mirror of
https://git.proxmox.com/git/pve-network
synced 2025-08-08 16:21:41 +00:00
controllers: evpn: fix multiple exit-nodes with route-map filtering
Currently, when multiple exit-nodes are defined, each exit-nodes exchanges their own default route, so traffic is looping between both exit nodes instead going out. This add a new route-map to filter received type-5 on exit node Signed-off-by: Alexandre Derumier <aderumier@odiso.com>
This commit is contained in:
parent
824252f691
commit
916488ccca
@ -121,10 +121,11 @@ sub generate_controller_config {
|
|||||||
push(@{$config->{frr}->{''}}, "ip prefix-list loopbacks_ips seq 10 permit 0.0.0.0/0 le 32");
|
push(@{$config->{frr}->{''}}, "ip prefix-list loopbacks_ips seq 10 permit 0.0.0.0/0 le 32");
|
||||||
push(@{$config->{frr}->{''}}, "ip protocol bgp route-map correct_src");
|
push(@{$config->{frr}->{''}}, "ip protocol bgp route-map correct_src");
|
||||||
|
|
||||||
my $routemap_config = [];
|
my $routemap_config = ();
|
||||||
push @{$routemap_config}, "match ip address prefix-list loopbacks_ips";
|
push @{$routemap_config}, "match ip address prefix-list loopbacks_ips";
|
||||||
push @{$routemap_config}, "set src $ifaceip";
|
push @{$routemap_config}, "set src $ifaceip";
|
||||||
push(@{$config->{frr_routemap}->{'correct_src'}}, $routemap_config);
|
my $routemap = { rule => $routemap_config, action => "permit" };
|
||||||
|
push(@{$config->{frr_routemap}->{'correct_src'}}, $routemap);
|
||||||
}
|
}
|
||||||
|
|
||||||
return $config;
|
return $config;
|
||||||
|
@ -99,13 +99,16 @@ sub generate_controller_config {
|
|||||||
|
|
||||||
# address-family l2vpn
|
# address-family l2vpn
|
||||||
@controller_config = ();
|
@controller_config = ();
|
||||||
|
push @controller_config, "neighbor VTEP route-map MAP_VTEP_IN in";
|
||||||
push @controller_config, "neighbor VTEP route-map MAP_VTEP_OUT out";
|
push @controller_config, "neighbor VTEP route-map MAP_VTEP_OUT out";
|
||||||
push @controller_config, "neighbor VTEP activate";
|
push @controller_config, "neighbor VTEP activate";
|
||||||
push @controller_config, "advertise-all-vni";
|
push @controller_config, "advertise-all-vni";
|
||||||
push @controller_config, "autort as $autortas" if $autortas;
|
push @controller_config, "autort as $autortas" if $autortas;
|
||||||
push(@{$bgp->{"address-family"}->{"l2vpn evpn"}}, @controller_config);
|
push(@{$bgp->{"address-family"}->{"l2vpn evpn"}}, @controller_config);
|
||||||
|
|
||||||
push(@{$config->{frr_routemap}->{'MAP_VTEP_OUT'}}, []);
|
my $routemap = { rule => undef, action => "permit" };
|
||||||
|
push(@{$config->{frr_routemap}->{'MAP_VTEP_IN'}}, $routemap );
|
||||||
|
push(@{$config->{frr_routemap}->{'MAP_VTEP_OUT'}}, $routemap );
|
||||||
|
|
||||||
return $config;
|
return $config;
|
||||||
}
|
}
|
||||||
@ -160,14 +163,22 @@ sub generate_controller_zone_config {
|
|||||||
|
|
||||||
if ($is_gateway) {
|
if ($is_gateway) {
|
||||||
|
|
||||||
if($exitnodes_primary && $exitnodes_primary ne $local_node) {
|
if(!$exitnodes_primary || $exitnodes_primary eq $local_node) {
|
||||||
|
#filter default type5 route coming from other exit nodes on primary node or both nodes if no primary is defined.
|
||||||
|
my $routemap_config = ();
|
||||||
|
push @{$routemap_config}, "match evpn route-type prefix";
|
||||||
|
my $routemap = { rule => $routemap_config, action => "deny" };
|
||||||
|
unshift(@{$config->{frr_routemap}->{'MAP_VTEP_IN'}}, $routemap);
|
||||||
|
} elsif ($exitnodes_primary ne $local_node) {
|
||||||
my $routemap_config = ();
|
my $routemap_config = ();
|
||||||
push @{$routemap_config}, "match evpn vni $vrfvxlan";
|
push @{$routemap_config}, "match evpn vni $vrfvxlan";
|
||||||
push @{$routemap_config}, "match evpn route-type prefix";
|
push @{$routemap_config}, "match evpn route-type prefix";
|
||||||
push @{$routemap_config}, "set metric 200";
|
push @{$routemap_config}, "set metric 200";
|
||||||
unshift(@{$config->{frr_routemap}->{'MAP_VTEP_OUT'}}, $routemap_config);
|
my $routemap = { rule => $routemap_config, action => "permit" };
|
||||||
|
unshift(@{$config->{frr_routemap}->{'MAP_VTEP_OUT'}}, $routemap);
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|
||||||
if (!$exitnodes_local_routing) {
|
if (!$exitnodes_local_routing) {
|
||||||
@controller_config = ();
|
@controller_config = ();
|
||||||
#import /32 routes of evpn network from vrf1 to default vrf (for packet return)
|
#import /32 routes of evpn network from vrf1 to default vrf (for packet return)
|
||||||
@ -355,10 +366,12 @@ sub generate_frr_routemap {
|
|||||||
my $order = 0;
|
my $order = 0;
|
||||||
foreach my $seq (@$routemap) {
|
foreach my $seq (@$routemap) {
|
||||||
$order++;
|
$order++;
|
||||||
|
next if !defined($seq->{action});
|
||||||
my @config = ();
|
my @config = ();
|
||||||
push @config, "!";
|
push @config, "!";
|
||||||
push @config, "route-map $id permit $order";
|
push @config, "route-map $id $seq->{action} $order";
|
||||||
push @config, map { " $_" } @$seq;
|
my $rule = $seq->{rule};
|
||||||
|
push @config, map { " $_" } @$rule;
|
||||||
push @{$final_config}, @config;
|
push @{$final_config}, @config;
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
@ -20,6 +20,7 @@ router bgp 65000
|
|||||||
neighbor 192.168.0.3 peer-group VTEP
|
neighbor 192.168.0.3 peer-group VTEP
|
||||||
!
|
!
|
||||||
address-family l2vpn evpn
|
address-family l2vpn evpn
|
||||||
|
neighbor VTEP route-map MAP_VTEP_IN in
|
||||||
neighbor VTEP route-map MAP_VTEP_OUT out
|
neighbor VTEP route-map MAP_VTEP_OUT out
|
||||||
neighbor VTEP activate
|
neighbor VTEP activate
|
||||||
advertise-all-vni
|
advertise-all-vni
|
||||||
@ -41,6 +42,8 @@ router bgp 65000 vrf vrf_myzone
|
|||||||
advertise ipv6 unicast
|
advertise ipv6 unicast
|
||||||
exit-address-family
|
exit-address-family
|
||||||
!
|
!
|
||||||
|
route-map MAP_VTEP_IN permit 1
|
||||||
|
!
|
||||||
route-map MAP_VTEP_OUT permit 1
|
route-map MAP_VTEP_OUT permit 1
|
||||||
!
|
!
|
||||||
line vty
|
line vty
|
||||||
|
@ -20,6 +20,7 @@ router bgp 65000
|
|||||||
neighbor 192.168.0.3 peer-group VTEP
|
neighbor 192.168.0.3 peer-group VTEP
|
||||||
!
|
!
|
||||||
address-family l2vpn evpn
|
address-family l2vpn evpn
|
||||||
|
neighbor VTEP route-map MAP_VTEP_IN in
|
||||||
neighbor VTEP route-map MAP_VTEP_OUT out
|
neighbor VTEP route-map MAP_VTEP_OUT out
|
||||||
neighbor VTEP activate
|
neighbor VTEP activate
|
||||||
advertise-all-vni
|
advertise-all-vni
|
||||||
@ -28,6 +29,8 @@ router bgp 65000
|
|||||||
router bgp 65000 vrf vrf_myzone
|
router bgp 65000 vrf vrf_myzone
|
||||||
bgp router-id 192.168.0.1
|
bgp router-id 192.168.0.1
|
||||||
!
|
!
|
||||||
|
route-map MAP_VTEP_IN permit 1
|
||||||
|
!
|
||||||
route-map MAP_VTEP_OUT permit 1
|
route-map MAP_VTEP_OUT permit 1
|
||||||
!
|
!
|
||||||
line vty
|
line vty
|
||||||
|
@ -31,6 +31,7 @@ router bgp 65001
|
|||||||
exit-address-family
|
exit-address-family
|
||||||
!
|
!
|
||||||
address-family l2vpn evpn
|
address-family l2vpn evpn
|
||||||
|
neighbor VTEP route-map MAP_VTEP_IN in
|
||||||
neighbor VTEP route-map MAP_VTEP_OUT out
|
neighbor VTEP route-map MAP_VTEP_OUT out
|
||||||
neighbor VTEP activate
|
neighbor VTEP activate
|
||||||
advertise-all-vni
|
advertise-all-vni
|
||||||
@ -45,6 +46,8 @@ router bgp 65001 vrf vrf_myzone
|
|||||||
route-target export 65000:1000
|
route-target export 65000:1000
|
||||||
exit-address-family
|
exit-address-family
|
||||||
!
|
!
|
||||||
|
route-map MAP_VTEP_IN permit 1
|
||||||
|
!
|
||||||
route-map MAP_VTEP_OUT permit 1
|
route-map MAP_VTEP_OUT permit 1
|
||||||
!
|
!
|
||||||
line vty
|
line vty
|
||||||
|
@ -36,6 +36,7 @@ router bgp 65001
|
|||||||
exit-address-family
|
exit-address-family
|
||||||
!
|
!
|
||||||
address-family l2vpn evpn
|
address-family l2vpn evpn
|
||||||
|
neighbor VTEP route-map MAP_VTEP_IN in
|
||||||
neighbor VTEP route-map MAP_VTEP_OUT out
|
neighbor VTEP route-map MAP_VTEP_OUT out
|
||||||
neighbor VTEP activate
|
neighbor VTEP activate
|
||||||
advertise-all-vni
|
advertise-all-vni
|
||||||
@ -50,6 +51,8 @@ router bgp 65001 vrf vrf_myzone
|
|||||||
route-target export 65000:1000
|
route-target export 65000:1000
|
||||||
exit-address-family
|
exit-address-family
|
||||||
!
|
!
|
||||||
|
route-map MAP_VTEP_IN permit 1
|
||||||
|
!
|
||||||
route-map MAP_VTEP_OUT permit 1
|
route-map MAP_VTEP_OUT permit 1
|
||||||
!
|
!
|
||||||
route-map correct_src permit 1
|
route-map correct_src permit 1
|
||||||
|
@ -28,6 +28,7 @@ router bgp 65000
|
|||||||
exit-address-family
|
exit-address-family
|
||||||
!
|
!
|
||||||
address-family l2vpn evpn
|
address-family l2vpn evpn
|
||||||
|
neighbor VTEP route-map MAP_VTEP_IN in
|
||||||
neighbor VTEP route-map MAP_VTEP_OUT out
|
neighbor VTEP route-map MAP_VTEP_OUT out
|
||||||
neighbor VTEP activate
|
neighbor VTEP activate
|
||||||
advertise-all-vni
|
advertise-all-vni
|
||||||
@ -49,6 +50,11 @@ router bgp 65000 vrf vrf_myzone
|
|||||||
default-originate ipv6
|
default-originate ipv6
|
||||||
exit-address-family
|
exit-address-family
|
||||||
!
|
!
|
||||||
|
route-map MAP_VTEP_IN deny 1
|
||||||
|
match evpn route-type prefix
|
||||||
|
!
|
||||||
|
route-map MAP_VTEP_IN permit 2
|
||||||
|
!
|
||||||
route-map MAP_VTEP_OUT permit 1
|
route-map MAP_VTEP_OUT permit 1
|
||||||
!
|
!
|
||||||
line vty
|
line vty
|
||||||
|
@ -21,6 +21,7 @@ router bgp 65000
|
|||||||
neighbor 192.168.0.3 peer-group VTEP
|
neighbor 192.168.0.3 peer-group VTEP
|
||||||
!
|
!
|
||||||
address-family l2vpn evpn
|
address-family l2vpn evpn
|
||||||
|
neighbor VTEP route-map MAP_VTEP_IN in
|
||||||
neighbor VTEP route-map MAP_VTEP_OUT out
|
neighbor VTEP route-map MAP_VTEP_OUT out
|
||||||
neighbor VTEP activate
|
neighbor VTEP activate
|
||||||
advertise-all-vni
|
advertise-all-vni
|
||||||
@ -34,6 +35,11 @@ router bgp 65000 vrf vrf_myzone
|
|||||||
default-originate ipv6
|
default-originate ipv6
|
||||||
exit-address-family
|
exit-address-family
|
||||||
!
|
!
|
||||||
|
route-map MAP_VTEP_IN deny 1
|
||||||
|
match evpn route-type prefix
|
||||||
|
!
|
||||||
|
route-map MAP_VTEP_IN permit 2
|
||||||
|
!
|
||||||
route-map MAP_VTEP_OUT permit 1
|
route-map MAP_VTEP_OUT permit 1
|
||||||
!
|
!
|
||||||
line vty
|
line vty
|
||||||
|
@ -28,6 +28,7 @@ router bgp 65000
|
|||||||
exit-address-family
|
exit-address-family
|
||||||
!
|
!
|
||||||
address-family l2vpn evpn
|
address-family l2vpn evpn
|
||||||
|
neighbor VTEP route-map MAP_VTEP_IN in
|
||||||
neighbor VTEP route-map MAP_VTEP_OUT out
|
neighbor VTEP route-map MAP_VTEP_OUT out
|
||||||
neighbor VTEP activate
|
neighbor VTEP activate
|
||||||
advertise-all-vni
|
advertise-all-vni
|
||||||
@ -49,6 +50,8 @@ router bgp 65000 vrf vrf_myzone
|
|||||||
default-originate ipv6
|
default-originate ipv6
|
||||||
exit-address-family
|
exit-address-family
|
||||||
!
|
!
|
||||||
|
route-map MAP_VTEP_IN permit 1
|
||||||
|
!
|
||||||
route-map MAP_VTEP_OUT permit 1
|
route-map MAP_VTEP_OUT permit 1
|
||||||
match evpn vni 1000
|
match evpn vni 1000
|
||||||
match evpn route-type prefix
|
match evpn route-type prefix
|
||||||
|
@ -28,6 +28,7 @@ router bgp 65000
|
|||||||
exit-address-family
|
exit-address-family
|
||||||
!
|
!
|
||||||
address-family l2vpn evpn
|
address-family l2vpn evpn
|
||||||
|
neighbor VTEP route-map MAP_VTEP_IN in
|
||||||
neighbor VTEP route-map MAP_VTEP_OUT out
|
neighbor VTEP route-map MAP_VTEP_OUT out
|
||||||
neighbor VTEP activate
|
neighbor VTEP activate
|
||||||
advertise-all-vni
|
advertise-all-vni
|
||||||
@ -49,6 +50,11 @@ router bgp 65000 vrf vrf_myzone
|
|||||||
default-originate ipv6
|
default-originate ipv6
|
||||||
exit-address-family
|
exit-address-family
|
||||||
!
|
!
|
||||||
|
route-map MAP_VTEP_IN deny 1
|
||||||
|
match evpn route-type prefix
|
||||||
|
!
|
||||||
|
route-map MAP_VTEP_IN permit 2
|
||||||
|
!
|
||||||
route-map MAP_VTEP_OUT permit 1
|
route-map MAP_VTEP_OUT permit 1
|
||||||
!
|
!
|
||||||
line vty
|
line vty
|
||||||
|
@ -20,6 +20,7 @@ router bgp 65000
|
|||||||
neighbor 192.168.0.3 peer-group VTEP
|
neighbor 192.168.0.3 peer-group VTEP
|
||||||
!
|
!
|
||||||
address-family l2vpn evpn
|
address-family l2vpn evpn
|
||||||
|
neighbor VTEP route-map MAP_VTEP_IN in
|
||||||
neighbor VTEP route-map MAP_VTEP_OUT out
|
neighbor VTEP route-map MAP_VTEP_OUT out
|
||||||
neighbor VTEP activate
|
neighbor VTEP activate
|
||||||
advertise-all-vni
|
advertise-all-vni
|
||||||
@ -28,6 +29,8 @@ router bgp 65000
|
|||||||
router bgp 65000 vrf vrf_myzone
|
router bgp 65000 vrf vrf_myzone
|
||||||
bgp router-id 192.168.0.1
|
bgp router-id 192.168.0.1
|
||||||
!
|
!
|
||||||
|
route-map MAP_VTEP_IN permit 1
|
||||||
|
!
|
||||||
route-map MAP_VTEP_OUT permit 1
|
route-map MAP_VTEP_OUT permit 1
|
||||||
!
|
!
|
||||||
line vty
|
line vty
|
||||||
|
@ -20,6 +20,7 @@ router bgp 65000
|
|||||||
neighbor 192.168.0.3 peer-group VTEP
|
neighbor 192.168.0.3 peer-group VTEP
|
||||||
!
|
!
|
||||||
address-family l2vpn evpn
|
address-family l2vpn evpn
|
||||||
|
neighbor VTEP route-map MAP_VTEP_IN in
|
||||||
neighbor VTEP route-map MAP_VTEP_OUT out
|
neighbor VTEP route-map MAP_VTEP_OUT out
|
||||||
neighbor VTEP activate
|
neighbor VTEP activate
|
||||||
advertise-all-vni
|
advertise-all-vni
|
||||||
@ -28,6 +29,8 @@ router bgp 65000
|
|||||||
router bgp 65000 vrf vrf_myzone
|
router bgp 65000 vrf vrf_myzone
|
||||||
bgp router-id 192.168.0.1
|
bgp router-id 192.168.0.1
|
||||||
!
|
!
|
||||||
|
route-map MAP_VTEP_IN permit 1
|
||||||
|
!
|
||||||
route-map MAP_VTEP_OUT permit 1
|
route-map MAP_VTEP_OUT permit 1
|
||||||
!
|
!
|
||||||
line vty
|
line vty
|
||||||
|
@ -20,6 +20,7 @@ router bgp 65000
|
|||||||
neighbor 192.168.0.3 peer-group VTEP
|
neighbor 192.168.0.3 peer-group VTEP
|
||||||
!
|
!
|
||||||
address-family l2vpn evpn
|
address-family l2vpn evpn
|
||||||
|
neighbor VTEP route-map MAP_VTEP_IN in
|
||||||
neighbor VTEP route-map MAP_VTEP_OUT out
|
neighbor VTEP route-map MAP_VTEP_OUT out
|
||||||
neighbor VTEP activate
|
neighbor VTEP activate
|
||||||
advertise-all-vni
|
advertise-all-vni
|
||||||
@ -28,6 +29,8 @@ router bgp 65000
|
|||||||
router bgp 65000 vrf vrf_myzone
|
router bgp 65000 vrf vrf_myzone
|
||||||
bgp router-id 192.168.0.1
|
bgp router-id 192.168.0.1
|
||||||
!
|
!
|
||||||
|
route-map MAP_VTEP_IN permit 1
|
||||||
|
!
|
||||||
route-map MAP_VTEP_OUT permit 1
|
route-map MAP_VTEP_OUT permit 1
|
||||||
!
|
!
|
||||||
line vty
|
line vty
|
||||||
|
@ -20,6 +20,7 @@ router bgp 65000
|
|||||||
neighbor 192.168.0.3 peer-group VTEP
|
neighbor 192.168.0.3 peer-group VTEP
|
||||||
!
|
!
|
||||||
address-family l2vpn evpn
|
address-family l2vpn evpn
|
||||||
|
neighbor VTEP route-map MAP_VTEP_IN in
|
||||||
neighbor VTEP route-map MAP_VTEP_OUT out
|
neighbor VTEP route-map MAP_VTEP_OUT out
|
||||||
neighbor VTEP activate
|
neighbor VTEP activate
|
||||||
advertise-all-vni
|
advertise-all-vni
|
||||||
@ -28,6 +29,8 @@ router bgp 65000
|
|||||||
router bgp 65000 vrf vrf_myzone
|
router bgp 65000 vrf vrf_myzone
|
||||||
bgp router-id 192.168.0.1
|
bgp router-id 192.168.0.1
|
||||||
!
|
!
|
||||||
|
route-map MAP_VTEP_IN permit 1
|
||||||
|
!
|
||||||
route-map MAP_VTEP_OUT permit 1
|
route-map MAP_VTEP_OUT permit 1
|
||||||
!
|
!
|
||||||
line vty
|
line vty
|
||||||
|
@ -32,6 +32,7 @@ router bgp 65000
|
|||||||
exit-address-family
|
exit-address-family
|
||||||
!
|
!
|
||||||
address-family l2vpn evpn
|
address-family l2vpn evpn
|
||||||
|
neighbor VTEP route-map MAP_VTEP_IN in
|
||||||
neighbor VTEP route-map MAP_VTEP_OUT out
|
neighbor VTEP route-map MAP_VTEP_OUT out
|
||||||
neighbor VTEP activate
|
neighbor VTEP activate
|
||||||
advertise-all-vni
|
advertise-all-vni
|
||||||
@ -40,6 +41,8 @@ router bgp 65000
|
|||||||
router bgp 65000 vrf vrf_myzone
|
router bgp 65000 vrf vrf_myzone
|
||||||
bgp router-id 192.168.0.1
|
bgp router-id 192.168.0.1
|
||||||
!
|
!
|
||||||
|
route-map MAP_VTEP_IN permit 1
|
||||||
|
!
|
||||||
route-map MAP_VTEP_OUT permit 1
|
route-map MAP_VTEP_OUT permit 1
|
||||||
!
|
!
|
||||||
line vty
|
line vty
|
||||||
|
@ -20,6 +20,7 @@ router bgp 65000
|
|||||||
neighbor 192.168.0.3 peer-group VTEP
|
neighbor 192.168.0.3 peer-group VTEP
|
||||||
!
|
!
|
||||||
address-family l2vpn evpn
|
address-family l2vpn evpn
|
||||||
|
neighbor VTEP route-map MAP_VTEP_IN in
|
||||||
neighbor VTEP route-map MAP_VTEP_OUT out
|
neighbor VTEP route-map MAP_VTEP_OUT out
|
||||||
neighbor VTEP activate
|
neighbor VTEP activate
|
||||||
advertise-all-vni
|
advertise-all-vni
|
||||||
@ -34,6 +35,8 @@ router bgp 65000 vrf vrf_myzone
|
|||||||
route-target import 65003:1000
|
route-target import 65003:1000
|
||||||
exit-address-family
|
exit-address-family
|
||||||
!
|
!
|
||||||
|
route-map MAP_VTEP_IN permit 1
|
||||||
|
!
|
||||||
route-map MAP_VTEP_OUT permit 1
|
route-map MAP_VTEP_OUT permit 1
|
||||||
!
|
!
|
||||||
line vty
|
line vty
|
||||||
|
Loading…
Reference in New Issue
Block a user