Description
With SONiC mgmt-framework it is possible to configure BGP via ConfigDB instead of writing frr.conf and reloading FRR. This would potentially make metal-core more stable as the frr-reload.service is often flaky—randomly failing and succeeding on second attempt—or taking very long and causing timeouts. With mgmt-framework, updates to the ConfigDB will instantly be reflected in the FRR config.
However, the mgmt-framework is not complete, especially in community and edgecore SONiC. In this issue we would like to track what features we need and how or if it can be configured via mgmt-framework.
What we need:
frr defaults datacenter
!
! Each VRF is associated with a L3VNI.
vrf Vrf20
vni 20
exit-vrf
!
! Each interface participating in a BGP session needs this config.
interface Ethernet3
ipv6 nd ra-interval 6
no ipv6 nd suppress-ra
exit
!
interface Ethernet0
ipv6 nd ra-interval 6
no ipv6 nd suppress-ra
exit
!
interface Ethernet47
ipv6 nd ra-interval 6
no ipv6 nd suppress-ra
exit
!
router bgp 4200000012
bgp router-id 10.0.0.12
! Enable multipath-relax.
bgp bestpath as-path multipath-relax
! Create peer groups.
neighbor FABRIC peer-group
! Set remote-as.
neighbor FABRIC remote-as external
! Set BGP timers.
neighbor FABRIC timers 2 8
neighbor FIREWALL peer-group
neighbor FIREWALL remote-as external
neighbor FIREWALL timers 2 8
! Add unnumbered BGP peers in a peer group.
neighbor Ethernet47 interface peer-group FABRIC
neighbor Ethernet0 interface peer-group FIREWALL
!
address-family ipv4 unicast
! Redistribute routes restricted by route maps.
redistribute connected route-map DENY_MGMT
! Allow AS.
neighbor FIREWALL allowas-in 2
! Incoming and outgoing route maps.
neighbor Ethernet0 route-map fw-Ethernet0-in in
exit-address-family
!
address-family ipv6 unicast
redistribute connected route-map DENY_MGMT
neighbor FIREWALL activate
neighbor FIREWALL allowas-in 2
neighbor Ethernet0 route-map fw-Ethernet0-in in
exit-address-family
!
address-family l2vpn evpn
neighbor FABRIC activate
neighbor FABRIC allowas-in 2
neighbor FIREWALL activate
neighbor FIREWALL allowas-in 2
! Advertise all VNIs.
advertise-all-vni
exit-address-family
exit
!
router bgp 4200000012 vrf Vrf20
bgp router-id 10.0.0.12
bgp bestpath as-path multipath-relax
neighbor MACHINE peer-group
neighbor MACHINE remote-as external
neighbor MACHINE timers 2 8
neighbor Ethernet3 interface peer-group MACHINE
!
address-family ipv4 unicast
redistribute connected
neighbor MACHINE maximum-prefix 24000
neighbor MACHINE route-map Vrf20-in in
exit-address-family
!
address-family l2vpn evpn
advertise ipv4 unicast
exit-address-family
exit
!
! Add prefix lists.
ip prefix-list fw-Ethernet0-in-prefixes seq 5 permit 10.4.0.2/32 le 32
ip prefix-list Vrf20-in-prefixes seq 5 permit 10.4.0.2/32 le 32
ip prefix-list Vrf20-in-prefixes seq 10 permit 10.100.253.130/32 le 32
ip prefix-list Vrf20-in-prefixes seq 15 permit 10.128.0.0/24 le 32
ip prefix-list Vrf20-in-prefixes seq 20 permit 10.240.0.0/12 le 32
!
! Add route maps
route-map DENY_MGMT deny 10
match interface eth0
exit
!
route-map DENY_MGMT permit 20
exit
!
route-map fw-Ethernet0-in permit 10
! Match prefix lists.
match ip address prefix-list fw-Ethernet0-in-prefixes
exit
!
route-map fw-Ethernet0-in permit 10
! Match VNIs.
match evpn vni 20
exit
!
route-map Vrf20-in permit 10
match ip address prefix-list Vrf20-in-prefixes
exit
!
! Set default source address to loopback.
route-map RM_SET_SRC permit 10
set src 10.0.0.12
exit
!
ip protocol bgp route-map RM_SET_SRC
Description
With SONiC mgmt-framework it is possible to configure BGP via ConfigDB instead of writing frr.conf and reloading FRR. This would potentially make metal-core more stable as the frr-reload.service is often flaky—randomly failing and succeeding on second attempt—or taking very long and causing timeouts. With mgmt-framework, updates to the ConfigDB will instantly be reflected in the FRR config.
However, the mgmt-framework is not complete, especially in community and edgecore SONiC. In this issue we would like to track what features we need and how or if it can be configured via mgmt-framework.
What we need: