@michmoor me too.

https://forum.netgate.com/topic/195542/i-from-24-0-3-upgrade-to-24-11-frr-bgp-service-can-t-start/9

it is should add the bgpd_options=" -A 127.0.0.1 -M rpki" in daemons.

@stephenw10 said in I from 24.0.3 upgrade to 24.11 FRR BGP service can't start:

How is it configured? Does it appear correctly in vtysh 'show run'?

no.

show run
Building configuration...

Current configuration:
!
Warning: connecting to mgmtd...success!
Warning: connecting to zebra...success!
Warning: connecting to bgpd...failed!
Warning: connecting to watchfrr...success!
Warning: connecting to bgpd...failed!
Warning: connecting to staticd...success!
Warning: connecting to bgpd...failed!
Warning: connecting to bgpd...failed!
Warning: connecting to bgpd...failed!
frr version 9.1.2
frr defaults traditional
hostname pf
log syslog
service integrated-vtysh-config
!
password
!
ipv6 prefix-list cymru-out-v6 seq 50 deny ::/0 le 128
ipv6 prefix-list ipv6in seq 95 deny fe80::/10 le 128
ipv6 prefix-list ipv6in seq 120 deny 3ffe::/16 le 128
ipv6 prefix-list ipv6in seq 125 deny 2001:db8::/32 le 128
ipv6 prefix-list ipv6in seq 130 deny 2001::/32
ipv6 prefix-list ipv6in seq 135 deny 2001::/32 le 128
ipv6 prefix-list ipv6in seq 140 permit 2002::/16
ipv6 prefix-list ipv6in seq 145 deny 2002::/16 le 128
ipv6 prefix-list ipv6in seq 155 deny fe00::/9 le 128
ipv6 prefix-list ipv6in seq 160 deny ff00::/8 le 128
ipv6 prefix-list ipv6in seq 205 permit 2000::/3 le 48
ipv6 prefix-list ipv6in seq 900 deny ::/0 le 128
ipv6 prefix-list ipv6in seq 999 deny any
ipv6 prefix-list myv6out description my ipv6 out
ipv6 prefix-list myv6out seq 50 permit
ipv6 prefix-list myv6out seq 55 permit
ipv6 prefix-list myv6out seq 60 permit
ipv6 prefix-list myv6out seq 65 permit
ipv6 prefix-list myv6out seq 75 permit
ipv6 prefix-list myv6out seq 80 permit
ipv6 prefix-list myv6out seq 85 permit
ipv6 prefix-list myv6out seq 999 deny any
!
route-map RPKI deny 20
exit
!
route-map RPKI permit 30
set metric 100
exit
!
route-map RPKI permit 50
set metric 0
exit
!
route-map ipv6routein permit 80
match ipv6 address prefix-list ipv6in
exit
!
end

@frijolierthnthou Were you able to solve this issue? I've been dealing with this same exact problem from the past 2 weeks

@michmoor said in BGP Routing Issue: Traffic Still Preferring Default Route Despite Prepending and MED Adjustments:

Are you doing any policy based routing? Setting a specific gateway in the firewall rules? Thats the only thing i can imagine that would bypass the route table.

There is no policy based routing or specific gateway in firewall rule. Only one default gateway present on both site routers. I would say it is just a basic BGP config. I just followed the example configuration from the netgate docs - https://docs.netgate.com/pfsense/en/latest/packages/frr/bgp/example.html

" stop advertising these routes if the LAN interface goes down as the virtual IPs use 1:1 NAT to route traffic to internal IPs."

If the physical interface goes down then the subnet reachable out of that interface will be withdrawn in route advertisements.
VIPs like loopbacks, are logical and are always UP.

@mcury It seemed like a bug to me as well but this is my first time doing this kind of configuration. I felt like I was going crazy or had done something wrong. Thanks for the response.

@swiss If the log entries do not provide sufficient detail, one thing you can do is run a packet canpture on the VPN interface vor TCP port 179 and use wireshark to show you exactly what is being sent that your side does not like. Then you have something to either accommodate in your configuration or ask the other side to stop doing.

@mAineAc No - you'd have to build/install it manually for the public dev build. I'm not aware of any official bug report for the issue you're experiencing. My suggestion is to treat it like any other bug report: provide steps to reproduce it, and determine if it's a regression by finding the version(s) of the related software when it last worked.

@marcosm Does this fix the issue with selecting the redistribute default always? Whether a default is present or not?

@mcury Yes. It's here.

@michmoor - Yes, disabling the firewall didn't solve the issues, but I don't want a router only without any firewalling capabilities exposed to the public internet.

@yon-0 I'm not sure about CE, but there is FRR 9.1 in the latest PFsense+ 24.3 release. What is your motivation for upgrading from FRR 9.0.2 to 9.1 in pfSense CE 2.7.2?

@michmoor Yes, this is it.

Actually, someone from frr seems to be assigned to it, however last ticket update was 6mo ago:

https://github.com/FRRouting/frr/issues/14875

At least it's recognized as a frr issue, how long after a potential fix until that arrives in pfsense however is another story.

Regards
Thomas

@centromere We have the same problem, is there already a solution?
I have to correct myself a little, the error is just similar. It seems that the frr is running though. We also see briefly how the bgp router is set up

42232 - Ss 0:18.86 /usr/local/sbin/watchfrr -d -r /usr/local/etc/rc.d/frrbBrestartbB%s -s /usr/local/etc/rc.d/frrbBstartbB%s -k /usr/local/etc/rc.d/frrbBstopbB%s -b bB -t 30 zebra mgmtd staticd bgpd frr-reload.py /var/etc/frr/frr.conf --reload [78701|mgmtd] sending configuration [78923|zebra] sending configuration [79902|bgpd] sending configuration [81349|watchfrr] sending configuration [81506|staticd] sending configuration Waiting for children to finish applying config... [78701|mgmtd] done [79902|bgpd] done [81349|watchfrr] done [78923|zebra] done [81506|staticd] done [83692|mgmtd] sending configuration [83752|zebra] sending configuration [84958|bgpd] sending configuration [86227|watchfrr] sending configuration [86505|staticd] sending configuration Waiting for children to finish applying config... [84958|bgpd] done [83692|mgmtd] done [86505|staticd] done [83752|zebra] done [86227|watchfrr] done cat /var/log/frr/frr-reload.log 2024-05-30 07:23:52,336 INFO: /var/run/frr/reload-5VBEZR.txt content ['router bgp 65000\n' ' address-family ipv4 unicast\n' ' neighbor 169.254.185.105 activate\n' ' exit\n' 'exit\n', 'router bgp 65000\n' ' address-family ipv4 unicast\n' ' neighbor 169.254.146.9 activate\n' ' exit\n' 'exit\n', 'line vty\nexit\n', 'router bgp 65000\n' ' address-family ipv4 unicast\n' ' neighbor 169.254.185.105 activate\n' ' exit\n' 'exit\n', 'router bgp 65000\n' ' address-family ipv4 unicast\n' ' neighbor 169.254.146.9 activate\n' ' exit\n' 'exit\n', 'line vty\nexit\n']

@michmoor thanks for your time