9567c06570
Why I did it For route registry service, in order to block hijacked routes, IBGP session needs to be set up from BGP sentinel service to SONiC, and BGP sentinel service advertise the same route with higher local-preference and no export community. So that SONiC takes the route from BGP sentinel as the best path and does not advertise the route to EBGP peers. In order to do that, new route-maps are needed. So this change adds a new set of templates, keeping BGPSentinel peers out of the other templates. Work item tracking Microsoft ADO (number only): 24451346 How I did it Add sentinel_community in constants.yml, route from BGPSentinel do not match this community will be denied. Add support to convert BGPSentinel related configuration in the BGPPeerPassive element of the minigraph to a new BGP_SENTINELS table in CONFIG_DB Add a new set of "sentinels" templates to docker-fpm-frr Add a new BGP peer manager to bgpcfgd, to add neighbors from the BGP_SENTINELS table using the "sentinels" templates Add a test case for minigraph.py, making sure the BGPSentinel and BGPSentinelV6 elements create BGP_SENTINELS DB entry. Add a set of test cases for the new sentinels templates in sonic-bgpcfgd tests. Add sonic-bgp-sentinel.yang and a set of testcases for the yang file. How to verify it Testcases and UT newly added would pass. Setup IPv4 and IPv6 BGPSentinel services in minigraph, and load minigraph, show CONFIG_DB and "show runningconfig bgp", configuration would be loaded successfully. Using t1-lag topo and setup IBGP session from BGPSentinel to SONiC loopback address, IBGP session would up. Advertise route from BGPSentinel to T1 with sentinel_community, higher local-preference and no-export communiyt. In T1, show bgp route, the result is "Not advertise to any EBGP peer". Withdraw the route in BGPSentinel, in T1, route would advertise to EBGP peers. Advertise route from T1 that does not match sentinel_community, in T1, would not see the route in show bgp route.
66 lines
1.7 KiB
YAML
66 lines
1.7 KiB
YAML
constants:
|
|
deployment_id_asn_map:
|
|
"1" : 65432
|
|
"2" : 65433
|
|
bgp:
|
|
traffic_shift_community: 12345:12345
|
|
sentinel_community: 12345:12346
|
|
families:
|
|
- ipv4
|
|
- ipv6
|
|
use_deployment_id: false
|
|
use_neighbors_meta: false
|
|
graceful_restart:
|
|
enabled: true
|
|
restart_time: 240
|
|
multipath_relax:
|
|
enabled: true
|
|
maximum_paths:
|
|
enabled: true
|
|
ipv4: 64
|
|
ipv6: 64
|
|
allow_list:
|
|
enabled: true
|
|
default_action: "permit" # or "deny"
|
|
drop_community: 5060:12345 # value of the community to identify a prefix to drop. Make sense only with allow_list_default_action equal to 'permit'
|
|
default_pl_rules:
|
|
v4:
|
|
- "deny 0.0.0.0/0 le 17"
|
|
- "permit 127.0.0.1/32"
|
|
v6:
|
|
- "deny 0::/0 le 59"
|
|
- "deny 0::/0 ge 65"
|
|
bbr:
|
|
enabled: true
|
|
default_state: "disabled"
|
|
peers:
|
|
general: # peer_type
|
|
db_table: "BGP_NEIGHBOR"
|
|
template_dir: "general"
|
|
bbr:
|
|
PEER_V4:
|
|
- ipv4
|
|
PEER_V6:
|
|
- ipv6
|
|
internal: # peer_type
|
|
db_table: "BGP_INTERNAL_NEIGHBOR"
|
|
template_dir: "internal"
|
|
monitors: # peer_type
|
|
enabled: true
|
|
db_table: "BGP_MONITORS"
|
|
peer_group: "BGPMON"
|
|
template_dir: "monitors"
|
|
dynamic: # peer_type
|
|
enabled: true
|
|
db_table: "BGP_PEER_RANGE"
|
|
peer_group: "BGP_SPEAKER"
|
|
template_dir: "dynamic"
|
|
voq_chassis: # peer_type
|
|
enabled: true
|
|
db_table: "BGP_VOQ_CHASSIS_NEIGHBOR"
|
|
template_dir: "voq_chassis"
|
|
sentinels: # peer_type
|
|
enabled: true
|
|
db_table: "BGP_SENTINELS"
|
|
template_dir: "sentinels"
|