FRR - ADD BFD feature on web interface #2050

LensHunnel · 2020-10-01T20:45:42Z

Is your feature request related to a problem? Please describe.
always frustrated when I configure the routing on Opnsense because I'm using bfd on my OSPF configuration and I can't start the bfdd process because on the template /usr/local/opnsense/service/templates/OPNsense/Quagga/frr it only configure ospf rip and BGP and not BFD.

Describe the solution you'd like
I would like two checkboxes fields:
the first one to activate bfd globally and
the second one in the ui/quagga/ospf/, in the interface configuration view, which would add ip ospf bfd in frr configuration under interface.

The text was updated successfully, but these errors were encountered:

mimugmail · 2020-10-02T03:58:29Z

Did you check If bfd is compatible on the FreeBSD Version of FRR? Most of it only works with linux

LensHunnel · 2020-10-02T06:53:51Z

Hi, thanks for your answer. I can activate BFD via the cli vtysh but all the BFD configuration is reset when the server reboot or the service frr reloaded because it's not configured via OPNSense.

mimugmail · 2020-10-02T07:26:19Z

Can you leave a füll sample Here so I can have a look

LensHunnel · 2020-10-02T08:43:34Z

In the file /etc/rc.conf.d/frr I have to add bfdd in variable frr_daemons :

frr_daemons="zebra ospfd bfdd bgpd"

And My frr cli configuration looks like:

Building configuration...

Current configuration:
!
frr version 7.4
frr defaults traditional
hostname XXXX
log file /var/log/frr.log informational
!
interface vtnet1
 ip ospf bfd # That is the line that disappear when I reboot.
 ip ospf authentication message-digest
 ip ospf dead-interval 3
 ip ospf hello-interval 1
 ip ospf message-digest-key 1 md5 liain-border
!
router bgp XXX
 bgp router-id X.X.X.X
 no bgp ebgp-requires-policy
 neighbor X.X.X.X remote-as XXX
 !
 address-family ipv4 unicast
  neighbor X.X.X.X next-hop-self
 exit-address-family
!
router ospf
 ospf router-id 192.168.199.241
 passive-interface lo2
 passive-interface vtnet0
 network 192.168.199.0/24 area 0.0.0.0
!
route-map RM_SET_SRC permit 10
!
line vty
!
bfd  # That is the other line that disappear when I reload.
!
end

mimugmail · 2020-10-02T11:34:40Z

And after this BFD really works? I mean, it eats the commands, but regarding FreeBSD and FRR this means nothing.

LensHunnel · 2020-10-03T17:04:45Z

Yes I can see BFD packets get out from my interface using tcpdump.

mimugmail · 2020-10-03T17:29:09Z

I had a look at the docs, they are using peer syntax in bfdd.conf, is there a reason why you not configuring it?

I will try to add a bfd submenu

LensHunnel · 2020-10-05T09:42:37Z

Firstly I can't use it because the BFD configuration that I use is in the file /usr/local/etc/frr/ospfd.conf generated by opnsense and Secondly the file /etc/rc.conf.d/frr where we can specify to frr to start BFD daemon is also generated by opnsense.

Thanks for your answers.

mimugmail · 2020-10-05T09:59:01Z

They only get overwritten when you hit save in the UI. You can setup everything from UI, then switch to CLI, edit rc.conf.d file and also add a bfdd.conf in etc folder and restart via service frr restart

LensHunnel · 2020-10-05T15:29:43Z

But it'll be overwritten after a reboot and each time after a save in the UI.

mimugmail · 2020-10-07T09:11:47Z

Indeed, the only thing I need from you is an "OK", I've tested it with just config files and CLI, it runs fine, peers are detected. (a show run and show bfd XXX would be nice)

I can't count the times I added a feature which in the end wasn't supported the way, the issuer thought it should work, dont take it as an offence.

LensHunnel · 2020-10-07T15:26:38Z

Oh no worries, I'm grateful that feature could be added. It's all fine to me if the configuration I pasted before can be configured in UI or at least not reset when I save in the UI

fprina · 2020-12-10T09:27:45Z

BFD would be great ... it should also speed up the convergence if used with the "Enable CARP Failover" option

mimugmail · 2020-12-10T10:10:46Z

When you follow the thread you'll see that this needs more testers before to get integrated.

fprina · 2020-12-10T12:06:29Z

Oh I see, I misunderstood you previous post.

IMHO it works fine; I've added bfdd as daemon and ip ospf bfd to the interface via vtysh.
If I stop the FFR service on the firewall the device immediately disappear from the neighbor list of the device on the other side (at the moment a VyOS)

opnsense# show bfd peer 10.1.92.101
BFD Peer:
        peer 10.1.92.101 vrf default interface vtnet0
                ID: 4136871459
                Remote ID: 1140280080
                Status: up
                Uptime: 1 minute(s), 24 second(s)
                Diagnostics: ok
                Remote diagnostics: ok
                Peer Type: dynamic
                Local timers:
                        Detect-multiplier: 3
                        Receive interval: 300ms
                        Transmission interval: 300ms
                        Echo transmission interval: 50ms
                Remote timers:
                        Detect-multiplier: 3
                        Receive interval: 300ms
                        Transmission interval: 300ms
                        Echo transmission interval: 50ms

vyos# show bfd peer 10.1.92.11
BFD Peer:
        peer 10.1.92.11 vrf default interface eth0.2009
                ID: 1140280080
                Remote ID: 4136871459
                Status: up
                Uptime: 1 minute(s), 58 second(s)
                Diagnostics: ok
                Remote diagnostics: ok
                Peer Type: dynamic
                Local timers:
                        Detect-multiplier: 3
                        Receive interval: 300ms
                        Transmission interval: 300ms
                        Echo transmission interval: 50ms
                Remote timers:
                        Detect-multiplier: 3
                        Receive interval: 300ms
                        Transmission interval: 300ms
                        Echo transmission interval: 50ms

mimugmail · 2020-12-10T12:09:56Z

Can you do a write in vtysh and post the contents of bfdd.conf, please?

fprina · 2020-12-10T12:20:15Z

if I add the BFD only under the interface the file is:

!
! Zebra configuration saved from vty
!   2020/12/10 13:14:30
!
frr version 7.4
frr defaults traditional
!
hostname opnsense
!
!
!
line vty
!
!

if I add it in the main configuration

!
! Zebra configuration saved from vty
!   2020/12/10 13:16:58
!
frr version 7.4
frr defaults traditional
!
hostname opnsense
!
!
!
line vty
!
!
bfd
!

fprina · 2020-12-10T12:29:58Z

The vtysh commands was

1st case:

configure						
interface vtnet0
 ip ospf bfd
!

2nd case:

configure						
bfd
exit

PS: In my operational tests I used only the interface config as with the vyos I use just this one

mimugmail · 2020-12-10T12:32:19Z

@fprina ok thx, and can you also check this: #2050 (comment)

fprina · 2020-12-10T13:29:35Z

vtysh

configure
bfd
peer 10.1.92.101
exit
exit

bfdd.conf

!
! Zebra configuration saved from vty
!   2020/12/10 14:12:10
!
frr version 7.4
frr defaults traditional
!
hostname opnsense
!
!
!
line vty
!
!
bfd
 peer 10.1.92.101
 !
!

After a quick test it have the same behaviour of ip ospf bfd in the interface section

BFD Peer:
        peer 10.1.92.101 vrf default
                ID: 557545475
                Remote ID: 2851476737
                Status: up
                Uptime: 2 minute(s), 15 second(s)
                Diagnostics: ok
                Remote diagnostics: ok
                Peer Type: configured
                Local timers:
                        Detect-multiplier: 3
                        Receive interval: 300ms
                        Transmission interval: 300ms
                        Echo transmission interval: 50ms
                Remote timers:
                        Detect-multiplier: 3
                        Receive interval: 300ms
                        Transmission interval: 300ms
                        Echo transmission interval: 50ms

LensHunnel · 2020-12-15T10:39:36Z

When you follow the thread you'll see that this needs more testers before to get integrated.

What do you mean by this needs more testers before to get integrated ? Should I show you more tests results and configurations ?

mimugmail · 2020-12-15T10:51:23Z

When you follow the thread you'll see that this needs more testers before to get integrated.

What do you mean by this needs more testers before to get integrated ? Should I show you more tests results and configurations ?

Not anymore, initially I needed a confirmation of #2050 (comment) cause it changes they way to introduce it. The first test would be a checkbox in OSPF, the second one is a new submenu where you configure peers outside of the protocol (which is more generic)

LensHunnel · 2020-12-15T11:02:01Z

Thanks for quick response. Since it is the same behavior, the second seems to me indeed more suitable.

fprina · 2021-03-04T15:39:03Z

hai @mimugmail
do you need further test ?

MarkStitson · 2021-04-07T20:13:33Z

I am just setting up an opnsense router in a BGP environement and want to use BFD as well. The other routers in my test lab use BFD, so I am happy to help testing this.

mimugmail · 2021-04-10T16:55:23Z

Sorry for the delay guys, I added a PR for BFD

mimugmail · 2021-04-27T14:26:25Z

@MarkStitson @fprina @LensHunnel can anyone of you guys test the new devel package and check if it works for you?

fprina · 2021-04-27T14:40:30Z

Which is the right command to use to patch the code ?

MarkStitson · 2021-04-28T08:47:36Z

Being new to OpnSense, it took me a few attempts to get the update, but basically I switched to Development in System->Firmware->Settings->Type, then ran an update rebooted and ran an update again.
If you check in System->Firmware->Plugins, you should see version 1.22 of the os-frr-devel plugin which has the change.

It seems to do the right thing for me and bfd is running:
`root@OPNsense:/usr/local/opnsense/mvc/app # vtysh

OPNsense.local.xxx.com# show bfd peers brief
Session count: 1
SessionId LocalAddress PeerAddress Status
========= ============ =========== ======
2815985383 192.168.11.92 192.168.11.1 up
OPNsense.local.xxx.com# show bfd peers
BFD Peers:
peer 192.168.11.1 vrf default
ID: 2815985383
Remote ID: 1673250282
Status: up
Uptime: 20 minute(s), 20 second(s)
Diagnostics: ok
Remote diagnostics: ok
Peer Type: configured
Local timers:
Detect-multiplier: 3
Receive interval: 300ms
Transmission interval: 300ms
Echo transmission interval: 50ms
Remote timers:
Detect-multiplier: 5
Receive interval: 10ms
Transmission interval: 100ms
Echo transmission interval: 0ms

OPNsense.local.xxx.com#
`

A useful addition would be to add BFD to the diagnostics under Routing->Diagnostics->BFD with 2 tabs like BGP:

Neighbours displaying show bfd peers
Summary displaying show bfd peers

Should I raise a separate feature request for that?

MarkStitson · 2021-04-28T09:05:16Z

Oops. I spoke too soon.

I can't enabled BFD in Routing->BGP-Neighbors when adding a peer to create the line: neighbor 192.168.11.1 bfd in the config file bgpd.conf in a router section, eg.

router bgp 65509
no bgp ebgp-requires-policy
bgp router-id 192.168.252.25
neighbor 192.168.11.1 remote-as 65501
neighbor 192.168.11.1 bfd
neighbor 192.168.11.1 update-source bce0
address-family ipv4 unicast
network Null
redistribute connected
neighbor 192.168.11.1 prefix-list Upstream in
neighbor 192.168.11.1 prefix-list Remote out
exit-address-family
!

mimugmail · 2021-04-28T09:15:48Z

@MarkStitson Do you really need this line in bgp when you already have a peer in BFD.
My thoughts were this should be enough, also confirmed by @fprina (regarding OSPF).

By the way you don't need to switch to Development branch, you can also just install via CLI:
pkg install os-frr-devel

MarkStitson · 2021-04-28T09:31:33Z

Thanks for the hint how to install the package.

With regard to if the line is required in the BGP section, the BGP daemon needs to be told which peer uses BFD and which peer does not use BFD, the FRR docs also say that http://docs.frrouting.org/en/latest/bfd.html

BFD is a helper for the actual routing protocol, alone it doesn't do anything useful. It needs to be linked to an actual routing protocol and tells the routing protocol if a peer with BGP (or interface with OSPF) is up or down.

If I configure with the extra line, then the vtysh show ip bgp neighbors command shows 3 additional lines:

BFD: Type: single hop
Detect Multiplier: 3, Min Rx interval: 300, Min Tx interval: 300
Status: Up, Last update: 0:00:01:01

If I don't have the extra line the BFD status is missing from BGP, to enable it we need a tickbox in the BGP Neigbour config.

I believe you have to do something similar for OSPF, but there it is per interface, not per peer, see above

mimugmail · 2021-04-28T10:59:55Z

So this means you only need a checkpoint in neighbor grid to enable/disable BFD correct?

MarkStitson · 2021-04-28T13:04:06Z

Correct, there has to be a checkpoint in the BGP Neighbour and the OSPF Interface so BFD can be enabled or disabled for each neighbout/interface.

There should probably also be a checkbox in the BFD Neighbour settings, so you can enable multihop per neighbour, but I don't use that and I am not sure how to test it. This would generate peer A.B.C.D multihop instead of peer A.B.C.D in the bfd config. If you do want to put it in, I'll try to create a test setup for it.

mimugmail · 2021-04-28T15:58:51Z

I try to add it tomorrow

MarkStitson · 2021-04-28T16:03:35Z

That's great. I would offer to help more, but I'm not that familiar with the OpenSense system yet.

mimugmail · 2021-04-28T19:19:37Z

@MarkStitson no worries .. these were the required changes for adding the checkbox:
https://github.com/opnsense/plugins/pull/2364/files

MarkStitson · 2021-05-21T16:17:59Z

I've now checked the change and it works as expected.

I've also created the missing diagnostics and made a pull request for that: #2399

I've got the code for the OSPF setup for BFD here as well, but I need someone who can test this for me.

mimugmail · 2021-05-21T17:21:45Z

Thx 😍

jberkleef · 2023-06-20T18:42:32Z

Hi @MarkStitson,

Sorry to reopen such an old issue, but I'm in a situation where I want to use BFD over OSPF. Would you still be willing to contribute the code if I run the tests for you?

MarkStitson · 2023-06-20T20:29:11Z

As far as I recall I added the code for BGP and OSPF. I just couldn't test it. The thing that I never finished was the diagnostics. Happy to get back onto that and test with you. I won't have time to look at it until next week though. Mark Sent from Outlook for Android<https://aka.ms/AAb9ysg>

…

________________________________ From: Jeremy Berkleef ***@***.***> Sent: Tuesday, June 20, 2023 7:42:43 PM To: opnsense/plugins ***@***.***> Cc: Mark Stitson ***@***.***>; Mention ***@***.***> Subject: Re: [opnsense/plugins] FRR - ADD BFD feature on web interface (#2050) Hi @MarkStitson<https://github.com/MarkStitson>, Sorry to reopen such an old issue, but I'm in a situation where I want to use BFD over OSPF. Would you still be willing to contribute the code if I run the tests for you? — Reply to this email directly, view it on GitHub<#2050 (comment)>, or unsubscribe<https://github.com/notifications/unsubscribe-auth/AGFP3ILJJOVGEQ7CBSIVOWDXMHVKHANCNFSM4SA5JZ7Q>. You are receiving this because you were mentioned.Message ID: ***@***.***>

jberkleef · 2023-06-21T06:57:16Z

Hi Mark,

Thanks for getting back to this. As far as I can tell, there's no UI to enable BFD for my OSPF interfaces.
Take all the time you need, I'll be ready when you are.

MarkStitson · 2023-06-21T09:59:08Z

If you are confident in trying it out on your box, here is my branch commit for BFD on OSPF:

af6e9f4

jberkleef · 2023-06-21T12:17:46Z

Hi Mark,

I've just deployed the patch to 2 live boxes, seems to be working fine.

The packets seem to be being sent out and received over the wireguard tunnels I've set up.
These are 3 firewalls (2 opnsense, 1 pfsense) connected in a full mesh, BFD seems to remove the OSPF routes from the database properly.

One thing I ran into is that if BFD peers are configured and enabled, but the BFD checkbox is not checked on the OSPF interface, the routes never get accepted into the OSPF table by the other end, therefore locking me out. I assume this is just a quirk of FRR and not something related to this plugin.

jberkleef · 2023-06-21T12:26:05Z

I've also found a small issue.

I believe this line should read "ip ospf bfd" instead.

mimugmail mentioned this issue Apr 10, 2021

net/frr: Add BFD support #2326

Merged

fichtner closed this as completed in #2326 Apr 12, 2021

fichtner assigned mimugmail Apr 12, 2021

fichtner added the feature Adding new functionality label Apr 12, 2021

mimugmail mentioned this issue Apr 28, 2021

net/frr: finalize BFD for BGP #2364

Merged

MarkStitson mentioned this issue May 21, 2021

net/frr: Adding diagnostics for BFD #2399

Closed

MarkStitson mentioned this issue Jun 29, 2023

BFD for OSPF #3488

Merged

KellenRenshaw mentioned this issue Oct 6, 2024

[os-frr] Add multihop support to BFD web interface #4282

Open

FRR - ADD BFD feature on web interface #2050

FRR - ADD BFD feature on web interface #2050

Comments

LensHunnel commented Oct 1, 2020

mimugmail commented Oct 2, 2020

LensHunnel commented Oct 2, 2020

mimugmail commented Oct 2, 2020

LensHunnel commented Oct 2, 2020

mimugmail commented Oct 2, 2020

LensHunnel commented Oct 3, 2020

mimugmail commented Oct 3, 2020

LensHunnel commented Oct 5, 2020

mimugmail commented Oct 5, 2020

LensHunnel commented Oct 5, 2020

mimugmail commented Oct 7, 2020

LensHunnel commented Oct 7, 2020

fprina commented Dec 10, 2020

mimugmail commented Dec 10, 2020

fprina commented Dec 10, 2020

mimugmail commented Dec 10, 2020

fprina commented Dec 10, 2020

fprina commented Dec 10, 2020

mimugmail commented Dec 10, 2020

fprina commented Dec 10, 2020

LensHunnel commented Dec 15, 2020

mimugmail commented Dec 15, 2020

LensHunnel commented Dec 15, 2020

fprina commented Mar 4, 2021

MarkStitson commented Apr 7, 2021

mimugmail commented Apr 10, 2021

mimugmail commented Apr 27, 2021

fprina commented Apr 27, 2021

MarkStitson commented Apr 28, 2021

MarkStitson commented Apr 28, 2021

mimugmail commented Apr 28, 2021

MarkStitson commented Apr 28, 2021

mimugmail commented Apr 28, 2021

MarkStitson commented Apr 28, 2021

mimugmail commented Apr 28, 2021

MarkStitson commented Apr 28, 2021

mimugmail commented Apr 28, 2021

MarkStitson commented May 21, 2021

mimugmail commented May 21, 2021

jberkleef commented Jun 20, 2023

MarkStitson commented Jun 20, 2023 via email

jberkleef commented Jun 21, 2023

MarkStitson commented Jun 21, 2023

jberkleef commented Jun 21, 2023

jberkleef commented Jun 21, 2023