BIRD 实验 5 BGP动态路由

December 16, 2023

简介

本文描述进行一个最小的BIRD 2台机器的BGP动态路由实验。

目标

两个路由器互联,分别在lo1接口挂载一个子网

如图所示，两个路由器通过两个网桥直连,分别在lo1接口各挂一个子网，实验的目的是通过BGP协议动态交换路由，在一台路由器上能够ping通另一台路由器lo1接口上的子网。

在这里：

arch1为AS 65000。
arch2为AS 64496。

两者AS不同，互为EBGP邻居。

准备

与实验1一样，配置好arch1、arch2基本环境。

$ lxc list
+-------+---------+-----------------------+-----------------------------------------------+-----------+-----------+
| NAME  |  STATE  |         IPV4          |                     IPV6                      |   TYPE    | SNAPSHOTS |
+-------+---------+-----------------------+-----------------------------------------------+-----------+-----------+
| arch1 | RUNNING | 192.168.101.1 (lo1)   | fd42:7d6a:5878:6514:216:3eff:fea6:6269 (eth1) | CONTAINER | 0         |
|       |         | 10.215.137.113 (eth0) | fd42:62ab:9b76:b227:216:3eff:fe87:c55f (eth0) |           |           |
+-------+---------+-----------------------+-----------------------------------------------+-----------+-----------+
| arch2 | RUNNING | 192.168.102.1 (lo1)   | fd42:62ab:9b76:b227:216:3eff:feed:52a9 (eth0) | CONTAINER | 0         |
|       |         | 10.215.137.88 (eth0)  |                                               |           |           |
+-------+---------+-----------------------+-----------------------------------------------+-----------+-----------+

实验

arch1机的/etc/bird.conf配置。

log syslog all;

protocol device {
}

protocol direct {
    disabled;		# Disable by default
    ipv4;			# Connect to default IPv4 table
    ipv6;			# ... and to default IPv6 table
}

protocol kernel {
    ipv4 {			# Connect protocol to IPv4 table by channel
          export all;	# Export to protocol. default is export none
    };
}

protocol kernel {
    ipv6 { export all; };
}

protocol static {
    ipv4;			# Again, IPv4 channel with default options
    route 192.168.101.0/24 via 192.168.101.1;
}

filter rt_import
{
    if bgp_path.first != 64496 then reject;
    if bgp_path.len > 64 then reject;
    if bgp_next_hop != from then reject;
    accept;
}

 protocol bgp uplink1 {
    local 10.215.137.113 as 65000;
    neighbor 10.215.137.88 as 64496;
    hold time 90;		# Default is 240
    password "secret";	# Password used for MD5 authentication

    ipv4 {			# regular IPv4 unicast (1/1)
	    import filter rt_import;
	    export where source ~ [ RTS_STATIC, RTS_BGP ];
    };
}

arch2机的/etc/bird.conf配置。

log syslog all;

protocol device {
}

protocol direct {
    disabled;		# Disable by default
    ipv4;			# Connect to default IPv4 table
    ipv6;			# ... and to default IPv6 table
}

protocol kernel {
    ipv4 {			# Connect protocol to IPv4 table by channel
          export all;	# Export to protocol. default is export none
    };
}

protocol kernel {
    ipv6 { export all; };
}

protocol static {
    ipv4;			# Again, IPv4 channel with default options
    route 192.168.102.0/24 via 192.168.102.1;
}

filter rt_import
{
    if bgp_path.first != 65000 then reject;
    if bgp_path.len > 64 then reject;
    if bgp_next_hop != from then reject;
    accept;
}

protocol bgp uplink1 {
    local 10.215.137.88 as 64496;
    neighbor 10.215.137.113 as 65000;
    hold time 90;		# Default is 240
    password "secret";	# Password used for MD5 authentication

    ipv4 {			# regular IPv4 unicast (1/1)
	    import filter rt_import;
	    export where source ~ [ RTS_STATIC, RTS_BGP ];
    };
}

实验结果，在arch1上，正常情况下

# ip route
default via 10.215.137.1 dev eth0 proto dhcp src 10.215.137.113 metric 1024 
10.215.137.0/24 dev eth0 proto kernel scope link src 10.215.137.113 metric 1024 
10.215.137.1 dev eth0 proto dhcp scope link src 10.215.137.113 metric 1024 
192.168.101.0/24 dev lo1 proto kernel scope link src 192.168.101.1 
192.168.101.0/24 via 192.168.101.1 dev lo1 proto bird metric 32 
192.168.102.0/24 via 10.215.137.88 dev eth0 proto bird metric 32 

# ping 192.168.102.1
PING 192.168.102.1 (192.168.102.1) 56(84) bytes of data.
64 bytes from 192.168.102.1: icmp_seq=1 ttl=64 time=0.055 ms

birdc show route:

bird> show route 
Table master4:
192.168.101.0/24     unicast [static1 16:45:31.771] ! (200)
    via 192.168.101.1 on lo1
192.168.102.0/24     unicast [uplink1 16:45:35.732] * (100) [AS64496i]
    via 10.215.137.88 on eth0

birdc show route all:

bird> show route all
Table master4:
192.168.101.0/24     unicast [static1 16:45:31.771] ! (200)
    via 192.168.101.1 on lo1
    Type: static univ
192.168.102.0/24     unicast [uplink1 16:45:35.732] * (100) [AS64496i]
    via 10.215.137.88 on eth0
    Type: BGP univ
    BGP.origin: IGP
    BGP.as_path: 64496
    BGP.next_hop: 10.215.137.88
    BGP.local_pref: 100

如上，实验成功。

总结

小心default那条路由，lxd自己也是路由器，别被误导了。
lo1的路由还是通过静态路由宣告的。
filter rt_import用于定义BGP从协议到路由表的导入规则,这里的accept与reject与默认模板中的方向是反的，注意修改。
protocol bgp中local和neighbor的AS号不一样，自动成为EBGP邻居。

若把arch1、arch2的AS都改成65000,则两者成为IBGP邻居。在protocol bgp中必须使用import all;才行，因为同AS，收到的路由的BGP.as_path为空，会导致rt_import失败。以下是import all后看到的BIRD的路由表详情：

  bird> show route all
  Table master4:
  192.168.101.0/24     unicast [static1 17:18:22.509] * (200)
      via 192.168.101.1 on lo1
      Type: static univ
  192.168.102.0/24     unreachable [uplink1 17:18:55.464 from 10.215.137.88] * (100) [i]
      Type: BGP univ
      BGP.origin: IGP
      BGP.as_path: 
      BGP.next_hop: 192.168.102.1
      BGP.local_pref: 100

结束

实验结束，最后删除虚拟机。

lxc delete -f arch1
lxc delete -f arch2

下次搭建一个EBGP和IBGP混合的实验。