Add VyOS BGP peer example setup documentation
Change-Id: I919e449cf93e0568914391aa85ba23777f4c93f4
This commit is contained in:
Samir Ibradžić
parent
65e26b4a0c
commit
582ebd398b
330
doc/content/bgp-peer.rst
Normal file
330
doc/content/bgp-peer.rst
Normal file
@ -0,0 +1,330 @@
|
|||||||
|
Setting up test BGP peer
|
||||||
|
========================
|
||||||
|
|
||||||
|
`BGP <https://en.wikipedia.org/wiki/Border_Gateway_Protocol>`_ is routing is an
|
||||||
|
exterior gateway protocol supported and recommended to MidoNet
|
||||||
|
production use case. An external BGP peer is necessary for Floating IP (FIP) traffic
|
||||||
|
between the deployed OpenStack cloud instances and the external network(s).
|
||||||
|
These BGP peers are usually available for production or data-center ISP environments,
|
||||||
|
so for the sake of supporting BGP tests under lab or proof-of-concept conditions we
|
||||||
|
are providing instructions on how to set up a "fake" BGP peer that provide fully
|
||||||
|
functional external connectivity. This guide shows how it can be done by setting up
|
||||||
|
VyOS network operating system instance to serve up as an external BGP peer.
|
||||||
|
|
||||||
|
`VyOS <http://vyos.net>`_ is a community fork of
|
||||||
|
`Vyatta <https://en.wikipedia.org/wiki/Vyatta>`_, a Linux-based network operating
|
||||||
|
system that provides software-based network routing, firewall, and VPN functionality.
|
||||||
|
|
||||||
|
Introduction
|
||||||
|
------------
|
||||||
|
|
||||||
|
VyOS works just fine as a live OS when booted from
|
||||||
|
`VyOS ISO <http://mirror.vyos.net/iso/release/1.1.7/vyos-1.1.7-amd64.iso>`_
|
||||||
|
and configured properly, but we will cover some basic steps on how to install it
|
||||||
|
to an actual server or a virtual machine. Being a network operating system and a
|
||||||
|
router appliance, it makes sense to install it on a host that has multiple network
|
||||||
|
interfaces. Minimum hardware requirements for VyOS are single core CPU and 512MB of
|
||||||
|
RAM. It can run just fine without any permanent storage, which is only necessary to
|
||||||
|
save the configuration state.
|
||||||
|
|
||||||
|
Required addressing information
|
||||||
|
-------------------------------
|
||||||
|
|
||||||
|
For the sake of this example we assume following IP addresses will be used
|
||||||
|
in this guide:
|
||||||
|
|
||||||
|
- VyOS management IP on eth0 interface: **10.20.0.254/24**
|
||||||
|
- Default gateway for management subnet: **10.20.0.1**
|
||||||
|
|
||||||
|
|
|
||||||
|
|
||||||
|
Also, BGP protocol itself needs some parameters to be set up. For our simple
|
||||||
|
demonstration we assume that VyOS BGP peer that we are creating is going to
|
||||||
|
communicate with MidoNet gateway BGP peer. As a part of BGP specification, each
|
||||||
|
BGP peer has to have AS number which identifies it when connecting to other peers.
|
||||||
|
Also, BGP peers needs to find each other on specific IP addresses, belonging to a
|
||||||
|
same IP subnet. For our example, we assume following AS numbers and IP addresses:
|
||||||
|
|
||||||
|
- BGP IP subnet: **10.88.88.0/30**
|
||||||
|
- VyOS BGP peer IP address: **10.88.88.1**
|
||||||
|
- VyOS BGP peer AS number: **65535**
|
||||||
|
- MidoNet BGP gateway IP address: **10.88.88.2**
|
||||||
|
- MidoNet BGP gateway AS number: **12345**
|
||||||
|
|
||||||
|
|
|
||||||
|
|
||||||
|
Finally, to fulfill the purpose of this BGP setup, we need to know which Floating IP
|
||||||
|
subnet is going to be handled by MidoNet-based OpenStack cloud, so we specify subnet:
|
||||||
|
|
||||||
|
- Floating IP subnet: **200.200.200.0/24**
|
||||||
|
|
||||||
|
|
||||||
|
VyOS Installation
|
||||||
|
-----------------
|
||||||
|
|
||||||
|
We start installing by booting our server or VM from
|
||||||
|
`VyOS CD <http://mirror.vyos.net/iso/release/1.1.7/vyos-1.1.7-amd64.iso>`_
|
||||||
|
and logging in with username and password, both **vyos** by default. Following
|
||||||
|
that, we run this command to install VyOS to a hard drive:
|
||||||
|
|
||||||
|
::
|
||||||
|
|
||||||
|
vyos@vyos:~$ install image
|
||||||
|
|
||||||
|
After that the following installation prompts will be displayed:
|
||||||
|
|
||||||
|
::
|
||||||
|
|
||||||
|
Welcome to the VyOS install program. This script
|
||||||
|
will walk you through the process of installing the
|
||||||
|
VyOS image to a local hard drive.
|
||||||
|
Would you like to continue? (Yes/No) [Yes]: Yes
|
||||||
|
Probing drives: OK
|
||||||
|
Looking for pre-existing RAID groups...none found.
|
||||||
|
The VyOS image will require a minimum 1000MB root.
|
||||||
|
Would you like me to try to partition a drive automatically
|
||||||
|
or would you rather partition it manually with parted? If
|
||||||
|
you have already setup your partitions, you may skip this step
|
||||||
|
|
||||||
|
Partition (Auto/Parted/Skip) [Auto]:
|
||||||
|
|
||||||
|
I found the following drives on your system:
|
||||||
|
vda 4294MB
|
||||||
|
|
||||||
|
Install the image on? [vda]:
|
||||||
|
|
||||||
|
This will destroy all data on /dev/vda.
|
||||||
|
Continue? (Yes/No) [No]:
|
||||||
|
|
||||||
|
Confirm the that you really want to install VyOS to the target disk drive by
|
||||||
|
typing **Yes**. The rest of the installation can be completed by simply pressing
|
||||||
|
Enter on each prompt, and typing the desired administrator password when asked:
|
||||||
|
|
||||||
|
::
|
||||||
|
|
||||||
|
How big of a root partition should I create? (1000MB - 4294MB) [4294]MB:
|
||||||
|
|
||||||
|
Creating filesystem on /dev/vda1: OK
|
||||||
|
Done!
|
||||||
|
Mounting /dev/vda1...
|
||||||
|
What would you like to name this image? [1.1.7]:
|
||||||
|
OK. This image will be named: 1.1.7
|
||||||
|
Copying squashfs image...
|
||||||
|
Copying kernel and initrd images...
|
||||||
|
Done!
|
||||||
|
I found the following configuration files:
|
||||||
|
/config/config.boot
|
||||||
|
/opt/vyatta/etc/config.boot.default
|
||||||
|
Which one should I copy to vda? [/config/config.boot]:
|
||||||
|
|
||||||
|
Copying /config/config.boot to vda.
|
||||||
|
Enter password for administrator account
|
||||||
|
Enter password for user 'vyos':
|
||||||
|
Retype password for user 'vyos':
|
||||||
|
I need to install the GRUB boot loader.
|
||||||
|
I found the following drives on your system:
|
||||||
|
vda 4294MB
|
||||||
|
|
||||||
|
Which drive should GRUB modify the boot partition on? [vda]:
|
||||||
|
|
||||||
|
Setting up grub: OK
|
||||||
|
Done!
|
||||||
|
vyos@vyos:~$
|
||||||
|
|
||||||
|
This means that the installation has been successful, time to reboot
|
||||||
|
VyOS and do some configuration:
|
||||||
|
|
||||||
|
::
|
||||||
|
|
||||||
|
vyos@vyos:~$ reboot
|
||||||
|
Proceed with reboot? (Yes/No) [No] Yes
|
||||||
|
|
||||||
|
Broadcast message from root@vyos (ttyS0) (Wed Mar 2 12:28:15 2016):
|
||||||
|
|
||||||
|
The system is going down for reboot NOW!
|
||||||
|
|
||||||
|
|
||||||
|
Essential VyOS Configuration
|
||||||
|
----------------------------
|
||||||
|
|
||||||
|
Following the reboot, we need to configure VyOS management IP address and ssh
|
||||||
|
access. Do this by accessing **configuration** mode:
|
||||||
|
|
||||||
|
::
|
||||||
|
|
||||||
|
vyos@vyos:~$ configure
|
||||||
|
[edit]
|
||||||
|
|
||||||
|
Set up management IP address, default gateway, ssh access and a DNS name:
|
||||||
|
|
||||||
|
::
|
||||||
|
|
||||||
|
vyos@vyos# set interfaces ethernet eth0 address 10.20.0.254/24
|
||||||
|
[edit]
|
||||||
|
vyos@vyos# set interfaces ethernet eth0 description MGMT
|
||||||
|
[edit]
|
||||||
|
vyos@vyos# set protocols static route 0.0.0.0/0 next-hop 10.20.0.1
|
||||||
|
[edit]
|
||||||
|
vyos@vyos# set service ssh port 22
|
||||||
|
[edit]
|
||||||
|
vyos@vyos# set service dns forwarding listen-on eth0
|
||||||
|
[edit]
|
||||||
|
vyos@vyos# set service dns forwarding name-server 8.8.8.8
|
||||||
|
[edit]
|
||||||
|
|
||||||
|
To apply as well as save the configuration changes do:
|
||||||
|
|
||||||
|
::
|
||||||
|
|
||||||
|
vyos@vyos# commit
|
||||||
|
[ service ssh ]
|
||||||
|
Restarting OpenBSD Secure Shell server: sshd.
|
||||||
|
|
||||||
|
[edit]
|
||||||
|
vyos@vyos# save
|
||||||
|
Saving configuration to '/config/config.boot'...
|
||||||
|
Done
|
||||||
|
[edit]
|
||||||
|
vyos@vyos# exit
|
||||||
|
exit
|
||||||
|
vyos@vyos:~$ exit
|
||||||
|
logout
|
||||||
|
|
||||||
|
Our VyOS instance should be accessible via ssh at 10.20.0.254 now:
|
||||||
|
|
||||||
|
::
|
||||||
|
|
||||||
|
$ ssh vyos@10.20.0.254
|
||||||
|
|
||||||
|
|
||||||
|
VyOS BGP Configuration
|
||||||
|
----------------------
|
||||||
|
|
||||||
|
It is time to configure VyOS as a BGP peer. For this we will use all the
|
||||||
|
IP and AS addresses we mentioned above. Enter the configuration mode,
|
||||||
|
|
||||||
|
::
|
||||||
|
|
||||||
|
vyos@vyos:~$ configure
|
||||||
|
[edit]
|
||||||
|
|
||||||
|
followed by a stream of commands:
|
||||||
|
|
||||||
|
::
|
||||||
|
|
||||||
|
set interfaces ethernet eth1 address 10.88.88.1/30
|
||||||
|
set policy prefix-list DEFAULT rule 100 action permit
|
||||||
|
set policy prefix-list DEFAULT rule 100 prefix 0.0.0.0/0
|
||||||
|
set policy prefix-list DEFAULT rule 999 action deny
|
||||||
|
set policy prefix-list DEFAULT rule 999 le 32
|
||||||
|
set policy prefix-list DEFAULT rule 999 prefix 0.0.0.0/0
|
||||||
|
set policy prefix-list fromAS12345 rule 100 action permit
|
||||||
|
set policy prefix-list fromAS12345 rule 100 le 32
|
||||||
|
set policy prefix-list fromAS12345 rule 100 prefix 200.200.200.0/24
|
||||||
|
set policy prefix-list fromAS12345 rule 999 action deny
|
||||||
|
set policy prefix-list fromAS12345 rule 999 le 32
|
||||||
|
set policy prefix-list fromAS12345 rule 999 prefix 0.0.0.0/0
|
||||||
|
commit
|
||||||
|
|
||||||
|
set policy route-map fromAS12345 rule 100 match ip address prefix-list fromAS12345
|
||||||
|
set policy route-map fromAS12345 rule 100 action permit
|
||||||
|
set policy route-map fromAS12345 rule 999 action deny
|
||||||
|
commit
|
||||||
|
|
||||||
|
set policy route-map toAS12345 rule 100 action permit
|
||||||
|
set policy route-map toAS12345 rule 100 match ip address prefix-list DEFAULT
|
||||||
|
set policy route-map toAS12345 rule 100 set metric 100
|
||||||
|
set policy route-map toAS12345 rule 999 action deny
|
||||||
|
commit
|
||||||
|
|
||||||
|
set protocols bgp 65535 neighbor 10.88.88.2 default-originate route-map toAS12345
|
||||||
|
set protocols bgp 65535 neighbor 10.88.88.2 route-map export toAS12345
|
||||||
|
set protocols bgp 65535 neighbor 10.88.88.2 route-map import fromAS12345
|
||||||
|
set protocols bgp 65535 neighbor 10.88.88.2 soft-reconfiguration inbound
|
||||||
|
set protocols bgp 65535 neighbor 10.88.88.2 remote-as 12345
|
||||||
|
commit
|
||||||
|
|
||||||
|
Now, we can verify if our VyOS BGP peer is actually connected to the other BGP peer(s):
|
||||||
|
|
||||||
|
::
|
||||||
|
|
||||||
|
vyos@vyos# run show ip bgp summary
|
||||||
|
BGP router identifier 10.20.0.254, local AS number 65535
|
||||||
|
IPv4 Unicast - max multipaths: ebgp 1 ibgp 1
|
||||||
|
RIB entries 1, using 96 bytes of memory
|
||||||
|
Peers 1, using 4560 bytes of memory
|
||||||
|
|
||||||
|
Neighbor V AS MsgRcvd MsgSent TblVer InQ OutQ Up/Down State/PfxRcd
|
||||||
|
10.88.88.2 4 12345 7 8 0 0 0 00:04:22 1
|
||||||
|
|
||||||
|
Total number of neighbors 1
|
||||||
|
|
||||||
|
If you see an output similar to the above, congratulations, you have set up your
|
||||||
|
VyOS BGP peer correctly! It is advised to save this configuration:
|
||||||
|
|
||||||
|
::
|
||||||
|
|
||||||
|
vyos@vyos# save
|
||||||
|
Saving configuration to '/config/config.boot'...
|
||||||
|
Done
|
||||||
|
[edit]
|
||||||
|
|
||||||
|
|
||||||
|
VyOS NAT Configuration
|
||||||
|
----------------------
|
||||||
|
|
||||||
|
In our test setup, the Floating IP subnet 200.200.200.0/24 is not real
|
||||||
|
public IP subnet, hence the "fake BGP peer" mention in the begining of
|
||||||
|
this guide. In lab condition we want to make "fake" OpenStack instances
|
||||||
|
into believing they really can use a floating IP from a
|
||||||
|
200.200.200.0/24 subnet. For that to work we have to set up some
|
||||||
|
NAT rules in our VyOS so that our OpenStack instances can really talk to
|
||||||
|
public Internet.
|
||||||
|
First, we create this NAT rule to allow Floating IP subnet to access
|
||||||
|
public Internet:
|
||||||
|
|
||||||
|
::
|
||||||
|
|
||||||
|
set nat source rule 10 source address 200.200.200.0/24
|
||||||
|
set nat source rule 10 outbound-interface eth0
|
||||||
|
set nat source rule 10 protocol all
|
||||||
|
set nat source rule 10 translation address masquerade
|
||||||
|
commit
|
||||||
|
|
||||||
|
Second, we create NAT rule that will allow traffic from out management
|
||||||
|
subnet, 10.20.0.0/24, to a fake public Floating IP subnet:
|
||||||
|
|
||||||
|
::
|
||||||
|
|
||||||
|
set nat source rule 11 source address 10.20.0.0/24
|
||||||
|
set nat source rule 11 outbound-interface eth1
|
||||||
|
set nat source rule 11 protocol all
|
||||||
|
set nat source rule 11 translation address masquerade
|
||||||
|
commit
|
||||||
|
|
||||||
|
Don't forget to save this configuration:
|
||||||
|
|
||||||
|
::
|
||||||
|
|
||||||
|
vyos@vyos# save
|
||||||
|
Saving configuration to '/config/config.boot'...
|
||||||
|
Done
|
||||||
|
[edit]
|
||||||
|
|
||||||
|
|
||||||
|
Final consideration
|
||||||
|
-------------------
|
||||||
|
|
||||||
|
In a likely case that we want to make fake Floating IP subnet,
|
||||||
|
200.200.200.0/24, available from the rest of our internal management
|
||||||
|
network, 10.20.0.0/24, it is highly advised to set up a static route
|
||||||
|
in the management network gateway router, 10.20.0.1. For example:
|
||||||
|
|
||||||
|
::
|
||||||
|
|
||||||
|
# ip route add 200.200.200.0/24 via 10.20.0.254
|
||||||
|
|
||||||
|
In case management gateway router is not accessible, the above
|
||||||
|
static route can be set at each individual host that needs to access
|
||||||
|
"fake" Floating IP network range.
|
||||||
|
|
||||||
Loading…
Reference in New Issue
Block a user