Skip to content

CS4.20.1 ROUTED VPC BGP PEERS NOT CREATED #11827

Closed
Closed
CS4.20.1 ROUTED VPC BGP PEERS NOT CREATED#11827

Description

@tatay188
tatay188
opened on Oct 12, 2025

problem

  1. the VC is under a subdomain mydomain, and under a project.
  2. use.system.bgp.peers is set to true.
  3. BGP peers are set under the zone, and are not dedicated to any account or domain.

and the VPC BGP shows :

Image

there are no BGP peers

Should this work under a subdomain ?
IF Yes, Should I configure the BGP peerings manually on the Vrouter? If Yes, How as the Subdomain does not have visibility over the VROUTER.

Thank you

versions

ACS 4.20.1

The steps to reproduce the bug

  1. the VC is under a subdomain mydomain, and under a project.
  2. use.system.bgp.peers is set to true.
  3. BGP peers are set under the zone, and are not dedicated to any account or domain.

What to do about it?

No response

Activity

  1. weizhouapache commented on Oct 12, 2025

    @weizhouapache
    weizhouapache
    on Oct 12, 2025
    Member

    @tatay188
    It is expected.

    Can you check frr config in VR ?
    It should connect to all BGP peers.

  2. tatay188 commented on Oct 12, 2025

    @tatay188
    tatay188
    on Oct 12, 2025
    Author

    @weizhouapache

    Only root have access to the VR:
    And No, there is no BGP configured.

    Image Image

  3. weizhouapache commented on Oct 12, 2025

    @weizhouapache
    weizhouapache
    on Oct 12, 2025
    Member

    @weizhouapache

    Only root have access to the VR:
    And No, there is no BGP configured.

    Image Image

    @tatay188
    have you created a vpc tier and vms in the vpc ?

  4. tatay188 commented on Oct 12, 2025

    @tatay188
    tatay188
    on Oct 12, 2025
    Author

    @weizhouapache
    VPC tier was created but nothing happened until I added the VM, then

    Image

    BGP not coming up

    Suggestion for Functionality: The VR created the BGP peers, But for pretty much any infrastructure the Multihop should be added with at least 5 hops that way covers most of the possibilities; knowing that, as a subdomain do not have access to the VR.

    Where can I modify the VR, then each time the VR is modified or restarted the BGP-multihop configuration remains?

  5. weizhouapache commented on Oct 13, 2025

    @weizhouapache
    weizhouapache
    on Oct 13, 2025
    Member

    Suggestion for Functionality: The VR created the BGP peers, But for pretty much any infrastructure the Multihop should be added with at least 5 hops that way covers most of the possibilities; knowing that, as a subdomain do not have access to the VR.

    Where can I modify the VR, then each time the VR is modified or restarted the BGP-multihop configuration remains?

    You can update BGP peer details by cloudmonkey/cmk, or insert a record in bgp_peer_details

    cmk update bgppeer id=xxxxx details[0].EBGP_MultiHop=5

    a line will be added in frr configuration

    neighbor 1.2.3.4 ebgp-multihop 5

    is it what you needed ?

  6. tatay188 commented on Oct 13, 2025

    @tatay188
    tatay188
    on Oct 13, 2025
    Author

    @weizhouapache
    Apologies; but No, is not what I need.
    I added a line manually in the FRR as a root admin; however, this needs to be done by the domain administrator not by the root admin - If the cloud operator is serving multiple companies - We can't use CMK, We will not use CMK as it does not pass security for our requirements.

    Is there a UI where I can add the bgp_peer_details ? I look everywhere !

  7. weizhouapache commented on Oct 13, 2025

    @weizhouapache
    weizhouapache
    on Oct 13, 2025
    Member

    @weizhouapache Apologies; but No, is not what I need. I added a line manually in the FRR as a root admin; however, this needs to be done by the domain administrator not by the root admin - If the cloud operator is serving multiple companies - We can't use CMK, We will not use CMK as it does not pass security for our requirements.

    Is there a UI where I can add the bgp_peer_details ? I look everywhere !

    what I mean is, is the configuration what you needed ?

    the BGP peer details can not be updated on UI, it can only be done via cloudmonkey
    once it is added, no other actions needed for domain admins, except reapplying/updating the BGP peers of the networks.

  8. tatay188 commented on Oct 15, 2025

    @tatay188
    tatay188
    on Oct 15, 2025
    Author

    @weizhouapache
    All BGP is up and running, and works !!!

    1. Manual config of vROUTER: I configured the vRouter manually as a ROOT Admin - that is going to be a burden for Subdomain customers and for the CS administrators:
    2. Dynamic vROUTER Script: What script takes care of the vRouter Dynamic config? then I can make standard for our deployments, I have to add several lines.
    3. Router infrastructure configuration: Any tool you recommend to configure the router from cloudstack - I have to add only one line on each router, but wan it to make automatic.
    4. Subdomain Project BGP peers not visible: Seems cosmetic, Maybe this is intended, and only domain admins should be able to see the BGP peers. Please let me know However under the Subdomain - Dynamic routed Project the BGP peers are empty:

    Image

    Let me know if you want me to make some additional tests, that does not involve APIs.

  9. weizhouapache commented on Oct 15, 2025

    @weizhouapache
    weizhouapache
    on Oct 15, 2025
    Member

    @weizhouapache All BGP is up and running, and works !!!

    1. Manual config of vROUTER: I configured the vRouter manually as a ROOT Admin - that is going to be a burden for Subdomain customers and for the CS administrators: 2. Dynamic vROUTER Script: What script takes care of the vRouter Dynamic config? then I can make standard for our deployments, I have to add several lines. 3. Router infrastructure configuration: Any tool you recommend to configure the router from cloudstack - I have to add only one line on each router, but wan it to make automatic. 4. Subdomain Project BGP peers not visible: Seems cosmetic, Maybe this is intended, and only domain admins should be able to see the BGP peers. Please let me know However under the Subdomain - Dynamic routed Project the BGP peers are empty:

    what manual configuration have you made inside the VR ?

    the frr configuration is generated by a python script: https://github.com/apache/cloudstack/blob/main/systemvm/debian/opt/cloud/bin/cs/CsBgpPeers.py
    if you make some changes in the script, you need to update /usr/share/cloudstack-common/vms/cloud-scripts.tgz on hosts or mgmt servers (if you use vmware)

    the table lists the BGP peers associated to the VPC, by default it is empty. the configuration is described on the UI

    Please note, if no BGP peers are selected, the VR will connect to
(1) dedicated BGP peers the owner can access, if the owner has dedicated BGP peers and account setting use.system.bgp.peers is set to false;
(2) all BGP peers the owner can access, otherwise.

    Only root admin can change BGP peers for network and VPC.

  10. tatay188 commented on Oct 15, 2025

    @tatay188
    tatay188
    on Oct 15, 2025
    Author

    @weizhouapache totally Agree with this part "Only root admin can change BGP peers for network and VPC."

    The point for the table is its not showing any data even though BGP is up and running. Questions is: Should it show Any data ? remember our scenario is a Subdomain and a project inside the Subdomain.

  11. tatay188 commented on Oct 17, 2025

    @tatay188
    tatay188
    on Oct 17, 2025
    Author

    @weizhouapache @DaanHoogland

    Will be great to have the Chance to add a New Tier on the VPC that is not tied to the initial segment, I need to add a Tier but keep it using RFC1918 for the backend, not routed.

    This will be awesome if possible - I can using a VNF, but makes no sense to add more Network elements in my case.

    Thank you

  12. weizhouapache commented on Oct 17, 2025

    @weizhouapache
    weizhouapache
    on Oct 17, 2025
    Member

    @weizhouapache @DaanHoogland

    Will be great to have the Chance to add a New Tier on the VPC that is not tied to the initial segment, I need to add a Tier but keep it using RFC1918 for the backend, not routed.

    VPC tier cidr must be in the VPC cidr - this is not changable.

    This will be awesome if possible - I can using a VNF, but makes no sense to add more Network elements in my case.

    Thank you

  13. apache
    locked and limited conversation to collaborators on Oct 30, 2025
  14. DaanHoogland
    converted this issue into a discussion #11938 on Oct 30, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions