Description
flowspec not installed in PBR
Version
How to reproduce
My flowspec routers did't install on linux.
Expected behavior
My flowspec routers did't install on linux.
Actual behavior
My flowspec routes did't install in linux.
Additional context
I have problem. FRR didn't install flowspec routes in linux.
I use Ubuntu 26, kernel 7.0.0-27-generic
My configuration FRR:
bgp-frr# show bgp ipv4 flowspec detail
BGP flowspec entry: (flags 0x418)
Source Address 12.12.12.0/24
IP Protocol = 1
FS:rate 0.000000
received for 00:05:20
not installed in PBR
BGP flowspec entry: (flags 0x418)
Destination Address 100.0.0.2/32
Source Address 12.12.12.12/32
IP Protocol = 17
Destination Port = 53
FS:rate 0.000000
received for 00:05:20
not installed in PBR
BGP flowspec entry: (flags 0x418)
Destination Address 100.0.0.2/32
Source Address 192.168.0.0/16
IP Protocol = 17
Destination Port = 53
FS:rate 0.000000
received for 00:05:20
not installed in PBR
BGP flowspec entry: (flags 0x418)
Source Address 12.12.12.12/32
IP Protocol = 1
FS:rate 0.000000
received for 00:05:20
not installed in PBR
BGP flowspec entry: (flags 0x418)
Source Address 192.168.0.0/16
IP Protocol = 17
Destination Port = 53
FS:rate 0.000000
received for 00:05:20
not installed in PBR
BGP flowspec entry: (flags 0x418)
Destination Address 100.0.0.2/32
FS:rate 0.000000
received for 00:05:20
not installed in PBR
BGP flowspec entry: (flags 0x418)
Destination Address 100.0.0.2/32
Source Address 12.12.12.12/32
FS:rate 0.000000
received for 00:05:20
not installed in PBR
Displayed 7 flowspec entries
bgp-frr# show pbr
bgp-frr# show pbr iptable
IPtable match0x56ffb14a0a40 family IPv4 action drop (3)
lookup dst port
protocol 17
IPtable match0x7e11480075d0 family IPv4 action drop (1)
IPtable match0x56ffb15b2b00 family IPv4 action drop (5)
lookup dst port
protocol 17
IPtable match0x56ffb15b3350 family IPv4 action drop (4)
protocol 1
IPtable match0x56ffb16aae80 family IPv4 action drop (2)
bgp-frr# show pbr ipset
IPset match0x56ffb16aae80 type net family IPv4
to 100.0.0.2 (2)
IPset match0x56ffb15b2b00 type net,port,net family IPv4
from 12.12.12.12 to 100.0.0.2:proto 17:53 (6)
from 192.168.0.0/16 to 100.0.0.2:proto 17:53 (5)
IPset match0x56ffb14a0a40 type net,port family IPv4
from 192.168.0.0/16:proto 17:53 (3)
IPset match0x56ffb15b3350 type net family IPv4
from 12.12.12.12:icmp:echo-reply (4)
from 12.12.12.0/24:icmp:echo-reply (7)
IPset match0x7e11480075d0 type net,net family IPv4
from 12.12.12.12 to 100.0.0.2 (1)
bgp-frr# show pbr interface
bgp-frr# show run
Building configuration...
Current configuration:
!
frr version 10.5.1
frr defaults traditional
hostname bgp-frr
log syslog informational
service integrated-vtysh-config
!
ip prefix-list INPUT-BGP seq 10 permit any
!
router bgp 65401
no bgp enforce-first-as
neighbor 10.12.0.2 remote-as 65402
neighbor 10.20.20.106 remote-as 65401
neighbor 10.20.20.108 remote-as 65400
!
address-family ipv4 unicast
neighbor 10.12.0.2 prefix-list INPUT-BGP in
neighbor 10.12.0.2 prefix-list INPUT-BGP out
neighbor 10.20.20.106 prefix-list INPUT-BGP in
neighbor 10.20.20.106 prefix-list INPUT-BGP out
neighbor 10.20.20.108 prefix-list INPUT-BGP in
neighbor 10.20.20.108 prefix-list INPUT-BGP out
exit-address-family
!
address-family ipv4 flowspec
neighbor 10.12.0.2 activate
neighbor 10.20.20.106 activate
neighbor 10.20.20.108 activate
local-install ens18
local-install ens19
exit-address-family
exit
!
end
bgp-frr# exit
root@bgp-frr:/home/user# iptables -L -nv -t mangle
Chain PREROUTING (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
Chain POSTROUTING (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
root@bgp-frr:/home/user# ipset
ipset ipset-translate
root@bgp-frr:/home/user# ipset list
Checklist
Description
flowspec not installed in PBR
Version
How to reproduce
My flowspec routers did't install on linux.
Expected behavior
My flowspec routers did't install on linux.
Actual behavior
My flowspec routes did't install in linux.
Additional context
I have problem. FRR didn't install flowspec routes in linux.
I use Ubuntu 26, kernel 7.0.0-27-generic
My configuration FRR:
bgp-frr# show bgp ipv4 flowspec detail
BGP flowspec entry: (flags 0x418)
Source Address 12.12.12.0/24
IP Protocol = 1
FS:rate 0.000000
received for 00:05:20
not installed in PBR
BGP flowspec entry: (flags 0x418)
Destination Address 100.0.0.2/32
Source Address 12.12.12.12/32
IP Protocol = 17
Destination Port = 53
FS:rate 0.000000
received for 00:05:20
not installed in PBR
BGP flowspec entry: (flags 0x418)
Destination Address 100.0.0.2/32
Source Address 192.168.0.0/16
IP Protocol = 17
Destination Port = 53
FS:rate 0.000000
received for 00:05:20
not installed in PBR
BGP flowspec entry: (flags 0x418)
Source Address 12.12.12.12/32
IP Protocol = 1
FS:rate 0.000000
received for 00:05:20
not installed in PBR
BGP flowspec entry: (flags 0x418)
Source Address 192.168.0.0/16
IP Protocol = 17
Destination Port = 53
FS:rate 0.000000
received for 00:05:20
not installed in PBR
BGP flowspec entry: (flags 0x418)
Destination Address 100.0.0.2/32
FS:rate 0.000000
received for 00:05:20
not installed in PBR
BGP flowspec entry: (flags 0x418)
Destination Address 100.0.0.2/32
Source Address 12.12.12.12/32
FS:rate 0.000000
received for 00:05:20
not installed in PBR
Displayed 7 flowspec entries
bgp-frr# show pbr
bgp-frr# show pbr iptable
IPtable match0x56ffb14a0a40 family IPv4 action drop (3)
lookup dst port
protocol 17
IPtable match0x7e11480075d0 family IPv4 action drop (1)
IPtable match0x56ffb15b2b00 family IPv4 action drop (5)
lookup dst port
protocol 17
IPtable match0x56ffb15b3350 family IPv4 action drop (4)
protocol 1
IPtable match0x56ffb16aae80 family IPv4 action drop (2)
bgp-frr# show pbr ipset
IPset match0x56ffb16aae80 type net family IPv4
to 100.0.0.2 (2)
IPset match0x56ffb15b2b00 type net,port,net family IPv4
from 12.12.12.12 to 100.0.0.2:proto 17:53 (6)
from 192.168.0.0/16 to 100.0.0.2:proto 17:53 (5)
IPset match0x56ffb14a0a40 type net,port family IPv4
from 192.168.0.0/16:proto 17:53 (3)
IPset match0x56ffb15b3350 type net family IPv4
from 12.12.12.12:icmp:echo-reply (4)
from 12.12.12.0/24:icmp:echo-reply (7)
IPset match0x7e11480075d0 type net,net family IPv4
from 12.12.12.12 to 100.0.0.2 (1)
bgp-frr# show pbr interface
bgp-frr# show run
Building configuration...
Current configuration:
!
frr version 10.5.1
frr defaults traditional
hostname bgp-frr
log syslog informational
service integrated-vtysh-config
!
ip prefix-list INPUT-BGP seq 10 permit any
!
router bgp 65401
no bgp enforce-first-as
neighbor 10.12.0.2 remote-as 65402
neighbor 10.20.20.106 remote-as 65401
neighbor 10.20.20.108 remote-as 65400
!
address-family ipv4 unicast
neighbor 10.12.0.2 prefix-list INPUT-BGP in
neighbor 10.12.0.2 prefix-list INPUT-BGP out
neighbor 10.20.20.106 prefix-list INPUT-BGP in
neighbor 10.20.20.106 prefix-list INPUT-BGP out
neighbor 10.20.20.108 prefix-list INPUT-BGP in
neighbor 10.20.20.108 prefix-list INPUT-BGP out
exit-address-family
!
address-family ipv4 flowspec
neighbor 10.12.0.2 activate
neighbor 10.20.20.106 activate
neighbor 10.20.20.108 activate
local-install ens18
local-install ens19
exit-address-family
exit
!
end
bgp-frr# exit
root@bgp-frr:/home/user# iptables -L -nv -t mangle
Chain PREROUTING (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
Chain POSTROUTING (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
root@bgp-frr:/home/user# ipset
ipset ipset-translate
root@bgp-frr:/home/user# ipset list
Checklist