k.rennerandClaude Opus 4.7
e95dba9049
The single v4-transport multiprotocol session couldn't actually deliver v6 routes: Cilium 1.19 BGPv2 advertises extended-nexthop capability only for the IPv4 Unicast AFI/SAFI tuple, so v6 routes sent with the IPv4-mapped MpReach next-hop landed in the UDM's BGP RIB but never made it to the kernel FIB. The kernel can't resolve an IPv4-mapped v6 address as a v6 next-hop on a v6 interface, and there's no CRD field in Cilium 1.19 to fix the capability advertisement. Solution is structural: run two parallel sessions, one per family. fd40::/64 already has SLAAC addresses on every cluster node and a ULA fd40::1 on UDM's br40, so peering natively over v6 needs no new addressing — just a second peer entry on each side and an additional listen range on UDM. v6 routes flow with v6 next-hops, v4 routes flow with v4 next-hops, neither path depends on extended-nexthop. fd40::1 (ULA) is the v6 peer address rather than the GUA so the session survives ISP renumber events. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
64 lines
2.2 KiB
Plaintext
64 lines
2.2 KiB
Plaintext
! UDM FRR BGP config — peers with the k8s cluster (ASN 64513) over the
|
|
! management LAN, dual-stack: v6 sessions on fd40::/64 carry the IPv6
|
|
! Unicast SAFI, v4 sessions on 10.2.40.0/24 carry the IPv4 Unicast SAFI.
|
|
! Cluster side: kubernetes/infrastructure/post-crds/cilium-bgp.yaml.
|
|
!
|
|
! Upload procedure: UniFi UI → Settings → Routing → BGP → upload as
|
|
! `bgp.conf` (do NOT name it `frr.conf` — some versions reject that name).
|
|
! Verify with `vtysh -c "show ip bgp summary"` on the UDM CLI.
|
|
!
|
|
frr defaults traditional
|
|
hostname udm
|
|
log syslog informational
|
|
!
|
|
router bgp 64512
|
|
bgp router-id 10.2.40.1
|
|
bgp ebgp-requires-policy
|
|
bgp bestpath as-path multipath-relax
|
|
maximum-paths 4
|
|
!
|
|
neighbor K8S peer-group
|
|
neighbor K8S remote-as 64513
|
|
neighbor K8S timers 30 90
|
|
neighbor K8S timers connect 10
|
|
neighbor K8S advertisement-interval 1
|
|
neighbor K8S maximum-prefix 200
|
|
!
|
|
! Two parallel sessions per node, one per family. Cilium 1.19 doesn't
|
|
! advertise extended-nexthop for the IPv6 Unicast SAFI when v6 routes
|
|
! are carried over a v4 transport, so we run a native v6 session that
|
|
! carries v6 routes with v6 next-hops and skip the capability dance
|
|
! entirely. Dynamic neighbors — k8s nodes are SLAAC-addressed on mgmt
|
|
! LAN; the listen ranges cover the SLAAC suffix space.
|
|
bgp listen range 10.2.40.0/24 peer-group K8S
|
|
bgp listen range fd40::/64 peer-group K8S
|
|
!
|
|
address-family ipv4 unicast
|
|
neighbor K8S activate
|
|
neighbor K8S route-map K8S-IN in
|
|
neighbor K8S soft-reconfiguration inbound
|
|
exit-address-family
|
|
!
|
|
address-family ipv6 unicast
|
|
neighbor K8S activate
|
|
neighbor K8S route-map K8S-IN-V6 in
|
|
neighbor K8S soft-reconfiguration inbound
|
|
exit-address-family
|
|
!
|
|
! Prefix-lists MUST appear after the router bgp block — FRR on the UDM
|
|
! silently ignores them if they're declared earlier in the file.
|
|
ip prefix-list K8S-ALLOWED-V4 seq 10 permit 10.244.0.0/16 le 24
|
|
ip prefix-list K8S-ALLOWED-V4 seq 20 permit 10.2.99.0/24 le 32
|
|
!
|
|
ipv6 prefix-list K8S-ALLOWED-V6 seq 10 permit fd10:244::/56 le 64
|
|
ipv6 prefix-list K8S-ALLOWED-V6 seq 20 permit fd99::/64 le 128
|
|
!
|
|
route-map K8S-IN permit 10
|
|
match ip address prefix-list K8S-ALLOWED-V4
|
|
!
|
|
route-map K8S-IN-V6 permit 10
|
|
match ipv6 address prefix-list K8S-ALLOWED-V6
|
|
!
|
|
line vty
|
|
!
|