[a-nsp] tracked static routes in EOS

[Bryan Holloway]

That's pretty cool. Thank you for sharing!


On 9/11/26 21:00, Tyler Conrad via arista-nsp wrote:
> Hey Drew,
> 
> This is what I meant about conmon being built-in. You can chain 
> connectivity-monitoring for monitoring, have it syslog, and then react 
> to the syslog using an event handler. Gives you a lot of flexibility.
> 
> Something like this, where 10.0.0.1 is reachable on local interface via 
> L2 transport, so we monitor it. Then depending on if it's up or not, we 
> add or remove a static route to *MailScanner warning: numerical links 
> are often malicious:* 10.1.2.3/32 <http://10.1.2.3/32> toward 10.0.0.1.
> 
> monitor connectivity
>     no shutdown
>     !
>     host host1
>        ip 10.0.0.1
> 
> --- Syslog output:
> 
> 2026-09-11T11:54:31.144742-07:00 LAB-MGMT-48ZC2 ConnectivityMonitor: 
> %CONNECTIVITYMON-5-HOST_UNREACHABLE: Host host1 (10.0.0.1) is 
> unreachable with ICMP probes
> 
> 2026-09-11T11:58:67.530900-07:00 LAB-MGMT-48ZC2 ConnectivityMonitor: 
> %CONNECTIVITYMON-5-HOST_REACHABLE: Host host1 (10.0.0.1) is reachable 
> with ICMP probes
> 
> 
> --- Built event-handler:
> event-handler Host1Down
>     action bash Cli -p15 -c $'enable\n configure\n no ip route 
> *MailScanner warning: numerical links are often malicious:* 10.1.2.3/32 
> <http://10.1.2.3/32> 10.0.0.1\n end'
>     delay 0
>     asynchronous
>     !
>     trigger on-logging
>        regex "Host host1 .* is unreachable .*"
> 
> event-handler Host1Up
>     action bash Cli -p15 -c $'enable\n configure\n ip route *MailScanner 
> warning: numerical links are often malicious:* 10.1.2.3/32 
> <http://10.1.2.3/32> 10.0.0.1\n end'
>     delay 0
>     asynchronous
>     !
>     trigger on-logging
>        regex "Host host1 .* is reachable .*"
> 
> Is this what you're after?
> 
> -T
> 
> On Fri, Sep 11, 2026 at 12:36 PM Drew Weaver <drew.weaver at thenap.com 
> <mailto:drew.weaver at thenap.com>> wrote:
> 
>     Right but none of that is built into EOS correct?____
> 
>     __ __
> 
>     That was what the post was mostly about.____
> 
>     __ __
> 
>     Whether they had ever gone back and corrected the omission?____
> 
>     __ __
> 
>     Thanks,____
> 
>     -Drew____
> 
>     __ __
> 
>     __ __
> 
>     *From:*Tyler Conrad <Tyler at tgconrad.com <mailto:Tyler at tgconrad.com>>
>     *Sent:* Friday, September 11, 2026 1:25 PM
>     *To:* Drew Weaver <drew.weaver at thenap.com
>     <mailto:drew.weaver at thenap.com>>
>     *Cc:* arista-nsp at puck.nether.net <mailto:arista-nsp at puck.nether.net>
>     *Subject:* Re: [a-nsp] tracked static routes in EOS____
> 
>     __ __
> 
>     Hi Drew,____
> 
>     __ __
> 
>     I've worked on a couple extensions to do this over the years, and
>     there's also a built-in way.____
> 
>     __ __
> 
>     Built-in: Connectivity-monitor with an on-logging event-handler can
>     work for script-less behavior.____
> 
>     PingCheck Extension: *MailScanner has detected a possible fraud
>     attempt from "urldefense.proofpoint.com" claiming to be* https://
>     github.com/arista-eosext/PingCheck <https://
>     urldefense.proofpoint.com/v2/url?
>     u=https-3A__github.com_arista-2Deosext_PingCheck&d=DwMFaQ&c=euGZstcaTDllvimEN8b7jXrwqOf-v5A_CdpgnVfiiMM&r=OPufM5oSy-PFpzfoijO_w76wskMALE1o4LtA3tMGmuw&m=bPv27DsWHvJOKXO1fg-IGUnqlmv3IzCXU57K_UK6OKd83rMtLkgFxTjUGCICVrCw&s=U1Lbsb6ispBFDPisCYWxAwXksSBjf3cioxLYf8pn-ro&e=> - this one uses a simple ping check.____
> 
>     SynAcktor Extension: *MailScanner has detected a possible fraud
>     attempt from "urldefense.proofpoint.com" claiming to be* https://
>     github.com/etedor/synacktor <https://urldefense.proofpoint.com/v2/
>     url?
>     u=https-3A__github.com_etedor_synacktor&d=DwMFaQ&c=euGZstcaTDllvimEN8b7jXrwqOf-v5A_CdpgnVfiiMM&r=OPufM5oSy-PFpzfoijO_w76wskMALE1o4LtA3tMGmuw&m=bPv27DsWHvJOKXO1fg-IGUnqlmv3IzCXU57K_UK6OKd83rMtLkgFxTjUGCICVrCw&s=49RFYRbP_3OyShNE6hz-8Ix9XOqpCVFYwaU7o1C8Uc8&e=> - adds flexibility to be able to monitor a tcp service and set an arbitrary next-hop. Useful for monitoring a path without changing the routing table.____
> 
>     __ __
> 
>     Hope this helps,____
> 
>     -T____
> 
>     __ __
> 
>     On Fri, Sep 11, 2026 at 9:03 AM Drew Weaver via arista-nsp <arista-
>     nsp at puck.nether.net <mailto:arista-nsp at puck.nether.net>> wrote:____
> 
>         Howdy____
> 
>         ____
> 
>         Is it true that there really is no way to do tracked static
>         routes in EOS without installing a python script that you have
>         to reinstall every time the switch reboots?____
> 
>         ____
> 
>         By tracked static routes I just mean a route that withdrawals
>         when something stops pinging (or another tracking mechanism)
>         would just use BFD but the device on the far end of the L2
>         network doesn’t support it.____
> 
>         ____
> 
>         Use case is basically just a L2 network in between the route
>         origin and the destination. if the entire network goes down and
>         the physical link facing the route originating device disappears
>         then the route is withdrawn anyway but if only the portion on
>         the other side of the L2 network goes down then you’re null
>         routing traffic unintentionally.____
> 
>         ____
> 
>         I’m just wondering.____
> 
>         ____
> 
>         Thanks,____
> 
>         -Drew____
> 
>         ____
> 
>         -- 
>         arista-nsp mailing list
>         arista-nsp at puck.nether.net <mailto:arista-nsp at puck.nether.net>
>         *MailScanner has detected a possible fraud attempt from
>         "urldefense.proofpoint.com" claiming to be* https://
>         puck.nether.net/mailman/listinfo/arista-nsp <https://
>         urldefense.proofpoint.com/v2/url?
>         u=https-3A__puck.nether.net_mailman_listinfo_arista-2Dnsp&d=DwMFaQ&c=euGZstcaTDllvimEN8b7jXrwqOf-v5A_CdpgnVfiiMM&r=OPufM5oSy-PFpzfoijO_w76wskMALE1o4LtA3tMGmuw&m=bPv27DsWHvJOKXO1fg-IGUnqlmv3IzCXU57K_UK6OKd83rMtLkgFxTjUGCICVrCw&s=swn2J_fnMYrd_r3G6EW4ljY7o_Qytb7wfPxQk74pBjE&e=>____
> 
>