BGP as a Service (BGPaaS) Feature in Contrail Cloud 3.0

Transcription

1 BGP as a Service (BGPaaS) Feature in Contrail Cloud 3.0 BGPaaS Overview: Juniper has provided a new feature to use BGP as a service in Contrail Cloud 3.0 as referred on Juniper- Techpubs-BGPaaS: With this feature if a VNF VM have a capability to support BGP then it can do BGP peering with vrouteragent/controller and can advertise routes into the VRF instance. When BGPaaS is configured in contrail, the vrouter-agent listens for the TCP/179 onto the virtual network default-gateway and virtual DNS addresses. These are configured as ebgp sessions. The vrouter-agent then proxy the TCP connection to the control node on behalf of the tenant VM. The BGP peers will be established and can exchange routes with each other. All routes advertised from contrail to VNF will have next-hop set to default-gateway IP address. Our Lab Topology for Deploying BGPaaS: The following snapshot describes our lab-environment topology for contrail cloud 3.0 as well as the BGP peering when BGPaaS will configured: We will see how to configure the BGPaaS service in contrail and deploy BGP sessions in VNF (here we will use JunOS router) and see how the advertised routes will be reflected into the contrail controller routing instance table.

2 First we will configure BGPaaS with virtual machine s VMI-address. Whereas on tenant s VM, BGP will be configured with default-gateway address and see the BGP sessions and flows on both tenant and compute. We will advertise the loopback addresses both IPv4 & IPv6 from VM into the BGP and see these routes will be available in control nodes VRF table. Secondly we will configure BGP with vdns address and see the flow sessions. Finally we will configure the BGPaaS with the loopback address of tenant VM rather than its VMI-address and see the behavior of BGP sessions. In the end we will provide some cautions/recommendations to configure BGPaaS for it to work properly. Tenant Network Creation: For our analysis we have created a virtual network and launched a VM to test BGPaaS as shown below: Virtual Network VN_TEST o CIDR: /24 o Default-Gateway: o vdns IP address: Virtual Machine VM_BGPaaS o VMI-IP-address: /32 o Lo0 IP-address: /32 o Lo0 IPv6-address: 2001::10:10:100:100/128 The VM is created and is up & running.

3 Configuring BGPaaS: To configure the BGPaaS, in Configure tab, go to the Services and select BGP as a Service and hit the + sign to create a new service as shown below:

4 Enter the name for this service object, the AS number for VNF, select address families that need to be transported and the VMI, here it will be as shown in below snapshot: As the service is created, the vrouter-agent started listening TCP 179 on both default-gateway & vdns addresses. To complete the BGP peering process, create BGP configurations in VM. Here in our environment we are using JunOS so following minimal configs are made in the VM: interfaces { lo0 { unit 0 { family inet { address /32; family inet6 { address 2001::10:10:100:100/128;

5 routing-options { router-id ; autonomous-system 65000; policy-options { policy-statement export-to-bgp { term allow_local { from protocol [ direct local ]; then { next-hop ; accept; term deny_all { then reject; protocols { bgp { group BGPaaS-VN_TEST { type external; multihop; local-address ; family inet { unicast; family inet6 { unicast; export export-to-bgp; peer-as 64512; multipath; neighbor ; This will create BGP session between the VM and the vrouter-agent and advertise routes. Verification of configured BGPaaS: To verify the service, we can see the BGPaaS is configured successfully in introspect as:

6 In control node, the BGP neighbor list report also shows the peering session with VM instance: We can find the flow for this peering session with virtual network default-gateway in compute node as: flow --match Flow table(size , entries ) Entries: Created Added Processed Used Overflow entries 0 (Created Flows/CPU: )(oflows 0) Action:F=Forward, D=Drop N=NAT(S=SNAT, D=DNAT, Ps=SPAT, Pd=DPAT, L=Link Local Port) Other:K(nh)=Key_Nexthop, S(nh)=RPF_Nexthop Flags:E=Evicted, Ec=Evict Candidate, N=New Flow, M=Modified Dm=Delete Marked TCP(r=reverse):S=SYN, F=FIN, R=RST, C=HalfClose, E=Established, D=Dead Listing flows matching ([ ]:*) Index Source:Port/Destination:Port Proto(V) <=> : (1->0) :179 (Gen: 26, K(nh):31, Action:N(SPsDL), Flags:, TCP:SSrEEr, S(nh):31, Stats:20/1558, SPort 62035) root@cs4:~# As vrtouer-agent proxy this peering session to the controller, so we can see the flow as shown below: root@cs4:~# flow --match

7 Flow table(size , entries ) Entries: Created Added Processed Used Overflow entries 0 (Created Flows/CPU: )(oflows 0) Action:F=Forward, D=Drop N=NAT(S=SNAT, D=DNAT, Ps=SPAT, Pd=DPAT, L=Link Local Port) Other:K(nh)=Key_Nexthop, S(nh)=RPF_Nexthop Flags:E=Evicted, Ec=Evict Candidate, N=New Flow, M=Modified Dm=Delete Marked TCP(r=reverse):S=SYN, F=FIN, R=RST, C=HalfClose, E=Established, D=Dead Listing flows matching ([ ]:*) Index Source:Port/Destination:Port Proto(V) <=> :179 6 (0->1) :50000 (Gen: 19, K(nh):5, Action:N(SDPdL), Flags:, TCP:SSrEEr, S(nh):12, Stats:42/2263, SPort 54056) root@cs4:~# In VM, we can also verify the BGP session as: sdn-e@junos-vm> show bgp summary Groups: 1 Peers: 1 Down peers: 0 Table Tot Paths Act Paths Suppressed History Damp State Pending inet inet Peer AS InPkt OutPkt OutQ Flaps Last Up/Dwn State #Active/Received/Accepted/Damped :38 Establ inet.0: 0/0/0/0 inet6.0: 0/0/0/0 sdn-e@junos-vm> Advertised routes in VRF instance: As we can see in VM configuration we configured loopback0 for inet and inet6. These prefixes are advertised in BGP as shown below: sdn-e@junos-vm> show route advertising-protocol bgp inet.0: 4 destinations, 4 routes (4 active, 0 holddown, 0 hidden) Prefix Nexthop MED Lclpref AS path * / I * / I inet6.0: 2 destinations, 2 routes (2 active, 0 holddown, 0 hidden)

8 Prefix Nexthop MED Lclpref AS path 2001::10:10:100:100/128 * I sdn-e@junos-vm> These prefixes are shown in the VRF table of the control node as shown in below snapshot: vdns BGP session: For high availability, a second BGP session can be configured with vdns IP address for that particular virtual network as vrouter-agent listens for port 179 onto both default-gateway and vdns IP addresses. So we only need to create session in the VM: [edit] sdn-e@junos-vm# set protocols bgp group BGPaaS-VN_TEST neighbor [edit] sdn-e@junos-vm# commit and-quit commit complete Exiting configuration mode sdn-e@junos-vm> show bgp summary Groups: 1 Peers: 2 Down peers: 0 Table Tot Paths Act Paths Suppressed History Damp State Pending inet inet Peer AS InPkt OutPkt OutQ Flaps Last Up/Dwn State #Active/Received/Accepted/Damped :20 Establ inet.0: 0/0/0/0 inet6.0: 0/0/0/0

9 Establ inet.0: 0/0/0/0 inet6.0: 0/0/0/0 sdn-e@junos-vm> We can see the flow session in compute node as follows: root@cs4:~# flow --match Flow table(size , entries ) Entries: Created Added Processed Used Overflow entries 0 (Created Flows/CPU: )(oflows 0) Action:F=Forward, D=Drop N=NAT(S=SNAT, D=DNAT, Ps=SPAT, Pd=DPAT, L=Link Local Port) Other:K(nh)=Key_Nexthop, S(nh)=RPF_Nexthop Flags:E=Evicted, Ec=Evict Candidate, N=New Flow, M=Modified Dm=Delete Marked TCP(r=reverse):S=SYN, F=FIN, R=RST, C=HalfClose, E=Established, D=Dead Listing flows matching ([ ]:*) Index Source:Port/Destination:Port Proto(V) <=> : (1->0) :179 (Gen: 26, K(nh):31, Action:N(SPsDL), Flags:, TCP:SSrEEr, S(nh):31, Stats:105/7003, SPort 62035) <=> : (1->0) :179 (Gen: 11, K(nh):31, Action:N(SPsDL), Flags:, TCP:SSrEEr, S(nh):31, Stats:9/909, SPort 58383) root@cs4:~# BGP peering with loopback address: Contrail cloud has enhanced the BGPaaS feature by adding the facility for BGP peering with loopback address of the VM instance. To do this, edit the BGPaaS object and in Advanced Options enter the loopback IP of the VM:

10 Here in this case it is In addition to this we need to add a static route in network route table of vrouter for the VM instance s loopback address. To do so, go to Networking and select Routing ; then select + to create a static route table as shown below:

11 Now go the Networks and edit the virtual network VN_TEST. In Advanced Options select the created network table under Static Routes option. This will add this route to the network table of this virtual network. Now we need to change the BGP configs on VM instance also as follow: [edit] set protocols bgp group BGPaaS-VN_TEST local-address [edit] commit and-quit commit complete Exiting configuration mode show bgp summary Groups: 1 Peers: 2 Down peers: 0 Table Tot Paths Act Paths Suppressed History Damp State Pending inet inet Peer AS InPkt OutPkt OutQ Flaps Last Up/Dwn State #Active/Received/Accepted/Damped Establ inet.0: 0/0/0/0 inet6.0: 0/0/0/ Establ inet.0: 0/0/0/0 inet6.0: 0/0/0/0 sdn-e@junos-vm>

12 As now the BGP session is created with the loopback IP address so we can see the flow session for this BGP peering onto compute node as follows: flow --match Flow table(size , entries ) Entries: Created Added Processed Used Overflow entries 0 (Created Flows/CPU: )(oflows 0) Action:F=Forward, D=Drop N=NAT(S=SNAT, D=DNAT, Ps=SPAT, Pd=DPAT, L=Link Local Port) Other:K(nh)=Key_Nexthop, S(nh)=RPF_Nexthop Flags:E=Evicted, Ec=Evict Candidate, N=New Flow, M=Modified Dm=Delete Marked TCP(r=reverse):S=SYN, F=FIN, R=RST, C=HalfClose, E=Established, D=Dead Listing flows matching ([ ]:*) Index Source:Port/Destination:Port Proto(V) <=> : (1->0) :179 (Gen: 12, K(nh):31, Action:N(SPsDL), Flags:, TCP:SSrEEr, S(nh):31, Stats:21/1834, SPort 50140) <=> : (1->0) :179 (Gen: 15, K(nh):31, Action:N(SPsDL), Flags:, TCP:SSrEEr, S(nh):31, Stats:21/1815, SPort 61715) root@cs4:~# This is worth to note that this BGPaaS object on vrouter-agent is same as it was configured for VMI address previously. Only the peer-ip is changed. This can be verified from the below introspect snapshot: Caution Notes: i. EBGP-Multihop must be enabled on tenant VM

13 ii. iii. iv. Static route must be configured and associated with virtual network if BGP peering is configured through non-vmi address (loopback address) Its recommended to configure both peering sessions each with default-gateway as well as vdns IP address For routes to be advertised in tenant VM, protocol next-hop should be set to VIF address of the VM assigned by vrouter