BGP dynamic routing firewall.

[j3cky]

HI ,
i face issue when configure VPC dynamic routing BGP , 2 bgp can't connect each other and i found this is firewall issue.
after i put firewall rule "nft add rule ip ip4_acl INPUT tcp dport 179 accept" bgp connected and prefix advertised.

fyi, i ssh to vr and than run this command "nft add rule ip ip4_acl INPUT tcp dport 179 accept"

how can i allow port 179 from GUI,i can't find firewall configuration in GUI

[weizhouapache]

@j3cky
did you create two VPCs with Dynamic Routing and connect them via BGP ?

can you share more information ?

• the vpc offering
• the vpc settings
• the bgp settings
• the FRR config in VPC VRs

[j3cky]

Hi @weizhouapache
yes i create 2 vpc with dynamic routing.,
since it already few mount after my post, i have delete my testing environment. i need to rebuild this test environment.
i will posted later

[weizhouapache]

Hi @weizhouapache yes i create 2 vpc with dynamic routing., since it already few mount after my post, i have delete my testing environment. i need to rebuild this test environment. i will posted later

@j3cky
no need, I will try to reproduce the issue

I think it is a valid use case.
The fix could be very simple - however, will it cause security issue ?

[j3cky]

so in my test environment i have 2 region and i try connect network between 2 region with dynamic routing but bgp connection can't established because port 179 is not allowed.
is it known bug?am i miss something?.

[weizhouapache]

so in my test environment i have 2 region and i try connect network between 2 region with dynamic routing but bgp connection can't established because port 179 is not allowed. is it known bug?am i miss something?.

By design in CloudStack, the two VPC Virtual Routers (VRs) connect to the upstream router via BGP. The upstream router advertises the networks and routes to both VRs, enabling communication between VMs across the VPCs. The VRs themselves do not establish a direct BGP session with each other.

Did you use a upstream router as BGP server ? If not, I would suggest to do it

[j3cky]

hi @weizhouapache
i try use direct bgp connection in vr to make our customer able to connect network in both region.
so this is not supported.

[j3cky]

@weizhouapache
hi, i have question what about port 179 it is blocked in vr. how can i establish bgp connection to upstream router if port 179 is blocked?

[weizhouapache]

the incoming traffic to port 179 of VR is blocked, but VR can still connect to port 179 of upstream router
@j3cky

[DaanHoogland]

@j3cky , did you resolve your issue with @weizhouapache ’s replies?

[j3cky]

HI, yes i have resolve the issue