hi all
just a short question (related to a quite new feature from cisco).
with the new cisco ASR software (15.0(1)S - released some days ago) it is able
to do BGP on the same box.
we need this feature because we use the VASI interfaces to bring and filter
traffic from one VRF to another VRF and performing firewalling (ZBF).
basically we have on the box:
[VRF_A via vasileft1]--[VRF_B via vasiright1]
and the box itself speaks BGP on VRF_B with some RR's:
[ASRBox] ---- (RR) ---- [anotherbox]
the fun part is, if you want to announce (e.g. 0.0.0.0/0) from VRF_B (announced
from anotherbox) to VRF_A it should be possible now with that new feature.
according to BGP I need to configure the VRF_A peer as route-reflector-client
so the routes from the anotherbox get reflected via RR to VRF_B.
but, it seems that the router itself needs to be tricked, since he thinks that
both peers are in the same route-reflector cluster ("DENIED due to: reflected
from the same cluster"):
Aug 2 13:35:03: BGP(0): 213.3.246.33 send UPDATE (format) 0.0.0.0/0, next
10.62.112.65, metric 0, path 44038 3303, extended community RT:65501:1702
Aug 2 13:35:03: BGP(0): 213.3.246.34 rcv UPDATE w/ attr: nexthop 10.62.112.65,
origin i, localpref 250, metric 0, originator 10.62.112.65, clusterlist
10.62.112.79 10.62.112.17, merged path 44038 3303, AS_PATH , community
Aug 2 13:35:03: BGP(0): 213.3.246.34 rcv UPDATE about 0.0.0.0/0 -- DENIED due
to: reflected from the same cluster;
Aug 2 13:35:03: BGP: 213.3.246.34 Modifying prefix 0.0.0.0/0 from 0 -> 4
address
so, this is my config:
config:
<snip>
interface vasileft1
ip vrf forwarding VRF_A
ip address 10.0.0.1 255.255.255.252
zone-member security VASILEFT
!
interface vasiright1
ip vrf forwarding VRF_B
ip address 10.0.0.2 255.255.255.252
zone-member security VASIRIGHT
!
router bgp 65501
address-family ipv4 vrf IABIP-
bgp router-id 10.0.0.1
redistribute connected
redistribute static
neighbor 10.0.0.2 remote-as 65501
neighbor 10.0.0.2 update-source vasileft1
neighbor 10.0.0.2 activate
neighbor 10.0.0.2 send-community both
neighbor 10.0.0.2 next-hop-self
exit-address-family
!
address-family ipv4 vrf IACYP-
import path selection multipaths
bgp router-id 10.0.0.2
redistribute connected
redistribute static route-map SET-PREFIX-SoO
neighbor 10.0.0.1 remote-as 65501
neighbor 10.0.0.1 update-source vasiright1
neighbor 10.0.0.1 activate
neighbor 10.0.0.1 send-community both
neighbor 10.0.0.1 next-hop-self
exit-address-family
</snip>
what does not works:
- having another AS number on the same box (otherwise eBGP would be possible)
- client-to-client reflection
- magic stuff in route-map
- setting different cluster-id's for different address-families
- nothing found in the release notes:
http://www.cisco.com/en/US/docs/ios/ios_xe/3/release/notes/asr1k_rn_3s_rel_notes.html
so, does anyone knows a nice hidden command to disable this cluster-checking on
a per-peer basis or so?
-steven
