Re: [f-nsp] Netiron AS4 capabilities
Bogdan-Stefan Rotariu <[email protected]> Thu, 29 Jun 2023 15:37:03 +0300
| Newsgroups | gmane.network.nsp.foundry |
|---|---|
| Message-ID | <[email protected]> |
--===============2079643690834968034== Content-Type: multipart/alternative; boundary="Apple-Mail=_E61580DD-D120-4C3A-A92E-0CF1E6047719" --Apple-Mail=_E61580DD-D120-4C3A-A92E-0CF1E6047719 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 Thank you J=C3=B6rg for the quick update. Yes, I had a few messages with Mikrotik regarding this issue, and they = keep saying that the devices are old, and almost I agree with them = because I cannot duplicate the issue using Quagga/FRR/Bird and Cisco = IOS/XR BGP. That is why I am asking the experts. Mikrotik said this in their last reply: "As it was mentioned before, RouterOS sends ASes encoded in 4bytes even = if ASN fit in 2bytes because RFC states " " A BGP speaker that advertises such a capability to a particular peer, = and receives from that peer the advertisement of such a capability, MUST = encode AS numbers as four-octet entities in both the AS_PATH attribute = and the AGGREGATOR attribute in the updates it sends to the peer and = MUST assume that these attributes in the updates received from the peer = encode AS numbers as four-octet entities. " " =20 No matter you like it or not, that old software on remote peers are not = RFC compliant, there were other customers who complained about the same = problem, upgrade of this old software fixes the problem. =20 We will not make hacks just to support software from 2007 that are not = current RFC compliant." > On 29 Jun 2023, at 15:31, J=C3=B6rg Kost <[email protected]> wrote: >=20 > Hello Bogdan, >=20 > According to https://www.rfc-editor.org/rfc/rfc4271.html, >=20 > "the AGGREGATOR is an attribute of length 6", not 8. >=20 > According to https://www.rfc-editor.org/rfc/rfc6793.html, >=20 > "the AS4_AGGREGATOR attribute in an UPDATE message SHALL be considered = malformed if the attribute length is not 8". >=20 > I think it looks like a bug in the Mikrotik BGP code that tries to = encode AS4 in an AS attribute. >=20 > BR > J=C3=B6rg >=20 >=20 > On 29 Jun 2023, at 13:44, Bogdan-Stefan Rotariu wrote: >=20 >> Hi there, >>=20 >> We have some CER2024 in our network, and we are starting to encounter = issues when receiving prefixes from Mikrotik CCR2216 that is running = with ROSv7. Has anyone any ideea except replacing the CER=E2=80=99s? >>=20 >> The peer is has AS4 capability negociated: >>=20 >> Neighbor AS4 Capability Negotiation: >> Peer Negotiated AS4 capability >> Peer configured for AS4 capability >>=20 >> We are running version 6.3.0.fT183: >>=20 >> IronWare : Version 6.3.0fT183 Copyright (c) 2017-2019 Extreme = Networks, Inc. >> Compiled on Jul 14 2022 at 21:38:40 labeled as ce06300f >> (18589108 bytes) from Primary >>=20 >> last-packet-with-error decode shows : >>=20 >> Received Message Length: 94 >> BGP Message: >> 0xffffffff 0xffffffff 0xffffffff 0xffffffff 0x005e0200 >> 0x00004340 0x01010050 0x02001602 0x05000022 0x04000015 >> 0xe60000ad 0x820000ad 0x820000ad 0x82400304 0x0a0b010f >> 0x40050400 0x00006440 0x0600d008 0x00042204 0x0064d007 >> 0x00080000 0xad825509 0x1f8617c3 0xd204 >>=20 >> BGP Header >> Marker: 0xffffffff 0xffffffff 0xffffffff 0xffffffff >> Message Length: (0x005e) 94 >> Message Type: (0x02) UPDATE >>=20 >> UPDATE Message >> Unfeasible route length: (0x0000) 0 >> Update path attributes >> Total Path Attribute length: (0x0043) 67 >> Flags : (0x40) Well Known, Transitive, Complete >> Type : (0x01) Origin >> Length: (0x01) 1 >> Origin: (0x00) IGP >>=20 >> Flags : (0x50) Well Known, Transitive, Complete, Extended length >> Type : (0x02) AS Path >> Length: (0x0016) 22 >> Segment Type : (0x02) AS Sequence >> Segment Length: (0x05) 5 >> AS Numbers : (0x0000) 0, (0x2204) 8708, (0x0000) 0, (0x15e6) = 5606, (0x0000) 0, >> Segment Type : (0xad) Unknown(173) >> Segment Length: (0x82) 130 >> AS Numbers : (0x0000) 0, (0xad82) 44418, (0x0000) 0, (0xad82) = 44418, >>=20 >> Flags : (0x40) Well Known, Transitive, Complete >> Type : (0x03) Next Hop >> Length: (0x04) 4 >> Next Hop IP address: (0x0a0b010f) 10.11.1.15 >>=20 >> Flags : (0x40) Well Known, Transitive, Complete >> Type : (0x05) Local Preference >> Length: (0x04) 4 >> Local Preference: (0x00000064) 100 >>=20 >> Flags : (0x40) Well Known, Transitive, Complete >> Type : (0x06) Atomic Aggregate >> Length: (0x00) 0 >>=20 >> Flags : (0xd0) Optional, Transitive, Complete, Extended length >> Type : (0x08) Community >> Length: (0x0004) 4 >> Community List: (0x22040064) 8708:100 >>=20 >> Flags : (0xd0) Optional, Transitive, Complete, Extended length >> Type : (0x07) Aggregator >> Length: (0x0008) 8 >> Error: Invalid AGGREGATOR attribute length 8 >> _______________________________________________ >> foundry-nsp mailing list >> [email protected] >> http://puck.nether.net/mailman/listinfo/foundry-nsp --Apple-Mail=_E61580DD-D120-4C3A-A92E-0CF1E6047719 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 <html><head><meta http-equiv=3D"content-type" content=3D"text/html; = charset=3Dutf-8"></head><body style=3D"overflow-wrap: break-word; = -webkit-nbsp-mode: space; line-break: after-white-space;">Thank you = J=C3=B6rg for the quick update.<div><br></div><div>Yes, I had a few = messages with Mikrotik regarding this issue, and they keep saying that = the devices are old, and almost I agree with them because I cannot = duplicate the issue using Quagga/FRR/Bird and Cisco IOS/XR BGP. That is = why I am asking the experts.<div><br></div><div>Mikrotik said this in = their last reply:</div><div><br></div><div>"<span style=3D"caret-color: = rgb(23, 43, 77); color: rgb(23, 43, 77); font-family: -apple-system, = BlinkMacSystemFont, "Segoe UI", Roboto, Oxygen, Ubuntu, = "Fira Sans", "Droid Sans", "Helvetica = Neue", sans-serif; font-size: 14px;">As it was mentioned before, = RouterOS sends ASes encoded in 4bytes even if ASN fit in 2bytes because = RFC states</span></div><p style=3D"caret-color: rgb(23, 43, 77); color: = rgb(23, 43, 77); font-family: -apple-system, BlinkMacSystemFont, = "Segoe UI", Roboto, Oxygen, Ubuntu, "Fira Sans", = "Droid Sans", "Helvetica Neue", sans-serif; = font-size: 14px;">"</p><p style=3D"caret-color: rgb(23, 43, 77); color: = rgb(23, 43, 77); font-family: -apple-system, BlinkMacSystemFont, = "Segoe UI", Roboto, Oxygen, Ubuntu, "Fira Sans", = "Droid Sans", "Helvetica Neue", sans-serif; = font-size: 14px;">" A BGP speaker that advertises such a capability to a = particular peer, and receives from that peer the advertisement of such a = capability, MUST encode AS numbers as four-octet entities in both the = AS_PATH attribute and the AGGREGATOR attribute in the updates it sends = to the peer and MUST assume that these attributes in the updates = received from the peer encode AS numbers as four-octet entities. "</p><p = style=3D"caret-color: rgb(23, 43, 77); color: rgb(23, 43, 77); = font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", = Roboto, Oxygen, Ubuntu, "Fira Sans", "Droid Sans", = "Helvetica Neue", sans-serif; font-size: 14px;">"</p><p = style=3D"caret-color: rgb(23, 43, 77); color: rgb(23, 43, 77); = font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", = Roboto, Oxygen, Ubuntu, "Fira Sans", "Droid Sans", = "Helvetica Neue", sans-serif; font-size: 14px;"> </p><p = style=3D"caret-color: rgb(23, 43, 77); color: rgb(23, 43, 77); = font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", = Roboto, Oxygen, Ubuntu, "Fira Sans", "Droid Sans", = "Helvetica Neue", sans-serif; font-size: 14px;">No matter you = like it or not, that old software on remote peers are not RFC compliant, = there were other customers who complained about the same problem, = upgrade of this old software fixes the problem.</p><p = style=3D"caret-color: rgb(23, 43, 77); color: rgb(23, 43, 77); = font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", = Roboto, Oxygen, Ubuntu, "Fira Sans", "Droid Sans", = "Helvetica Neue", sans-serif; font-size: 14px;"> </p><p = style=3D"caret-color: rgb(23, 43, 77); color: rgb(23, 43, 77); = font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", = Roboto, Oxygen, Ubuntu, "Fira Sans", "Droid Sans", = "Helvetica Neue", sans-serif; font-size: 14px;"> We will = not make hacks just to support software from 2007 that are not current = RFC compliant."<br></p><div><br></div><div><br><div><br><blockquote = type=3D"cite"><div>On 29 Jun 2023, at 15:31, J=C3=B6rg Kost = <[email protected]> wrote:</div><br = class=3D"Apple-interchange-newline"><div><div>Hello = Bogdan,<br><br>According to = https://www.rfc-editor.org/rfc/rfc4271.html,<br><br>"the AGGREGATOR is = an attribute of length 6", not 8.<br><br>According to = https://www.rfc-editor.org/rfc/rfc6793.html,<br><br>"the AS4_AGGREGATOR = attribute in an UPDATE message SHALL be considered malformed if the = attribute length is not 8".<br><br>I think it looks like a bug in the = Mikrotik BGP code that tries to encode AS4 in an AS = attribute.<br><br>BR<br>J=C3=B6rg<br><br><br>On 29 Jun 2023, at 13:44, = Bogdan-Stefan Rotariu wrote:<br><br><blockquote type=3D"cite">Hi = there,<br><br>We have some CER2024 in our network, and we are starting = to encounter issues when receiving prefixes from Mikrotik CCR2216 that = is running with ROSv7. Has anyone any ideea except replacing the = CER=E2=80=99s?<br><br>The peer is has AS4 capability negociated:<br><br> = Neighbor AS4 Capability Negotiation:<br> = Peer Negotiated AS4 capability<br> = Peer configured for AS4 = capability<br><br>We are running version = 6.3.0.fT183:<br><br>IronWare : Version 6.3.0fT183 Copyright (c) = 2017-2019 Extreme Networks, Inc.<br>Compiled on Jul 14 2022 at 21:38:40 = labeled as ce06300f<br>(18589108 bytes) from = Primary<br><br>last-packet-with-error decode shows :<br><br>Received = Message Length: 94<br>BGP Message:<br> 0xffffffff 0xffffffff = 0xffffffff 0xffffffff 0x005e0200<br> 0x00004340 = 0x01010050 0x02001602 0x05000022 0x04000015<br> = 0xe60000ad 0x820000ad 0x820000ad 0x82400304 = 0x0a0b010f<br> 0x40050400 0x00006440 0x0600d008 = 0x00042204 0x0064d007<br> 0x00080000 0xad825509 = 0x1f8617c3 0xd204<br><br>BGP Header<br> Marker: = 0xffffffff 0xffffffff 0xffffffff = 0xffffffff<br> Message Length: (0x005e) 94<br> Message Type: = (0x02) UPDATE<br><br>UPDATE Message<br>Unfeasible route length: (0x0000) = 0<br>Update path attributes<br>Total Path Attribute length: (0x0043) = 67<br> Flags : (0x40) Well Known, Transitive, Complete<br> Type : = (0x01) Origin<br> Length: (0x01) 1<br> Origin: (0x00) IGP<br><br> Flags = : (0x50) Well Known, Transitive, Complete, Extended length<br> Type = : (0x02) AS Path<br> Length: (0x0016) 22<br> Segment Type = : (0x02) AS Sequence<br> Segment Length: (0x05) 5<br> = AS Numbers : (0x0000) 0, (0x2204) 8708, (0x0000) = 0, (0x15e6) 5606, (0x0000) 0,<br> Segment Type : (0xad) = Unknown(173)<br> Segment Length: (0x82) 130<br> AS Numbers = : (0x0000) 0, (0xad82) 44418, (0x0000) 0, (0xad82) = 44418,<br><br> Flags : (0x40) Well Known, Transitive, Complete<br> Type = : (0x03) Next Hop<br> Length: (0x04) 4<br> Next Hop IP address: = (0x0a0b010f) 10.11.1.15<br><br> Flags : (0x40) Well Known, Transitive, = Complete<br> Type : (0x05) Local Preference<br> Length: (0x04) = 4<br> Local Preference: (0x00000064) 100<br><br> Flags : (0x40) Well = Known, Transitive, Complete<br> Type : (0x06) Atomic Aggregate<br> = Length: (0x00) 0<br><br> Flags : (0xd0) Optional, Transitive, Complete, = Extended length<br> Type : (0x08) Community<br> Length: (0x0004) = 4<br> Community List: (0x22040064) 8708:100<br><br> Flags : (0xd0) = Optional, Transitive, Complete, Extended length<br> Type : (0x07) = Aggregator<br> Length: (0x0008) 8<br>Error: Invalid AGGREGATOR attribute = length = 8<br>_______________________________________________<br>foundry-nsp = mailing = list<br>[email protected]<br>http://puck.nether.net/mailman/list= info/foundry-nsp<br></blockquote></div></div></blockquote></div><br></div>= </div></body></html>= --Apple-Mail=_E61580DD-D120-4C3A-A92E-0CF1E6047719-- --===============2079643690834968034== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ foundry-nsp mailing list [email protected] http://puck.nether.net/mailman/listinfo/foundry-nsp --===============2079643690834968034==--