Skip to content

Commit df7d044

Browse files
alexeygorbunovClausHolbechAristapre-commit-ci[bot]gmuloc
authored
Feat(eos_designs): RCF-based route filtering for evpn_prevent_readvertise_to_server (#5984)
Co-authored-by: Claus Holbech <[email protected]> Co-authored-by: pre-commit-ci[bot] <66853113+pre-commit-ci[bot]@users.noreply.github.com> Co-authored-by: Guillaume Mulocher <[email protected]>
1 parent 807672c commit df7d044

18 files changed

Lines changed: 327 additions & 26 deletions

‎ansible_collections/arista/avd/extensions/molecule/eos_designs_unit_tests/intended/configs/evpn-prevent-readvertise-to-server-2.cfg‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -60,6 +60,9 @@ router bgp 65002
6060
neighbor 192.168.255.116 peer group EVPN-OVERLAY-PEERS
6161
neighbor 192.168.255.116 remote-as 65005
6262
neighbor 192.168.255.116 description evpn-prevent-readvertise-to-server-6_Loopback0
63+
neighbor 192.168.255.118 peer group EVPN-OVERLAY-PEERS
64+
neighbor 192.168.255.118 remote-as 65007
65+
neighbor 192.168.255.118 description evpn-prevent-readvertise-to-server-8_Loopback0
6366
redistribute connected route-map RM-CONN-2-BGP
6467
!
6568
address-family evpn

‎ansible_collections/arista/avd/extensions/molecule/eos_designs_unit_tests/intended/configs/evpn-prevent-readvertise-to-server-3.cfg‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -60,6 +60,9 @@ router bgp 65003
6060
neighbor 192.168.255.116 peer group EVPN-OVERLAY-PEERS
6161
neighbor 192.168.255.116 remote-as 65005
6262
neighbor 192.168.255.116 description evpn-prevent-readvertise-to-server-6_Loopback0
63+
neighbor 192.168.255.118 peer group EVPN-OVERLAY-PEERS
64+
neighbor 192.168.255.118 remote-as 65007
65+
neighbor 192.168.255.118 description evpn-prevent-readvertise-to-server-8_Loopback0
6366
redistribute connected route-map RM-CONN-2-BGP
6467
!
6568
address-family evpn

‎ansible_collections/arista/avd/extensions/molecule/eos_designs_unit_tests/intended/configs/evpn-prevent-readvertise-to-server-5.cfg‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -57,6 +57,9 @@ router bgp 65003
5757
neighbor 192.168.255.116 peer group EVPN-OVERLAY-PEERS
5858
neighbor 192.168.255.116 remote-as 65005
5959
neighbor 192.168.255.116 description evpn-prevent-readvertise-to-server-6_Loopback0
60+
neighbor 192.168.255.118 peer group EVPN-OVERLAY-PEERS
61+
neighbor 192.168.255.118 remote-as 65007
62+
neighbor 192.168.255.118 description evpn-prevent-readvertise-to-server-8_Loopback0
6063
redistribute connected route-map RM-CONN-2-BGP
6164
!
6265
address-family evpn

‎ansible_collections/arista/avd/extensions/molecule/eos_designs_unit_tests/intended/configs/evpn-prevent-readvertise-to-server-8.cfg‎

Lines changed: 87 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,87 @@
1+
!
2+
no enable password
3+
no aaa root
4+
!
5+
vlan internal order ascending range 1006 1199
6+
!
7+
transceiver qsfp default-mode 4x10G
8+
!
9+
service routing protocols model multi-agent
10+
!
11+
hostname evpn-prevent-readvertise-to-server-8
12+
!
13+
vrf instance MGMT
14+
!
15+
interface Loopback0
16+
description ROUTER_ID
17+
no shutdown
18+
ip address 192.168.255.118/32
19+
!
20+
interface Loopback1
21+
description VXLAN_TUNNEL_SOURCE
22+
no shutdown
23+
ip address 192.168.254.118/32
24+
!
25+
interface Vxlan1
26+
description evpn-prevent-readvertise-to-server-8_VTEP
27+
vxlan source-interface Loopback1
28+
vxlan udp-port 4789
29+
!
30+
ip routing
31+
no ip routing vrf MGMT
32+
!
33+
ip prefix-list PL-LOOPBACKS-EVPN-OVERLAY
34+
seq 10 permit 192.168.255.0/24 eq 32
35+
seq 20 permit 192.168.254.0/24 eq 32
36+
!
37+
ip route vrf MGMT 0.0.0.0/0 192.168.0.1
38+
!
39+
route-map RM-CONN-2-BGP permit 10
40+
match ip address prefix-list PL-LOOPBACKS-EVPN-OVERLAY
41+
!
42+
router bfd
43+
multihop interval 300 min-rx 300 multiplier 3
44+
!
45+
router bgp 65007
46+
router-id 192.168.255.118
47+
update wait-install
48+
no bgp default ipv4-unicast
49+
maximum-paths 4
50+
neighbor EVPN-OVERLAY-PEERS peer group
51+
neighbor EVPN-OVERLAY-PEERS update-source Loopback0
52+
neighbor EVPN-OVERLAY-PEERS bfd
53+
neighbor EVPN-OVERLAY-PEERS ebgp-multihop 3
54+
neighbor EVPN-OVERLAY-PEERS send-community
55+
neighbor EVPN-OVERLAY-PEERS maximum-routes 0
56+
neighbor 192.168.255.112 peer group EVPN-OVERLAY-PEERS
57+
neighbor 192.168.255.112 remote-as 65002
58+
neighbor 192.168.255.112 description evpn-prevent-readvertise-to-server-2_Loopback0
59+
neighbor 192.168.255.113 peer group EVPN-OVERLAY-PEERS
60+
neighbor 192.168.255.113 remote-as 65003
61+
neighbor 192.168.255.113 description evpn-prevent-readvertise-to-server-3_Loopback0
62+
neighbor 192.168.255.115 peer group EVPN-OVERLAY-PEERS
63+
neighbor 192.168.255.115 remote-as 65003
64+
neighbor 192.168.255.115 description evpn-prevent-readvertise-to-server-5_Loopback0
65+
redistribute connected route-map RM-CONN-2-BGP
66+
!
67+
address-family evpn
68+
neighbor EVPN-OVERLAY-PEERS activate
69+
neighbor 192.168.255.112 rcf out RCF_EVPN_FILTER_AS( 65002 )
70+
neighbor 192.168.255.113 rcf out RCF_EVPN_FILTER_AS( 65003 )
71+
neighbor 192.168.255.115 rcf out RCF_EVPN_FILTER_AS( 65003 )
72+
!
73+
address-family ipv4
74+
no neighbor EVPN-OVERLAY-PEERS activate
75+
!
76+
router general
77+
control-functions
78+
code unit CU_EVPN_FILTER_AS
79+
function RCF_EVPN_FILTER_AS( as_number_type $PEER_ASN ) {
80+
return as_path has_none { $PEER_ASN };
81+
}
82+
EOF
83+
!
84+
exit
85+
exit
86+
!
87+
end

‎ansible_collections/arista/avd/extensions/molecule/eos_designs_unit_tests/intended/structured_configs/evpn-prevent-readvertise-to-server-2.yml‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -71,6 +71,12 @@ router_bgp:
7171
metadata:
7272
peer: evpn-prevent-readvertise-to-server-6
7373
description: evpn-prevent-readvertise-to-server-6_Loopback0
74+
- ip_address: 192.168.255.118
75+
peer_group: EVPN-OVERLAY-PEERS
76+
remote_as: '65007'
77+
metadata:
78+
peer: evpn-prevent-readvertise-to-server-8
79+
description: evpn-prevent-readvertise-to-server-8_Loopback0
7480
redistribute:
7581
connected:
7682
enabled: true

‎ansible_collections/arista/avd/extensions/molecule/eos_designs_unit_tests/intended/structured_configs/evpn-prevent-readvertise-to-server-3.yml‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -71,6 +71,12 @@ router_bgp:
7171
metadata:
7272
peer: evpn-prevent-readvertise-to-server-6
7373
description: evpn-prevent-readvertise-to-server-6_Loopback0
74+
- ip_address: 192.168.255.118
75+
peer_group: EVPN-OVERLAY-PEERS
76+
remote_as: '65007'
77+
metadata:
78+
peer: evpn-prevent-readvertise-to-server-8
79+
description: evpn-prevent-readvertise-to-server-8_Loopback0
7480
redistribute:
7581
connected:
7682
enabled: true

‎ansible_collections/arista/avd/extensions/molecule/eos_designs_unit_tests/intended/structured_configs/evpn-prevent-readvertise-to-server-5.yml‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -65,6 +65,12 @@ router_bgp:
6565
metadata:
6666
peer: evpn-prevent-readvertise-to-server-6
6767
description: evpn-prevent-readvertise-to-server-6_Loopback0
68+
- ip_address: 192.168.255.118
69+
peer_group: EVPN-OVERLAY-PEERS
70+
remote_as: '65007'
71+
metadata:
72+
peer: evpn-prevent-readvertise-to-server-8
73+
description: evpn-prevent-readvertise-to-server-8_Loopback0
6874
redistribute:
6975
connected:
7076
enabled: true

‎ansible_collections/arista/avd/extensions/molecule/eos_designs_unit_tests/intended/structured_configs/evpn-prevent-readvertise-to-server-8.yml‎

Lines changed: 122 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,122 @@
1+
aaa_root:
2+
disabled: true
3+
config_end: true
4+
enable_password:
5+
disabled: true
6+
hostname: evpn-prevent-readvertise-to-server-8
7+
ip_igmp_snooping:
8+
globally_enabled: true
9+
ip_routing: true
10+
loopback_interfaces:
11+
- name: Loopback0
12+
description: ROUTER_ID
13+
shutdown: false
14+
ip_address: 192.168.255.118/32
15+
- name: Loopback1
16+
description: VXLAN_TUNNEL_SOURCE
17+
shutdown: false
18+
ip_address: 192.168.254.118/32
19+
metadata:
20+
is_deployed: true
21+
fabric_name: EOS_DESIGNS_UNIT_TESTS
22+
prefix_lists:
23+
- name: PL-LOOPBACKS-EVPN-OVERLAY
24+
sequence_numbers:
25+
- sequence: 10
26+
action: permit 192.168.255.0/24 eq 32
27+
- sequence: 20
28+
action: permit 192.168.254.0/24 eq 32
29+
route_maps:
30+
- name: RM-CONN-2-BGP
31+
sequence_numbers:
32+
- sequence: 10
33+
type: permit
34+
match:
35+
- ip address prefix-list PL-LOOPBACKS-EVPN-OVERLAY
36+
router_bfd:
37+
multihop:
38+
interval: 300
39+
min_rx: 300
40+
multiplier: 3
41+
router_bgp:
42+
as: '65007'
43+
router_id: 192.168.255.118
44+
maximum_paths:
45+
paths: 4
46+
updates:
47+
wait_install: true
48+
bgp:
49+
default:
50+
ipv4_unicast: false
51+
peer_groups:
52+
- name: EVPN-OVERLAY-PEERS
53+
metadata:
54+
type: evpn
55+
update_source: Loopback0
56+
bfd: true
57+
ebgp_multihop: 3
58+
send_community: all
59+
maximum_routes: 0
60+
neighbors:
61+
- ip_address: 192.168.255.112
62+
peer_group: EVPN-OVERLAY-PEERS
63+
remote_as: '65002'
64+
metadata:
65+
peer: evpn-prevent-readvertise-to-server-2
66+
description: evpn-prevent-readvertise-to-server-2_Loopback0
67+
- ip_address: 192.168.255.113
68+
peer_group: EVPN-OVERLAY-PEERS
69+
remote_as: '65003'
70+
metadata:
71+
peer: evpn-prevent-readvertise-to-server-3
72+
description: evpn-prevent-readvertise-to-server-3_Loopback0
73+
- ip_address: 192.168.255.115
74+
peer_group: EVPN-OVERLAY-PEERS
75+
remote_as: '65003'
76+
metadata:
77+
peer: evpn-prevent-readvertise-to-server-5
78+
description: evpn-prevent-readvertise-to-server-5_Loopback0
79+
redistribute:
80+
connected:
81+
enabled: true
82+
route_map: RM-CONN-2-BGP
83+
address_family_evpn:
84+
neighbors:
85+
- ip_address: 192.168.255.112
86+
rcf_out: RCF_EVPN_FILTER_AS( 65002 )
87+
- ip_address: 192.168.255.113
88+
rcf_out: RCF_EVPN_FILTER_AS( 65003 )
89+
- ip_address: 192.168.255.115
90+
rcf_out: RCF_EVPN_FILTER_AS( 65003 )
91+
peer_groups:
92+
- name: EVPN-OVERLAY-PEERS
93+
activate: true
94+
address_family_ipv4:
95+
peer_groups:
96+
- name: EVPN-OVERLAY-PEERS
97+
activate: false
98+
router_general:
99+
control_functions:
100+
code_units:
101+
- name: CU_EVPN_FILTER_AS
102+
content: "function RCF_EVPN_FILTER_AS( as_number_type $PEER_ASN ) {\n return as_path has_none { $PEER_ASN };\n}\nEOF"
103+
service_routing_protocols_model: multi-agent
104+
static_routes:
105+
- vrf: MGMT
106+
prefix: 0.0.0.0/0
107+
next_hop: 192.168.0.1
108+
transceiver_qsfp_default_mode_4x10: true
109+
vlan_internal_order:
110+
allocation: ascending
111+
range:
112+
beginning: 1006
113+
ending: 1199
114+
vrfs:
115+
- name: MGMT
116+
ip_routing: false
117+
vxlan_interface:
118+
vxlan1:
119+
description: evpn-prevent-readvertise-to-server-8_VTEP
120+
vxlan:
121+
source_interface: Loopback1
122+
udp_port: 4789

‎ansible_collections/arista/avd/extensions/molecule/eos_designs_unit_tests/inventory/group_vars/EVPN_PREVENT_READVERTISE_TO_SERVER.yml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -39,3 +39,8 @@ l3leaf:
3939
id: 108
4040
bgp_as: 65005
4141
evpn_route_servers: [evpn-prevent-readvertise-to-server-2, evpn-prevent-readvertise-to-server-3, evpn-prevent-readvertise-to-server-5]
42+
# Test filtering out EVPN routes using RCF feature
43+
- name: evpn-prevent-readvertise-to-server-8
44+
id: 110
45+
bgp_as: 65007
46+
evpn_route_servers: [evpn-prevent-readvertise-to-server-2, evpn-prevent-readvertise-to-server-3, evpn-prevent-readvertise-to-server-5]

‎ansible_collections/arista/avd/extensions/molecule/eos_designs_unit_tests/inventory/host_vars/evpn-prevent-readvertise-to-server-8.yml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
evpn_prevent_readvertise_to_server_mode: rcf

0 commit comments

Comments
 (0)