exit: strip own AS prefix from routes received by firewalls

For some reason routes with own ASN are not imported into default VRF.
Maybe also others. These routes forward packets through the firewalls.
As long as both exits are up this is not a problem, because routes
going to peer exit don’t include this exit’s own ASN.

If the peer goes down, all remaining routes sent by firewalls have our
own ASN and are not imported into default VRF, so L3 servers lose
connectivity to internal networks.

If the exit strips own ASN from received routes, importing works OK.
We strip both our and peer’s ASNs to keep path lengths the same.

This has involved an indecent amount of poking knobs and knobbing
pokes and it might cause other issues elsewhere.

roles/exit/templates/frr.conf.j2

@@ -392,10 +392,12 @@ route-map firewall->outside permit 41
 route-map firewall-{{ loop.index }}->inside permit 1
   set tag {{ loop.index }}
   set weight {{ 100 * loop.index }}
+  set as-path exclude {{ asn.asn }} {{ hostvars[peer].asn.asn }}
   call firewall->inside
 route-map firewall-{{ loop.index }}->outside permit 1
   set tag {{ loop.index }}
   set weight {{ 100 * loop.index }}
+  set as-path exclude {{ asn.asn }} {{ hostvars[peer].asn.asn }}
   call firewall->outside
 {% endfor %}