Project

General

Profile

Bug #11392

FRR - Advanced Routing Behavior - Network Import Check: Flag should be reversed

Added by M Felden 2 months ago. Updated 3 days ago.

Status:
Closed
Priority:
Normal
Assignee:
Category:
FRR
Target version:
-
Start date:
02/10/2021
Due date:
% Done:

100%

Estimated time:
Affected Version:
2.5.0
Affected Architecture:
All

Description

In Services -> FRR -> BGP -> Advanced -> Advanced Routing Behavior

There is a "Network Import Check" that is not enabled by default in the GUI. Enabling it will add "bgp network import-check" to the configuration.

Disabling it will remove "bgp network import-check" from the configuration rather then add "no bgp network import-check" to the configuration.

Because FRR 7.5 now defaults to "frr defaults traditional" this flag is assumed even if not specified.

pfSense should modify configuration to reflect "no bgp network import-check" if the "Network Import Check" option in the UI is unchecked.

dwg.PNG (80.4 KB) dwg.PNG M Felden, 02/10/2021 04:46 AM
ds.PNG (70.5 KB) ds.PNG M Felden, 02/10/2021 04:46 AM

History

#1 Updated by Jim Pingle 2 months ago

  • Project changed from pfSense to pfSense Packages
  • Category changed from Web Interface to FRR
  • Target version deleted (CE-Next)

#2 Updated by M Felden 2 months ago

Ok I am up and running now and after some testing I can rephrase the issue more clearly.

- We have some changes between FRR 7.3 and 7.5 regarding RFC8212. This is good.

- An upgrade from 2.4.5-p1 to 2.5.0-RC means the config from FRR 7.3 gets migrated to 7.5.

- If the environment was previously configured in a way where the announced prefix is not in the RIB, FRR will now not announce the prefix.

From FRR docu:

For versions 7.3 and before frr defaults for datacenter were the network must exist, traditional did not check for existence. For versions 7.4 and beyond both traditional and datacenter the network must exist.

- pfSense 2.5.0-RC exposes most FRR options, including Services -> FRR -> BGP -> Advanced -> Advanced Routing Behavior -> Network Import Check

The flag is not set by default. But the underlying FRR configuration on versions > 7.3 assumes this is set unless otherwise specified.

Thus setting or not setting this option in the GUI has no operational effect. If it is set, we add the line explicitly, if it is not set the option is assumed implicitly.

Suggest we either make it so that the option is a negative statement, similar to how "Disable eBGP Require Policy" works. Meaning if nothing is selected, we do nothing to the config. If it is checked, we add "no bgp network import-check" to the configuration.

#3 Updated by Viktor Gurov about 2 months ago

add "no bgp network import-check" if unchecked:
https://gitlab.netgate.com/pfSense/FreeBSD-ports/-/merge_requests/54

#4 Updated by Jim Pingle about 2 months ago

  • Status changed from New to Pull Request Review

#5 Updated by Renato Botelho about 2 months ago

  • Status changed from Pull Request Review to Feedback
  • Assignee set to Viktor Gurov

PR has been merged. Thanks!

#6 Updated by Jim Pingle 11 days ago

  • Status changed from Feedback to In Progress
  • Assignee changed from Viktor Gurov to Jim Pingle

This doesn't add the option when there is no frrbgpadvanced config present, and it should since we want it to be the default behavior.

Easy fix, will push momentarily.

#7 Updated by Jim Pingle 11 days ago

  • Status changed from In Progress to Feedback
  • % Done changed from 0 to 100

Fixed committed and merged everywhere it is relevant.

#8 Updated by Alhusein Zawi 10 days ago

"bgp network import-check" will not be shown up in configuration if I did not enable it once.

if I enabled it it will be displayed in configuration

router bgp 61000
bgp network import-check
neighbor 192.168.1.88 remote-as 61000

or disabled

router bgp 61000
no bgp network import-check
neighbor 192.168.1.88 remote-as 61000

#9 Updated by Jim Pingle 10 days ago

That's what I fixed yesterday but there isn't a new package yet. Wait for pfSense-pkg-frr version 1.1.0_10.

#10 Updated by Alhusein Zawi 3 days ago

fixed.

"bgp network import-check" is shown up in configuration by default.

router bgp 61000
no bgp network import-check

Enabling/disabling is shown up in configuration too.

#11 Updated by Jim Pingle 3 days ago

  • Status changed from Feedback to Closed

Also available in: Atom PDF