From d79e0e085bc177d85eccd8267e343d6cdb5baff9 Mon Sep 17 00:00:00 2001 From: Quentin Young Date: Tue, 16 Apr 2019 15:19:10 +0000 Subject: [PATCH] doc: document bgp listen ranges and md5 behavior Signed-off-by: Quentin Young --- doc/user/bgp.rst | 24 ++++++++++++++++++++++++ 1 file changed, 24 insertions(+) diff --git a/doc/user/bgp.rst b/doc/user/bgp.rst index be331ffb99..35e42d95cb 100644 --- a/doc/user/bgp.rst +++ b/doc/user/bgp.rst @@ -826,6 +826,30 @@ Defining Peers peers ASN is the same as mine as specified under the :clicmd:`router bgp ASN` command the connection will be denied. +.. index:: [no] bgp listen range peer-group WORD +.. clicmd:: [no] bgp listen range peer-group WORD + + Accept connections from any peers in the specified prefix. Configuration + from the specified peer-group is used to configure these peers. + +.. note:: + + When using BGP listen ranges, if the associated peer group has TCP MD5 + authentication configured, your kernel must support this on prefixes. On + Linux, this support was added in kernel version 4.14. If your kernel does + not support this feature you will get a warning in the log file, and the + listen range will only accept connections from peers without MD5 configured. + + Additionally, we have observed that when using this option at scale (several + hundred peers) the kernel may hit its option memory limit. In this situation + you will see error messages like: + + ``bgpd: sockopt_tcp_signature: setsockopt(23): Cannot allocate memory`` + + In this case you need to increase the value of the sysctl + ``net.core.optmem_max`` to allow the kernel to allocate the necessary option + memory. + .. _bgp-configuring-peers: Configuring Peers -- 2.39.5