remove-private-AS not working as expected.

cjsoftuk commented 5 years ago

First discussed at https://lists.frrouting.org/pipermail/frog/2019-February/000490.html
FRR Version: 5.0.2 (pfSense)

Things you may try first

(put "x" in "[ ]" if you already tried following)

[x] Did you check if this is a duplicate issue?
[ ] Did you test it on the latest FRRouting/frr master branch?

Description

ebgp multihop and remove-private-AS together do not function as expected (possibly just remove-private-AS)

Steps to Reproduce

router bgp 65001
 neighbor w.x.y.z remote-as nnnnn
 neighbor w.x.y.z local-as 205804
 neighbor w.x.y.z description Upstream - Peering Router - b
 neighbor w.x.y.z ebgp-multihop 2
 neighbor w.x.y.z disable-connected-check
 neighbor w.x.y.z update-source a.b.c.d
 address-family ipv4 unicast
  neighbor w.x.y.z remove-private-AS all replace-AS

Expected behavior: BGP Updates are sent with no private ASes in path

Actual behavior: Wireshark shows the following: Path Attribute - AS_PATH: 205804 65001 Flags: 0x50, Transitive, Extended-Length, Well-known, Complete Type Code: AS_PATH (2) Length: 10 AS Path segment: 205804 65001 Segment type: AS_SEQUENCE (2) Segment length (number of ASN): 2 AS4: 205804 AS4: 65001

Components

bgpd + zebra

Versions

OS: pfSense 2.4.4-RELEAE-p2
Kernel: BSD 11.2-RELEASE-p6
FRR: 5.0.2

If you need any more info - please let me know.

ton31337 commented 5 years ago

I will debug this more.

cjsoftuk commented 5 years ago

I've been debugging this this evening - and it seems that it works fine on redistributed routes, but not originated routes. That is to say:

If a route containing a private AS arrives from a peer, and that peer is marked with remove-private-AS, the private AS is removed before being redistributed. It appears to only be routes that are originated that cannot have this treatment applied on their outbound routes..... maybe I should be doing it with route-maps.

cjsoftuk commented 5 years ago

Further investigation has revealed that trying to remove one of your own ASes from the path (as FRR will happily add both the AS it's configured with and the local-as configured to the AS-path) doesn't work either.

The end result in my set up is that I get routes being advertised as AS path: 205804 65001

Attempts to use route-maps to remove 65001 fails on the router that is AS 65001 as the main instance.

ton31337 commented 5 years ago

The problem is that if you originate the route and have local-as defined together with private AS as primary, remove private AS function is called before the aspath is generated. I did yesterday a working patch, but it needs further testing. I will update you.

FRRouting / frr