Skip to content

Commit 75024b9

Browse files
lance0factory-droid[bot]
lance0
and
factory-droid[bot]
committed
Add containerlab topologies for Juniper router testing
Three lab configurations for testing FlowSpec with real Juniper routers: 1. vjunos-flowspec.clab.yml - vJunos-router (MX-based classic Junos) - Matches most production deployments - 5GB RAM, ~5-10 min boot 2. cjunos-flowspec.clab.yml - cJunosEvolved (PTX-based Junos Evolved) - Juniper's future direction - 8GB RAM, ~15 min boot 3. dual-flowspec.clab.yml - Both routers simultaneously - Compare behavior between classic Junos and Junos Evolved - 13GB RAM total Each topology includes: - GoBGP peer configured for FlowSpec - Router startup configs with BGP and FlowSpec enabled - Import policies to accept FlowSpec routes Requires downloading images from Juniper (free account). Co-authored-by: factory-droid[bot] <138933559+factory-droid[bot]@users.noreply.github.com>
1 parent 4eaece9 commit 75024b9

11 files changed

Lines changed: 730 additions & 0 deletions

‎lab/README.md‎

Lines changed: 143 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,143 @@
1+
# prefixd Lab Environment
2+
3+
Containerlab topologies for testing FlowSpec with real Juniper routers.
4+
5+
## Prerequisites
6+
7+
1. Install containerlab:
8+
```bash
9+
bash -c "$(curl -sL https://get.containerlab.dev)"
10+
```
11+
12+
2. Download router images from Juniper (free account required):
13+
- **vJunos-router**: https://support.juniper.net/support/downloads/?p=vjunos-router
14+
- **cJunosEvolved**: https://support.juniper.net/support/downloads/?p=cjunosevolved
15+
16+
3. Import images into containerlab:
17+
```bash
18+
# vJunos-router (MX-based)
19+
cd /path/to/downloaded/images
20+
containerlab tools vrnetlab import vjunos-router-23.2R1.15.qcow2
21+
22+
# cJunosEvolved (PTX-based)
23+
containerlab tools vrnetlab import cjunosevolved-24.2R1.17.qcow2
24+
```
25+
26+
## Topologies
27+
28+
### vjunos-flowspec.clab.yml
29+
Tests FlowSpec with vJunos-router (MX-based Junos). This matches most production deployments.
30+
31+
```
32+
┌─────────────┐ eBGP ┌─────────────┐
33+
│ GoBGP │◄─────────────►│ vJunos │
34+
│ (prefixd) │ FlowSpec │ Router │
35+
└─────────────┘ └─────────────┘
36+
AS 65001 AS 65002
37+
```
38+
39+
### cjunos-flowspec.clab.yml
40+
Tests FlowSpec with cJunosEvolved (PTX-based Junos Evolved). Future-proof testing.
41+
42+
```
43+
┌─────────────┐ eBGP ┌─────────────┐
44+
│ GoBGP │◄─────────────►│ cJunos │
45+
│ (prefixd) │ FlowSpec │ Evolved │
46+
└─────────────┘ └─────────────┘
47+
AS 65001 AS 65002
48+
```
49+
50+
## Quick Start
51+
52+
```bash
53+
# Start vJunos lab
54+
cd /path/to/prefixd/lab
55+
sudo containerlab deploy -t vjunos-flowspec.clab.yml
56+
57+
# Wait for router to boot (~5-10 min for vJunos, ~15 min for cJunos)
58+
sudo containerlab inspect -t vjunos-flowspec.clab.yml
59+
60+
# SSH to router (default: admin/admin@123)
61+
ssh admin@clab-vjunos-flowspec-router
62+
63+
# Verify BGP session
64+
show bgp summary
65+
66+
# Check FlowSpec rules
67+
show route table inetflow.0
68+
show firewall filter __flowspec_default_inet__
69+
```
70+
71+
## Testing FlowSpec
72+
73+
1. Start prefixd connected to the lab GoBGP:
74+
```bash
75+
# Update configs/prefixd.yaml to point to lab GoBGP
76+
# bgp.gobgp_grpc: "172.20.20.2:50051"
77+
cargo run -- --config ./configs
78+
```
79+
80+
2. Inject a test event:
81+
```bash
82+
curl -X POST http://localhost:8080/v1/events \
83+
-H "Content-Type: application/json" \
84+
-d '{
85+
"timestamp": "2026-01-18T00:00:00Z",
86+
"source": "lab_test",
87+
"victim_ip": "203.0.113.10",
88+
"vector": "udp_flood",
89+
"bps": 1000000000,
90+
"pps": 1000000,
91+
"top_dst_ports": [53],
92+
"confidence": 0.9
93+
}'
94+
```
95+
96+
3. Verify on router:
97+
```bash
98+
# Check FlowSpec route received
99+
show route table inetflow.0
100+
101+
# Check firewall filter created
102+
show firewall filter __flowspec_default_inet__
103+
104+
# Check filter counters
105+
show firewall filter __flowspec_default_inet__ detail
106+
```
107+
108+
## Cleanup
109+
110+
```bash
111+
sudo containerlab destroy -t vjunos-flowspec.clab.yml
112+
```
113+
114+
## Resource Requirements
115+
116+
| Router | RAM | CPU | Boot Time |
117+
|--------|-----|-----|-----------|
118+
| vJunos-router | 5 GB | 4 cores | ~5-10 min |
119+
| cJunosEvolved | 8 GB | 4 cores | ~15 min |
120+
121+
## Troubleshooting
122+
123+
### Router not accepting FlowSpec
124+
Check import policy:
125+
```
126+
show configuration policy-options policy-statement FLOWSPEC-IMPORT
127+
show configuration protocols bgp group GOBGP import
128+
```
129+
130+
### BGP session not establishing
131+
Check reachability and config:
132+
```
133+
ping 172.20.20.2
134+
show bgp neighbor 172.20.20.2
135+
show configuration protocols bgp
136+
```
137+
138+
### FlowSpec rules not installing
139+
Check validation:
140+
```
141+
show route receive-protocol bgp 172.20.20.2 table inetflow.0 detail
142+
show route validation-state inetflow.0
143+
```

‎lab/cjunos-config.txt‎

Lines changed: 81 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,81 @@
1+
## cJunosEvolved FlowSpec configuration
2+
## AS 65003 - receives FlowSpec from GoBGP (AS 65001)
3+
##
4+
## Note: Junos Evolved syntax differs slightly from classic Junos
5+
6+
system {
7+
host-name cjunos-flowspec;
8+
root-authentication {
9+
encrypted-password "$6$rounds=5000$abc123$xyz"; /* admin@123 */
10+
}
11+
login {
12+
user admin {
13+
class super-user;
14+
authentication {
15+
encrypted-password "$6$rounds=5000$abc123$xyz"; /* admin@123 */
16+
}
17+
}
18+
}
19+
services {
20+
ssh;
21+
netconf {
22+
ssh;
23+
}
24+
}
25+
}
26+
27+
interfaces {
28+
et-0/0/0 {
29+
description "Link to GoBGP";
30+
unit 0 {
31+
family inet {
32+
address 10.0.1.2/30;
33+
}
34+
}
35+
}
36+
lo0 {
37+
unit 0 {
38+
family inet {
39+
address 192.0.2.2/32;
40+
}
41+
}
42+
}
43+
}
44+
45+
routing-options {
46+
router-id 192.0.2.2;
47+
autonomous-system 65003;
48+
flow {
49+
/* Enable FlowSpec route installation */
50+
validation;
51+
/* Install FlowSpec as firewall filters */
52+
term-order standard;
53+
}
54+
}
55+
56+
policy-options {
57+
policy-statement FLOWSPEC-IMPORT {
58+
term accept-all {
59+
then accept;
60+
}
61+
}
62+
}
63+
64+
protocols {
65+
bgp {
66+
group GOBGP {
67+
type external;
68+
description "FlowSpec from prefixd via GoBGP";
69+
import FLOWSPEC-IMPORT;
70+
peer-as 65001;
71+
neighbor 10.0.1.1 {
72+
family inet {
73+
flow {
74+
/* Receive IPv4 FlowSpec */
75+
no-validate FLOWSPEC-IMPORT;
76+
}
77+
}
78+
}
79+
}
80+
}
81+
}

‎lab/cjunos-dual-config.txt‎

Lines changed: 75 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,75 @@
1+
## cJunosEvolved config for dual-router lab
2+
## AS 65003 - receives FlowSpec from GoBGP (AS 65001)
3+
4+
system {
5+
host-name cjunos-dual;
6+
root-authentication {
7+
encrypted-password "$6$rounds=5000$abc123$xyz";
8+
}
9+
login {
10+
user admin {
11+
class super-user;
12+
authentication {
13+
encrypted-password "$6$rounds=5000$abc123$xyz";
14+
}
15+
}
16+
}
17+
services {
18+
ssh;
19+
netconf {
20+
ssh;
21+
}
22+
}
23+
}
24+
25+
interfaces {
26+
et-0/0/0 {
27+
description "Link to GoBGP";
28+
unit 0 {
29+
family inet {
30+
address 10.0.1.2/30;
31+
}
32+
}
33+
}
34+
lo0 {
35+
unit 0 {
36+
family inet {
37+
address 192.0.2.2/32;
38+
}
39+
}
40+
}
41+
}
42+
43+
routing-options {
44+
router-id 192.0.2.2;
45+
autonomous-system 65003;
46+
flow {
47+
validation;
48+
term-order standard;
49+
}
50+
}
51+
52+
policy-options {
53+
policy-statement FLOWSPEC-IMPORT {
54+
term accept-all {
55+
then accept;
56+
}
57+
}
58+
}
59+
60+
protocols {
61+
bgp {
62+
group GOBGP {
63+
type external;
64+
import FLOWSPEC-IMPORT;
65+
peer-as 65001;
66+
neighbor 10.0.1.1 {
67+
family inet {
68+
flow {
69+
no-validate FLOWSPEC-IMPORT;
70+
}
71+
}
72+
}
73+
}
74+
}
75+
}

‎lab/cjunos-flowspec.clab.yml‎

Lines changed: 45 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,45 @@
1+
# cJunosEvolved FlowSpec Lab
2+
#
3+
# Tests FlowSpec propagation: prefixd -> GoBGP -> cJunosEvolved
4+
# cJunosEvolved is PTX-based Junos Evolved - Juniper's future direction
5+
#
6+
# Prerequisites:
7+
# 1. Download cJunosEvolved qcow2 from Juniper
8+
# 2. Import: containerlab tools vrnetlab import cjunosevolved-24.2R1.17.qcow2
9+
#
10+
# Usage:
11+
# sudo containerlab deploy -t cjunos-flowspec.clab.yml
12+
# sudo containerlab destroy -t cjunos-flowspec.clab.yml
13+
#
14+
# Note: cJunosEvolved takes ~15 min to boot and requires 8GB RAM
15+
16+
name: cjunos-flowspec
17+
18+
mgmt:
19+
network: clab-mgmt-evo
20+
ipv4-subnet: 172.20.21.0/24
21+
22+
topology:
23+
nodes:
24+
# GoBGP - FlowSpec announcer (connected to prefixd)
25+
gobgp:
26+
kind: linux
27+
image: jauderho/gobgp:latest
28+
binds:
29+
- gobgp-cjunos.conf:/etc/gobgp/gobgp.conf:ro
30+
exec:
31+
- gobgpd -f /etc/gobgp/gobgp.conf -p --api-hosts=0.0.0.0:50051
32+
mgmt-ipv4: 172.20.21.2
33+
ports:
34+
- 50052:50051 # Different port to avoid conflict with vjunos lab
35+
36+
# cJunosEvolved - FlowSpec receiver/enforcer
37+
router:
38+
kind: juniper_vjunosevolved
39+
image: vrnetlab/juniper_vjunosevolved:24.2R1
40+
mgmt-ipv4: 172.20.21.3
41+
startup-config: cjunos-config.txt
42+
43+
links:
44+
# eBGP peering link between GoBGP and cJunosEvolved
45+
- endpoints: ["gobgp:eth1", "router:eth1"]

0 commit comments

Comments
 (0)