From 0dbc8d47c77bcd9fd78a106c680a18efaa8d3b3e Mon Sep 17 00:00:00 2001 From: mreiger Date: Fri, 5 Jun 2026 19:46:17 +0200 Subject: [PATCH 1/4] Add ability to configure ipv6 unicast addressfamily to sonic-config role --- partition/roles/sonic-config/README.md | 25 ++++++++++- .../roles/sonic-config/templates/frr.conf.j2 | 44 +++++++++++++++++++ .../sonic-config/test/data/exit/frr.conf | 29 ++++++++++++ .../sonic-config/test/data/exit/input.yaml | 21 +++++++++ .../sonic-config/test/data/leaf/frr.conf | 10 +++++ 5 files changed, 128 insertions(+), 1 deletion(-) diff --git a/partition/roles/sonic-config/README.md b/partition/roles/sonic-config/README.md index 82c81d5e4..5d213fc20 100644 --- a/partition/roles/sonic-config/README.md +++ b/partition/roles/sonic-config/README.md @@ -285,10 +285,14 @@ sonic_config_frr_syslog_level: informational sonic_config_interconnects: # The name is only a reference within the deployment. It will not be reflected on the switch. interconnect-name: - # BGP announcements to the connecting parties. + # BGP announcements to the connecting parties. Ipv4 addressfamily only. announcements: - network 10.1.2.0/24 + # BGP announcements to the connecting parties for the Ipv6 addressfamily. + announcements_ipv6family: + - redistribute connected + # BFD configuration to apply to this connection. # An empty string is a valid parameter and will tell FRR to listen for BFD events # from this neighbor. @@ -300,11 +304,22 @@ sonic_config_interconnects: # Use specific BGP timer values for the BGP session with the remote party. bgp_timers: 1 3 + # Whether to disable default membership of peers in the ipv4 unicast addressfamily. + # To control addressfamily memberships in dual-stack scenarios. + # Only valid for external interconnects (that is, with vrf). + # You need to explicitly set the addressfamily of each peer if you use this! + no_default_ipv4family: true + # Connect to these BGP neighbors - supports multiple neighbors with individual routemaps. + # Only valid for external interconnects (that is, with vrf). extended_neighbors: # The IP of this extended neighbor. - ip: 10.1.1.1 + # Choose the addressfamily membership of this neighbor. v4 or v6. + families: + - v4 + # Apply an incoming routemap to this neighbor. routemap_in: # Name of the routemap. @@ -354,6 +369,10 @@ sonic_config_interconnects: # Name of the routemap. name: ALLOW-STATIC-IN + # Addressfamily / families to apply this routemap to. Default: ipv4 unicast + families: + - ipv4 + # List of routemap entries. entries: - match ip address prefix-list STATIC_PREFIX_IN @@ -363,6 +382,10 @@ sonic_config_interconnects: # Name of the routemap. name: ALLOW-MPLS-OUT + # Addressfamily / families to apply this routemap to. Default: ipv4 unicast + families: + - ipv4 + # List of routemap entries. entries: - "match ip address prefix-list MPLS_PREFIX_OUT" diff --git a/partition/roles/sonic-config/templates/frr.conf.j2 b/partition/roles/sonic-config/templates/frr.conf.j2 index 0bc6d443e..0ebb8b61e 100644 --- a/partition/roles/sonic-config/templates/frr.conf.j2 +++ b/partition/roles/sonic-config/templates/frr.conf.j2 @@ -118,6 +118,9 @@ router bgp {{ sonic_config_asn }} router bgp {{ sonic_config_asn }} vrf {{ i.vrf }} bgp router-id {{ sonic_config_loopback_address }} bgp bestpath as-path multipath-relax + {% if i.no_default_ipv4family is defined and i.no_default_ipv4family %} + no bgp default ipv4-unicast + {% endif %} neighbor {{ i.peer_group | default("EXTERNAL") }} peer-group neighbor {{ i.peer_group | default("EXTERNAL") }} remote-as {{ i.remote_as | default("external") }} neighbor {{ i.peer_group | default("EXTERNAL") }} timers {{ i.bgp_timers | default("1 3") }} @@ -157,19 +160,60 @@ router bgp {{ sonic_config_asn }} vrf {{ i.vrf }} neighbor {{ i.peer_group | default("EXTERNAL") }} remove-private-AS all {% endif %} {% if i.routemap_in is defined %} + {% if i.routemap_in.families is not defined or "v4" in i.routemap_in.families %} neighbor {{ i.peer_group | default("EXTERNAL") }} route-map {{ i.routemap_in.name }} in {% endif %} + {% endif %} {% if i.routemap_out is defined %} + {% if i.routemap_out.families is not defined or "v4" in i.routemap_out.families %} neighbor {{ i.peer_group | default("EXTERNAL") }} route-map {{ i.routemap_out.name }} out {% endif %} + {% endif %} {% if i.extended_neighbors is defined %} {% for ext in i.extended_neighbors %} + {% if i.no_default_ipv4family is not defined or not i.no_default_ipv4family or ext.families is defined and "v4" in ext.families %} + {% if i.no_default_ipv4family is defined and i.no_default_ipv4family %} + neighbor {{ ext.ip }} activate + {% endif %} {% if ext.routemap_in is defined %} neighbor {{ ext.ip }} route-map {{ ext.routemap_in.name }} in {% endif %} {% if ext.routemap_out is defined %} neighbor {{ ext.ip }} route-map {{ ext.routemap_out.name }} out {% endif %} + {% endif %} + {% endfor %} + {% endif %} + exit-address-family + ! + address-family ipv6 unicast + {% for a in i.announcements_ipv6family|default([]) %} + {{ a }} + {% endfor %} + {% if not i.keep_private_as|default(false) %} + neighbor {{ i.peer_group | default("EXTERNAL") }} remove-private-AS all + {% endif %} + {% if i.routemap_in is defined %} + {% if i.routemap_in.families is defined and "v6" in i.routemap_in.families %} + neighbor {{ i.peer_group | default("EXTERNAL") }} route-map {{ i.routemap_in.name }} in + {% endif %} + {% endif %} + {% if i.routemap_out is defined %} + {% if i.routemap_out.families is defined and "v6" in i.routemap_out.families %} + neighbor {{ i.peer_group | default("EXTERNAL") }} route-map {{ i.routemap_out.name }} out + {% endif %} + {% endif %} + {% if i.extended_neighbors is defined %} + {% for ext in i.extended_neighbors %} + {% if ext.families is defined and "v6" in ext.families %} + neighbor {{ ext.ip }} activate + {% if ext.routemap_in is defined %} + neighbor {{ ext.ip }} route-map {{ ext.routemap_in.name }} in + {% endif %} + {% if ext.routemap_out is defined %} + neighbor {{ ext.ip }} route-map {{ ext.routemap_out.name }} out + {% endif %} + {% endif %} {% endfor %} {% endif %} exit-address-family diff --git a/partition/roles/sonic-config/test/data/exit/frr.conf b/partition/roles/sonic-config/test/data/exit/frr.conf index e4debdd81..030f1e5c4 100644 --- a/partition/roles/sonic-config/test/data/exit/frr.conf +++ b/partition/roles/sonic-config/test/data/exit/frr.conf @@ -88,6 +88,10 @@ router bgp 4200000000 vrf VrfMpls neighbor MPLS route-map ALLOW-MPLS-OUT out exit-address-family ! + address-family ipv6 unicast + neighbor MPLS remove-private-AS all + exit-address-family + ! address-family l2vpn evpn advertise ipv4 unicast exit-address-family @@ -95,20 +99,31 @@ router bgp 4200000000 vrf VrfMpls router bgp 4200000000 vrf VrfInternet bgp router-id 10.0.0.1 bgp bestpath as-path multipath-relax + no bgp default ipv4-unicast neighbor INTERNET peer-group neighbor INTERNET remote-as external neighbor INTERNET timers 1 3 neighbor 172.17.146.177 peer-group INTERNET neighbor 172.17.146.161 peer-group INTERNET + neighbor 2a02:c00:ff0:102::1 peer-group INTERNET ! address-family ipv4 unicast neighbor INTERNET remove-private-AS all + neighbor 172.17.146.177 activate neighbor 172.17.146.177 route-map ALLOW-INTERNET-2-IN in neighbor 172.17.146.177 route-map ALLOW-INTERNET-2-OUT out + neighbor 172.17.146.161 activate neighbor 172.17.146.161 route-map ALLOW-INTERNET-4-IN in neighbor 172.17.146.161 route-map ALLOW-INTERNET-4-OUT out exit-address-family ! + address-family ipv6 unicast + neighbor INTERNET remove-private-AS all + neighbor 2a02:c00:ff0:102::1 activate + neighbor 2a02:c00:ff0:102::1 route-map ALLOW-V6INTERNET-2-IN in + neighbor 2a02:c00:ff0:102::1 route-map ALLOW-V6INTERNET-2-OUT out + exit-address-family + ! address-family l2vpn evpn advertise ipv4 unicast exit-address-family @@ -127,6 +142,10 @@ router bgp 4200000000 vrf Vrf1560 neighbor EXTERNAL remove-private-AS all exit-address-family ! + address-family ipv6 unicast + neighbor EXTERNAL remove-private-AS all + exit-address-family + ! address-family l2vpn evpn advertise ipv4 unicast exit-address-family @@ -144,6 +163,8 @@ ip prefix-list INTERNET_PREFIX_IN seq 10 permit 0.0.0.0/0 ip prefix-list INTERNET_PREFIX_OUT seq 10 permit 185.153.67.0/24 ge 32 ip prefix-list INTERNET_PREFIX_OUT seq 11 permit 212.34.85.0/24 ge 32 ip prefix-list INTERNET_PREFIX_OUT seq 12 permit 212.34.89.0/24 ge 32 +ip prefix-list V6INTERNET_PREFIX_IN seq 10 permit ::0/0 +ip prefix-list V6INTERNET_PREFIX_OUT seq 10 permit 2a02:c00:2f:ff00::/56 ge 128 ! route-map ALLOW-INTERNET-2-IN permit 10 match ip address prefix-list INTERNET_PREFIX_IN @@ -161,6 +182,14 @@ route-map ALLOW-INTERNET-4-OUT permit 20 match ip address prefix-list INTERNET_PREFIX_OUT set as-path prepend 4200000000 4200000000 4200000000 4200000000 ! +route-map ALLOW-V6INTERNET-2-IN permit 10 + match ip address prefix-list V6INTERNET_PREFIX_IN + set as-path prepend last-as 2 +! +route-map ALLOW-V6INTERNET-2-OUT permit 20 + match ip address prefix-list V6INTERNET_PREFIX_OUT + set as-path prepend 4200000000 4200000000 +! ip prefix-list Vrf1560-IN seq 10 permit 10.0.0.0/16 ! route-map IMPORT-INTO-Vrf1560 permit 10 diff --git a/partition/roles/sonic-config/test/data/exit/input.yaml b/partition/roles/sonic-config/test/data/exit/input.yaml index 2bd8edf2c..1113ba8a2 100644 --- a/partition/roles/sonic-config/test/data/exit/input.yaml +++ b/partition/roles/sonic-config/test/data/exit/input.yaml @@ -43,14 +43,19 @@ sonic_config_interconnects: vrf: VrfInternet vlan: 4009 vni: 104009 + no_default_ipv4family: true announcements: [] prefixlists: - "ip prefix-list INTERNET_PREFIX_IN seq 10 permit 0.0.0.0/0" - "ip prefix-list INTERNET_PREFIX_OUT seq 10 permit 185.153.67.0/24 ge 32" - "ip prefix-list INTERNET_PREFIX_OUT seq 11 permit 212.34.85.0/24 ge 32" - "ip prefix-list INTERNET_PREFIX_OUT seq 12 permit 212.34.89.0/24 ge 32" + - "ip prefix-list V6INTERNET_PREFIX_IN seq 10 permit ::0/0" + - "ip prefix-list V6INTERNET_PREFIX_OUT seq 10 permit 2a02:c00:2f:ff00::/56 ge 128" extended_neighbors: - ip: "172.17.146.177" + families: + - v4 routemap_in: name: "ALLOW-INTERNET-2-IN" entries: @@ -62,6 +67,8 @@ sonic_config_interconnects: - "match ip address prefix-list INTERNET_PREFIX_OUT" - "set as-path prepend {{ sonic_config_asn }} {{ sonic_config_asn }}" - ip: "172.17.146.161" + families: + - v4 routemap_in: name: "ALLOW-INTERNET-4-IN" entries: @@ -72,6 +79,20 @@ sonic_config_interconnects: entries: - "match ip address prefix-list INTERNET_PREFIX_OUT" - "set as-path prepend {{ sonic_config_asn }} {{ sonic_config_asn }} {{ sonic_config_asn }} {{ sonic_config_asn }}" + - ip: "2a02:c00:ff0:102::1" + families: + - v6 + routemap_in: + name: "ALLOW-V6INTERNET-2-IN" + entries: + - "match ip address prefix-list V6INTERNET_PREFIX_IN" + - "set as-path prepend last-as 2" + routemap_out: + name: "ALLOW-V6INTERNET-2-OUT" + entries: + - "match ip address prefix-list V6INTERNET_PREFIX_OUT" + - "set as-path prepend {{ sonic_config_asn }} {{ sonic_config_asn }}" + croit: vrf: Vrf1560 vni: 1560 diff --git a/partition/roles/sonic-config/test/data/leaf/frr.conf b/partition/roles/sonic-config/test/data/leaf/frr.conf index 12f616338..4e323bdbc 100644 --- a/partition/roles/sonic-config/test/data/leaf/frr.conf +++ b/partition/roles/sonic-config/test/data/leaf/frr.conf @@ -79,6 +79,10 @@ router bgp 4200000000 vrf Vrf46 neighbor EXTERNAL remove-private-AS all exit-address-family ! + address-family ipv6 unicast + neighbor EXTERNAL remove-private-AS all + exit-address-family + ! address-family l2vpn evpn advertise ipv4 unicast exit-address-family @@ -100,6 +104,9 @@ router bgp 4200000000 vrf Vrf64 neighbor STATIC route-map ALLOW-STATIC-IN in exit-address-family ! + address-family ipv6 unicast + exit-address-family + ! address-family l2vpn evpn advertise ipv4 unicast exit-address-family @@ -119,6 +126,9 @@ router bgp 4200000000 vrf Vrf65 neighbor STATICN route-map ALLOW-STATICN-IN in exit-address-family ! + address-family ipv6 unicast + exit-address-family + ! address-family l2vpn evpn advertise ipv4 unicast exit-address-family From dfc200f6b94dc0514ec62f686c3c29db566a5a2e Mon Sep 17 00:00:00 2001 From: mreiger Date: Tue, 16 Jun 2026 17:59:34 +0200 Subject: [PATCH 2/4] Also advertise ipv6 unicast into evpn --- partition/roles/sonic-config/templates/frr.conf.j2 | 1 + partition/roles/sonic-config/test/data/exit/frr.conf | 3 +++ partition/roles/sonic-config/test/data/leaf/frr.conf | 3 +++ 3 files changed, 7 insertions(+) diff --git a/partition/roles/sonic-config/templates/frr.conf.j2 b/partition/roles/sonic-config/templates/frr.conf.j2 index 0ebb8b61e..8ed24b111 100644 --- a/partition/roles/sonic-config/templates/frr.conf.j2 +++ b/partition/roles/sonic-config/templates/frr.conf.j2 @@ -220,6 +220,7 @@ router bgp {{ sonic_config_asn }} vrf {{ i.vrf }} ! address-family l2vpn evpn advertise ipv4 unicast + advertise ipv6 unicast exit-address-family ! {% endif %} diff --git a/partition/roles/sonic-config/test/data/exit/frr.conf b/partition/roles/sonic-config/test/data/exit/frr.conf index 030f1e5c4..8c6a21281 100644 --- a/partition/roles/sonic-config/test/data/exit/frr.conf +++ b/partition/roles/sonic-config/test/data/exit/frr.conf @@ -94,6 +94,7 @@ router bgp 4200000000 vrf VrfMpls ! address-family l2vpn evpn advertise ipv4 unicast + advertise ipv6 unicast exit-address-family ! router bgp 4200000000 vrf VrfInternet @@ -126,6 +127,7 @@ router bgp 4200000000 vrf VrfInternet ! address-family l2vpn evpn advertise ipv4 unicast + advertise ipv6 unicast exit-address-family ! router bgp 4200000000 vrf Vrf1560 @@ -148,6 +150,7 @@ router bgp 4200000000 vrf Vrf1560 ! address-family l2vpn evpn advertise ipv4 unicast + advertise ipv6 unicast exit-address-family ! ip prefix-list MPLS_PREFIX_IN seq 10 permit 10.0.0.0/8 diff --git a/partition/roles/sonic-config/test/data/leaf/frr.conf b/partition/roles/sonic-config/test/data/leaf/frr.conf index 4e323bdbc..fc865a687 100644 --- a/partition/roles/sonic-config/test/data/leaf/frr.conf +++ b/partition/roles/sonic-config/test/data/leaf/frr.conf @@ -85,6 +85,7 @@ router bgp 4200000000 vrf Vrf46 ! address-family l2vpn evpn advertise ipv4 unicast + advertise ipv6 unicast exit-address-family ! router bgp 4200000000 vrf Vrf64 @@ -109,6 +110,7 @@ router bgp 4200000000 vrf Vrf64 ! address-family l2vpn evpn advertise ipv4 unicast + advertise ipv6 unicast exit-address-family ! router bgp 4200000000 vrf Vrf65 @@ -131,6 +133,7 @@ router bgp 4200000000 vrf Vrf65 ! address-family l2vpn evpn advertise ipv4 unicast + advertise ipv6 unicast exit-address-family ! ip prefix-list STATIC_PREFIX_IN seq 10 permit 10.64.64.0/22 ge 32 From c34c56712e5d0fe39783bed3ddd8a5515c6f4775 Mon Sep 17 00:00:00 2001 From: mreiger Date: Tue, 14 Jul 2026 13:01:37 +0200 Subject: [PATCH 3/4] Pacify ansible-lint --- partition/roles/sonic-config/test/data/exit/input.yaml | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/partition/roles/sonic-config/test/data/exit/input.yaml b/partition/roles/sonic-config/test/data/exit/input.yaml index 12fc97c28..0b6b9e82d 100644 --- a/partition/roles/sonic-config/test/data/exit/input.yaml +++ b/partition/roles/sonic-config/test/data/exit/input.yaml @@ -62,7 +62,7 @@ sonic_config_interconnects: extended_neighbors: - ip: "172.17.146.177" families: - - v4 + - v4 routemap_in: name: "ALLOW-INTERNET-2-IN" entries: @@ -75,7 +75,7 @@ sonic_config_interconnects: - "set as-path prepend {{ sonic_config_asn }} {{ sonic_config_asn }}" - ip: "172.17.146.161" families: - - v4 + - v4 routemap_in: name: "ALLOW-INTERNET-4-IN" entries: @@ -88,15 +88,15 @@ sonic_config_interconnects: - "set as-path prepend {{ sonic_config_asn }} {{ sonic_config_asn }} {{ sonic_config_asn }} {{ sonic_config_asn }}" - ip: "2a02:c00:ff0:102::1" families: - - v6 + - v6 routemap_in: name: "ALLOW-V6INTERNET-2-IN" entries: - "match ip address prefix-list V6INTERNET_PREFIX_IN" - "set as-path prepend last-as 2" routemap_out: - name: "ALLOW-V6INTERNET-2-OUT" - entries: + name: "ALLOW-V6INTERNET-2-OUT" + entries: - "match ip address prefix-list V6INTERNET_PREFIX_OUT" - "set as-path prepend {{ sonic_config_asn }} {{ sonic_config_asn }}" From 57e6518b01f125a2dec352687953f00ba3b9be9d Mon Sep 17 00:00:00 2001 From: mreiger Date: Wed, 15 Jul 2026 11:05:05 +0200 Subject: [PATCH 4/4] Adjust tests for proper ipv6 prefix-list configuration --- partition/roles/sonic-config/test/data/exit/frr.conf | 8 ++++---- partition/roles/sonic-config/test/data/exit/input.yaml | 8 ++++---- 2 files changed, 8 insertions(+), 8 deletions(-) diff --git a/partition/roles/sonic-config/test/data/exit/frr.conf b/partition/roles/sonic-config/test/data/exit/frr.conf index da0fb90a2..10a76fd66 100644 --- a/partition/roles/sonic-config/test/data/exit/frr.conf +++ b/partition/roles/sonic-config/test/data/exit/frr.conf @@ -166,8 +166,8 @@ ip prefix-list INTERNET_PREFIX_IN seq 10 permit 0.0.0.0/0 ip prefix-list INTERNET_PREFIX_OUT seq 10 permit 185.153.67.0/24 ge 32 ip prefix-list INTERNET_PREFIX_OUT seq 11 permit 212.34.85.0/24 ge 32 ip prefix-list INTERNET_PREFIX_OUT seq 12 permit 212.34.89.0/24 ge 32 -ip prefix-list V6INTERNET_PREFIX_IN seq 10 permit ::0/0 -ip prefix-list V6INTERNET_PREFIX_OUT seq 10 permit 2a02:c00:2f:ff00::/56 ge 128 +ipv6 prefix-list V6INTERNET_PREFIX_IN seq 10 permit ::0/0 +ipv6 prefix-list V6INTERNET_PREFIX_OUT seq 10 permit 2a02:c00:2f:ff00::/56 ge 128 ! route-map ALLOW-INTERNET-2-IN permit 10 match ip address prefix-list INTERNET_PREFIX_IN @@ -186,11 +186,11 @@ route-map ALLOW-INTERNET-4-OUT permit 20 set as-path prepend 4200000000 4200000000 4200000000 4200000000 ! route-map ALLOW-V6INTERNET-2-IN permit 10 - match ip address prefix-list V6INTERNET_PREFIX_IN + match ipv6 address prefix-list V6INTERNET_PREFIX_IN set as-path prepend last-as 2 ! route-map ALLOW-V6INTERNET-2-OUT permit 20 - match ip address prefix-list V6INTERNET_PREFIX_OUT + match ipv6 address prefix-list V6INTERNET_PREFIX_OUT set as-path prepend 4200000000 4200000000 ! ip prefix-list Vrf1560-IN seq 10 permit 10.0.0.0/16 diff --git a/partition/roles/sonic-config/test/data/exit/input.yaml b/partition/roles/sonic-config/test/data/exit/input.yaml index 0b6b9e82d..6f1e6457c 100644 --- a/partition/roles/sonic-config/test/data/exit/input.yaml +++ b/partition/roles/sonic-config/test/data/exit/input.yaml @@ -57,8 +57,8 @@ sonic_config_interconnects: - "ip prefix-list INTERNET_PREFIX_OUT seq 10 permit 185.153.67.0/24 ge 32" - "ip prefix-list INTERNET_PREFIX_OUT seq 11 permit 212.34.85.0/24 ge 32" - "ip prefix-list INTERNET_PREFIX_OUT seq 12 permit 212.34.89.0/24 ge 32" - - "ip prefix-list V6INTERNET_PREFIX_IN seq 10 permit ::0/0" - - "ip prefix-list V6INTERNET_PREFIX_OUT seq 10 permit 2a02:c00:2f:ff00::/56 ge 128" + - "ipv6 prefix-list V6INTERNET_PREFIX_IN seq 10 permit ::0/0" + - "ipv6 prefix-list V6INTERNET_PREFIX_OUT seq 10 permit 2a02:c00:2f:ff00::/56 ge 128" extended_neighbors: - ip: "172.17.146.177" families: @@ -92,12 +92,12 @@ sonic_config_interconnects: routemap_in: name: "ALLOW-V6INTERNET-2-IN" entries: - - "match ip address prefix-list V6INTERNET_PREFIX_IN" + - "match ipv6 address prefix-list V6INTERNET_PREFIX_IN" - "set as-path prepend last-as 2" routemap_out: name: "ALLOW-V6INTERNET-2-OUT" entries: - - "match ip address prefix-list V6INTERNET_PREFIX_OUT" + - "match ipv6 address prefix-list V6INTERNET_PREFIX_OUT" - "set as-path prepend {{ sonic_config_asn }} {{ sonic_config_asn }}" croit: