Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[pbr] No way to configure policy for dual-stack (IPv4/IPv6) interface #17878

Open
2 tasks done
noonedeadpunk opened this issue Jan 17, 2025 · 0 comments
Open
2 tasks done
Labels
triage Needs further investigation

Comments

@noonedeadpunk
Copy link

Description

At the moment it seems to be impossible to configure a PBR for the interface with both IPv4 and IPv6, as:

  • Only single src-ip can be defined per policy
  • Only single policy map can be defined per interface
  • Same interface can be defined only once

Version

# show version
FRRouting 9.1 (os-net02) on Linux(5.15.0-89-generic).
Copyright 1996-2005 Kunihiro Ishiguro, et al.
configured with:
    '--build=x86_64-linux-gnu' '--prefix=/usr' '--includedir=${prefix}/include' '--mandir=${prefix}/share/man' '--infodir=${prefix}/share/info' '--sysconfdir=/etc' '--localstatedir=/var' '--disable-option-checking' '--disable-silent-rules' '--libdir=${prefix}/lib/x86_64-linux-gnu' '--libexecdir=${prefix}/lib/x86_64-linux-gnu' '--disable-maintainer-mode' '--localstatedir=/var/run/frr' '--sbindir=/usr/lib/frr' '--sysconfdir=/etc/frr' '--with-vtysh-pager=/usr/bin/pager' '--libdir=/usr/lib/x86_64-linux-gnu/frr' '--with-moduledir=/usr/lib/x86_64-linux-gnu/frr/modules' '--disable-dependency-tracking' '--enable-rpki' '--disable-scripting' '--enable-pim6d' '--with-libpam' '--enable-doc' '--enable-doc-html' '--enable-snmp' '--enable-fpm' '--disable-protobuf' '--disable-zeromq' '--enable-ospfapi' '--enable-bgp-vnc' '--enable-multipath=256' '--enable-user=frr' '--enable-group=frr' '--enable-vty-group=frrvty' '--enable-configfile-mask=0640' '--enable-logfile-mask=0640' 'build_alias=x86_64-linux-gnu' 'PYTHON=python3'

How to reproduce

It's assumed, that configuration like that should work:

pbr-map FLOATING-IPS seq 101
  match src-ip 192.168.0.0/24
  set nexthop 10.0.0.65 bond0.3114
pbr-map FLOATING-IPS-V6 seq 101
  match src-ip fd53:d91e:400::/40
  set nexthop fe80::2220:ff:fe00:aa bond0.3114
interface br-provide.3102
  pbr-policy FLOATING-IPS
  pbr-policy FLOATING-IPS-V6

Or, maybe, smth like this:

nexthop-group PROVIDER
  nexthop 10.0.0.65 bond0.3114
  nexthop fe80::2220:ff:fe00:aa bond0.3114
pbr-map FLOATING-IPS seq 101
  match src-ip 192.168.0.0/24
  match src-ip fd53:d91e:400::/40
  set nexthop-group PROVIDER
interface br-provide.3102
  pbr-policy FLOATING-IPS

Expected behavior

os-net02# show pbr map
  pbr-map FLOATING-IPS valid: yes
    Seq: 101 rule: 400
        Installed: yes Reason: Valid
        SRC IP Match: 192.168.0.0/24
        nexthop 10.0.0.65 bond0.3114
          Installed: yes Tableid: 10000
  pbr-map FLOATING-IPS-V6 valid: yes
    Seq: 101 rule: 400
        Installed: yes Reason: Valid
        SRC IP Match: fd53:d91e:400::/40
        nexthop fe80::2220:ff:fe00:aa bond0.3114
          Installed: yes Tableid: 10001
os-net02# show pbr int
  br-provide.3102(20) with pbr-policy FLOATING-IPS FLOATING-IPS-V6

Actual behavior

os-net02# show pbr map
  pbr-map FLOATING-IPS valid: yes
    Seq: 101 rule: 400
        Installed: no Reason: Valid
        SRC IP Match: 192.168.0.0/24
        nexthop 10.0.0.65 bond0.3114
          Installed: yes Tableid: 10000
  pbr-map FLOATING-IPS-V6 valid: yes
    Seq: 101 rule: 400
        Installed: yes Reason: Valid
        SRC IP Match: fd53:d91e:400::/40
        nexthop fe80::2220:ff:fe00:aa bond0.3114
          Installed: yes Tableid: 10001
os-net02# show pbr int
  br-provide.3102(20) with pbr-policy FLOATING-IPS-V6

Additional context

No response

Checklist

  • I have searched the open issues for this bug.
  • I have not included sensitive information in this report.
@noonedeadpunk noonedeadpunk added the triage Needs further investigation label Jan 17, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
triage Needs further investigation
Projects
None yet
Development

No branches or pull requests

1 participant