ff-policy.conf 4.3 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166
  1. #
  2. # FFHO Routing Policy
  3. #
  4. {%- set node_roles = salt['pillar.get']('nodes:' ~ grains['id'] ~ ':roles', []) %}
  5. {%- set node_sites = salt['pillar.get']('nodes:' ~ grains['id'] ~ ':sites', []) %}
  6. {%- set sites = salt['pillar.get']('sites', {}) %}
  7. {%- set te = salt['pillar.get']('te', {}) %}
  8. ################################################################################
  9. # Static Filters #
  10. ################################################################################
  11. filter external_IPs_to_learn {
  12. if net ~ [
  13. {%- if proto == 'v4' %}
  14. 80.70.181.59/32, # mail.ffho.net
  15. 80.70.181.60/32, # dns-auth.ffho.net
  16. 80.70.181.61/32 # fe01.ffho.net
  17. {%- else %}
  18. 2a02:450:1:0::/64 # Vega VM Subnet
  19. {%- endif %}
  20. ] then accept;
  21. reject;
  22. };
  23. filter own_prefixes {
  24. if net ~ [
  25. {%- if proto == 'v4' %}
  26. 10.132.0.0/16,
  27. 172.30.0.0/16{24,24}
  28. {%- else %}
  29. fdca:ffee:ff12::/48,
  30. 2a03:2260:2342::/48
  31. {%- endif %}
  32. ] then accept;
  33. reject;
  34. };
  35. ################################################################################
  36. # iBGP routing policy (Communities + Filter) + TE #
  37. ################################################################################
  38. {%- for site in node_sites %}
  39. {%- set site_config = sites.get (site) %}
  40. {%- set community = 'SITE_' ~ site|upper|replace('-', '') ~ '_ROUTE' %}
  41. {%- set community_id = site_config.get ('site_no')|int + 100 %}
  42. define {{ community }} = (65132,{{ community_id }});
  43. {%- endfor %}
  44. # Prefixes longer that site prefix leaving a gateway as TE prefixes.
  45. # They are for TE core -> gateway only and must not be imported on other gateways.
  46. define GATEWAY_TE_ROUTE = (65132,300);
  47. # All our prefixes learned in the external VRF and redistributed into the
  48. # internal network
  49. define EXTERNAL_ROUTE = (65132,1023);
  50. # TE routes only to be exported by specific border routers
  51. define EXPORT_RESTRICT = (65132, 100);
  52. define EXPORT_ONLY_AT_CR01 = (65132, 101);
  53. define EXPORT_ONLY_AT_CR02 = (65132, 102);
  54. define EXPORT_ONLY_AT_CR03 = (65132, 103);
  55. define EXPORT_ONLY_AT_CR04 = (65132, 104);
  56. define EXPORT_ONLY_AT_BBR_KT = (65132, 197);
  57. # Anycasted prefix
  58. define ANYCAST_PREFIX = (65132,999);
  59. # To be placed in /etc/bird/ff_killswitch.conf
  60. define SITE_LEGACY_ONLINE = 1;
  61. define SITE_PADCTY_ONLINE = 1;
  62. define SITE_PADUML_ONLINE = 1;
  63. define DRAINED = 0;
  64. {%- if 'batman_gw' in node_roles %}
  65. function tag_site_routes ()
  66. {
  67. {%- for site in node_sites %}
  68. {%- set site_config = sites.get (site) %}
  69. {%- set prefix = site_config.get ('prefix_' ~ proto) %}
  70. {%- set prefix_mask_te = prefix.split ('/')[1]|int + 1 %}
  71. {%- set community = 'SITE_' ~ site|upper|replace('-', '') ~ '_ROUTE' %}
  72. # {{ site_config.get ('name', site) }}
  73. if net ~ [ {{ prefix }}+ ] then {
  74. bgp_community.add ({{ community }});
  75. }
  76. {#-
  77. # Tag all routes for prefixes longer than site prefix leaving a gateway
  78. # as TE prefixes. They are for TE core -> gateway only and must not be
  79. # imported on other gateways.
  80. #}
  81. {%- if proto == 'v4' %}
  82. if net ~ [ {{ prefix ~ '{' ~ prefix_mask_te ~ ',32}' }} ] then {
  83. bgp_community.add (GATEWAY_TE_ROUTE);
  84. }
  85. {%- endif %}
  86. {% endfor %}
  87. }
  88. {%- endif %}
  89. filter ibgp_in {
  90. {#- Don't import other gateways TE prefixes here #}
  91. {%- if 'batman_gw' in node_roles %}
  92. if (GATEWAY_TE_ROUTE ~ bgp_community) then {
  93. reject;
  94. }
  95. {%- endif %}
  96. accept;
  97. }
  98. filter ibgp_out {
  99. # Don't redistribute OSPF into iBGP
  100. if "IGP" = proto then
  101. reject;
  102. # Don't redistribute v6 LO IP
  103. if "lo_v6" = proto then
  104. reject;
  105. # Don't redistribute null routes for bogon prefixes
  106. if "bogon_unreach" = proto then
  107. reject;
  108. # Don't redistribute TE prefixes for FFRL
  109. if "ffrl_te" = proto then
  110. reject;
  111. # Don't redistribute anything IF we are drained
  112. if 1 = DRAINED then
  113. reject;
  114. {%- if 'batman_gw' in node_roles %}
  115. tag_site_routes ();
  116. {%- endif %}
  117. accept;
  118. }
  119. # Traffic engineering routes
  120. protocol static ffho_te {
  121. preference 23;
  122. {% set prefixes = salt['ffho_net.get_te_prefixes'](te, grains['id'], proto) %}
  123. {% for prefix in prefixes|sort %}
  124. {%- set config = prefixes.get (prefix) %}
  125. {%- if 'desc' in config %}
  126. # {{ config.get ('desc') }}
  127. {%- endif %}
  128. route {{ prefix }} unreachable {
  129. {%- for community in config.get ('communities', []) %}
  130. bgp_community.add ({{ community }});
  131. {%- endfor %}
  132. };
  133. {%- endfor %}
  134. }