== all logged in ## Konfiguration [A] $ configure [A] $ set interfaces ethernet eth1 address 10.0.0.1/24 [A] $ set interfaces ethernet eth2 address 10.1.0.1/24 [A] $ set vpp settings interface eth1 [A] $ set vpp settings interface eth2 [A] $ set vpp settings poll-sleep-usec 10 [A] $ commit [ vpp ] [B] $ configure [B] $ set interfaces ethernet eth1 address 10.0.0.2/24 [B] $ set interfaces ethernet eth1 mac 00:00:5e:00:aa:02 [B] $ set protocols static route 10.1.0.0/24 next-hop 10.0.0.1 [B] $ commit [C] $ configure [C] $ set interfaces ethernet eth1 address 10.1.0.2/24 [C] $ set interfaces ethernet eth1 mac 00:00:5e:00:aa:03 [C] $ set protocols static route 10.0.0.0/24 next-hop 10.1.0.1 [C] $ commit ## Linux-CP: Ping zum Router ueber VPP [B] $ run ping 10.0.0.1 count 3 interval 0.2 | grep -E "transmitted" 3 packets transmitted, 3 received, 0% packet loss, time 401ms [A] $ sudo vppctl show int | grep -E "eth1|eth2" eth1 1 up 1500/0/0/0 rx packets 13 eth2 2 up 1500/0/0/0 rx packets 8 [A] $ sudo vppctl show lcp | head -8 lcp default netns '' lcp lcp-auto-subint on lcp lcp-sync on lcp lcp-sync-unnumbered on lcp del-static-on-link-down off lcp del-dynamic-on-link-down off lcp route-no-paths on itf-pair: [0] eth1 tap4096 eth1 11 type tap ## Weiterleitung durch VPP: B nach C [B] $ run ping 10.1.0.2 count 5 interval 0.2 | grep -E "transmitted|ttl=" | tail -2 64 bytes from 10.1.0.2: icmp_seq=5 ttl=63 time=1.66 ms 5 packets transmitted, 4 received, 20% packet loss, time 809ms [A] $ sudo vppctl show ip fib 10.1.0.2/32 | head -8 ipv4-VRF:0, fib_index:0, flow hash:[src dst sport dport proto flowlabel ] epoch:4 flags:none locks:[adjacency:1, default-route:1, lcp-rt:1, ] 10.1.0.2/32 fib:0 index:22 locks:2 adjacency refs:1 entry-flags:attached, src-flags:added,contributing,active, cover:15 path-list:[34] locks:2 uPRF-list:26 len:1 itfs:[2, ] path:[50] pl-index:34 ip4 weight=1 pref=0 attached-nexthop: oper-flags:resolved, 10.1.0.2 eth2 [@0]: ipv4 via 10.1.0.2 eth2: mtu:1500 next:6 flags:[] 00005e00aa0300005e0053020800 Extensions: [A] $ sudo vppctl show errors | head -12 Count Node Reason Severity 1 arp-reply ARP replies sent info 2 arp-reply ARP request IP4 source address lear info 1 ip4-glean ARP requests sent info 6 ip6-input ip6 source lookup miss error 8 ip6-local-hop-by-hop Unknown protocol ip6 local h-b-h pa error 2 ip6-icmp-input neighbor solicitations for unknown error [A] $ sudo ip route show | head 10.0.0.0/24 dev eth1 proto kernel scope link src 10.0.0.1 10.1.0.0/24 dev eth2 proto kernel scope link src 10.1.0.1 ## Firewall: Forward-Filter als ACL [A] $ set firewall global-options state-policy established action accept [A] $ set firewall global-options state-policy related action accept [A] $ set firewall ipv4 forward filter default-action drop [A] $ set firewall ipv4 forward filter rule 10 action accept [A] $ set firewall ipv4 forward filter rule 10 inbound-interface name eth1 [A] $ set firewall ipv4 forward filter rule 10 protocol tcp [A] $ commit [B] $ run ping 10.1.0.2 count 3 interval 0.2 | grep transmitted 3 packets transmitted, 0 received, 100% packet loss, time 413ms [B] $ run ping 10.0.0.1 count 3 interval 0.2 | grep transmitted 3 packets transmitted, 3 received, 0% packet loss, time 401ms [A] $ sudo vppctl show acl-plugin acl | grep -E "tag|applied|deny|permit\+reflect" acl-index 0 count 8 tag {fw-in-eth1} 5: ipv4 permit+reflect src 0.0.0.0/0 dst 0.0.0.0/0 proto 6 sport 0-65535 dport 0-65535 6: ipv4 deny src 0.0.0.0/0 dst 0.0.0.0/0 proto 0 sport 0-65535 dport 0-65535 7: ipv6 permit+reflect src ::/0 dst ::/0 proto 0 sport 0-65535 dport 0-65535 applied inbound on sw_if_index: 1 applied outbound on sw_if_index: acl-index 1 count 7 tag {fw-in-eth2} 5: ipv4 deny src 0.0.0.0/0 dst 0.0.0.0/0 proto 0 sport 0-65535 dport 0-65535 6: ipv6 permit+reflect src ::/0 dst ::/0 proto 0 sport 0-65535 dport 0-65535 applied inbound on sw_if_index: 2 applied outbound on sw_if_index: acl-index 2 count 2 tag {fw-out} 0: ipv4 permit+reflect src 0.0.0.0/0 dst 0.0.0.0/0 proto 0 sport 0-65535 dport 0-65535 1: ipv6 permit+reflect src ::/0 dst ::/0 proto 0 sport 0-65535 dport 0-65535 applied outbound on sw_if_index: 1, 2 [A] $ set firewall ipv4 forward filter rule 20 action accept [A] $ set firewall ipv4 forward filter rule 20 inbound-interface name eth1 [A] $ set firewall ipv4 forward filter rule 20 protocol icmp [A] $ commit [B] $ run ping 10.1.0.2 count 3 interval 0.2 | grep transmitted 3 packets transmitted, 3 received, 0% packet loss, time 402ms [C] $ run ping 10.0.0.2 count 3 interval 0.2 | grep transmitted 3 packets transmitted, 0 received, 100% packet loss, time 409ms [A] $ sudo vppctl show acl-plugin sessions | head -12 Sessions total: add 3 - del 0 = 3 Sessions active: add 3 - deact 0 = 3 Sessions being purged: deact 0 - del 0 = 0 now: 341148821820 clocks per second: 1996249991 Per-thread data: Thread #0: connection add/del stats: sw_if_index 0: add 0 - del 0 = 0; epoch chg: 0 sw_if_index 1: add 2 - del 0 = 2; epoch chg: 0 sw_if_index 2: add 1 - del 0 = 1; epoch chg: 0 [A] $ delete firewall [A] $ commit ## BGP mit BIRD ueber VPP, Route in VPP-FIB [B] $ set protocols static route 203.0.113.0/24 blackhole [B] $ set protocols bgp system-as 65002 [B] $ set protocols bgp parameters router-id 10.0.0.2 [B] $ set protocols bgp neighbor 10.0.0.1 remote-as 65001 [B] $ set protocols bgp neighbor 10.0.0.1 address-family ipv4-unicast [B] $ set protocols bgp address-family ipv4-unicast redistribute static [B] $ commit [A] $ set protocols bgp system-as 65001 [A] $ set protocols bgp parameters router-id 10.0.0.1 [A] $ set protocols bgp neighbor 10.0.0.2 remote-as 65002 [A] $ set protocols bgp neighbor 10.0.0.2 address-family ipv4-unicast [A] $ commit [A] $ sudo birdc show protocols | grep -iE "bgp|name" Name Proto Table State Since Info bgp_default_10_0_0_2 BGP --- up 2026-11-01 18:34:19 Established [A] $ ip route show 203.0.113.0/24 203.0.113.0/24 via 10.0.0.2 dev eth1 proto bird metric 19 [A] $ sudo vppctl show ip fib 203.0.113.0/24 | head -8 ipv4-VRF:0, fib_index:0, flow hash:[src dst sport dport proto flowlabel ] epoch:4 flags:none locks:[adjacency:1, default-route:1, lcp-rt:1, ] 203.0.113.0/24 fib:0 index:23 locks:2 lcp-rt-dynamic refs:1 src-flags:added,contributing,active, path-list:[35] locks:2 flags:shared, uPRF-list:27 len:1 itfs:[1, ] path:[51] pl-index:35 ip4 weight=1 pref=19 attached-nexthop: oper-flags:resolved, 10.0.0.2 eth1 [@0]: ipv4 via 10.0.0.2 eth1: mtu:1500 next:5 flags:[] 00005e00aa0200005e0053010800 ## Neustart von A: VPP, ACLs, BGP kommen wieder [A] $ set firewall global-options state-policy established action accept [A] $ set firewall ipv4 forward filter default-action accept [A] $ set firewall ipv4 forward filter rule 5 action drop [A] $ set firewall ipv4 forward filter rule 5 inbound-interface name eth1 [A] $ set firewall ipv4 forward filter rule 5 destination address 10.1.0.99 [A] $ commit [A] $ save [A] $ exit exit == A rebooted [A] $ sudo vppctl show int | grep -E "eth1|eth2" eth1 1 up 1500/0/0/0 rx packets 9 eth2 2 up 1500/0/0/0 tx packets 10 [A] $ sudo vppctl show acl-plugin acl | grep -E "tag|deny" acl-index 0 count 8 tag {fw-in-eth1} 5: ipv4 deny src 0.0.0.0/0 dst 10.1.0.99/32 proto 0 sport 0-65535 dport 0-65535 acl-index 1 count 7 tag {fw-in-eth2} acl-index 2 count 2 tag {fw-out} [A] $ sudo birdc show protocols | grep -iE "bgp" bgp_default_10_0_0_2 BGP --- up 2026-11-01 18:35:33 Established [A] $ sudo vppctl show ip fib 203.0.113.0/24 | head -5 ipv4-VRF:0, fib_index:0, flow hash:[src dst sport dport proto flowlabel ] epoch:4 flags:none locks:[adjacency:1, default-route:1, lcp-rt:1, ] 203.0.113.0/24 fib:0 index:22 locks:2 lcp-rt-dynamic refs:1 src-flags:added,contributing,active, path-list:[34] locks:2 flags:shared, uPRF-list:26 len:1 itfs:[1, ] path:[50] pl-index:34 ip4 weight=1 pref=19 attached-nexthop: oper-flags:resolved, [B] $ run ping 10.1.0.2 count 3 interval 0.2 | grep transmitted 3 packets transmitted, 2 received, 33.3333% packet loss, time 404ms