Table of Contents generated with DocToc

• ansible-frr
  • Build Status
    • GitHub Actions
    • Travis CI
  • Requirements
  • Role Variables
  • Dependencies
  • Example Playbook
  • Route Maps and Prefix Lists
    • Route Maps
      • Configuring Route Maps
    • General Options
      • IP/IPv6 Forwarding
    • Prefix Lists
      • Configuring Prefix Lists
    • Access Lists
      • Configuring Access Lists
  • Bidirectional Forwarding Detection
    • Enable BFD
    • Configuring BFD
  • Supported Routing Protocols
    • BGP
      • Enable BGP
      • Configuring BGP
      • Example BGP
    • OSPF
      • Enable OSPF
      • Configuring OSPF
        • VRF-aware OSPF
    • STATIC
      • Configuring STATIC routes
  • Interface Configuration
    • Interfaces
  • Upgrade/Downgrade
  • Quagga configuration
  • License
  • Author Information

ansible-frr

Ansible role to install/configure FRR

NOTE: FRRouting (FRR) is an IP routing protocol suite for Linux and Unix platforms which includes protocol daemons for BFD, BGP, IS-IS, LDP, OSPF, PIM, and RIP.

Build Status

GitHub Actions

Travis CI

Requirements

For any required Ansible roles, review: requirements.yml

Role Variables

defaults/main.yml

Dependencies

Example Playbook

playbook.yml

Route Maps and Prefix Lists

Route Maps

Configuring Route Maps

Below is an example of Route Maps Configuration:

frr_route_map:
  RTBH:
    permit 10:
      interface: blackhole
      prefix_list: Bad_IPs
      origin: igp
      community: "12345:100"
      src: 2001:db8::bf03
  RTBH_IN:
    deny 10: []

General Options

IP/IPv6 Forwarding

Below is an example of enabling ip and ipv6 forwading:

frr_ip_forwarding: true
frr_ipv6_forwarding: true

To enable kernel forwarding, the role sets the sysctl variables net.ipv4.ip_forward and net.ipv6.conf.all.forwarding. To customize the location of the sysctl configuration, the following variable may be used:

frr_sysctl_file: /etc/sysctl.d/100-ansible-frr.conf

Next-hop tracking via default

Resolve nexthops using the default route; useful if BGP peer is only reachable via default gateway (disabled by default).

To enable:

frr_nht_resolve_default: true

Prefix Lists

Configuring Prefix Lists

Below is an example of Prefix List Configuration:

frr_prefix_list:
  Bad_IPs:
    05 permit:
      prefix: 192.168.88.0/24
      match: ge 32
    10 permit:
      prefix: 172.16.0.0/16
      match: le 32
frr_prefix_list_v6:
  Bad_IPs:
    05 permit:
      prefix: 1234:5678::/32
      match: ge 128

Access Lists

Configuring Access Lists

Below is an example

frr_access_list:
  - "10 permit 10.10.10.21/32"
  - "10 permit 192.168.0.0/17"
  - "101 permit ip 10.0.0.0 0.0.0.255 any"

Bidirectional Forwarding Detection (BFD)

Enable BFD

To enable BFD, make sure that bfdd: true is configured under:

frr_daemons:
  bfdd: true
  bgpd: false
  isisd: false
  ldpd: false
  nhrpd: false
  ospf6d: false
  ospfd: false
  pimd: false
  ripd: false
  ripngd: false
  zebra: true

Configuring BFD

BFD configuration is made under BGP neighbor settings. BFD for OSPF is not supported yet.

Supported Routing Protocols

BGP

Enable BGP

To enable BGP routing, make sure that bgpd: true is configured under:

frr_daemons:
  bfdd: false
  bgpd: false
  isisd: false
  ldpd: false
  nhrpd: false
  ospf6d: false
  ospfd: false
  pimd: false
  ripd: false
  ripngd: false
  zebra: true

Configuring BGP

In order to configure BGP, define the following based on your requirements:

frr_bgp:
  asns:
    65000:
      log_neighbor_changes: true
      no_ebgp_requires_policy: true
      timers: '3 9'
      other:
        - "bgp bestpath as-path multipath-relax"
        - "no bgp network import-check"
      neighbors:
        group1:
          asn: 66000
          is_peer_group: true
          multihop: 255
        192.168.250.11:
          asn: 65000
          default_originate: false
          description: node1
          next_hop_self: true
          timers_connect: 5
          v6only: true
          bfd_peer: true
          bfd_peer_detect_multiplier: 3
          bfd_peer_receive_interval: 50
          bfd_peer_transmit_interval: 50
          bfd_peer_echo_interval: 50
          bfd_peer_passive_mode: true
          bfd_peer_minimum_ttl: 253
          other:
            - "capability dynamic"
        192.168.250.12:
          asn: 65000
          default_originate: false
          description: node2
          next_hop_self: true
          v4_route_reflector_client: true
          password: secret
          bfd_peer: true
          bfd_peer_transmit_interval: 2000
          bfd_peer_echo_mode: true
          other:
            - "prefix-list Bad_IPs in"
        192.168.250.12:
          peer_group: group1
          description: far_away
      listen_range:
        192.168.250.0/24: group1
      networks:
        - "{{ frr_router_id }}/32"
        - "{{ hostvars[inventory_hostname]['ansible_enp0s8']['ipv4']['address'] }}/24"
      redistribute:
        - bgp
        - connected
        - kernel
        - ospf
        - static
      redistribute_v6:
        - bgp
        - connected
        - kernel

Example BGP

Below is an example of a BGP configuration:

frr_bgp:
  asns:
    65000:
      log_neighbor_changes: true
      af_v4:
        - "maximum-paths 2"
      af_v6:
        - "maximum-paths 2"
      af_evpn:
        - "advertise-all-vni"
        - "rd {{ frr_router_id }}:1"
      neighbors:
        192.168.250.11:
          asn: 65000
          default_originate: false
          description: node1
          next_hop_self: true
          af_v4:
            - "soft-reconfiguration inbound"
        192.168.250.12:
          asn: 65000
          default_originate: false
          description: node2
          next_hop_self: true
        "::1":
          asn: 65000
          default_originate: false
          description: node1
          next_hop_self: true
          af_v6:
            - "activate"
            - "soft-reconfiguration inbound"
        172.16.250.10:
          asn: internal
          timers_connect: 5
          description: "L2VPN EVPN neighbor"
          af_evpn:
            - "activate"
          other:
            - "capability extended-nexthop"
      networks:
        - "{{ frr_router_id }}/32"
        - "{{ hostvars[inventory_hostname]['ansible_enp0s8']['ipv4']['address'] }}/24"
        - "{{ hostvars[inventory_hostname]['ansible_enp0s9']['ipv4']['address'] }}/24"
        - "{{ hostvars[inventory_hostname]['ansible_enp0s10']['ipv4']['address'] }}/24"
        - "{{ hostvars[inventory_hostname]['ansible_enp0s16']['ipv4']['address'] }}/24"
      networks_v6:
        - "1::3/64"

Below is an example of a BGP summary based on the above configuration:

BGP table version is 13, local router ID is 1.1.1.1
Status codes: s suppressed, d damped, h history, * valid, > best, = multipath,
              i internal, r RIB-failure, S Stale, R Removed
Origin codes: i - IGP, e - EGP, ? - incomplete

   Network          Next Hop            Metric LocPrf Weight Path
*> 1.1.1.1/32       0.0.0.0                  0         32768 i
*>i2.2.2.2/32       192.168.250.11           0    100      0 i
*>i3.3.3.3/32       192.168.250.12           0    100      0 i
*> 192.168.10.0     0.0.0.0                  0         32768 i
*>i192.168.11.0     192.168.250.11           0    100      0 i
*>i192.168.12.0     192.168.250.12           0    100      0 i
*> 192.168.20.0     0.0.0.0                  0         32768 i
*>i192.168.21.0     192.168.250.11           0    100      0 i
*>i192.168.22.0     192.168.250.12           0    100      0 i
*> 192.168.30.0     0.0.0.0                  0         32768 i
*>i192.168.31.0     192.168.250.11           0    100      0 i
*>i192.168.32.0     192.168.250.12           0    100      0 i
* i192.168.250.0    192.168.250.11           0    100      0 i
* i                 192.168.250.12           0    100      0 i
*>                  0.0.0.0                  0         32768 i

Displayed  13 routes and 15 total paths

OSPF

Enable OSPF

To enable OSPF routing, make sure that ospfd: true is configured under:

frr_daemons:
  bfdd: false
  bgpd: false
  isisd: false
  ldpd: false
  nhrpd: false
  ospf6d: false
  ospfd: false
  pimd: false
  ripd: false
  ripngd: false
  zebra: true

Configuring OSPF

In order to configure OSPF, define the following based on your requirements:

frr_ospf:
  areas:
    0:
      networks:
        - "{{ frr_router_id }}/32"
    1:
      networks:
        - "{{ hostvars[inventory_hostname]['ansible_enp0s8']['ipv4']['address'] }}/24"
      auth: true

    2:
      networks:
        - "{{ hostvars[inventory_hostname]['ansible_enp0s9']['ipv4']['address'] }}/24"
      type: nssa

  log_adjacency_changes: true
  passive_interfaces: # A list of interfaces to set passive
    - default
  redistribute: # A list of protocols to redistribute
    - bgp
    - connected
    - kernel
    - ospf
    - static
  distribute_list:
    - name: 10
      dir: out
      protocol: connected

VRF-aware OSPF

Each key under frr_ospf_vrf_enabled represents VRF name:

frr_ospf_vrf_enabled:
  public:
    redistribute:
    - bgp
    - connected
    passive_interfaces:
     - lo
    log_adjacency_changes: true
    areas:
      1:
        networks:
          - "{{ hostvars[inventory_hostname]['ansible_ens3']['ipv4']['address'] }}/30"
        auth: true
  mgmt:
    redistribute:
      - kernel
    areas:
      0:
        networks:
          - 172.16.0.0/12
      2:
        networks:
          - 192.168.0.0/16
        type: nssa

STATIC

Configuring STATIC routes

In order to configure static routes, define the following based on your requirements:

frr_static: # A dict. key = destination, value = nexthop
  10.0.0.0/8: 192.168.1.1
  1.1.1.1: 192.168.1.1
  1.1.1.2: blackhole
frr_static_v6: # A dict. key = destination, value = nexthop
  2001:0db8:85a3:8a2e::/64 2001::1

Interface Configuration

Interfaces

frr_interfaces: # A dict. key = iface name, value = iface data
  lo:
    ip: 10.0.0.0/32 # ip can be a single value or list
    ipv6: 2001:0db8:85a3:8a2e::1/64 # ipv6 can be a single value or list
    description: loopback
  eth0:
    ip: # ip can be a single value or list
      - 10.0.0.0/32
      - 172.16.0.0/32
    ipv6: # ipv6 can be a single value or list
      - 2001:0db8:85a3:8a2e::1/64
      - 2001:0db8:85a3:8a2e::2/64
    vrf: management # put interface in 'management' VRF
    auth:
      id: 1
      key: supersecret
    other:
      - "no ipv6 nd suppress-ra"
      - "link-detect"

NOTE: Device should have correct VRF assignment on each vrf-aware interface:

ip link set dev ${IFACE} master ${VRF}

Upgrade/Downgrade

NOTE: FRR is unable to be downgraded from 6.0.2 using this role.

You can upgrade or downgrade FRR by setting the following variable:

frr_version: 6.0.2 from frr_version: 6.0

Quagga configuration

NOTE: Quagga must be installed from the local repos of the OS

You can configure quagga instead of FRR by using the following variable:

routing_type: quagga

Additional Quagga-specific configurations

frr_bgp:
  asns:
    65000:
      neighbors:
        swp1:
          **interface: true**

License

MIT

Author Information

Larry Smith Jr.

• @mrlesmithjr
• [email protected]
• http://everythingshouldbevirtual.com

NOTE: Repo has been created/updated using https://github.com/mrlesmithjr/cookiecutter-ansible-role as a template.