pfSense » pfSense Packages

Ok I am up and running now and after some testing I can rephrase the issue more clearly.

- We have some changes between FRR 7.3 and 7.5 regarding RFC8212. This is good.

- An upgrade from 2.4.5-p1 to 2.5.0-RC means the config from FRR 7.3 gets migrated to 7.5.

- If the environment was previously configured in a way where the announced prefix is not in the RIB, FRR will now not announce the prefix.

From FRR docu:

For versions 7.3 and before frr defaults for datacenter were the network must exist, traditional did not check for existence. For versions 7.4 and beyond both traditional and datacenter the network must exist.

- pfSense 2.5.0-RC exposes most FRR options, including Services -> FRR -> BGP -> Advanced -> Advanced Routing Behavior -> Network Import Check

The flag is not set by default. But the underlying FRR configuration on versions > 7.3 assumes this is set unless otherwise specified.

Thus setting or not setting this option in the GUI has no operational effect. If it is set, we add the line explicitly, if it is not set the option is assumed implicitly.

Suggest we either make it so that the option is a negative statement, similar to how "Disable eBGP Require Policy" works. Meaning if nothing is selected, we do nothing to the config. If it is checked, we add "no bgp network import-check" to the configuration.

add "no bgp network import-check" if unchecked:
https://gitlab.netgate.com/pfSense/FreeBSD-ports/-/merge_requests/54

"bgp network import-check" will not be shown up in configuration if I did not enable it once.

if I enabled it it will be displayed in configuration

router bgp 61000
bgp network import-check
neighbor 192.168.1.88 remote-as 61000

or disabled

router bgp 61000
no bgp network import-check
neighbor 192.168.1.88 remote-as 61000

That's what I fixed yesterday but there isn't a new package yet. Wait for pfSense-pkg-frr version 1.1.0_10.

fixed.

"bgp network import-check" is shown up in configuration by default.

router bgp 61000
no bgp network import-check

Enabling/disabling is shown up in configuration too.