[c-nsp] Cisco ASR BGP within the box question

[Steven.Glogger at swisscom.com]

hi all

just a short question (related to a quite new feature from cisco).
with the new cisco ASR software (15.0(1)S - released some days ago) it is able to do BGP on the same box.
we need this feature because we use the VASI interfaces to bring and filter traffic from one VRF to another VRF and performing firewalling (ZBF).

basically we have on the box:
[VRF_A via vasileft1]--[VRF_B via vasiright1]

and the box itself speaks BGP on VRF_B with some RR's:
[ASRBox] ---- (RR) ---- [anotherbox]

the fun part is, if you want to announce (e.g. 0.0.0.0/0) from VRF_B (announced from anotherbox) to VRF_A it should be possible now with that new feature.

according to BGP I need to configure the VRF_A peer as route-reflector-client so the routes from the anotherbox get reflected via RR to VRF_B.

but, it seems that the router itself needs to be tricked, since he thinks that both peers are in the same route-reflector cluster ("DENIED due to: reflected from the same cluster"):

Aug  2 13:35:03: BGP(0): 213.3.246.33 send UPDATE (format) 0.0.0.0/0, next 10.62.112.65, metric 0, path 44038 3303, extended community RT:65501:1702

Aug  2 13:35:03: BGP(0): 213.3.246.34 rcv UPDATE w/ attr: nexthop 10.62.112.65, origin i, localpref 250, metric 0, originator 10.62.112.65, clusterlist 10.62.112.79 10.62.112.17, merged path 44038 3303, AS_PATH , community

Aug  2 13:35:03: BGP(0): 213.3.246.34 rcv UPDATE about 0.0.0.0/0 -- DENIED due to: reflected from the same cluster;

Aug  2 13:35:03: BGP: 213.3.246.34 Modifying prefix 0.0.0.0/0 from 0 -> 4 address


so, this is my config:


config:
<snip>
interface vasileft1
ip vrf forwarding VRF_A
 ip address 10.0.0.1 255.255.255.252
 zone-member security VASILEFT
!
interface vasiright1
ip vrf forwarding VRF_B
 ip address 10.0.0.2 255.255.255.252
zone-member security VASIRIGHT
!

router bgp 65501
 address-family ipv4 vrf IABIP-
  bgp router-id 10.0.0.1
  redistribute connected
  redistribute static
  neighbor 10.0.0.2 remote-as 65501
  neighbor 10.0.0.2 update-source vasileft1
  neighbor 10.0.0.2 activate
  neighbor 10.0.0.2 send-community both
  neighbor 10.0.0.2 next-hop-self

 exit-address-family
 !
 address-family ipv4 vrf IACYP-
  import path selection multipaths
  bgp router-id 10.0.0.2
  redistribute connected
  redistribute static route-map SET-PREFIX-SoO
  neighbor 10.0.0.1 remote-as 65501
  neighbor 10.0.0.1 update-source vasiright1
  neighbor 10.0.0.1 activate
  neighbor 10.0.0.1 send-community both
  neighbor 10.0.0.1 next-hop-self
 exit-address-family
</snip>




what does not works:
- having another AS number on the same box (otherwise eBGP would be possible)
- client-to-client reflection
- magic stuff in route-map
- setting different cluster-id's for different address-families
- nothing found in the release notes: http://www.cisco.com/en/US/docs/ios/ios_xe/3/release/notes/asr1k_rn_3s_rel_notes.html

so, does anyone knows a nice hidden command to disable this cluster-checking on a per-peer basis or so?


-steven