Troubleshooting connectivity in BGP/Quagga/Docker lab

Question

I have created a virtual networking lab to test BGP routing. The lab is made up of two Debian Docker images which serve as end users and two images running Alpine Linux with Quagga to serve as the routers. The lab has the following architecture:

The containers have the following network configurations (loopbacks excluded):

PC1# ip addr && ip route show:

57: eth0@if58: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default 
    link/ether 02:42:ac:13:00:03 brd ff:ff:ff:ff:ff:ff link-netnsid 0
    inet 172.19.0.3/16 brd 172.19.255.255 scope global eth0
       valid_lft forever preferred_lft forever
default via 172.19.0.2 dev eth0 
172.19.0.0/16 dev eth0 proto kernel scope link src 172.19.0.3 

PC2# ip addr && ip route show:

62: eth0@if63: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default 
    link/ether 02:42:ac:14:00:03 brd ff:ff:ff:ff:ff:ff link-netnsid 0
    inet 172.20.0.3/16 brd 172.20.255.255 scope global eth0
       valid_lft forever preferred_lft forever
default via 172.20.0.2 dev eth0 
172.20.0.0/16 dev eth0 proto kernel scope link src 172.20.0.3

R1# ip addr && ip route show:

17: eth0@if18: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default 
    link/ether 02:42:ac:12:00:02 brd ff:ff:ff:ff:ff:ff
    inet 172.18.0.2/16 brd 172.18.255.255 scope global eth0
       valid_lft forever preferred_lft forever
49: eth3@if50: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default 
    link/ether 02:42:ac:13:00:02 brd ff:ff:ff:ff:ff:ff
    inet 172.19.0.2/16 brd 172.19.255.255 scope global eth3
       valid_lft forever preferred_lft forever
default via 172.18.0.1 dev eth0 
172.18.0.0/16 dev eth0  proto kernel  scope link  src 172.18.0.2 
172.19.0.0/16 dev eth3  proto kernel  scope link  src 172.19.0.2 

R2# ip addr && ip route show:

43: eth0@if44: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default 
    link/ether 02:42:ac:12:00:03 brd ff:ff:ff:ff:ff:ff
    inet 172.18.0.3/16 brd 172.18.255.255 scope global eth0
       valid_lft forever preferred_lft forever
60: eth1@if61: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default 
    link/ether 02:42:ac:14:00:02 brd ff:ff:ff:ff:ff:ff
    inet 172.20.0.2/16 brd 172.20.255.255 scope global eth1
       valid_lft forever preferred_lft forever
default via 172.18.0.1 dev eth0 
172.18.0.0/16 dev eth0  proto kernel  scope link  src 172.18.0.3 
172.20.0.0/16 dev eth1  proto kernel  scope link  src 172.20.0.2 

R1# show running-config:

Current configuration:
!
hostname R1
password xxx
!
router bgp 65530
 bgp router-id 172.19.0.2
 network 172.19.0.0/16
 neighbor 172.18.0.3 remote-as 65531
!
line vty
!
end

R2# show running-config:

Current configuration:
!
hostname R2
password xxx
!
router bgp 65531
 bgp router-id 172.20.0.2
 network 172.20.0.0/16
 neighbor 172.18.0.2 remote-as 65530
!
line vty
!

R1> show ip bgp:

BGP table version is 0, local router ID is 172.19.0.2
Status codes: s suppressed, d damped, h history, * valid, > best, = multipath,
              i internal, r RIB-failure, S Stale, R Removed
Origin codes: i - IGP, e - EGP, ? - incomplete

   Network          Next Hop            Metric LocPrf Weight Path
*> 172.19.0.0       0.0.0.0                  0         32768 i
*> 172.20.0.0       172.18.0.3               0             0 65531 i

Total number of prefixes 2

R2> show ip bgp:

BGP table version is 0, local router ID is 172.20.0.2
Status codes: s suppressed, d damped, h history, * valid, > best, = multipath,
              i internal, r RIB-failure, S Stale, R Removed
Origin codes: i - IGP, e - EGP, ? - incomplete

   Network          Next Hop            Metric LocPrf Weight Path
*> 172.19.0.0       172.18.0.2               0             0 65530 i
*> 172.20.0.0       0.0.0.0                  0         32768 i

Total number of prefixes 2

The problem is that PC1 has no connectivity (cannot ping) to R2 or PC2, and vice-versa. Note that:

• R1_container can ping 172.18.0.3.
• PC1 can ping 172.18.0.2.
• PC1 cannot ping 172.18.0.3.
• PC1 cannot ping 172.20.0.3.

What changes must be made?

Answer 1

Enabling logging in Zebra and in the BGPD and issuing a BGP reset provided important information about my problem:

2019/10/08 09:42:00 ZEBRA: netlink-cmd error: Operation not permitted, type=RTM_NEWROUTE(24), seq=7, pid=0 2019/10/08 09:43:07 ZEBRA: netlink-cmd error: Operation not permitted, type=RTM_NEWROUTE(24), seq=8, pid=0

I believe what was happening is that Quagga did not have permissions to add the routes learned from BGP into its container's routing table. To resolve this, the containers were remade with the --cap-add NET_ADMIN switch and now they can add the routes to the routing table. Evidence of success:

PC1# ip route show:

default via 172.18.0.1 dev eth0 
172.18.0.0/16 dev eth0  proto kernel  scope link  src 172.18.0.2 
172.19.0.0/16 dev eth1  proto kernel  scope link  src 172.19.0.2 
172.20.0.0/16 via 172.18.0.3 dev eth0  proto zebra 

Answer 2

sudo docker run --privileged --cap-add NET_ADMIN --cap-add NET_BROADCAST -d -ti --name Q1 ubuntu:16.04

Use this option --privileged.

Because it needs to be modified to vim /etc/sysctl.conf,net.ipv4.ip_forward=1.

Execute sysctl -p after modification.

Use this option --cap-add NET_ADMIN and --cap-add NET_BROADCAST.

Because Quagga needs to have permission to modify the Routing table.

Hope this helps you.