From 8bc3c9ba755895468ac4bbcdb70416503a5710a6 Mon Sep 17 00:00:00 2001 From: Philippe Guibert Date: Mon, 20 Apr 2020 09:18:20 +0200 Subject: [PATCH] doc: add bgp flowspec ipv6 documentation add bgp flowspdec ipv6 documentation. Signed-off-by: Philippe Guibert --- doc/user/flowspec.rst | 35 ++++++++++++++++++++++++++++++++++- 1 file changed, 34 insertions(+), 1 deletion(-) diff --git a/doc/user/flowspec.rst b/doc/user/flowspec.rst index b274afe8a2..d3eb25a7c7 100644 --- a/doc/user/flowspec.rst +++ b/doc/user/flowspec.rst @@ -22,6 +22,9 @@ more or less complex combination of the following: - Layer 3 information: DSCP value, Protocol type, packet length, fragmentation. - Misc layer 4 TCP flags. +Note that if originally Flowspec defined IPv4 rules, this is also possible to use +IPv6 address-family. The same set of combinations as defined for IPv4 can be used. + A combination of the above rules is applied for traffic filtering. This is encoded as part of specific BGP extended communities and the action can range from the obvious rerouting (to nexthop or to separate VRF) to shaping, or @@ -31,6 +34,7 @@ The following IETF drafts and RFCs have been used to implement FRR Flowspec: - :rfc:`5575` - [Draft-IETF-IDR-Flowspec-redirect-IP]_ +- [Draft-IETF-IDR-Flow-Spec-V6]_ .. _design-principles-flowspec: @@ -108,9 +112,13 @@ As of today, it is only possible to configure Flowspec on the default VRF. router bgp neighbor remote-as + neighbor remote-as address-family ipv4 flowspec neighbor activate - exit + exit + address-family ipv6 flowspec + neighbor activate + exit exit You can see Flowspec entries, by using one of the following show commands: @@ -118,6 +126,8 @@ You can see Flowspec entries, by using one of the following show commands: .. index:: show bgp ipv4 flowspec [detail | A.B.C.D] .. clicmd:: show bgp ipv4 flowspec [detail | A.B.C.D] +.. index:: show bgp ipv6 flowspec [detail | A:B::C:D] +.. clicmd:: show bgp ipv6 flowspec [detail | A:B::C:D] Per-interface configuration ^^^^^^^^^^^^^^^^^^^^^^^^^^^ @@ -183,6 +193,28 @@ interfaces are created with private IP addressing scheme. exit exit +Similarly, it is possible to do the same for IPv6 flowspec rules, by using +an IPv6 extended community. The format is defined on :rfc:`5701`, and that +community contains an IPv6 address encoded in the attribute, and matches the +locally configured imported route target IPv6 defined under the appropriate +BGP VRF instance. Below example defines an IPv6 extended community containing +`E:F::G:H` address followed by 2 bytes chosen by admin ( here `JJ`). + +.. code-block:: frr + + router bgp + neighbor remote-as + address-family ipv6 flowspec + neighbor A:B::C:D activate + exit + exit + router bgp vrf vrf2 + address-family ipv6 unicast + rt6 redirect import + exit + exit + + Flowspec monitoring & troubleshooting ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ @@ -348,4 +380,5 @@ inside FRRouting. .. [Draft-IETF-IDR-Flowspec-redirect-IP] .. [Draft-IETF-IDR-Flowspec-Interface-Set] +.. [Draft-IETF-IDR-Flow-Spec-V6] .. [Presentation] -- 2.39.5