From d171c97269aedb018c3ae1d0913cd90e4a855026 Mon Sep 17 00:00:00 2001 From: Emanuele Di Pascale Date: Mon, 13 Jul 2026 12:05:04 +0200 Subject: [PATCH 1/2] document hostbgp+systemd coexistence issue Signed-off-by: Emanuele Di Pascale --- docs/user-guide/host-settings.md | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/docs/user-guide/host-settings.md b/docs/user-guide/host-settings.md index eed7060c..c4aaf560 100644 --- a/docs/user-guide/host-settings.md +++ b/docs/user-guide/host-settings.md @@ -200,6 +200,20 @@ sudo ip link delete dev enp2s2.1001 Users should consider automating the startup of the hostbgp container at system boot up, to make sure that connectivity is restored in case of a reboot. +### Coexistence with systemd-networkd + +The hostbgp container runs with `--network=host`, which means that any route installed +by BGP will be visible in the host networking stack. If the server where the container runs is +managed by `systemd-networkd`, it is crucial to ensure that those routes are not +removed by systemd. For this reason, users running systemd version >=246 should disable the +management of foreign routes, e.g. by creating a drop-in file such as +`/etc/systemd/networkd.conf.d/10-systemd-frr-coexist.conf` with the following content: + +```console +[Network] +ManageForeignRoutes=no +``` + ### Example: multi-VPC multi-homed server Let's assume that `server-03` is attached to both `leaf-01` and `leaf-02` with unbundled connections From cf05539c08423dece2e75c4b029528e113b1ff45 Mon Sep 17 00:00:00 2001 From: Emanuele Di Pascale Date: Tue, 14 Jul 2026 10:20:15 +0200 Subject: [PATCH 2/2] document hostbgp static route option Signed-off-by: Emanuele Di Pascale --- docs/user-guide/host-settings.md | 18 ++++++++++++++---- 1 file changed, 14 insertions(+), 4 deletions(-) diff --git a/docs/user-guide/host-settings.md b/docs/user-guide/host-settings.md index c4aaf560..b381e8df 100644 --- a/docs/user-guide/host-settings.md +++ b/docs/user-guide/host-settings.md @@ -121,10 +121,15 @@ using the host's interfaces) and in privileged mode. Additionally, a few input p the provided interface as the master device. - `a=` is the Virtual IP (or VIP) to be advertised to the leaves; it should have a prefix length of /32 and be part of the subnet the host is attaching to. +- an optional list of static routes (which, if present, must go after the VPC subnets), in the format + `--routes :i=[:d=] [:i=[:d=]...]`, where: + - `` is the destination IP prefix for the route. + - `i=` is the egress interface for the route. + - `d=` is an optional administrative distance for the route, in the range 1-255 (default 1). As an example, the command might look something like this: ```bash -docker run --network=host --privileged --rm --detach --name hostbgp ghcr.io/githedgehog/host-bgp 64307 vpc-01:v=1001:i=enp2s1:i=enp2s2:a=10.100.34.5/32 +docker run --network=host --privileged --rm --detach --name hostbgp ghcr.io/githedgehog/host-bgp 64307 vpc-01:v=1001:i=enp2s1:i=enp2s2:a=10.100.34.5/32 --routes 0.0.0.0/0:i=enp2s0:d=100 ``` !!! note With the above command, any output produced by the container will not be visible from the terminal @@ -136,6 +141,8 @@ With the above command: - VLAN interfaces `enp2s1.1001` and `enp2s2.1001` would be created, if not already existing - BGP unnumbered sessions would be created on those same interfaces, using ASN 64307 - the address `10.100.34.5/32` would be configured on the loopback of the host server and it would be advertised to the leaves +- a default route via `enp2s0` would be installed with administrative distance 100; this is higher than the default distance for a BGP + route (20), meaning that any default route learned via BGP would take priority over this, effectively making it a "backup" route To further modify the configuration or to troubleshoot the state of the system, an expert user can invoke the FRR CLI using the following command: @@ -161,6 +168,8 @@ route-map vpc-01 permit 10 match ip address prefix-list vpc-01 exit ! +ip route 0.0.0.0/0 enp2s0 100 +! interface lo ip address 10.100.34.5/32 exit @@ -188,10 +197,11 @@ To stop the container, just run the following command: docker stop -t 1 hostbgp ``` -Note that stopping the docker container does not currently remove the VIPs from the loopback, nor -does it delete the VLAN interfaces. If needed, these should be removed manually; for example, -using iproute2 and the reference command above, one could run: +Note that stopping the docker container does not currently remove the VIPs from the loopback +or any static route configured, nor does it delete the VLAN interfaces. If needed, these should +be removed manually; for example, using iproute2 and the reference command above, one could run: ```bash +sudo ip route delete 0.0.0.0/0 dev enp2s0 sudo ip address delete dev lo 10.100.34.5/32 sudo ip link delete dev enp2s1.1001 sudo ip link delete dev enp2s2.1001