controllers: evpn: fix multiple exit-nodes with route-map filtering

Currently, when multiple exit-nodes are defined, each exit-nodes exchanges
their own default route, so traffic is looping between both exit nodes
instead going out.

This add a new route-map to filter received type-5 on exit node

Signed-off-by: Alexandre Derumier <aderumier@odiso.com>
This commit is contained in:
Alexandre Derumier 2022-04-20 16:19:30 +02:00 committed by Thomas Lamprecht
parent 824252f691
commit 916488ccca
16 changed files with 72 additions and 7 deletions

View File

@ -121,10 +121,11 @@ sub generate_controller_config {
push(@{$config->{frr}->{''}}, "ip prefix-list loopbacks_ips seq 10 permit 0.0.0.0/0 le 32"); push(@{$config->{frr}->{''}}, "ip prefix-list loopbacks_ips seq 10 permit 0.0.0.0/0 le 32");
push(@{$config->{frr}->{''}}, "ip protocol bgp route-map correct_src"); push(@{$config->{frr}->{''}}, "ip protocol bgp route-map correct_src");
my $routemap_config = []; my $routemap_config = ();
push @{$routemap_config}, "match ip address prefix-list loopbacks_ips"; push @{$routemap_config}, "match ip address prefix-list loopbacks_ips";
push @{$routemap_config}, "set src $ifaceip"; push @{$routemap_config}, "set src $ifaceip";
push(@{$config->{frr_routemap}->{'correct_src'}}, $routemap_config); my $routemap = { rule => $routemap_config, action => "permit" };
push(@{$config->{frr_routemap}->{'correct_src'}}, $routemap);
} }
return $config; return $config;

View File

@ -99,13 +99,16 @@ sub generate_controller_config {
# address-family l2vpn # address-family l2vpn
@controller_config = (); @controller_config = ();
push @controller_config, "neighbor VTEP route-map MAP_VTEP_IN in";
push @controller_config, "neighbor VTEP route-map MAP_VTEP_OUT out"; push @controller_config, "neighbor VTEP route-map MAP_VTEP_OUT out";
push @controller_config, "neighbor VTEP activate"; push @controller_config, "neighbor VTEP activate";
push @controller_config, "advertise-all-vni"; push @controller_config, "advertise-all-vni";
push @controller_config, "autort as $autortas" if $autortas; push @controller_config, "autort as $autortas" if $autortas;
push(@{$bgp->{"address-family"}->{"l2vpn evpn"}}, @controller_config); push(@{$bgp->{"address-family"}->{"l2vpn evpn"}}, @controller_config);
push(@{$config->{frr_routemap}->{'MAP_VTEP_OUT'}}, []); my $routemap = { rule => undef, action => "permit" };
push(@{$config->{frr_routemap}->{'MAP_VTEP_IN'}}, $routemap );
push(@{$config->{frr_routemap}->{'MAP_VTEP_OUT'}}, $routemap );
return $config; return $config;
} }
@ -160,14 +163,22 @@ sub generate_controller_zone_config {
if ($is_gateway) { if ($is_gateway) {
if($exitnodes_primary && $exitnodes_primary ne $local_node) { if(!$exitnodes_primary || $exitnodes_primary eq $local_node) {
#filter default type5 route coming from other exit nodes on primary node or both nodes if no primary is defined.
my $routemap_config = ();
push @{$routemap_config}, "match evpn route-type prefix";
my $routemap = { rule => $routemap_config, action => "deny" };
unshift(@{$config->{frr_routemap}->{'MAP_VTEP_IN'}}, $routemap);
} elsif ($exitnodes_primary ne $local_node) {
my $routemap_config = (); my $routemap_config = ();
push @{$routemap_config}, "match evpn vni $vrfvxlan"; push @{$routemap_config}, "match evpn vni $vrfvxlan";
push @{$routemap_config}, "match evpn route-type prefix"; push @{$routemap_config}, "match evpn route-type prefix";
push @{$routemap_config}, "set metric 200"; push @{$routemap_config}, "set metric 200";
unshift(@{$config->{frr_routemap}->{'MAP_VTEP_OUT'}}, $routemap_config); my $routemap = { rule => $routemap_config, action => "permit" };
unshift(@{$config->{frr_routemap}->{'MAP_VTEP_OUT'}}, $routemap);
} }
if (!$exitnodes_local_routing) { if (!$exitnodes_local_routing) {
@controller_config = (); @controller_config = ();
#import /32 routes of evpn network from vrf1 to default vrf (for packet return) #import /32 routes of evpn network from vrf1 to default vrf (for packet return)
@ -355,10 +366,12 @@ sub generate_frr_routemap {
my $order = 0; my $order = 0;
foreach my $seq (@$routemap) { foreach my $seq (@$routemap) {
$order++; $order++;
next if !defined($seq->{action});
my @config = (); my @config = ();
push @config, "!"; push @config, "!";
push @config, "route-map $id permit $order"; push @config, "route-map $id $seq->{action} $order";
push @config, map { " $_" } @$seq; my $rule = $seq->{rule};
push @config, map { " $_" } @$rule;
push @{$final_config}, @config; push @{$final_config}, @config;
} }
} }

View File

@ -20,6 +20,7 @@ router bgp 65000
neighbor 192.168.0.3 peer-group VTEP neighbor 192.168.0.3 peer-group VTEP
! !
address-family l2vpn evpn address-family l2vpn evpn
neighbor VTEP route-map MAP_VTEP_IN in
neighbor VTEP route-map MAP_VTEP_OUT out neighbor VTEP route-map MAP_VTEP_OUT out
neighbor VTEP activate neighbor VTEP activate
advertise-all-vni advertise-all-vni
@ -41,6 +42,8 @@ router bgp 65000 vrf vrf_myzone
advertise ipv6 unicast advertise ipv6 unicast
exit-address-family exit-address-family
! !
route-map MAP_VTEP_IN permit 1
!
route-map MAP_VTEP_OUT permit 1 route-map MAP_VTEP_OUT permit 1
! !
line vty line vty

View File

@ -20,6 +20,7 @@ router bgp 65000
neighbor 192.168.0.3 peer-group VTEP neighbor 192.168.0.3 peer-group VTEP
! !
address-family l2vpn evpn address-family l2vpn evpn
neighbor VTEP route-map MAP_VTEP_IN in
neighbor VTEP route-map MAP_VTEP_OUT out neighbor VTEP route-map MAP_VTEP_OUT out
neighbor VTEP activate neighbor VTEP activate
advertise-all-vni advertise-all-vni
@ -28,6 +29,8 @@ router bgp 65000
router bgp 65000 vrf vrf_myzone router bgp 65000 vrf vrf_myzone
bgp router-id 192.168.0.1 bgp router-id 192.168.0.1
! !
route-map MAP_VTEP_IN permit 1
!
route-map MAP_VTEP_OUT permit 1 route-map MAP_VTEP_OUT permit 1
! !
line vty line vty

View File

@ -31,6 +31,7 @@ router bgp 65001
exit-address-family exit-address-family
! !
address-family l2vpn evpn address-family l2vpn evpn
neighbor VTEP route-map MAP_VTEP_IN in
neighbor VTEP route-map MAP_VTEP_OUT out neighbor VTEP route-map MAP_VTEP_OUT out
neighbor VTEP activate neighbor VTEP activate
advertise-all-vni advertise-all-vni
@ -45,6 +46,8 @@ router bgp 65001 vrf vrf_myzone
route-target export 65000:1000 route-target export 65000:1000
exit-address-family exit-address-family
! !
route-map MAP_VTEP_IN permit 1
!
route-map MAP_VTEP_OUT permit 1 route-map MAP_VTEP_OUT permit 1
! !
line vty line vty

View File

@ -36,6 +36,7 @@ router bgp 65001
exit-address-family exit-address-family
! !
address-family l2vpn evpn address-family l2vpn evpn
neighbor VTEP route-map MAP_VTEP_IN in
neighbor VTEP route-map MAP_VTEP_OUT out neighbor VTEP route-map MAP_VTEP_OUT out
neighbor VTEP activate neighbor VTEP activate
advertise-all-vni advertise-all-vni
@ -50,6 +51,8 @@ router bgp 65001 vrf vrf_myzone
route-target export 65000:1000 route-target export 65000:1000
exit-address-family exit-address-family
! !
route-map MAP_VTEP_IN permit 1
!
route-map MAP_VTEP_OUT permit 1 route-map MAP_VTEP_OUT permit 1
! !
route-map correct_src permit 1 route-map correct_src permit 1

View File

@ -28,6 +28,7 @@ router bgp 65000
exit-address-family exit-address-family
! !
address-family l2vpn evpn address-family l2vpn evpn
neighbor VTEP route-map MAP_VTEP_IN in
neighbor VTEP route-map MAP_VTEP_OUT out neighbor VTEP route-map MAP_VTEP_OUT out
neighbor VTEP activate neighbor VTEP activate
advertise-all-vni advertise-all-vni
@ -49,6 +50,11 @@ router bgp 65000 vrf vrf_myzone
default-originate ipv6 default-originate ipv6
exit-address-family exit-address-family
! !
route-map MAP_VTEP_IN deny 1
match evpn route-type prefix
!
route-map MAP_VTEP_IN permit 2
!
route-map MAP_VTEP_OUT permit 1 route-map MAP_VTEP_OUT permit 1
! !
line vty line vty

View File

@ -21,6 +21,7 @@ router bgp 65000
neighbor 192.168.0.3 peer-group VTEP neighbor 192.168.0.3 peer-group VTEP
! !
address-family l2vpn evpn address-family l2vpn evpn
neighbor VTEP route-map MAP_VTEP_IN in
neighbor VTEP route-map MAP_VTEP_OUT out neighbor VTEP route-map MAP_VTEP_OUT out
neighbor VTEP activate neighbor VTEP activate
advertise-all-vni advertise-all-vni
@ -34,6 +35,11 @@ router bgp 65000 vrf vrf_myzone
default-originate ipv6 default-originate ipv6
exit-address-family exit-address-family
! !
route-map MAP_VTEP_IN deny 1
match evpn route-type prefix
!
route-map MAP_VTEP_IN permit 2
!
route-map MAP_VTEP_OUT permit 1 route-map MAP_VTEP_OUT permit 1
! !
line vty line vty

View File

@ -28,6 +28,7 @@ router bgp 65000
exit-address-family exit-address-family
! !
address-family l2vpn evpn address-family l2vpn evpn
neighbor VTEP route-map MAP_VTEP_IN in
neighbor VTEP route-map MAP_VTEP_OUT out neighbor VTEP route-map MAP_VTEP_OUT out
neighbor VTEP activate neighbor VTEP activate
advertise-all-vni advertise-all-vni
@ -49,6 +50,8 @@ router bgp 65000 vrf vrf_myzone
default-originate ipv6 default-originate ipv6
exit-address-family exit-address-family
! !
route-map MAP_VTEP_IN permit 1
!
route-map MAP_VTEP_OUT permit 1 route-map MAP_VTEP_OUT permit 1
match evpn vni 1000 match evpn vni 1000
match evpn route-type prefix match evpn route-type prefix

View File

@ -28,6 +28,7 @@ router bgp 65000
exit-address-family exit-address-family
! !
address-family l2vpn evpn address-family l2vpn evpn
neighbor VTEP route-map MAP_VTEP_IN in
neighbor VTEP route-map MAP_VTEP_OUT out neighbor VTEP route-map MAP_VTEP_OUT out
neighbor VTEP activate neighbor VTEP activate
advertise-all-vni advertise-all-vni
@ -49,6 +50,11 @@ router bgp 65000 vrf vrf_myzone
default-originate ipv6 default-originate ipv6
exit-address-family exit-address-family
! !
route-map MAP_VTEP_IN deny 1
match evpn route-type prefix
!
route-map MAP_VTEP_IN permit 2
!
route-map MAP_VTEP_OUT permit 1 route-map MAP_VTEP_OUT permit 1
! !
line vty line vty

View File

@ -20,6 +20,7 @@ router bgp 65000
neighbor 192.168.0.3 peer-group VTEP neighbor 192.168.0.3 peer-group VTEP
! !
address-family l2vpn evpn address-family l2vpn evpn
neighbor VTEP route-map MAP_VTEP_IN in
neighbor VTEP route-map MAP_VTEP_OUT out neighbor VTEP route-map MAP_VTEP_OUT out
neighbor VTEP activate neighbor VTEP activate
advertise-all-vni advertise-all-vni
@ -28,6 +29,8 @@ router bgp 65000
router bgp 65000 vrf vrf_myzone router bgp 65000 vrf vrf_myzone
bgp router-id 192.168.0.1 bgp router-id 192.168.0.1
! !
route-map MAP_VTEP_IN permit 1
!
route-map MAP_VTEP_OUT permit 1 route-map MAP_VTEP_OUT permit 1
! !
line vty line vty

View File

@ -20,6 +20,7 @@ router bgp 65000
neighbor 192.168.0.3 peer-group VTEP neighbor 192.168.0.3 peer-group VTEP
! !
address-family l2vpn evpn address-family l2vpn evpn
neighbor VTEP route-map MAP_VTEP_IN in
neighbor VTEP route-map MAP_VTEP_OUT out neighbor VTEP route-map MAP_VTEP_OUT out
neighbor VTEP activate neighbor VTEP activate
advertise-all-vni advertise-all-vni
@ -28,6 +29,8 @@ router bgp 65000
router bgp 65000 vrf vrf_myzone router bgp 65000 vrf vrf_myzone
bgp router-id 192.168.0.1 bgp router-id 192.168.0.1
! !
route-map MAP_VTEP_IN permit 1
!
route-map MAP_VTEP_OUT permit 1 route-map MAP_VTEP_OUT permit 1
! !
line vty line vty

View File

@ -20,6 +20,7 @@ router bgp 65000
neighbor 192.168.0.3 peer-group VTEP neighbor 192.168.0.3 peer-group VTEP
! !
address-family l2vpn evpn address-family l2vpn evpn
neighbor VTEP route-map MAP_VTEP_IN in
neighbor VTEP route-map MAP_VTEP_OUT out neighbor VTEP route-map MAP_VTEP_OUT out
neighbor VTEP activate neighbor VTEP activate
advertise-all-vni advertise-all-vni
@ -28,6 +29,8 @@ router bgp 65000
router bgp 65000 vrf vrf_myzone router bgp 65000 vrf vrf_myzone
bgp router-id 192.168.0.1 bgp router-id 192.168.0.1
! !
route-map MAP_VTEP_IN permit 1
!
route-map MAP_VTEP_OUT permit 1 route-map MAP_VTEP_OUT permit 1
! !
line vty line vty

View File

@ -20,6 +20,7 @@ router bgp 65000
neighbor 192.168.0.3 peer-group VTEP neighbor 192.168.0.3 peer-group VTEP
! !
address-family l2vpn evpn address-family l2vpn evpn
neighbor VTEP route-map MAP_VTEP_IN in
neighbor VTEP route-map MAP_VTEP_OUT out neighbor VTEP route-map MAP_VTEP_OUT out
neighbor VTEP activate neighbor VTEP activate
advertise-all-vni advertise-all-vni
@ -28,6 +29,8 @@ router bgp 65000
router bgp 65000 vrf vrf_myzone router bgp 65000 vrf vrf_myzone
bgp router-id 192.168.0.1 bgp router-id 192.168.0.1
! !
route-map MAP_VTEP_IN permit 1
!
route-map MAP_VTEP_OUT permit 1 route-map MAP_VTEP_OUT permit 1
! !
line vty line vty

View File

@ -32,6 +32,7 @@ router bgp 65000
exit-address-family exit-address-family
! !
address-family l2vpn evpn address-family l2vpn evpn
neighbor VTEP route-map MAP_VTEP_IN in
neighbor VTEP route-map MAP_VTEP_OUT out neighbor VTEP route-map MAP_VTEP_OUT out
neighbor VTEP activate neighbor VTEP activate
advertise-all-vni advertise-all-vni
@ -40,6 +41,8 @@ router bgp 65000
router bgp 65000 vrf vrf_myzone router bgp 65000 vrf vrf_myzone
bgp router-id 192.168.0.1 bgp router-id 192.168.0.1
! !
route-map MAP_VTEP_IN permit 1
!
route-map MAP_VTEP_OUT permit 1 route-map MAP_VTEP_OUT permit 1
! !
line vty line vty

View File

@ -20,6 +20,7 @@ router bgp 65000
neighbor 192.168.0.3 peer-group VTEP neighbor 192.168.0.3 peer-group VTEP
! !
address-family l2vpn evpn address-family l2vpn evpn
neighbor VTEP route-map MAP_VTEP_IN in
neighbor VTEP route-map MAP_VTEP_OUT out neighbor VTEP route-map MAP_VTEP_OUT out
neighbor VTEP activate neighbor VTEP activate
advertise-all-vni advertise-all-vni
@ -34,6 +35,8 @@ router bgp 65000 vrf vrf_myzone
route-target import 65003:1000 route-target import 65003:1000
exit-address-family exit-address-family
! !
route-map MAP_VTEP_IN permit 1
!
route-map MAP_VTEP_OUT permit 1 route-map MAP_VTEP_OUT permit 1
! !
line vty line vty