rc/network
2
0
Fork 0
Code Issues Pull requests Actions Packages Projects Releases Wiki Activity

exit: strip own AS prefix from routes received by firewalls

Browse source 
For some reason routes with own ASN are not imported into default VRF.
Maybe also others. These routes forward packets through the firewalls.
As long as both exits are up this is not a problem, because routes
going to peer exit don’t include this exit’s own ASN.

If the peer goes down, all remaining routes sent by firewalls have our
own ASN and are not imported into default VRF, so L3 servers lose
connectivity to internal networks.

If the exit strips own ASN from received routes, importing works OK.
We strip both our and peer’s ASNs to keep path lengths the same.

This has involved an indecent amount of poking knobs and knobbing
pokes and it might cause other issues elsewhere.
This commit is contained in:
Timotej Lazar 2024-09-21 16:13:59 +02:00
parent ef1b00adce
commit 5a9f0ac26a
1 changed files with 2 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
roles/exit/templates/frr.conf.j2
View file

@ -392,10 +392,12 @@ route-map firewall->outside permit 41
route-map firewall-{{ loop.index }}->inside permit 1 route-map firewall-{{ loop.index }}->inside permit 1
set tag {{ loop.index }} set tag {{ loop.index }}
set weight {{ 100 * loop.index }} set weight {{ 100 * loop.index }}
set as-path exclude {{ asn.asn }} {{ hostvars[peer].asn.asn }}
call firewall->inside call firewall->inside
route-map firewall-{{ loop.index }}->outside permit 1 route-map firewall-{{ loop.index }}->outside permit 1
set tag {{ loop.index }} set tag {{ loop.index }}
set weight {{ 100 * loop.index }} set weight {{ 100 * loop.index }}
set as-path exclude {{ asn.asn }} {{ hostvars[peer].asn.asn }}
call firewall->outside call firewall->outside
{% endfor %} {% endfor %}