CS4.20.1 ROUTED VPC BGP PEERS NOT CREATED

[tatay188]

problem

1. the VC is under a subdomain mydomain, and under a project.
2. use.system.bgp.peers is set to true.
3. BGP peers are set under the zone, and are not dedicated to any account or domain.

and the VPC BGP shows :

there are no BGP peers

Should this work under a subdomain ?
IF Yes, Should I configure the BGP peerings manually on the Vrouter? If Yes, How as the Subdomain does not have visibility over the VROUTER.

Thank you

versions

ACS 4.20.1

The steps to reproduce the bug

1. the VC is under a subdomain mydomain, and under a project.
2. use.system.bgp.peers is set to true.
3. BGP peers are set under the zone, and are not dedicated to any account or domain.

What to do about it?

No response

[weizhouapache]

@tatay188
It is expected.

Can you check frr config in VR ?
It should connect to all BGP peers.

[tatay188]

@weizhouapache

Only root have access to the VR:
And No, there is no BGP configured.

[weizhouapache]

@weizhouapache

Only root have access to the VR:
And No, there is no BGP configured.

@tatay188
have you created a vpc tier and vms in the vpc ?

[tatay188]

@weizhouapache
VPC tier was created but nothing happened until I added the VM, then

BGP not coming up

Suggestion for Functionality: The VR created the BGP peers, But for pretty much any infrastructure the Multihop should be added with at least 5 hops that way covers most of the possibilities; knowing that, as a subdomain do not have access to the VR.

Where can I modify the VR, then each time the VR is modified or restarted the BGP-multihop configuration remains?

[weizhouapache]

Suggestion for Functionality: The VR created the BGP peers, But for pretty much any infrastructure the Multihop should be added with at least 5 hops that way covers most of the possibilities; knowing that, as a subdomain do not have access to the VR.

Where can I modify the VR, then each time the VR is modified or restarted the BGP-multihop configuration remains?

You can update BGP peer details by cloudmonkey/cmk, or insert a record in bgp_peer_details

cmk update bgppeer id=xxxxx details[0].EBGP_MultiHop=5

a line will be added in frr configuration

neighbor 1.2.3.4 ebgp-multihop 5

is it what you needed ?

[tatay188]

@weizhouapache
Apologies; but No, is not what I need.
I added a line manually in the FRR as a root admin; however, this needs to be done by the domain administrator not by the root admin - If the cloud operator is serving multiple companies - We can't use CMK, We will not use CMK as it does not pass security for our requirements.

Is there a UI where I can add the bgp_peer_details ? I look everywhere !

[weizhouapache]

@weizhouapache Apologies; but No, is not what I need. I added a line manually in the FRR as a root admin; however, this needs to be done by the domain administrator not by the root admin - If the cloud operator is serving multiple companies - We can't use CMK, We will not use CMK as it does not pass security for our requirements.

Is there a UI where I can add the bgp_peer_details ? I look everywhere !

what I mean is, is the configuration what you needed ?

the BGP peer details can not be updated on UI, it can only be done via cloudmonkey
once it is added, no other actions needed for domain admins, except reapplying/updating the BGP peers of the networks.

[tatay188]

@weizhouapache
All BGP is up and running, and works !!!

1. Manual config of vROUTER: I configured the vRouter manually as a ROOT Admin - that is going to be a burden for Subdomain customers and for the CS administrators:
2. Dynamic vROUTER Script: What script takes care of the vRouter Dynamic config? then I can make standard for our deployments, I have to add several lines.
3. Router infrastructure configuration: Any tool you recommend to configure the router from cloudstack - I have to add only one line on each router, but wan it to make automatic.
4. Subdomain Project BGP peers not visible: Seems cosmetic, Maybe this is intended, and only domain admins should be able to see the BGP peers. Please let me know However under the Subdomain - Dynamic routed Project the BGP peers are empty:

Let me know if you want me to make some additional tests, that does not involve APIs.

[weizhouapache]

@weizhouapache All BGP is up and running, and works !!!

1. Manual config of vROUTER: I configured the vRouter manually as a ROOT Admin - that is going to be a burden for Subdomain customers and for the CS administrators: 2. Dynamic vROUTER Script: What script takes care of the vRouter Dynamic config? then I can make standard for our deployments, I have to add several lines. 3. Router infrastructure configuration: Any tool you recommend to configure the router from cloudstack - I have to add only one line on each router, but wan it to make automatic. 4. Subdomain Project BGP peers not visible: Seems cosmetic, Maybe this is intended, and only domain admins should be able to see the BGP peers. Please let me know However under the Subdomain - Dynamic routed Project the BGP peers are empty:

what manual configuration have you made inside the VR ?

the frr configuration is generated by a python script: https://github.com/apache/cloudstack/blob/main/systemvm/debian/opt/cloud/bin/cs/CsBgpPeers.py
if you make some changes in the script, you need to update /usr/share/cloudstack-common/vms/cloud-scripts.tgz on hosts or mgmt servers (if you use vmware)

the table lists the BGP peers associated to the VPC, by default it is empty. the configuration is described on the UI

Please note, if no BGP peers are selected, the VR will connect to
(1) dedicated BGP peers the owner can access, if the owner has dedicated BGP peers and account setting use.system.bgp.peers is set to false;
(2) all BGP peers the owner can access, otherwise.

Only root admin can change BGP peers for network and VPC.

[tatay188]

@weizhouapache totally Agree with this part "Only root admin can change BGP peers for network and VPC."

The point for the table is its not showing any data even though BGP is up and running. Questions is: Should it show Any data ? remember our scenario is a Subdomain and a project inside the Subdomain.

[tatay188]

@weizhouapache @DaanHoogland

Will be great to have the Chance to add a New Tier on the VPC that is not tied to the initial segment, I need to add a Tier but keep it using RFC1918 for the backend, not routed.

This will be awesome if possible - I can using a VNF, but makes no sense to add more Network elements in my case.

Thank you

[DaanHoogland]

Will be great to have the Chance to add a New Tier on the VPC that is not tied to the initial segment, I need to add a Tier but keep it using RFC1918 for the backend, not routed.

@tatay188 , a VPC has an internal CIDR. It sounds like you are looking for private gateway instead.

[tatay188]

@DaanHoogland Certainly It's a more complex scenario - like for a carrier to give you an idea, there tons of vNFS missing in the ASCII diagram, but you got the Idea.

VPC--vr with Dynamic routing
|
|-----Public VMs Proxies
====vTAP==vNF(GW)===== DMZ private IPs
| \ ECMP
|
(privateIP & VNF)Core Radio(privateIP & VNFs)

[weizhouapache]

@weizhouapache @DaanHoogland

Will be great to have the Chance to add a New Tier on the VPC that is not tied to the initial segment, I need to add a Tier but keep it using RFC1918 for the backend, not routed.

VPC tier cidr must be in the VPC cidr - this is not changable.

This will be awesome if possible - I can using a VNF, but makes no sense to add more Network elements in my case.

Thank you

[tatay188]

@weizhouapache That Works we find a way to establish the architecture. This actually works better.