{"id":4408,"date":"2015-03-22T00:33:13","date_gmt":"2015-03-21T22:33:13","guid":{"rendered":"http:\/\/www.imacandi.net\/sin\/blog\/?p=4408"},"modified":"2015-04-04T20:26:36","modified_gmt":"2015-04-04T18:26:36","slug":"internet-paralel-2","status":"publish","type":"post","link":"https:\/\/www.imacandi.net\/sin\/blog\/2015\/03\/22\/internet-paralel-2.html","title":{"rendered":"“internet” paralel (2)"},"content":{"rendered":"

Se pare ca la partea cu un singur ASN puneam problema gresit:<\/p>\n

Initial aveam asa pe vpn-hub<\/strong> spre vpn-gw-a<\/strong>:<\/p>\n

route-map A permit 1\r\n match origin igp\r\n set ip next-hop 192.168.168.1<\/pre>\n
route-map-ul era aplicat asa:<\/p>\n
neighbor 192.168.168.2 route-map A out<\/pre>\n
Care teoretic ar fi trebuit sa schimbe next-hop<\/strong> din anunturi in ce i-am zis io mai sus.<\/p>\n
Cu un hint de la gabim ca nu trebuie sa fac match pe nimic ci doar sa setez ip next-hop<\/strong>, asa ca am lasat doar varianta cu set ip next-hop<\/strong>. Dar tot fara noroc.<\/p>\n
Ma mai scarpinai un pic si ajunsei la alta combinatie care se pare ca merge: pun route-map pe in pe gateway-uri si nu mai fac nimic pe vpn-hub<\/strong>, lucru care se pare ca merge. Plus bonus points ca setand next-hop ca peer-address<\/strong> ma doare la bachetzi cine e peer-ul, deci pot sa fac template.<\/p>\n
route-map set-nh permit 1\r\n set ip next-hop peer-address<\/pre>\n
Care\u00a0se aplica asa:<\/p>\n
neighbor 192.168.168.1 remote-as 4200000000\r\nneighbor 192.168.168.1 route-map set-nh in<\/pre>\n
Iar pe vpn-hub<\/strong> arata in felul urmator:<\/p>\n
neighbor 192.168.168.2 remote-as 4200000000\r\nneighbor 192.168.168.2 route-reflector-client<\/pre>\n
Pentru confirmare ca functioneaza treaba:<\/p>\n
vpn-gw-a# sh ip bgp 172.16.3.0\/24\r\nBGP routing table entry for 172.16.3.0\/24\r\nPaths: (1 available, best #1, table Default-IP-Routing-Table)\r\n Not advertised to any peer\r\n Local\r\n192.168.168.1 (metric 1) from 192.168.168.1 (192.168.168.10)\r\n Origin IGP, metric 0, localpref 100, valid, internal, best\r\n Originator: 192.168.168.10, Cluster list: 192.168.168.9\r\n Last update: Sat Mar 21 21:55:27 2015<\/pre>\n
zebra instaleaza ruta corect:<\/p>\n
[root@vpn-gw-a ~]# ip r l 172.16.3.0\/24\r\n172.16.3.0\/24 via 192.168.168.1 dev to-hub\u00a0 proto zebra<\/pre>\n
Ping:<\/p>\n
[root@vpn-gw-a ~]# ping 172.16.3.1 -I172.16.1.1 -c3\r\nPING 172.16.3.1 (172.16.3.1) from 172.16.1.1 : 56(84) bytes of data.\r\n64 bytes from 172.16.3.1: icmp_seq=1 ttl=63 time=1.99 ms\r\n64 bytes from 172.16.3.1: icmp_seq=2 ttl=63 time=1.37 ms\r\n64 bytes from 172.16.3.1: icmp_seq=3 ttl=63 time=1.37 ms\r\n\r\n--- 172.16.3.1 ping statistics ---\r\n3 packets transmitted, 3 received, 0% packet loss, time 2006ms\r\nrtt min\/avg\/max\/mdev = 1.376\/1.582\/1.993\/0.290 ms<\/pre>\n
De asta imi place mie BGP-ul, ca poti sa-l violezi in cele mai oribile moduri (ca ce-am facut mai sus e viol cu perversiuni) si tot functioneaza bine :))<\/p>\n
Pe vpn-hub<\/strong> pot sa pun un peer-group<\/strong> imens in care ii strang pe toti, iar pe gateway-uri peer-address. Asa iti vin ideile, facand stuff :)<\/p>\n
Teoretic, ar fi mers route-map-ul si pe vpn-hub cum il pusesem inainte, insa se pare ca implementare de quagga nu face stuff cand pui route-map pe out<\/strong>. Dar bine ca merge pe in<\/strong>.<\/p>\n
Asa ca\u00a0pot folosi un singur ASN indiferent de cati neighbor-i am. Acum as putea sa-mi pun un pahar de vin ca am intuit ca se poate, doar ca a durat ceva pana m-am prins si cum.<\/p>\n","protected":false},"excerpt":{"rendered":"
Se pare ca la partea cu un singur ASN puneam problema gresit: Initial aveam asa pe vpn-hub spre vpn-gw-a: route-map A permit 1 match origin igp set ip next-hop 192.168.168.1 route-map-ul era aplicat asa: neighbor 192.168.168.2 route-map A out Care teoretic ar fi trebuit sa schimbe next-hop din anunturi in ce i-am zis io mai … Continue reading “internet” paralel (2)<\/span> →<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_monsterinsights_skip_tracking":false,"_monsterinsights_sitenote_active":false,"_monsterinsights_sitenote_note":"","_monsterinsights_sitenote_category":0,"ngg_post_thumbnail":0,"footnotes":""},"categories":[2],"tags":[7],"class_list":["post-4408","post","type-post","status-publish","format-standard","hentry","category-diverse","tag-computers"],"_links":{"self":[{"href":"https:\/\/www.imacandi.net\/sin\/blog\/wp-json\/wp\/v2\/posts\/4408","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.imacandi.net\/sin\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.imacandi.net\/sin\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.imacandi.net\/sin\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.imacandi.net\/sin\/blog\/wp-json\/wp\/v2\/comments?post=4408"}],"version-history":[{"count":3,"href":"https:\/\/www.imacandi.net\/sin\/blog\/wp-json\/wp\/v2\/posts\/4408\/revisions"}],"predecessor-version":[{"id":4411,"href":"https:\/\/www.imacandi.net\/sin\/blog\/wp-json\/wp\/v2\/posts\/4408\/revisions\/4411"}],"wp:attachment":[{"href":"https:\/\/www.imacandi.net\/sin\/blog\/wp-json\/wp\/v2\/media?parent=4408"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.imacandi.net\/sin\/blog\/wp-json\/wp\/v2\/categories?post=4408"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.imacandi.net\/sin\/blog\/wp-json\/wp\/v2\/tags?post=4408"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}