[pve-devel] [PATCH] controllers: bgp: enable multihop on the underlay

[pve-devel] [PATCH] controllers: bgp: enable multihop on the underlay

[Alexandre Bruyelles]

From: Alexandre Bruyelles <git@jack.fr.eu.org>

Multihop is required when the bgpd are running across
a pair of MLAG routers.
In such scenario, TCP trafic from Proxmox to router A
may pass through router B, which will decrease the TTL.

Signed-off-by: Alexandre Bruyelles <git@jack.fr.eu.org>
---
 PVE/Network/SDN/Controllers/BgpPlugin.pm | 1 +
 1 file changed, 1 insertion(+)

diff --git a/PVE/Network/SDN/Controllers/BgpPlugin.pm b/PVE/Network/SDN/Controllers/BgpPlugin.pm
index e5d8490..69436a0 100644
--- a/PVE/Network/SDN/Controllers/BgpPlugin.pm
+++ b/PVE/Network/SDN/Controllers/BgpPlugin.pm
@@ -85,6 +85,7 @@ sub generate_controller_config {
 	push @controller_config, "neighbor BGP peer-group";
 	push @controller_config, "neighbor BGP remote-as $remoteas";
 	push @controller_config, "neighbor BGP bfd";
+	push @controller_config, "neighbor BGP ebgp-multihop 3";
     }
 
     # BGP peers
-- 
2.31.0

Re: [pve-devel] [PATCH] controllers: bgp: enable multihop on the underlay

[alexandre derumier]

Hi,

any impact to enable it by default ?

if user have only 1 peer for example ?

maybe is is better to only enable it if we have more than 1 peer in the 
group ?

and check that we use ebgp.

something like:

push @controller_config, "neighbor BGP ebgp-multihop 3" if $ebgp && scalar @peers > 1;


On 09/04/2021 14:21, Alexandre Bruyelles wrote:
> From: Alexandre Bruyelles <git@jack.fr.eu.org>
>
> Multihop is required when the bgpd are running across
> a pair of MLAG routers.
> In such scenario, TCP trafic from Proxmox to router A
> may pass through router B, which will decrease the TTL.
>
> Signed-off-by: Alexandre Bruyelles <git@jack.fr.eu.org>
> ---
>   PVE/Network/SDN/Controllers/BgpPlugin.pm | 1 +
>   1 file changed, 1 insertion(+)
>
> diff --git a/PVE/Network/SDN/Controllers/BgpPlugin.pm b/PVE/Network/SDN/Controllers/BgpPlugin.pm
> index e5d8490..69436a0 100644
> --- a/PVE/Network/SDN/Controllers/BgpPlugin.pm
> +++ b/PVE/Network/SDN/Controllers/BgpPlugin.pm
> @@ -85,6 +85,7 @@ sub generate_controller_config {
>   	push @controller_config, "neighbor BGP peer-group";
>   	push @controller_config, "neighbor BGP remote-as $remoteas";
>   	push @controller_config, "neighbor BGP bfd";
> +	push @controller_config, "neighbor BGP ebgp-multihop 3";
>       }
>   
>       # BGP peers

Re: [pve-devel] [PATCH] controllers: bgp: enable multihop on the underlay

[px]

Hello,

In Proxmox setup, there is no known serious issue

In contrary to "ttl security" (aka GTSM), multihop is not a security feature

I don't think there is a drawback to the proposed patch
However, disabling multihop when there is only one peer should also 
works, so your proposal shall work as well

As you wish :)

Best regards,

On 4/9/21 3:50 PM, alexandre derumier wrote:
> Hi,
> 
> any impact to enable it by default ?
> 
> if user have only 1 peer for example ?
> 
> maybe is is better to only enable it if we have more than 1 peer in the 
> group ?
> 
> and check that we use ebgp.
> 
> something like:
> 
> push @controller_config, "neighbor BGP ebgp-multihop 3" if $ebgp && 
> scalar @peers > 1;
> 
> 
> On 09/04/2021 14:21, Alexandre Bruyelles wrote:
>> From: Alexandre Bruyelles <git@jack.fr.eu.org>
>>
>> Multihop is required when the bgpd are running across
>> a pair of MLAG routers.
>> In such scenario, TCP trafic from Proxmox to router A
>> may pass through router B, which will decrease the TTL.
>>
>> Signed-off-by: Alexandre Bruyelles <git@jack.fr.eu.org>
>> ---
>>   PVE/Network/SDN/Controllers/BgpPlugin.pm | 1 +
>>   1 file changed, 1 insertion(+)
>>
>> diff --git a/PVE/Network/SDN/Controllers/BgpPlugin.pm 
>> b/PVE/Network/SDN/Controllers/BgpPlugin.pm
>> index e5d8490..69436a0 100644
>> --- a/PVE/Network/SDN/Controllers/BgpPlugin.pm
>> +++ b/PVE/Network/SDN/Controllers/BgpPlugin.pm
>> @@ -85,6 +85,7 @@ sub generate_controller_config {
>>       push @controller_config, "neighbor BGP peer-group";
>>       push @controller_config, "neighbor BGP remote-as $remoteas";
>>       push @controller_config, "neighbor BGP bfd";
>> +    push @controller_config, "neighbor BGP ebgp-multihop 3";
>>       }
>>       # BGP peers

Re: [pve-devel] [PATCH] controllers: bgp: enable multihop on the underlay

[alexandre derumier]

I just send a patch with an explicit option to add ebgp-multihop, as

it's a tunable value, and maybe users could have differents setup with 
more hops.


On 09/04/2021 17:40, px@jack.fr.eu.org wrote:
> Hello,
>
> In Proxmox setup, there is no known serious issue
>
> In contrary to "ttl security" (aka GTSM), multihop is not a security 
> feature
>
> I don't think there is a drawback to the proposed patch
> However, disabling multihop when there is only one peer should also 
> works, so your proposal shall work as well
>
> As you wish :)
>
> Best regards,
>
> On 4/9/21 3:50 PM, alexandre derumier wrote:
>> Hi,
>>
>> any impact to enable it by default ?
>>
>> if user have only 1 peer for example ?
>>
>> maybe is is better to only enable it if we have more than 1 peer in 
>> the group ?
>>
>> and check that we use ebgp.
>>
>> something like:
>>
>> push @controller_config, "neighbor BGP ebgp-multihop 3" if $ebgp && 
>> scalar @peers > 1;
>>
>>
>> On 09/04/2021 14:21, Alexandre Bruyelles wrote:
>>> From: Alexandre Bruyelles <git@jack.fr.eu.org>
>>>
>>> Multihop is required when the bgpd are running across
>>> a pair of MLAG routers.
>>> In such scenario, TCP trafic from Proxmox to router A
>>> may pass through router B, which will decrease the TTL.
>>>
>>> Signed-off-by: Alexandre Bruyelles <git@jack.fr.eu.org>
>>> ---
>>>   PVE/Network/SDN/Controllers/BgpPlugin.pm | 1 +
>>>   1 file changed, 1 insertion(+)
>>>
>>> diff --git a/PVE/Network/SDN/Controllers/BgpPlugin.pm 
>>> b/PVE/Network/SDN/Controllers/BgpPlugin.pm
>>> index e5d8490..69436a0 100644
>>> --- a/PVE/Network/SDN/Controllers/BgpPlugin.pm
>>> +++ b/PVE/Network/SDN/Controllers/BgpPlugin.pm
>>> @@ -85,6 +85,7 @@ sub generate_controller_config {
>>>       push @controller_config, "neighbor BGP peer-group";
>>>       push @controller_config, "neighbor BGP remote-as $remoteas";
>>>       push @controller_config, "neighbor BGP bfd";
>>> +    push @controller_config, "neighbor BGP ebgp-multihop 3";
>>>       }
>>>       # BGP peers
>