device. +``` + + +```{cfgcmd} set protocols mpls ldp discovery transport-ipv4-address \ + +``` +```{cfgcmd} set protocols mpls ldp discovery transport-ipv6-address \ + +Use this command to set the IPv4 or IPv6 transport-address used by LDP. +``` + +```{cfgcmd} set protocols mpls ldp neighbor \ password \ + +Use this command to configure authentication for LDP peers. Set the +IP address of the LDP peer and a password that should be shared in +order to become neighbors. +``` + +```{cfgcmd} set protocols mpls ldp neighbor \ session-holdtime \ + +Use this command to configure a specific session hold time for LDP peers. +Set the IP address of the LDP peer and a session hold time that should be +configured for it. You may have to reset the neighbor for this to work. +``` + +```{cfgcmd} set protocols mpls ldp neighbor \ ttl-security \ + +Use this command to enable, disable, or specify hop count for TTL security +for LDP peers. By default the value is set to 255 (or max TTL). +``` + +```{eval-rst} +.. cfgcmd:: set protocols mpls ldp discovery hello-ipv4-interval +.. cfgcmd:: set protocols mpls ldp discovery hello-ipv4-holdtime +.. cfgcmd:: set protocols mpls ldp discovery hello-ipv6-interval +.. cfgcmd:: set protocols mpls ldp discovery hello-ipv6-holdtime + + Use these commands if you would like to set the discovery hello and hold time + parameters. +``` + +```{eval-rst} +.. cfgcmd:: set protocols mpls ldp discovery session-ipv4-holdtime +.. cfgcmd:: set protocols mpls ldp discovery session-ipv6-holdtime + + Use this command if you would like to set the TCP session hold time intervals. +``` + +```{eval-rst} +.. cfgcmd:: set protocols mpls ldp import ipv4 import-filter filter-access-list + +.. cfgcmd:: set protocols mpls ldp import ipv6 import-filter filter-access-list6 + + + Use these commands to control the importing of forwarding equivalence classes + (FECs) for LDP from neighbors. This would be useful for example on only + accepting the labeled routes that are needed and not ones that are not + needed, such as accepting loopback interfaces and rejecting all others. +``` + +```{eval-rst} +.. cfgcmd:: set protocols mpls ldp export ipv4 export-filter filter-access-list + +.. cfgcmd:: set protocols mpls ldp export ipv6 export-filter filter-access-list6 + + + Use these commands to control the exporting of forwarding equivalence classes + (FECs) for LDP to neighbors. This would be useful for example on only + announcing the labeled routes that are needed and not ones that are not + needed, such as announcing loopback interfaces and no others. +``` + +```{eval-rst} +.. cfgcmd:: set protocols mpls ldp export ipv4 explicit-null +.. cfgcmd:: set protocols mpls ldp export ipv6 explicit-null + + Use this command if you would like for the router to advertise FECs with a + label of 0 for explicit null operations. +``` + +```{eval-rst} +.. cfgcmd:: set protocols mpls ldp allocation ipv4 access-list +.. cfgcmd:: set protocols mpls ldp allocation ipv6 access-list6 + + Use this command if you would like to control the local FEC allocations for + LDP. A good example would be for your local router to not allocate a label for + everything. Just a label for what it's useful. A good example would be just a + loopback label. +``` + +```{cfgcmd} set protocols mpls ldp parameters cisco-interop-tlv + +Use this command to use a Cisco non-compliant format to send and interpret +the Dual-Stack capability TLV for IPv6 LDP communications. This is related to +{rfc}`7552`. +``` + +```{cfgcmd} set protocols mpls ldp parameters ordered-control + +Use this command to use ordered label distribution control mode. FRR +by default uses independent label distribution control mode for label +distribution. This is related to {rfc}`5036`. +``` + +```{cfgcmd} set protocols mpls ldp parameters transport-prefer-ipv4 + +Use this command to prefer IPv4 for TCP peer transport connection for LDP +when both an IPv4 and IPv6 LDP address are configured on the same interface. +``` + +```{cfgcmd} set protocols mpls ldp targeted-neighbor ipv4 enable +``` + +```{cfgcmd} set protocols mpls ldp targeted-neighbor ipv6 enable + +Use this command to enable targeted LDP sessions to the local router. The +router will then respond to any sessions that are trying to connect to it that +are not a link local type of TCP connection. +``` + +```{cfgcmd} set protocols mpls ldp targeted-neighbor ipv4 address \ +``` + +```{cfgcmd} set protocols mpls ldp targeted-neighbor ipv6 address \ + +Use this command to enable the local router to try and connect with a targeted +LDP session to another router. +``` + +```{cfgcmd} set protocols mpls ldp targeted-neighbor ipv4 hello-holdtime \ +``` + +```{cfgcmd} set protocols mpls ldp targeted-neighbor ipv4 hello-interval \ +``` + +```{cfgcmd} set protocols mpls ldp targeted-neighbor ipv6 hello-holdtime \ +``` + +```{cfgcmd} set protocols mpls ldp targeted-neighbor ipv6 hello-interval \ + +Use these commands if you would like to set the discovery hello and hold time +parameters for the targeted LDP neighbors. +``` + +### Sample configuration to setup LDP on VyOS + +```none +set protocols ospf area 0 network '192.168.255.252/32' <--- Routing for loopback +set protocols ospf area 0 network '192.168.0.5/32' <--- Routing for an interface connecting to the network +set protocols ospf parameters router-id '192.168.255.252' <--- Router ID setting for OSPF +set protocols mpls interface 'eth1' <--- Enable MPLS for an interface connecting to network +set protocols mpls ldp discovery transport-ipv4-address '192.168.255.252' <--- Transport address for LDP for TCP sessions to connect to +set protocols mpls ldp interface 'eth1' <--- Enable LDP for an interface connecting to network +set protocols mpls ldp interface 'lo' <--- Enable LDP on loopback for future services connectivity +set protocols mpls ldp router-id '192.168.255.252' <--- Router ID setting for LDP +set interfaces ethernet eth1 address '192.168.0.5/31' <--- Interface IP for connecting to network +set interfaces loopback lo address '192.168.255.252/32' <--- Interface loopback IP for router ID and other uses +``` + +## Operational Mode Commands + +When LDP is working, you will be able to see label information in the outcome +of `show ip route`. Besides that information, there are also specific *show* +commands for LDP: + +### Show + +```{opcmd} show mpls ldp binding + +Use this command to see the Label Information Base. + +``` + +```{opcmd} show mpls ldp discovery + +Use this command to see discovery hello information +``` + +```{opcmd} show mpls ldp interface + +Use this command to see LDP interface information +``` + +```{opcmd} show mpls ldp neighbor + +Use this command to see LDP neighbor information +``` + +```{opcmd} show mpls ldp neighbor detail + +Use this command to see detailed LDP neighbor information +``` + +### Reset + +```{opcmd} reset mpls ldp neighbor \ + +Use this command to reset an LDP neighbor/TCP session that is established +``` + +[wikipedia (mpls)]: diff --git a/docs/configuration/protocols/mpls.rst b/docs/configuration/protocols/mpls.rst deleted file mode 100644 index 550473d7..00000000 --- a/docs/configuration/protocols/mpls.rst +++ /dev/null @@ -1,259 +0,0 @@ -.. _mpls: - -#### -MPLS -#### - -:abbr:`MPLS (Multi-Protocol Label Switching)` is a packet forwarding paradigm -which differs from regular IP forwarding. Instead of IP addresses being used to -make the decision on finding the exit interface, a router will instead use an -exact match on a 32 bit/4 byte header called the MPLS label. This label is -inserted between the ethernet (layer 2) header and the IP (layer 3) header. -One can statically or dynamically assign label allocations, but we will focus -on dynamic allocation of labels using some sort of label distribution protocol -(such as the aptly named Label Distribution Protocol / LDP, Resource Reservation -Protocol / RSVP, or Segment Routing through OSPF/ISIS). These protocols allow -for the creation of a unidirectional/unicast path called a labeled switched -path (initialized as LSP) throughout the network that operates very much like -a tunnel through the network. An easy way of thinking about how an MPLS LSP -actually forwards traffic throughout a network is to think of a GRE tunnel. -They are not the same in how they operate, but they are the same in how they -handle the tunneled packet. It would be good to think of MPLS as a tunneling -technology that can be used to transport many different types of packets, to -aid in traffic engineering by allowing one to specify paths throughout the -network (using RSVP or SR), and to generally allow for easier intra/inter -network transport of data packets. - -For more information on how MPLS label switching works, please go visit -`Wikipedia (MPLS)`_. - -.. note:: MPLS support in VyOS is not finished yet, and therefore its - functionality is limited. Currently there is no support for MPLS enabled VPN - services such as L2VPNs and mVPNs. RSVP support is also not present as the - underlying routing stack (FRR) does not implement it. Currently VyOS - implements LDP as described in RFC 5036; other LDP standard are the - following ones: RFC 6720, RFC 6667, RFC 5919, RFC 5561, RFC 7552, RFC 4447. - Because MPLS is already available (FRR also supports RFC 3031). - - -Label Distribution Protocol -=========================== - -The :abbr:`MPLS (Multi-Protocol Label Switching)` architecture does not assume -a single protocol to create MPLS paths. VyOS supports the Label Distribution -Protocol (LDP) as implemented by FRR, based on :rfc:`5036`. - -:abbr:`LDP (Label Distribution Protocol)` is a TCP based MPLS signaling protocol -that distributes labels creating MPLS label switched paths in a dynamic manner. -LDP is not a routing protocol, as it relies on other routing protocols for -forwarding decisions. LDP cannot bootstrap itself, and therefore relies on said -routing protocols for communication with other routers that use LDP. - -In order to allow for LDP on the local router to exchange label advertisements -with other routers, a TCP session will be established between automatically -discovered and statically assigned routers. LDP will try to establish a TCP -session to the **transport address** of other routers. Therefore for LDP to -function properly please make sure the transport address is shown in the -routing table and reachable to traffic at all times. - -It is highly recommended to use the same address for both the LDP router-id and -the discovery transport address, but for VyOS MPLS LDP to work both parameters -must be explicitly set in the configuration. - -Another thing to keep in mind with LDP is that much like BGP, it is a protocol -that runs on top of TCP. It however does not have an ability to do something -like a refresh capability like BGPs route refresh capability. Therefore one -might have to reset the neighbor for a capability change or a configuration -change to work. - -Configuration Options -===================== - -.. cfgcmd:: set protocols mpls interface - - Use this command to enable MPLS processing on the interface you define. - -.. cfgcmd:: set protocols mpls ldp interface - - Use this command to enable LDP on the interface you define. - -.. cfgcmd:: set protocols mpls ldp router-id
- - Use this command to configure the IP address used as the LDP router-id of the - local device. - -.. cfgcmd:: set protocols mpls ldp discovery transport-ipv4-address
-.. cfgcmd:: set protocols mpls ldp discovery transport-ipv6-address
- - Use this command to set the IPv4 or IPv6 transport-address used by LDP. - -.. cfgcmd:: set protocols mpls ldp neighbor
password - - Use this command to configure authentication for LDP peers. Set the - IP address of the LDP peer and a password that should be shared in - order to become neighbors. - -.. cfgcmd:: set protocols mpls ldp neighbor
session-holdtime - - Use this command to configure a specific session hold time for LDP peers. - Set the IP address of the LDP peer and a session hold time that should be - configured for it. You may have to reset the neighbor for this to work. - -.. cfgcmd:: set protocols mpls ldp neighbor
ttl-security - - - Use this command to enable, disable, or specify hop count for TTL security - for LDP peers. By default the value is set to 255 (or max TTL). - -.. cfgcmd:: set protocols mpls ldp discovery hello-ipv4-interval -.. cfgcmd:: set protocols mpls ldp discovery hello-ipv4-holdtime -.. cfgcmd:: set protocols mpls ldp discovery hello-ipv6-interval -.. cfgcmd:: set protocols mpls ldp discovery hello-ipv6-holdtime - - Use these commands if you would like to set the discovery hello and hold time - parameters. - -.. cfgcmd:: set protocols mpls ldp discovery session-ipv4-holdtime -.. cfgcmd:: set protocols mpls ldp discovery session-ipv6-holdtime - - Use this command if you would like to set the TCP session hold time intervals. - -.. cfgcmd:: set protocols mpls ldp import ipv4 import-filter filter-access-list - -.. cfgcmd:: set protocols mpls ldp import ipv6 import-filter filter-access-list6 - - - Use these commands to control the importing of forwarding equivalence classes - (FECs) for LDP from neighbors. This would be useful for example on only - accepting the labeled routes that are needed and not ones that are not - needed, such as accepting loopback interfaces and rejecting all others. - -.. cfgcmd:: set protocols mpls ldp export ipv4 export-filter filter-access-list - -.. cfgcmd:: set protocols mpls ldp export ipv6 export-filter filter-access-list6 - - - Use these commands to control the exporting of forwarding equivalence classes - (FECs) for LDP to neighbors. This would be useful for example on only - announcing the labeled routes that are needed and not ones that are not - needed, such as announcing loopback interfaces and no others. - -.. cfgcmd:: set protocols mpls ldp export ipv4 explicit-null -.. cfgcmd:: set protocols mpls ldp export ipv6 explicit-null - - Use this command if you would like for the router to advertise FECs with a - label of 0 for explicit null operations. - -.. cfgcmd:: set protocols mpls ldp allocation ipv4 access-list - -.. cfgcmd:: set protocols mpls ldp allocation ipv6 access-list6 - - - Use this command if you would like to control the local FEC allocations for - LDP. A good example would be for your local router to not allocate a label for - everything. Just a label for what it's useful. A good example would be just a - loopback label. - -.. cfgcmd:: set protocols mpls ldp parameters cisco-interop-tlv - - Use this command to use a Cisco non-compliant format to send and interpret - the Dual-Stack capability TLV for IPv6 LDP communications. This is related to - :rfc:`7552`. - -.. cfgcmd:: set protocols mpls ldp parameters ordered-control - - Use this command to use ordered label distribution control mode. FRR - by default uses independent label distribution control mode for label - distribution. This is related to :rfc:`5036`. - -.. cfgcmd:: set protocols mpls ldp parameters transport-prefer-ipv4 - - Use this command to prefer IPv4 for TCP peer transport connection for LDP - when both an IPv4 and IPv6 LDP address are configured on the same interface. - -.. cfgcmd:: set protocols mpls ldp targeted-neighbor ipv4 enable -.. cfgcmd:: set protocols mpls ldp targeted-neighbor ipv6 enable - - Use this command to enable targeted LDP sessions to the local router. The - router will then respond to any sessions that are trying to connect to it that - are not a link local type of TCP connection. - -.. cfgcmd:: set protocols mpls ldp targeted-neighbor ipv4 address
-.. cfgcmd:: set protocols mpls ldp targeted-neighbor ipv6 address
- - Use this command to enable the local router to try and connect with a targeted - LDP session to another router. - -.. cfgcmd:: set protocols mpls ldp targeted-neighbor ipv4 hello-holdtime - -.. cfgcmd:: set protocols mpls ldp targeted-neighbor ipv4 hello-interval - -.. cfgcmd:: set protocols mpls ldp targeted-neighbor ipv6 hello-holdtime - -.. cfgcmd:: set protocols mpls ldp targeted-neighbor ipv6 hello-interval - - - Use these commands if you would like to set the discovery hello and hold time - parameters for the targeted LDP neighbors. - - -Sample configuration to setup LDP on VyOS ------------------------------------------ - -.. code-block:: none - - set protocols ospf area 0 network '192.168.255.252/32' <--- Routing for loopback - set protocols ospf area 0 network '192.168.0.5/32' <--- Routing for an interface connecting to the network - set protocols ospf parameters router-id '192.168.255.252' <--- Router ID setting for OSPF - set protocols mpls interface 'eth1' <--- Enable MPLS for an interface connecting to network - set protocols mpls ldp discovery transport-ipv4-address '192.168.255.252' <--- Transport address for LDP for TCP sessions to connect to - set protocols mpls ldp interface 'eth1' <--- Enable LDP for an interface connecting to network - set protocols mpls ldp interface 'lo' <--- Enable LDP on loopback for future services connectivity - set protocols mpls ldp router-id '192.168.255.252' <--- Router ID setting for LDP - set interfaces ethernet eth1 address '192.168.0.5/31' <--- Interface IP for connecting to network - set interfaces loopback lo address '192.168.255.252/32' <--- Interface loopback IP for router ID and other uses - - -Operational Mode Commands -========================= - -When LDP is working, you will be able to see label information in the outcome -of ``show ip route``. Besides that information, there are also specific *show* -commands for LDP: - -Show ----- - -.. opcmd:: show mpls ldp binding - - Use this command to see the Label Information Base. - -.. opcmd:: show mpls ldp discovery - - Use this command to see discovery hello information - -.. opcmd:: show mpls ldp interface - - Use this command to see LDP interface information - -.. opcmd:: show mpls ldp neighbor - - Use this command to see LDP neighbor information - -.. opcmd:: show mpls ldp neighbor detail - - Use this command to see detailed LDP neighbor information - -Reset ------ - -.. opcmd:: reset mpls ldp neighbor - - Use this command to reset an LDP neighbor/TCP session that is established - - -.. stop_vyoslinter - -.. _`Wikipedia (MPLS)`: https://en.wikipedia.org/wiki/Multiprotocol_Label_Switching - -.. start_vyoslinter \ No newline at end of file diff --git a/docs/configuration/protocols/ospf.md b/docs/configuration/protocols/ospf.md new file mode 100644 index 00000000..adc62520 --- /dev/null +++ b/docs/configuration/protocols/ospf.md @@ -0,0 +1,1560 @@ +(routing-ospf)= + +# OSPF + +{abbr}`OSPF (Open Shortest Path First)` is a routing protocol for Internet +Protocol (IP) networks. It uses a link state routing (LSR) algorithm and falls +into the group of interior gateway protocols (IGPs), operating within a single +autonomous system (AS). It is defined as OSPF Version 2 in {rfc}`2328` (1998) +for IPv4. Updates for IPv6 are specified as OSPF Version 3 in {rfc}`5340` +(2008). OSPF supports the {abbr}`CIDR (Classless Inter-Domain Routing)` +addressing model. + +OSPF is a widely used IGP in large enterprise networks. + +## OSPFv2 (IPv4) + +### Configuration + +#### General + +VyOS does not have a special command to start the OSPF process. The OSPF process +starts when the first ospf enabled interface is configured. + +```{eval-rst} +.. cfgcmd:: set protocols ospf area network + + This command specifies the OSPF enabled interface(s). If the interface has + an address from defined range then the command enables OSPF on this + interface so router can provide network information to the other ospf + routers via this interface. + + This command is also used to enable the OSPF process. The area number can be + specified in decimal notation in the range from 0 to 4294967295. Or it + can be specified in dotted decimal notation similar to ip address. + + Prefix length in interface must be equal or bigger (i.e. smaller network) + than prefix length in network statement. For example statement above doesn't + enable ospf on interface with address 192.168.1.1/23, but it does on + interface with address 192.168.1.129/25. + + In some cases it may be more convenient to enable OSPF on a per + interface/subnet + basis {cfgcmd}`set protocols ospf interface area ` +``` + +```{eval-rst} +.. cfgcmd:: set protocols ospf auto-cost reference-bandwidth + + This command sets the reference bandwidth for cost calculations, where + bandwidth can be in range from 1 to 4294967, specified in Mbits/s. The + default is 100Mbit/s (i.e. a link of bandwidth 100Mbit/s or higher will + have a cost of 1. Cost of lower bandwidth links will be scaled with + reference to this cost). +``` + +```{eval-rst} +.. cfgcmd:: set protocols ospf parameters router-id + + This command sets the router-ID of the OSPF process. The router-ID may be an + IP address of the router, but need not be – it can be any arbitrary 32bit + number. However it MUST be unique within the entire OSPF domain to the OSPF + speaker – bad things will happen if multiple OSPF speakers are configured + with the same router-ID! + +``` + +#### Optional + +```{eval-rst} +.. cfgcmd:: set protocols ospf default-information originate [always] + [metric ] [metric-type <1|2>] [route-map ] + + Originate an AS-External (type-5) LSA describing a default route into all + external-routing capable areas, of the specified metric and metric type. + If the {cfgcmd}`always` keyword is given then the default is always + advertised, even when there is no default present in the routing table. + The argument {cfgcmd}`route-map` specifies to advertise the default route + if the route map is satisfied. +``` + +```{eval-rst} +.. cfgcmd:: set protocols ospf distance global + + This command change distance value of OSPF globally. + The distance range is 1 to 255. +``` + +```{eval-rst} +.. cfgcmd:: set protocols ospf distance ospf + + + This command change distance value of OSPF. The arguments are the distance + values for external routes, inter-area routes and intra-area routes + respectively. The distance range is 1 to 255. + + .. note:: Routes with a distance of 255 are effectively disabled and not + installed into the kernel. +``` + +```{eval-rst} +.. cfgcmd:: set protocols ospf log-adjacency-changes [detail] + + This command allows to log changes in adjacency. With the optional + {cfgcmd}`detail` argument, all changes in adjacency status are shown. + Without {cfgcmd}`detail`, only changes to full or regressions are shown. +``` + +```{eval-rst} +.. cfgcmd:: set protocols ospf max-metric router-lsa + |on-startup > + + This enables {rfc}`3137` support, where the OSPF process describes its + transit links in its router-LSA as having infinite distance so that other + routers will avoid calculating transit paths through the router while + still being able to reach networks through the router. + + This support may be enabled administratively (and indefinitely) with the + {cfgcmd}`administrative` command. It may also be enabled conditionally. + Conditional enabling of max-metric router-lsas can be for a period of + seconds after startup with the {cfgcmd}`on-startup ` command + and/or for a period of seconds prior to shutdown with the + {cfgcmd}`on-shutdown ` command. The time range is 5 to 86400. +``` + +```{eval-rst} +.. cfgcmd:: set protocols ospf parameters abr-type + + + This command selects ABR model. OSPF router supports four ABR models: + + **cisco** – a router will be considered as ABR if it has several configured + links to the networks in different areas one of which is a backbone area. + Moreover, the link to the backbone area should be active (working). + **ibm** – identical to "cisco" model but in this case a backbone area link + may not be active. + **standard** – router has several active links to different areas. + **shortcut** – identical to "standard" but in this model a router is + allowed to use a connected areas topology without involving a backbone + area for inter-area connections. + + Detailed information about "cisco" and "ibm" models differences can be + found in {rfc}`3509`. A "shortcut" model allows ABR to create routes + between areas based on the topology of the areas connected to this router + but not using a backbone area in case if non-backbone route will be + cheaper. For more information about "shortcut" model, + see :t:`ospf-shortcut-abr-02.txt` +``` + +```{eval-rst} +.. cfgcmd:: set protocols ospf parameters rfc1583-compatibility + + {rfc}`2328`, the successor to {rfc}`1583`, suggests according to section + G.2 (changes) in section 16.4.1 a change to the path preference algorithm + that prevents possible routing loops that were possible in the old version + of OSPFv2. More specifically it demands that inter-area paths and + intra-area backbone path are now of equal preference but still both + preferred to external paths. + + This command should NOT be set normally. +``` + +```{eval-rst} +.. cfgcmd:: set protocols ospf interface passive [disable] + + This command specifies interface as passive. Passive interface advertises + its address, but does not run the OSPF protocol (adjacencies are not formed + and hello packets are not generated). + + The optional `disable` option allows to exclude interface from passive state. + This command is used if the command {cfgcmd}`passive-interface default` was + configured. +``` + +```{eval-rst} +.. cfgcmd:: set protocols ospf passive-interface default + + This command specifies all interfaces as passive by default. Because this + command changes the configuration logic to a default passive; therefore, + interfaces where router adjacencies are expected need to be configured + by setting the {cfgcmd}`passive disable` flag for the specific interface. +``` + +```{eval-rst} +.. cfgcmd:: set protocols ospf maximum-paths <1-64> + + Use this command to control the maximum number of equal cost paths to reach + a specific destination. The upper limit may differ if you change the value + of MULTIPATH_NUM during compilation. The default is MULTIPATH_NUM (64). +``` + +```{eval-rst} +.. cfgcmd:: set protocols ospf refresh timers + + The router automatically updates link-state information with its neighbors. + Only an obsolete information is updated which age has exceeded a specific + threshold. This parameter changes a threshold value, which by default is + 1800 seconds (half an hour). The value is applied to the whole OSPF router. + The timer range is 10 to 1800. +``` + +```{eval-rst} +.. cfgcmd:: set protocols ospf timers throttle spf + + + This command sets the initial delay, the initial-holdtime and the + maximum-holdtime between when SPF is calculated and the event which + triggered the calculation. The times are specified in milliseconds and must + be in the range of 0 to 600000 milliseconds. {cfgcmd}`delay` sets the + initial SPF schedule delay in milliseconds. The default value is 200 ms. + {cfgcmd}`initial-holdtime` sets the minimum hold time between two + consecutive SPF calculations. The default value is 1000 ms. + {cfgcmd}`max-holdtime` sets the maximum wait time between two + consecutive SPF calculations. The default value is 10000 ms. +``` + +```{eval-rst} +.. cfgcmd:: set protocols ospf ldp-sync + + This command will enable IGP-LDP synchronization globally for OSPF. This + requires for LDP to be functional. This is described in {rfc}`5443`. By + default all interfaces operational in OSPF are enabled for synchronization. + Loopbacks are exempt. +``` + +```{eval-rst} +.. cfgcmd:: set protocols ospf ldp-sync holddown + + This command will change the hold down value globally for IGP-LDP + synchronization during convergence/interface flap events. +``` + +```{eval-rst} +.. cfgcmd:: set protocols ospf capability opaque + + ospfd supports Opaque LSA {rfc}`2370` as partial support for MPLS Traffic + Engineering LSAs. The opaque-lsa capability must be enabled in the + configuration. + + An alternate command could be "mpls-te on" (Traffic Engineering) + + .. note:: FRR offers only partial support for some of the routing + protocol extensions that are used with MPLS-TE; it does not + support a complete RSVP-TE solution. +``` + +#### Area Configuration + +```{eval-rst} +.. cfgcmd:: set protocols ospf area area-type stub + + This command specifies the area to be a Stub Area. That is, an area where + no router originates routes external to OSPF and hence an area where all + external routes are via the ABR(s). Hence, ABRs for such an area do not + need to pass AS-External LSAs (type-5) or ASBR-Summary LSAs (type-4) into + the area. They need only pass Network-Summary (type-3) LSAs into such an + area, along with a default-route summary. +``` + +```{eval-rst} +.. cfgcmd:: set protocols ospf area area-type stub no-summary + + This command specifies the area to be a Totally Stub Area. In addition to + stub area limitations this area type prevents an ABR from injecting + Network-Summary (type-3) LSAs into the specified stub area. Only default + summary route is allowed. +``` + +```{eval-rst} +.. cfgcmd:: set protocols ospf area area-type stub default-cost + + + This command sets the cost of default-summary LSAs announced to stubby + areas. The cost range is 0 to 16777215. +``` + +```{eval-rst} +.. cfgcmd:: set protocols ospf area area-type nssa + + This command specifies the area to be a Not So Stubby Area. External + routing information is imported into an NSSA in Type-7 LSAs. Type-7 LSAs + are similar to Type-5 AS-external LSAs, except that they can only be + flooded into the NSSA. In order to further propagate the NSSA external + information, the Type-7 LSA must be translated to a Type-5 AS-external-LSA + by the NSSA ABR. +``` + +```{eval-rst} +.. cfgcmd:: set protocols ospf area area-type nssa no-summary + + This command specifies the area to be a NSSA Totally Stub Area. ABRs for + such an area do not need to pass Network-Summary (type-3) LSAs (except the + default summary route), ASBR-Summary LSAs (type-4) and AS-External LSAs + (type-5) into the area. But Type-7 LSAs that convert to Type-5 at the NSSA + ABR are allowed. +``` + +```{eval-rst} +.. cfgcmd:: set protocols ospf area area-type nssa default-cost + + + This command sets the default cost of LSAs announced to NSSA areas. + The cost range is 0 to 16777215. +``` + +```{eval-rst} +.. cfgcmd:: set protocols ospf area area-type nssa translate + + + Specifies whether this NSSA border router will unconditionally translate + Type-7 LSAs into Type-5 LSAs. When role is Always, Type-7 LSAs are + translated into Type-5 LSAs regardless of the translator state of other + NSSA border routers. When role is Candidate, this router participates in + the translator election to determine if it will perform the translations + duties. When role is Never, this router will never translate Type-7 LSAs + into Type-5 LSAs. +``` + +```{eval-rst} +.. cfgcmd:: set protocols ospf area authentication plaintext-password + + This command specifies that simple password authentication should be used + for the given area. The password must also be configured on a per-interface + basis. +``` + +```{eval-rst} +.. cfgcmd:: set protocols ospf area authentication md5 + + This command specify that OSPF packets must be authenticated with MD5 HMACs + within the given area. Keying material must also be configured on a + per-interface basis. +``` + +```{eval-rst} +.. cfgcmd:: set protocols ospf area range [cost ] + + This command summarizes intra area paths from specified area into one + summary-LSA (Type-3) announced to other areas. This command can be used + only in ABR and ONLY router-LSAs (Type-1) and network-LSAs (Type-2) + (i.e. LSAs with scope area) can be summarized. AS-external-LSAs (Type-5) + can’t be summarized - their scope is AS. The optional argument + {cfgcmd}`cost` specifies the aggregated link metric. The metric range is 0 + to 16777215. +``` + +```{eval-rst} +.. cfgcmd:: set protocols ospf area range not-advertise + + This command instead of summarizing intra area paths filter them - i.e. + intra area paths from this range are not advertised into other areas. + This command makes sense in ABR only. +``` + +```{eval-rst} +.. cfgcmd:: set protocols ospf area export-list + + Filter Type-3 summary-LSAs announced to other areas originated from + intra- area paths from specified area. + This command makes sense in ABR only. +``` + +```{eval-rst} +.. cfgcmd:: set protocols ospf area import-list + + Same as export-list, but it applies to paths announced into specified + area as Type-3 summary-LSAs. + This command makes sense in ABR only. +``` + +```{eval-rst} +.. cfgcmd:: set protocols ospf area range substitute + + + One Type-3 summary-LSA with routing info is announced into + backbone area if defined area contains at least one intra-area network + (i.e. described with router-LSA or network-LSA) from range . + This command makes sense in ABR only. +``` + +```{eval-rst} +.. cfgcmd:: set protocols ospf area shortcut + + This parameter allows to "shortcut" routes (non-backbone) for inter-area + routes. There are three modes available for routes shortcutting: + + **default** – this area will be used for shortcutting only if ABR does not + have a link to the backbone area or this link was lost. + **enable** – the area will be used for shortcutting every time the route + that goes through it is cheaper. + **disable** – this area is never used by ABR for routes shortcutting. +``` + +```{eval-rst} +.. cfgcmd:: set protocols ospf area virtual-link + + Provides a backbone area coherence by virtual link establishment. + + In general, OSPF protocol requires a backbone area (area 0) to be coherent + and fully connected. I.e. any backbone area router must have a route to any + other backbone area router. Moreover, every ABR must have a link to + backbone area. However, it is not always possible to have a physical link + to a backbone area. In this case between two ABR (one of them has a link to + the backbone area) in the area (not stub area) a virtual link is organized. + + – area identifier through which a virtual link goes. + – ABR router-id with which a virtual link is established. Virtual + link must be configured on both routers. + + Formally, a virtual link looks like a point-to-point network connecting two + ABR from one area one of which physically connected to a backbone area. + This pseudo-network is considered to belong to a backbone area. + +``` + +#### Interface Configuration + +```{eval-rst} +.. cfgcmd:: set protocols ospf interface area + + Enable ospf on an interface and set associated area. + + If you have a lot of interfaces, and/or a lot of subnets, then enabling + OSPF via this command may result in a slight performance improvement. +``` + +```{eval-rst} +.. cfgcmd:: set protocols ospf interface authentication + plaintext-password + + This command sets OSPF authentication key to a simple password. After + setting, all OSPF packets are authenticated. Key has length up to 8 chars. + + Simple text password authentication is insecure and deprecated in favour of + MD5 HMAC authentication. +``` + +```{eval-rst} +.. cfgcmd:: set protocols ospf interface authentication md5 + key-id md5-key + + This command specifys that MD5 HMAC authentication must be used on this + interface. It sets OSPF authentication key to a cryptographic password. + Key-id identifies secret key used to create the message digest. This ID + is part of the protocol and must be consistent across routers on a link. + The key can be long up to 16 chars (larger strings will be truncated), + and is associated with the given key-id. +``` + +```{eval-rst} +.. cfgcmd:: set protocols ospf interface bandwidth + + This command sets the interface bandwidth for cost calculations, where + bandwidth can be in range from 1 to 100000, specified in Mbits/s. +``` + +```{eval-rst} +.. cfgcmd:: set protocols ospf interface cost + + This command sets link cost for the specified interface. The cost value is + set to router-LSA’s metric field and used for SPF calculation. The cost + range is 1 to 65535. +``` + +```{eval-rst} +.. cfgcmd:: set protocols ospf interface dead-interval + + Set number of seconds for router Dead Interval timer value used for Wait + Timer and Inactivity Timer. This value must be the same for all routers + attached to a common network. The default value is 40 seconds. The + interval range is 1 to 65535. +``` + +```{eval-rst} +.. cfgcmd:: set protocols ospf interface hello-multiplier + + The hello-multiplier specifies how many Hellos to send per second, from 1 + (every second) to 10 (every 100ms). Thus one can have 1s convergence time + for OSPF. If this form is specified, then the hello-interval advertised in + Hello packets is set to 0 and the hello-interval on received Hello packets + is not checked, thus the hello-multiplier need NOT be the same across + multiple routers on a common link. +``` + +```{eval-rst} +.. cfgcmd:: set protocols ospf interface hello-interval + + Set number of seconds for Hello Interval timer value. Setting this value, + Hello packet will be sent every timer value seconds on the specified + interface. This value must be the same for all routers attached to a + common network. The default value is 10 seconds. The interval range is 1 + to 65535. +``` + +```{eval-rst} +.. cfgcmd:: set protocols ospf interface bfd + + This command enables {abbr}`BFD (Bidirectional Forwarding Detection)` on + this OSPF link interface. +``` + +```{eval-rst} +.. cfgcmd:: set protocols ospf interface mtu-ignore + + This command disables check of the MTU value in the OSPF DBD packets. Thus, + use of this command allows the OSPF adjacency to reach the FULL state even + though there is an interface MTU mismatch between two OSPF routers. +``` + +```{eval-rst} +.. cfgcmd:: set protocols ospf interface network + + This command allows to specify the distribution type for the network + connected to this interface: + + **broadcast** – broadcast IP addresses distribution. + **non-broadcast** – address distribution in NBMA networks topology. + **point-to-multipoint** – address distribution in point-to-multipoint + networks. + **point-to-point** – address distribution in point-to-point networks. +``` + +```{eval-rst} +.. cfgcmd:: set protocols ospf interface priority + + This command sets Router Priority integer value. The router with the + highest priority will be more eligible to become Designated Router. + Setting the value to 0, makes the router ineligible to become + Designated Router. The default value is 1. The interval range is 0 to 255. +``` + +```{eval-rst} +.. cfgcmd:: set protocols ospf interface retransmit-interval + + + This command sets number of seconds for RxmtInterval timer value. This + value is used when retransmitting Database Description and Link State + Request packets if acknowledge was not received. The default value is 5 + seconds. The interval range is 3 to 65535. +``` + +```{eval-rst} +.. cfgcmd:: set protocols ospf interface transmit-delay + + This command sets number of seconds for InfTransDelay value. It allows to + set and adjust for each interface the delay interval before starting the + synchronizing process of the router's database with all neighbors. The + default value is 1 seconds. The interval range is 3 to 65535. +``` + +```{eval-rst} +.. cfgcmd:: set protocols ospf interface ldp-sync disable + + This command disables IGP-LDP sync for this specific interface. +``` + +```{eval-rst} +.. cfgcmd:: set protocols ospf interface ldp-sync holddown + + + This command will change the hold down value for IGP-LDP synchronization + during convergence/interface flap events, but for this interface only. +``` + +#### External Route Summarisation + +This feature summarises originated external LSAs (Type-5 and Type-7). Summary +Route will be originated on-behalf of all matched external LSAs. + +```{eval-rst} +.. cfgcmd:: set protocols ospf aggregation timer + + Configure aggregation delay timer interval. + + Summarisation starts only after this delay timer expiry. +``` + +```{eval-rst} +.. cfgcmd:: set protocols ospf summary-address x.x.x.x/y [tag (1-4294967295)] + + This command enable/disables summarisation for the configured address range. + + Tag is the optional parameter. If tag configured Summary route will be + originated with the configured tag. +``` + +```{eval-rst} +.. cfgcmd:: set protocols ospf summary-address x.x.x.x/y no-advertise + + This command to ensure not advertise the summary lsa for the matched + external LSAs. +``` + +#### Graceful Restart + +```{eval-rst} +.. cfgcmd:: set protocols ospf graceful-restart [grace-period (1-1800)] + + Configure Graceful Restart {rfc}`3623` restarting support. When enabled, + the default grace period is 120 seconds. + + To perform a graceful shutdown, the FRR ``graceful-restart prepare ip + ospf`` EXEC-level command needs to be issued before restarting the + ospfd daemon. +``` + +```{eval-rst} +.. cfgcmd:: set protocols ospf graceful-restart helper enable [router-id A.B.C.D] + + Configure Graceful Restart {rfc}`3623` helper support. By default, helper support + is disabled for all neighbours. This config enables/disables helper support + on this router for all neighbours. + + To enable/disable helper support for a specific neighbour, the router-id + (A.B.C.D) has to be specified. +``` + +```{eval-rst} +.. cfgcmd:: set protocols ospf graceful-restart helper no-strict-lsa-checking + + By default `strict-lsa-checking` is configured then the helper will abort + the Graceful Restart when a LSA change occurs which affects the restarting + router. + + This command disables it. +``` + +```{eval-rst} +.. cfgcmd:: set protocols ospf graceful-restart helper supported-grace-time + + Supports as HELPER for configured grace period. +``` + +```{eval-rst} +.. cfgcmd:: set protocols ospf graceful-restart helper planned-only + + It helps to support as HELPER only for planned restarts. + + By default, it supports both planned and unplanned outages. +``` + +#### Manual Neighbor Configuration + +OSPF routing devices normally discover their neighbors dynamically by +listening to the broadcast or multicast hello packets on the network. +Because an NBMA network does not support broadcast (or multicast), the +device cannot discover its neighbors dynamically, so you must configure all +the neighbors statically. + +```{eval-rst} +.. cfgcmd:: set protocols ospf neighbor + + This command specifies the IP address of the neighboring device. +``` + +```{eval-rst} +.. cfgcmd:: set protocols ospf neighbor poll-interval + + This command specifies the length of time, in seconds, before the routing + device sends hello packets out of the interface before it establishes + adjacency with a neighbor. The range is 1 to 65535 seconds. The default + value is 60 seconds. +``` + +```{eval-rst} +.. cfgcmd:: set protocols ospf neighbor priority + + This command specifies the router priority value of the nonbroadcast + neighbor associated with the IP address specified. The default is 0. + This keyword does not apply to point-to-multipoint interfaces. + +``` + +#### Redistribution Configuration + +```{eval-rst} +.. cfgcmd:: set protocols ospf redistribute + + This command redistributes routing information from the given route source + to the OSPF process. There are five modes available for route source: bgp, + connected, kernel, rip, static. +``` + +```{eval-rst} +.. cfgcmd:: set protocols ospf default-metric + + This command specifies the default metric value of redistributed routes. + The metric range is 0 to 16777214. +``` + +```{eval-rst} +.. cfgcmd:: set protocols ospf redistribute metric + + This command specifies metric for redistributed routes from the given + route source. There are five modes available for route source: bgp, + connected, kernel, rip, static. The metric range is 1 to 16777214. +``` + +```{eval-rst} +.. cfgcmd:: set protocols ospf redistribute metric-type <1|2> + + This command specifies metric type for redistributed routes. Difference + between two metric types that metric type 1 is a metric which is + "commensurable" with inner OSPF links. When calculating a metric to the + external destination, the full path metric is calculated as a metric sum + path of a router which had advertised this link plus the link metric. + Thus, a route with the least summary metric will be selected. If external + link is advertised with metric type 2 the path is selected which lies + through the router which advertised this link with the least metric + despite of the fact that internal path to this router is longer (with more + cost). However, if two routers advertised an external link and with metric + type 2 the preference is given to the path which lies through the router + with a shorter internal path. If two different routers advertised two + links to the same external destimation but with different metric type, + metric type 1 is preferred. If type of a metric left undefined the router + will consider these external links to have a default metric type 2. +``` + +```{eval-rst} +.. cfgcmd:: set protocols ospf redistribute route-map + + This command allows to use route map to filter redistributed routes from + the given route source. There are five modes available for route source: + bgp, connected, kernel, rip, static. + +``` + +#### Operational Mode Commands + +```{eval-rst} +.. opcmd:: show ip ospf neighbor + + This command displays the neighbors status. +``` + +```none +Neighbor ID Pri State Dead Time Address Interface RXmtL RqstL DBsmL +10.0.13.1 1 Full/DR 38.365s 10.0.13.1 eth0:10.0.13.3 0 0 0 +10.0.23.2 1 Full/Backup 39.175s 10.0.23.2 eth1:10.0.23.3 0 0 0 +``` + +```{eval-rst} +.. opcmd:: show ip ospf neighbor detail + + This command displays the neighbors information in a detailed form, not + just a summary table. +``` + +```none + Neighbor 10.0.13.1, interface address 10.0.13.1 + In the area 0.0.0.0 via interface eth0 + Neighbor priority is 1, State is Full, 5 state changes + Most recent state change statistics: + Progressive change 11m55s ago + DR is 10.0.13.1, BDR is 10.0.13.3 + Options 2 *|-|-|-|-|-|E|- + Dead timer due in 34.854s + Database Summary List 0 + Link State Request List 0 + Link State Retransmission List 0 + Thread Inactivity Timer on + Thread Database Description Retransmision off + Thread Link State Request Retransmission on + Thread Link State Update Retransmission on + +Neighbor 10.0.23.2, interface address 10.0.23.2 + In the area 0.0.0.1 via interface eth1 + Neighbor priority is 1, State is Full, 4 state changes + Most recent state change statistics: + Progressive change 41.193s ago + DR is 10.0.23.3, BDR is 10.0.23.2 + Options 2 *|-|-|-|-|-|E|- + Dead timer due in 35.661s + Database Summary List 0 + Link State Request List 0 + Link State Retransmission List 0 + Thread Inactivity Timer on + Thread Database Description Retransmision off + Thread Link State Request Retransmission on + Thread Link State Update Retransmission on +``` + +```{eval-rst} +.. opcmd:: show ip ospf neighbor + + This command displays the neighbors information in a detailed form for a + neighbor whose IP address is specified. +``` + +```{eval-rst} +.. opcmd:: show ip ospf neighbor + + This command displays the neighbors status for a neighbor on the specified + interface. +``` + +```{eval-rst} +.. opcmd:: show ip ospf interface [] + + This command displays state and configuration of OSPF the specified + interface, or all interfaces if no interface is given. +``` + +```none +eth0 is up + ifindex 2, MTU 1500 bytes, BW 4294967295 Mbit + Internet Address 10.0.13.3/24, Broadcast 10.0.13.255, Area 0.0.0.0 + MTU mismatch detection: enabled + Router ID 10.0.23.3, Network Type BROADCAST, Cost: 1 + Transmit Delay is 1 sec, State Backup, Priority 1 + Backup Designated Router (ID) 10.0.23.3, Interface Address 10.0.13.3 + Multicast group memberships: OSPFAllRouters OSPFDesignatedRouters + Timer intervals configured, Hello 10s, Dead 40s, Wait 40s, Retransmit 5 + Hello due in 4.470s + Neighbor Count is 1, Adjacent neighbor count is 1 +eth1 is up + ifindex 3, MTU 1500 bytes, BW 4294967295 Mbit + Internet Address 10.0.23.3/24, Broadcast 10.0.23.255, Area 0.0.0.1 + MTU mismatch detection: enabled + Router ID 10.0.23.3, Network Type BROADCAST, Cost: 1 + Transmit Delay is 1 sec, State DR, Priority 1 + Backup Designated Router (ID) 10.0.23.2, Interface Address 10.0.23.2 + Saved Network-LSA sequence number 0x80000002 + Multicast group memberships: OSPFAllRouters OSPFDesignatedRouters + Timer intervals configured, Hello 10s, Dead 40s, Wait 40s, Retransmit 5 + Hello due in 4.563s + Neighbor Count is 1, Adjacent neighbor count is 1 +``` + +```{eval-rst} +.. opcmd:: show ip ospf route [detail] + + This command displays the OSPF routing table, as determined by the most + recent SPF calculation. With the optional {cfgcmd}`detail` argument, + each route item's advertiser router and network attribute will be shown. +``` + +```none +============ OSPF network routing table ============ +N IA 10.0.12.0/24 [3] area: 0.0.0.0 + via 10.0.13.3, eth0 +N 10.0.13.0/24 [1] area: 0.0.0.0 + directly attached to eth0 +N IA 10.0.23.0/24 [2] area: 0.0.0.0 + via 10.0.13.3, eth0 +N 10.0.34.0/24 [2] area: 0.0.0.0 + via 10.0.13.3, eth0 + +============ OSPF router routing table ============= +R 10.0.23.3 [1] area: 0.0.0.0, ABR + via 10.0.13.3, eth0 +R 10.0.34.4 [2] area: 0.0.0.0, ASBR + via 10.0.13.3, eth0 + +============ OSPF external routing table =========== +N E2 172.16.0.0/24 [2/20] tag: 0 + via 10.0.13.3, eth0 +``` + +The table consists of following data: + +**OSPF network routing table** – includes a list of acquired routes for all +accessible networks (or aggregated area ranges) of OSPF system. "IA" flag +means that route destination is in the area to which the router is not +connected, i.e. it’s an inter-area path. In square brackets a summary metric +for all links through which a path lies to this network is specified. "via" +prefix defines a router-gateway, i.e. the first router on the way to the +destination (next hop). +**OSPF router routing table** – includes a list of acquired routes to all +accessible ABRs and ASBRs. +**OSPF external routing table** – includes a list of acquired routes that are +external to the OSPF process. "E" flag points to the external link metric type +(E1 – metric type 1, E2 – metric type 2). External link metric is printed in +the "\/\" format. + +```{eval-rst} +.. opcmd:: show ip ospf border-routers + + This command displays a table of paths to area boundary and autonomous + system boundary routers. +``` + +```{eval-rst} +.. opcmd:: show ip ospf database + + This command displays a summary table with a database contents (LSA). +``` + +```none + OSPF Router with ID (10.0.13.1) + + Router Link States (Area 0.0.0.0) + +Link ID ADV Router Age Seq# CkSum Link count +10.0.13.1 10.0.13.1 984 0x80000005 0xd915 1 +10.0.23.3 10.0.23.3 1186 0x80000008 0xfe62 2 +10.0.34.4 10.0.34.4 1063 0x80000004 0x4e3f 1 + + Net Link States (Area 0.0.0.0) + +Link ID ADV Router Age Seq# CkSum +10.0.13.1 10.0.13.1 994 0x80000003 0x30bb +10.0.34.4 10.0.34.4 1188 0x80000001 0x9411 + + Summary Link States (Area 0.0.0.0) + +Link ID ADV Router Age Seq# CkSum Route +10.0.12.0 10.0.23.3 1608 0x80000001 0x6ab6 10.0.12.0/24 +10.0.23.0 10.0.23.3 981 0x80000003 0xe232 10.0.23.0/24 + + AS External Link States + +Link ID ADV Router Age Seq# CkSum Route +172.16.0.0 10.0.34.4 1063 0x80000001 0xc40d E2 172.16.0.0/24 [0x0] +``` + +```{eval-rst} +.. opcmd:: show ip ospf database [A.B.C.D] + [adv-router |self-originate] + + This command displays a database contents for a specific link advertisement + type. + + The type can be the following: + asbr-summary, external, network, nssa-external, opaque-area, opaque-as, + opaque-link, router, summary. + + [A.B.C.D] – link-state-id. With this specified the command displays portion + of the network environment that is being described by the advertisement. + The value entered depends on the advertisement’s LS type. It must be + entered in the form of an IP address. + + {cfgcmd}`adv-router ` – router id, which link advertisements need + to be reviewed. + + {cfgcmd}`self-originate` displays only self-originated LSAs from the local + router. +``` + +```none + OSPF Router with ID (10.0.13.1) + + Router Link States (Area 0.0.0.0) + +LS age: 1213 +Options: 0x2 : *|-|-|-|-|-|E|- +LS Flags: 0x3 +Flags: 0x0 +LS Type: router-LSA +Link State ID: 10.0.13.1 +Advertising Router: 10.0.13.1 +LS Seq Number: 80000009 +Checksum: 0xd119 +Length: 36 + + Number of Links: 1 + + Link connected to: a Transit Network + (Link ID) Designated Router address: 10.0.13.1 + (Link Data) Router Interface address: 10.0.13.1 + Number of TOS metrics: 0 + TOS 0 Metric: 1 +``` + +```{eval-rst} +.. opcmd:: show ip ospf database max-age + + This command displays LSAs in MaxAge list. + +``` + +#### Examples + +##### Enable OSPF + +**Node 1** + +```none +set interfaces loopback lo address 10.1.1.1/32 +set interfaces ethernet eth0 address 192.168.0.1/24 +set protocols ospf area 0 network 192.168.0.0/24 +set protocols ospf area 0 network 10.1.1.1/32 +set protocols ospf parameters router-id 10.1.1.1 +``` + +**Node 2** + +```none +set interfaces loopback lo address 10.1.1.2/32 +set interfaces ethernet eth0 address 192.168.0.2/24 +set protocols ospf area 0 network 192.168.0.0/24 +set protocols ospf area 0 network 10.1.1.2/32 +set protocols ospf parameters router-id 10.1.1.2 +``` + +Here's the neighbors up: + +```none +Node-1@vyos:~$ show ip ospf neighbor + +Neighbor ID Pri State Up Time Dead Time Address Interface RXmtL RqstL DBsmL +10.1.1.2 1 Full/DR 3m43s 36.094s 192.168.0.2 eth0:192.168.0.1 0 0 0 + + + +Node-2@vyos:~$ show ip ospf neighbor + +Neighbor ID Pri State Up Time Dead Time Address Interface RXmtL RqstL DBsmL +10.1.1.1 1 Full/Backup 3m47s 31.736s 192.168.0.1 eth0:192.168.0.2 0 0 0 +``` + +Here's the routes: + +```none +Node-1@vyos:~$ show ip route ospf +Codes: K - kernel route, C - connected, S - static, R - RIP, + O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP, + T - Table, v - VNC, V - VNC-Direct, A - Babel, F - PBR, + f - OpenFabric, + > - selected route, * - FIB route, q - queued, r - rejected, b - backup + t - trapped, o - offload failure + +O 10.1.1.1/32 [110/0] is directly connected, lo, weight 1, 00:00:14 +O>* 10.1.1.2/32 [110/1] via 192.168.0.2, eth0, weight 1, 00:00:07 +O 192.168.0.0/24 [110/1] is directly connected, eth0, weight 1, 00:03:32 + +Node-2@vyos:~$ show ip route ospf +Codes: K - kernel route, C - connected, S - static, R - RIP, + O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP, + T - Table, v - VNC, V - VNC-Direct, A - Babel, F - PBR, + f - OpenFabric, + > - selected route, * - FIB route, q - queued, r - rejected, b - backup + t - trapped, o - offload failure + +O>* 10.1.1.1/32 [110/1] via 192.168.0.1, eth0, weight 1, 00:00:11 +O 10.1.1.2/32 [110/0] is directly connected, lo, weight 1, 00:00:04 +O 192.168.0.0/24 [110/1] is directly connected, eth0, weight 1, 00:03:18 +``` + +##### Enable OSPF with route redistribution of the loopback and default originate: + +**Node 1** + +```none +set interfaces loopback lo address 10.1.1.1/32 +set protocols ospf area 0 network 192.168.0.0/24 +set protocols ospf default-information originate always +set protocols ospf default-information originate metric 10 +set protocols ospf default-information originate metric-type 2 +set protocols ospf log-adjacency-changes +set protocols ospf parameters router-id 10.1.1.1 +set protocols ospf redistribute connected metric-type 2 +set protocols ospf redistribute connected route-map CONNECT + +set policy route-map CONNECT rule 10 action permit +set policy route-map CONNECT rule 10 match interface lo +``` + +**Node 2** + +```none +set interfaces loopback lo address 10.2.2.2/32 +set protocols ospf area 0 network 192.168.0.0/24 +set protocols ospf log-adjacency-changes +set protocols ospf parameters router-id 10.2.2.2 +set protocols ospf redistribute connected metric-type 2 +set protocols ospf redistribute connected route-map CONNECT + +set policy route-map CONNECT rule 10 action permit +set policy route-map CONNECT rule 10 match interface lo +``` + +##### Enable OSPF and IGP-LDP synchronization: + +**Node 1:** + +```none +set interfaces loopback lo address 10.1.1.1/32 +set interfaces ethernet eth0 address 192.168.0.1/24 + +set protocols ospf area 0 network '192.168.0.0/24' +set protocols ospf area 0 network '10.1.1.1/32' +set protocols ospf parameters router-id '10.1.1.1' +set protocols ospf ldp-sync + +set protocols mpls interface eth0 +set protocols mpls ldp discovery transport-ipv4-address 10.1.1.1 +set protocols mpls ldp interface lo +set protocols mpls ldp interface eth0 +set protocols mpls ldp parameters transport-prefer-ipv4 +set protocols mpls ldp router-id 10.1.1.1 +``` + +This gives us IGP-LDP synchronization for all non-loopback interfaces with +a holddown timer of zero seconds: + +```none +Node-1@vyos:~$ show ip ospf mpls ldp-sync + eth0 + LDP-IGP Synchronization enabled: yes + Holddown timer in seconds: 0 + State: Sync achieved +``` + +##### Enable OSPF with Segment Routing (Experimental): + +**Node 1** + +```none +set interfaces loopback lo address 10.1.1.1/32 +set interfaces ethernet eth0 address 192.168.0.1/24 + +set protocols ospf area 0 network '192.168.0.0/24' +set protocols ospf area 0 network '10.1.1.1/32' +set protocols ospf parameters opaque-lsa +set protocols ospf parameters router-id '10.1.1.1' +set protocols ospf segment-routing global-block high-label-value '1100' +set protocols ospf segment-routing global-block low-label-value '1000' +set protocols ospf segment-routing prefix 10.1.1.1/32 index explicit-null +set protocols ospf segment-routing prefix 10.1.1.1/32 index value '1' +``` + +**Node 2** + +```none +set interfaces loopback lo address 10.1.1.2/32 +set interfaces ethernet eth0 address 192.168.0.2/24 + +set protocols ospf area 0 network '192.168.0.0/24' +set protocols ospf area 0 network '10.1.1.2/32' +set protocols ospf parameters opaque-lsa +set protocols ospf parameters router-id '10.1.1.2' +set protocols ospf segment-routing global-block high-label-value '1100' +set protocols ospf segment-routing global-block low-label-value '1000' +set protocols ospf segment-routing prefix 10.1.1.2/32 index explicit-null +set protocols ospf segment-routing prefix 10.1.1.2/32 index value '2' +``` + +This gives us MPLS segment routing enabled and labels for far end loopbacks: + +```none +Node-1@vyos:~$ show mpls table + Inbound Label Type Nexthop Outbound Label + ----------------------------------------------------------- + 1002 SR (OSPF) 192.168.0.2 IPv4 Explicit Null <-- Node-2 loopback learned on Node-1 + 15000 SR (OSPF) 192.168.0.2 implicit-null + 15001 SR (OSPF) 192.168.0.2 implicit-null + +Node-2@vyos:~$ show mpls table + Inbound Label Type Nexthop Outbound Label + ----------------------------------------------------------- + 1001 SR (OSPF) 192.168.0.1 IPv4 Explicit Null <-- Node-1 loopback learned on Node-2 + 15000 SR (OSPF) 192.168.0.1 implicit-null + 15001 SR (OSPF) 192.168.0.1 implicit-null +``` + +Here is the routing tables showing the MPLS segment routing label operations: + +```none +Node-1@vyos:~$ show ip route ospf +Codes: K - kernel route, C - connected, S - static, R - RIP, + O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP, + T - Table, v - VNC, V - VNC-Direct, A - Babel, F - PBR, + f - OpenFabric, + > - selected route, * - FIB route, q - queued, r - rejected, b - backup + t - trapped, o - offload failure + +O 10.1.1.1/32 [110/0] is directly connected, lo, weight 1, 00:03:43 +O>* 10.1.1.2/32 [110/1] via 192.168.0.2, eth0, label IPv4 Explicit Null, weight 1, 00:03:32 +O 192.168.0.0/24 [110/1] is directly connected, eth0, weight 1, 00:03:43 + +Node-2@vyos:~$ show ip route ospf +Codes: K - kernel route, C - connected, S - static, R - RIP, + O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP, + T - Table, v - VNC, V - VNC-Direct, A - Babel, F - PBR, + f - OpenFabric, + > - selected route, * - FIB route, q - queued, r - rejected, b - backup + t - trapped, o - offload failure + +O>* 10.1.1.1/32 [110/1] via 192.168.0.1, eth0, label IPv4 Explicit Null, weight 1, 00:03:36 +O 10.1.1.2/32 [110/0] is directly connected, lo, weight 1, 00:03:51 +O 192.168.0.0/24 [110/1] is directly connected, eth0, weight 1, 00:03:51 +``` + +(routing-ospfv3)= + +## OSPFv3 (IPv6) + +(ospf-v3-configuration)= + +### Configuration + +(ospf-v3-general)= + +#### General + +VyOS does not have a special command to start the OSPFv3 process. The OSPFv3 +process starts when the first ospf enabled interface is configured. + +```{eval-rst} +.. cfgcmd:: set protocols ospfv3 interface area + + This command specifies the OSPFv3 enabled interface. This command is also + used to enable the OSPF process. The area number can be specified in + decimal notation in the range from 0 to 4294967295. Or it can be specified + in dotted decimal notation similar to ip address. +``` + +```{eval-rst} +.. cfgcmd:: set protocols ospfv3 parameters router-id + + This command sets the router-ID of the OSPFv3 process. The router-ID may be + an IP address of the router, but need not be – it can be any arbitrary + 32bit number. However it MUST be unique within the entire OSPFv3 domain to + the OSPFv3 speaker – bad things will happen if multiple OSPFv3 speakers are + configured with the same router-ID! + +``` + +(ospf-v3-optional)= + +#### Optional + +```{eval-rst} +.. cfgcmd:: set protocols ospfv3 distance global + + This command change distance value of OSPFv3 globally. + The distance range is 1 to 255. +``` + +```{eval-rst} +.. cfgcmd:: set protocols ospfv3 distance ospfv3 + + + This command change distance value of OSPFv3. The arguments are the + distance values for external routes, inter-area routes and intra-area + routes respectively. The distance range is 1 to 255. +``` + +(ospf-v3-area-configuration)= + +#### Area Configuration + +```{eval-rst} +.. cfgcmd:: set protocols ospfv3 area range + + This command summarizes intra area paths from specified area into one + Type-3 Inter-Area Prefix LSA announced to other areas. This command can be + used only in ABR. +``` + +```{eval-rst} +.. cfgcmd:: set protocols ospfv3 area range not-advertise + + This command instead of summarizing intra area paths filter them - i.e. + intra area paths from this range are not advertised into other areas. This + command makes sense in ABR only. +``` + +(ospf-v3-interface-config)= + +#### Interface Configuration + +```{eval-rst} +.. cfgcmd:: set protocols ospfv3 interface ipv6 cost + + This command sets link cost for the specified interface. The cost value is + set to router-LSA’s metric field and used for SPF calculation. The cost + range is 1 to 65535. +``` + +```{eval-rst} +.. cfgcmd:: set protocols ospfv3 interface dead-interval + + Set number of seconds for router Dead Interval timer value used for Wait + Timer and Inactivity Timer. This value must be the same for all routers + attached to a common network. The default value is 40 seconds. The + interval range is 1 to 65535. +``` + +```{eval-rst} +.. cfgcmd:: set protocols ospfv3 interface hello-interval + + + Set number of seconds for Hello Interval timer value. Setting this value, + Hello packet will be sent every timer value seconds on the specified + interface. This value must be the same for all routers attached to a + common network. The default value is 10 seconds. The interval range is 1 + to 65535. +``` + +```{eval-rst} +.. cfgcmd:: set protocols ospfv3 interface mtu-ignore + + This command disables check of the MTU value in the OSPF DBD packets. + Thus, use of this command allows the OSPF adjacency to reach the FULL + state even though there is an interface MTU mismatch between two OSPF + routers. +``` + +```{eval-rst} +.. cfgcmd:: set protocols ospfv3 interface network + + This command allows to specify the distribution type for the network + connected to this interface: + + **broadcast** – broadcast IP addresses distribution. + **point-to-point** – address distribution in point-to-point networks. +``` + +```{eval-rst} +.. cfgcmd:: set protocols ospfv3 interface priority + + This command sets Router Priority integer value. The router with the + highest priority will be more eligible to become Designated Router. + Setting the value to 0, makes the router ineligible to become Designated + Router. The default value is 1. The interval range is 0 to 255. +``` + +```{eval-rst} +.. cfgcmd:: set protocols ospfv3 interface passive + + This command specifies interface as passive. Passive interface advertises + its address, but does not run the OSPF protocol (adjacencies are not formed + and hello packets are not generated). +``` + +```{eval-rst} +.. cfgcmd:: set protocols ospfv3 interface retransmit-interval + + + This command sets number of seconds for RxmtInterval timer value. This + value is used when retransmitting Database Description and Link State + Request packets if acknowledge was not received. The default value is 5 + seconds. The interval range is 3 to 65535. +``` + +```{eval-rst} +.. cfgcmd:: set protocols ospfv3 interface transmit-delay + + + This command sets number of seconds for InfTransDelay value. It allows to + set and adjust for each interface the delay interval before starting the + synchronizing process of the router's database with all neighbors. The + default value is 1 seconds. The interval range is 3 to 65535. +``` + +(ospf-v3-graceful-restart)= + +#### Graceful Restart + +```{eval-rst} +.. cfgcmd:: set protocols ospfv3 graceful-restart [grace-period (1-1800)] + + Configure Graceful Restart {rfc}`3623` restarting support. When enabled, + the default grace period is 120 seconds. + + To perform a graceful shutdown, the FRR ``graceful-restart prepare ip + ospf`` EXEC-level command needs to be issued before restarting the + ospfd daemon. +``` + +```{eval-rst} +.. cfgcmd:: set protocols ospfv3 graceful-restart helper enable [router-id A.B.C.D] + + Configure Graceful Restart {rfc}`3623` helper support. By default, helper support + is disabled for all neighbours. This config enables/disables helper support + on this router for all neighbours. + + To enable/disable helper support for a specific neighbour, the router-id + (A.B.C.D) has to be specified. +``` + +```{eval-rst} +.. cfgcmd:: set protocols ospfv3 graceful-restart helper lsa-check-disable + + By default `strict-lsa-checking` is configured then the helper will abort + the Graceful Restart when a LSA change occurs which affects the restarting + router. + + This command disables it. +``` + +```{eval-rst} +.. cfgcmd:: set protocols ospfv3 graceful-restart helper supported-grace-time + + Supports as HELPER for configured grace period. +``` + +```{eval-rst} +.. cfgcmd:: set protocols ospfv3 graceful-restart helper planned-only + + It helps to support as HELPER only for planned restarts. + + By default, it supports both planned and unplanned outages. +``` + +(ospf-v3-redistribution-config)= + +#### Redistribution Configuration + +```{eval-rst} +.. cfgcmd:: set protocols ospfv3 redistribute + + This command redistributes routing information from the given route source + to the OSPFv3 process. There are five modes available for route source: + bgp, connected, kernel, ripng, static. +``` + +```{eval-rst} +.. cfgcmd:: set protocols ospf redistribute route-map + + This command allows to use route map to filter redistributed routes from + given route source. There are five modes available for route source: bgp, + connected, kernel, ripng, static. +``` + +(ospf-v3-op-cmd)= + +#### Operational Mode Commands + +```{eval-rst} +.. opcmd:: show ipv6 ospfv3 neighbor + + This command displays the neighbors status. +``` + +```{eval-rst} +.. opcmd:: show ipv6 ospfv3 neighbor detail + + This command displays the neighbors information in a detailed form, not + just a summary table. +``` + +```{eval-rst} +.. opcmd:: show ipv6 ospfv3 neighbor drchoice + + This command displays the neighbor DR choice information. +``` + +```{eval-rst} +.. opcmd:: show ipv6 ospfv3 interface [prefix]|[ [prefix]] + + This command displays state and configuration of OSPF the specified + interface, or all interfaces if no interface is given. Whith the argument + {cfgcmd}`prefix` this command shows connected prefixes to advertise. +``` + +```{eval-rst} +.. opcmd:: show ipv6 ospfv3 route + + This command displays the OSPF routing table, as determined by the most + recent SPF calculation. +``` + +```{eval-rst} +.. opcmd:: show ipv6 ospfv3 border-routers + + This command displays a table of paths to area boundary and autonomous + system boundary routers. +``` + +```{eval-rst} +.. opcmd:: show ipv6 ospfv3 database + + This command displays a summary table with a database contents (LSA). +``` + +```{eval-rst} +.. opcmd:: show ipv6 ospfv3 database [A.B.C.D] + [adv-router |self-originate] + + This command displays a database contents for a specific link + advertisement type. +``` + +```{eval-rst} +.. opcmd:: show ipv6 ospfv3 redistribute + + This command displays external information redistributed into OSPFv3 +``` + +(ospf-v3-config-example)= + +#### Configuration Example + +A typical configuration using 2 nodes. + +**Node 1:** + +```none +set protocols ospfv3 interface eth1 area 0.0.0.0 +set protocols ospfv3 area 0.0.0.0 range 2001:db8:1::/64 +set protocols ospfv3 parameters router-id 192.168.1.1 +set protocols ospfv3 redistribute connected +``` + +**Node 2:** + +```none +set protocols ospfv3 interface eth1 area 0.0.0.0 +set protocols ospfv3 area 0.0.0.0 range 2001:db8:2::/64 +set protocols ospfv3 parameters router-id 192.168.2.1 +set protocols ospfv3 redistribute connected +``` + +**To see the redistributed routes:** + +```none +show ipv6 ospfv3 redistribute +``` + +:::{note} +You cannot easily redistribute IPv6 routes via OSPFv3 on a +WireGuard interface link. This requires you to configure link-local +addresses manually on the WireGuard interfaces, see {vytask}`T1483`. +::: + +Example configuration for WireGuard interfaces: + +**Node 1** + +```none +set interfaces wireguard wg01 address 'fe80::216:3eff:fe51:fd8c/64' +set interfaces wireguard wg01 address '192.168.0.1/24' +set interfaces wireguard wg01 peer ospf02 allowed-ips '::/0' +set interfaces wireguard wg01 peer ospf02 allowed-ips '0.0.0.0/0' +set interfaces wireguard wg01 peer ospf02 endpoint '10.1.1.101:12345' +set interfaces wireguard wg01 peer ospf02 pubkey 'ie3...=' +set interfaces wireguard wg01 port '12345' +set protocols ospfv3 parameters router-id 192.168.1.1 +set protocols ospfv3 interface 'wg01' area 0.0.0.0 +set protocols ospfv3 interface 'lo' area 0.0.0.0 +``` + +**Node 2** + +```none +set interfaces wireguard wg01 address 'fe80::216:3eff:fe0a:7ada/64' +set interfaces wireguard wg01 address '192.168.0.2/24' +set interfaces wireguard wg01 peer ospf01 allowed-ips '::/0' +set interfaces wireguard wg01 peer ospf01 allowed-ips '0.0.0.0/0' +set interfaces wireguard wg01 peer ospf01 endpoint '10.1.1.100:12345' +set interfaces wireguard wg01 peer ospf01 pubkey 'NHI...=' +set interfaces wireguard wg01 port '12345' +set protocols ospfv3 parameters router-id 192.168.1.2 +set protocols ospfv3 interface 'wg01' area 0.0.0.0 +set protocols ospfv3 interface 'lo' area 0.0.0.0 +``` + +**Status** + +```none +vyos@ospf01:~$ sh ipv6 ospfv3 neighbor +Neighbor ID Pri DeadTime State/IfState Duration I/F[State] +192.168.0.2 1 00:00:37 Full/PointToPoint 00:18:03 wg01[PointToPoint] + +vyos@ospf02# run sh ipv6 ospfv3 neighbor +Neighbor ID Pri DeadTime State/IfState Duration I/F[State] +192.168.0.1 1 00:00:39 Full/PointToPoint 00:19:44 wg01[PointToPoint] +``` diff --git a/docs/configuration/protocols/ospf.rst b/docs/configuration/protocols/ospf.rst deleted file mode 100644 index 43680520..00000000 --- a/docs/configuration/protocols/ospf.rst +++ /dev/null @@ -1,1391 +0,0 @@ -.. _routing-ospf: - -#### -OSPF -#### - -:abbr:`OSPF (Open Shortest Path First)` is a routing protocol for Internet -Protocol (IP) networks. It uses a link state routing (LSR) algorithm and falls -into the group of interior gateway protocols (IGPs), operating within a single -autonomous system (AS). It is defined as OSPF Version 2 in :rfc:`2328` (1998) -for IPv4. Updates for IPv6 are specified as OSPF Version 3 in :rfc:`5340` -(2008). OSPF supports the :abbr:`CIDR (Classless Inter-Domain Routing)` -addressing model. - -OSPF is a widely used IGP in large enterprise networks. - -************* -OSPFv2 (IPv4) -************* - -Configuration -============= - -General -------- - -VyOS does not have a special command to start the OSPF process. The OSPF process -starts when the first ospf enabled interface is configured. - -.. cfgcmd:: set protocols ospf area network - - This command specifies the OSPF enabled interface(s). If the interface has - an address from defined range then the command enables OSPF on this - interface so router can provide network information to the other ospf - routers via this interface. - - This command is also used to enable the OSPF process. The area number can be - specified in decimal notation in the range from 0 to 4294967295. Or it - can be specified in dotted decimal notation similar to ip address. - - Prefix length in interface must be equal or bigger (i.e. smaller network) - than prefix length in network statement. For example statement above doesn't - enable ospf on interface with address 192.168.1.1/23, but it does on - interface with address 192.168.1.129/25. - - In some cases it may be more convenient to enable OSPF on a per - interface/subnet - basis :cfgcmd:`set protocols ospf interface area ` - -.. cfgcmd:: set protocols ospf auto-cost reference-bandwidth - - This command sets the reference bandwidth for cost calculations, where - bandwidth can be in range from 1 to 4294967, specified in Mbits/s. The - default is 100Mbit/s (i.e. a link of bandwidth 100Mbit/s or higher will - have a cost of 1. Cost of lower bandwidth links will be scaled with - reference to this cost). - -.. cfgcmd:: set protocols ospf parameters router-id - - This command sets the router-ID of the OSPF process. The router-ID may be an - IP address of the router, but need not be – it can be any arbitrary 32bit - number. However it MUST be unique within the entire OSPF domain to the OSPF - speaker – bad things will happen if multiple OSPF speakers are configured - with the same router-ID! - - -Optional --------- - -.. cfgcmd:: set protocols ospf default-information originate [always] - [metric ] [metric-type <1|2>] [route-map ] - - Originate an AS-External (type-5) LSA describing a default route into all - external-routing capable areas, of the specified metric and metric type. - If the :cfgcmd:`always` keyword is given then the default is always - advertised, even when there is no default present in the routing table. - The argument :cfgcmd:`route-map` specifies to advertise the default route - if the route map is satisfied. - -.. cfgcmd:: set protocols ospf distance global - - This command change distance value of OSPF globally. - The distance range is 1 to 255. - -.. cfgcmd:: set protocols ospf distance ospf - - - This command change distance value of OSPF. The arguments are the distance - values for external routes, inter-area routes and intra-area routes - respectively. The distance range is 1 to 255. - - .. note:: Routes with a distance of 255 are effectively disabled and not - installed into the kernel. - -.. cfgcmd:: set protocols ospf log-adjacency-changes [detail] - - This command allows to log changes in adjacency. With the optional - :cfgcmd:`detail` argument, all changes in adjacency status are shown. - Without :cfgcmd:`detail`, only changes to full or regressions are shown. - -.. cfgcmd:: set protocols ospf max-metric router-lsa - |on-startup > - - This enables :rfc:`3137` support, where the OSPF process describes its - transit links in its router-LSA as having infinite distance so that other - routers will avoid calculating transit paths through the router while - still being able to reach networks through the router. - - This support may be enabled administratively (and indefinitely) with the - :cfgcmd:`administrative` command. It may also be enabled conditionally. - Conditional enabling of max-metric router-lsas can be for a period of - seconds after startup with the :cfgcmd:`on-startup ` command - and/or for a period of seconds prior to shutdown with the - :cfgcmd:`on-shutdown ` command. The time range is 5 to 86400. - -.. cfgcmd:: set protocols ospf parameters abr-type - - - This command selects ABR model. OSPF router supports four ABR models: - - **cisco** – a router will be considered as ABR if it has several configured - links to the networks in different areas one of which is a backbone area. - Moreover, the link to the backbone area should be active (working). - **ibm** – identical to "cisco" model but in this case a backbone area link - may not be active. - **standard** – router has several active links to different areas. - **shortcut** – identical to "standard" but in this model a router is - allowed to use a connected areas topology without involving a backbone - area for inter-area connections. - - Detailed information about "cisco" and "ibm" models differences can be - found in :rfc:`3509`. A "shortcut" model allows ABR to create routes - between areas based on the topology of the areas connected to this router - but not using a backbone area in case if non-backbone route will be - cheaper. For more information about "shortcut" model, - see :t:`ospf-shortcut-abr-02.txt` - -.. cfgcmd:: set protocols ospf parameters rfc1583-compatibility - - :rfc:`2328`, the successor to :rfc:`1583`, suggests according to section - G.2 (changes) in section 16.4.1 a change to the path preference algorithm - that prevents possible routing loops that were possible in the old version - of OSPFv2. More specifically it demands that inter-area paths and - intra-area backbone path are now of equal preference but still both - preferred to external paths. - - This command should NOT be set normally. - -.. cfgcmd:: set protocols ospf interface passive [disable] - - This command specifies interface as passive. Passive interface advertises - its address, but does not run the OSPF protocol (adjacencies are not formed - and hello packets are not generated). - - The optional `disable` option allows to exclude interface from passive state. - This command is used if the command :cfgcmd:`passive-interface default` was - configured. - -.. cfgcmd:: set protocols ospf passive-interface default - - This command specifies all interfaces as passive by default. Because this - command changes the configuration logic to a default passive; therefore, - interfaces where router adjacencies are expected need to be configured - by setting the :cfgcmd:`passive disable` flag for the specific interface. - -.. cfgcmd:: set protocols ospf maximum-paths <1-64> - - Use this command to control the maximum number of equal cost paths to reach - a specific destination. The upper limit may differ if you change the value - of MULTIPATH_NUM during compilation. The default is MULTIPATH_NUM (64). - -.. cfgcmd:: set protocols ospf refresh timers - - The router automatically updates link-state information with its neighbors. - Only an obsolete information is updated which age has exceeded a specific - threshold. This parameter changes a threshold value, which by default is - 1800 seconds (half an hour). The value is applied to the whole OSPF router. - The timer range is 10 to 1800. - -.. cfgcmd:: set protocols ospf timers throttle spf - - - This command sets the initial delay, the initial-holdtime and the - maximum-holdtime between when SPF is calculated and the event which - triggered the calculation. The times are specified in milliseconds and must - be in the range of 0 to 600000 milliseconds. :cfgcmd:`delay` sets the - initial SPF schedule delay in milliseconds. The default value is 200 ms. - :cfgcmd:`initial-holdtime` sets the minimum hold time between two - consecutive SPF calculations. The default value is 1000 ms. - :cfgcmd:`max-holdtime` sets the maximum wait time between two - consecutive SPF calculations. The default value is 10000 ms. - -.. cfgcmd:: set protocols ospf ldp-sync - - This command will enable IGP-LDP synchronization globally for OSPF. This - requires for LDP to be functional. This is described in :rfc:`5443`. By - default all interfaces operational in OSPF are enabled for synchronization. - Loopbacks are exempt. - -.. cfgcmd:: set protocols ospf ldp-sync holddown - - This command will change the hold down value globally for IGP-LDP - synchronization during convergence/interface flap events. - -.. cfgcmd:: set protocols ospf capability opaque - - ospfd supports Opaque LSA :rfc:`2370` as partial support for MPLS Traffic - Engineering LSAs. The opaque-lsa capability must be enabled in the - configuration. - - An alternate command could be "mpls-te on" (Traffic Engineering) - - .. note:: FRR offers only partial support for some of the routing - protocol extensions that are used with MPLS-TE; it does not - support a complete RSVP-TE solution. - -Area Configuration ------------------- - -.. cfgcmd:: set protocols ospf area area-type stub - - This command specifies the area to be a Stub Area. That is, an area where - no router originates routes external to OSPF and hence an area where all - external routes are via the ABR(s). Hence, ABRs for such an area do not - need to pass AS-External LSAs (type-5) or ASBR-Summary LSAs (type-4) into - the area. They need only pass Network-Summary (type-3) LSAs into such an - area, along with a default-route summary. - -.. cfgcmd:: set protocols ospf area area-type stub no-summary - - This command specifies the area to be a Totally Stub Area. In addition to - stub area limitations this area type prevents an ABR from injecting - Network-Summary (type-3) LSAs into the specified stub area. Only default - summary route is allowed. - -.. cfgcmd:: set protocols ospf area area-type stub default-cost - - - This command sets the cost of default-summary LSAs announced to stubby - areas. The cost range is 0 to 16777215. - -.. cfgcmd:: set protocols ospf area area-type nssa - - This command specifies the area to be a Not So Stubby Area. External - routing information is imported into an NSSA in Type-7 LSAs. Type-7 LSAs - are similar to Type-5 AS-external LSAs, except that they can only be - flooded into the NSSA. In order to further propagate the NSSA external - information, the Type-7 LSA must be translated to a Type-5 AS-external-LSA - by the NSSA ABR. - -.. cfgcmd:: set protocols ospf area area-type nssa no-summary - - This command specifies the area to be a NSSA Totally Stub Area. ABRs for - such an area do not need to pass Network-Summary (type-3) LSAs (except the - default summary route), ASBR-Summary LSAs (type-4) and AS-External LSAs - (type-5) into the area. But Type-7 LSAs that convert to Type-5 at the NSSA - ABR are allowed. - -.. cfgcmd:: set protocols ospf area area-type nssa default-cost - - - This command sets the default cost of LSAs announced to NSSA areas. - The cost range is 0 to 16777215. - -.. cfgcmd:: set protocols ospf area area-type nssa translate - - - Specifies whether this NSSA border router will unconditionally translate - Type-7 LSAs into Type-5 LSAs. When role is Always, Type-7 LSAs are - translated into Type-5 LSAs regardless of the translator state of other - NSSA border routers. When role is Candidate, this router participates in - the translator election to determine if it will perform the translations - duties. When role is Never, this router will never translate Type-7 LSAs - into Type-5 LSAs. - -.. cfgcmd:: set protocols ospf area authentication plaintext-password - - This command specifies that simple password authentication should be used - for the given area. The password must also be configured on a per-interface - basis. - -.. cfgcmd:: set protocols ospf area authentication md5 - - This command specify that OSPF packets must be authenticated with MD5 HMACs - within the given area. Keying material must also be configured on a - per-interface basis. - -.. cfgcmd:: set protocols ospf area range [cost ] - - This command summarizes intra area paths from specified area into one - summary-LSA (Type-3) announced to other areas. This command can be used - only in ABR and ONLY router-LSAs (Type-1) and network-LSAs (Type-2) - (i.e. LSAs with scope area) can be summarized. AS-external-LSAs (Type-5) - can’t be summarized - their scope is AS. The optional argument - :cfgcmd:`cost` specifies the aggregated link metric. The metric range is 0 - to 16777215. - -.. cfgcmd:: set protocols ospf area range not-advertise - - This command instead of summarizing intra area paths filter them - i.e. - intra area paths from this range are not advertised into other areas. - This command makes sense in ABR only. - -.. cfgcmd:: set protocols ospf area export-list - - Filter Type-3 summary-LSAs announced to other areas originated from - intra- area paths from specified area. - This command makes sense in ABR only. - -.. cfgcmd:: set protocols ospf area import-list - - Same as export-list, but it applies to paths announced into specified - area as Type-3 summary-LSAs. - This command makes sense in ABR only. - -.. cfgcmd:: set protocols ospf area range substitute - - - One Type-3 summary-LSA with routing info is announced into - backbone area if defined area contains at least one intra-area network - (i.e. described with router-LSA or network-LSA) from range . - This command makes sense in ABR only. - -.. cfgcmd:: set protocols ospf area shortcut - - This parameter allows to "shortcut" routes (non-backbone) for inter-area - routes. There are three modes available for routes shortcutting: - - **default** – this area will be used for shortcutting only if ABR does not - have a link to the backbone area or this link was lost. - **enable** – the area will be used for shortcutting every time the route - that goes through it is cheaper. - **disable** – this area is never used by ABR for routes shortcutting. - -.. cfgcmd:: set protocols ospf area virtual-link - - Provides a backbone area coherence by virtual link establishment. - - In general, OSPF protocol requires a backbone area (area 0) to be coherent - and fully connected. I.e. any backbone area router must have a route to any - other backbone area router. Moreover, every ABR must have a link to - backbone area. However, it is not always possible to have a physical link - to a backbone area. In this case between two ABR (one of them has a link to - the backbone area) in the area (not stub area) a virtual link is organized. - - – area identifier through which a virtual link goes. - – ABR router-id with which a virtual link is established. Virtual - link must be configured on both routers. - - Formally, a virtual link looks like a point-to-point network connecting two - ABR from one area one of which physically connected to a backbone area. - This pseudo-network is considered to belong to a backbone area. - - -Interface Configuration ------------------------ - -.. cfgcmd:: set protocols ospf interface area - - Enable ospf on an interface and set associated area. - - If you have a lot of interfaces, and/or a lot of subnets, then enabling - OSPF via this command may result in a slight performance improvement. - -.. cfgcmd:: set protocols ospf interface authentication - plaintext-password - - This command sets OSPF authentication key to a simple password. After - setting, all OSPF packets are authenticated. Key has length up to 8 chars. - - Simple text password authentication is insecure and deprecated in favour of - MD5 HMAC authentication. - -.. cfgcmd:: set protocols ospf interface authentication md5 - key-id md5-key - - This command specifys that MD5 HMAC authentication must be used on this - interface. It sets OSPF authentication key to a cryptographic password. - Key-id identifies secret key used to create the message digest. This ID - is part of the protocol and must be consistent across routers on a link. - The key can be long up to 16 chars (larger strings will be truncated), - and is associated with the given key-id. - -.. cfgcmd:: set protocols ospf interface bandwidth - - This command sets the interface bandwidth for cost calculations, where - bandwidth can be in range from 1 to 100000, specified in Mbits/s. - -.. cfgcmd:: set protocols ospf interface cost - - This command sets link cost for the specified interface. The cost value is - set to router-LSA’s metric field and used for SPF calculation. The cost - range is 1 to 65535. - -.. cfgcmd:: set protocols ospf interface dead-interval - - Set number of seconds for router Dead Interval timer value used for Wait - Timer and Inactivity Timer. This value must be the same for all routers - attached to a common network. The default value is 40 seconds. The - interval range is 1 to 65535. - -.. cfgcmd:: set protocols ospf interface hello-multiplier - - The hello-multiplier specifies how many Hellos to send per second, from 1 - (every second) to 10 (every 100ms). Thus one can have 1s convergence time - for OSPF. If this form is specified, then the hello-interval advertised in - Hello packets is set to 0 and the hello-interval on received Hello packets - is not checked, thus the hello-multiplier need NOT be the same across - multiple routers on a common link. - -.. cfgcmd:: set protocols ospf interface hello-interval - - Set number of seconds for Hello Interval timer value. Setting this value, - Hello packet will be sent every timer value seconds on the specified - interface. This value must be the same for all routers attached to a - common network. The default value is 10 seconds. The interval range is 1 - to 65535. - -.. cfgcmd:: set protocols ospf interface bfd - - This command enables :abbr:`BFD (Bidirectional Forwarding Detection)` on - this OSPF link interface. - -.. cfgcmd:: set protocols ospf interface mtu-ignore - - This command disables check of the MTU value in the OSPF DBD packets. Thus, - use of this command allows the OSPF adjacency to reach the FULL state even - though there is an interface MTU mismatch between two OSPF routers. - -.. cfgcmd:: set protocols ospf interface network - - This command allows to specify the distribution type for the network - connected to this interface: - - **broadcast** – broadcast IP addresses distribution. - **non-broadcast** – address distribution in NBMA networks topology. - **point-to-multipoint** – address distribution in point-to-multipoint - networks. - **point-to-point** – address distribution in point-to-point networks. - -.. cfgcmd:: set protocols ospf interface priority - - This command sets Router Priority integer value. The router with the - highest priority will be more eligible to become Designated Router. - Setting the value to 0, makes the router ineligible to become - Designated Router. The default value is 1. The interval range is 0 to 255. - -.. cfgcmd:: set protocols ospf interface retransmit-interval - - - This command sets number of seconds for RxmtInterval timer value. This - value is used when retransmitting Database Description and Link State - Request packets if acknowledge was not received. The default value is 5 - seconds. The interval range is 3 to 65535. - -.. cfgcmd:: set protocols ospf interface transmit-delay - - This command sets number of seconds for InfTransDelay value. It allows to - set and adjust for each interface the delay interval before starting the - synchronizing process of the router's database with all neighbors. The - default value is 1 seconds. The interval range is 3 to 65535. - -.. cfgcmd:: set protocols ospf interface ldp-sync disable - - This command disables IGP-LDP sync for this specific interface. - -.. cfgcmd:: set protocols ospf interface ldp-sync holddown - - - This command will change the hold down value for IGP-LDP synchronization - during convergence/interface flap events, but for this interface only. - -External Route Summarisation ----------------------------- - -This feature summarises originated external LSAs (Type-5 and Type-7). Summary -Route will be originated on-behalf of all matched external LSAs. - -.. cfgcmd:: set protocols ospf aggregation timer - - Configure aggregation delay timer interval. - - Summarisation starts only after this delay timer expiry. - -.. cfgcmd:: set protocols ospf summary-address x.x.x.x/y [tag (1-4294967295)] - - This command enable/disables summarisation for the configured address range. - - Tag is the optional parameter. If tag configured Summary route will be - originated with the configured tag. - -.. cfgcmd:: set protocols ospf summary-address x.x.x.x/y no-advertise - - This command to ensure not advertise the summary lsa for the matched - external LSAs. - -Graceful Restart ----------------- - -.. cfgcmd:: set protocols ospf graceful-restart [grace-period (1-1800)] - - Configure Graceful Restart :rfc:`3623` restarting support. When enabled, - the default grace period is 120 seconds. - - To perform a graceful shutdown, the FRR ``graceful-restart prepare ip - ospf`` EXEC-level command needs to be issued before restarting the - ospfd daemon. - -.. cfgcmd:: set protocols ospf graceful-restart helper enable [router-id A.B.C.D] - - Configure Graceful Restart :rfc:`3623` helper support. By default, helper support - is disabled for all neighbours. This config enables/disables helper support - on this router for all neighbours. - - To enable/disable helper support for a specific neighbour, the router-id - (A.B.C.D) has to be specified. - -.. cfgcmd:: set protocols ospf graceful-restart helper no-strict-lsa-checking - - By default `strict-lsa-checking` is configured then the helper will abort - the Graceful Restart when a LSA change occurs which affects the restarting - router. - - This command disables it. - -.. cfgcmd:: set protocols ospf graceful-restart helper supported-grace-time - - Supports as HELPER for configured grace period. - -.. cfgcmd:: set protocols ospf graceful-restart helper planned-only - - It helps to support as HELPER only for planned restarts. - - By default, it supports both planned and unplanned outages. - -Manual Neighbor Configuration ------------------------------ - -OSPF routing devices normally discover their neighbors dynamically by -listening to the broadcast or multicast hello packets on the network. -Because an NBMA network does not support broadcast (or multicast), the -device cannot discover its neighbors dynamically, so you must configure all -the neighbors statically. - -.. cfgcmd:: set protocols ospf neighbor - - This command specifies the IP address of the neighboring device. - -.. cfgcmd:: set protocols ospf neighbor poll-interval - - This command specifies the length of time, in seconds, before the routing - device sends hello packets out of the interface before it establishes - adjacency with a neighbor. The range is 1 to 65535 seconds. The default - value is 60 seconds. - -.. cfgcmd:: set protocols ospf neighbor priority - - This command specifies the router priority value of the nonbroadcast - neighbor associated with the IP address specified. The default is 0. - This keyword does not apply to point-to-multipoint interfaces. - - -Redistribution Configuration ----------------------------- - -.. cfgcmd:: set protocols ospf redistribute - - This command redistributes routing information from the given route source - to the OSPF process. There are five modes available for route source: bgp, - connected, kernel, rip, static. - -.. cfgcmd:: set protocols ospf default-metric - - This command specifies the default metric value of redistributed routes. - The metric range is 0 to 16777214. - -.. cfgcmd:: set protocols ospf redistribute metric - - This command specifies metric for redistributed routes from the given - route source. There are five modes available for route source: bgp, - connected, kernel, rip, static. The metric range is 1 to 16777214. - -.. cfgcmd:: set protocols ospf redistribute metric-type <1|2> - - This command specifies metric type for redistributed routes. Difference - between two metric types that metric type 1 is a metric which is - "commensurable" with inner OSPF links. When calculating a metric to the - external destination, the full path metric is calculated as a metric sum - path of a router which had advertised this link plus the link metric. - Thus, a route with the least summary metric will be selected. If external - link is advertised with metric type 2 the path is selected which lies - through the router which advertised this link with the least metric - despite of the fact that internal path to this router is longer (with more - cost). However, if two routers advertised an external link and with metric - type 2 the preference is given to the path which lies through the router - with a shorter internal path. If two different routers advertised two - links to the same external destimation but with different metric type, - metric type 1 is preferred. If type of a metric left undefined the router - will consider these external links to have a default metric type 2. - -.. cfgcmd:: set protocols ospf redistribute route-map - - This command allows to use route map to filter redistributed routes from - the given route source. There are five modes available for route source: - bgp, connected, kernel, rip, static. - - -Operational Mode Commands -------------------------- - -.. opcmd:: show ip ospf neighbor - - This command displays the neighbors status. - -.. code-block:: none - - Neighbor ID Pri State Dead Time Address Interface RXmtL RqstL DBsmL - 10.0.13.1 1 Full/DR 38.365s 10.0.13.1 eth0:10.0.13.3 0 0 0 - 10.0.23.2 1 Full/Backup 39.175s 10.0.23.2 eth1:10.0.23.3 0 0 0 - -.. opcmd:: show ip ospf neighbor detail - - This command displays the neighbors information in a detailed form, not - just a summary table. - -.. code-block:: none - - Neighbor 10.0.13.1, interface address 10.0.13.1 - In the area 0.0.0.0 via interface eth0 - Neighbor priority is 1, State is Full, 5 state changes - Most recent state change statistics: - Progressive change 11m55s ago - DR is 10.0.13.1, BDR is 10.0.13.3 - Options 2 *|-|-|-|-|-|E|- - Dead timer due in 34.854s - Database Summary List 0 - Link State Request List 0 - Link State Retransmission List 0 - Thread Inactivity Timer on - Thread Database Description Retransmision off - Thread Link State Request Retransmission on - Thread Link State Update Retransmission on - - Neighbor 10.0.23.2, interface address 10.0.23.2 - In the area 0.0.0.1 via interface eth1 - Neighbor priority is 1, State is Full, 4 state changes - Most recent state change statistics: - Progressive change 41.193s ago - DR is 10.0.23.3, BDR is 10.0.23.2 - Options 2 *|-|-|-|-|-|E|- - Dead timer due in 35.661s - Database Summary List 0 - Link State Request List 0 - Link State Retransmission List 0 - Thread Inactivity Timer on - Thread Database Description Retransmision off - Thread Link State Request Retransmission on - Thread Link State Update Retransmission on - -.. opcmd:: show ip ospf neighbor - - This command displays the neighbors information in a detailed form for a - neighbor whose IP address is specified. - -.. opcmd:: show ip ospf neighbor - - This command displays the neighbors status for a neighbor on the specified - interface. - -.. opcmd:: show ip ospf interface [] - - This command displays state and configuration of OSPF the specified - interface, or all interfaces if no interface is given. - -.. code-block:: none - - eth0 is up - ifindex 2, MTU 1500 bytes, BW 4294967295 Mbit - Internet Address 10.0.13.3/24, Broadcast 10.0.13.255, Area 0.0.0.0 - MTU mismatch detection: enabled - Router ID 10.0.23.3, Network Type BROADCAST, Cost: 1 - Transmit Delay is 1 sec, State Backup, Priority 1 - Backup Designated Router (ID) 10.0.23.3, Interface Address 10.0.13.3 - Multicast group memberships: OSPFAllRouters OSPFDesignatedRouters - Timer intervals configured, Hello 10s, Dead 40s, Wait 40s, Retransmit 5 - Hello due in 4.470s - Neighbor Count is 1, Adjacent neighbor count is 1 - eth1 is up - ifindex 3, MTU 1500 bytes, BW 4294967295 Mbit - Internet Address 10.0.23.3/24, Broadcast 10.0.23.255, Area 0.0.0.1 - MTU mismatch detection: enabled - Router ID 10.0.23.3, Network Type BROADCAST, Cost: 1 - Transmit Delay is 1 sec, State DR, Priority 1 - Backup Designated Router (ID) 10.0.23.2, Interface Address 10.0.23.2 - Saved Network-LSA sequence number 0x80000002 - Multicast group memberships: OSPFAllRouters OSPFDesignatedRouters - Timer intervals configured, Hello 10s, Dead 40s, Wait 40s, Retransmit 5 - Hello due in 4.563s - Neighbor Count is 1, Adjacent neighbor count is 1 - -.. opcmd:: show ip ospf route [detail] - - This command displays the OSPF routing table, as determined by the most - recent SPF calculation. With the optional :cfgcmd:`detail` argument, - each route item's advertiser router and network attribute will be shown. - -.. code-block:: none - - ============ OSPF network routing table ============ - N IA 10.0.12.0/24 [3] area: 0.0.0.0 - via 10.0.13.3, eth0 - N 10.0.13.0/24 [1] area: 0.0.0.0 - directly attached to eth0 - N IA 10.0.23.0/24 [2] area: 0.0.0.0 - via 10.0.13.3, eth0 - N 10.0.34.0/24 [2] area: 0.0.0.0 - via 10.0.13.3, eth0 - - ============ OSPF router routing table ============= - R 10.0.23.3 [1] area: 0.0.0.0, ABR - via 10.0.13.3, eth0 - R 10.0.34.4 [2] area: 0.0.0.0, ASBR - via 10.0.13.3, eth0 - - ============ OSPF external routing table =========== - N E2 172.16.0.0/24 [2/20] tag: 0 - via 10.0.13.3, eth0 - -The table consists of following data: - -**OSPF network routing table** – includes a list of acquired routes for all -accessible networks (or aggregated area ranges) of OSPF system. "IA" flag -means that route destination is in the area to which the router is not -connected, i.e. it’s an inter-area path. In square brackets a summary metric -for all links through which a path lies to this network is specified. "via" -prefix defines a router-gateway, i.e. the first router on the way to the -destination (next hop). -**OSPF router routing table** – includes a list of acquired routes to all -accessible ABRs and ASBRs. -**OSPF external routing table** – includes a list of acquired routes that are -external to the OSPF process. "E" flag points to the external link metric type -(E1 – metric type 1, E2 – metric type 2). External link metric is printed in -the "/" format. - -.. opcmd:: show ip ospf border-routers - - This command displays a table of paths to area boundary and autonomous - system boundary routers. - -.. opcmd:: show ip ospf database - - This command displays a summary table with a database contents (LSA). - -.. code-block:: none - - OSPF Router with ID (10.0.13.1) - - Router Link States (Area 0.0.0.0) - - Link ID ADV Router Age Seq# CkSum Link count - 10.0.13.1 10.0.13.1 984 0x80000005 0xd915 1 - 10.0.23.3 10.0.23.3 1186 0x80000008 0xfe62 2 - 10.0.34.4 10.0.34.4 1063 0x80000004 0x4e3f 1 - - Net Link States (Area 0.0.0.0) - - Link ID ADV Router Age Seq# CkSum - 10.0.13.1 10.0.13.1 994 0x80000003 0x30bb - 10.0.34.4 10.0.34.4 1188 0x80000001 0x9411 - - Summary Link States (Area 0.0.0.0) - - Link ID ADV Router Age Seq# CkSum Route - 10.0.12.0 10.0.23.3 1608 0x80000001 0x6ab6 10.0.12.0/24 - 10.0.23.0 10.0.23.3 981 0x80000003 0xe232 10.0.23.0/24 - - AS External Link States - - Link ID ADV Router Age Seq# CkSum Route - 172.16.0.0 10.0.34.4 1063 0x80000001 0xc40d E2 172.16.0.0/24 [0x0] - -.. opcmd:: show ip ospf database [A.B.C.D] - [adv-router |self-originate] - - This command displays a database contents for a specific link advertisement - type. - - The type can be the following: - asbr-summary, external, network, nssa-external, opaque-area, opaque-as, - opaque-link, router, summary. - - [A.B.C.D] – link-state-id. With this specified the command displays portion - of the network environment that is being described by the advertisement. - The value entered depends on the advertisement’s LS type. It must be - entered in the form of an IP address. - - :cfgcmd:`adv-router ` – router id, which link advertisements need - to be reviewed. - - :cfgcmd:`self-originate` displays only self-originated LSAs from the local - router. - -.. code-block:: none - - OSPF Router with ID (10.0.13.1) - - Router Link States (Area 0.0.0.0) - - LS age: 1213 - Options: 0x2 : *|-|-|-|-|-|E|- - LS Flags: 0x3 - Flags: 0x0 - LS Type: router-LSA - Link State ID: 10.0.13.1 - Advertising Router: 10.0.13.1 - LS Seq Number: 80000009 - Checksum: 0xd119 - Length: 36 - - Number of Links: 1 - - Link connected to: a Transit Network - (Link ID) Designated Router address: 10.0.13.1 - (Link Data) Router Interface address: 10.0.13.1 - Number of TOS metrics: 0 - TOS 0 Metric: 1 - -.. opcmd:: show ip ospf database max-age - - This command displays LSAs in MaxAge list. - - -Examples --------- - - -Enable OSPF -^^^^^^^^^^^ - -**Node 1** - -.. code-block:: none - - set interfaces loopback lo address 10.1.1.1/32 - set interfaces ethernet eth0 address 192.168.0.1/24 - set protocols ospf area 0 network 192.168.0.0/24 - set protocols ospf area 0 network 10.1.1.1/32 - set protocols ospf parameters router-id 10.1.1.1 - -**Node 2** - -.. code-block:: none - - set interfaces loopback lo address 10.1.1.2/32 - set interfaces ethernet eth0 address 192.168.0.2/24 - set protocols ospf area 0 network 192.168.0.0/24 - set protocols ospf area 0 network 10.1.1.2/32 - set protocols ospf parameters router-id 10.1.1.2 - - - -Here's the neighbors up: - -.. code-block:: none - - Node-1@vyos:~$ show ip ospf neighbor - - Neighbor ID Pri State Up Time Dead Time Address Interface RXmtL RqstL DBsmL - 10.1.1.2 1 Full/DR 3m43s 36.094s 192.168.0.2 eth0:192.168.0.1 0 0 0 - - - - Node-2@vyos:~$ show ip ospf neighbor - - Neighbor ID Pri State Up Time Dead Time Address Interface RXmtL RqstL DBsmL - 10.1.1.1 1 Full/Backup 3m47s 31.736s 192.168.0.1 eth0:192.168.0.2 0 0 0 - -Here's the routes: - -.. code-block:: none - - Node-1@vyos:~$ show ip route ospf - Codes: K - kernel route, C - connected, S - static, R - RIP, - O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP, - T - Table, v - VNC, V - VNC-Direct, A - Babel, F - PBR, - f - OpenFabric, - > - selected route, * - FIB route, q - queued, r - rejected, b - backup - t - trapped, o - offload failure - - O 10.1.1.1/32 [110/0] is directly connected, lo, weight 1, 00:00:14 - O>* 10.1.1.2/32 [110/1] via 192.168.0.2, eth0, weight 1, 00:00:07 - O 192.168.0.0/24 [110/1] is directly connected, eth0, weight 1, 00:03:32 - - Node-2@vyos:~$ show ip route ospf - Codes: K - kernel route, C - connected, S - static, R - RIP, - O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP, - T - Table, v - VNC, V - VNC-Direct, A - Babel, F - PBR, - f - OpenFabric, - > - selected route, * - FIB route, q - queued, r - rejected, b - backup - t - trapped, o - offload failure - - O>* 10.1.1.1/32 [110/1] via 192.168.0.1, eth0, weight 1, 00:00:11 - O 10.1.1.2/32 [110/0] is directly connected, lo, weight 1, 00:00:04 - O 192.168.0.0/24 [110/1] is directly connected, eth0, weight 1, 00:03:18 - - - - - -Enable OSPF with route redistribution of the loopback and default originate: -^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ - -**Node 1** - -.. code-block:: none - - set interfaces loopback lo address 10.1.1.1/32 - set protocols ospf area 0 network 192.168.0.0/24 - set protocols ospf default-information originate always - set protocols ospf default-information originate metric 10 - set protocols ospf default-information originate metric-type 2 - set protocols ospf log-adjacency-changes - set protocols ospf parameters router-id 10.1.1.1 - set protocols ospf redistribute connected metric-type 2 - set protocols ospf redistribute connected route-map CONNECT - - set policy route-map CONNECT rule 10 action permit - set policy route-map CONNECT rule 10 match interface lo - -**Node 2** - -.. code-block:: none - - set interfaces loopback lo address 10.2.2.2/32 - set protocols ospf area 0 network 192.168.0.0/24 - set protocols ospf log-adjacency-changes - set protocols ospf parameters router-id 10.2.2.2 - set protocols ospf redistribute connected metric-type 2 - set protocols ospf redistribute connected route-map CONNECT - - set policy route-map CONNECT rule 10 action permit - set policy route-map CONNECT rule 10 match interface lo - - -Enable OSPF and IGP-LDP synchronization: -^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ - -**Node 1:** - -.. code-block:: none - - set interfaces loopback lo address 10.1.1.1/32 - set interfaces ethernet eth0 address 192.168.0.1/24 - - set protocols ospf area 0 network '192.168.0.0/24' - set protocols ospf area 0 network '10.1.1.1/32' - set protocols ospf parameters router-id '10.1.1.1' - set protocols ospf ldp-sync - - set protocols mpls interface eth0 - set protocols mpls ldp discovery transport-ipv4-address 10.1.1.1 - set protocols mpls ldp interface lo - set protocols mpls ldp interface eth0 - set protocols mpls ldp parameters transport-prefer-ipv4 - set protocols mpls ldp router-id 10.1.1.1 - - -This gives us IGP-LDP synchronization for all non-loopback interfaces with -a holddown timer of zero seconds: - - -.. code-block:: none - - Node-1@vyos:~$ show ip ospf mpls ldp-sync - eth0 - LDP-IGP Synchronization enabled: yes - Holddown timer in seconds: 0 - State: Sync achieved - - - -Enable OSPF with Segment Routing (Experimental): -^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ - -**Node 1** - -.. code-block:: none - - set interfaces loopback lo address 10.1.1.1/32 - set interfaces ethernet eth0 address 192.168.0.1/24 - - set protocols ospf area 0 network '192.168.0.0/24' - set protocols ospf area 0 network '10.1.1.1/32' - set protocols ospf parameters opaque-lsa - set protocols ospf parameters router-id '10.1.1.1' - set protocols ospf segment-routing global-block high-label-value '1100' - set protocols ospf segment-routing global-block low-label-value '1000' - set protocols ospf segment-routing prefix 10.1.1.1/32 index explicit-null - set protocols ospf segment-routing prefix 10.1.1.1/32 index value '1' - -**Node 2** - -.. code-block:: none - - set interfaces loopback lo address 10.1.1.2/32 - set interfaces ethernet eth0 address 192.168.0.2/24 - - set protocols ospf area 0 network '192.168.0.0/24' - set protocols ospf area 0 network '10.1.1.2/32' - set protocols ospf parameters opaque-lsa - set protocols ospf parameters router-id '10.1.1.2' - set protocols ospf segment-routing global-block high-label-value '1100' - set protocols ospf segment-routing global-block low-label-value '1000' - set protocols ospf segment-routing prefix 10.1.1.2/32 index explicit-null - set protocols ospf segment-routing prefix 10.1.1.2/32 index value '2' - - -This gives us MPLS segment routing enabled and labels for far end loopbacks: - -.. code-block:: none - - Node-1@vyos:~$ show mpls table - Inbound Label Type Nexthop Outbound Label - ----------------------------------------------------------- - 1002 SR (OSPF) 192.168.0.2 IPv4 Explicit Null <-- Node-2 loopback learned on Node-1 - 15000 SR (OSPF) 192.168.0.2 implicit-null - 15001 SR (OSPF) 192.168.0.2 implicit-null - - Node-2@vyos:~$ show mpls table - Inbound Label Type Nexthop Outbound Label - ----------------------------------------------------------- - 1001 SR (OSPF) 192.168.0.1 IPv4 Explicit Null <-- Node-1 loopback learned on Node-2 - 15000 SR (OSPF) 192.168.0.1 implicit-null - 15001 SR (OSPF) 192.168.0.1 implicit-null - -Here is the routing tables showing the MPLS segment routing label operations: - -.. code-block:: none - - Node-1@vyos:~$ show ip route ospf - Codes: K - kernel route, C - connected, S - static, R - RIP, - O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP, - T - Table, v - VNC, V - VNC-Direct, A - Babel, F - PBR, - f - OpenFabric, - > - selected route, * - FIB route, q - queued, r - rejected, b - backup - t - trapped, o - offload failure - - O 10.1.1.1/32 [110/0] is directly connected, lo, weight 1, 00:03:43 - O>* 10.1.1.2/32 [110/1] via 192.168.0.2, eth0, label IPv4 Explicit Null, weight 1, 00:03:32 - O 192.168.0.0/24 [110/1] is directly connected, eth0, weight 1, 00:03:43 - - Node-2@vyos:~$ show ip route ospf - Codes: K - kernel route, C - connected, S - static, R - RIP, - O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP, - T - Table, v - VNC, V - VNC-Direct, A - Babel, F - PBR, - f - OpenFabric, - > - selected route, * - FIB route, q - queued, r - rejected, b - backup - t - trapped, o - offload failure - - O>* 10.1.1.1/32 [110/1] via 192.168.0.1, eth0, label IPv4 Explicit Null, weight 1, 00:03:36 - O 10.1.1.2/32 [110/0] is directly connected, lo, weight 1, 00:03:51 - O 192.168.0.0/24 [110/1] is directly connected, eth0, weight 1, 00:03:51 - - - - -.. _routing-ospfv3: - -************* -OSPFv3 (IPv6) -************* - -.. _ospf:v3_configuration: - -Configuration -============= - -.. _ospf:v3_general: - -General -------- - -VyOS does not have a special command to start the OSPFv3 process. The OSPFv3 -process starts when the first ospf enabled interface is configured. - -.. cfgcmd:: set protocols ospfv3 interface area - - This command specifies the OSPFv3 enabled interface. This command is also - used to enable the OSPF process. The area number can be specified in - decimal notation in the range from 0 to 4294967295. Or it can be specified - in dotted decimal notation similar to ip address. - -.. cfgcmd:: set protocols ospfv3 parameters router-id - - This command sets the router-ID of the OSPFv3 process. The router-ID may be - an IP address of the router, but need not be – it can be any arbitrary - 32bit number. However it MUST be unique within the entire OSPFv3 domain to - the OSPFv3 speaker – bad things will happen if multiple OSPFv3 speakers are - configured with the same router-ID! - - -.. _ospf:v3_optional: - -Optional --------- - -.. cfgcmd:: set protocols ospfv3 distance global - - This command change distance value of OSPFv3 globally. - The distance range is 1 to 255. - -.. cfgcmd:: set protocols ospfv3 distance ospfv3 - - - This command change distance value of OSPFv3. The arguments are the - distance values for external routes, inter-area routes and intra-area - routes respectively. The distance range is 1 to 255. - -.. _ospf:v3_area_configuration: - -Area Configuration ------------------- - -.. cfgcmd:: set protocols ospfv3 area range - - This command summarizes intra area paths from specified area into one - Type-3 Inter-Area Prefix LSA announced to other areas. This command can be - used only in ABR. - -.. cfgcmd:: set protocols ospfv3 area range not-advertise - - This command instead of summarizing intra area paths filter them - i.e. - intra area paths from this range are not advertised into other areas. This - command makes sense in ABR only. - -.. _ospf:v3_interface_config: - -Interface Configuration ------------------------ - -.. cfgcmd:: set protocols ospfv3 interface ipv6 cost - - This command sets link cost for the specified interface. The cost value is - set to router-LSA’s metric field and used for SPF calculation. The cost - range is 1 to 65535. - -.. cfgcmd:: set protocols ospfv3 interface dead-interval - - Set number of seconds for router Dead Interval timer value used for Wait - Timer and Inactivity Timer. This value must be the same for all routers - attached to a common network. The default value is 40 seconds. The - interval range is 1 to 65535. - -.. cfgcmd:: set protocols ospfv3 interface hello-interval - - - Set number of seconds for Hello Interval timer value. Setting this value, - Hello packet will be sent every timer value seconds on the specified - interface. This value must be the same for all routers attached to a - common network. The default value is 10 seconds. The interval range is 1 - to 65535. - -.. cfgcmd:: set protocols ospfv3 interface mtu-ignore - - This command disables check of the MTU value in the OSPF DBD packets. - Thus, use of this command allows the OSPF adjacency to reach the FULL - state even though there is an interface MTU mismatch between two OSPF - routers. - -.. cfgcmd:: set protocols ospfv3 interface network - - This command allows to specify the distribution type for the network - connected to this interface: - - **broadcast** – broadcast IP addresses distribution. - **point-to-point** – address distribution in point-to-point networks. - -.. cfgcmd:: set protocols ospfv3 interface priority - - This command sets Router Priority integer value. The router with the - highest priority will be more eligible to become Designated Router. - Setting the value to 0, makes the router ineligible to become Designated - Router. The default value is 1. The interval range is 0 to 255. - -.. cfgcmd:: set protocols ospfv3 interface passive - - This command specifies interface as passive. Passive interface advertises - its address, but does not run the OSPF protocol (adjacencies are not formed - and hello packets are not generated). - -.. cfgcmd:: set protocols ospfv3 interface retransmit-interval - - - This command sets number of seconds for RxmtInterval timer value. This - value is used when retransmitting Database Description and Link State - Request packets if acknowledge was not received. The default value is 5 - seconds. The interval range is 3 to 65535. - -.. cfgcmd:: set protocols ospfv3 interface transmit-delay - - - This command sets number of seconds for InfTransDelay value. It allows to - set and adjust for each interface the delay interval before starting the - synchronizing process of the router's database with all neighbors. The - default value is 1 seconds. The interval range is 3 to 65535. - -.. _ospf:v3_graceful_restart: - -Graceful Restart ----------------- - -.. cfgcmd:: set protocols ospfv3 graceful-restart [grace-period (1-1800)] - - Configure Graceful Restart :rfc:`3623` restarting support. When enabled, - the default grace period is 120 seconds. - - To perform a graceful shutdown, the FRR ``graceful-restart prepare ip - ospf`` EXEC-level command needs to be issued before restarting the - ospfd daemon. - -.. cfgcmd:: set protocols ospfv3 graceful-restart helper enable [router-id A.B.C.D] - - Configure Graceful Restart :rfc:`3623` helper support. By default, helper support - is disabled for all neighbours. This config enables/disables helper support - on this router for all neighbours. - - To enable/disable helper support for a specific neighbour, the router-id - (A.B.C.D) has to be specified. - -.. cfgcmd:: set protocols ospfv3 graceful-restart helper lsa-check-disable - - By default `strict-lsa-checking` is configured then the helper will abort - the Graceful Restart when a LSA change occurs which affects the restarting - router. - - This command disables it. - -.. cfgcmd:: set protocols ospfv3 graceful-restart helper supported-grace-time - - Supports as HELPER for configured grace period. - -.. cfgcmd:: set protocols ospfv3 graceful-restart helper planned-only - - It helps to support as HELPER only for planned restarts. - - By default, it supports both planned and unplanned outages. - -.. _ospf:v3_redistribution_config: - -Redistribution Configuration ----------------------------- - -.. cfgcmd:: set protocols ospfv3 redistribute - - This command redistributes routing information from the given route source - to the OSPFv3 process. There are five modes available for route source: - bgp, connected, kernel, ripng, static. - -.. cfgcmd:: set protocols ospf redistribute route-map - - This command allows to use route map to filter redistributed routes from - given route source. There are five modes available for route source: bgp, - connected, kernel, ripng, static. - -.. _ospf:v3_op_cmd: - -Operational Mode Commands -------------------------- - -.. opcmd:: show ipv6 ospfv3 neighbor - - This command displays the neighbors status. - -.. opcmd:: show ipv6 ospfv3 neighbor detail - - This command displays the neighbors information in a detailed form, not - just a summary table. - -.. opcmd:: show ipv6 ospfv3 neighbor drchoice - - This command displays the neighbor DR choice information. - -.. opcmd:: show ipv6 ospfv3 interface [prefix]|[ [prefix]] - - This command displays state and configuration of OSPF the specified - interface, or all interfaces if no interface is given. Whith the argument - :cfgcmd:`prefix` this command shows connected prefixes to advertise. - -.. opcmd:: show ipv6 ospfv3 route - - This command displays the OSPF routing table, as determined by the most - recent SPF calculation. - -.. opcmd:: show ipv6 ospfv3 border-routers - - This command displays a table of paths to area boundary and autonomous - system boundary routers. - -.. opcmd:: show ipv6 ospfv3 database - - This command displays a summary table with a database contents (LSA). - -.. opcmd:: show ipv6 ospfv3 database [A.B.C.D] - [adv-router |self-originate] - - This command displays a database contents for a specific link - advertisement type. - -.. opcmd:: show ipv6 ospfv3 redistribute - - This command displays external information redistributed into OSPFv3 - -.. _ospf:v3_config_example: - -Configuration Example ---------------------- - -A typical configuration using 2 nodes. - -**Node 1:** - -.. code-block:: none - - set protocols ospfv3 interface eth1 area 0.0.0.0 - set protocols ospfv3 area 0.0.0.0 range 2001:db8:1::/64 - set protocols ospfv3 parameters router-id 192.168.1.1 - set protocols ospfv3 redistribute connected - -**Node 2:** - -.. code-block:: none - - set protocols ospfv3 interface eth1 area 0.0.0.0 - set protocols ospfv3 area 0.0.0.0 range 2001:db8:2::/64 - set protocols ospfv3 parameters router-id 192.168.2.1 - set protocols ospfv3 redistribute connected - -**To see the redistributed routes:** - -.. code-block:: none - - show ipv6 ospfv3 redistribute - -.. note:: You cannot easily redistribute IPv6 routes via OSPFv3 on a - WireGuard interface link. This requires you to configure link-local - addresses manually on the WireGuard interfaces, see :vytask:`T1483`. - -Example configuration for WireGuard interfaces: - -**Node 1** - -.. code-block:: none - - set interfaces wireguard wg01 address 'fe80::216:3eff:fe51:fd8c/64' - set interfaces wireguard wg01 address '192.168.0.1/24' - set interfaces wireguard wg01 peer ospf02 allowed-ips '::/0' - set interfaces wireguard wg01 peer ospf02 allowed-ips '0.0.0.0/0' - set interfaces wireguard wg01 peer ospf02 endpoint '10.1.1.101:12345' - set interfaces wireguard wg01 peer ospf02 pubkey 'ie3...=' - set interfaces wireguard wg01 port '12345' - set protocols ospfv3 parameters router-id 192.168.1.1 - set protocols ospfv3 interface 'wg01' area 0.0.0.0 - set protocols ospfv3 interface 'lo' area 0.0.0.0 - -**Node 2** - -.. code-block:: none - - set interfaces wireguard wg01 address 'fe80::216:3eff:fe0a:7ada/64' - set interfaces wireguard wg01 address '192.168.0.2/24' - set interfaces wireguard wg01 peer ospf01 allowed-ips '::/0' - set interfaces wireguard wg01 peer ospf01 allowed-ips '0.0.0.0/0' - set interfaces wireguard wg01 peer ospf01 endpoint '10.1.1.100:12345' - set interfaces wireguard wg01 peer ospf01 pubkey 'NHI...=' - set interfaces wireguard wg01 port '12345' - set protocols ospfv3 parameters router-id 192.168.1.2 - set protocols ospfv3 interface 'wg01' area 0.0.0.0 - set protocols ospfv3 interface 'lo' area 0.0.0.0 - -**Status** - -.. code-block:: none - - vyos@ospf01:~$ sh ipv6 ospfv3 neighbor - Neighbor ID Pri DeadTime State/IfState Duration I/F[State] - 192.168.0.2 1 00:00:37 Full/PointToPoint 00:18:03 wg01[PointToPoint] - - vyos@ospf02# run sh ipv6 ospfv3 neighbor - Neighbor ID Pri DeadTime State/IfState Duration I/F[State] - 192.168.0.1 1 00:00:39 Full/PointToPoint 00:19:44 wg01[PointToPoint] - diff --git a/docs/configuration/protocols/pim.md b/docs/configuration/protocols/pim.md new file mode 100644 index 00000000..1768be72 --- /dev/null +++ b/docs/configuration/protocols/pim.md @@ -0,0 +1,304 @@ +--- +lastproofread: '2023-11-13' +--- + +(pim)= + +# PIM – Protocol Independent Multicast + +VyOS supports {abbr}`PIM-SM (PIM Sparse Mode)` as well as +{abbr}`IGMP (Internet Group Management Protocol)` v2 and v3 + +{abbr}`PIM (Protocol Independent Multicast)` must be configured in every +interface of every participating router. Every router must also have the +location of the Rendevouz Point manually configured. Then, unidirectional +shared trees rooted at the Rendevouz Point will automatically be built +for multicast distribution. + +Traffic from multicast sources will go to the Rendezvous Point, and +receivers will pull it from a shared tree using {abbr}`IGMP (Internet +Group Management Protocol)`. + +Multicast receivers will talk IGMP to their local router, so, besides +having PIM configured in every router, IGMP must also be configured in +any router where there could be a multicast receiver locally connected. + +VyOS supports both IGMP version 2 and version 3 (which allows +source-specific multicast). + +## PIM-SM - PIM Sparse Mode + +```{eval-rst} +.. cfgcmd:: set protocols pim ecmp + + If PIM has the a choice of ECMP nexthops for a particular + {abbr}`RPF (Reverse Path Forwarding)`, PIM will cause S,G flows to be + spread out amongst the nexthops. If this command is not specified then + the first nexthop found will be used. +``` + +```{eval-rst} +.. cfgcmd:: set protocols pim ecmp rebalance + + If PIM is using ECMP and an interface goes down, cause PIM to rebalance all + S,G flows across the remaining nexthops. If this command is not configured + PIM only modifies those S,G flows that were using the interface that went + down. +``` + +```{eval-rst} +.. cfgcmd:: set protocols pim join-prune-interval + + Modify the join/prune interval that PIM uses to the new value. Time is + specified in seconds. + + The default time is 60 seconds. + + If you enter a value smaller than 60 seconds be aware that this can and + will affect convergence at scale. +``` + +```{eval-rst} +.. cfgcmd:: set protocols pim keep-alive-timer + + Modify the time out value for a S,G flow from 1-65535 seconds. If choosing + a value below 31 seconds be aware that some hardware platforms cannot see + data flowing in better than 30 second chunks. +``` + +```{eval-rst} +.. cfgcmd:: set protocols pim packets + + When processing packets from a neighbor process the number of packets + incoming at one time before moving on to the next task. + + The default value is 3 packets. + + This command is only useful at scale when you can possibly have a large + number of PIM control packets flowing. +``` + +```{eval-rst} +.. cfgcmd:: set protocols pim register-accept-list + + When PIM receives a register packet the source of the packet will be compared + to the prefix-list specified, and if a permit is received normal processing + continues. If a deny is returned for the source address of the register packet + a register stop message is sent to the source. +``` + +```{eval-rst} +.. cfgcmd:: set protocols pim register-suppress-time + + Modify the time that pim will register suppress a FHR will send register + notifications to the kernel. +``` + +```{eval-rst} +.. cfgcmd:: set protocols pim rp
group + + In order to use PIM, it is necessary to configure a {abbr}`RP (Rendezvous Point)` + for join messages to be sent to. Currently the only methodology to do this is + via static rendezvous point commands. + + All routers in the PIM network must agree on these values. + + The first ip address is the RP's address and the second value is the matching + prefix of group ranges covered. +``` + +```{eval-rst} +.. cfgcmd:: set protocols pim rp keep-alive-timer + + Modify the time out value for a S,G flow from 1-65535 seconds at + {abbr}`RP (Rendezvous Point)`. The normal keepalive period for the KAT(S,G) + defaults to 210 seconds. However, at the {abbr}`RP (Rendezvous Point)`, the + keepalive period must be at least the Register_Suppression_Time, or the RP + may time out the (S,G) state before the next Null-Register arrives. + Thus, the KAT(S,G) is set to max(Keepalive_Period, RP_Keepalive_Period) + when a Register-Stop is sent. + + If choosing a value below 31 seconds be aware that some hardware platforms + cannot see data flowing in better than 30 second chunks. + + See {rfc}`7761#section-4.1` for details. +``` + +```{eval-rst} +.. cfgcmd:: set protocols pim no-v6-secondary + + When sending PIM hello packets tell PIM to not send any v6 secondary + addresses on the interface. This information is used to allow PIM to use v6 + nexthops in it's decision for {abbr}`RPF (Reverse Path Forwarding)` lookup + if this option is not set (default). +``` + +```{eval-rst} +.. cfgcmd:: set protocols pim spt-switchover infinity-and-beyond [prefix-list ] + + On the last hop router if it is desired to not switch over to the SPT tree + configure this command. + + Optional parameter prefix-list can be use to control which groups to switch or + not switch. If a group is PERMIT as per the prefix-list, then the SPT switchover + does not happen for it and if it is DENY, then the SPT switchover happens. +``` + +```{eval-rst} +.. cfgcmd:: set protocols pim ssm prefix-list + + Specify a range of group addresses via a prefix-list that forces PIM to never + do {abbr}`SSM (Source-Specific Multicast)` over. +``` + +### Interface specific commands + +```{eval-rst} +.. cfgcmd:: set protocols pim interface bfd [profile ] + + Automatically create BFD session for each RIP peer discovered in this + interface. When the BFD session monitor signalize that the link is down + the RIP peer is removed and all the learned routes associated with that + peer are removed. + + If optional profile parameter is used, select a BFD profile for the BFD + sessions created via this interface. +``` + +```{eval-rst} +.. cfgcmd:: set protocols pim interface dr-priority + + Set the {abbr}`DR (Designated Router)` Priority for the interface. + This command is useful to allow the user to influence what node becomes + the DR for a LAN segment. +``` + +```{eval-rst} +.. cfgcmd:: set protocols pim interface hello + + Set the PIM hello and hold interval for a interface. +``` + +```{eval-rst} +.. cfgcmd:: set protocols pim interface no-bsm + + Tell PIM that we would not like to use this interface to process + bootstrap messages. +``` + +```{eval-rst} +.. cfgcmd:: set protocols pim interface no-unicast-bsm + + Tell PIM that we would not like to use this interface to process + unicast bootstrap messages. +``` + +```{eval-rst} +.. cfgcmd:: set protocols pim interface passive + + Disable sending and receiving PIM control packets on the interface. + + .. cfgcmd:: set protocols pim interface source-address + + If you have multiple addresses configured on a particular interface and would + like PIM to use a specific source address associated with that interface. +``` + +## IGMP - Internet Group Management Protocol) + +```{eval-rst} +.. cfgcmd:: set protocols pim igmp watermark-warning + + Configure watermark warning generation for an IGMP group limit. Generates + warning once the configured group limit is reached while adding new groups. +``` + +(pim-igmp-interface-commands)= + +### Interface specific commands + +```{eval-rst} +.. cfgcmd:: set protocols pim interface igmp + join source-address + + Use this command to allow the selected interface to join a multicast + group defining the multicast address you want to join and the source + IP address too. +``` + +```{eval-rst} +.. cfgcmd:: set protocols pim interface igmp + query-interval + + Use this command to configure in the selected interface the IGMP + host query interval (1-1800) in seconds that PIM will use. +``` + +```{eval-rst} +.. cfgcmd:: set protocols pim interface igmp + query-max-response-time + + Use this command to configure in the selected interface the IGMP + query response timeout value (10-250) in deciseconds. If a report is + not returned in the specified time, it will be assumed the (S,G) or + (\*,G) state {rfc}`7761#section-4.1` has timed out. +``` + +```{eval-rst} +.. cfgcmd:: set protocols pim interface igmp version + + Use this command to define in the selected interface whether you + choose IGMP version 2 or 3. + + The default value is 3. +``` + +#### Example + +In the following example we can see a basic multicast setup: + +```{image} /_static/images/multicast-basic.png +:align: center +:alt: Network Topology Diagram +:width: 90% +``` + +**Router 1** + +```none +set interfaces ethernet eth2 address '172.16.0.2/24' +set interfaces ethernet eth1 address '100.64.0.1/24' +set protocols ospf area 0 network '172.16.0.0/24' +set protocols ospf area 0 network '100.64.0.0/24' +set protocols igmp interface eth1 +set protocols pim interface eth1 +set protocols pim interface eth2 +set protocols pim rp address 172.16.255.1 group '224.0.0.0/4' +``` + +**Router 3** + +```none +set interfaces dummy dum0 address '172.16.255.1/24' +set interfaces ethernet eth0 address '172.16.0.1/24' +set interfaces ethernet eth1 address '172.16.1.1/24' +set protocols ospf area 0 network '172.16.0.0/24' +set protocols ospf area 0 network '172.16.255.0/24' +set protocols ospf area 0 network '172.16.1.0/24' +set protocols pim interface dum0 +set protocols pim interface eth0 +set protocols pim interface eth1 +set protocols pim rp address 172.16.255.1 group '224.0.0.0/4' +``` + +**Router 2** + +```none +set interfaces ethernet eth1 address '10.0.0.1/24' +set interfaces ethernet eth2 address '172.16.1.2/24' +set protocols ospf area 0 network '10.0.0.0/24' +set protocols ospf area 0 network '172.16.1.0/24' +set protocols pim interface eth1 +set protocols pim interface eth2 +set protocols pim rp address 172.16.255.1 group '224.0.0.0/4' +``` diff --git a/docs/configuration/protocols/pim.rst b/docs/configuration/protocols/pim.rst deleted file mode 100644 index 2e881943..00000000 --- a/docs/configuration/protocols/pim.rst +++ /dev/null @@ -1,266 +0,0 @@ -:lastproofread: 2023-11-13 - -.. _pim: - -#################################### -PIM – Protocol Independent Multicast -#################################### - -VyOS supports :abbr:`PIM-SM (PIM Sparse Mode)` as well as -:abbr:`IGMP (Internet Group Management Protocol)` v2 and v3 - -:abbr:`PIM (Protocol Independent Multicast)` must be configured in every -interface of every participating router. Every router must also have the -location of the Rendevouz Point manually configured. Then, unidirectional -shared trees rooted at the Rendevouz Point will automatically be built -for multicast distribution. - -Traffic from multicast sources will go to the Rendezvous Point, and -receivers will pull it from a shared tree using :abbr:`IGMP (Internet -Group Management Protocol)`. - -Multicast receivers will talk IGMP to their local router, so, besides -having PIM configured in every router, IGMP must also be configured in -any router where there could be a multicast receiver locally connected. - -VyOS supports both IGMP version 2 and version 3 (which allows -source-specific multicast). - -************************ -PIM-SM - PIM Sparse Mode -************************ - -.. cfgcmd:: set protocols pim ecmp - - If PIM has the a choice of ECMP nexthops for a particular - :abbr:`RPF (Reverse Path Forwarding)`, PIM will cause S,G flows to be - spread out amongst the nexthops. If this command is not specified then - the first nexthop found will be used. - -.. cfgcmd:: set protocols pim ecmp rebalance - - If PIM is using ECMP and an interface goes down, cause PIM to rebalance all - S,G flows across the remaining nexthops. If this command is not configured - PIM only modifies those S,G flows that were using the interface that went - down. - -.. cfgcmd:: set protocols pim join-prune-interval - - Modify the join/prune interval that PIM uses to the new value. Time is - specified in seconds. - - The default time is 60 seconds. - - If you enter a value smaller than 60 seconds be aware that this can and - will affect convergence at scale. - -.. cfgcmd:: set protocols pim keep-alive-timer - - Modify the time out value for a S,G flow from 1-65535 seconds. If choosing - a value below 31 seconds be aware that some hardware platforms cannot see - data flowing in better than 30 second chunks. - -.. cfgcmd:: set protocols pim packets - - When processing packets from a neighbor process the number of packets - incoming at one time before moving on to the next task. - - The default value is 3 packets. - - This command is only useful at scale when you can possibly have a large - number of PIM control packets flowing. - -.. cfgcmd:: set protocols pim register-accept-list - - When PIM receives a register packet the source of the packet will be compared - to the prefix-list specified, and if a permit is received normal processing - continues. If a deny is returned for the source address of the register packet - a register stop message is sent to the source. - -.. cfgcmd:: set protocols pim register-suppress-time - - Modify the time that pim will register suppress a FHR will send register - notifications to the kernel. - -.. cfgcmd:: set protocols pim rp
group - - In order to use PIM, it is necessary to configure a :abbr:`RP (Rendezvous Point)` - for join messages to be sent to. Currently the only methodology to do this is - via static rendezvous point commands. - - All routers in the PIM network must agree on these values. - - The first ip address is the RP's address and the second value is the matching - prefix of group ranges covered. - -.. cfgcmd:: set protocols pim rp keep-alive-timer - - Modify the time out value for a S,G flow from 1-65535 seconds at - :abbr:`RP (Rendezvous Point)`. The normal keepalive period for the KAT(S,G) - defaults to 210 seconds. However, at the :abbr:`RP (Rendezvous Point)`, the - keepalive period must be at least the Register_Suppression_Time, or the RP - may time out the (S,G) state before the next Null-Register arrives. - Thus, the KAT(S,G) is set to max(Keepalive_Period, RP_Keepalive_Period) - when a Register-Stop is sent. - - If choosing a value below 31 seconds be aware that some hardware platforms - cannot see data flowing in better than 30 second chunks. - - See :rfc:`7761#section-4.1` for details. - -.. cfgcmd:: set protocols pim no-v6-secondary - - When sending PIM hello packets tell PIM to not send any v6 secondary - addresses on the interface. This information is used to allow PIM to use v6 - nexthops in it's decision for :abbr:`RPF (Reverse Path Forwarding)` lookup - if this option is not set (default). - -.. cfgcmd:: set protocols pim spt-switchover infinity-and-beyond [prefix-list ] - - On the last hop router if it is desired to not switch over to the SPT tree - configure this command. - - Optional parameter prefix-list can be use to control which groups to switch or - not switch. If a group is PERMIT as per the prefix-list, then the SPT switchover - does not happen for it and if it is DENY, then the SPT switchover happens. - -.. cfgcmd:: set protocols pim ssm prefix-list - - Specify a range of group addresses via a prefix-list that forces PIM to never - do :abbr:`SSM (Source-Specific Multicast)` over. - -Interface specific commands -=========================== - -.. cfgcmd:: set protocols pim interface bfd [profile ] - - Automatically create BFD session for each RIP peer discovered in this - interface. When the BFD session monitor signalize that the link is down - the RIP peer is removed and all the learned routes associated with that - peer are removed. - - If optional profile parameter is used, select a BFD profile for the BFD - sessions created via this interface. - -.. cfgcmd:: set protocols pim interface dr-priority - - Set the :abbr:`DR (Designated Router)` Priority for the interface. - This command is useful to allow the user to influence what node becomes - the DR for a LAN segment. - -.. cfgcmd:: set protocols pim interface hello - - Set the PIM hello and hold interval for a interface. - -.. cfgcmd:: set protocols pim interface no-bsm - - Tell PIM that we would not like to use this interface to process - bootstrap messages. - -.. cfgcmd:: set protocols pim interface no-unicast-bsm - - Tell PIM that we would not like to use this interface to process - unicast bootstrap messages. - -.. cfgcmd:: set protocols pim interface passive - - Disable sending and receiving PIM control packets on the interface. - - .. cfgcmd:: set protocols pim interface source-address - - If you have multiple addresses configured on a particular interface and would - like PIM to use a specific source address associated with that interface. - -****************************************** -IGMP - Internet Group Management Protocol) -****************************************** - -.. cfgcmd:: set protocols pim igmp watermark-warning - - Configure watermark warning generation for an IGMP group limit. Generates - warning once the configured group limit is reached while adding new groups. - -.. _pim:igmp_interface_commands: - -Interface specific commands -=========================== - -.. cfgcmd:: set protocols pim interface igmp - join source-address - - Use this command to allow the selected interface to join a multicast - group defining the multicast address you want to join and the source - IP address too. - -.. cfgcmd:: set protocols pim interface igmp - query-interval - - Use this command to configure in the selected interface the IGMP - host query interval (1-1800) in seconds that PIM will use. - -.. cfgcmd:: set protocols pim interface igmp - query-max-response-time - - Use this command to configure in the selected interface the IGMP - query response timeout value (10-250) in deciseconds. If a report is - not returned in the specified time, it will be assumed the (S,G) or - (\*,G) state :rfc:`7761#section-4.1` has timed out. - -.. cfgcmd:: set protocols pim interface igmp version - - Use this command to define in the selected interface whether you - choose IGMP version 2 or 3. - - The default value is 3. - -Example -------- - -In the following example we can see a basic multicast setup: - -.. image:: /_static/images/multicast-basic.png - :width: 90% - :align: center - :alt: Network Topology Diagram - - - -**Router 1** - -.. code-block:: none - - set interfaces ethernet eth2 address '172.16.0.2/24' - set interfaces ethernet eth1 address '100.64.0.1/24' - set protocols ospf area 0 network '172.16.0.0/24' - set protocols ospf area 0 network '100.64.0.0/24' - set protocols igmp interface eth1 - set protocols pim interface eth1 - set protocols pim interface eth2 - set protocols pim rp address 172.16.255.1 group '224.0.0.0/4' - -**Router 3** - -.. code-block:: none - - set interfaces dummy dum0 address '172.16.255.1/24' - set interfaces ethernet eth0 address '172.16.0.1/24' - set interfaces ethernet eth1 address '172.16.1.1/24' - set protocols ospf area 0 network '172.16.0.0/24' - set protocols ospf area 0 network '172.16.255.0/24' - set protocols ospf area 0 network '172.16.1.0/24' - set protocols pim interface dum0 - set protocols pim interface eth0 - set protocols pim interface eth1 - set protocols pim rp address 172.16.255.1 group '224.0.0.0/4' - -**Router 2** - -.. code-block:: none - - set interfaces ethernet eth1 address '10.0.0.1/24' - set interfaces ethernet eth2 address '172.16.1.2/24' - set protocols ospf area 0 network '10.0.0.0/24' - set protocols ospf area 0 network '172.16.1.0/24' - set protocols pim interface eth1 - set protocols pim interface eth2 - set protocols pim rp address 172.16.255.1 group '224.0.0.0/4' diff --git a/docs/configuration/protocols/pim6.md b/docs/configuration/protocols/pim6.md new file mode 100644 index 00000000..707ae606 --- /dev/null +++ b/docs/configuration/protocols/pim6.md @@ -0,0 +1,100 @@ +(pim6)= + +# PIM6 - Protocol Independent Multicast for IPv6 + +VyOS facilitates IPv6 Multicast by supporting **PIMv6** and **MLD**. + +PIMv6 (Protocol Independent Multicast for IPv6) must be configured in every +interface of every participating router. Every router must also have the +location of the Rendevouz Point manually configured. +Then, unidirectional shared trees rooted at the Rendevouz Point will +automatically be built for multicast distribution. + +Traffic from multicast sources will go to the Rendezvous Point, and receivers +will pull it from a shared tree using MLD (Multicast Listener Discovery). + +Multicast receivers will talk MLD to their local router, so, besides having +PIMv6 configured in every router, MLD must also be configured in any router +where there could be a multicast receiver locally connected. + +VyOS supports both MLD version 1 and version 2 +(which allows source-specific multicast). + +## Basic commands + +These are the commands for a basic setup. + +```{cfgcmd} set protocols pim6 interface \ + + Use this command to enable PIMv6 in the selected interface so that it + can communicate with PIMv6 neighbors. This command also enables MLD reports + and query on the interface unless {cfgcmd}`mld disable` is configured. +``` + + +```{cfgcmd} set protocols pim6 interface \ mld disable + +Disable MLD reports and query on the interface. +``` + + +## Tuning commands + +You can also tune multicast with the following commands. + +```{cfgcmd} set protocols pim6 interface \ mld interval \ + +Use this command to configure in the selected interface the MLD +host query interval (1-65535) in seconds that PIM will use. +The default value is 125 seconds. +``` + +```{cfgcmd} set protocols pim6 interface \ mld join \ + +Use this command to allow the selected interface to join a multicast group. +``` + +```{cfgcmd} set protocols pim6 interface \ mld join \ source \ + +Use this command to allow the selected interface to join a source-specific multicast +group. +``` + +```{cfgcmd} set protocols pim6 interface \ mld last-member-query-count \ + +Set the MLD last member query count. The default value is 2. +``` + +```{cfgcmd} set protocols pim6 interface \ mld last-member-query-interval \ + +Set the MLD last member query interval in milliseconds (100-6553500). The default value is 1000 milliseconds. +``` + +```{cfgcmd} set protocols pim6 interface \ mld max-response-time \ + +Set the MLD query response timeout in milliseconds (100-6553500). The default value is 10000 milliseconds. +``` + +```{cfgcmd} set protocols pim6 interface \ mld version \ + +Set the MLD version used on this interface. The default value is 2. +``` + + +### Configuration Example + +To enable MLD reports and query on interfaces `eth0` and `eth1`: + +```none +set protocols pim6 interface eth0 +set protocols pim6 interface eth1 +``` + +The following configuration explicitly joins multicast group `ff15::1234` on interface `eth1` +and source-specific multicast group `ff15::5678` with source address `2001:db8::1` on interface +`eth1`: + +```none +set protocols pim6 interface eth0 mld join ff15::1234 +set protocols pim6 interface eth1 mld join ff15::5678 source 2001:db8::1 +``` diff --git a/docs/configuration/protocols/pim6.rst b/docs/configuration/protocols/pim6.rst deleted file mode 100644 index 2b2276a7..00000000 --- a/docs/configuration/protocols/pim6.rst +++ /dev/null @@ -1,94 +0,0 @@ -.. _pim6: - -############################################## -PIM6 - Protocol Independent Multicast for IPv6 -############################################## - -VyOS facilitates IPv6 Multicast by supporting **PIMv6** and **MLD**. - -PIMv6 (Protocol Independent Multicast for IPv6) must be configured in every -interface of every participating router. Every router must also have the -location of the Rendevouz Point manually configured. -Then, unidirectional shared trees rooted at the Rendevouz Point will -automatically be built for multicast distribution. - -Traffic from multicast sources will go to the Rendezvous Point, and receivers -will pull it from a shared tree using MLD (Multicast Listener Discovery). - -Multicast receivers will talk MLD to their local router, so, besides having -PIMv6 configured in every router, MLD must also be configured in any router -where there could be a multicast receiver locally connected. - -VyOS supports both MLD version 1 and version 2 -(which allows source-specific multicast). - -Basic commands -============== -These are the commands for a basic setup. - -.. cfgcmd:: set protocols pim6 interface - - Use this command to enable PIMv6 in the selected interface so that it - can communicate with PIMv6 neighbors. This command also enables MLD reports - and query on the interface unless :cfgcmd:`mld disable` is configured. - -.. cfgcmd:: set protocols pim6 interface mld disable - - Disable MLD reports and query on the interface. - - -Tuning commands -=============== -You can also tune multicast with the following commands. - - -.. cfgcmd:: set protocols pim6 interface mld interval - - Use this command to configure in the selected interface the MLD - host query interval (1-65535) in seconds that PIM will use. - The default value is 125 seconds. - -.. cfgcmd:: set protocols pim6 interface mld join - - Use this command to allow the selected interface to join a multicast group. - -.. cfgcmd:: set protocols pim6 interface mld join source - - Use this command to allow the selected interface to join a source-specific multicast - group. - -.. cfgcmd:: set protocols pim6 interface mld last-member-query-count - - Set the MLD last member query count. The default value is 2. - -.. cfgcmd:: set protocols pim6 interface mld last-member-query-interval - - Set the MLD last member query interval in milliseconds (100-6553500). The default value is 1000 milliseconds. - -.. cfgcmd:: set protocols pim6 interface mld max-response-time - - Set the MLD query response timeout in milliseconds (100-6553500). The default value is 10000 milliseconds. - -.. cfgcmd:: set protocols pim6 interface mld version - - Set the MLD version used on this interface. The default value is 2. - -********************* -Configuration Example -********************* - -To enable MLD reports and query on interfaces `eth0` and `eth1`: - -.. code-block:: none - - set protocols pim6 interface eth0 - set protocols pim6 interface eth1 - -The following configuration explicitly joins multicast group `ff15::1234` on interface `eth1` -and source-specific multicast group `ff15::5678` with source address `2001:db8::1` on interface -`eth1`: - -.. code-block:: none - - set protocols pim6 interface eth0 mld join ff15::1234 - set protocols pim6 interface eth1 mld join ff15::5678 source 2001:db8::1 diff --git a/docs/configuration/protocols/rip.md b/docs/configuration/protocols/rip.md new file mode 100644 index 00000000..684337d6 --- /dev/null +++ b/docs/configuration/protocols/rip.md @@ -0,0 +1,294 @@ +--- +lastproofread: '2021-10-04' +--- + +(rip)= + +# RIP + +{abbr}`RIP (Routing Information Protocol)` is a widely deployed interior gateway +protocol. RIP was developed in the 1970s at Xerox Labs as part of the XNS +routing protocol. RIP is a distance-vector protocol and is based on the +Bellman-Ford algorithms. As a distance-vector protocol, RIP router send updates +to its neighbors periodically, thus allowing the convergence to a known +topology. In each update, the distance to any given network will be broadcast +to its neighboring router. + +Supported versions of RIP are: + +> - RIPv1 as described in {rfc}`1058` +> - RIPv2 as described in {rfc}`2453` + +## General Configuration + +```{cfgcmd} set protocols rip network \ + +This command enables RIP and sets the RIP enable interface by NETWORK. +The interfaces which have addresses matching with NETWORK are enabled. +``` + + +```{cfgcmd} set protocols rip interface \ + +This command specifies a RIP enabled interface by interface name. Both +the sending and receiving of RIP packets will be enabled on the port +specified in this command. +``` + + +```{cfgcmd} set protocols rip neighbor \ + +This command specifies a RIP neighbor. When a neighbor doesn’t understand +multicast, this command is used to specify neighbors. In some cases, not +all routers will be able to understand multicasting, where packets are +sent to a network or a group of addresses. In a situation where a neighbor +cannot process multicast packets, it is necessary to establish a direct +link between routers. +``` + + +```{cfgcmd} set protocols rip passive-interface interface \ + +This command sets the specified interface to passive mode. On passive mode +interface, all receiving packets are processed as normal and VyOS does not +send either multicast or unicast RIP packets except to RIP neighbors +specified with neighbor command. +``` + + +```{cfgcmd} set protocols rip passive-interface interface default + +This command specifies all interfaces to passive mode. +``` + +## Optional Configuration + +```{cfgcmd} set protocols rip default-distance \ + +This command change the distance value of RIP. The distance range is 1 to 255. + +> :::{note} +> Routes with a distance of 255 are effectively disabled and not +> installed into the kernel. +> ::: +``` + + +```{cfgcmd} set protocols rip network-distance \ distance \ + +This command sets default RIP distance to a specified value when the routes +source IP address matches the specified prefix. +``` + + +```{cfgcmd} set protocols rip network-distance \ access-list \ + +This command can be used with previous command to sets default RIP distance +to specified value when the route source IP address matches the specified +prefix and the specified access-list. +``` + + +```{cfgcmd} set protocols rip default-information originate + +This command generate a default route into the RIP. +``` + + +```{cfgcmd} set protocols rip distribute-list access-list \ \ + +This command can be used to filter the RIP path using access lists. +{cfgcmd}`in` and {cfgcmd}`out` this is the direction in which the access +lists are applied. +``` + + +```{cfgcmd} set protocols rip distribute-list interface \ access-list \ \ + +This command allows you apply access lists to a chosen interface to +filter the RIP path. +``` + + +```{cfgcmd} set protocols rip distribute-list prefix-list \ \ + +This command can be used to filter the RIP path using prefix lists. +{cfgcmd}`in` and {cfgcmd}`out` this is the direction in which the prefix +lists are applied. +``` + + +```{cfgcmd} set protocols rip distribute-list interface \ prefix-list \ \ + +This command allows you apply prefix lists to a chosen interface to +filter the RIP path. +``` + + +```{cfgcmd} set protocols rip route \ + +This command is specific to FRR and VyOS. The route command makes a static +route only inside RIP. This command should be used only by advanced users +who are particularly knowledgeable about the RIP protocol. In most cases, +we recommend creating a static route in VyOS and redistributing it in RIP +using {cfgcmd}`redistribute static`. +``` + + +```{cfgcmd} set protocols rip timers update \ + +This command specifies the update timer. Every update timer seconds, the +RIP process is awakened to send an unsolicited response message containing +the complete routing table to all neighboring RIP routers. The time range +is 5 to 2147483647. The default value is 30 seconds. +``` + + +```{cfgcmd} set protocols rip timers timeout \ + +This command specifies the timeout timer. Upon expiration of the timeout, +the route is no longer valid; however, it is retained in the routing table +for a short time so that neighbors can be notified that the route has been +dropped. The time range is 5 to 2147483647. The default value is 180 +seconds. +``` + + +```{cfgcmd} set protocols rip timers garbage-collection \ + +This command specifies the garbage-collection timer. Upon expiration of +the garbage-collection timer, the route is finally removed from the +routing table. The time range is 5 to 2147483647. The default value is 120 +seconds. +``` + +## Redistribution Configuration + +```{cfgcmd} set protocols rip redistribute \ + +This command redistributes routing information from the given route source +into the RIP tables. There are five modes available for route source: bgp, +connected, kernel, ospf, static. +``` + + +```{cfgcmd} set protocols rip redistribute \ metric \ + +This command specifies metric for redistributed routes from the given route +source. There are five modes available for route source: bgp, connected, +kernel, ospf, static. The metric range is 1 to 16. +``` + + +```{cfgcmd} set protocols rip redistribute \ route-map \ + +This command allows to use route map to filter redistributed routes from +the given route source. There are five modes available for route source: +bgp, connected, kernel, ospf, static. +``` + + +```{cfgcmd} set protocols rip default-metric \ + +This command modifies the default metric (hop count) value for redistributed +routes. The metric range is 1 to 16. The default value is 1. This command +does not affect connected route even if it is redistributed by +{cfgcmd}`redistribute connected`. To modify connected routes metric +value, please use {cfgcmd}`redistribute connected metric`. +``` + +## Interfaces Configuration + +```{cfgcmd} set interfaces \ \ ip rip authentication plaintext-password \ + +This command sets the interface with RIP simple password authentication. +This command also sets authentication string. The string must be shorter +than 16 characters. +``` + + +```{cfgcmd} set interfaces \ \ ip rip authentication md5 \ password \ + +This command sets the interface with RIP MD5 authentication. This command +also sets MD5 Key. The key must be shorter than 16 characters. +``` + + +```{cfgcmd} set interfaces \ \ ip rip split-horizon disable + +This command disables split-horizon on the interface. By default, VyOS does +not advertise RIP routes out the interface over which they were learned +(split horizon).3 +``` + + +```{cfgcmd} set interfaces \ \ ip rip split-horizon poison-reverse + +This command enables poison-reverse on the interface. If both poison reverse +and split horizon are enabled, then VyOS advertises the learned routes +as unreachable over the interface on which the route was learned. +``` + +## Operational Mode Commands + +```{opcmd} show ip rip + +This command displays RIP routes. +``` +```none +Codes: R - RIP, C - connected, S - Static, O - OSPF, B - BGP +Sub-codes: + (n) - normal, (s) - static, (d) - default, (r) - redistribute, + (i) - interface + + Network Next Hop Metric From Tag Time +C(i) 10.0.12.0/24 0.0.0.0 1 self 0 +C(i) 10.0.13.0/24 0.0.0.0 1 self 0 +R(n) 10.0.23.0/24 10.0.12.2 2 10.0.12.2 0 02:53 +``` + +```{opcmd} show ip rip status + +The command displays current RIP status. It includes RIP timer, filtering, +version, RIP enabled interface and RIP peer information. +``` +```none +Routing Protocol is "rip" + Sending updates every 30 seconds with +/-50%, next due in 11 seconds + Timeout after 180 seconds, garbage collect after 120 seconds + Outgoing update filter list for all interface is not set + Incoming update filter list for all interface is not set + Default redistribution metric is 1 + Redistributing: + Default version control: send version 2, receive any version + Interface Send Recv Key-chain + eth0 2 1 2 + eth2 2 1 2 + Routing for Networks: + 10.0.12.0/24 + eth0 + Routing Information Sources: + Gateway BadPackets BadRoutes Distance Last Update + 10.0.12.2 0 0 120 00:00:11 + Distance: (default is 120) +``` + +## Configuration Example + +Simple RIP configuration using 2 nodes and redistributing connected interfaces. + +**Node 1:** + +```none +set interfaces loopback address 10.1.1.1/32 +set protocols rip network 192.168.0.0/24 +set protocols rip redistribute connected +``` + +**Node 2:** + +```none +set interfaces loopback address 10.2.2.2/32 +set protocols rip network 192.168.0.0/24 +set protocols rip redistribute connected +``` diff --git a/docs/configuration/protocols/rip.rst b/docs/configuration/protocols/rip.rst deleted file mode 100644 index fd20a90c..00000000 --- a/docs/configuration/protocols/rip.rst +++ /dev/null @@ -1,257 +0,0 @@ -:lastproofread: 2021-10-04 - -.. _rip: - -### -RIP -### - -:abbr:`RIP (Routing Information Protocol)` is a widely deployed interior gateway -protocol. RIP was developed in the 1970s at Xerox Labs as part of the XNS -routing protocol. RIP is a distance-vector protocol and is based on the -Bellman-Ford algorithms. As a distance-vector protocol, RIP router send updates -to its neighbors periodically, thus allowing the convergence to a known -topology. In each update, the distance to any given network will be broadcast -to its neighboring router. - -Supported versions of RIP are: - - - RIPv1 as described in :rfc:`1058` - - RIPv2 as described in :rfc:`2453` - -General Configuration ---------------------- - -.. cfgcmd:: set protocols rip network - - This command enables RIP and sets the RIP enable interface by NETWORK. - The interfaces which have addresses matching with NETWORK are enabled. - -.. cfgcmd:: set protocols rip interface - - This command specifies a RIP enabled interface by interface name. Both - the sending and receiving of RIP packets will be enabled on the port - specified in this command. - -.. cfgcmd:: set protocols rip neighbor - - This command specifies a RIP neighbor. When a neighbor doesn’t understand - multicast, this command is used to specify neighbors. In some cases, not - all routers will be able to understand multicasting, where packets are - sent to a network or a group of addresses. In a situation where a neighbor - cannot process multicast packets, it is necessary to establish a direct - link between routers. - -.. cfgcmd:: set protocols rip passive-interface interface - - This command sets the specified interface to passive mode. On passive mode - interface, all receiving packets are processed as normal and VyOS does not - send either multicast or unicast RIP packets except to RIP neighbors - specified with neighbor command. - -.. cfgcmd:: set protocols rip passive-interface interface default - - This command specifies all interfaces to passive mode. - - -Optional Configuration ----------------------- - -.. cfgcmd:: set protocols rip default-distance - - This command change the distance value of RIP. The distance range is 1 to 255. - - .. note:: Routes with a distance of 255 are effectively disabled and not - installed into the kernel. - -.. cfgcmd:: set protocols rip network-distance distance - - This command sets default RIP distance to a specified value when the routes - source IP address matches the specified prefix. - -.. cfgcmd:: set protocols rip network-distance access-list - - This command can be used with previous command to sets default RIP distance - to specified value when the route source IP address matches the specified - prefix and the specified access-list. - -.. cfgcmd:: set protocols rip default-information originate - - This command generate a default route into the RIP. - -.. cfgcmd:: set protocols rip distribute-list access-list - - This command can be used to filter the RIP path using access lists. - :cfgcmd:`in` and :cfgcmd:`out` this is the direction in which the access - lists are applied. - -.. cfgcmd:: set protocols rip distribute-list interface access-list - - This command allows you apply access lists to a chosen interface to - filter the RIP path. - -.. cfgcmd:: set protocols rip distribute-list prefix-list - - This command can be used to filter the RIP path using prefix lists. - :cfgcmd:`in` and :cfgcmd:`out` this is the direction in which the prefix - lists are applied. - -.. cfgcmd:: set protocols rip distribute-list interface prefix-list - - This command allows you apply prefix lists to a chosen interface to - filter the RIP path. - -.. cfgcmd:: set protocols rip route - - This command is specific to FRR and VyOS. The route command makes a static - route only inside RIP. This command should be used only by advanced users - who are particularly knowledgeable about the RIP protocol. In most cases, - we recommend creating a static route in VyOS and redistributing it in RIP - using :cfgcmd:`redistribute static`. - -.. cfgcmd:: set protocols rip timers update - - This command specifies the update timer. Every update timer seconds, the - RIP process is awakened to send an unsolicited response message containing - the complete routing table to all neighboring RIP routers. The time range - is 5 to 2147483647. The default value is 30 seconds. - -.. cfgcmd:: set protocols rip timers timeout - - This command specifies the timeout timer. Upon expiration of the timeout, - the route is no longer valid; however, it is retained in the routing table - for a short time so that neighbors can be notified that the route has been - dropped. The time range is 5 to 2147483647. The default value is 180 - seconds. - -.. cfgcmd:: set protocols rip timers garbage-collection - - This command specifies the garbage-collection timer. Upon expiration of - the garbage-collection timer, the route is finally removed from the - routing table. The time range is 5 to 2147483647. The default value is 120 - seconds. - - -Redistribution Configuration ----------------------------- - -.. cfgcmd:: set protocols rip redistribute - - This command redistributes routing information from the given route source - into the RIP tables. There are five modes available for route source: bgp, - connected, kernel, ospf, static. - -.. cfgcmd:: set protocols rip redistribute metric - - This command specifies metric for redistributed routes from the given route - source. There are five modes available for route source: bgp, connected, - kernel, ospf, static. The metric range is 1 to 16. - -.. cfgcmd:: set protocols rip redistribute route-map - - This command allows to use route map to filter redistributed routes from - the given route source. There are five modes available for route source: - bgp, connected, kernel, ospf, static. - -.. cfgcmd:: set protocols rip default-metric - - This command modifies the default metric (hop count) value for redistributed - routes. The metric range is 1 to 16. The default value is 1. This command - does not affect connected route even if it is redistributed by - :cfgcmd:`redistribute connected`. To modify connected routes metric - value, please use :cfgcmd:`redistribute connected metric`. - - -Interfaces Configuration ------------------------- - -.. cfgcmd:: set interfaces ip rip authentication plaintext-password - - This command sets the interface with RIP simple password authentication. - This command also sets authentication string. The string must be shorter - than 16 characters. - -.. cfgcmd:: set interfaces ip rip authentication md5 password - - This command sets the interface with RIP MD5 authentication. This command - also sets MD5 Key. The key must be shorter than 16 characters. - -.. cfgcmd:: set interfaces ip rip split-horizon disable - - This command disables split-horizon on the interface. By default, VyOS does - not advertise RIP routes out the interface over which they were learned - (split horizon).3 - -.. cfgcmd:: set interfaces ip rip split-horizon poison-reverse - - This command enables poison-reverse on the interface. If both poison reverse - and split horizon are enabled, then VyOS advertises the learned routes - as unreachable over the interface on which the route was learned. - - -Operational Mode Commands -------------------------- - -.. opcmd:: show ip rip - - This command displays RIP routes. - -.. code-block:: none - - Codes: R - RIP, C - connected, S - Static, O - OSPF, B - BGP - Sub-codes: - (n) - normal, (s) - static, (d) - default, (r) - redistribute, - (i) - interface - - Network Next Hop Metric From Tag Time - C(i) 10.0.12.0/24 0.0.0.0 1 self 0 - C(i) 10.0.13.0/24 0.0.0.0 1 self 0 - R(n) 10.0.23.0/24 10.0.12.2 2 10.0.12.2 0 02:53 - -.. opcmd:: show ip rip status - - The command displays current RIP status. It includes RIP timer, filtering, - version, RIP enabled interface and RIP peer information. - -.. code-block:: none - - Routing Protocol is "rip" - Sending updates every 30 seconds with +/-50%, next due in 11 seconds - Timeout after 180 seconds, garbage collect after 120 seconds - Outgoing update filter list for all interface is not set - Incoming update filter list for all interface is not set - Default redistribution metric is 1 - Redistributing: - Default version control: send version 2, receive any version - Interface Send Recv Key-chain - eth0 2 1 2 - eth2 2 1 2 - Routing for Networks: - 10.0.12.0/24 - eth0 - Routing Information Sources: - Gateway BadPackets BadRoutes Distance Last Update - 10.0.12.2 0 0 120 00:00:11 - Distance: (default is 120) - - -Configuration Example ---------------------- - -Simple RIP configuration using 2 nodes and redistributing connected interfaces. - -**Node 1:** - -.. code-block:: none - - set interfaces loopback address 10.1.1.1/32 - set protocols rip network 192.168.0.0/24 - set protocols rip redistribute connected - -**Node 2:** - -.. code-block:: none - - set interfaces loopback address 10.2.2.2/32 - set protocols rip network 192.168.0.0/24 - set protocols rip redistribute connected diff --git a/docs/configuration/protocols/rpki.md b/docs/configuration/protocols/rpki.md new file mode 100644 index 00000000..1f4cf5bf --- /dev/null +++ b/docs/configuration/protocols/rpki.md @@ -0,0 +1,210 @@ +(rpki)= + +# RPKI + +:::{pull-quote} + +There are two types of Network Admins who deal with BGP, those who have +created an international incident and/or outage, and those who are lying + +-- [tweet by EvilMog](https://twitter.com/Evil_Mog/status/1230924170508169216), 2020-02-21 +::: + +{abbr}`RPKI (Resource Public Key Infrastructure)` is a framework designed to +secure the Internet routing infrastructure. It associates BGP route +announcements with the correct originating {abbr}`ASN (Autonomus System +Number)` which BGP routers can then use to check each route against the +corresponding {abbr}`ROA (Route Origin Authorisation)` for validity. RPKI is +described in {rfc}`6480`. + +A BGP-speaking router like VyOS can retrieve ROA information from RPKI +"Relying Party software" (often just called an "RPKI server" or "RPKI +validator") by using {abbr}`RTR (RPKI to Router)` protocol. There are several +open source implementations to choose from, such as NLNetLabs' [Routinator] +(written in Rust), OpenBSD's [rpki-client] (written in C), and [StayRTR] (written +in Go). The RTR protocol is described in {rfc}`8210`. + +:::{tip} +If you are new to these routing security technologies then there is an +[excellent guide to RPKI] by NLnet Labs which will get you up to speed +very quickly. Their documentation explains everything from what RPKI is to +deploying it in production. It also has some +[help and operational guidance] including "What can I do about my route +having an Invalid state?" +::: + +## Getting started + +First you will need to deploy an RPKI validator for your routers to use. NLnet +Labs provides a collection of [software] you can compare and settle on one. +Once your server is running you can start validating announcements. + +Imported prefixes during the validation may have values: + +> valid +> +> : The prefix and ASN that originated it match a signed ROA. These are +> probably trustworthy route announcements. +> +> invalid +> +> : The prefix or prefix length and ASN that originated it doesn't +> match any existing ROA. This could be the result of a prefix hijack, or +> merely a misconfiguration, but should probably be treated as +> untrustworthy route announcements. +> +> notfound +> +> : No ROA exists which covers that prefix. Unfortunately this is the case for +> about 40%-50% of the prefixes which were announced to the {abbr}`DFZ +> (default-free zone)` at the start of 2024. + +:::{note} +If you are responsible for the global addresses assigned to your +network, please make sure that your prefixes have ROAs associated with them +to avoid being `notfound` by RPKI. For most ASNs this will involve +publishing ROAs via your {abbr}`RIR (Regional Internet Registry)` (RIPE +NCC, APNIC, ARIN, LACNIC, or AFRINIC), and is something you are encouraged +to do whenever you plan to announce addresses into the DFZ. + +Particularly large networks may wish to run their own RPKI certificate +authority and publication server instead of publishing ROAs via their RIR. +This is a subject far beyond the scope of VyOS' documentation. Consider +reading about [Krill] if this is a rabbit hole you need or especially want +to dive down. +::: + +### Features of the Current Implementation + +In a nutshell, the current implementation provides the following features: + +- The BGP router can connect to one or more RPKI cache servers to receive + validated prefix to origin AS mappings. Advanced failover can be implemented + by server sockets with different preference values. +- If no connection to an RPKI cache server can be established after a + pre-defined timeout, the router will process routes without prefix origin + validation. It still will try to establish a connection to an RPKI cache + server in the background. +- By default, enabling RPKI does not change best path selection. In particular, + invalid prefixes will still be considered during best path selection. However, + the router can be configured to ignore all invalid prefixes. +- Route maps can be configured to match a specific RPKI validation state. This + allows the creation of local policies, which handle BGP routes based on the + outcome of the Prefix Origin Validation. +- Updates from the RPKI cache servers are directly applied and path selection is + updated accordingly. (Soft reconfiguration must be enabled for this to work). + +## Configuration + +```{cfgcmd} set protocols rpki polling-period \<1-86400\> + +Define the time interval to update the local cache + +The default value is 300 seconds. +``` + +```{cfgcmd} set protocols rpki expire-interval \<600-172800\> + +Set the number of seconds the router waits until the router +expires the cache. + +The default value is 7200 seconds. +``` + +```{cfgcmd} set protocols rpki retry-interval \<1-7200\> + +Set the number of seconds the router waits until retrying to connect +to the cache server. + +The default value is 600 seconds. +``` + +```{cfgcmd} set protocols rpki cache \ port \ + +Defined the IPv4, IPv6 or FQDN and port number of the caching RPKI caching +instance which is used. + +This is a mandatory setting. +``` + +```{cfgcmd} set protocols rpki cache \ preference \ + +Multiple RPKI caching instances can be supplied and they need a preference in +which their result sets are used. + +This is a mandatory setting. +``` + + +### SSH + +Connections to the RPKI caching server can not only be established by TCP using +the RTR protocol but you can also rely on a secure SSH session to the server. +This provides transport integrity and confidentiality and it is a good idea if +your validation software supports it. To enable SSH, first you need to create +an SSH client keypair using `generate ssh client-key +/config/auth/id_rsa_rpki`. Once your key is created you can setup the +connection. + +```{cfgcmd} set protocols rpki cache \ ssh username \ + +SSH username to establish an SSH connection to the cache server. +``` + +```{cfgcmd} set protocols rpki cache \ ssh private-key-file \ + +Local path that includes the private key file of the router. +``` + +```{cfgcmd} set protocols rpki cache \ ssh public-key-file \ + +Local path that includes the public key file of the router. +``` + +:::{note} +When using SSH, private-key-file and public-key-file +are mandatory options. +::: + +## Example + +We can build route-maps for import based on these states. Here is a simple +RPKI configuration, where `routinator` is the RPKI-validating "cache" +server with ip `192.0.2.1`: + +```none +set protocols rpki cache 192.0.2.1 port '3323' +set protocols rpki cache 192.0.2.1 preference '1' +``` + +Here is an example route-map to apply to routes learned at import. In this +filter we reject prefixes with the state `invalid`, and set a higher +`local-preference` if the prefix is RPKI `valid` rather than merely +`notfound`. + +```none +set policy route-map ROUTES-IN rule 10 action 'permit' +set policy route-map ROUTES-IN rule 10 match rpki 'valid' +set policy route-map ROUTES-IN rule 10 set local-preference '300' +set policy route-map ROUTES-IN rule 20 action 'permit' +set policy route-map ROUTES-IN rule 20 match rpki 'notfound' +set policy route-map ROUTES-IN rule 20 set local-preference '125' +set policy route-map ROUTES-IN rule 30 action 'deny' +set policy route-map ROUTES-IN rule 30 match rpki 'invalid' +``` + +Once your routers are configured to reject RPKI-invalid prefixes, you can +test whether the configuration is working correctly using Cloudflare's [test] +website. Keep in mind that in order for this to work, you need to have no +default routes or anything else that would still send traffic to RPKI-invalid +destinations. + +[excellent guide to rpki]: https://rpki.readthedocs.io/ +[help and operational guidance]: https://rpki.readthedocs.io/en/latest/about/help.html +[krill]: https://www.nlnetlabs.nl/projects/rpki/krill/ +[routinator]: https://www.nlnetlabs.nl/projects/rpki/routinator/ +[rpki-client]: https://www.rpki-client.org/ +[software]: https://rpki.readthedocs.io/en/latest/ops/tools.html#relying-party-software +[stayrtr]: https://github.com/bgp/stayrtr/ +[test]: https://isbgpsafeyet.com/ +[tweet by evilmog]: diff --git a/docs/configuration/protocols/rpki.rst b/docs/configuration/protocols/rpki.rst deleted file mode 100644 index 17557884..00000000 --- a/docs/configuration/protocols/rpki.rst +++ /dev/null @@ -1,211 +0,0 @@ -.. _rpki: - -#### -RPKI -#### - -.. pull-quote:: - - There are two types of Network Admins who deal with BGP, those who have - created an international incident and/or outage, and those who are lying - - -- `tweet by EvilMog`_, 2020-02-21 - -:abbr:`RPKI (Resource Public Key Infrastructure)` is a framework designed to -secure the Internet routing infrastructure. It associates BGP route -announcements with the correct originating :abbr:`ASN (Autonomus System -Number)` which BGP routers can then use to check each route against the -corresponding :abbr:`ROA (Route Origin Authorisation)` for validity. RPKI is -described in :rfc:`6480`. - -A BGP-speaking router like VyOS can retrieve ROA information from RPKI -"Relying Party software" (often just called an "RPKI server" or "RPKI -validator") by using :abbr:`RTR (RPKI to Router)` protocol. There are several -open source implementations to choose from, such as NLNetLabs' Routinator_ -(written in Rust), OpenBSD's rpki-client_ (written in C), and StayRTR_ (written -in Go). The RTR protocol is described in :rfc:`8210`. - -.. tip:: - If you are new to these routing security technologies then there is an - `excellent guide to RPKI`_ by NLnet Labs which will get you up to speed - very quickly. Their documentation explains everything from what RPKI is to - deploying it in production. It also has some - `help and operational guidance`_ including "What can I do about my route - having an Invalid state?" - -*************** -Getting started -*************** - -First you will need to deploy an RPKI validator for your routers to use. NLnet -Labs provides a collection of software_ you can compare and settle on one. -Once your server is running you can start validating announcements. - -Imported prefixes during the validation may have values: - - valid - The prefix and ASN that originated it match a signed ROA. These are - probably trustworthy route announcements. - - invalid - The prefix or prefix length and ASN that originated it doesn't - match any existing ROA. This could be the result of a prefix hijack, or - merely a misconfiguration, but should probably be treated as - untrustworthy route announcements. - - notfound - No ROA exists which covers that prefix. Unfortunately this is the case for - about 40%-50% of the prefixes which were announced to the :abbr:`DFZ - (default-free zone)` at the start of 2024. - -.. note:: - If you are responsible for the global addresses assigned to your - network, please make sure that your prefixes have ROAs associated with them - to avoid being `notfound` by RPKI. For most ASNs this will involve - publishing ROAs via your :abbr:`RIR (Regional Internet Registry)` (RIPE - NCC, APNIC, ARIN, LACNIC, or AFRINIC), and is something you are encouraged - to do whenever you plan to announce addresses into the DFZ. - - Particularly large networks may wish to run their own RPKI certificate - authority and publication server instead of publishing ROAs via their RIR. - This is a subject far beyond the scope of VyOS' documentation. Consider - reading about Krill_ if this is a rabbit hole you need or especially want - to dive down. - -Features of the Current Implementation -====================================== - -In a nutshell, the current implementation provides the following features: - -* The BGP router can connect to one or more RPKI cache servers to receive - validated prefix to origin AS mappings. Advanced failover can be implemented - by server sockets with different preference values. - -* If no connection to an RPKI cache server can be established after a - pre-defined timeout, the router will process routes without prefix origin - validation. It still will try to establish a connection to an RPKI cache - server in the background. - -* By default, enabling RPKI does not change best path selection. In particular, - invalid prefixes will still be considered during best path selection. However, - the router can be configured to ignore all invalid prefixes. - -* Route maps can be configured to match a specific RPKI validation state. This - allows the creation of local policies, which handle BGP routes based on the - outcome of the Prefix Origin Validation. - -* Updates from the RPKI cache servers are directly applied and path selection is - updated accordingly. (Soft reconfiguration must be enabled for this to work). - -************* -Configuration -************* - -.. cfgcmd:: set protocols rpki polling-period <1-86400> - - Define the time interval to update the local cache - - The default value is 300 seconds. - -.. cfgcmd:: set protocols rpki expire-interval <600-172800> - - Set the number of seconds the router waits until the router - expires the cache. - - The default value is 7200 seconds. - -.. cfgcmd:: set protocols rpki retry-interval <1-7200> - - Set the number of seconds the router waits until retrying to connect - to the cache server. - - The default value is 600 seconds. - -.. cfgcmd:: set protocols rpki cache
port - - Defined the IPv4, IPv6 or FQDN and port number of the caching RPKI caching - instance which is used. - - This is a mandatory setting. - -.. cfgcmd:: set protocols rpki cache
preference - - Multiple RPKI caching instances can be supplied and they need a preference in - which their result sets are used. - - This is a mandatory setting. - -SSH -=== - -Connections to the RPKI caching server can not only be established by TCP using -the RTR protocol but you can also rely on a secure SSH session to the server. -This provides transport integrity and confidentiality and it is a good idea if -your validation software supports it. To enable SSH, first you need to create -an SSH client keypair using ``generate ssh client-key -/config/auth/id_rsa_rpki``. Once your key is created you can setup the -connection. - -.. cfgcmd:: set protocols rpki cache
ssh username - - SSH username to establish an SSH connection to the cache server. - -.. cfgcmd:: set protocols rpki cache
ssh private-key-file - - Local path that includes the private key file of the router. - -.. cfgcmd:: set protocols rpki cache
ssh public-key-file - - Local path that includes the public key file of the router. - -.. note:: When using SSH, private-key-file and public-key-file - are mandatory options. - -******* -Example -******* - -We can build route-maps for import based on these states. Here is a simple -RPKI configuration, where `routinator` is the RPKI-validating "cache" -server with ip `192.0.2.1`: - -.. code-block:: none - - set protocols rpki cache 192.0.2.1 port '3323' - set protocols rpki cache 192.0.2.1 preference '1' - -Here is an example route-map to apply to routes learned at import. In this -filter we reject prefixes with the state `invalid`, and set a higher -`local-preference` if the prefix is RPKI `valid` rather than merely -`notfound`. - -.. code-block:: none - - set policy route-map ROUTES-IN rule 10 action 'permit' - set policy route-map ROUTES-IN rule 10 match rpki 'valid' - set policy route-map ROUTES-IN rule 10 set local-preference '300' - set policy route-map ROUTES-IN rule 20 action 'permit' - set policy route-map ROUTES-IN rule 20 match rpki 'notfound' - set policy route-map ROUTES-IN rule 20 set local-preference '125' - set policy route-map ROUTES-IN rule 30 action 'deny' - set policy route-map ROUTES-IN rule 30 match rpki 'invalid' - -Once your routers are configured to reject RPKI-invalid prefixes, you can -test whether the configuration is working correctly using Cloudflare's test_ -website. Keep in mind that in order for this to work, you need to have no -default routes or anything else that would still send traffic to RPKI-invalid -destinations. - -.. stop_vyoslinter - -.. _tweet by EvilMog: https://twitter.com/Evil_Mog/status/1230924170508169216 -.. _Routinator: https://www.nlnetlabs.nl/projects/rpki/routinator/ -.. _Krill: https://www.nlnetlabs.nl/projects/rpki/krill/ -.. _excellent guide to RPKI: https://rpki.readthedocs.io/ -.. _help and operational guidance: https://rpki.readthedocs.io/en/latest/about/help.html -.. _rpki-client: https://www.rpki-client.org/ -.. _StayRTR: https://github.com/bgp/stayrtr/ -.. _software: https://rpki.readthedocs.io/en/latest/ops/tools.html#relying-party-software -.. _test: https://isbgpsafeyet.com/ - -.. start_vyoslinter diff --git a/docs/configuration/protocols/rst-babel.rst b/docs/configuration/protocols/rst-babel.rst new file mode 100644 index 00000000..07d1bc86 --- /dev/null +++ b/docs/configuration/protocols/rst-babel.rst @@ -0,0 +1,210 @@ +.. _babel: + +##### +Babel +##### + +Babel is a modern routing protocol designed to be robust and efficient +both in ordinary wired networks and in wireless mesh networks. +By default, it uses hop-count on wired networks and a variant of ETX +on wireless links, It can be configured to take radio diversity into account +and to automatically compute a link's latency and include it in the metric. +It is defined in :rfc:`8966`. + +Babel a dual stack protocol. +A single Babel instance is able to perform routing for both IPv4 and IPv6. + +General Configuration +--------------------- + +VyOS does not have a special command to start the Babel process. +The Babel process starts when the first Babel enabled interface is configured. + +.. cfgcmd:: set protocols babel interface + + This command specifies a Babel enabled interface by interface name. Both + the sending and receiving of Babel packets will be enabled on the interface + specified in this command. + +Optional Configuration +---------------------- + +.. cfgcmd:: set protocols babel parameters diversity + + This command enables routing using radio frequency diversity. + This is highly recommended in networks with many wireless nodes. + + .. note:: If you enable this, you will probably want to + set diversity-factor and channel below. + +.. cfgcmd:: set protocols babel parameters diversity-factor <1-256> + + This command sets the multiplicative factor used for diversity routing, + in units of 1/256; lower values cause diversity to play a more important role + in route selection. + The default it 256, which means that diversity plays no role in route + selection; you will probably want to set that to 128 or less on nodes + with multiple independent radios. + +.. cfgcmd:: set protocols babel parameters resend-delay + + This command specifies the time in milliseconds after which an 'important' + request or update will be resent. The default is 2000 ms. + +.. cfgcmd:: set protocols babel parameters smoothing-half-life + + This command specifies the time constant, in seconds, of the smoothing + algorithm used for implementing hysteresis. + Larger values reduce route oscillation at the cost of very slightly increasing + convergence time. The value 0 disables hysteresis, and is suitable for wired + networks. The default is 4 s. + +Interfaces Configuration +------------------------ + +.. cfgcmd:: set protocols babel interface type + + This command sets the interface type: + + **auto** – automatically determines the interface type. + **wired** – enables optimisations for wired interfaces. + **wireless** – disables a number of optimisations that are only correct + on wired interfaces. Specifying wireless is always correct, + but may cause slower convergence and extra routing traffic. + +.. cfgcmd:: set protocols babel interface split-horizon + + This command specifies whether to perform split-horizon on the interface. + Specifying no babel split-horizon is always correct, while babel split-horizon + is an optimisation that should only be used on symmetric + and transitive (wired) networks. + + **default** – enable split-horizon on wired interfaces, and disable + split-horizon on wireless interfaces. + **enable** – enable split-horizon on this interfaces. + **disable** – disable split-horizon on this interfaces. + +.. cfgcmd:: set protocols babel interface hello-interval + + This command specifies the time in milliseconds between two scheduled hellos. + On wired links, Babel notices a link failure within two hello intervals; + on wireless links, the link quality value is reestimated at every hello + interval. + The default is 4000 ms. + +.. cfgcmd:: set protocols babel interface update-interval + + This command specifies the time in milliseconds between two scheduled updates. + Since Babel makes extensive use of triggered updates, + this can be set to fairly high values on links with little packet loss. + The default is 20000 ms. + +.. cfgcmd:: set protocols babel interface rxcost <1-65534> + + This command specifies the base receive cost for this interface. + For wireless interfaces, it specifies the multiplier used for computing + the ETX reception cost (default 256); + for wired interfaces, it specifies the cost that will be advertised to + neighbours. + +.. cfgcmd:: set protocols babel interface rtt-decay <1-256> + + This command specifies the decay factor for the exponential moving average + of RTT samples, in units of 1/256. + Higher values discard old samples faster. The default is 42. + +.. cfgcmd:: set protocols babel interface rtt-min + + This command specifies the minimum RTT, in milliseconds, + starting from which we increase the cost to a neighbour. + The additional cost is linear in (rtt - rtt-min). The default is 10 ms. + +.. cfgcmd:: set protocols babel interface rtt-max + + This command specifies the maximum RTT, in milliseconds, above which + we don't increase the cost to a neighbour. The default is 120 ms. + + +.. cfgcmd:: set protocols babel interface max-rtt-penalty + + This command specifies the maximum cost added to a neighbour because of RTT, + i.e. when the RTT is higher or equal than rtt-max. + The default is 150. + Setting it to 0 effectively disables the use of a RTT-based cost. + +.. cfgcmd:: set protocols babel interface enable-timestamps + + This command enables sending timestamps with each Hello and IHU message + in order to compute RTT values. + It is recommended to enable timestamps on tunnel interfaces. + +.. cfgcmd:: set protocols babel interface channel <1-254|interfering|noninterfering> + + This command set the channel number that diversity routing uses for this + interface (see diversity option above). + + **1-254** – interfaces with a channel number interfere with + interfering interfaces and interfaces with the same channel number. + **interfering** – interfering interfaces are assumed to interfere with all other channels except + noninterfering channels. + **noninterfering** – noninterfering interfaces are assumed to only interfere + with themselves. + +Redistribution Configuration +---------------------------- + +.. cfgcmd:: set protocols babel redistribute + + This command redistributes routing information from the given route source + to the Babel process. + + IPv4 route source: bgp, connected, eigrp, isis, kernel, nhrp, ospf, rip, static. + + IPv6 route source: bgp, connected, eigrp, isis, kernel, nhrp, ospfv3, ripng, static. + +.. cfgcmd:: set protocols babel distribute-list access-list + + This command can be used to filter the Babel routes using access lists. + :cfgcmd:`in` and :cfgcmd:`out` this is the direction in which the access + lists are applied. + +.. cfgcmd:: set protocols babel distribute-list interface access-list + + This command allows you apply access lists to a chosen interface to + filter the Babel routes. + +.. cfgcmd:: set protocols babel distribute-list prefix-list + + This command can be used to filter the Babel routes using prefix lists. + :cfgcmd:`in` and :cfgcmd:`out` this is the direction in which the prefix + lists are applied. + +.. cfgcmd:: set protocols babel distribute-list interface prefix-list + + This command allows you apply prefix lists to a chosen interface to + filter the Babel routes. + +Configuration Example +--------------------- + +Simple Babel configuration using 2 nodes and redistributing connected interfaces. + +**Node 1:** + +.. code-block:: none + + set interfaces loopback lo address 10.1.1.1/32 + set interfaces loopback lo address fd12:3456:dead:beef::1/128 + set protocols babel interface eth0 type wired + set protocols babel redistribute ipv4 connected + set protocols babel redistribute ipv6 connected + +**Node 2:** + +.. code-block:: none + + set interfaces loopback lo address 10.2.2.2/32 + set interfaces loopback lo address fd12:3456:beef:dead::2/128 + set protocols babel interface eth0 type wired + set protocols babel redistribute ipv4 connected + set protocols babel redistribute ipv6 connected diff --git a/docs/configuration/protocols/rst-bfd.rst b/docs/configuration/protocols/rst-bfd.rst new file mode 100644 index 00000000..30876efc --- /dev/null +++ b/docs/configuration/protocols/rst-bfd.rst @@ -0,0 +1,199 @@ +:lastproofread: 2023-01-27 + +.. include:: /_include/need_improvement.txt + +.. _routing-bfd: + +### +BFD +### + +:abbr:`BFD (Bidirectional Forwarding Detection)` is described and extended by +the following RFCs: :rfc:`5880`, :rfc:`5881` and :rfc:`5883`. + +In the age of very fast networks, a second of unreachability may equal millions of lost packets. +The idea behind BFD is to detect very quickly when a peer is down and take action extremely fast. + +BFD sends lots of small UDP packets very quickly to ensures that the peer is still alive. + +This allows avoiding the timers defined in BGP and OSPF protocol to expires. + +Configure BFD +============= + +.. cfgcmd:: set protocols bfd peer
+ + Set BFD peer IPv4 address or IPv6 address + +.. cfgcmd:: set protocols bfd peer
echo-mode + + Enables the echo transmission mode + +.. cfgcmd:: set protocols bfd peer
multihop + + Allow this BFD peer to not be directly connected + +.. cfgcmd:: set protocols bfd peer
source + [address
| interface ] + + Bind listener to specific interface/address, mandatory for IPv6 + +.. cfgcmd:: set protocols bfd peer
interval echo-interval <10-60000> + + The minimal echo receive transmission interval that this system is + capable of handling + +.. cfgcmd:: set protocols bfd peer
interval multiplier <2-255> + + Remote transmission interval will be multiplied by this value + +.. cfgcmd:: set protocols bfd peer
interval + [receive | transmit] <10-60000> + + Interval in milliseconds + +.. cfgcmd:: set protocols bfd peer
shutdown + + Disable a BFD peer + +.. cfgcmd:: set protocols bfd peer
minimum-ttl <1-254> + + For multi hop sessions only. Configure the minimum expected TTL for an + incoming BFD control packet. + + This feature serves the purpose of thightening the packet validation + requirements to avoid receiving BFD control packets from other sessions. + +Enable BFD in BGP +----------------- + +.. cfgcmd:: set protocols bgp neighbor bfd + + Enable BFD on a single BGP neighbor + +.. cfgcmd:: set protocols bgp peer-group bfd + + Enable BFD on a BGP peer group + + +Enable BFD in OSPF +------------------ + +.. cfgcmd:: set protocols ospf interface bfd + + Enable BFD for OSPF on an interface + +.. cfgcmd:: set protocols ospfv3 interface bfd + + Enable BFD for OSPFv3 on an interface + + +Enable BFD in ISIS +------------------ + +.. cfgcmd:: set protocols isis interface bfd + + Enable BFD for ISIS on an interface + + + +Operational Commands +==================== + +.. opcmd:: show bfd peers + + Show all BFD peers + + .. code-block:: none + + BFD Peers: + peer 198.51.100.33 vrf default interface eth4.100 + ID: 4182341893 + Remote ID: 12678929647 + Status: up + Uptime: 1 month(s), 16 hour(s), 29 minute(s), 38 second(s) + Diagnostics: ok + Remote diagnostics: ok + Local timers: + Receive interval: 300ms + Transmission interval: 300ms + Echo transmission interval: 50ms + Remote timers: + Receive interval: 300ms + Transmission interval: 300ms + Echo transmission interval: 0ms + + peer 198.51.100.55 vrf default interface eth4.101 + ID: 4618932327 + Remote ID: 3312345688 + Status: up + Uptime: 20 hour(s), 16 minute(s), 19 second(s) + Diagnostics: ok + Remote diagnostics: ok + Local timers: + Receive interval: 300ms + Transmission interval: 300ms + Echo transmission interval: 50ms + Remote timers: + Receive interval: 300ms + Transmission interval: 300ms + Echo transmission interval: 0ms + +BFD Static Route Monitoring +=========================== + +A monitored static route conditions the installation to the RIB on the BFD +session running state: when BFD session is up the route is installed to RIB, +but when the BFD session is down it is removed from the RIB. + +Configuration +------------- + +.. cfgcmd:: set protocols static route next-hop
+ bfd profile + + Configure a static route for using gateway
+ and use the gateway address as BFD peer destination address. + +.. cfgcmd:: set protocols static route next-hop
+ bfd multi-hop source
profile + + Configure a static route for using gateway
+ , use source address to indentify the peer when is multi-hop session + and the gateway address as BFD peer destination address. + +.. cfgcmd:: set protocols static route6 next-hop
+ bfd profile + + Configure a static route for using gateway
+ and use the gateway address as BFD peer destination address. + +.. cfgcmd:: set protocols static route6 next-hop
+ bfd multi-hop source
profile + + Configure a static route for using gateway
+ , use source address to indentify the peer when is multi-hop session + and the gateway address as BFD peer destination address. + + +.. _BFD Operational Commands: + +Operational Commands +==================== + +.. opcmd:: show bfd static routes + + Showing BFD monitored static routes + + .. code-block:: none + + Showing BFD monitored static routes: + + Next hops: + VRF default IPv4 Unicast: + 10.10.13.3/32 peer 192.168.2.3 (status: installed) + 172.16.10.3/32 peer 192.168.10.1 (status: uninstalled) + + VRF default IPv4 Multicast: + + VRF default IPv6 Unicast: diff --git a/docs/configuration/protocols/rst-bgp.rst b/docs/configuration/protocols/rst-bgp.rst new file mode 100644 index 00000000..6d93bcc4 --- /dev/null +++ b/docs/configuration/protocols/rst-bgp.rst @@ -0,0 +1,1274 @@ +.. _routing-bgp: + +### +BGP +### + +:abbr:`BGP (Border Gateway Protocol)` is one of the Exterior Gateway Protocols +and the de facto standard interdomain routing protocol. The latest BGP version +is 4. BGP-4 is described in :rfc:`1771` and updated by :rfc:`4271`. :rfc:`2858` +adds multiprotocol support to BGP. + +VyOS makes use of :abbr:`FRR (Free Range Routing)` and we would like to thank +them for their effort! + +************** +Basic Concepts +************** + +.. _bgp-autonomous-systems: + +Autonomous Systems +================== + +From :rfc:`1930`: + + An AS is a connected group of one or more IP prefixes run by one or more + network operators which has a SINGLE and CLEARLY DEFINED routing policy. + +Each :abbr:`AS (Autonomous System)` has an identifying number associated with it +called an :abbr:`ASN (Autonomous System Number)`. This is a two octet value +ranging in value from 1 to 65535. The AS numbers 64512 through 65535 are defined +as private AS numbers. Private AS numbers must not be advertised on the global +Internet. The 2-byte AS number range has been exhausted. 4-byte AS numbers are +specified in :rfc:`6793`, and provide a pool of 4294967296 AS numbers. + +The :abbr:`ASN (Autonomous System Number)` is one of the essential elements of +BGP. BGP is a distance vector routing protocol, and the AS-Path framework +provides distance vector metric and loop detection to BGP. + +.. cfgcmd:: set protocols bgp system-as + + Set local :abbr:`ASN (Autonomous System Number)` that this router represents. + This is a a mandatory option! + +.. _bgp-address-families: + +Address Families +================ + +Multiprotocol extensions enable BGP to carry routing information for multiple +network layer protocols. BGP supports an Address Family Identifier (AFI) for +IPv4 and IPv6. + +.. _bgp-route-selection: + +Route Selection +=============== + +The route selection process used by FRR's BGP implementation uses the following +decision criterion, starting at the top of the list and going towards the +bottom until one of the factors can be used. + +1. **Weight check** + + Prefer higher local weight routes to lower routes. + +2. **Local preference check** + + Prefer higher local preference routes to lower. + +3. **Local route check** + + Prefer local routes (statics, aggregates, redistributed) to received routes. + +4. **AS path length check** + + Prefer shortest hop-count AS_PATHs. + +5. **Origin check** + + Prefer the lowest origin type route. That is, prefer IGP origin routes to + EGP, to Incomplete routes. + +6. **MED check** + + Where routes with a MED were received from the same AS, prefer the route + with the lowest MED. + +7. **External check** + + Prefer the route received from an external, eBGP peer over routes received + from other types of peers. + +8. **IGP cost check** + + Prefer the route with the lower IGP cost. + +9. **Multi-path check** + + If multi-pathing is enabled, then check whether the routes not yet + distinguished in preference may be considered equal. If + :cfgcmd:`bgp bestpath as-path multipath-relax` is set, all such routes are + considered equal, otherwise routes received via iBGP with identical AS_PATHs + or routes received from eBGP neighbours in the same AS are considered equal. + +10. **Already-selected external check** + + Where both routes were received from eBGP peers, then prefer the route + which is already selected. Note that this check is not applied if + :cfgcmd:`bgp bestpath compare-routerid` is configured. This check can + prevent some cases of oscillation. + +11. **Router-ID check** + + Prefer the route with the lowest `router-ID`. If the route has an + `ORIGINATOR_ID` attribute, through iBGP reflection, then that router ID is + used, otherwise the `router-ID` of the peer the route was received from is + used. + +12. **Cluster-List length check** + + The route with the shortest cluster-list length is used. The cluster-list + reflects the iBGP reflection path the route has taken. + +13. **Peer address** + + Prefer the route received from the peer with the higher transport layer + address, as a last-resort tie-breaker. + +.. _bgp-capability-negotiation: + +Capability Negotiation +====================== + +When adding IPv6 routing information exchange feature to BGP. There were some +proposals. :abbr:`IETF (Internet Engineering Task Force)` +:abbr:`IDR (Inter Domain Routing)` adopted a proposal called Multiprotocol +Extension for BGP. The specification is described in :rfc:`2283`. The protocol +does not define new protocols. It defines new attributes to existing BGP. When +it is used exchanging IPv6 routing information it is called BGP-4+. When it is +used for exchanging multicast routing information it is called MBGP. + +*bgpd* supports Multiprotocol Extension for BGP. So if a remote peer supports +the protocol, *bgpd* can exchange IPv6 and/or multicast routing information. + +Traditional BGP did not have the feature to detect a remote peer's +capabilities, e.g. whether it can handle prefix types other than IPv4 unicast +routes. This was a big problem using Multiprotocol Extension for BGP in an +operational network. :rfc:`2842` adopted a feature called Capability +Negotiation. *bgpd* use this Capability Negotiation to detect the remote peer's +capabilities. If a peer is only configured as an IPv4 unicast neighbor, *bgpd* +does not send these Capability Negotiation packets (at least not unless other +optional BGP features require capability negotiation). + +By default, FRR will bring up peering with minimal common capability for the +both sides. For example, if the local router has unicast and multicast +capabilities and the remote router only has unicast capability the local router +will establish the connection with unicast only capability. When there are no +common capabilities, FRR sends Unsupported Capability error and then resets the +connection. + +************* +Configuration +************* + +.. _bgp-router-configuration: + +BGP Router Configuration +======================== + +First of all you must configure BGP router with the :abbr:`ASN (Autonomous +System Number)`. The AS number is an identifier for the autonomous system. +The BGP protocol uses the AS number for detecting whether the BGP connection +is internal or external. VyOS does not have a special command to start the BGP +process. The BGP process starts when the first neighbor is configured. + +.. cfgcmd:: set protocols bgp system-as + + Set local autonomous system number that this router represents. This is a + mandatory option! + +Peers Configuration +------------------- + +Defining Peers +^^^^^^^^^^^^^^ + +.. cfgcmd:: set protocols bgp neighbor remote-as + + + This command creates a new neighbor whose remote-as is . The neighbor + address can be an IPv4 address or an IPv6 address or an interface to use + for the connection. The command is applicable for peer and peer group. + +.. cfgcmd:: set protocols bgp neighbor remote-as + internal + + Create a peer as you would when you specify an ASN, except that if the + peers ASN is different than mine as specified under the :cfgcmd:`protocols + bgp ` command the connection will be denied. + +.. cfgcmd:: set protocols bgp neighbor remote-as + external + + Create a peer as you would when you specify an ASN, except that if the + peers ASN is the same as mine as specified under the :cfgcmd:`protocols + bgp ` command the connection will be denied. + +.. cfgcmd:: set protocols bgp neighbor local-role + [strict] + + BGP roles are defined in RFC :rfc:`9234` and provide an easy way to + add route leak prevention, detection and mitigation. The local Role + value is negotiated with the new BGP Role capability which has a + built-in check of the corresponding value. In case of a mismatch the + new OPEN Roles Mismatch Notification <2, 11> would be sent. + The correct Role pairs are: + + Provider - Customer + + Peer - Peer + + RS-Server - RS-Client + + If :cfgcmd:`strict` is set the BGP session won’t become established + until the BGP neighbor sets local Role on its side. This + configuration parameter is defined in RFC :rfc:`9234` and is used to + enforce the corresponding configuration at your counter-parts side. + + Routes that are sent from provider, rs-server, or the peer local-role + (or if received by customer, rs-client, or the peer local-role) will + be marked with a new Only to Customer (OTC) attribute. + + Routes with this attribute can only be sent to your neighbor if your + local-role is provider or rs-server. Routes with this attribute can + be received only if your local-role is customer or rs-client. + + In case of peer-peer relationship routes can be received only if OTC + value is equal to your neighbor AS number. + + All these rules with OTC will help to detect and mitigate route leaks + and happen automatically if local-role is set. + +.. cfgcmd:: set protocols bgp neighbor shutdown + + This command disable the peer or peer group. To reenable the peer use + the delete form of this command. + +.. cfgcmd:: set protocols bgp neighbor description + + + Set description of the peer or peer group. + +.. cfgcmd:: set protocols bgp neighbor update-source + + + Specify the IPv4 source address to use for the BGP session to this neighbor, + may be specified as either an IPv4 address directly or as an interface name. + +.. _bgp_capability_negotiation: + +Capability Negotiation +^^^^^^^^^^^^^^^^^^^^^^ + +.. cfgcmd:: set protocols bgp neighbor capability + dynamic + + This command would allow the dynamic update of capabilities over an + established BGP session. + +.. cfgcmd:: set protocols bgp neighbor capability + extended-nexthop + + Allow bgp to negotiate the extended-nexthop capability with it’s peer. + If you are peering over a IPv6 Link-Local address then this capability + is turned on automatically. If you are peering over a IPv6 Global Address + then turning on this command will allow BGP to install IPv4 routes with + IPv6 nexthops if you do not have IPv4 configured on interfaces. + +.. cfgcmd:: set protocols bgp neighbor + disable-capability-negotiation + + Suppress sending Capability Negotiation as OPEN message optional + parameter to the peer. This command only affects the peer is + configured other than IPv4 unicast configuration. + + When remote peer does not have capability negotiation feature, + remote peer will not send any capabilities at all. In that case, + bgp configures the peer with configured capabilities. + + You may prefer locally configured capabilities more than the negotiated + capabilities even though remote peer sends capabilities. If the peer is + configured by :cfgcmd:`override-capability`, VyOS ignores received + capabilities then override negotiated capabilities with configured values. + + Additionally you should keep in mind that this feature fundamentally + disables the ability to use widely deployed BGP features. BGP unnumbered, + hostname support, AS4, Addpath, Route Refresh, ORF, Dynamic Capabilities, + and graceful restart. + +.. cfgcmd:: set protocols bgp neighbor + override-capability + + This command allow override the result of Capability Negotiation with + local configuration. Ignore remote peer’s capability value. + +.. cfgcmd:: set protocols bgp neighbor + strict-capability-match + + This command forces strictly compare remote capabilities and local + capabilities. If capabilities are different, send Unsupported Capability + error then reset connection. + + You may want to disable sending Capability Negotiation OPEN message + optional parameter to the peer when remote peer does not implement + Capability Negotiation. Please use :cfgcmd:`disable-capability-negotiation` + command to disable the feature. + + +Peer Parameters +^^^^^^^^^^^^^^^ + +.. cfgcmd:: set protocols bgp neighbor address-family + allowas-in number + + This command accept incoming routes with AS path containing AS + number with the same value as the current system AS. This is + used when you want to use the same AS number in your sites, + but you can’t connect them directly. + + The number parameter (1-10) configures the amount of accepted + occurences of the system AS number in AS path. + + This command is only allowed for eBGP peers. It is not applicable + for peer groups. + +.. cfgcmd:: set protocols bgp neighbor address-family + as-override + + This command override AS number of the originating router with + the local AS number. + + Usually this configuration is used in PEs (Provider Edge) to + replace the incoming customer AS number so the connected CE ( + Customer Edge) can use the same AS number as the other customer + sites. This allows customers of the provider network to use the + same AS number across their sites. + + This command is only allowed for eBGP peers. + +.. cfgcmd:: set protocols bgp neighbor address-family + attribute-unchanged + + This command specifies attributes to be left unchanged for + advertisements sent to a peer or peer group. + +.. cfgcmd:: set protocols bgp neighbor address-family + maximum-prefix + + This command specifies a maximum number of prefixes we can receive + from a given peer. If this number is exceeded, the BGP session + will be destroyed. The number range is 1 to 4294967295. + +.. cfgcmd:: set protocols bgp neighbor address-family + nexthop-self + + This command forces the BGP speaker to report itself as the + next hop for an advertised route it advertised to a neighbor. + +.. cfgcmd:: set protocols bgp neighbor address-family + remove-private-as + + This command removes the private ASN of routes that are advertised + to the configured peer. It removes only private ASNs on routes + advertised to EBGP peers. + + If the AS-Path for the route has only private ASNs, the private + ASNs are removed. + + If the AS-Path for the route has a private ASN between public + ASNs, it is assumed that this is a design choice, and the + private ASN is not removed. + +.. cfgcmd:: set protocols bgp neighbor address-family + soft-reconfiguration inbound + + Changes in BGP policies require the BGP session to be cleared. Clearing has a + large negative impact on network operations. Soft reconfiguration enables you + to generate inbound updates from a neighbor, change and activate BGP policies + without clearing the BGP session. + + This command specifies that route updates received from this neighbor will be + stored unmodified, regardless of the inbound policy. When inbound soft + reconfiguration is enabled, the stored updates are processed by the new + policy configuration to create new inbound updates. + + .. note:: Storage of route updates uses memory. If you enable soft + reconfiguration inbound for multiple neighbors, the amount of memory used + can become significant. + +.. cfgcmd:: set protocols bgp neighbor address-family + weight + + This command specifies a default weight value for the neighbor’s + routes. The number range is 1 to 65535. + +.. cfgcmd:: set protocols bgp neighbor + advertisement-interval + + This command specifies the minimum route advertisement interval for + the peer. The interval value is 0 to 600 seconds, with the default + advertisement interval being 0. + +.. cfgcmd:: set protocols bgp neighbor + disable-connected-check + + This command allows peerings between directly connected eBGP peers + using loopback addresses without adjusting the default TTL of 1. + +.. cfgcmd:: set protocols bgp neighbor + disable-send-community + + This command specifies that the community attribute should not be sent + in route updates to a peer. By default community attribute is sent. + +.. cfgcmd:: set protocols bgp neighbor ebgp-multihop + + + This command allows sessions to be established with eBGP neighbors + when they are multiple hops away. When the neighbor is not directly + connected and this knob is not enabled, the session will not establish. + The number of hops range is 1 to 255. This command is mutually + exclusive with :cfgcmd:`ttl-security hops`. + +.. cfgcmd:: set protocols bgp neighbor local-as + [no-prepend] [replace-as] + + Specify an alternate AS for this BGP process when interacting with + the specified peer or peer group. With no modifiers, the specified + local-as is prepended to the received AS_PATH when receiving routing + updates from the peer, and prepended to the outgoing AS_PATH (after + the process local AS) when transmitting local routes to the peer. + + If the :cfgcmd:`no-prepend` attribute is specified, then the supplied + local-as is not prepended to the received AS_PATH. + + If the :cfgcmd:`replace-as` attribute is specified, then only the supplied + local-as is prepended to the AS_PATH when transmitting local-route + updates to this peer. + + .. note:: This command is only allowed for eBGP peers. + +.. cfgcmd:: set protocols bgp neighbor passive + + Configures the BGP speaker so that it only accepts inbound connections + from, but does not initiate outbound connections to the peer or peer group. + +.. cfgcmd:: set protocols bgp neighbor password + + + This command specifies a MD5 password to be used with the tcp socket that + is being used to connect to the remote peer. + +.. cfgcmd:: set protocols bgp neighbor ttl-security + hops + + This command enforces Generalized TTL Security Mechanism (GTSM), + as specified in :rfc:`5082`. With this command, only neighbors + that are specified number of hops away will be allowed to + become neighbors. The number of hops range is 1 to 254. This + command is mutually exclusive with :cfgcmd:`ebgp-multihop`. + + +Peer Groups +^^^^^^^^^^^ + +Peer groups are used to help improve scaling by generating the same update +information to all members of a peer group. Note that this means that the +routes generated by a member of a peer group will be sent back to that +originating peer with the originator identifier attribute set to indicated +the originating peer. All peers not associated with a specific peer group +are treated as belonging to a default peer group, and will share updates. + +.. cfgcmd:: set protocols bgp peer-group + + This command defines a new peer group. You can specify to the group the same + parameters that you can specify for specific neighbors. + + .. note:: If you apply a parameter to an individual neighbor IP address, you + override the action defined for a peer group that includes that IP + address. + +.. cfgcmd:: set protocols bgp neighbor peer-group + + + This command bind specific peer to peer group with a given name. + + +Network Advertisement Configuration +----------------------------------- + +.. cfgcmd:: set protocols bgp address-family + network + + This command is used for advertising IPv4 or IPv6 networks. + + .. note:: By default, the BGP prefix is advertised even if it's not present + in the routing table. This behaviour differs from the implementation of + some vendors. + +.. cfgcmd:: set protocols bgp parameters network-import-check + + This configuration modifies the behavior of the network statement. If you + have this configured the underlying network must exist in the routing table. + +.. cfgcmd:: set protocols bgp neighbor address-family + default-originate [route-map ] + + By default, VyOS does not advertise a default route (0.0.0.0/0) even if it is + in routing table. When you want to announce default routes to the peer, use + this command. Using optional argument :cfgcmd:`route-map` you can inject the + default route to given neighbor only if the conditions in the route map are + met. + + +Route Aggregation Configuration +------------------------------- + +.. cfgcmd:: set protocols bgp address-family + aggregate-address + + This command specifies an aggregate address. The router will also + announce longer-prefixes inside of the aggregate address. + +.. cfgcmd:: set protocols bgp address-family + aggregate-address as-set + + This command specifies an aggregate address with a mathematical set of + autonomous systems. This command summarizes the AS_PATH attributes of + all the individual routes. + +.. cfgcmd:: set protocols bgp address-family + aggregate-address summary-only + + This command specifies an aggregate address and provides that + longer-prefixes inside of the aggregate address are suppressed + before sending BGP updates out to peers. + +.. cfgcmd:: set protocols bgp neighbor address-family + unsuppress-map + + This command applies route-map to selectively unsuppress prefixes + suppressed by summarisation. + + +Redistribution Configuration +---------------------------- + +.. cfgcmd:: set protocols bgp address-family + redistribute + + This command redistributes routing information from the given route source + to the BGP process. There are six modes available for route source: + connected, kernel, ospf, rip, static, table. + +.. cfgcmd:: set protocols bgp address-family + redistribute metric + + This command specifies metric (MED) for redistributed routes. The + metric range is 0 to 4294967295. There are six modes available for + route source: connected, kernel, ospf, rip, static, table. + +.. cfgcmd:: set protocols bgp address-family + redistribute route-map + + This command allows to use route map to filter redistributed routes. + There are six modes available for route source: connected, kernel, + ospf, rip, static, table. + + +General Configuration +--------------------- + +Common parameters +^^^^^^^^^^^^^^^^^ + +.. cfgcmd:: set protocols bgp parameters allow-martian-nexthop + + When a peer receives a martian nexthop as part of the NLRI for a route + permit the nexthop to be used as such, instead of rejecting and resetting + the connection. + +.. cfgcmd:: set protocols bgp parameters router-id + + This command specifies the router-ID. If router ID is not specified it will + use the highest interface IP address. + +.. cfgcmd:: set protocols bgp address-family + maximum-paths + + This command defines the maximum number of parallel routes that + the BGP can support. In order for BGP to use the second path, the + following attributes have to match: Weight, Local Preference, AS + Path (both AS number and AS path length), Origin code, MED, IGP + metric. Also, the next hop address for each path must be different. + +.. cfgcmd:: set protocols bgp parameters no-hard-administrative-reset + + Do not send Hard Reset CEASE Notification for "Administrative Reset" + events. When set and Graceful Restart Notification capability is exchanged + between the peers, Graceful Restart procedures apply, and routes will be retained. + +.. cfgcmd:: set protocols bgp parameters log-neighbor-changes + + This command enable logging neighbor up/down changes and reset reason. + +.. cfgcmd:: set protocols bgp parameters no-client-to-client-reflection + + This command disables route reflection between route reflector clients. + By default, the clients of a route reflector are not required to be + fully meshed and the routes from a client are reflected to other clients. + However, if the clients are fully meshed, route reflection is not required. + In this case, use the :cfgcmd:`no-client-to-client-reflection` command + to disable client-to-client reflection. + +.. cfgcmd:: set protocols bgp parameters no-fast-external-failover + + Disable immediate session reset if peer's connected link goes down. + +.. cfgcmd:: set protocols bgp parameters no-ipv6-auto-ra + + By default, FRR sends router advertisement packets when Extended Next Hop is + on or when a connection is established directly using the device name (Unnumbered BGP). + Setting this option prevents FRR from sending router advertisement packets, but could break Unnumbered BGP. + +.. cfgcmd:: set protocols bgp listen range peer-group + + This command is useful if one desires to loosen the requirement for BGP + to have strictly defined neighbors. Specifically what is allowed is for + the local router to listen to a range of IPv4 or IPv6 addresses defined + by a prefix and to accept BGP open messages. When a TCP connection + (and subsequently a BGP open message) from within this range tries to + connect the local router then the local router will respond and connect + with the parameters that are defined within the peer group. One must define + a peer-group for each range that is listed. If no peer-group is defined + then an error will keep you from committing the configuration. + +.. cfgcmd:: set protocols bgp listen limit + + This command goes hand in hand with the listen range command to limit the + amount of BGP neighbors that are allowed to connect to the local router. + The limit range is 1 to 5000. + +.. cfgcmd:: set protocols bgp parameters ebgp-requires-policy + + This command changes the eBGP behavior of FRR. By default FRR enables + :rfc:`8212` functionality which affects how eBGP routes are advertised, + namely no routes are advertised across eBGP sessions without some + sort of egress route-map/policy in place. In VyOS however we have this + RFC functionality disabled by default so that we can preserve backwards + compatibility with older versions of VyOS. With this option one can + enable :rfc:`8212` functionality to operate. + +.. cfgcmd:: set protocols bgp parameters labeled-unicast + + By default, locally advertised prefixes use the implicit-null label to + encode in the outgoing NLRI. + + The following command uses the explicit-null label value for all the + BGP instances. + + +Administrative Distance +^^^^^^^^^^^^^^^^^^^^^^^ + +.. cfgcmd:: set protocols bgp parameters distance global + + + This command change distance value of BGP. The arguments are the distance + values for external routes, internal routes and local routes respectively. + The distance range is 1 to 255. + +.. cfgcmd:: set protocols bgp parameters distance prefix + distance + + This command sets the administrative distance for a particular route. The + distance range is 1 to 255. + + .. note:: Routes with a distance of 255 are effectively disabled and not + installed into the kernel. + + +Timers +^^^^^^ + +.. cfgcmd:: set protocols bgp timers holdtime + + This command specifies hold-time in seconds. The timer range is + 4 to 65535. The default value is 180 second. If you set value to 0 + VyOS will not hold routes. + +.. cfgcmd:: set protocols bgp timers keepalive + + This command specifies keep-alive time in seconds. The timer + can range from 4 to 65535. The default value is 60 second. + + +Route Dampening +^^^^^^^^^^^^^^^ + +When a route fails, a routing update is sent to withdraw the route from the +network's routing tables. When the route is re-enabled, the change in +availability is also advertised. A route that continually fails and returns +requires a great deal of network traffic to update the network about the +route's status. + +Route dampening wich described in :rfc:`2439` enables you to identify routes +that repeatedly fail and return. If route dampening is enabled, an unstable +route accumulates penalties each time the route fails and returns. If the +accumulated penalties exceed a threshold, the route is no longer advertised. +This is route suppression. Routes that have been suppressed are re-entered +into the routing table only when the amount of their penalty falls below a +threshold. + +A penalty of 1000 is assessed each time the route fails. When the penalties +reach a predefined threshold (suppress-value), the router stops advertising +the route. + +Once a route is assessed a penalty, the penalty is decreased by half each time +a predefined amount of time elapses (half-life-time). When the accumulated +penalties fall below a predefined threshold (reuse-value), the route is +unsuppressed and added back into the BGP routing table. + +No route is suppressed indefinitely. Maximum-suppress-time defines the maximum +time a route can be suppressed before it is re-advertised. + +.. cfgcmd:: set protocols bgp parameters dampening + half-life + + This command defines the amount of time in minutes after + which a penalty is reduced by half. The timer range is + 10 to 45 minutes. + +.. cfgcmd:: set protocols bgp parameters dampening + re-use + + This command defines the accumulated penalty amount at which the + route is re-advertised. The penalty range is 1 to 20000. + +.. cfgcmd:: set protocols bgp parameters dampening + start-suppress-time + + This command defines the accumulated penalty amount at which the + route is suppressed. The penalty range is 1 to 20000. + +.. cfgcmd:: set protocols bgp parameters dampening + max-suppress-time + + This command defines the maximum time in minutes that a route is + suppressed. The timer range is 1 to 255 minutes. + + +Route Selection Configuration +----------------------------- + +.. cfgcmd:: set protocols bgp parameters always-compare-med + + This command provides to compare the MED on routes, even when they were + received from different neighbouring ASes. Setting this option makes the + order of preference of routes more defined, and should eliminate MED + induced oscillations. + +.. cfgcmd:: set protocols bgp parameters bestpath as-path confed + + This command specifies that the length of confederation path sets and + sequences should be taken into account during the BGP best path + decision process. + +.. cfgcmd:: set protocols bgp parameters bestpath as-path multipath-relax + + This command specifies that BGP decision process should consider paths + of equal AS_PATH length candidates for multipath computation. Without + the knob, the entire AS_PATH must match for multipath computation. + +.. cfgcmd:: set protocols bgp parameters bestpath as-path ignore + + Ignore AS_PATH length when selecting a route + +.. cfgcmd:: set protocols bgp parameters bestpath compare-routerid + + Ensure that when comparing routes where both are equal on most metrics, + including local-pref, AS_PATH length, IGP cost, MED, that the tie is + broken based on router-ID. + + If this option is enabled, then the already-selected check, where + already selected eBGP routes are preferred, is skipped. + + If a route has an ORIGINATOR_ID attribute because it has been reflected, + that ORIGINATOR_ID will be used. Otherwise, the router-ID of the peer + the route was received from will be used. + + The advantage of this is that the route-selection (at this point) will + be more deterministic. The disadvantage is that a few or even one lowest-ID + router may attract all traffic to otherwise-equal paths because of this + check. It may increase the possibility of MED or IGP oscillation, unless + other measures were taken to avoid these. The exact behaviour will be + sensitive to the iBGP and reflection topology. + +.. cfgcmd:: set protocols bgp parameters bestpath med confed + + This command specifies that BGP considers the MED when comparing routes + originated from different sub-ASs within the confederation to which this + BGP speaker belongs. The default state, where the MED attribute is not + considered. + +.. cfgcmd:: set protocols bgp parameters bestpath med missing-as-worst + + This command specifies that a route with a MED is always considered to be + better than a route without a MED by causing the missing MED attribute to + have a value of infinity. The default state, where the missing MED + attribute is considered to have a value of zero. + +.. cfgcmd:: set protocols bgp parameters default local-pref + + + This command specifies the default local preference value. The local + preference range is 0 to 4294967295. + +.. cfgcmd:: set protocols bgp parameters deterministic-med + + This command provides to compare different MED values that advertised by + neighbours in the same AS for routes selection. When this command is + enabled, routes from the same autonomous system are grouped together, and + the best entries of each group are compared. + +.. cfgcmd:: set protocols bgp address-family ipv4-unicast network + backdoor + + This command allows the router to prefer route to specified prefix learned + via IGP through backdoor link instead of a route to the same prefix learned + via EBGP. + + +Route Filtering Configuration +----------------------------- + +In order to control and modify routing information that is exchanged between +peers you can use route-map, filter-list, prefix-list, distribute-list. + +For inbound updates the order of preference is: + + - route-map + - filter-list + - prefix-list, distribute-list + +For outbound updates the order of preference is: + + - prefix-list, distribute-list + - filter-list + - route-map + + .. note:: The attributes :cfgcmd:`prefix-list` and :cfgcmd:`distribute-list` + are mutually exclusive, and only one command (distribute-list or + prefix-list) can be applied to each inbound or outbound direction for a + particular neighbor. + +.. cfgcmd:: set protocols bgp neighbor address-family + distribute-list + + This command applies the access list filters named in to the + specified BGP neighbor to restrict the routing information that BGP learns + and/or advertises. The arguments :cfgcmd:`export` and :cfgcmd:`import` + specify the direction in which the access list are applied. + +.. cfgcmd:: set protocols bgp neighbor address-family + prefix-list + + This command applies the prfefix list filters named in to the + specified BGP neighbor to restrict the routing information that BGP learns + and/or advertises. The arguments :cfgcmd:`export` and :cfgcmd:`import` + specify the direction in which the prefix list are applied. + +.. cfgcmd:: set protocols bgp neighbor address-family + route-map + + This command applies the route map named in to the specified BGP + neighbor to control and modify routing information that is exchanged + between peers. The arguments :cfgcmd:`export` and :cfgcmd:`import` + specify the direction in which the route map are applied. + +.. cfgcmd:: set protocols bgp neighbor address-family + filter-list + + This command applies the AS path access list filters named in to the + specified BGP neighbor to restrict the routing information that BGP learns + and/or advertises. The arguments :cfgcmd:`export` and :cfgcmd:`import` + specify the direction in which the AS path access list are applied. + +.. cfgcmd:: set protocols bgp neighbor address-family + capability orf + + This command enables the ORF capability (described in :rfc:`5291`) on the + local router, and enables ORF capability advertisement to the specified BGP + peer. The :cfgcmd:`receive` keyword configures a router to advertise ORF + receive capabilities. The :cfgcmd:`send` keyword configures a router to + advertise ORF send capabilities. To advertise a filter from a sender, you + must create an IP prefix list for the specified BGP peer applied in inbound + derection. + +.. cfgcmd:: set protocols bgp neighbor solo + + This command prevents from sending back prefixes learned from the neighbor. + +BGP Scaling Configuration +------------------------- + +BGP routers connected inside the same AS through BGP belong to an internal BGP +session, or IBGP. In order to prevent routing table loops, IBGP speaker does +not advertise IBGP-learned routes to other IBGP speaker (Split Horizon +mechanism). As such, IBGP requires a full mesh of all peers. For large +networks, this quickly becomes unscalable. + +There are two ways that help us to mitigate the BGPs full-mesh requirement in +a network: + + - Using BGP route-reflectors + - Using BGP confederation + + +Route Reflector Configuration +^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ + +Introducing route reflectors removes the need for the full-mesh. When you +configure a route reflector you have to tell the router whether the other IBGP +router is a client or non-client. A client is an IBGP router that the route +reflector will “reflect” routes to, the non-client is just a regular IBGP +neighbor. Route reflectors mechanism is described in :rfc:`4456` and updated +by :rfc:`7606`. + +.. cfgcmd:: set protocols bgp neighbor
address-family + route-reflector-client + + This command specifies the given neighbor as route reflector client. + +.. cfgcmd:: set protocols bgp parameters cluster-id + + This command specifies cluster ID which identifies a collection of route + reflectors and their clients, and is used by route reflectors to avoid + looping. By default cluster ID is set to the BGP router id value, but can be + set to an arbitrary 32-bit value. + + +Confederation Configuration +^^^^^^^^^^^^^^^^^^^^^^^^^^^ + +A BGP confederation divides our AS into sub-ASes to reduce the number of +required IBGP peerings. Within a sub-AS we still require full-mesh IBGP but +between these sub-ASes we use something that looks like EBGP but behaves like +IBGP (called confederation BGP). Confederation mechanism is described in +:rfc:`5065` + +.. cfgcmd:: set protocols bgp parameters confederation identifier + + + This command specifies a BGP confederation identifier. is the number + of the autonomous system that internally includes multiple sub-autonomous + systems (a confederation). + +.. cfgcmd:: set protocols bgp parameters confederation peers + + This command sets other confederations as members of autonomous + system specified by :cfgcmd:`confederation identifier `. + + +************************* +Operational Mode Commands +************************* + +Show +==== + +.. opcmd:: show bgp + + This command displays all entries in BGP routing table. + +.. code-block:: none + + BGP table version is 10, local router ID is 10.0.35.3, vrf id 0 + Default local pref 100, local AS 65000 + Status codes: s suppressed, d damped, h history, * valid, > best, = multipath, + i internal, r RIB-failure, S Stale, R Removed + Nexthop codes: @NNN nexthop's vrf id, < announce-nh-self + Origin codes: i - IGP, e - EGP, ? - incomplete + + Network Next Hop Metric LocPrf Weight Path + *> 198.51.100.0/24 10.0.34.4 0 0 65004 i + *> 203.0.113.0/24 10.0.35.5 0 0 65005 i + + Displayed 2 routes and 2 total paths + +.. opcmd:: show bgp + + This command displays information about the particular entry in the BGP + routing table. + +.. code-block:: none + + BGP routing table entry for 198.51.100.0/24 + Paths: (1 available, best #1, table default) + Advertised to non peer-group peers: + 10.0.13.1 10.0.23.2 10.0.34.4 10.0.35.5 + 65004 + 10.0.34.4 from 10.0.34.4 (10.0.34.4) + Origin IGP, metric 0, valid, external, best (First path received) + Last update: Wed Jan 6 12:18:53 2021 + +.. opcmd:: show bgp cidr-only + + This command displays routes with classless interdomain routing (CIDR). + +.. opcmd:: show bgp community + + This command displays routes that belong to specified BGP communities. + Valid value is a community number in the range from 1 to 4294967200, + or AA:NN (autonomous system-community number/2-byte number), no-export, + local-as, or no-advertise. + +.. opcmd:: show bgp community-list + + This command displays routes that are permitted by the BGP + community list. + +.. opcmd:: show bgp dampening dampened-paths + + This command displays BGP dampened routes. + +.. opcmd:: show bgp dampening flap-statistics + + This command displays information about flapping BGP routes. + +.. opcmd:: show bgp filter-list + + This command displays BGP routes allowed by the specified AS Path + access list. + +.. opcmd:: show bgp neighbors
advertised-routes + + This command displays BGP routes advertised to a neighbor. + +.. opcmd:: show bgp neighbors
received-routes + + This command displays BGP routes originating from the specified BGP + neighbor before inbound policy is applied. To use this command inbound + soft reconfiguration must be enabled. + +.. opcmd:: show bgp neighbors
routes + + This command displays BGP received-routes that are accepted after filtering. + +.. opcmd:: show bgp neighbors
dampened-routes + + This command displays dampened routes received from BGP neighbor. + +.. opcmd:: show bgp regexp + + This command displays information about BGP routes whose AS path + matches the specified regular expression. + +.. opcmd:: show bgp summary + + This command displays the status of all BGP connections. + +.. code-block:: none + + IPv4 Unicast Summary: + BGP router identifier 10.0.35.3, local AS number 65000 vrf-id 0 + BGP table version 11 + RIB entries 5, using 920 bytes of memory + Peers 4, using 82 KiB of memory + + Neighbor V AS MsgRcvd MsgSent TblVer InQ OutQ Up/Down State/PfxRcd + 10.0.13.1 4 65000 148 159 0 0 0 02:16:01 0 + 10.0.23.2 4 65000 136 143 0 0 0 02:13:21 0 + 10.0.34.4 4 65004 161 163 0 0 0 02:16:01 1 + 10.0.35.5 4 65005 162 166 0 0 0 02:16:01 1 + + Total number of neighbors 4 + +Reset +===== + +.. opcmd:: reset bgp
[soft [in|out]] + + This command resets BGP connections to the specified neighbor IP address. + With argument :cfgcmd:`soft` this command initiates a soft reset. If + you do not specify the :cfgcmd:`in` or :cfgcmd:`out` options, both + inbound and outbound soft reconfiguration are triggered. + +.. opcmd:: reset ip bgp all + + This command resets all BGP connections of given router. + +.. opcmd:: reset bgp external + + This command resets all external BGP peers of given router. + +.. opcmd:: reset bgp peer-group [soft [in|out]] + + This command resets BGP connections to the specified peer group. + With argument :cfgcmd:`soft` this command initiates a soft reset. If + you do not specify the :cfgcmd:`in` or :cfgcmd:`out` options, both + inbound and outbound soft reconfiguration are triggered. + + +******** +Examples +******** + +IPv4 peering +============ + +A simple eBGP configuration: + +**Node 1:** + +.. code-block:: none + + set protocols bgp system-as 65534 + set protocols bgp neighbor 192.168.0.2 ebgp-multihop '2' + set protocols bgp neighbor 192.168.0.2 remote-as '65535' + set protocols bgp neighbor 192.168.0.2 update-source '192.168.0.1' + set protocols bgp neighbor 192.168.0.2 address-family ipv4-unicast + set protocols bgp address-family ipv4-unicast network '172.16.0.0/16' + set protocols bgp parameters router-id '192.168.0.1' + +**Node 2:** + +.. code-block:: none + + set protocols bgp system-as 65535 + set protocols bgp neighbor 192.168.0.1 ebgp-multihop '2' + set protocols bgp neighbor 192.168.0.1 remote-as '65534' + set protocols bgp neighbor 192.168.0.1 update-source '192.168.0.2' + set protocols bgp neighbor 192.168.0.2 address-family ipv4-unicast + set protocols bgp address-family ipv4-unicast network '172.17.0.0/16' + set protocols bgp parameters router-id '192.168.0.2' + + +Don't forget, the CIDR declared in the network statement MUST **exist in your +routing table (dynamic or static), the best way to make sure that is true is +creating a static route:** + +**Node 1:** + +.. code-block:: none + + set protocols static route 172.16.0.0/16 blackhole distance '254' + +**Node 2:** + +.. code-block:: none + + set protocols static route 172.17.0.0/16 blackhole distance '254' + + +IPv6 peering +============ + +A simple BGP configuration via IPv6. + +**Node 1:** + +.. code-block:: none + + set protocols bgp system-as 65534 + set protocols bgp neighbor 2001:db8::2 ebgp-multihop '2' + set protocols bgp neighbor 2001:db8::2 remote-as '65535' + set protocols bgp neighbor 2001:db8::2 update-source '2001:db8::1' + set protocols bgp neighbor 2001:db8::2 address-family ipv6-unicast + set protocols bgp address-family ipv6-unicast network '2001:db8:1::/48' + set protocols bgp parameters router-id '10.1.1.1' + +**Node 2:** + +.. code-block:: none + + set protocols bgp system-as 65535 + set protocols bgp neighbor 2001:db8::1 ebgp-multihop '2' + set protocols bgp neighbor 2001:db8::1 remote-as '65534' + set protocols bgp neighbor 2001:db8::1 update-source '2001:db8::2' + set protocols bgp neighbor 2001:db8::1 address-family ipv6-unicast + set protocols bgp address-family ipv6-unicast network '2001:db8:2::/48' + set protocols bgp parameters router-id '10.1.1.2' + +Don't forget, the CIDR declared in the network statement **MUST exist in your +routing table (dynamic or static), the best way to make sure that is true is +creating a static route:** + +**Node 1:** + +.. code-block:: none + + set protocols static route6 2001:db8:1::/48 blackhole distance '254' + +**Node 2:** + +.. code-block:: none + + set protocols static route6 2001:db8:2::/48 blackhole distance '254' + +Route Filtering +=============== + +Route filter can be applied using a route-map: + +**Node1:** + +.. code-block:: none + + set policy prefix-list AS65535-IN rule 10 action 'permit' + set policy prefix-list AS65535-IN rule 10 prefix '172.16.0.0/16' + set policy prefix-list AS65535-OUT rule 10 action 'deny' + set policy prefix-list AS65535-OUT rule 10 prefix '172.16.0.0/16' + set policy prefix-list6 AS65535-IN rule 10 action 'permit' + set policy prefix-list6 AS65535-IN rule 10 prefix '2001:db8:2::/48' + set policy prefix-list6 AS65535-OUT rule 10 action 'deny' + set policy prefix-list6 AS65535-OUT rule 10 prefix '2001:db8:2::/48' + + set policy route-map AS65535-IN rule 10 action 'permit' + set policy route-map AS65535-IN rule 10 match ip address prefix-list 'AS65535-IN' + set policy route-map AS65535-IN rule 10 match ipv6 address prefix-list 'AS65535-IN' + set policy route-map AS65535-IN rule 20 action 'deny' + set policy route-map AS65535-OUT rule 10 action 'deny' + set policy route-map AS65535-OUT rule 10 match ip address prefix-list 'AS65535-OUT' + set policy route-map AS65535-OUT rule 10 match ipv6 address prefix-list 'AS65535-OUT' + set policy route-map AS65535-OUT rule 20 action 'permit' + + set protocols bgp system-as 65534 + set protocols bgp neighbor 2001:db8::2 address-family ipv4-unicast route-map export 'AS65535-OUT' + set protocols bgp neighbor 2001:db8::2 address-family ipv4-unicast route-map import 'AS65535-IN' + set protocols bgp neighbor 2001:db8::2 address-family ipv6-unicast route-map export 'AS65535-OUT' + set protocols bgp neighbor 2001:db8::2 address-family ipv6-unicast route-map import 'AS65535-IN' + +**Node2:** + +.. code-block:: none + + set policy prefix-list AS65534-IN rule 10 action 'permit' + set policy prefix-list AS65534-IN rule 10 prefix '172.17.0.0/16' + set policy prefix-list AS65534-OUT rule 10 action 'deny' + set policy prefix-list AS65534-OUT rule 10 prefix '172.17.0.0/16' + set policy prefix-list6 AS65534-IN rule 10 action 'permit' + set policy prefix-list6 AS65534-IN rule 10 prefix '2001:db8:1::/48' + set policy prefix-list6 AS65534-OUT rule 10 action 'deny' + set policy prefix-list6 AS65534-OUT rule 10 prefix '2001:db8:1::/48' + + set policy route-map AS65534-IN rule 10 action 'permit' + set policy route-map AS65534-IN rule 10 match ip address prefix-list 'AS65534-IN' + set policy route-map AS65534-IN rule 10 match ipv6 address prefix-list 'AS65534-IN' + set policy route-map AS65534-IN rule 20 action 'deny' + set policy route-map AS65534-OUT rule 10 action 'deny' + set policy route-map AS65534-OUT rule 10 match ip address prefix-list 'AS65534-OUT' + set policy route-map AS65534-OUT rule 10 match ipv6 address prefix-list 'AS65534-OUT' + set policy route-map AS65534-OUT rule 20 action 'permit' + + set protocols bgp system-as 65535 + set protocols bgp neighbor 2001:db8::1 address-family ipv4-unicast route-map export 'AS65534-OUT' + set protocols bgp neighbor 2001:db8::1 address-family ipv4-unicast route-map import 'AS65534-IN' + set protocols bgp neighbor 2001:db8::1 address-family ipv6-unicast route-map export 'AS65534-OUT' + set protocols bgp neighbor 2001:db8::1 address-family ipv6-unicast route-map import 'AS65534-IN' + +We could expand on this and also deny link local and multicast in the rule 20 +action deny. diff --git a/docs/configuration/protocols/rst-failover.rst b/docs/configuration/protocols/rst-failover.rst new file mode 100644 index 00000000..8088e104 --- /dev/null +++ b/docs/configuration/protocols/rst-failover.rst @@ -0,0 +1,114 @@ +######## +Failover +######## + +Failover routes are manually configured routes, but they only install +to the routing table if the health-check target is alive. +If the target is not alive the route is removed from the routing table +until the target becomes available. + +*************** +Failover Routes +*************** + +.. cfgcmd:: set protocols failover route next-hop
check + target + + Configure next-hop `
` and `` for an IPv4 static + route. Specify the target + IPv4 address for health checking. + +.. cfgcmd:: set protocols failover route next-hop
check + timeout + + Timeout in seconds between health target checks. + + Range is 1 to 300, default is 10. + +.. cfgcmd:: set protocols failover route next-hop
check + type + + Defines protocols for checking ARP, ICMP, TCP + + Default is ``icmp``. + +.. cfgcmd:: set protocols failover route next-hop
check + policy + + Policy for checking targets + +* ``all-available`` all checking target addresses must be available to pass + this check + +* ``any-available`` any of the checking target addresses must be available + to pass this check + + Default is ``any-available``. + +.. cfgcmd:: set protocols failover route next-hop
+ interface + + Next-hop interface for the route + +.. cfgcmd:: set protocols failover route next-hop
+ metric + + Route metric + + Default 1. + + +******* +Example +******* + +**One gateway:** + +.. code-block:: none + + set protocols failover route 203.0.113.1/32 next-hop 192.0.2.1 check target '192.0.2.1' + set protocols failover route 203.0.113.1/32 next-hop 192.0.2.1 check timeout '5' + set protocols failover route 203.0.113.1/32 next-hop 192.0.2.1 check type 'icmp' + set protocols failover route 203.0.113.1/32 next-hop 192.0.2.1 interface 'eth0' + set protocols failover route 203.0.113.1/32 next-hop 192.0.2.1 metric '10' + +Show the route + +.. code-block:: none + + vyos@vyos:~$ show ip route 203.0.113.1 + Routing entry for 203.0.113.1/32 + Known via "kernel", distance 0, metric 10, best + Last update 00:00:39 ago + * 192.0.2.1, via eth0 + +**Two gateways and different metrics:** + +.. code-block:: none + + set protocols failover route 203.0.113.1/32 next-hop 192.0.2.1 check target '192.0.2.1' + set protocols failover route 203.0.113.1/32 next-hop 192.0.2.1 check timeout '5' + set protocols failover route 203.0.113.1/32 next-hop 192.0.2.1 check type 'icmp' + set protocols failover route 203.0.113.1/32 next-hop 192.0.2.1 interface 'eth0' + set protocols failover route 203.0.113.1/32 next-hop 192.0.2.1 metric '10' + + set protocols failover route 203.0.113.1/32 next-hop 198.51.100.1 check target '198.51.100.99' + set protocols failover route 203.0.113.1/32 next-hop 198.51.100.1 check timeout '5' + set protocols failover route 203.0.113.1/32 next-hop 198.51.100.1 check type 'icmp' + set protocols failover route 203.0.113.1/32 next-hop 198.51.100.1 interface 'eth2' + set protocols failover route 203.0.113.1/32 next-hop 198.51.100.1 metric '20' + +Show the route + +.. code-block:: none + + vyos@vyos:~$ show ip route 203.0.113.1 + Routing entry for 203.0.113.1/32 + Known via "kernel", distance 0, metric 10, best + Last update 00:08:06 ago + * 192.0.2.1, via eth0 + + Routing entry for 203.0.113.1/32 + Known via "kernel", distance 0, metric 20 + Last update 00:08:14 ago + * 198.51.100.1, via eth2 diff --git a/docs/configuration/protocols/rst-igmp-proxy.rst b/docs/configuration/protocols/rst-igmp-proxy.rst new file mode 100644 index 00000000..f62a289e --- /dev/null +++ b/docs/configuration/protocols/rst-igmp-proxy.rst @@ -0,0 +1,77 @@ +:lastproofread: 2023-11-13 + +.. _igmp_proxy: + +########## +IGMP Proxy +########## + +:abbr:`IGMP (Internet Group Management Protocol)` proxy sends IGMP host messages +on behalf of a connected client. The configuration must define one, and only one +upstream interface, and one or more downstream interfaces. + +Configuration +============= + +.. cfgcmd:: set protocols igmp-proxy interface role + + + * **upstream:** The upstream network interface is the outgoing interface + which is responsible for communicating to available multicast data sources. + There can only be one upstream interface. + + * **downstream:** Downstream network interfaces are the distribution + interfaces to the destination networks, where multicast clients can join + groups and receive multicast data. One or more downstream interfaces must + be configured. + +.. cfgcmd:: set protocols igmp-proxy interface alt-subnet + + Defines alternate sources for multicasting and IGMP data. The network address + must be on the following format 'a.b.c.d/n'. By default, the router will + accept data from sources on the same network as configured on an interface. + If the multicast source lies on a remote network, one must define from where + traffic should be accepted. + + This is especially useful for the upstream interface, since the source for + multicast traffic is often from a remote location. + + This option can be supplied multiple times. + +.. cfgcmd:: set protocols igmp-proxy disable-quickleave + + Disables quickleave mode. In this mode the daemon will not send a Leave IGMP + message upstream as soon as it receives a Leave message for any downstream + interface. The daemon will not ask for Membership reports on the downstream + interfaces, and if a report is received the group is not joined again the + upstream. + + If it's vital that the daemon should act exactly like a real multicast client + on the upstream interface, this function should be enabled. + + Enabling this function increases the risk of bandwidth saturation. + +.. cfgcmd:: set protocols igmp-proxy disable + + Disable this service. + +.. _igmp:proxy_example: + +Example +------- + +Interface `eth1` LAN is behind NAT. In order to subscribe `10.0.0.0/23` subnet +multicast which is in `eth0` WAN we need to configure igmp-proxy. + +.. code-block:: none + + set protocols igmp-proxy interface eth0 role upstream + set protocols igmp-proxy interface eth0 alt-subnet 10.0.0.0/23 + set protocols igmp-proxy interface eth1 role downstream + +Operation +========= + +.. opcmd:: restart igmp-proxy + + Restart the IGMP proxy process. diff --git a/docs/configuration/protocols/rst-index.rst b/docs/configuration/protocols/rst-index.rst new file mode 100644 index 00000000..ea217d3c --- /dev/null +++ b/docs/configuration/protocols/rst-index.rst @@ -0,0 +1,22 @@ +######### +Protocols +######### + +.. toctree:: + :maxdepth: 1 + :includehidden: + + babel + bfd + bgp + failover + igmp-proxy + isis + mpls + segment-routing + ospf + pim + pim6 + rip + rpki + static diff --git a/docs/configuration/protocols/rst-isis.rst b/docs/configuration/protocols/rst-isis.rst new file mode 100644 index 00000000..18a7c166 --- /dev/null +++ b/docs/configuration/protocols/rst-isis.rst @@ -0,0 +1,547 @@ +.. include:: /_include/need_improvement.txt + +.. _routing-isis: + +##### +IS-IS +##### + +:abbr:`IS-IS (Intermediate System to Intermediate System)` is a link-state +interior gateway protocol (IGP) which is described in ISO10589, +:rfc:`1195`, :rfc:`5308`. IS-IS runs the Dijkstra shortest-path first (SPF) +algorithm to create a database of the network’s topology, and +from that database to determine the best (that is, lowest cost) path to a +destination. The intermediate systems (the name for routers) exchange topology +information with their directly conencted neighbors. IS-IS runs directly on +the data link layer (Layer 2). IS-IS addresses are called +:abbr:`NETs (Network Entity Titles)` and can be 8 to 20 bytes long, but are +generally 10 bytes long. The tree database that is created with IS-IS is +similar to the one that is created with OSPF in that the paths chosen should +be similar. Comparisons to OSPF are inevitable and often are reasonable ones +to make in regards to the way a network will respond with either IGP. + +******* +General +******* + +Configuration +============= + +Mandatory Settings +------------------ + +For IS-IS top operate correctly, one must do the equivalent of a Router ID in +CLNS. This Router ID is called the :abbr:`NET (Network Entity Title)`. This +must be unique for each and every router that is operating in IS-IS. It also +must not be duplicated otherwise the same issues that occur within OSPF will +occur within IS-IS when it comes to said duplication. + + +.. cfgcmd:: set protocols isis net + + This commad sets network entity title (NET) provided in ISO format. + + Here is an example :abbr:`NET (Network Entity Title)` value: + + .. code-block:: none + + 49.0001.1921.6800.1002.00 + + The CLNS address consists of the following parts: + + * :abbr:`AFI (Address family authority identifier)` - ``49`` The AFI value + 49 is what IS-IS uses for private addressing. + + * Area identifier: ``0001`` IS-IS area number (numberical area ``1``) + + * System identifier: ``1921.6800.1002`` - for system idetifiers we recommend + to use IP address or MAC address of the router itself. The way to construct + this is to keep all of the zeroes of the router IP address, and then change + the periods from being every three numbers to every four numbers. The + address that is listed here is ``192.168.1.2``, which if expanded will turn + into ``192.168.001.002``. Then all one has to do is move the dots to have + four numbers instead of three. This gives us ``1921.6800.1002``. + + * :abbr:`NET (Network Entity Title)` selector: ``00`` Must always be 00. This + setting indicates "this system" or "local system." + +.. cfgcmd:: set protocols isis interface + + This command enables IS-IS on this interface, and allows for + adjacency to occur. Note that the name of IS-IS instance must be + the same as the one used to configure the IS-IS process. + +IS-IS Global Configuration +-------------------------- + +.. cfgcmd:: set protocols isis dynamic-hostname + + This command enables support for dynamic hostname TLV. Dynamic hostname + mapping determined as described in :rfc:`2763`, Dynamic Hostname + Exchange Mechanism for IS-IS. + +.. cfgcmd:: set protocols isis level + + This command defines the IS-IS router behavior: + + * **level-1** - Act as a station (Level 1) router only. + * **level-1-2** - Act as a station (Level 1) router and area (Level 2) router. + * **level-2-only** - Act as an area (Level 2) router only. + +.. cfgcmd:: set protocols isis lsp-mtu + + This command configures the maximum size of generated + :abbr:`LSPs (Link State PDUs)`, in bytes. The size range is 128 to 4352. + +.. cfgcmd:: set protocols isis metric-style + + This command sets old-style (ISO 10589) or new style packet formats: + + * **narrow** - Use old style of TLVs with narrow metric. + * **transition** - Send and accept both styles of TLVs during transition. + * **wide** - Use new style of TLVs to carry wider metric. + +.. cfgcmd:: set protocols isis purge-originator + + This command enables :rfc:`6232` purge originator identification. Enable + purge originator identification (POI) by adding the type, length and value + (TLV) with the Intermediate System (IS) identification to the LSPs that do + not contain POI information. If an IS generates a purge, VyOS adds this TLV + with the system ID of the IS to the purge. + +.. cfgcmd:: set protocols isis set-attached-bit + + This command sets ATT bit to 1 in Level1 LSPs. It is described in :rfc:`3787`. + +.. cfgcmd:: set protocols isis set-overload-bit + + This command sets overload bit to avoid any transit traffic through this + router. It is described in :rfc:`3787`. + +.. cfgcmd:: set protocols isis name default-information originate + level-1 + + This command will generate a default-route in L1 database. + +.. cfgcmd:: set protocols isis name default-information originate + level-2 + + This command will generate a default-route in L2 database. + + +.. cfgcmd:: set protocols isis ldp-sync + + This command will enable IGP-LDP synchronization globally for ISIS. This + requires for LDP to be functional. This is described in :rfc:`5443`. By + default all interfaces operational in IS-IS are enabled for synchronization. + Loopbacks are exempt. + +.. cfgcmd:: set protocols isis ldp-sync holddown + + This command will change the hold down value globally for IGP-LDP + synchronization during convergence/interface flap events. + + +Interface Configuration +----------------------- + +.. cfgcmd:: set protocols isis interface circuit-type + + + This command specifies circuit type for interface: + + * **level-1** - Level-1 only adjacencies are formed. + * **level-1-2** - Level-1-2 adjacencies are formed + * **level-2-only** - Level-2 only adjacencies are formed + +.. cfgcmd:: set protocols isis interface hello-interval + + + This command sets hello interval in seconds on a given interface. + The range is 1 to 600. + +.. cfgcmd:: set protocols isis interface hello-multiplier + + + This command sets multiplier for hello holding time on a given + interface. The range is 2 to 100. + +.. cfgcmd:: set protocols isis interface hello-padding + + This command configures padding on hello packets to accommodate asymmetrical + maximum transfer units (MTUs) from different hosts as described in + :rfc:`3719`. This helps to prevent a premature adjacency Up state when one + routing devices MTU does not meet the requirements to establish the adjacency. + +.. cfgcmd:: set protocols isis interface metric + + This command set default metric for circuit. + + The metric range is 1 to 16777215 (Max value depend if metric support narrow + or wide value). + +.. cfgcmd:: set protocols isis interface network + point-to-point + + This command specifies network type to Point-to-Point. The default + network type is broadcast. + +.. cfgcmd:: set protocols isis interface passive + + This command configures the passive mode for this interface. + +.. cfgcmd:: set protocols isis interface password + plaintext-password + + This command configures the authentication password for the interface. + +.. cfgcmd:: set protocols isis interface priority + + This command sets priority for the interface for + :abbr:`DIS (Designated Intermediate System)` election. The priority + range is 0 to 127. + +.. cfgcmd:: set protocols isis interface psnp-interval + + + This command sets PSNP interval in seconds. The interval range is 0 + to 127. + +.. cfgcmd:: set protocols isis interface + no-three-way-handshake + + This command disables Three-Way Handshake for P2P adjacencies which + described in :rfc:`5303`. Three-Way Handshake is enabled by default. + +.. cfgcmd:: set protocols isis interface ldp-sync disable + + This command disables IGP-LDP sync for this specific interface. + +.. cfgcmd:: set protocols isis interface ldp-sync holddown + + + This command will change the hold down value for IGP-LDP synchronization + during convergence/interface flap events, but for this interface only. + +Route Redistribution +-------------------- + +.. cfgcmd:: set protocols isis redistribute ipv4 level-1 + + This command redistributes routing information from the given route source + into the ISIS database as Level-1. There are six modes available for route + source: bgp, connected, kernel, ospf, rip, static. + +.. cfgcmd:: set protocols isis redistribute ipv4 level-2 + + This command redistributes routing information from the given route source + into the ISIS database as Level-2. There are six modes available for route + source: bgp, connected, kernel, ospf, rip, static. + +.. cfgcmd:: set protocols isis redistribute ipv4 + metric + + This command specifies metric for redistributed routes from the given route + source. There are six modes available for route source: bgp, connected, + kernel, ospf, rip, static. The metric range is 1 to 16777215. + +.. cfgcmd:: set protocols isis redistribute ipv4 + route-map + + This command allows to use route map to filter redistributed routes from + the given route source. There are six modes available for route source: + bgp, connected, kernel, ospf, rip, static. + + +Timers +------ + +.. cfgcmd:: set protocols isis lsp-gen-interval + + This command sets minimum interval in seconds between regenerating same + LSP. The interval range is 1 to 120. + +.. cfgcmd:: set protocols isis lsp-refresh-interval + + This command sets LSP refresh interval in seconds. IS-IS generates LSPs + when the state of a link changes. However, to ensure that routing + databases on all routers remain converged, LSPs in stable networks are + generated on a regular basis even though there has been no change to + the state of the links. The interval range is 1 to 65235. The default + value is 900 seconds. + +.. cfgcmd:: set protocols isis max-lsp-lifetime + + This command sets LSP maximum LSP lifetime in seconds. The interval range + is 350 to 65535. LSPs remain in a database for 1200 seconds by default. + If they are not refreshed by that time, they are deleted. You can change + the LSP refresh interval or the LSP lifetime. The LSP refresh interval + should be less than the LSP lifetime or else LSPs will time out before + they are refreshed. + +.. cfgcmd:: set protocols isis spf-interval + + This command sets minimum interval between consecutive SPF calculations in + seconds.The interval range is 1 to 120. + +.. cfgcmd:: set protocols isis spf-delay-ietf holddown + +.. cfgcmd:: set protocols isis spf-delay-ietf init-delay + + +.. cfgcmd:: set protocols isis spf-delay-ietf long-delay + + +.. cfgcmd:: set protocols isis spf-delay-ietf short-delay + + +.. cfgcmd:: set protocols isis spf-delay-ietf time-to-learn + + + This commands specifies the Finite State Machine (FSM) intended to + control the timing of the execution of SPF calculations in response + to IGP events. The process described in :rfc:`8405`. + + +******** +Examples +******** + +Enable IS-IS +============ + +**Node 1:** + +.. code-block:: none + + set interfaces loopback lo address '192.168.255.255/32' + set interfaces ethernet eth1 address '192.0.2.1/24' + + set protocols isis interface eth1 + set protocols isis interface lo + set protocols isis net '49.0001.1921.6825.5255.00' + +**Node 2:** + +.. code-block:: none + + set interfaces ethernet eth1 address '192.0.2.2/24' + + set interfaces loopback lo address '192.168.255.254/32' + set interfaces ethernet eth1 address '192.0.2.2/24' + + set protocols isis interface eth1 + set protocols isis interface lo + set protocols isis net '49.0001.1921.6825.5254.00' + + + +This gives us the following neighborships, Level 1 and Level 2: + +.. code-block:: none + + Node-1@vyos:~$ show isis neighbor + Area VyOS: + System Id Interface L State Holdtime SNPA + vyos eth1 1 Up 28 0c87.6c09.0001 + vyos eth1 2 Up 28 0c87.6c09.0001 + + Node-2@vyos:~$ show isis neighbor + Area VyOS: + System Id Interface L State Holdtime SNPA + vyos eth1 1 Up 29 0c33.0280.0001 + vyos eth1 2 Up 28 0c33.0280.0001 + + + +Here's the IP routes that are populated. Just the loopback: + +.. code-block:: none + + Node-1@vyos:~$ show ip route isis + Codes: K - kernel route, C - connected, S - static, R - RIP, + O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP, + T - Table, v - VNC, V - VNC-Direct, A - Babel, F - PBR, + f - OpenFabric, + > - selected route, * - FIB route, q - queued, r - rejected, b - backup + t - trapped, o - offload failure + + I 192.0.2.0/24 [115/20] via 192.0.2.2, eth1 inactive, weight 1, 00:02:22 + I>* 192.168.255.254/32 [115/20] via 192.0.2.2, eth1, weight 1, 00:02:22 + + Node-2@vyos:~$ show ip route isis + Codes: K - kernel route, C - connected, S - static, R - RIP, + O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP, + T - Table, v - VNC, V - VNC-Direct, A - Babel, F - PBR, + f - OpenFabric, + > - selected route, * - FIB route, q - queued, r - rejected, b - backup + t - trapped, o - offload failure + + I 192.0.2.0/24 [115/20] via 192.0.2.1, eth1 inactive, weight 1, 00:02:21 + I>* 192.168.255.255/32 [115/20] via 192.0.2.1, eth1, weight 1, 00:02:21 + + + +Enable IS-IS and redistribute routes not natively in IS-IS +========================================================== + +**Node 1:** + +.. code-block:: none + + set interfaces dummy dum0 address '203.0.113.1/24' + set interfaces ethernet eth1 address '192.0.2.1/24' + + set policy prefix-list EXPORT-ISIS rule 10 action 'permit' + set policy prefix-list EXPORT-ISIS rule 10 prefix '203.0.113.0/24' + set policy route-map EXPORT-ISIS rule 10 action 'permit' + set policy route-map EXPORT-ISIS rule 10 match ip address prefix-list 'EXPORT-ISIS' + + set protocols isis interface eth1 + set protocols isis net '49.0001.1921.6800.1002.00' + set protocols isis redistribute ipv4 connected level-2 route-map 'EXPORT-ISIS' + +**Node 2:** + +.. code-block:: none + + set interfaces ethernet eth1 address '192.0.2.2/24' + + set protocols isis interface eth1 + set protocols isis net '49.0001.1921.6800.2002.00' + +Routes on Node 2: + +.. code-block:: none + + Node-2@r2:~$ show ip route isis + Codes: K - kernel route, C - connected, S - static, R - RIP, + O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP, + T - Table, v - VNC, V - VNC-Direct, A - Babel, D - SHARP, + F - PBR, f - OpenFabric, + > - selected route, * - FIB route, q - queued route, r - rejected route + + I 203.0.113.0/24 [115/10] via 192.0.2.1, eth1, 00:03:42 + +Enable IS-IS and IGP-LDP synchronization +======================================== + +**Node 1:** + +.. code-block:: none + + set interfaces loopback lo address 192.168.255.255/32 + set interfaces ethernet eth0 address 192.0.2.1/24 + + set protocols isis interface eth0 + set protocols isis interface lo passive + set protocols isis ldp-sync + set protocols isis net 49.0001.1921.6825.5255.00 + + set protocols mpls interface eth0 + set protocols mpls ldp discovery transport-ipv4-address 192.168.255.255 + set protocols mpls ldp interface lo + set protocols mpls ldp interface eth0 + set protocols mpls ldp parameters transport-prefer-ipv4 + set protocols mpls ldp router-id 192.168.255.255 + + +This gives us IGP-LDP synchronization for all non-loopback interfaces with +a holddown timer of zero seconds: + + +.. code-block:: none + + Node-1@vyos:~$ show isis mpls ldp-sync + eth0 + LDP-IGP Synchronization enabled: yes + holddown timer in seconds: 0 + State: Sync achieved + + + + +Enable IS-IS with Segment Routing (Experimental) +================================================ + +**Node 1:** + +.. code-block:: none + + set interfaces loopback lo address '192.168.255.255/32' + set interfaces ethernet eth1 address '192.0.2.1/24' + + set protocols isis interface eth1 + set protocols isis interface lo + set protocols isis net '49.0001.1921.6825.5255.00' + set protocols isis segment-routing global-block high-label-value '599' + set protocols isis segment-routing global-block low-label-value '550' + set protocols isis segment-routing prefix 192.168.255.255/32 index value '1' + set protocols isis segment-routing prefix 192.168.255.255/32 index explicit-null + set protocols mpls interface 'eth1' + +**Node 2:** + +.. code-block:: none + + set interfaces loopback lo address '192.168.255.254/32' + set interfaces ethernet eth1 address '192.0.2.2/24' + + set protocols isis interface eth1 + set protocols isis interface lo + set protocols isis net '49.0001.1921.6825.5254.00' + set protocols isis segment-routing global-block high-label-value '599' + set protocols isis segment-routing global-block low-label-value '550' + set protocols isis segment-routing prefix 192.168.255.254/32 index value '2' + set protocols isis segment-routing prefix 192.168.255.254/32 index explicit-null + set protocols mpls interface 'eth1' + + + +This gives us MPLS segment routing enabled and labels for far end loopbacks: + +.. code-block:: none + + Node-1@vyos:~$ show mpls table + Inbound Label Type Nexthop Outbound Label + ---------------------------------------------------------------------- + 552 SR (IS-IS) 192.0.2.2 IPv4 Explicit Null <-- Node-2 loopback learned on Node-1 + 15000 SR (IS-IS) 192.0.2.2 implicit-null + 15001 SR (IS-IS) fe80::e87:6cff:fe09:1 implicit-null + 15002 SR (IS-IS) 192.0.2.2 implicit-null + 15003 SR (IS-IS) fe80::e87:6cff:fe09:1 implicit-null + + Node-2@vyos:~$ show mpls table + Inbound Label Type Nexthop Outbound Label + --------------------------------------------------------------------- + 551 SR (IS-IS) 192.0.2.1 IPv4 Explicit Null <-- Node-1 loopback learned on Node-2 + 15000 SR (IS-IS) 192.0.2.1 implicit-null + 15001 SR (IS-IS) fe80::e33:2ff:fe80:1 implicit-null + 15002 SR (IS-IS) 192.0.2.1 implicit-null + 15003 SR (IS-IS) fe80::e33:2ff:fe80:1 implicit-null + +Here is the routing tables showing the MPLS segment routing label operations: + +.. code-block:: none + + Node-1@vyos:~$ show ip route isis + Codes: K - kernel route, C - connected, S - static, R - RIP, + O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP, + T - Table, v - VNC, V - VNC-Direct, A - Babel, F - PBR, + f - OpenFabric, + > - selected route, * - FIB route, q - queued, r - rejected, b - backup + t - trapped, o - offload failure + + I 192.0.2.0/24 [115/20] via 192.0.2.2, eth1 inactive, weight 1, 00:07:48 + I>* 192.168.255.254/32 [115/20] via 192.0.2.2, eth1, label IPv4 Explicit Null, weight 1, 00:03:39 + + Node-2@vyos:~$ show ip route isis + Codes: K - kernel route, C - connected, S - static, R - RIP, + O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP, + T - Table, v - VNC, V - VNC-Direct, A - Babel, F - PBR, + f - OpenFabric, + > - selected route, * - FIB route, q - queued, r - rejected, b - backup + t - trapped, o - offload failure + + I 192.0.2.0/24 [115/20] via 192.0.2.1, eth1 inactive, weight 1, 00:07:46 + I>* 192.168.255.255/32 [115/20] via 192.0.2.1, eth1, label IPv4 Explicit Null, weight 1, 00:03:43 diff --git a/docs/configuration/protocols/rst-mpls.rst b/docs/configuration/protocols/rst-mpls.rst new file mode 100644 index 00000000..550473d7 --- /dev/null +++ b/docs/configuration/protocols/rst-mpls.rst @@ -0,0 +1,259 @@ +.. _mpls: + +#### +MPLS +#### + +:abbr:`MPLS (Multi-Protocol Label Switching)` is a packet forwarding paradigm +which differs from regular IP forwarding. Instead of IP addresses being used to +make the decision on finding the exit interface, a router will instead use an +exact match on a 32 bit/4 byte header called the MPLS label. This label is +inserted between the ethernet (layer 2) header and the IP (layer 3) header. +One can statically or dynamically assign label allocations, but we will focus +on dynamic allocation of labels using some sort of label distribution protocol +(such as the aptly named Label Distribution Protocol / LDP, Resource Reservation +Protocol / RSVP, or Segment Routing through OSPF/ISIS). These protocols allow +for the creation of a unidirectional/unicast path called a labeled switched +path (initialized as LSP) throughout the network that operates very much like +a tunnel through the network. An easy way of thinking about how an MPLS LSP +actually forwards traffic throughout a network is to think of a GRE tunnel. +They are not the same in how they operate, but they are the same in how they +handle the tunneled packet. It would be good to think of MPLS as a tunneling +technology that can be used to transport many different types of packets, to +aid in traffic engineering by allowing one to specify paths throughout the +network (using RSVP or SR), and to generally allow for easier intra/inter +network transport of data packets. + +For more information on how MPLS label switching works, please go visit +`Wikipedia (MPLS)`_. + +.. note:: MPLS support in VyOS is not finished yet, and therefore its + functionality is limited. Currently there is no support for MPLS enabled VPN + services such as L2VPNs and mVPNs. RSVP support is also not present as the + underlying routing stack (FRR) does not implement it. Currently VyOS + implements LDP as described in RFC 5036; other LDP standard are the + following ones: RFC 6720, RFC 6667, RFC 5919, RFC 5561, RFC 7552, RFC 4447. + Because MPLS is already available (FRR also supports RFC 3031). + + +Label Distribution Protocol +=========================== + +The :abbr:`MPLS (Multi-Protocol Label Switching)` architecture does not assume +a single protocol to create MPLS paths. VyOS supports the Label Distribution +Protocol (LDP) as implemented by FRR, based on :rfc:`5036`. + +:abbr:`LDP (Label Distribution Protocol)` is a TCP based MPLS signaling protocol +that distributes labels creating MPLS label switched paths in a dynamic manner. +LDP is not a routing protocol, as it relies on other routing protocols for +forwarding decisions. LDP cannot bootstrap itself, and therefore relies on said +routing protocols for communication with other routers that use LDP. + +In order to allow for LDP on the local router to exchange label advertisements +with other routers, a TCP session will be established between automatically +discovered and statically assigned routers. LDP will try to establish a TCP +session to the **transport address** of other routers. Therefore for LDP to +function properly please make sure the transport address is shown in the +routing table and reachable to traffic at all times. + +It is highly recommended to use the same address for both the LDP router-id and +the discovery transport address, but for VyOS MPLS LDP to work both parameters +must be explicitly set in the configuration. + +Another thing to keep in mind with LDP is that much like BGP, it is a protocol +that runs on top of TCP. It however does not have an ability to do something +like a refresh capability like BGPs route refresh capability. Therefore one +might have to reset the neighbor for a capability change or a configuration +change to work. + +Configuration Options +===================== + +.. cfgcmd:: set protocols mpls interface + + Use this command to enable MPLS processing on the interface you define. + +.. cfgcmd:: set protocols mpls ldp interface + + Use this command to enable LDP on the interface you define. + +.. cfgcmd:: set protocols mpls ldp router-id
+ + Use this command to configure the IP address used as the LDP router-id of the + local device. + +.. cfgcmd:: set protocols mpls ldp discovery transport-ipv4-address
+.. cfgcmd:: set protocols mpls ldp discovery transport-ipv6-address
+ + Use this command to set the IPv4 or IPv6 transport-address used by LDP. + +.. cfgcmd:: set protocols mpls ldp neighbor
password + + Use this command to configure authentication for LDP peers. Set the + IP address of the LDP peer and a password that should be shared in + order to become neighbors. + +.. cfgcmd:: set protocols mpls ldp neighbor
session-holdtime + + Use this command to configure a specific session hold time for LDP peers. + Set the IP address of the LDP peer and a session hold time that should be + configured for it. You may have to reset the neighbor for this to work. + +.. cfgcmd:: set protocols mpls ldp neighbor
ttl-security + + + Use this command to enable, disable, or specify hop count for TTL security + for LDP peers. By default the value is set to 255 (or max TTL). + +.. cfgcmd:: set protocols mpls ldp discovery hello-ipv4-interval +.. cfgcmd:: set protocols mpls ldp discovery hello-ipv4-holdtime +.. cfgcmd:: set protocols mpls ldp discovery hello-ipv6-interval +.. cfgcmd:: set protocols mpls ldp discovery hello-ipv6-holdtime + + Use these commands if you would like to set the discovery hello and hold time + parameters. + +.. cfgcmd:: set protocols mpls ldp discovery session-ipv4-holdtime +.. cfgcmd:: set protocols mpls ldp discovery session-ipv6-holdtime + + Use this command if you would like to set the TCP session hold time intervals. + +.. cfgcmd:: set protocols mpls ldp import ipv4 import-filter filter-access-list + +.. cfgcmd:: set protocols mpls ldp import ipv6 import-filter filter-access-list6 + + + Use these commands to control the importing of forwarding equivalence classes + (FECs) for LDP from neighbors. This would be useful for example on only + accepting the labeled routes that are needed and not ones that are not + needed, such as accepting loopback interfaces and rejecting all others. + +.. cfgcmd:: set protocols mpls ldp export ipv4 export-filter filter-access-list + +.. cfgcmd:: set protocols mpls ldp export ipv6 export-filter filter-access-list6 + + + Use these commands to control the exporting of forwarding equivalence classes + (FECs) for LDP to neighbors. This would be useful for example on only + announcing the labeled routes that are needed and not ones that are not + needed, such as announcing loopback interfaces and no others. + +.. cfgcmd:: set protocols mpls ldp export ipv4 explicit-null +.. cfgcmd:: set protocols mpls ldp export ipv6 explicit-null + + Use this command if you would like for the router to advertise FECs with a + label of 0 for explicit null operations. + +.. cfgcmd:: set protocols mpls ldp allocation ipv4 access-list + +.. cfgcmd:: set protocols mpls ldp allocation ipv6 access-list6 + + + Use this command if you would like to control the local FEC allocations for + LDP. A good example would be for your local router to not allocate a label for + everything. Just a label for what it's useful. A good example would be just a + loopback label. + +.. cfgcmd:: set protocols mpls ldp parameters cisco-interop-tlv + + Use this command to use a Cisco non-compliant format to send and interpret + the Dual-Stack capability TLV for IPv6 LDP communications. This is related to + :rfc:`7552`. + +.. cfgcmd:: set protocols mpls ldp parameters ordered-control + + Use this command to use ordered label distribution control mode. FRR + by default uses independent label distribution control mode for label + distribution. This is related to :rfc:`5036`. + +.. cfgcmd:: set protocols mpls ldp parameters transport-prefer-ipv4 + + Use this command to prefer IPv4 for TCP peer transport connection for LDP + when both an IPv4 and IPv6 LDP address are configured on the same interface. + +.. cfgcmd:: set protocols mpls ldp targeted-neighbor ipv4 enable +.. cfgcmd:: set protocols mpls ldp targeted-neighbor ipv6 enable + + Use this command to enable targeted LDP sessions to the local router. The + router will then respond to any sessions that are trying to connect to it that + are not a link local type of TCP connection. + +.. cfgcmd:: set protocols mpls ldp targeted-neighbor ipv4 address
+.. cfgcmd:: set protocols mpls ldp targeted-neighbor ipv6 address
+ + Use this command to enable the local router to try and connect with a targeted + LDP session to another router. + +.. cfgcmd:: set protocols mpls ldp targeted-neighbor ipv4 hello-holdtime + +.. cfgcmd:: set protocols mpls ldp targeted-neighbor ipv4 hello-interval + +.. cfgcmd:: set protocols mpls ldp targeted-neighbor ipv6 hello-holdtime + +.. cfgcmd:: set protocols mpls ldp targeted-neighbor ipv6 hello-interval + + + Use these commands if you would like to set the discovery hello and hold time + parameters for the targeted LDP neighbors. + + +Sample configuration to setup LDP on VyOS +----------------------------------------- + +.. code-block:: none + + set protocols ospf area 0 network '192.168.255.252/32' <--- Routing for loopback + set protocols ospf area 0 network '192.168.0.5/32' <--- Routing for an interface connecting to the network + set protocols ospf parameters router-id '192.168.255.252' <--- Router ID setting for OSPF + set protocols mpls interface 'eth1' <--- Enable MPLS for an interface connecting to network + set protocols mpls ldp discovery transport-ipv4-address '192.168.255.252' <--- Transport address for LDP for TCP sessions to connect to + set protocols mpls ldp interface 'eth1' <--- Enable LDP for an interface connecting to network + set protocols mpls ldp interface 'lo' <--- Enable LDP on loopback for future services connectivity + set protocols mpls ldp router-id '192.168.255.252' <--- Router ID setting for LDP + set interfaces ethernet eth1 address '192.168.0.5/31' <--- Interface IP for connecting to network + set interfaces loopback lo address '192.168.255.252/32' <--- Interface loopback IP for router ID and other uses + + +Operational Mode Commands +========================= + +When LDP is working, you will be able to see label information in the outcome +of ``show ip route``. Besides that information, there are also specific *show* +commands for LDP: + +Show +---- + +.. opcmd:: show mpls ldp binding + + Use this command to see the Label Information Base. + +.. opcmd:: show mpls ldp discovery + + Use this command to see discovery hello information + +.. opcmd:: show mpls ldp interface + + Use this command to see LDP interface information + +.. opcmd:: show mpls ldp neighbor + + Use this command to see LDP neighbor information + +.. opcmd:: show mpls ldp neighbor detail + + Use this command to see detailed LDP neighbor information + +Reset +----- + +.. opcmd:: reset mpls ldp neighbor + + Use this command to reset an LDP neighbor/TCP session that is established + + +.. stop_vyoslinter + +.. _`Wikipedia (MPLS)`: https://en.wikipedia.org/wiki/Multiprotocol_Label_Switching + +.. start_vyoslinter \ No newline at end of file diff --git a/docs/configuration/protocols/rst-ospf.rst b/docs/configuration/protocols/rst-ospf.rst new file mode 100644 index 00000000..43680520 --- /dev/null +++ b/docs/configuration/protocols/rst-ospf.rst @@ -0,0 +1,1391 @@ +.. _routing-ospf: + +#### +OSPF +#### + +:abbr:`OSPF (Open Shortest Path First)` is a routing protocol for Internet +Protocol (IP) networks. It uses a link state routing (LSR) algorithm and falls +into the group of interior gateway protocols (IGPs), operating within a single +autonomous system (AS). It is defined as OSPF Version 2 in :rfc:`2328` (1998) +for IPv4. Updates for IPv6 are specified as OSPF Version 3 in :rfc:`5340` +(2008). OSPF supports the :abbr:`CIDR (Classless Inter-Domain Routing)` +addressing model. + +OSPF is a widely used IGP in large enterprise networks. + +************* +OSPFv2 (IPv4) +************* + +Configuration +============= + +General +------- + +VyOS does not have a special command to start the OSPF process. The OSPF process +starts when the first ospf enabled interface is configured. + +.. cfgcmd:: set protocols ospf area network + + This command specifies the OSPF enabled interface(s). If the interface has + an address from defined range then the command enables OSPF on this + interface so router can provide network information to the other ospf + routers via this interface. + + This command is also used to enable the OSPF process. The area number can be + specified in decimal notation in the range from 0 to 4294967295. Or it + can be specified in dotted decimal notation similar to ip address. + + Prefix length in interface must be equal or bigger (i.e. smaller network) + than prefix length in network statement. For example statement above doesn't + enable ospf on interface with address 192.168.1.1/23, but it does on + interface with address 192.168.1.129/25. + + In some cases it may be more convenient to enable OSPF on a per + interface/subnet + basis :cfgcmd:`set protocols ospf interface area ` + +.. cfgcmd:: set protocols ospf auto-cost reference-bandwidth + + This command sets the reference bandwidth for cost calculations, where + bandwidth can be in range from 1 to 4294967, specified in Mbits/s. The + default is 100Mbit/s (i.e. a link of bandwidth 100Mbit/s or higher will + have a cost of 1. Cost of lower bandwidth links will be scaled with + reference to this cost). + +.. cfgcmd:: set protocols ospf parameters router-id + + This command sets the router-ID of the OSPF process. The router-ID may be an + IP address of the router, but need not be – it can be any arbitrary 32bit + number. However it MUST be unique within the entire OSPF domain to the OSPF + speaker – bad things will happen if multiple OSPF speakers are configured + with the same router-ID! + + +Optional +-------- + +.. cfgcmd:: set protocols ospf default-information originate [always] + [metric ] [metric-type <1|2>] [route-map ] + + Originate an AS-External (type-5) LSA describing a default route into all + external-routing capable areas, of the specified metric and metric type. + If the :cfgcmd:`always` keyword is given then the default is always + advertised, even when there is no default present in the routing table. + The argument :cfgcmd:`route-map` specifies to advertise the default route + if the route map is satisfied. + +.. cfgcmd:: set protocols ospf distance global + + This command change distance value of OSPF globally. + The distance range is 1 to 255. + +.. cfgcmd:: set protocols ospf distance ospf + + + This command change distance value of OSPF. The arguments are the distance + values for external routes, inter-area routes and intra-area routes + respectively. The distance range is 1 to 255. + + .. note:: Routes with a distance of 255 are effectively disabled and not + installed into the kernel. + +.. cfgcmd:: set protocols ospf log-adjacency-changes [detail] + + This command allows to log changes in adjacency. With the optional + :cfgcmd:`detail` argument, all changes in adjacency status are shown. + Without :cfgcmd:`detail`, only changes to full or regressions are shown. + +.. cfgcmd:: set protocols ospf max-metric router-lsa + |on-startup > + + This enables :rfc:`3137` support, where the OSPF process describes its + transit links in its router-LSA as having infinite distance so that other + routers will avoid calculating transit paths through the router while + still being able to reach networks through the router. + + This support may be enabled administratively (and indefinitely) with the + :cfgcmd:`administrative` command. It may also be enabled conditionally. + Conditional enabling of max-metric router-lsas can be for a period of + seconds after startup with the :cfgcmd:`on-startup ` command + and/or for a period of seconds prior to shutdown with the + :cfgcmd:`on-shutdown ` command. The time range is 5 to 86400. + +.. cfgcmd:: set protocols ospf parameters abr-type + + + This command selects ABR model. OSPF router supports four ABR models: + + **cisco** – a router will be considered as ABR if it has several configured + links to the networks in different areas one of which is a backbone area. + Moreover, the link to the backbone area should be active (working). + **ibm** – identical to "cisco" model but in this case a backbone area link + may not be active. + **standard** – router has several active links to different areas. + **shortcut** – identical to "standard" but in this model a router is + allowed to use a connected areas topology without involving a backbone + area for inter-area connections. + + Detailed information about "cisco" and "ibm" models differences can be + found in :rfc:`3509`. A "shortcut" model allows ABR to create routes + between areas based on the topology of the areas connected to this router + but not using a backbone area in case if non-backbone route will be + cheaper. For more information about "shortcut" model, + see :t:`ospf-shortcut-abr-02.txt` + +.. cfgcmd:: set protocols ospf parameters rfc1583-compatibility + + :rfc:`2328`, the successor to :rfc:`1583`, suggests according to section + G.2 (changes) in section 16.4.1 a change to the path preference algorithm + that prevents possible routing loops that were possible in the old version + of OSPFv2. More specifically it demands that inter-area paths and + intra-area backbone path are now of equal preference but still both + preferred to external paths. + + This command should NOT be set normally. + +.. cfgcmd:: set protocols ospf interface passive [disable] + + This command specifies interface as passive. Passive interface advertises + its address, but does not run the OSPF protocol (adjacencies are not formed + and hello packets are not generated). + + The optional `disable` option allows to exclude interface from passive state. + This command is used if the command :cfgcmd:`passive-interface default` was + configured. + +.. cfgcmd:: set protocols ospf passive-interface default + + This command specifies all interfaces as passive by default. Because this + command changes the configuration logic to a default passive; therefore, + interfaces where router adjacencies are expected need to be configured + by setting the :cfgcmd:`passive disable` flag for the specific interface. + +.. cfgcmd:: set protocols ospf maximum-paths <1-64> + + Use this command to control the maximum number of equal cost paths to reach + a specific destination. The upper limit may differ if you change the value + of MULTIPATH_NUM during compilation. The default is MULTIPATH_NUM (64). + +.. cfgcmd:: set protocols ospf refresh timers + + The router automatically updates link-state information with its neighbors. + Only an obsolete information is updated which age has exceeded a specific + threshold. This parameter changes a threshold value, which by default is + 1800 seconds (half an hour). The value is applied to the whole OSPF router. + The timer range is 10 to 1800. + +.. cfgcmd:: set protocols ospf timers throttle spf + + + This command sets the initial delay, the initial-holdtime and the + maximum-holdtime between when SPF is calculated and the event which + triggered the calculation. The times are specified in milliseconds and must + be in the range of 0 to 600000 milliseconds. :cfgcmd:`delay` sets the + initial SPF schedule delay in milliseconds. The default value is 200 ms. + :cfgcmd:`initial-holdtime` sets the minimum hold time between two + consecutive SPF calculations. The default value is 1000 ms. + :cfgcmd:`max-holdtime` sets the maximum wait time between two + consecutive SPF calculations. The default value is 10000 ms. + +.. cfgcmd:: set protocols ospf ldp-sync + + This command will enable IGP-LDP synchronization globally for OSPF. This + requires for LDP to be functional. This is described in :rfc:`5443`. By + default all interfaces operational in OSPF are enabled for synchronization. + Loopbacks are exempt. + +.. cfgcmd:: set protocols ospf ldp-sync holddown + + This command will change the hold down value globally for IGP-LDP + synchronization during convergence/interface flap events. + +.. cfgcmd:: set protocols ospf capability opaque + + ospfd supports Opaque LSA :rfc:`2370` as partial support for MPLS Traffic + Engineering LSAs. The opaque-lsa capability must be enabled in the + configuration. + + An alternate command could be "mpls-te on" (Traffic Engineering) + + .. note:: FRR offers only partial support for some of the routing + protocol extensions that are used with MPLS-TE; it does not + support a complete RSVP-TE solution. + +Area Configuration +------------------ + +.. cfgcmd:: set protocols ospf area area-type stub + + This command specifies the area to be a Stub Area. That is, an area where + no router originates routes external to OSPF and hence an area where all + external routes are via the ABR(s). Hence, ABRs for such an area do not + need to pass AS-External LSAs (type-5) or ASBR-Summary LSAs (type-4) into + the area. They need only pass Network-Summary (type-3) LSAs into such an + area, along with a default-route summary. + +.. cfgcmd:: set protocols ospf area area-type stub no-summary + + This command specifies the area to be a Totally Stub Area. In addition to + stub area limitations this area type prevents an ABR from injecting + Network-Summary (type-3) LSAs into the specified stub area. Only default + summary route is allowed. + +.. cfgcmd:: set protocols ospf area area-type stub default-cost + + + This command sets the cost of default-summary LSAs announced to stubby + areas. The cost range is 0 to 16777215. + +.. cfgcmd:: set protocols ospf area area-type nssa + + This command specifies the area to be a Not So Stubby Area. External + routing information is imported into an NSSA in Type-7 LSAs. Type-7 LSAs + are similar to Type-5 AS-external LSAs, except that they can only be + flooded into the NSSA. In order to further propagate the NSSA external + information, the Type-7 LSA must be translated to a Type-5 AS-external-LSA + by the NSSA ABR. + +.. cfgcmd:: set protocols ospf area area-type nssa no-summary + + This command specifies the area to be a NSSA Totally Stub Area. ABRs for + such an area do not need to pass Network-Summary (type-3) LSAs (except the + default summary route), ASBR-Summary LSAs (type-4) and AS-External LSAs + (type-5) into the area. But Type-7 LSAs that convert to Type-5 at the NSSA + ABR are allowed. + +.. cfgcmd:: set protocols ospf area area-type nssa default-cost + + + This command sets the default cost of LSAs announced to NSSA areas. + The cost range is 0 to 16777215. + +.. cfgcmd:: set protocols ospf area area-type nssa translate + + + Specifies whether this NSSA border router will unconditionally translate + Type-7 LSAs into Type-5 LSAs. When role is Always, Type-7 LSAs are + translated into Type-5 LSAs regardless of the translator state of other + NSSA border routers. When role is Candidate, this router participates in + the translator election to determine if it will perform the translations + duties. When role is Never, this router will never translate Type-7 LSAs + into Type-5 LSAs. + +.. cfgcmd:: set protocols ospf area authentication plaintext-password + + This command specifies that simple password authentication should be used + for the given area. The password must also be configured on a per-interface + basis. + +.. cfgcmd:: set protocols ospf area authentication md5 + + This command specify that OSPF packets must be authenticated with MD5 HMACs + within the given area. Keying material must also be configured on a + per-interface basis. + +.. cfgcmd:: set protocols ospf area range [cost ] + + This command summarizes intra area paths from specified area into one + summary-LSA (Type-3) announced to other areas. This command can be used + only in ABR and ONLY router-LSAs (Type-1) and network-LSAs (Type-2) + (i.e. LSAs with scope area) can be summarized. AS-external-LSAs (Type-5) + can’t be summarized - their scope is AS. The optional argument + :cfgcmd:`cost` specifies the aggregated link metric. The metric range is 0 + to 16777215. + +.. cfgcmd:: set protocols ospf area range not-advertise + + This command instead of summarizing intra area paths filter them - i.e. + intra area paths from this range are not advertised into other areas. + This command makes sense in ABR only. + +.. cfgcmd:: set protocols ospf area export-list + + Filter Type-3 summary-LSAs announced to other areas originated from + intra- area paths from specified area. + This command makes sense in ABR only. + +.. cfgcmd:: set protocols ospf area import-list + + Same as export-list, but it applies to paths announced into specified + area as Type-3 summary-LSAs. + This command makes sense in ABR only. + +.. cfgcmd:: set protocols ospf area range substitute + + + One Type-3 summary-LSA with routing info is announced into + backbone area if defined area contains at least one intra-area network + (i.e. described with router-LSA or network-LSA) from range . + This command makes sense in ABR only. + +.. cfgcmd:: set protocols ospf area shortcut + + This parameter allows to "shortcut" routes (non-backbone) for inter-area + routes. There are three modes available for routes shortcutting: + + **default** – this area will be used for shortcutting only if ABR does not + have a link to the backbone area or this link was lost. + **enable** – the area will be used for shortcutting every time the route + that goes through it is cheaper. + **disable** – this area is never used by ABR for routes shortcutting. + +.. cfgcmd:: set protocols ospf area virtual-link + + Provides a backbone area coherence by virtual link establishment. + + In general, OSPF protocol requires a backbone area (area 0) to be coherent + and fully connected. I.e. any backbone area router must have a route to any + other backbone area router. Moreover, every ABR must have a link to + backbone area. However, it is not always possible to have a physical link + to a backbone area. In this case between two ABR (one of them has a link to + the backbone area) in the area (not stub area) a virtual link is organized. + + – area identifier through which a virtual link goes. + – ABR router-id with which a virtual link is established. Virtual + link must be configured on both routers. + + Formally, a virtual link looks like a point-to-point network connecting two + ABR from one area one of which physically connected to a backbone area. + This pseudo-network is considered to belong to a backbone area. + + +Interface Configuration +----------------------- + +.. cfgcmd:: set protocols ospf interface area + + Enable ospf on an interface and set associated area. + + If you have a lot of interfaces, and/or a lot of subnets, then enabling + OSPF via this command may result in a slight performance improvement. + +.. cfgcmd:: set protocols ospf interface authentication + plaintext-password + + This command sets OSPF authentication key to a simple password. After + setting, all OSPF packets are authenticated. Key has length up to 8 chars. + + Simple text password authentication is insecure and deprecated in favour of + MD5 HMAC authentication. + +.. cfgcmd:: set protocols ospf interface authentication md5 + key-id md5-key + + This command specifys that MD5 HMAC authentication must be used on this + interface. It sets OSPF authentication key to a cryptographic password. + Key-id identifies secret key used to create the message digest. This ID + is part of the protocol and must be consistent across routers on a link. + The key can be long up to 16 chars (larger strings will be truncated), + and is associated with the given key-id. + +.. cfgcmd:: set protocols ospf interface bandwidth + + This command sets the interface bandwidth for cost calculations, where + bandwidth can be in range from 1 to 100000, specified in Mbits/s. + +.. cfgcmd:: set protocols ospf interface cost + + This command sets link cost for the specified interface. The cost value is + set to router-LSA’s metric field and used for SPF calculation. The cost + range is 1 to 65535. + +.. cfgcmd:: set protocols ospf interface dead-interval + + Set number of seconds for router Dead Interval timer value used for Wait + Timer and Inactivity Timer. This value must be the same for all routers + attached to a common network. The default value is 40 seconds. The + interval range is 1 to 65535. + +.. cfgcmd:: set protocols ospf interface hello-multiplier + + The hello-multiplier specifies how many Hellos to send per second, from 1 + (every second) to 10 (every 100ms). Thus one can have 1s convergence time + for OSPF. If this form is specified, then the hello-interval advertised in + Hello packets is set to 0 and the hello-interval on received Hello packets + is not checked, thus the hello-multiplier need NOT be the same across + multiple routers on a common link. + +.. cfgcmd:: set protocols ospf interface hello-interval + + Set number of seconds for Hello Interval timer value. Setting this value, + Hello packet will be sent every timer value seconds on the specified + interface. This value must be the same for all routers attached to a + common network. The default value is 10 seconds. The interval range is 1 + to 65535. + +.. cfgcmd:: set protocols ospf interface bfd + + This command enables :abbr:`BFD (Bidirectional Forwarding Detection)` on + this OSPF link interface. + +.. cfgcmd:: set protocols ospf interface mtu-ignore + + This command disables check of the MTU value in the OSPF DBD packets. Thus, + use of this command allows the OSPF adjacency to reach the FULL state even + though there is an interface MTU mismatch between two OSPF routers. + +.. cfgcmd:: set protocols ospf interface network + + This command allows to specify the distribution type for the network + connected to this interface: + + **broadcast** – broadcast IP addresses distribution. + **non-broadcast** – address distribution in NBMA networks topology. + **point-to-multipoint** – address distribution in point-to-multipoint + networks. + **point-to-point** – address distribution in point-to-point networks. + +.. cfgcmd:: set protocols ospf interface priority + + This command sets Router Priority integer value. The router with the + highest priority will be more eligible to become Designated Router. + Setting the value to 0, makes the router ineligible to become + Designated Router. The default value is 1. The interval range is 0 to 255. + +.. cfgcmd:: set protocols ospf interface retransmit-interval + + + This command sets number of seconds for RxmtInterval timer value. This + value is used when retransmitting Database Description and Link State + Request packets if acknowledge was not received. The default value is 5 + seconds. The interval range is 3 to 65535. + +.. cfgcmd:: set protocols ospf interface transmit-delay + + This command sets number of seconds for InfTransDelay value. It allows to + set and adjust for each interface the delay interval before starting the + synchronizing process of the router's database with all neighbors. The + default value is 1 seconds. The interval range is 3 to 65535. + +.. cfgcmd:: set protocols ospf interface ldp-sync disable + + This command disables IGP-LDP sync for this specific interface. + +.. cfgcmd:: set protocols ospf interface ldp-sync holddown + + + This command will change the hold down value for IGP-LDP synchronization + during convergence/interface flap events, but for this interface only. + +External Route Summarisation +---------------------------- + +This feature summarises originated external LSAs (Type-5 and Type-7). Summary +Route will be originated on-behalf of all matched external LSAs. + +.. cfgcmd:: set protocols ospf aggregation timer + + Configure aggregation delay timer interval. + + Summarisation starts only after this delay timer expiry. + +.. cfgcmd:: set protocols ospf summary-address x.x.x.x/y [tag (1-4294967295)] + + This command enable/disables summarisation for the configured address range. + + Tag is the optional parameter. If tag configured Summary route will be + originated with the configured tag. + +.. cfgcmd:: set protocols ospf summary-address x.x.x.x/y no-advertise + + This command to ensure not advertise the summary lsa for the matched + external LSAs. + +Graceful Restart +---------------- + +.. cfgcmd:: set protocols ospf graceful-restart [grace-period (1-1800)] + + Configure Graceful Restart :rfc:`3623` restarting support. When enabled, + the default grace period is 120 seconds. + + To perform a graceful shutdown, the FRR ``graceful-restart prepare ip + ospf`` EXEC-level command needs to be issued before restarting the + ospfd daemon. + +.. cfgcmd:: set protocols ospf graceful-restart helper enable [router-id A.B.C.D] + + Configure Graceful Restart :rfc:`3623` helper support. By default, helper support + is disabled for all neighbours. This config enables/disables helper support + on this router for all neighbours. + + To enable/disable helper support for a specific neighbour, the router-id + (A.B.C.D) has to be specified. + +.. cfgcmd:: set protocols ospf graceful-restart helper no-strict-lsa-checking + + By default `strict-lsa-checking` is configured then the helper will abort + the Graceful Restart when a LSA change occurs which affects the restarting + router. + + This command disables it. + +.. cfgcmd:: set protocols ospf graceful-restart helper supported-grace-time + + Supports as HELPER for configured grace period. + +.. cfgcmd:: set protocols ospf graceful-restart helper planned-only + + It helps to support as HELPER only for planned restarts. + + By default, it supports both planned and unplanned outages. + +Manual Neighbor Configuration +----------------------------- + +OSPF routing devices normally discover their neighbors dynamically by +listening to the broadcast or multicast hello packets on the network. +Because an NBMA network does not support broadcast (or multicast), the +device cannot discover its neighbors dynamically, so you must configure all +the neighbors statically. + +.. cfgcmd:: set protocols ospf neighbor + + This command specifies the IP address of the neighboring device. + +.. cfgcmd:: set protocols ospf neighbor poll-interval + + This command specifies the length of time, in seconds, before the routing + device sends hello packets out of the interface before it establishes + adjacency with a neighbor. The range is 1 to 65535 seconds. The default + value is 60 seconds. + +.. cfgcmd:: set protocols ospf neighbor priority + + This command specifies the router priority value of the nonbroadcast + neighbor associated with the IP address specified. The default is 0. + This keyword does not apply to point-to-multipoint interfaces. + + +Redistribution Configuration +---------------------------- + +.. cfgcmd:: set protocols ospf redistribute + + This command redistributes routing information from the given route source + to the OSPF process. There are five modes available for route source: bgp, + connected, kernel, rip, static. + +.. cfgcmd:: set protocols ospf default-metric + + This command specifies the default metric value of redistributed routes. + The metric range is 0 to 16777214. + +.. cfgcmd:: set protocols ospf redistribute metric + + This command specifies metric for redistributed routes from the given + route source. There are five modes available for route source: bgp, + connected, kernel, rip, static. The metric range is 1 to 16777214. + +.. cfgcmd:: set protocols ospf redistribute metric-type <1|2> + + This command specifies metric type for redistributed routes. Difference + between two metric types that metric type 1 is a metric which is + "commensurable" with inner OSPF links. When calculating a metric to the + external destination, the full path metric is calculated as a metric sum + path of a router which had advertised this link plus the link metric. + Thus, a route with the least summary metric will be selected. If external + link is advertised with metric type 2 the path is selected which lies + through the router which advertised this link with the least metric + despite of the fact that internal path to this router is longer (with more + cost). However, if two routers advertised an external link and with metric + type 2 the preference is given to the path which lies through the router + with a shorter internal path. If two different routers advertised two + links to the same external destimation but with different metric type, + metric type 1 is preferred. If type of a metric left undefined the router + will consider these external links to have a default metric type 2. + +.. cfgcmd:: set protocols ospf redistribute route-map + + This command allows to use route map to filter redistributed routes from + the given route source. There are five modes available for route source: + bgp, connected, kernel, rip, static. + + +Operational Mode Commands +------------------------- + +.. opcmd:: show ip ospf neighbor + + This command displays the neighbors status. + +.. code-block:: none + + Neighbor ID Pri State Dead Time Address Interface RXmtL RqstL DBsmL + 10.0.13.1 1 Full/DR 38.365s 10.0.13.1 eth0:10.0.13.3 0 0 0 + 10.0.23.2 1 Full/Backup 39.175s 10.0.23.2 eth1:10.0.23.3 0 0 0 + +.. opcmd:: show ip ospf neighbor detail + + This command displays the neighbors information in a detailed form, not + just a summary table. + +.. code-block:: none + + Neighbor 10.0.13.1, interface address 10.0.13.1 + In the area 0.0.0.0 via interface eth0 + Neighbor priority is 1, State is Full, 5 state changes + Most recent state change statistics: + Progressive change 11m55s ago + DR is 10.0.13.1, BDR is 10.0.13.3 + Options 2 *|-|-|-|-|-|E|- + Dead timer due in 34.854s + Database Summary List 0 + Link State Request List 0 + Link State Retransmission List 0 + Thread Inactivity Timer on + Thread Database Description Retransmision off + Thread Link State Request Retransmission on + Thread Link State Update Retransmission on + + Neighbor 10.0.23.2, interface address 10.0.23.2 + In the area 0.0.0.1 via interface eth1 + Neighbor priority is 1, State is Full, 4 state changes + Most recent state change statistics: + Progressive change 41.193s ago + DR is 10.0.23.3, BDR is 10.0.23.2 + Options 2 *|-|-|-|-|-|E|- + Dead timer due in 35.661s + Database Summary List 0 + Link State Request List 0 + Link State Retransmission List 0 + Thread Inactivity Timer on + Thread Database Description Retransmision off + Thread Link State Request Retransmission on + Thread Link State Update Retransmission on + +.. opcmd:: show ip ospf neighbor + + This command displays the neighbors information in a detailed form for a + neighbor whose IP address is specified. + +.. opcmd:: show ip ospf neighbor + + This command displays the neighbors status for a neighbor on the specified + interface. + +.. opcmd:: show ip ospf interface [] + + This command displays state and configuration of OSPF the specified + interface, or all interfaces if no interface is given. + +.. code-block:: none + + eth0 is up + ifindex 2, MTU 1500 bytes, BW 4294967295 Mbit + Internet Address 10.0.13.3/24, Broadcast 10.0.13.255, Area 0.0.0.0 + MTU mismatch detection: enabled + Router ID 10.0.23.3, Network Type BROADCAST, Cost: 1 + Transmit Delay is 1 sec, State Backup, Priority 1 + Backup Designated Router (ID) 10.0.23.3, Interface Address 10.0.13.3 + Multicast group memberships: OSPFAllRouters OSPFDesignatedRouters + Timer intervals configured, Hello 10s, Dead 40s, Wait 40s, Retransmit 5 + Hello due in 4.470s + Neighbor Count is 1, Adjacent neighbor count is 1 + eth1 is up + ifindex 3, MTU 1500 bytes, BW 4294967295 Mbit + Internet Address 10.0.23.3/24, Broadcast 10.0.23.255, Area 0.0.0.1 + MTU mismatch detection: enabled + Router ID 10.0.23.3, Network Type BROADCAST, Cost: 1 + Transmit Delay is 1 sec, State DR, Priority 1 + Backup Designated Router (ID) 10.0.23.2, Interface Address 10.0.23.2 + Saved Network-LSA sequence number 0x80000002 + Multicast group memberships: OSPFAllRouters OSPFDesignatedRouters + Timer intervals configured, Hello 10s, Dead 40s, Wait 40s, Retransmit 5 + Hello due in 4.563s + Neighbor Count is 1, Adjacent neighbor count is 1 + +.. opcmd:: show ip ospf route [detail] + + This command displays the OSPF routing table, as determined by the most + recent SPF calculation. With the optional :cfgcmd:`detail` argument, + each route item's advertiser router and network attribute will be shown. + +.. code-block:: none + + ============ OSPF network routing table ============ + N IA 10.0.12.0/24 [3] area: 0.0.0.0 + via 10.0.13.3, eth0 + N 10.0.13.0/24 [1] area: 0.0.0.0 + directly attached to eth0 + N IA 10.0.23.0/24 [2] area: 0.0.0.0 + via 10.0.13.3, eth0 + N 10.0.34.0/24 [2] area: 0.0.0.0 + via 10.0.13.3, eth0 + + ============ OSPF router routing table ============= + R 10.0.23.3 [1] area: 0.0.0.0, ABR + via 10.0.13.3, eth0 + R 10.0.34.4 [2] area: 0.0.0.0, ASBR + via 10.0.13.3, eth0 + + ============ OSPF external routing table =========== + N E2 172.16.0.0/24 [2/20] tag: 0 + via 10.0.13.3, eth0 + +The table consists of following data: + +**OSPF network routing table** – includes a list of acquired routes for all +accessible networks (or aggregated area ranges) of OSPF system. "IA" flag +means that route destination is in the area to which the router is not +connected, i.e. it’s an inter-area path. In square brackets a summary metric +for all links through which a path lies to this network is specified. "via" +prefix defines a router-gateway, i.e. the first router on the way to the +destination (next hop). +**OSPF router routing table** – includes a list of acquired routes to all +accessible ABRs and ASBRs. +**OSPF external routing table** – includes a list of acquired routes that are +external to the OSPF process. "E" flag points to the external link metric type +(E1 – metric type 1, E2 – metric type 2). External link metric is printed in +the "/" format. + +.. opcmd:: show ip ospf border-routers + + This command displays a table of paths to area boundary and autonomous + system boundary routers. + +.. opcmd:: show ip ospf database + + This command displays a summary table with a database contents (LSA). + +.. code-block:: none + + OSPF Router with ID (10.0.13.1) + + Router Link States (Area 0.0.0.0) + + Link ID ADV Router Age Seq# CkSum Link count + 10.0.13.1 10.0.13.1 984 0x80000005 0xd915 1 + 10.0.23.3 10.0.23.3 1186 0x80000008 0xfe62 2 + 10.0.34.4 10.0.34.4 1063 0x80000004 0x4e3f 1 + + Net Link States (Area 0.0.0.0) + + Link ID ADV Router Age Seq# CkSum + 10.0.13.1 10.0.13.1 994 0x80000003 0x30bb + 10.0.34.4 10.0.34.4 1188 0x80000001 0x9411 + + Summary Link States (Area 0.0.0.0) + + Link ID ADV Router Age Seq# CkSum Route + 10.0.12.0 10.0.23.3 1608 0x80000001 0x6ab6 10.0.12.0/24 + 10.0.23.0 10.0.23.3 981 0x80000003 0xe232 10.0.23.0/24 + + AS External Link States + + Link ID ADV Router Age Seq# CkSum Route + 172.16.0.0 10.0.34.4 1063 0x80000001 0xc40d E2 172.16.0.0/24 [0x0] + +.. opcmd:: show ip ospf database [A.B.C.D] + [adv-router |self-originate] + + This command displays a database contents for a specific link advertisement + type. + + The type can be the following: + asbr-summary, external, network, nssa-external, opaque-area, opaque-as, + opaque-link, router, summary. + + [A.B.C.D] – link-state-id. With this specified the command displays portion + of the network environment that is being described by the advertisement. + The value entered depends on the advertisement’s LS type. It must be + entered in the form of an IP address. + + :cfgcmd:`adv-router ` – router id, which link advertisements need + to be reviewed. + + :cfgcmd:`self-originate` displays only self-originated LSAs from the local + router. + +.. code-block:: none + + OSPF Router with ID (10.0.13.1) + + Router Link States (Area 0.0.0.0) + + LS age: 1213 + Options: 0x2 : *|-|-|-|-|-|E|- + LS Flags: 0x3 + Flags: 0x0 + LS Type: router-LSA + Link State ID: 10.0.13.1 + Advertising Router: 10.0.13.1 + LS Seq Number: 80000009 + Checksum: 0xd119 + Length: 36 + + Number of Links: 1 + + Link connected to: a Transit Network + (Link ID) Designated Router address: 10.0.13.1 + (Link Data) Router Interface address: 10.0.13.1 + Number of TOS metrics: 0 + TOS 0 Metric: 1 + +.. opcmd:: show ip ospf database max-age + + This command displays LSAs in MaxAge list. + + +Examples +-------- + + +Enable OSPF +^^^^^^^^^^^ + +**Node 1** + +.. code-block:: none + + set interfaces loopback lo address 10.1.1.1/32 + set interfaces ethernet eth0 address 192.168.0.1/24 + set protocols ospf area 0 network 192.168.0.0/24 + set protocols ospf area 0 network 10.1.1.1/32 + set protocols ospf parameters router-id 10.1.1.1 + +**Node 2** + +.. code-block:: none + + set interfaces loopback lo address 10.1.1.2/32 + set interfaces ethernet eth0 address 192.168.0.2/24 + set protocols ospf area 0 network 192.168.0.0/24 + set protocols ospf area 0 network 10.1.1.2/32 + set protocols ospf parameters router-id 10.1.1.2 + + + +Here's the neighbors up: + +.. code-block:: none + + Node-1@vyos:~$ show ip ospf neighbor + + Neighbor ID Pri State Up Time Dead Time Address Interface RXmtL RqstL DBsmL + 10.1.1.2 1 Full/DR 3m43s 36.094s 192.168.0.2 eth0:192.168.0.1 0 0 0 + + + + Node-2@vyos:~$ show ip ospf neighbor + + Neighbor ID Pri State Up Time Dead Time Address Interface RXmtL RqstL DBsmL + 10.1.1.1 1 Full/Backup 3m47s 31.736s 192.168.0.1 eth0:192.168.0.2 0 0 0 + +Here's the routes: + +.. code-block:: none + + Node-1@vyos:~$ show ip route ospf + Codes: K - kernel route, C - connected, S - static, R - RIP, + O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP, + T - Table, v - VNC, V - VNC-Direct, A - Babel, F - PBR, + f - OpenFabric, + > - selected route, * - FIB route, q - queued, r - rejected, b - backup + t - trapped, o - offload failure + + O 10.1.1.1/32 [110/0] is directly connected, lo, weight 1, 00:00:14 + O>* 10.1.1.2/32 [110/1] via 192.168.0.2, eth0, weight 1, 00:00:07 + O 192.168.0.0/24 [110/1] is directly connected, eth0, weight 1, 00:03:32 + + Node-2@vyos:~$ show ip route ospf + Codes: K - kernel route, C - connected, S - static, R - RIP, + O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP, + T - Table, v - VNC, V - VNC-Direct, A - Babel, F - PBR, + f - OpenFabric, + > - selected route, * - FIB route, q - queued, r - rejected, b - backup + t - trapped, o - offload failure + + O>* 10.1.1.1/32 [110/1] via 192.168.0.1, eth0, weight 1, 00:00:11 + O 10.1.1.2/32 [110/0] is directly connected, lo, weight 1, 00:00:04 + O 192.168.0.0/24 [110/1] is directly connected, eth0, weight 1, 00:03:18 + + + + + +Enable OSPF with route redistribution of the loopback and default originate: +^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ + +**Node 1** + +.. code-block:: none + + set interfaces loopback lo address 10.1.1.1/32 + set protocols ospf area 0 network 192.168.0.0/24 + set protocols ospf default-information originate always + set protocols ospf default-information originate metric 10 + set protocols ospf default-information originate metric-type 2 + set protocols ospf log-adjacency-changes + set protocols ospf parameters router-id 10.1.1.1 + set protocols ospf redistribute connected metric-type 2 + set protocols ospf redistribute connected route-map CONNECT + + set policy route-map CONNECT rule 10 action permit + set policy route-map CONNECT rule 10 match interface lo + +**Node 2** + +.. code-block:: none + + set interfaces loopback lo address 10.2.2.2/32 + set protocols ospf area 0 network 192.168.0.0/24 + set protocols ospf log-adjacency-changes + set protocols ospf parameters router-id 10.2.2.2 + set protocols ospf redistribute connected metric-type 2 + set protocols ospf redistribute connected route-map CONNECT + + set policy route-map CONNECT rule 10 action permit + set policy route-map CONNECT rule 10 match interface lo + + +Enable OSPF and IGP-LDP synchronization: +^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ + +**Node 1:** + +.. code-block:: none + + set interfaces loopback lo address 10.1.1.1/32 + set interfaces ethernet eth0 address 192.168.0.1/24 + + set protocols ospf area 0 network '192.168.0.0/24' + set protocols ospf area 0 network '10.1.1.1/32' + set protocols ospf parameters router-id '10.1.1.1' + set protocols ospf ldp-sync + + set protocols mpls interface eth0 + set protocols mpls ldp discovery transport-ipv4-address 10.1.1.1 + set protocols mpls ldp interface lo + set protocols mpls ldp interface eth0 + set protocols mpls ldp parameters transport-prefer-ipv4 + set protocols mpls ldp router-id 10.1.1.1 + + +This gives us IGP-LDP synchronization for all non-loopback interfaces with +a holddown timer of zero seconds: + + +.. code-block:: none + + Node-1@vyos:~$ show ip ospf mpls ldp-sync + eth0 + LDP-IGP Synchronization enabled: yes + Holddown timer in seconds: 0 + State: Sync achieved + + + +Enable OSPF with Segment Routing (Experimental): +^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ + +**Node 1** + +.. code-block:: none + + set interfaces loopback lo address 10.1.1.1/32 + set interfaces ethernet eth0 address 192.168.0.1/24 + + set protocols ospf area 0 network '192.168.0.0/24' + set protocols ospf area 0 network '10.1.1.1/32' + set protocols ospf parameters opaque-lsa + set protocols ospf parameters router-id '10.1.1.1' + set protocols ospf segment-routing global-block high-label-value '1100' + set protocols ospf segment-routing global-block low-label-value '1000' + set protocols ospf segment-routing prefix 10.1.1.1/32 index explicit-null + set protocols ospf segment-routing prefix 10.1.1.1/32 index value '1' + +**Node 2** + +.. code-block:: none + + set interfaces loopback lo address 10.1.1.2/32 + set interfaces ethernet eth0 address 192.168.0.2/24 + + set protocols ospf area 0 network '192.168.0.0/24' + set protocols ospf area 0 network '10.1.1.2/32' + set protocols ospf parameters opaque-lsa + set protocols ospf parameters router-id '10.1.1.2' + set protocols ospf segment-routing global-block high-label-value '1100' + set protocols ospf segment-routing global-block low-label-value '1000' + set protocols ospf segment-routing prefix 10.1.1.2/32 index explicit-null + set protocols ospf segment-routing prefix 10.1.1.2/32 index value '2' + + +This gives us MPLS segment routing enabled and labels for far end loopbacks: + +.. code-block:: none + + Node-1@vyos:~$ show mpls table + Inbound Label Type Nexthop Outbound Label + ----------------------------------------------------------- + 1002 SR (OSPF) 192.168.0.2 IPv4 Explicit Null <-- Node-2 loopback learned on Node-1 + 15000 SR (OSPF) 192.168.0.2 implicit-null + 15001 SR (OSPF) 192.168.0.2 implicit-null + + Node-2@vyos:~$ show mpls table + Inbound Label Type Nexthop Outbound Label + ----------------------------------------------------------- + 1001 SR (OSPF) 192.168.0.1 IPv4 Explicit Null <-- Node-1 loopback learned on Node-2 + 15000 SR (OSPF) 192.168.0.1 implicit-null + 15001 SR (OSPF) 192.168.0.1 implicit-null + +Here is the routing tables showing the MPLS segment routing label operations: + +.. code-block:: none + + Node-1@vyos:~$ show ip route ospf + Codes: K - kernel route, C - connected, S - static, R - RIP, + O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP, + T - Table, v - VNC, V - VNC-Direct, A - Babel, F - PBR, + f - OpenFabric, + > - selected route, * - FIB route, q - queued, r - rejected, b - backup + t - trapped, o - offload failure + + O 10.1.1.1/32 [110/0] is directly connected, lo, weight 1, 00:03:43 + O>* 10.1.1.2/32 [110/1] via 192.168.0.2, eth0, label IPv4 Explicit Null, weight 1, 00:03:32 + O 192.168.0.0/24 [110/1] is directly connected, eth0, weight 1, 00:03:43 + + Node-2@vyos:~$ show ip route ospf + Codes: K - kernel route, C - connected, S - static, R - RIP, + O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP, + T - Table, v - VNC, V - VNC-Direct, A - Babel, F - PBR, + f - OpenFabric, + > - selected route, * - FIB route, q - queued, r - rejected, b - backup + t - trapped, o - offload failure + + O>* 10.1.1.1/32 [110/1] via 192.168.0.1, eth0, label IPv4 Explicit Null, weight 1, 00:03:36 + O 10.1.1.2/32 [110/0] is directly connected, lo, weight 1, 00:03:51 + O 192.168.0.0/24 [110/1] is directly connected, eth0, weight 1, 00:03:51 + + + + +.. _routing-ospfv3: + +************* +OSPFv3 (IPv6) +************* + +.. _ospf:v3_configuration: + +Configuration +============= + +.. _ospf:v3_general: + +General +------- + +VyOS does not have a special command to start the OSPFv3 process. The OSPFv3 +process starts when the first ospf enabled interface is configured. + +.. cfgcmd:: set protocols ospfv3 interface area + + This command specifies the OSPFv3 enabled interface. This command is also + used to enable the OSPF process. The area number can be specified in + decimal notation in the range from 0 to 4294967295. Or it can be specified + in dotted decimal notation similar to ip address. + +.. cfgcmd:: set protocols ospfv3 parameters router-id + + This command sets the router-ID of the OSPFv3 process. The router-ID may be + an IP address of the router, but need not be – it can be any arbitrary + 32bit number. However it MUST be unique within the entire OSPFv3 domain to + the OSPFv3 speaker – bad things will happen if multiple OSPFv3 speakers are + configured with the same router-ID! + + +.. _ospf:v3_optional: + +Optional +-------- + +.. cfgcmd:: set protocols ospfv3 distance global + + This command change distance value of OSPFv3 globally. + The distance range is 1 to 255. + +.. cfgcmd:: set protocols ospfv3 distance ospfv3 + + + This command change distance value of OSPFv3. The arguments are the + distance values for external routes, inter-area routes and intra-area + routes respectively. The distance range is 1 to 255. + +.. _ospf:v3_area_configuration: + +Area Configuration +------------------ + +.. cfgcmd:: set protocols ospfv3 area range + + This command summarizes intra area paths from specified area into one + Type-3 Inter-Area Prefix LSA announced to other areas. This command can be + used only in ABR. + +.. cfgcmd:: set protocols ospfv3 area range not-advertise + + This command instead of summarizing intra area paths filter them - i.e. + intra area paths from this range are not advertised into other areas. This + command makes sense in ABR only. + +.. _ospf:v3_interface_config: + +Interface Configuration +----------------------- + +.. cfgcmd:: set protocols ospfv3 interface ipv6 cost + + This command sets link cost for the specified interface. The cost value is + set to router-LSA’s metric field and used for SPF calculation. The cost + range is 1 to 65535. + +.. cfgcmd:: set protocols ospfv3 interface dead-interval + + Set number of seconds for router Dead Interval timer value used for Wait + Timer and Inactivity Timer. This value must be the same for all routers + attached to a common network. The default value is 40 seconds. The + interval range is 1 to 65535. + +.. cfgcmd:: set protocols ospfv3 interface hello-interval + + + Set number of seconds for Hello Interval timer value. Setting this value, + Hello packet will be sent every timer value seconds on the specified + interface. This value must be the same for all routers attached to a + common network. The default value is 10 seconds. The interval range is 1 + to 65535. + +.. cfgcmd:: set protocols ospfv3 interface mtu-ignore + + This command disables check of the MTU value in the OSPF DBD packets. + Thus, use of this command allows the OSPF adjacency to reach the FULL + state even though there is an interface MTU mismatch between two OSPF + routers. + +.. cfgcmd:: set protocols ospfv3 interface network + + This command allows to specify the distribution type for the network + connected to this interface: + + **broadcast** – broadcast IP addresses distribution. + **point-to-point** – address distribution in point-to-point networks. + +.. cfgcmd:: set protocols ospfv3 interface priority + + This command sets Router Priority integer value. The router with the + highest priority will be more eligible to become Designated Router. + Setting the value to 0, makes the router ineligible to become Designated + Router. The default value is 1. The interval range is 0 to 255. + +.. cfgcmd:: set protocols ospfv3 interface passive + + This command specifies interface as passive. Passive interface advertises + its address, but does not run the OSPF protocol (adjacencies are not formed + and hello packets are not generated). + +.. cfgcmd:: set protocols ospfv3 interface retransmit-interval + + + This command sets number of seconds for RxmtInterval timer value. This + value is used when retransmitting Database Description and Link State + Request packets if acknowledge was not received. The default value is 5 + seconds. The interval range is 3 to 65535. + +.. cfgcmd:: set protocols ospfv3 interface transmit-delay + + + This command sets number of seconds for InfTransDelay value. It allows to + set and adjust for each interface the delay interval before starting the + synchronizing process of the router's database with all neighbors. The + default value is 1 seconds. The interval range is 3 to 65535. + +.. _ospf:v3_graceful_restart: + +Graceful Restart +---------------- + +.. cfgcmd:: set protocols ospfv3 graceful-restart [grace-period (1-1800)] + + Configure Graceful Restart :rfc:`3623` restarting support. When enabled, + the default grace period is 120 seconds. + + To perform a graceful shutdown, the FRR ``graceful-restart prepare ip + ospf`` EXEC-level command needs to be issued before restarting the + ospfd daemon. + +.. cfgcmd:: set protocols ospfv3 graceful-restart helper enable [router-id A.B.C.D] + + Configure Graceful Restart :rfc:`3623` helper support. By default, helper support + is disabled for all neighbours. This config enables/disables helper support + on this router for all neighbours. + + To enable/disable helper support for a specific neighbour, the router-id + (A.B.C.D) has to be specified. + +.. cfgcmd:: set protocols ospfv3 graceful-restart helper lsa-check-disable + + By default `strict-lsa-checking` is configured then the helper will abort + the Graceful Restart when a LSA change occurs which affects the restarting + router. + + This command disables it. + +.. cfgcmd:: set protocols ospfv3 graceful-restart helper supported-grace-time + + Supports as HELPER for configured grace period. + +.. cfgcmd:: set protocols ospfv3 graceful-restart helper planned-only + + It helps to support as HELPER only for planned restarts. + + By default, it supports both planned and unplanned outages. + +.. _ospf:v3_redistribution_config: + +Redistribution Configuration +---------------------------- + +.. cfgcmd:: set protocols ospfv3 redistribute + + This command redistributes routing information from the given route source + to the OSPFv3 process. There are five modes available for route source: + bgp, connected, kernel, ripng, static. + +.. cfgcmd:: set protocols ospf redistribute route-map + + This command allows to use route map to filter redistributed routes from + given route source. There are five modes available for route source: bgp, + connected, kernel, ripng, static. + +.. _ospf:v3_op_cmd: + +Operational Mode Commands +------------------------- + +.. opcmd:: show ipv6 ospfv3 neighbor + + This command displays the neighbors status. + +.. opcmd:: show ipv6 ospfv3 neighbor detail + + This command displays the neighbors information in a detailed form, not + just a summary table. + +.. opcmd:: show ipv6 ospfv3 neighbor drchoice + + This command displays the neighbor DR choice information. + +.. opcmd:: show ipv6 ospfv3 interface [prefix]|[ [prefix]] + + This command displays state and configuration of OSPF the specified + interface, or all interfaces if no interface is given. Whith the argument + :cfgcmd:`prefix` this command shows connected prefixes to advertise. + +.. opcmd:: show ipv6 ospfv3 route + + This command displays the OSPF routing table, as determined by the most + recent SPF calculation. + +.. opcmd:: show ipv6 ospfv3 border-routers + + This command displays a table of paths to area boundary and autonomous + system boundary routers. + +.. opcmd:: show ipv6 ospfv3 database + + This command displays a summary table with a database contents (LSA). + +.. opcmd:: show ipv6 ospfv3 database [A.B.C.D] + [adv-router |self-originate] + + This command displays a database contents for a specific link + advertisement type. + +.. opcmd:: show ipv6 ospfv3 redistribute + + This command displays external information redistributed into OSPFv3 + +.. _ospf:v3_config_example: + +Configuration Example +--------------------- + +A typical configuration using 2 nodes. + +**Node 1:** + +.. code-block:: none + + set protocols ospfv3 interface eth1 area 0.0.0.0 + set protocols ospfv3 area 0.0.0.0 range 2001:db8:1::/64 + set protocols ospfv3 parameters router-id 192.168.1.1 + set protocols ospfv3 redistribute connected + +**Node 2:** + +.. code-block:: none + + set protocols ospfv3 interface eth1 area 0.0.0.0 + set protocols ospfv3 area 0.0.0.0 range 2001:db8:2::/64 + set protocols ospfv3 parameters router-id 192.168.2.1 + set protocols ospfv3 redistribute connected + +**To see the redistributed routes:** + +.. code-block:: none + + show ipv6 ospfv3 redistribute + +.. note:: You cannot easily redistribute IPv6 routes via OSPFv3 on a + WireGuard interface link. This requires you to configure link-local + addresses manually on the WireGuard interfaces, see :vytask:`T1483`. + +Example configuration for WireGuard interfaces: + +**Node 1** + +.. code-block:: none + + set interfaces wireguard wg01 address 'fe80::216:3eff:fe51:fd8c/64' + set interfaces wireguard wg01 address '192.168.0.1/24' + set interfaces wireguard wg01 peer ospf02 allowed-ips '::/0' + set interfaces wireguard wg01 peer ospf02 allowed-ips '0.0.0.0/0' + set interfaces wireguard wg01 peer ospf02 endpoint '10.1.1.101:12345' + set interfaces wireguard wg01 peer ospf02 pubkey 'ie3...=' + set interfaces wireguard wg01 port '12345' + set protocols ospfv3 parameters router-id 192.168.1.1 + set protocols ospfv3 interface 'wg01' area 0.0.0.0 + set protocols ospfv3 interface 'lo' area 0.0.0.0 + +**Node 2** + +.. code-block:: none + + set interfaces wireguard wg01 address 'fe80::216:3eff:fe0a:7ada/64' + set interfaces wireguard wg01 address '192.168.0.2/24' + set interfaces wireguard wg01 peer ospf01 allowed-ips '::/0' + set interfaces wireguard wg01 peer ospf01 allowed-ips '0.0.0.0/0' + set interfaces wireguard wg01 peer ospf01 endpoint '10.1.1.100:12345' + set interfaces wireguard wg01 peer ospf01 pubkey 'NHI...=' + set interfaces wireguard wg01 port '12345' + set protocols ospfv3 parameters router-id 192.168.1.2 + set protocols ospfv3 interface 'wg01' area 0.0.0.0 + set protocols ospfv3 interface 'lo' area 0.0.0.0 + +**Status** + +.. code-block:: none + + vyos@ospf01:~$ sh ipv6 ospfv3 neighbor + Neighbor ID Pri DeadTime State/IfState Duration I/F[State] + 192.168.0.2 1 00:00:37 Full/PointToPoint 00:18:03 wg01[PointToPoint] + + vyos@ospf02# run sh ipv6 ospfv3 neighbor + Neighbor ID Pri DeadTime State/IfState Duration I/F[State] + 192.168.0.1 1 00:00:39 Full/PointToPoint 00:19:44 wg01[PointToPoint] + diff --git a/docs/configuration/protocols/rst-pim.rst b/docs/configuration/protocols/rst-pim.rst new file mode 100644 index 00000000..2e881943 --- /dev/null +++ b/docs/configuration/protocols/rst-pim.rst @@ -0,0 +1,266 @@ +:lastproofread: 2023-11-13 + +.. _pim: + +#################################### +PIM – Protocol Independent Multicast +#################################### + +VyOS supports :abbr:`PIM-SM (PIM Sparse Mode)` as well as +:abbr:`IGMP (Internet Group Management Protocol)` v2 and v3 + +:abbr:`PIM (Protocol Independent Multicast)` must be configured in every +interface of every participating router. Every router must also have the +location of the Rendevouz Point manually configured. Then, unidirectional +shared trees rooted at the Rendevouz Point will automatically be built +for multicast distribution. + +Traffic from multicast sources will go to the Rendezvous Point, and +receivers will pull it from a shared tree using :abbr:`IGMP (Internet +Group Management Protocol)`. + +Multicast receivers will talk IGMP to their local router, so, besides +having PIM configured in every router, IGMP must also be configured in +any router where there could be a multicast receiver locally connected. + +VyOS supports both IGMP version 2 and version 3 (which allows +source-specific multicast). + +************************ +PIM-SM - PIM Sparse Mode +************************ + +.. cfgcmd:: set protocols pim ecmp + + If PIM has the a choice of ECMP nexthops for a particular + :abbr:`RPF (Reverse Path Forwarding)`, PIM will cause S,G flows to be + spread out amongst the nexthops. If this command is not specified then + the first nexthop found will be used. + +.. cfgcmd:: set protocols pim ecmp rebalance + + If PIM is using ECMP and an interface goes down, cause PIM to rebalance all + S,G flows across the remaining nexthops. If this command is not configured + PIM only modifies those S,G flows that were using the interface that went + down. + +.. cfgcmd:: set protocols pim join-prune-interval + + Modify the join/prune interval that PIM uses to the new value. Time is + specified in seconds. + + The default time is 60 seconds. + + If you enter a value smaller than 60 seconds be aware that this can and + will affect convergence at scale. + +.. cfgcmd:: set protocols pim keep-alive-timer + + Modify the time out value for a S,G flow from 1-65535 seconds. If choosing + a value below 31 seconds be aware that some hardware platforms cannot see + data flowing in better than 30 second chunks. + +.. cfgcmd:: set protocols pim packets + + When processing packets from a neighbor process the number of packets + incoming at one time before moving on to the next task. + + The default value is 3 packets. + + This command is only useful at scale when you can possibly have a large + number of PIM control packets flowing. + +.. cfgcmd:: set protocols pim register-accept-list + + When PIM receives a register packet the source of the packet will be compared + to the prefix-list specified, and if a permit is received normal processing + continues. If a deny is returned for the source address of the register packet + a register stop message is sent to the source. + +.. cfgcmd:: set protocols pim register-suppress-time + + Modify the time that pim will register suppress a FHR will send register + notifications to the kernel. + +.. cfgcmd:: set protocols pim rp
group + + In order to use PIM, it is necessary to configure a :abbr:`RP (Rendezvous Point)` + for join messages to be sent to. Currently the only methodology to do this is + via static rendezvous point commands. + + All routers in the PIM network must agree on these values. + + The first ip address is the RP's address and the second value is the matching + prefix of group ranges covered. + +.. cfgcmd:: set protocols pim rp keep-alive-timer + + Modify the time out value for a S,G flow from 1-65535 seconds at + :abbr:`RP (Rendezvous Point)`. The normal keepalive period for the KAT(S,G) + defaults to 210 seconds. However, at the :abbr:`RP (Rendezvous Point)`, the + keepalive period must be at least the Register_Suppression_Time, or the RP + may time out the (S,G) state before the next Null-Register arrives. + Thus, the KAT(S,G) is set to max(Keepalive_Period, RP_Keepalive_Period) + when a Register-Stop is sent. + + If choosing a value below 31 seconds be aware that some hardware platforms + cannot see data flowing in better than 30 second chunks. + + See :rfc:`7761#section-4.1` for details. + +.. cfgcmd:: set protocols pim no-v6-secondary + + When sending PIM hello packets tell PIM to not send any v6 secondary + addresses on the interface. This information is used to allow PIM to use v6 + nexthops in it's decision for :abbr:`RPF (Reverse Path Forwarding)` lookup + if this option is not set (default). + +.. cfgcmd:: set protocols pim spt-switchover infinity-and-beyond [prefix-list ] + + On the last hop router if it is desired to not switch over to the SPT tree + configure this command. + + Optional parameter prefix-list can be use to control which groups to switch or + not switch. If a group is PERMIT as per the prefix-list, then the SPT switchover + does not happen for it and if it is DENY, then the SPT switchover happens. + +.. cfgcmd:: set protocols pim ssm prefix-list + + Specify a range of group addresses via a prefix-list that forces PIM to never + do :abbr:`SSM (Source-Specific Multicast)` over. + +Interface specific commands +=========================== + +.. cfgcmd:: set protocols pim interface bfd [profile ] + + Automatically create BFD session for each RIP peer discovered in this + interface. When the BFD session monitor signalize that the link is down + the RIP peer is removed and all the learned routes associated with that + peer are removed. + + If optional profile parameter is used, select a BFD profile for the BFD + sessions created via this interface. + +.. cfgcmd:: set protocols pim interface dr-priority + + Set the :abbr:`DR (Designated Router)` Priority for the interface. + This command is useful to allow the user to influence what node becomes + the DR for a LAN segment. + +.. cfgcmd:: set protocols pim interface hello + + Set the PIM hello and hold interval for a interface. + +.. cfgcmd:: set protocols pim interface no-bsm + + Tell PIM that we would not like to use this interface to process + bootstrap messages. + +.. cfgcmd:: set protocols pim interface no-unicast-bsm + + Tell PIM that we would not like to use this interface to process + unicast bootstrap messages. + +.. cfgcmd:: set protocols pim interface passive + + Disable sending and receiving PIM control packets on the interface. + + .. cfgcmd:: set protocols pim interface source-address + + If you have multiple addresses configured on a particular interface and would + like PIM to use a specific source address associated with that interface. + +****************************************** +IGMP - Internet Group Management Protocol) +****************************************** + +.. cfgcmd:: set protocols pim igmp watermark-warning + + Configure watermark warning generation for an IGMP group limit. Generates + warning once the configured group limit is reached while adding new groups. + +.. _pim:igmp_interface_commands: + +Interface specific commands +=========================== + +.. cfgcmd:: set protocols pim interface igmp + join source-address + + Use this command to allow the selected interface to join a multicast + group defining the multicast address you want to join and the source + IP address too. + +.. cfgcmd:: set protocols pim interface igmp + query-interval + + Use this command to configure in the selected interface the IGMP + host query interval (1-1800) in seconds that PIM will use. + +.. cfgcmd:: set protocols pim interface igmp + query-max-response-time + + Use this command to configure in the selected interface the IGMP + query response timeout value (10-250) in deciseconds. If a report is + not returned in the specified time, it will be assumed the (S,G) or + (\*,G) state :rfc:`7761#section-4.1` has timed out. + +.. cfgcmd:: set protocols pim interface igmp version + + Use this command to define in the selected interface whether you + choose IGMP version 2 or 3. + + The default value is 3. + +Example +------- + +In the following example we can see a basic multicast setup: + +.. image:: /_static/images/multicast-basic.png + :width: 90% + :align: center + :alt: Network Topology Diagram + + + +**Router 1** + +.. code-block:: none + + set interfaces ethernet eth2 address '172.16.0.2/24' + set interfaces ethernet eth1 address '100.64.0.1/24' + set protocols ospf area 0 network '172.16.0.0/24' + set protocols ospf area 0 network '100.64.0.0/24' + set protocols igmp interface eth1 + set protocols pim interface eth1 + set protocols pim interface eth2 + set protocols pim rp address 172.16.255.1 group '224.0.0.0/4' + +**Router 3** + +.. code-block:: none + + set interfaces dummy dum0 address '172.16.255.1/24' + set interfaces ethernet eth0 address '172.16.0.1/24' + set interfaces ethernet eth1 address '172.16.1.1/24' + set protocols ospf area 0 network '172.16.0.0/24' + set protocols ospf area 0 network '172.16.255.0/24' + set protocols ospf area 0 network '172.16.1.0/24' + set protocols pim interface dum0 + set protocols pim interface eth0 + set protocols pim interface eth1 + set protocols pim rp address 172.16.255.1 group '224.0.0.0/4' + +**Router 2** + +.. code-block:: none + + set interfaces ethernet eth1 address '10.0.0.1/24' + set interfaces ethernet eth2 address '172.16.1.2/24' + set protocols ospf area 0 network '10.0.0.0/24' + set protocols ospf area 0 network '172.16.1.0/24' + set protocols pim interface eth1 + set protocols pim interface eth2 + set protocols pim rp address 172.16.255.1 group '224.0.0.0/4' diff --git a/docs/configuration/protocols/rst-pim6.rst b/docs/configuration/protocols/rst-pim6.rst new file mode 100644 index 00000000..2b2276a7 --- /dev/null +++ b/docs/configuration/protocols/rst-pim6.rst @@ -0,0 +1,94 @@ +.. _pim6: + +############################################## +PIM6 - Protocol Independent Multicast for IPv6 +############################################## + +VyOS facilitates IPv6 Multicast by supporting **PIMv6** and **MLD**. + +PIMv6 (Protocol Independent Multicast for IPv6) must be configured in every +interface of every participating router. Every router must also have the +location of the Rendevouz Point manually configured. +Then, unidirectional shared trees rooted at the Rendevouz Point will +automatically be built for multicast distribution. + +Traffic from multicast sources will go to the Rendezvous Point, and receivers +will pull it from a shared tree using MLD (Multicast Listener Discovery). + +Multicast receivers will talk MLD to their local router, so, besides having +PIMv6 configured in every router, MLD must also be configured in any router +where there could be a multicast receiver locally connected. + +VyOS supports both MLD version 1 and version 2 +(which allows source-specific multicast). + +Basic commands +============== +These are the commands for a basic setup. + +.. cfgcmd:: set protocols pim6 interface + + Use this command to enable PIMv6 in the selected interface so that it + can communicate with PIMv6 neighbors. This command also enables MLD reports + and query on the interface unless :cfgcmd:`mld disable` is configured. + +.. cfgcmd:: set protocols pim6 interface mld disable + + Disable MLD reports and query on the interface. + + +Tuning commands +=============== +You can also tune multicast with the following commands. + + +.. cfgcmd:: set protocols pim6 interface mld interval + + Use this command to configure in the selected interface the MLD + host query interval (1-65535) in seconds that PIM will use. + The default value is 125 seconds. + +.. cfgcmd:: set protocols pim6 interface mld join + + Use this command to allow the selected interface to join a multicast group. + +.. cfgcmd:: set protocols pim6 interface mld join source + + Use this command to allow the selected interface to join a source-specific multicast + group. + +.. cfgcmd:: set protocols pim6 interface mld last-member-query-count + + Set the MLD last member query count. The default value is 2. + +.. cfgcmd:: set protocols pim6 interface mld last-member-query-interval + + Set the MLD last member query interval in milliseconds (100-6553500). The default value is 1000 milliseconds. + +.. cfgcmd:: set protocols pim6 interface mld max-response-time + + Set the MLD query response timeout in milliseconds (100-6553500). The default value is 10000 milliseconds. + +.. cfgcmd:: set protocols pim6 interface mld version + + Set the MLD version used on this interface. The default value is 2. + +********************* +Configuration Example +********************* + +To enable MLD reports and query on interfaces `eth0` and `eth1`: + +.. code-block:: none + + set protocols pim6 interface eth0 + set protocols pim6 interface eth1 + +The following configuration explicitly joins multicast group `ff15::1234` on interface `eth1` +and source-specific multicast group `ff15::5678` with source address `2001:db8::1` on interface +`eth1`: + +.. code-block:: none + + set protocols pim6 interface eth0 mld join ff15::1234 + set protocols pim6 interface eth1 mld join ff15::5678 source 2001:db8::1 diff --git a/docs/configuration/protocols/rst-rip.rst b/docs/configuration/protocols/rst-rip.rst new file mode 100644 index 00000000..fd20a90c --- /dev/null +++ b/docs/configuration/protocols/rst-rip.rst @@ -0,0 +1,257 @@ +:lastproofread: 2021-10-04 + +.. _rip: + +### +RIP +### + +:abbr:`RIP (Routing Information Protocol)` is a widely deployed interior gateway +protocol. RIP was developed in the 1970s at Xerox Labs as part of the XNS +routing protocol. RIP is a distance-vector protocol and is based on the +Bellman-Ford algorithms. As a distance-vector protocol, RIP router send updates +to its neighbors periodically, thus allowing the convergence to a known +topology. In each update, the distance to any given network will be broadcast +to its neighboring router. + +Supported versions of RIP are: + + - RIPv1 as described in :rfc:`1058` + - RIPv2 as described in :rfc:`2453` + +General Configuration +--------------------- + +.. cfgcmd:: set protocols rip network + + This command enables RIP and sets the RIP enable interface by NETWORK. + The interfaces which have addresses matching with NETWORK are enabled. + +.. cfgcmd:: set protocols rip interface + + This command specifies a RIP enabled interface by interface name. Both + the sending and receiving of RIP packets will be enabled on the port + specified in this command. + +.. cfgcmd:: set protocols rip neighbor + + This command specifies a RIP neighbor. When a neighbor doesn’t understand + multicast, this command is used to specify neighbors. In some cases, not + all routers will be able to understand multicasting, where packets are + sent to a network or a group of addresses. In a situation where a neighbor + cannot process multicast packets, it is necessary to establish a direct + link between routers. + +.. cfgcmd:: set protocols rip passive-interface interface + + This command sets the specified interface to passive mode. On passive mode + interface, all receiving packets are processed as normal and VyOS does not + send either multicast or unicast RIP packets except to RIP neighbors + specified with neighbor command. + +.. cfgcmd:: set protocols rip passive-interface interface default + + This command specifies all interfaces to passive mode. + + +Optional Configuration +---------------------- + +.. cfgcmd:: set protocols rip default-distance + + This command change the distance value of RIP. The distance range is 1 to 255. + + .. note:: Routes with a distance of 255 are effectively disabled and not + installed into the kernel. + +.. cfgcmd:: set protocols rip network-distance distance + + This command sets default RIP distance to a specified value when the routes + source IP address matches the specified prefix. + +.. cfgcmd:: set protocols rip network-distance access-list + + This command can be used with previous command to sets default RIP distance + to specified value when the route source IP address matches the specified + prefix and the specified access-list. + +.. cfgcmd:: set protocols rip default-information originate + + This command generate a default route into the RIP. + +.. cfgcmd:: set protocols rip distribute-list access-list + + This command can be used to filter the RIP path using access lists. + :cfgcmd:`in` and :cfgcmd:`out` this is the direction in which the access + lists are applied. + +.. cfgcmd:: set protocols rip distribute-list interface access-list + + This command allows you apply access lists to a chosen interface to + filter the RIP path. + +.. cfgcmd:: set protocols rip distribute-list prefix-list + + This command can be used to filter the RIP path using prefix lists. + :cfgcmd:`in` and :cfgcmd:`out` this is the direction in which the prefix + lists are applied. + +.. cfgcmd:: set protocols rip distribute-list interface prefix-list + + This command allows you apply prefix lists to a chosen interface to + filter the RIP path. + +.. cfgcmd:: set protocols rip route + + This command is specific to FRR and VyOS. The route command makes a static + route only inside RIP. This command should be used only by advanced users + who are particularly knowledgeable about the RIP protocol. In most cases, + we recommend creating a static route in VyOS and redistributing it in RIP + using :cfgcmd:`redistribute static`. + +.. cfgcmd:: set protocols rip timers update + + This command specifies the update timer. Every update timer seconds, the + RIP process is awakened to send an unsolicited response message containing + the complete routing table to all neighboring RIP routers. The time range + is 5 to 2147483647. The default value is 30 seconds. + +.. cfgcmd:: set protocols rip timers timeout + + This command specifies the timeout timer. Upon expiration of the timeout, + the route is no longer valid; however, it is retained in the routing table + for a short time so that neighbors can be notified that the route has been + dropped. The time range is 5 to 2147483647. The default value is 180 + seconds. + +.. cfgcmd:: set protocols rip timers garbage-collection + + This command specifies the garbage-collection timer. Upon expiration of + the garbage-collection timer, the route is finally removed from the + routing table. The time range is 5 to 2147483647. The default value is 120 + seconds. + + +Redistribution Configuration +---------------------------- + +.. cfgcmd:: set protocols rip redistribute + + This command redistributes routing information from the given route source + into the RIP tables. There are five modes available for route source: bgp, + connected, kernel, ospf, static. + +.. cfgcmd:: set protocols rip redistribute metric + + This command specifies metric for redistributed routes from the given route + source. There are five modes available for route source: bgp, connected, + kernel, ospf, static. The metric range is 1 to 16. + +.. cfgcmd:: set protocols rip redistribute route-map + + This command allows to use route map to filter redistributed routes from + the given route source. There are five modes available for route source: + bgp, connected, kernel, ospf, static. + +.. cfgcmd:: set protocols rip default-metric + + This command modifies the default metric (hop count) value for redistributed + routes. The metric range is 1 to 16. The default value is 1. This command + does not affect connected route even if it is redistributed by + :cfgcmd:`redistribute connected`. To modify connected routes metric + value, please use :cfgcmd:`redistribute connected metric`. + + +Interfaces Configuration +------------------------ + +.. cfgcmd:: set interfaces ip rip authentication plaintext-password + + This command sets the interface with RIP simple password authentication. + This command also sets authentication string. The string must be shorter + than 16 characters. + +.. cfgcmd:: set interfaces ip rip authentication md5 password + + This command sets the interface with RIP MD5 authentication. This command + also sets MD5 Key. The key must be shorter than 16 characters. + +.. cfgcmd:: set interfaces ip rip split-horizon disable + + This command disables split-horizon on the interface. By default, VyOS does + not advertise RIP routes out the interface over which they were learned + (split horizon).3 + +.. cfgcmd:: set interfaces ip rip split-horizon poison-reverse + + This command enables poison-reverse on the interface. If both poison reverse + and split horizon are enabled, then VyOS advertises the learned routes + as unreachable over the interface on which the route was learned. + + +Operational Mode Commands +------------------------- + +.. opcmd:: show ip rip + + This command displays RIP routes. + +.. code-block:: none + + Codes: R - RIP, C - connected, S - Static, O - OSPF, B - BGP + Sub-codes: + (n) - normal, (s) - static, (d) - default, (r) - redistribute, + (i) - interface + + Network Next Hop Metric From Tag Time + C(i) 10.0.12.0/24 0.0.0.0 1 self 0 + C(i) 10.0.13.0/24 0.0.0.0 1 self 0 + R(n) 10.0.23.0/24 10.0.12.2 2 10.0.12.2 0 02:53 + +.. opcmd:: show ip rip status + + The command displays current RIP status. It includes RIP timer, filtering, + version, RIP enabled interface and RIP peer information. + +.. code-block:: none + + Routing Protocol is "rip" + Sending updates every 30 seconds with +/-50%, next due in 11 seconds + Timeout after 180 seconds, garbage collect after 120 seconds + Outgoing update filter list for all interface is not set + Incoming update filter list for all interface is not set + Default redistribution metric is 1 + Redistributing: + Default version control: send version 2, receive any version + Interface Send Recv Key-chain + eth0 2 1 2 + eth2 2 1 2 + Routing for Networks: + 10.0.12.0/24 + eth0 + Routing Information Sources: + Gateway BadPackets BadRoutes Distance Last Update + 10.0.12.2 0 0 120 00:00:11 + Distance: (default is 120) + + +Configuration Example +--------------------- + +Simple RIP configuration using 2 nodes and redistributing connected interfaces. + +**Node 1:** + +.. code-block:: none + + set interfaces loopback address 10.1.1.1/32 + set protocols rip network 192.168.0.0/24 + set protocols rip redistribute connected + +**Node 2:** + +.. code-block:: none + + set interfaces loopback address 10.2.2.2/32 + set protocols rip network 192.168.0.0/24 + set protocols rip redistribute connected diff --git a/docs/configuration/protocols/rst-rpki.rst b/docs/configuration/protocols/rst-rpki.rst new file mode 100644 index 00000000..17557884 --- /dev/null +++ b/docs/configuration/protocols/rst-rpki.rst @@ -0,0 +1,211 @@ +.. _rpki: + +#### +RPKI +#### + +.. pull-quote:: + + There are two types of Network Admins who deal with BGP, those who have + created an international incident and/or outage, and those who are lying + + -- `tweet by EvilMog`_, 2020-02-21 + +:abbr:`RPKI (Resource Public Key Infrastructure)` is a framework designed to +secure the Internet routing infrastructure. It associates BGP route +announcements with the correct originating :abbr:`ASN (Autonomus System +Number)` which BGP routers can then use to check each route against the +corresponding :abbr:`ROA (Route Origin Authorisation)` for validity. RPKI is +described in :rfc:`6480`. + +A BGP-speaking router like VyOS can retrieve ROA information from RPKI +"Relying Party software" (often just called an "RPKI server" or "RPKI +validator") by using :abbr:`RTR (RPKI to Router)` protocol. There are several +open source implementations to choose from, such as NLNetLabs' Routinator_ +(written in Rust), OpenBSD's rpki-client_ (written in C), and StayRTR_ (written +in Go). The RTR protocol is described in :rfc:`8210`. + +.. tip:: + If you are new to these routing security technologies then there is an + `excellent guide to RPKI`_ by NLnet Labs which will get you up to speed + very quickly. Their documentation explains everything from what RPKI is to + deploying it in production. It also has some + `help and operational guidance`_ including "What can I do about my route + having an Invalid state?" + +*************** +Getting started +*************** + +First you will need to deploy an RPKI validator for your routers to use. NLnet +Labs provides a collection of software_ you can compare and settle on one. +Once your server is running you can start validating announcements. + +Imported prefixes during the validation may have values: + + valid + The prefix and ASN that originated it match a signed ROA. These are + probably trustworthy route announcements. + + invalid + The prefix or prefix length and ASN that originated it doesn't + match any existing ROA. This could be the result of a prefix hijack, or + merely a misconfiguration, but should probably be treated as + untrustworthy route announcements. + + notfound + No ROA exists which covers that prefix. Unfortunately this is the case for + about 40%-50% of the prefixes which were announced to the :abbr:`DFZ + (default-free zone)` at the start of 2024. + +.. note:: + If you are responsible for the global addresses assigned to your + network, please make sure that your prefixes have ROAs associated with them + to avoid being `notfound` by RPKI. For most ASNs this will involve + publishing ROAs via your :abbr:`RIR (Regional Internet Registry)` (RIPE + NCC, APNIC, ARIN, LACNIC, or AFRINIC), and is something you are encouraged + to do whenever you plan to announce addresses into the DFZ. + + Particularly large networks may wish to run their own RPKI certificate + authority and publication server instead of publishing ROAs via their RIR. + This is a subject far beyond the scope of VyOS' documentation. Consider + reading about Krill_ if this is a rabbit hole you need or especially want + to dive down. + +Features of the Current Implementation +====================================== + +In a nutshell, the current implementation provides the following features: + +* The BGP router can connect to one or more RPKI cache servers to receive + validated prefix to origin AS mappings. Advanced failover can be implemented + by server sockets with different preference values. + +* If no connection to an RPKI cache server can be established after a + pre-defined timeout, the router will process routes without prefix origin + validation. It still will try to establish a connection to an RPKI cache + server in the background. + +* By default, enabling RPKI does not change best path selection. In particular, + invalid prefixes will still be considered during best path selection. However, + the router can be configured to ignore all invalid prefixes. + +* Route maps can be configured to match a specific RPKI validation state. This + allows the creation of local policies, which handle BGP routes based on the + outcome of the Prefix Origin Validation. + +* Updates from the RPKI cache servers are directly applied and path selection is + updated accordingly. (Soft reconfiguration must be enabled for this to work). + +************* +Configuration +************* + +.. cfgcmd:: set protocols rpki polling-period <1-86400> + + Define the time interval to update the local cache + + The default value is 300 seconds. + +.. cfgcmd:: set protocols rpki expire-interval <600-172800> + + Set the number of seconds the router waits until the router + expires the cache. + + The default value is 7200 seconds. + +.. cfgcmd:: set protocols rpki retry-interval <1-7200> + + Set the number of seconds the router waits until retrying to connect + to the cache server. + + The default value is 600 seconds. + +.. cfgcmd:: set protocols rpki cache
port + + Defined the IPv4, IPv6 or FQDN and port number of the caching RPKI caching + instance which is used. + + This is a mandatory setting. + +.. cfgcmd:: set protocols rpki cache
preference + + Multiple RPKI caching instances can be supplied and they need a preference in + which their result sets are used. + + This is a mandatory setting. + +SSH +=== + +Connections to the RPKI caching server can not only be established by TCP using +the RTR protocol but you can also rely on a secure SSH session to the server. +This provides transport integrity and confidentiality and it is a good idea if +your validation software supports it. To enable SSH, first you need to create +an SSH client keypair using ``generate ssh client-key +/config/auth/id_rsa_rpki``. Once your key is created you can setup the +connection. + +.. cfgcmd:: set protocols rpki cache
ssh username + + SSH username to establish an SSH connection to the cache server. + +.. cfgcmd:: set protocols rpki cache
ssh private-key-file + + Local path that includes the private key file of the router. + +.. cfgcmd:: set protocols rpki cache
ssh public-key-file + + Local path that includes the public key file of the router. + +.. note:: When using SSH, private-key-file and public-key-file + are mandatory options. + +******* +Example +******* + +We can build route-maps for import based on these states. Here is a simple +RPKI configuration, where `routinator` is the RPKI-validating "cache" +server with ip `192.0.2.1`: + +.. code-block:: none + + set protocols rpki cache 192.0.2.1 port '3323' + set protocols rpki cache 192.0.2.1 preference '1' + +Here is an example route-map to apply to routes learned at import. In this +filter we reject prefixes with the state `invalid`, and set a higher +`local-preference` if the prefix is RPKI `valid` rather than merely +`notfound`. + +.. code-block:: none + + set policy route-map ROUTES-IN rule 10 action 'permit' + set policy route-map ROUTES-IN rule 10 match rpki 'valid' + set policy route-map ROUTES-IN rule 10 set local-preference '300' + set policy route-map ROUTES-IN rule 20 action 'permit' + set policy route-map ROUTES-IN rule 20 match rpki 'notfound' + set policy route-map ROUTES-IN rule 20 set local-preference '125' + set policy route-map ROUTES-IN rule 30 action 'deny' + set policy route-map ROUTES-IN rule 30 match rpki 'invalid' + +Once your routers are configured to reject RPKI-invalid prefixes, you can +test whether the configuration is working correctly using Cloudflare's test_ +website. Keep in mind that in order for this to work, you need to have no +default routes or anything else that would still send traffic to RPKI-invalid +destinations. + +.. stop_vyoslinter + +.. _tweet by EvilMog: https://twitter.com/Evil_Mog/status/1230924170508169216 +.. _Routinator: https://www.nlnetlabs.nl/projects/rpki/routinator/ +.. _Krill: https://www.nlnetlabs.nl/projects/rpki/krill/ +.. _excellent guide to RPKI: https://rpki.readthedocs.io/ +.. _help and operational guidance: https://rpki.readthedocs.io/en/latest/about/help.html +.. _rpki-client: https://www.rpki-client.org/ +.. _StayRTR: https://github.com/bgp/stayrtr/ +.. _software: https://rpki.readthedocs.io/en/latest/ops/tools.html#relying-party-software +.. _test: https://isbgpsafeyet.com/ + +.. start_vyoslinter diff --git a/docs/configuration/protocols/rst-segment-routing.rst b/docs/configuration/protocols/rst-segment-routing.rst new file mode 100644 index 00000000..5ee710e9 --- /dev/null +++ b/docs/configuration/protocols/rst-segment-routing.rst @@ -0,0 +1,357 @@ +.. _segment-routing: + +############### +Segment Routing +############### + +Segment Routing (SR) is a network architecture that is similar to source-routing +. In this architecture, the ingress router adds a list of segments, known as +SIDs, to the packet as it enters the network. These segments represent different +portions of the network path that the packet will take. + +The SR segments are portions of the network path taken by the packet, and are +called SIDs. At each node, the first SID of the list is read, executed as a +forwarding function, and may be popped to let the next node read the next SID of +the list. The SID list completely determines the path where the packet is +forwarded. + +Segment Routing can be applied to an existing MPLS-based data plane and defines +a control plane network architecture. In MPLS networks, segments are encoded as +MPLS labels and are added at the ingress router. These MPLS labels are then +exchanged and populated by Interior Gateway Protocols (IGPs) like IS-IS or OSPF +which are running on most ISPs. + + +.. note:: Segment routing defines a control plane network architecture and + can be applied to an existing MPLS based dataplane. In the MPLS networks, + segments are encoded as MPLS labels and are imposed at the ingress router. + MPLS labels are exchanged and populated by IGPs like IS-IS.Segment Routing + as per RFC8667 for MPLS dataplane. It supports IPv4, IPv6 and ECMP and has + been tested against Cisco & Juniper routers.however,this deployment is still + EXPERIMENTAL for FRR. + + +IS-IS SR Configuration +---------------------- + +Segment routing (SR) is used by the IGP protocols to interconnect network +devices, below configuration shows how to enable SR on IS-IS: + + +.. note:: ``Known limitations:`` + + No support for level redistribution (L1 to L2 or L2 to L1) + + No support for binding SID + + No support for SRLB + + Only one SRGB and default SPF Algorithm is supported + + + +.. cfgcmd:: set protocols isis segment-routing global-block high-label-value + + + Set the Segment Routing Global Block i.e. the label range used by MPLS to + store label in the MPLS FIB for Prefix SID. Note that the block size may + not exceed 65535. + +.. cfgcmd:: set protocols isis segment-routing global-block low-label-value + + + Set the Segment Routing Global Block i.e. the low label range used by MPLS to + store label in the MPLS FIB for Prefix SID. Note that the block size may + not exceed 65535. + +.. cfgcmd:: set protocols isis segment-routing local-block high-label-value + + + Set the Segment Routing Local Block i.e. the label range used by MPLS to + store label in the MPLS FIB for Prefix SID. Note that the block size may + not exceed 65535.Segment Routing Local Block, The negative command always + unsets both. + +.. cfgcmd:: set protocols isis segment-routing local-block + + Set the Segment Routing Local Block i.e. the low label range used by MPLS to + store label in the MPLS FIB for Prefix SID. Note that the block size may + not exceed 65535.Segment Routing Local Block, The negative command always + unsets both. + +.. cfgcmd:: set protocols isis segment-routing maximum-label-depth <1-16> + + Set the Maximum Stack Depth supported by the router. The value depend of + the MPLS dataplane. + +.. cfgcmd:: set protocols isis segment-routing prefix
index value + <0-65535> + + A segment ID that contains an IP address prefix calculated by an IGP in the + service provider core network. Prefix SIDs are globally unique, this value + indentify it + +.. cfgcmd:: set protocols isis segment-routing prefix
index + + + this option allows to configure prefix-sid on SR. The ‘no-php-flag’ means NO + Penultimate Hop Popping that allows SR node to request to its neighbor to + not pop the label. The ‘explicit-null’ flag allows SR node to request to its + neighbor to send IP packet with the EXPLICIT-NULL label. The ‘n-flag-clear’ + option can be used to explicitly clear the Node flag that is set by default + for Prefix-SIDs associated to loopback addresses. This option is necessary + to configure Anycast-SIDs. + + +.. opcmd:: show isis segment-routing node + + Show detailed information about all learned Segment Routing Nodes + +.. opcmd:: show isis route prefix-sid + + Show detailed information about prefix-sid and label learned + +.. note:: more information related IGP - :ref:`routing-isis` + + + +OSPF SR Configuration +---------------------- + +Segment routing (SR) is used by the IGP protocols to interconnect network +devices, below configuration shows how to enable SR on OSPF: + +.. cfgcmd:: set protocols ospf parameters opaque-lsa + + Enable the Opaque-LSA capability (rfc2370), necessary to transport label + on IGP + + +.. cfgcmd:: set protocols ospf segment-routing global-block high-label-value + + + Set the Segment Routing Global Block i.e. the label range used by MPLS to + store label in the MPLS FIB for Prefix SID. Note that the block size may + not exceed 65535. + +.. cfgcmd:: set protocols ospf segment-routing global-block low-label-value + + + Set the Segment Routing Global Block i.e. the low label range used by MPLS to + store label in the MPLS FIB for Prefix SID. Note that the block size may + not exceed 65535. + +.. cfgcmd:: set protocols ospf segment-routing local-block high-label-value + + + Set the Segment Routing Local Block i.e. the label range used by MPLS to + store label in the MPLS FIB for Prefix SID. Note that the block size may + not exceed 65535.Segment Routing Local Block, The negative command always + unsets both. + +.. cfgcmd:: set protocols ospf segment-routing local-block + + Set the Segment Routing Local Block i.e. the low label range used by MPLS to + store label in the MPLS FIB for Prefix SID. Note that the block size may + not exceed 65535.Segment Routing Local Block, The negative command always + unsets both. + +.. cfgcmd:: set protocols ospf segment-routing maximum-label-depth <1-16> + + Set the Maximum Stack Depth supported by the router. The value depend of + the MPLS dataplane. + +.. cfgcmd:: set protocols ospf segment-routing prefix
index value + <0-65535> + + A segment ID that contains an IP address prefix calculated by an IGP in the + service provider core network. Prefix SIDs are globally unique, this value + indentify it + +.. cfgcmd:: set protocols ospf segment-routing prefix
index + + + this option allows to configure prefix-sid on SR. The ‘no-php-flag’ means NO + Penultimate Hop Popping that allows SR node to request to its neighbor to + not pop the label. The ‘explicit-null’ flag allows SR node to request to its + neighbor to send IP packet with the EXPLICIT-NULL label. The ‘n-flag-clear’ + option can be used to explicitly clear the Node flag that is set by default + for Prefix-SIDs associated to loopback addresses. This option is necessary + to configure Anycast-SIDs. + +.. note:: more information related IGP - :ref:`routing-ospf` + +Configuration Example +--------------------- + +we described the configuration SR ISIS / SR OSPF using 2 connected with them to +share label information. + +Enable IS-IS with Segment Routing (Experimental) +================================================ + +**Node 1:** + +.. code-block:: none + + set interfaces loopback lo address '192.168.255.255/32' + set interfaces ethernet eth1 address '192.0.2.1/24' + + set protocols isis interface eth1 + set protocols isis interface lo + set protocols isis net '49.0001.1921.6825.5255.00' + set protocols isis segment-routing global-block high-label-value '599' + set protocols isis segment-routing global-block low-label-value '550' + set protocols isis segment-routing prefix 192.168.255.255/32 index value '1' + set protocols isis segment-routing prefix 192.168.255.255/32 index explicit-null + set protocols mpls interface 'eth1' + +**Node 2:** + +.. code-block:: none + + set interfaces loopback lo address '192.168.255.254/32' + set interfaces ethernet eth1 address '192.0.2.2/24' + + set protocols isis interface eth1 + set protocols isis interface lo + set protocols isis net '49.0001.1921.6825.5254.00' + set protocols isis segment-routing global-block high-label-value '599' + set protocols isis segment-routing global-block low-label-value '550' + set protocols isis segment-routing prefix 192.168.255.254/32 index value '2' + set protocols isis segment-routing prefix 192.168.255.254/32 index explicit-null + set protocols mpls interface 'eth1' + + + +This gives us MPLS segment routing enabled and labels for far end loopbacks: + +.. code-block:: none + + Node-1@vyos:~$ show mpls table + Inbound Label Type Nexthop Outbound Label + ---------------------------------------------------------------------- + 552 SR (IS-IS) 192.0.2.2 IPv4 Explicit Null <-- Node-2 loopback learned on Node-1 + 15000 SR (IS-IS) 192.0.2.2 implicit-null + 15001 SR (IS-IS) fe80::e87:6cff:fe09:1 implicit-null + 15002 SR (IS-IS) 192.0.2.2 implicit-null + 15003 SR (IS-IS) fe80::e87:6cff:fe09:1 implicit-null + + Node-2@vyos:~$ show mpls table + Inbound Label Type Nexthop Outbound Label + --------------------------------------------------------------------- + 551 SR (IS-IS) 192.0.2.1 IPv4 Explicit Null <-- Node-1 loopback learned on Node-2 + 15000 SR (IS-IS) 192.0.2.1 implicit-null + 15001 SR (IS-IS) fe80::e33:2ff:fe80:1 implicit-null + 15002 SR (IS-IS) 192.0.2.1 implicit-null + 15003 SR (IS-IS) fe80::e33:2ff:fe80:1 implicit-null + +Here is the routing tables showing the MPLS segment routing label operations: + +.. code-block:: none + + Node-1@vyos:~$ show ip route isis + Codes: K - kernel route, C - connected, S - static, R - RIP, + O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP, + T - Table, v - VNC, V - VNC-Direct, A - Babel, F - PBR, + f - OpenFabric, + > - selected route, * - FIB route, q - queued, r - rejected, b - backup + t - trapped, o - offload failure + + I 192.0.2.0/24 [115/20] via 192.0.2.2, eth1 inactive, weight 1, 00:07:48 + I>* 192.168.255.254/32 [115/20] via 192.0.2.2, eth1, label IPv4 Explicit Null, weight 1, 00:03:39 + + Node-2@vyos:~$ show ip route isis + Codes: K - kernel route, C - connected, S - static, R - RIP, + O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP, + T - Table, v - VNC, V - VNC-Direct, A - Babel, F - PBR, + f - OpenFabric, + > - selected route, * - FIB route, q - queued, r - rejected, b - backup + t - trapped, o - offload failure + + I 192.0.2.0/24 [115/20] via 192.0.2.1, eth1 inactive, weight 1, 00:07:46 + I>* 192.168.255.255/32 [115/20] via 192.0.2.1, eth1, label IPv4 Explicit Null, weight 1, 00:03:43 + + +Enable OSPF with Segment Routing (Experimental): +================================================ + +**Node 1** + +.. code-block:: none + + set interfaces loopback lo address 10.1.1.1/32 + set interfaces ethernet eth0 address 192.168.0.1/24 + set protocols ospf area 0 network '192.168.0.0/24' + set protocols ospf area 0 network '10.1.1.1/32' + set protocols ospf parameters opaque-lsa + set protocols ospf parameters router-id '10.1.1.1' + set protocols ospf segment-routing global-block high-label-value '1100' + set protocols ospf segment-routing global-block low-label-value '1000' + set protocols ospf segment-routing prefix 10.1.1.1/32 index explicit-null + set protocols ospf segment-routing prefix 10.1.1.1/32 index value '1' + +**Node 2** + +.. code-block:: none + + set interfaces loopback lo address 10.1.1.2/32 + set interfaces ethernet eth0 address 192.168.0.2/24 + set protocols ospf area 0 network '192.168.0.0/24' + set protocols ospf area 0 network '10.1.1.2/32' + set protocols ospf parameters opaque-lsa + set protocols ospf parameters router-id '10.1.1.2' + set protocols ospf segment-routing global-block high-label-value '1100' + set protocols ospf segment-routing global-block low-label-value '1000' + set protocols ospf segment-routing prefix 10.1.1.2/32 index explicit-null + set protocols ospf segment-routing prefix 10.1.1.2/32 index value '2' + + +This gives us MPLS segment routing enabled and labels for far end loopbacks: + +.. code-block:: none + + Node-1@vyos:~$ show mpls table + Inbound Label Type Nexthop Outbound Label + ----------------------------------------------------------- + 1002 SR (OSPF) 192.168.0.2 IPv4 Explicit Null <-- Node-2 loopback learned on Node-1 + 15000 SR (OSPF) 192.168.0.2 implicit-null + 15001 SR (OSPF) 192.168.0.2 implicit-null + + Node-2@vyos:~$ show mpls table + Inbound Label Type Nexthop Outbound Label + ----------------------------------------------------------- + 1001 SR (OSPF) 192.168.0.1 IPv4 Explicit Null <-- Node-1 loopback learned on Node-2 + 15000 SR (OSPF) 192.168.0.1 implicit-null + 15001 SR (OSPF) 192.168.0.1 implicit-null + +Here is the routing tables showing the MPLS segment routing label operations: + +.. code-block:: none + + Node-1@vyos:~$ show ip route ospf + Codes: K - kernel route, C - connected, S - static, R - RIP, + O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP, + T - Table, v - VNC, V - VNC-Direct, A - Babel, F - PBR, + f - OpenFabric, + > - selected route, * - FIB route, q - queued, r - rejected, b - backup + t - trapped, o - offload failure + + O 10.1.1.1/32 [110/0] is directly connected, lo, weight 1, 00:03:43 + O>* 10.1.1.2/32 [110/1] via 192.168.0.2, eth0, label IPv4 Explicit Null, weight 1, 00:03:32 + O 192.168.0.0/24 [110/1] is directly connected, eth0, weight 1, 00:03:43 + + Node-2@vyos:~$ show ip route ospf + Codes: K - kernel route, C - connected, S - static, R - RIP, + O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP, + T - Table, v - VNC, V - VNC-Direct, A - Babel, F - PBR, + f - OpenFabric, + > - selected route, * - FIB route, q - queued, r - rejected, b - backup + t - trapped, o - offload failure + + O>* 10.1.1.1/32 [110/1] via 192.168.0.1, eth0, label IPv4 Explicit Null, weight 1, 00:03:36 + O 10.1.1.2/32 [110/0] is directly connected, lo, weight 1, 00:03:51 + O 192.168.0.0/24 [110/1] is directly connected, eth0, weight 1, 00:03:51 + diff --git a/docs/configuration/protocols/rst-static.rst b/docs/configuration/protocols/rst-static.rst new file mode 100644 index 00000000..bfc25201 --- /dev/null +++ b/docs/configuration/protocols/rst-static.rst @@ -0,0 +1,242 @@ +.. _routing-static: + +###### +Static +###### + +Static routes are manually configured routes, which, in general, cannot be +updated dynamically from information VyOS learns about the network topology from +other routing protocols. However, if a link fails, the router will remove +routes, including static routes, from the :abbr:`RIPB (Routing Information +Base)` that used this interface to reach the next hop. In general, static +routes should only be used for very simple network topologies, or to override +the behavior of a dynamic routing protocol for a small number of routes. The +collection of all routes the router has learned from its configuration or from +its dynamic routing protocols is stored in the RIB. Unicast routes are directly +used to determine the forwarding table used for unicast packet forwarding. + +************* +Static Routes +************* + +.. cfgcmd:: set protocols static route next-hop
+ + Configure next-hop `
` for an IPv4 static route. Multiple static + routes can be created. + +.. cfgcmd:: set protocols static route next-hop
disable + + Disable this IPv4 static route entry. + +.. cfgcmd:: set protocols static route next-hop
+ distance + + Defines next-hop distance for this route, routes with smaller administrative + distance are elected prior to those with a higher distance. + + Range is 1 to 255, default is 1. + + .. note:: Routes with a distance of 255 are effectively disabled and not + installed into the kernel. + +.. cfgcmd:: set protocols static route6 next-hop
+ + Configure next-hop `
` for an IPv6 static route. Multiple static + routes can be created. + +.. cfgcmd:: set protocols static route6 next-hop
disable + + Disable this IPv6 static route entry. + +.. cfgcmd:: set protocols static route6 next-hop
+ distance + + Defines next-hop distance for this route, routes with smaller administrative + distance are elected prior to those with a higher distance. + + Range is 1 to 255, default is 1. + + .. note:: Routes with a distance of 255 are effectively disabled and not + installed into the kernel. + +.. cfgcmd:: set protocols static route6 next-hop
segments + + It is possible to specify a static route for ipv6 prefixes using an SRv6 segments + instruction. The `/` separator can be used to specify multiple segment instructions. + + Example: + + .. code-block:: none + + set protocols static route6 2001:db8:1000::/36 next-hop 2001:db8:201::ffff segments '2001:db8:aaaa::7/2002::4/2002::3/2002::2' + + .. code-block:: none + + vyos@vyos:~$ show ipv6 route + Codes: K - kernel route, C - connected, S - static, R - RIPng, + O - OSPFv3, I - IS-IS, B - BGP, N - NHRP, T - Table, + v - VNC, V - VNC-Direct, A - Babel, F - PBR, + f - OpenFabric, + > - selected route, * - FIB route, q - queued, r - rejected, b - backup + t - trapped, o - offload failure + C>* 2001:db8:201::/64 is directly connected, eth0.201, 00:00:46 + S>* 2001:db8:1000::/36 [1/0] via 2001:db8:201::ffff, eth0.201, seg6 2001:db8:aaaa::7,2002::4,2002::3,2002::2, weight 1, 00:00:08 + + +Interface Routes +================ + +.. cfgcmd:: set protocols static route interface + + + Allows you to configure the next-hop interface for an interface-based IPv4 + static route. `` will be the next-hop interface where traffic is + routed for the given ``. + +.. cfgcmd:: set protocols static route interface + disable + + Disables interface-based IPv4 static route. + +.. cfgcmd:: set protocols static route interface + distance + + Defines next-hop distance for this route, routes with smaller administrative + distance are elected prior to those with a higher distance. + + Range is 1 to 255, default is 1. + +.. cfgcmd:: set protocols static route6 interface + + + Allows you to configure the next-hop interface for an interface-based IPv6 + static route. `` will be the next-hop interface where traffic is + routed for the given ``. + +.. cfgcmd:: set protocols static route6 interface + disable + + Disables interface-based IPv6 static route. + +.. cfgcmd:: set protocols static route6 interface + distance + + Defines next-hop distance for this route, routes with smaller administrative + distance are elected prior to those with a higher distance. + + Range is 1 to 255, default is 1. + +.. cfgcmd:: set protocols static route6 interface + segments + + It is possible to specify a static route for ipv6 prefixes using an SRv6 segments + instruction. The `/` separator can be used to specify multiple segment instructions. + + Example: + + .. code-block:: none + + set protocols static route6 2001:db8:1000::/36 interface eth0 segments '2001:db8:aaaa::7/2002::4/2002::3/2002::2' + +Blackhole +========= + +.. cfgcmd:: set protocols static route blackhole + + Use this command to configure a "black-hole" route on the router. A + black-hole route is a route for which the system silently discard packets + that are matched. This prevents networks leaking out public interfaces, but + it does not prevent them from being used as a more specific route inside your + network. + +.. cfgcmd:: set protocols static route blackhole distance + + Defines blackhole distance for this route, routes with smaller administrative + distance are elected prior to those with a higher distance. + +.. cfgcmd:: set protocols static route6 blackhole + + Use this command to configure a "black-hole" route on the router. A + black-hole route is a route for which the system silently discard packets + that are matched. This prevents networks leaking out public interfaces, but + it does not prevent them from being used as a more specific route inside your + network. + +.. cfgcmd:: set protocols static route6 blackhole distance + + Defines blackhole distance for this route, routes with smaller administrative + distance are elected prior to those with a higher distance. + +Alternate Routing Tables +======================== + +TBD + +Alternate routing tables are used with policy based routing by utilizing +:ref:`vrf`. + + +.. _routing-arp: + +### +ARP +### + +:abbr:`ARP (Address Resolution Protocol)` is a communication protocol used for +discovering the link layer address, such as a MAC address, associated with a +given internet layer address, typically an IPv4 address. This mapping is a +critical function in the Internet protocol suite. ARP was defined in 1982 by +:rfc:`826` which is Internet Standard STD 37. + +In Internet Protocol Version 6 (IPv6) networks, the functionality of ARP is +provided by the Neighbor Discovery Protocol (NDP). + +To manipulate or display ARP_ table entries, the following commands are +implemented. + +********* +Configure +********* + +.. cfgcmd:: set protocols static arp interface address + mac + + This will configure a static ARP entry always resolving `
` to + `` for interface ``. + + Example: + + .. code-block:: none + + set protocols static arp interface eth0 address 192.0.2.1 mac 01:23:45:67:89:01 + + +********* +Operation +********* + + +.. opcmd:: show protocols static arp + + Display all known ARP table entries spanning across all interfaces + +.. code-block:: none + + vyos@vyos:~$ show protocols static arp + Address HWtype HWaddress Flags Mask Iface + 10.1.1.1 ether 00:53:00:de:23:2e C eth1 + 10.1.1.100 ether 00:53:00:de:23:aa CM eth1 + + +.. opcmd:: show protocols static arp interface eth1 + + Display all known ARP table entries on a given interface only (`eth1`): + +.. code-block:: none + + vyos@vyos:~$ show protocols static arp interface eth1 + Address HWtype HWaddress Flags Mask Iface + 10.1.1.1 ether 00:53:00:de:23:2e C eth1 + 10.1.1.100 ether 00:53:00:de:23:aa CM eth1 + +.. _ARP: https://en.wikipedia.org/wiki/Address_Resolution_Protocol diff --git a/docs/configuration/protocols/segment-routing.md b/docs/configuration/protocols/segment-routing.md new file mode 100644 index 00000000..af47d343 --- /dev/null +++ b/docs/configuration/protocols/segment-routing.md @@ -0,0 +1,359 @@ +(segment-routing)= + +# Segment Routing + +Segment Routing (SR) is a network architecture that is similar to source-routing +. In this architecture, the ingress router adds a list of segments, known as +SIDs, to the packet as it enters the network. These segments represent different +portions of the network path that the packet will take. + +The SR segments are portions of the network path taken by the packet, and are +called SIDs. At each node, the first SID of the list is read, executed as a +forwarding function, and may be popped to let the next node read the next SID of +the list. The SID list completely determines the path where the packet is +forwarded. + +Segment Routing can be applied to an existing MPLS-based data plane and defines +a control plane network architecture. In MPLS networks, segments are encoded as +MPLS labels and are added at the ingress router. These MPLS labels are then +exchanged and populated by Interior Gateway Protocols (IGPs) like IS-IS or OSPF +which are running on most ISPs. + +:::{note} +Segment routing defines a control plane network architecture and +can be applied to an existing MPLS based dataplane. In the MPLS networks, +segments are encoded as MPLS labels and are imposed at the ingress router. +MPLS labels are exchanged and populated by IGPs like IS-IS.Segment Routing +as per RFC8667 for MPLS dataplane. It supports IPv4, IPv6 and ECMP and has +been tested against Cisco & Juniper routers.however,this deployment is still +EXPERIMENTAL for FRR. +::: + +## IS-IS SR Configuration + +Segment routing (SR) is used by the IGP protocols to interconnect network +devices, below configuration shows how to enable SR on IS-IS: + +:::{note} +``Known limitations:`` + +No support for level redistribution (L1 to L2 or L2 to L1) + +No support for binding SID + +No support for SRLB + +Only one SRGB and default SPF Algorithm is supported +::: + +```{cfgcmd} set protocols isis segment-routing global-block high-label-value \ + +Set the Segment Routing Global Block i.e. the label range used by MPLS to +store label in the MPLS FIB for Prefix SID. Note that the block size may +not exceed 65535. +``` + + +```{cfgcmd} set protocols isis segment-routing global-block low-label-value \ + +Set the Segment Routing Global Block i.e. the low label range used by MPLS to +store label in the MPLS FIB for Prefix SID. Note that the block size may +not exceed 65535. +``` + + +```{cfgcmd} set protocols isis segment-routing local-block high-label-value \ + +Set the Segment Routing Local Block i.e. the label range used by MPLS to +store label in the MPLS FIB for Prefix SID. Note that the block size may +not exceed 65535.Segment Routing Local Block, The negative command always +unsets both. +``` + + +```{cfgcmd} set protocols isis segment-routing local-block \ + +Set the Segment Routing Local Block i.e. the low label range used by MPLS to +store label in the MPLS FIB for Prefix SID. Note that the block size may +not exceed 65535.Segment Routing Local Block, The negative command always +unsets both. +``` + + +```{cfgcmd} set protocols isis segment-routing maximum-label-depth \<1-16\> + +Set the Maximum Stack Depth supported by the router. The value depend of +the MPLS dataplane. +``` + + +```{cfgcmd} set protocols isis segment-routing prefix \ index value \<0-65535\> + +A segment ID that contains an IP address prefix calculated by an IGP in the +service provider core network. Prefix SIDs are globally unique, this value +identify it +``` + + +```{cfgcmd} set protocols isis segment-routing prefix \ index \ + +this option allows to configure prefix-sid on SR. The ‘no-php-flag’ means NO +Penultimate Hop Popping that allows SR node to request to its neighbor to +not pop the label. The ‘explicit-null’ flag allows SR node to request to its +neighbor to send IP packet with the EXPLICIT-NULL label. The ‘n-flag-clear’ +option can be used to explicitly clear the Node flag that is set by default +for Prefix-SIDs associated to loopback addresses. This option is necessary +to configure Anycast-SIDs. +``` + +```{opcmd} show isis segment-routing node + + Show detailed information about all learned Segment Routing Nodes +``` + + +```{opcmd} show isis route prefix-sid + +Show detailed information about prefix-sid and label learned +``` + +:::{note} +more information related IGP - {ref}`routing-isis` +::: + + +## OSPF SR Configuration + + +Segment routing (SR) is used by the IGP protocols to interconnect network +devices, below configuration shows how to enable SR on OSPF: + +```{cfgcmd} set protocols ospf parameters opaque-lsa + +Enable the Opaque-LSA capability (rfc2370), necessary to transport label +on IGP +``` + +```{cfgcmd} set protocols ospf segment-routing global-block high-label-value \ + +Set the Segment Routing Global Block i.e. the label range used by MPLS to +store label in the MPLS FIB for Prefix SID. Note that the block size may +not exceed 65535. +``` + +```{cfgcmd} set protocols ospf segment-routing global-block low-label-value \ + +Set the Segment Routing Global Block i.e. the low label range used by MPLS to +store label in the MPLS FIB for Prefix SID. Note that the block size may +not exceed 65535. +``` + +```{cfgcmd} set protocols ospf segment-routing local-block high-label-value \ + +Set the Segment Routing Local Block i.e. the label range used by MPLS to +store label in the MPLS FIB for Prefix SID. Note that the block size may +not exceed 65535.Segment Routing Local Block, The negative command always +unsets both. +``` + +```{cfgcmd} set protocols ospf segment-routing local-block \ + +Set the Segment Routing Local Block i.e. the low label range used by MPLS to +store label in the MPLS FIB for Prefix SID. Note that the block size may +not exceed 65535.Segment Routing Local Block, The negative command always +unsets both. +``` + +```{cfgcmd} set protocols ospf segment-routing maximum-label-depth \<1-16\> + +Set the Maximum Stack Depth supported by the router. The value depend of +the MPLS dataplane. +``` + +```{cfgcmd} set protocols ospf segment-routing prefix \ index value \<0-65535\> + +A segment ID that contains an IP address prefix calculated by an IGP in the +service provider core network. Prefix SIDs are globally unique, this value +identify it +``` + +```{cfgcmd} set protocols ospf segment-routing prefix \ index \ + +this option allows to configure prefix-sid on SR. The ‘no-php-flag’ means NO +Penultimate Hop Popping that allows SR node to request to its neighbor to +not pop the label. The ‘explicit-null’ flag allows SR node to request to its +neighbor to send IP packet with the EXPLICIT-NULL label. The ‘n-flag-clear’ +option can be used to explicitly clear the Node flag that is set by default +for Prefix-SIDs associated to loopback addresses. This option is necessary +to configure Anycast-SIDs. +``` + +:::{note} +more information related IGP - {ref}`routing-ospf` +::: + +## Configuration Example + +we described the configuration SR ISIS / SR OSPF using 2 connected with them to +share label information. + +### Enable IS-IS with Segment Routing (Experimental) + +**Node 1:** + +```none +set interfaces loopback lo address '192.168.255.255/32' +set interfaces ethernet eth1 address '192.0.2.1/24' + +set protocols isis interface eth1 +set protocols isis interface lo +set protocols isis net '49.0001.1921.6825.5255.00' +set protocols isis segment-routing global-block high-label-value '599' +set protocols isis segment-routing global-block low-label-value '550' +set protocols isis segment-routing prefix 192.168.255.255/32 index value '1' +set protocols isis segment-routing prefix 192.168.255.255/32 index explicit-null +set protocols mpls interface 'eth1' +``` + +**Node 2:** + +```none +set interfaces loopback lo address '192.168.255.254/32' +set interfaces ethernet eth1 address '192.0.2.2/24' + +set protocols isis interface eth1 +set protocols isis interface lo +set protocols isis net '49.0001.1921.6825.5254.00' +set protocols isis segment-routing global-block high-label-value '599' +set protocols isis segment-routing global-block low-label-value '550' +set protocols isis segment-routing prefix 192.168.255.254/32 index value '2' +set protocols isis segment-routing prefix 192.168.255.254/32 index explicit-null +set protocols mpls interface 'eth1' +``` + +This gives us MPLS segment routing enabled and labels for far end loopbacks: + +```none +Node-1@vyos:~$ show mpls table + Inbound Label Type Nexthop Outbound Label + ---------------------------------------------------------------------- + 552 SR (IS-IS) 192.0.2.2 IPv4 Explicit Null <-- Node-2 loopback learned on Node-1 + 15000 SR (IS-IS) 192.0.2.2 implicit-null + 15001 SR (IS-IS) fe80::e87:6cff:fe09:1 implicit-null + 15002 SR (IS-IS) 192.0.2.2 implicit-null + 15003 SR (IS-IS) fe80::e87:6cff:fe09:1 implicit-null + +Node-2@vyos:~$ show mpls table + Inbound Label Type Nexthop Outbound Label + --------------------------------------------------------------------- + 551 SR (IS-IS) 192.0.2.1 IPv4 Explicit Null <-- Node-1 loopback learned on Node-2 + 15000 SR (IS-IS) 192.0.2.1 implicit-null + 15001 SR (IS-IS) fe80::e33:2ff:fe80:1 implicit-null + 15002 SR (IS-IS) 192.0.2.1 implicit-null + 15003 SR (IS-IS) fe80::e33:2ff:fe80:1 implicit-null +``` + +Here is the routing tables showing the MPLS segment routing label operations: + +```none +Node-1@vyos:~$ show ip route isis +Codes: K - kernel route, C - connected, S - static, R - RIP, + O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP, + T - Table, v - VNC, V - VNC-Direct, A - Babel, F - PBR, + f - OpenFabric, + > - selected route, * - FIB route, q - queued, r - rejected, b - backup + t - trapped, o - offload failure + +I 192.0.2.0/24 [115/20] via 192.0.2.2, eth1 inactive, weight 1, 00:07:48 +I>* 192.168.255.254/32 [115/20] via 192.0.2.2, eth1, label IPv4 Explicit Null, weight 1, 00:03:39 + +Node-2@vyos:~$ show ip route isis +Codes: K - kernel route, C - connected, S - static, R - RIP, + O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP, + T - Table, v - VNC, V - VNC-Direct, A - Babel, F - PBR, + f - OpenFabric, + > - selected route, * - FIB route, q - queued, r - rejected, b - backup + t - trapped, o - offload failure + +I 192.0.2.0/24 [115/20] via 192.0.2.1, eth1 inactive, weight 1, 00:07:46 +I>* 192.168.255.255/32 [115/20] via 192.0.2.1, eth1, label IPv4 Explicit Null, weight 1, 00:03:43 +``` + + +### Enable OSPF with Segment Routing (Experimental): + +**Node 1** + +```none +set interfaces loopback lo address 10.1.1.1/32 +set interfaces ethernet eth0 address 192.168.0.1/24 +set protocols ospf area 0 network '192.168.0.0/24' +set protocols ospf area 0 network '10.1.1.1/32' +set protocols ospf parameters opaque-lsa +set protocols ospf parameters router-id '10.1.1.1' +set protocols ospf segment-routing global-block high-label-value '1100' +set protocols ospf segment-routing global-block low-label-value '1000' +set protocols ospf segment-routing prefix 10.1.1.1/32 index explicit-null +set protocols ospf segment-routing prefix 10.1.1.1/32 index value '1' +``` + +**Node 2** + +```none +set interfaces loopback lo address 10.1.1.2/32 +set interfaces ethernet eth0 address 192.168.0.2/24 +set protocols ospf area 0 network '192.168.0.0/24' +set protocols ospf area 0 network '10.1.1.2/32' +set protocols ospf parameters opaque-lsa +set protocols ospf parameters router-id '10.1.1.2' +set protocols ospf segment-routing global-block high-label-value '1100' +set protocols ospf segment-routing global-block low-label-value '1000' +set protocols ospf segment-routing prefix 10.1.1.2/32 index explicit-null +set protocols ospf segment-routing prefix 10.1.1.2/32 index value '2' +``` + +This gives us MPLS segment routing enabled and labels for far end loopbacks: + +```none +Node-1@vyos:~$ show mpls table + Inbound Label Type Nexthop Outbound Label + ----------------------------------------------------------- + 1002 SR (OSPF) 192.168.0.2 IPv4 Explicit Null <-- Node-2 loopback learned on Node-1 + 15000 SR (OSPF) 192.168.0.2 implicit-null + 15001 SR (OSPF) 192.168.0.2 implicit-null + +Node-2@vyos:~$ show mpls table + Inbound Label Type Nexthop Outbound Label + ----------------------------------------------------------- + 1001 SR (OSPF) 192.168.0.1 IPv4 Explicit Null <-- Node-1 loopback learned on Node-2 + 15000 SR (OSPF) 192.168.0.1 implicit-null + 15001 SR (OSPF) 192.168.0.1 implicit-null +``` + +Here is the routing tables showing the MPLS segment routing label operations: + +```none +Node-1@vyos:~$ show ip route ospf +Codes: K - kernel route, C - connected, S - static, R - RIP, + O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP, + T - Table, v - VNC, V - VNC-Direct, A - Babel, F - PBR, + f - OpenFabric, + > - selected route, * - FIB route, q - queued, r - rejected, b - backup + t - trapped, o - offload failure + +O 10.1.1.1/32 [110/0] is directly connected, lo, weight 1, 00:03:43 +O>* 10.1.1.2/32 [110/1] via 192.168.0.2, eth0, label IPv4 Explicit Null, weight 1, 00:03:32 +O 192.168.0.0/24 [110/1] is directly connected, eth0, weight 1, 00:03:43 + +Node-2@vyos:~$ show ip route ospf +Codes: K - kernel route, C - connected, S - static, R - RIP, + O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP, + T - Table, v - VNC, V - VNC-Direct, A - Babel, F - PBR, + f - OpenFabric, + > - selected route, * - FIB route, q - queued, r - rejected, b - backup + t - trapped, o - offload failure + +O>* 10.1.1.1/32 [110/1] via 192.168.0.1, eth0, label IPv4 Explicit Null, weight 1, 00:03:36 +O 10.1.1.2/32 [110/0] is directly connected, lo, weight 1, 00:03:51 +O 192.168.0.0/24 [110/1] is directly connected, eth0, weight 1, 00:03:51 +``` diff --git a/docs/configuration/protocols/segment-routing.rst b/docs/configuration/protocols/segment-routing.rst deleted file mode 100644 index 5ee710e9..00000000 --- a/docs/configuration/protocols/segment-routing.rst +++ /dev/null @@ -1,357 +0,0 @@ -.. _segment-routing: - -############### -Segment Routing -############### - -Segment Routing (SR) is a network architecture that is similar to source-routing -. In this architecture, the ingress router adds a list of segments, known as -SIDs, to the packet as it enters the network. These segments represent different -portions of the network path that the packet will take. - -The SR segments are portions of the network path taken by the packet, and are -called SIDs. At each node, the first SID of the list is read, executed as a -forwarding function, and may be popped to let the next node read the next SID of -the list. The SID list completely determines the path where the packet is -forwarded. - -Segment Routing can be applied to an existing MPLS-based data plane and defines -a control plane network architecture. In MPLS networks, segments are encoded as -MPLS labels and are added at the ingress router. These MPLS labels are then -exchanged and populated by Interior Gateway Protocols (IGPs) like IS-IS or OSPF -which are running on most ISPs. - - -.. note:: Segment routing defines a control plane network architecture and - can be applied to an existing MPLS based dataplane. In the MPLS networks, - segments are encoded as MPLS labels and are imposed at the ingress router. - MPLS labels are exchanged and populated by IGPs like IS-IS.Segment Routing - as per RFC8667 for MPLS dataplane. It supports IPv4, IPv6 and ECMP and has - been tested against Cisco & Juniper routers.however,this deployment is still - EXPERIMENTAL for FRR. - - -IS-IS SR Configuration ----------------------- - -Segment routing (SR) is used by the IGP protocols to interconnect network -devices, below configuration shows how to enable SR on IS-IS: - - -.. note:: ``Known limitations:`` - - No support for level redistribution (L1 to L2 or L2 to L1) - - No support for binding SID - - No support for SRLB - - Only one SRGB and default SPF Algorithm is supported - - - -.. cfgcmd:: set protocols isis segment-routing global-block high-label-value - - - Set the Segment Routing Global Block i.e. the label range used by MPLS to - store label in the MPLS FIB for Prefix SID. Note that the block size may - not exceed 65535. - -.. cfgcmd:: set protocols isis segment-routing global-block low-label-value - - - Set the Segment Routing Global Block i.e. the low label range used by MPLS to - store label in the MPLS FIB for Prefix SID. Note that the block size may - not exceed 65535. - -.. cfgcmd:: set protocols isis segment-routing local-block high-label-value - - - Set the Segment Routing Local Block i.e. the label range used by MPLS to - store label in the MPLS FIB for Prefix SID. Note that the block size may - not exceed 65535.Segment Routing Local Block, The negative command always - unsets both. - -.. cfgcmd:: set protocols isis segment-routing local-block - - Set the Segment Routing Local Block i.e. the low label range used by MPLS to - store label in the MPLS FIB for Prefix SID. Note that the block size may - not exceed 65535.Segment Routing Local Block, The negative command always - unsets both. - -.. cfgcmd:: set protocols isis segment-routing maximum-label-depth <1-16> - - Set the Maximum Stack Depth supported by the router. The value depend of - the MPLS dataplane. - -.. cfgcmd:: set protocols isis segment-routing prefix
index value - <0-65535> - - A segment ID that contains an IP address prefix calculated by an IGP in the - service provider core network. Prefix SIDs are globally unique, this value - indentify it - -.. cfgcmd:: set protocols isis segment-routing prefix
index - - - this option allows to configure prefix-sid on SR. The ‘no-php-flag’ means NO - Penultimate Hop Popping that allows SR node to request to its neighbor to - not pop the label. The ‘explicit-null’ flag allows SR node to request to its - neighbor to send IP packet with the EXPLICIT-NULL label. The ‘n-flag-clear’ - option can be used to explicitly clear the Node flag that is set by default - for Prefix-SIDs associated to loopback addresses. This option is necessary - to configure Anycast-SIDs. - - -.. opcmd:: show isis segment-routing node - - Show detailed information about all learned Segment Routing Nodes - -.. opcmd:: show isis route prefix-sid - - Show detailed information about prefix-sid and label learned - -.. note:: more information related IGP - :ref:`routing-isis` - - - -OSPF SR Configuration ----------------------- - -Segment routing (SR) is used by the IGP protocols to interconnect network -devices, below configuration shows how to enable SR on OSPF: - -.. cfgcmd:: set protocols ospf parameters opaque-lsa - - Enable the Opaque-LSA capability (rfc2370), necessary to transport label - on IGP - - -.. cfgcmd:: set protocols ospf segment-routing global-block high-label-value - - - Set the Segment Routing Global Block i.e. the label range used by MPLS to - store label in the MPLS FIB for Prefix SID. Note that the block size may - not exceed 65535. - -.. cfgcmd:: set protocols ospf segment-routing global-block low-label-value - - - Set the Segment Routing Global Block i.e. the low label range used by MPLS to - store label in the MPLS FIB for Prefix SID. Note that the block size may - not exceed 65535. - -.. cfgcmd:: set protocols ospf segment-routing local-block high-label-value - - - Set the Segment Routing Local Block i.e. the label range used by MPLS to - store label in the MPLS FIB for Prefix SID. Note that the block size may - not exceed 65535.Segment Routing Local Block, The negative command always - unsets both. - -.. cfgcmd:: set protocols ospf segment-routing local-block - - Set the Segment Routing Local Block i.e. the low label range used by MPLS to - store label in the MPLS FIB for Prefix SID. Note that the block size may - not exceed 65535.Segment Routing Local Block, The negative command always - unsets both. - -.. cfgcmd:: set protocols ospf segment-routing maximum-label-depth <1-16> - - Set the Maximum Stack Depth supported by the router. The value depend of - the MPLS dataplane. - -.. cfgcmd:: set protocols ospf segment-routing prefix
index value - <0-65535> - - A segment ID that contains an IP address prefix calculated by an IGP in the - service provider core network. Prefix SIDs are globally unique, this value - indentify it - -.. cfgcmd:: set protocols ospf segment-routing prefix
index - - - this option allows to configure prefix-sid on SR. The ‘no-php-flag’ means NO - Penultimate Hop Popping that allows SR node to request to its neighbor to - not pop the label. The ‘explicit-null’ flag allows SR node to request to its - neighbor to send IP packet with the EXPLICIT-NULL label. The ‘n-flag-clear’ - option can be used to explicitly clear the Node flag that is set by default - for Prefix-SIDs associated to loopback addresses. This option is necessary - to configure Anycast-SIDs. - -.. note:: more information related IGP - :ref:`routing-ospf` - -Configuration Example ---------------------- - -we described the configuration SR ISIS / SR OSPF using 2 connected with them to -share label information. - -Enable IS-IS with Segment Routing (Experimental) -================================================ - -**Node 1:** - -.. code-block:: none - - set interfaces loopback lo address '192.168.255.255/32' - set interfaces ethernet eth1 address '192.0.2.1/24' - - set protocols isis interface eth1 - set protocols isis interface lo - set protocols isis net '49.0001.1921.6825.5255.00' - set protocols isis segment-routing global-block high-label-value '599' - set protocols isis segment-routing global-block low-label-value '550' - set protocols isis segment-routing prefix 192.168.255.255/32 index value '1' - set protocols isis segment-routing prefix 192.168.255.255/32 index explicit-null - set protocols mpls interface 'eth1' - -**Node 2:** - -.. code-block:: none - - set interfaces loopback lo address '192.168.255.254/32' - set interfaces ethernet eth1 address '192.0.2.2/24' - - set protocols isis interface eth1 - set protocols isis interface lo - set protocols isis net '49.0001.1921.6825.5254.00' - set protocols isis segment-routing global-block high-label-value '599' - set protocols isis segment-routing global-block low-label-value '550' - set protocols isis segment-routing prefix 192.168.255.254/32 index value '2' - set protocols isis segment-routing prefix 192.168.255.254/32 index explicit-null - set protocols mpls interface 'eth1' - - - -This gives us MPLS segment routing enabled and labels for far end loopbacks: - -.. code-block:: none - - Node-1@vyos:~$ show mpls table - Inbound Label Type Nexthop Outbound Label - ---------------------------------------------------------------------- - 552 SR (IS-IS) 192.0.2.2 IPv4 Explicit Null <-- Node-2 loopback learned on Node-1 - 15000 SR (IS-IS) 192.0.2.2 implicit-null - 15001 SR (IS-IS) fe80::e87:6cff:fe09:1 implicit-null - 15002 SR (IS-IS) 192.0.2.2 implicit-null - 15003 SR (IS-IS) fe80::e87:6cff:fe09:1 implicit-null - - Node-2@vyos:~$ show mpls table - Inbound Label Type Nexthop Outbound Label - --------------------------------------------------------------------- - 551 SR (IS-IS) 192.0.2.1 IPv4 Explicit Null <-- Node-1 loopback learned on Node-2 - 15000 SR (IS-IS) 192.0.2.1 implicit-null - 15001 SR (IS-IS) fe80::e33:2ff:fe80:1 implicit-null - 15002 SR (IS-IS) 192.0.2.1 implicit-null - 15003 SR (IS-IS) fe80::e33:2ff:fe80:1 implicit-null - -Here is the routing tables showing the MPLS segment routing label operations: - -.. code-block:: none - - Node-1@vyos:~$ show ip route isis - Codes: K - kernel route, C - connected, S - static, R - RIP, - O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP, - T - Table, v - VNC, V - VNC-Direct, A - Babel, F - PBR, - f - OpenFabric, - > - selected route, * - FIB route, q - queued, r - rejected, b - backup - t - trapped, o - offload failure - - I 192.0.2.0/24 [115/20] via 192.0.2.2, eth1 inactive, weight 1, 00:07:48 - I>* 192.168.255.254/32 [115/20] via 192.0.2.2, eth1, label IPv4 Explicit Null, weight 1, 00:03:39 - - Node-2@vyos:~$ show ip route isis - Codes: K - kernel route, C - connected, S - static, R - RIP, - O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP, - T - Table, v - VNC, V - VNC-Direct, A - Babel, F - PBR, - f - OpenFabric, - > - selected route, * - FIB route, q - queued, r - rejected, b - backup - t - trapped, o - offload failure - - I 192.0.2.0/24 [115/20] via 192.0.2.1, eth1 inactive, weight 1, 00:07:46 - I>* 192.168.255.255/32 [115/20] via 192.0.2.1, eth1, label IPv4 Explicit Null, weight 1, 00:03:43 - - -Enable OSPF with Segment Routing (Experimental): -================================================ - -**Node 1** - -.. code-block:: none - - set interfaces loopback lo address 10.1.1.1/32 - set interfaces ethernet eth0 address 192.168.0.1/24 - set protocols ospf area 0 network '192.168.0.0/24' - set protocols ospf area 0 network '10.1.1.1/32' - set protocols ospf parameters opaque-lsa - set protocols ospf parameters router-id '10.1.1.1' - set protocols ospf segment-routing global-block high-label-value '1100' - set protocols ospf segment-routing global-block low-label-value '1000' - set protocols ospf segment-routing prefix 10.1.1.1/32 index explicit-null - set protocols ospf segment-routing prefix 10.1.1.1/32 index value '1' - -**Node 2** - -.. code-block:: none - - set interfaces loopback lo address 10.1.1.2/32 - set interfaces ethernet eth0 address 192.168.0.2/24 - set protocols ospf area 0 network '192.168.0.0/24' - set protocols ospf area 0 network '10.1.1.2/32' - set protocols ospf parameters opaque-lsa - set protocols ospf parameters router-id '10.1.1.2' - set protocols ospf segment-routing global-block high-label-value '1100' - set protocols ospf segment-routing global-block low-label-value '1000' - set protocols ospf segment-routing prefix 10.1.1.2/32 index explicit-null - set protocols ospf segment-routing prefix 10.1.1.2/32 index value '2' - - -This gives us MPLS segment routing enabled and labels for far end loopbacks: - -.. code-block:: none - - Node-1@vyos:~$ show mpls table - Inbound Label Type Nexthop Outbound Label - ----------------------------------------------------------- - 1002 SR (OSPF) 192.168.0.2 IPv4 Explicit Null <-- Node-2 loopback learned on Node-1 - 15000 SR (OSPF) 192.168.0.2 implicit-null - 15001 SR (OSPF) 192.168.0.2 implicit-null - - Node-2@vyos:~$ show mpls table - Inbound Label Type Nexthop Outbound Label - ----------------------------------------------------------- - 1001 SR (OSPF) 192.168.0.1 IPv4 Explicit Null <-- Node-1 loopback learned on Node-2 - 15000 SR (OSPF) 192.168.0.1 implicit-null - 15001 SR (OSPF) 192.168.0.1 implicit-null - -Here is the routing tables showing the MPLS segment routing label operations: - -.. code-block:: none - - Node-1@vyos:~$ show ip route ospf - Codes: K - kernel route, C - connected, S - static, R - RIP, - O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP, - T - Table, v - VNC, V - VNC-Direct, A - Babel, F - PBR, - f - OpenFabric, - > - selected route, * - FIB route, q - queued, r - rejected, b - backup - t - trapped, o - offload failure - - O 10.1.1.1/32 [110/0] is directly connected, lo, weight 1, 00:03:43 - O>* 10.1.1.2/32 [110/1] via 192.168.0.2, eth0, label IPv4 Explicit Null, weight 1, 00:03:32 - O 192.168.0.0/24 [110/1] is directly connected, eth0, weight 1, 00:03:43 - - Node-2@vyos:~$ show ip route ospf - Codes: K - kernel route, C - connected, S - static, R - RIP, - O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP, - T - Table, v - VNC, V - VNC-Direct, A - Babel, F - PBR, - f - OpenFabric, - > - selected route, * - FIB route, q - queued, r - rejected, b - backup - t - trapped, o - offload failure - - O>* 10.1.1.1/32 [110/1] via 192.168.0.1, eth0, label IPv4 Explicit Null, weight 1, 00:03:36 - O 10.1.1.2/32 [110/0] is directly connected, lo, weight 1, 00:03:51 - O 192.168.0.0/24 [110/1] is directly connected, eth0, weight 1, 00:03:51 - diff --git a/docs/configuration/protocols/static.md b/docs/configuration/protocols/static.md new file mode 100644 index 00000000..fca17a6c --- /dev/null +++ b/docs/configuration/protocols/static.md @@ -0,0 +1,268 @@ +(routing-static)= + +# Static + +Static routes are manually configured routes, which, in general, cannot be +updated dynamically from information VyOS learns about the network topology from +other routing protocols. However, if a link fails, the router will remove +routes, including static routes, from the {abbr}`RIPB (Routing Information +Base)` that used this interface to reach the next hop. In general, static +routes should only be used for very simple network topologies, or to override +the behavior of a dynamic routing protocol for a small number of routes. The +collection of all routes the router has learned from its configuration or from +its dynamic routing protocols is stored in the RIB. Unicast routes are directly +used to determine the forwarding table used for unicast packet forwarding. + +## Static Routes + +```{eval-rst} +.. cfgcmd:: set protocols static route next-hop
+ + Configure next-hop `
` for an IPv4 static route. Multiple static + routes can be created. +``` + +```{eval-rst} +.. cfgcmd:: set protocols static route next-hop
disable + + Disable this IPv4 static route entry. +``` + +```{eval-rst} +.. cfgcmd:: set protocols static route next-hop
+ distance + + Defines next-hop distance for this route, routes with smaller administrative + distance are elected prior to those with a higher distance. + + Range is 1 to 255, default is 1. + + .. note:: Routes with a distance of 255 are effectively disabled and not + installed into the kernel. +``` + +```{eval-rst} +.. cfgcmd:: set protocols static route6 next-hop
+ + Configure next-hop `
` for an IPv6 static route. Multiple static + routes can be created. +``` + +```{eval-rst} +.. cfgcmd:: set protocols static route6 next-hop
disable + + Disable this IPv6 static route entry. +``` + +```{eval-rst} +.. cfgcmd:: set protocols static route6 next-hop
+ distance + + Defines next-hop distance for this route, routes with smaller administrative + distance are elected prior to those with a higher distance. + + Range is 1 to 255, default is 1. + + .. note:: Routes with a distance of 255 are effectively disabled and not + installed into the kernel. +``` + +```{eval-rst} +.. cfgcmd:: set protocols static route6 next-hop
segments + + It is possible to specify a static route for ipv6 prefixes using an SRv6 segments + instruction. The `/` separator can be used to specify multiple segment instructions. + + Example: + + .. code-block:: none + + set protocols static route6 2001:db8:1000::/36 next-hop 2001:db8:201::ffff segments '2001:db8:aaaa::7/2002::4/2002::3/2002::2' + + .. code-block:: none + + vyos@vyos:~$ show ipv6 route + Codes: K - kernel route, C - connected, S - static, R - RIPng, + O - OSPFv3, I - IS-IS, B - BGP, N - NHRP, T - Table, + v - VNC, V - VNC-Direct, A - Babel, F - PBR, + f - OpenFabric, + > - selected route, * - FIB route, q - queued, r - rejected, b - backup + t - trapped, o - offload failure + C>* 2001:db8:201::/64 is directly connected, eth0.201, 00:00:46 + S>* 2001:db8:1000::/36 [1/0] via 2001:db8:201::ffff, eth0.201, seg6 2001:db8:aaaa::7,2002::4,2002::3,2002::2, weight 1, 00:00:08 + +``` + +### Interface Routes + +```{eval-rst} +.. cfgcmd:: set protocols static route interface + + + Allows you to configure the next-hop interface for an interface-based IPv4 + static route. `` will be the next-hop interface where traffic is + routed for the given ``. +``` + +```{eval-rst} +.. cfgcmd:: set protocols static route interface + disable + + Disables interface-based IPv4 static route. +``` + +```{eval-rst} +.. cfgcmd:: set protocols static route interface + distance + + Defines next-hop distance for this route, routes with smaller administrative + distance are elected prior to those with a higher distance. + + Range is 1 to 255, default is 1. +``` + +```{eval-rst} +.. cfgcmd:: set protocols static route6 interface + + + Allows you to configure the next-hop interface for an interface-based IPv6 + static route. `` will be the next-hop interface where traffic is + routed for the given ``. +``` + +```{eval-rst} +.. cfgcmd:: set protocols static route6 interface + disable + + Disables interface-based IPv6 static route. +``` + +```{eval-rst} +.. cfgcmd:: set protocols static route6 interface + distance + + Defines next-hop distance for this route, routes with smaller administrative + distance are elected prior to those with a higher distance. + + Range is 1 to 255, default is 1. +``` + +```{eval-rst} +.. cfgcmd:: set protocols static route6 interface + segments + + It is possible to specify a static route for ipv6 prefixes using an SRv6 segments + instruction. The `/` separator can be used to specify multiple segment instructions. + + Example: + + .. code-block:: none + + set protocols static route6 2001:db8:1000::/36 interface eth0 segments '2001:db8:aaaa::7/2002::4/2002::3/2002::2' +``` + +### Blackhole + +```{eval-rst} +.. cfgcmd:: set protocols static route blackhole + + Use this command to configure a "black-hole" route on the router. A + black-hole route is a route for which the system silently discard packets + that are matched. This prevents networks leaking out public interfaces, but + it does not prevent them from being used as a more specific route inside your + network. +``` + +```{eval-rst} +.. cfgcmd:: set protocols static route blackhole distance + + Defines blackhole distance for this route, routes with smaller administrative + distance are elected prior to those with a higher distance. +``` + +```{eval-rst} +.. cfgcmd:: set protocols static route6 blackhole + + Use this command to configure a "black-hole" route on the router. A + black-hole route is a route for which the system silently discard packets + that are matched. This prevents networks leaking out public interfaces, but + it does not prevent them from being used as a more specific route inside your + network. +``` + +```{eval-rst} +.. cfgcmd:: set protocols static route6 blackhole distance + + Defines blackhole distance for this route, routes with smaller administrative + distance are elected prior to those with a higher distance. +``` + +### Alternate Routing Tables + +TBD + +Alternate routing tables are used with policy based routing by utilizing +{ref}`vrf`. + +(routing-arp)= + +# ARP + +{abbr}`ARP (Address Resolution Protocol)` is a communication protocol used for +discovering the link layer address, such as a MAC address, associated with a +given internet layer address, typically an IPv4 address. This mapping is a +critical function in the Internet protocol suite. ARP was defined in 1982 by +{rfc}`826` which is Internet Standard STD 37. + +In Internet Protocol Version 6 (IPv6) networks, the functionality of ARP is +provided by the Neighbor Discovery Protocol (NDP). + +To manipulate or display [ARP] table entries, the following commands are +implemented. + +## Configure + +```{eval-rst} +.. cfgcmd:: set protocols static arp interface address + mac + + This will configure a static ARP entry always resolving `
` to + `` for interface ``. + + Example: + + .. code-block:: none + + set protocols static arp interface eth0 address 192.0.2.1 mac 01:23:45:67:89:01 + +``` + +## Operation + +```{eval-rst} +.. opcmd:: show protocols static arp + + Display all known ARP table entries spanning across all interfaces +``` + +```none +vyos@vyos:~$ show protocols static arp +Address HWtype HWaddress Flags Mask Iface +10.1.1.1 ether 00:53:00:de:23:2e C eth1 +10.1.1.100 ether 00:53:00:de:23:aa CM eth1 +``` + +```{eval-rst} +.. opcmd:: show protocols static arp interface eth1 + + Display all known ARP table entries on a given interface only (`eth1`): +``` + +```none +vyos@vyos:~$ show protocols static arp interface eth1 +Address HWtype HWaddress Flags Mask Iface +10.1.1.1 ether 00:53:00:de:23:2e C eth1 +10.1.1.100 ether 00:53:00:de:23:aa CM eth1 +``` + +[arp]: https://en.wikipedia.org/wiki/Address_Resolution_Protocol diff --git a/docs/configuration/protocols/static.rst b/docs/configuration/protocols/static.rst deleted file mode 100644 index bfc25201..00000000 --- a/docs/configuration/protocols/static.rst +++ /dev/null @@ -1,242 +0,0 @@ -.. _routing-static: - -###### -Static -###### - -Static routes are manually configured routes, which, in general, cannot be -updated dynamically from information VyOS learns about the network topology from -other routing protocols. However, if a link fails, the router will remove -routes, including static routes, from the :abbr:`RIPB (Routing Information -Base)` that used this interface to reach the next hop. In general, static -routes should only be used for very simple network topologies, or to override -the behavior of a dynamic routing protocol for a small number of routes. The -collection of all routes the router has learned from its configuration or from -its dynamic routing protocols is stored in the RIB. Unicast routes are directly -used to determine the forwarding table used for unicast packet forwarding. - -************* -Static Routes -************* - -.. cfgcmd:: set protocols static route next-hop
- - Configure next-hop `
` for an IPv4 static route. Multiple static - routes can be created. - -.. cfgcmd:: set protocols static route next-hop
disable - - Disable this IPv4 static route entry. - -.. cfgcmd:: set protocols static route next-hop
- distance - - Defines next-hop distance for this route, routes with smaller administrative - distance are elected prior to those with a higher distance. - - Range is 1 to 255, default is 1. - - .. note:: Routes with a distance of 255 are effectively disabled and not - installed into the kernel. - -.. cfgcmd:: set protocols static route6 next-hop
- - Configure next-hop `
` for an IPv6 static route. Multiple static - routes can be created. - -.. cfgcmd:: set protocols static route6 next-hop
disable - - Disable this IPv6 static route entry. - -.. cfgcmd:: set protocols static route6 next-hop
- distance - - Defines next-hop distance for this route, routes with smaller administrative - distance are elected prior to those with a higher distance. - - Range is 1 to 255, default is 1. - - .. note:: Routes with a distance of 255 are effectively disabled and not - installed into the kernel. - -.. cfgcmd:: set protocols static route6 next-hop
segments - - It is possible to specify a static route for ipv6 prefixes using an SRv6 segments - instruction. The `/` separator can be used to specify multiple segment instructions. - - Example: - - .. code-block:: none - - set protocols static route6 2001:db8:1000::/36 next-hop 2001:db8:201::ffff segments '2001:db8:aaaa::7/2002::4/2002::3/2002::2' - - .. code-block:: none - - vyos@vyos:~$ show ipv6 route - Codes: K - kernel route, C - connected, S - static, R - RIPng, - O - OSPFv3, I - IS-IS, B - BGP, N - NHRP, T - Table, - v - VNC, V - VNC-Direct, A - Babel, F - PBR, - f - OpenFabric, - > - selected route, * - FIB route, q - queued, r - rejected, b - backup - t - trapped, o - offload failure - C>* 2001:db8:201::/64 is directly connected, eth0.201, 00:00:46 - S>* 2001:db8:1000::/36 [1/0] via 2001:db8:201::ffff, eth0.201, seg6 2001:db8:aaaa::7,2002::4,2002::3,2002::2, weight 1, 00:00:08 - - -Interface Routes -================ - -.. cfgcmd:: set protocols static route interface - - - Allows you to configure the next-hop interface for an interface-based IPv4 - static route. `` will be the next-hop interface where traffic is - routed for the given ``. - -.. cfgcmd:: set protocols static route interface - disable - - Disables interface-based IPv4 static route. - -.. cfgcmd:: set protocols static route interface - distance - - Defines next-hop distance for this route, routes with smaller administrative - distance are elected prior to those with a higher distance. - - Range is 1 to 255, default is 1. - -.. cfgcmd:: set protocols static route6 interface - - - Allows you to configure the next-hop interface for an interface-based IPv6 - static route. `` will be the next-hop interface where traffic is - routed for the given ``. - -.. cfgcmd:: set protocols static route6 interface - disable - - Disables interface-based IPv6 static route. - -.. cfgcmd:: set protocols static route6 interface - distance - - Defines next-hop distance for this route, routes with smaller administrative - distance are elected prior to those with a higher distance. - - Range is 1 to 255, default is 1. - -.. cfgcmd:: set protocols static route6 interface - segments - - It is possible to specify a static route for ipv6 prefixes using an SRv6 segments - instruction. The `/` separator can be used to specify multiple segment instructions. - - Example: - - .. code-block:: none - - set protocols static route6 2001:db8:1000::/36 interface eth0 segments '2001:db8:aaaa::7/2002::4/2002::3/2002::2' - -Blackhole -========= - -.. cfgcmd:: set protocols static route blackhole - - Use this command to configure a "black-hole" route on the router. A - black-hole route is a route for which the system silently discard packets - that are matched. This prevents networks leaking out public interfaces, but - it does not prevent them from being used as a more specific route inside your - network. - -.. cfgcmd:: set protocols static route blackhole distance - - Defines blackhole distance for this route, routes with smaller administrative - distance are elected prior to those with a higher distance. - -.. cfgcmd:: set protocols static route6 blackhole - - Use this command to configure a "black-hole" route on the router. A - black-hole route is a route for which the system silently discard packets - that are matched. This prevents networks leaking out public interfaces, but - it does not prevent them from being used as a more specific route inside your - network. - -.. cfgcmd:: set protocols static route6 blackhole distance - - Defines blackhole distance for this route, routes with smaller administrative - distance are elected prior to those with a higher distance. - -Alternate Routing Tables -======================== - -TBD - -Alternate routing tables are used with policy based routing by utilizing -:ref:`vrf`. - - -.. _routing-arp: - -### -ARP -### - -:abbr:`ARP (Address Resolution Protocol)` is a communication protocol used for -discovering the link layer address, such as a MAC address, associated with a -given internet layer address, typically an IPv4 address. This mapping is a -critical function in the Internet protocol suite. ARP was defined in 1982 by -:rfc:`826` which is Internet Standard STD 37. - -In Internet Protocol Version 6 (IPv6) networks, the functionality of ARP is -provided by the Neighbor Discovery Protocol (NDP). - -To manipulate or display ARP_ table entries, the following commands are -implemented. - -********* -Configure -********* - -.. cfgcmd:: set protocols static arp interface address - mac - - This will configure a static ARP entry always resolving `
` to - `` for interface ``. - - Example: - - .. code-block:: none - - set protocols static arp interface eth0 address 192.0.2.1 mac 01:23:45:67:89:01 - - -********* -Operation -********* - - -.. opcmd:: show protocols static arp - - Display all known ARP table entries spanning across all interfaces - -.. code-block:: none - - vyos@vyos:~$ show protocols static arp - Address HWtype HWaddress Flags Mask Iface - 10.1.1.1 ether 00:53:00:de:23:2e C eth1 - 10.1.1.100 ether 00:53:00:de:23:aa CM eth1 - - -.. opcmd:: show protocols static arp interface eth1 - - Display all known ARP table entries on a given interface only (`eth1`): - -.. code-block:: none - - vyos@vyos:~$ show protocols static arp interface eth1 - Address HWtype HWaddress Flags Mask Iface - 10.1.1.1 ether 00:53:00:de:23:2e C eth1 - 10.1.1.100 ether 00:53:00:de:23:aa CM eth1 - -.. _ARP: https://en.wikipedia.org/wiki/Address_Resolution_Protocol -- cgit v1.2.3