BGP in separate rdomains

[fencepencil]

I am wondering if anyone out there has any experience with a bgpd.conf file where 2 different rdomains are configured. This is running OpenBSD 6.6.

I think it's probably possible, I just don't know the correct syntax for it.

A better description is here on what I'm trying to do exactly - https://www.reddit.com/r/openbsd/com...p_in_rdomains/

Any help is much appreciated.

[J65nko]

Hi and welcome. I don't think there are any forum members who can answer your question with BGP. Not because "our OpenBSD expertise" is low-level, because that isn't. Only because AFAIK they don't work in an network environment where you need BGP.

You could ask on the official OpenBSD "misc" mailing list or the "users" mailing list of openbgpd.org.

How to subscribe to these lists is mentioned in the "Managing list membership via Majordomo" section of https://www.openbsd.org/mail.html

BTW Are you sure bgp is running? Does # netstat -an | grep LISTEN show an entry with LISTEN on port 179?

[fencepencil]

That's perfect, I will surely look into those mailing lists, thank you.

And yes, BGP is running. I just ran that command and see:
tcp 0 0 *.179 *.* LISTEN

The other side of it sees "Connection refused by remote host" which made me think pf.conf.

My other issue when configuring "listen on 10.1.1.100" to the bgp.conf, it errored with "Cannot bind to 10.1.1.100:179: Can't assign requested address". This happens when I use the -df flags with rcctl restart bgpd.

Thank you for the reply, I will definitely look into those mailing lists.

[J65nko]

You could check with # ifconfig with the -A, -a, -C options to make sure the vlan interfaces have been configured correctly.

Also double check the routing tables for all routing domains with netstat(1)

For debugging you could run [oman]bgpd[/oman] in the foreground with the -d option All errors will then be logged to stderr.



BTW In your pf.conf you have :

# set skip on lo

After having things running and starting to tighten up the pf ruleset with a block log all this could bite you. Loopback traffic is local/internal to the box itself, so in general it is not a good idea to block loopback traffic.