Maniphest T340111

Configure bgp-error-tolerance on Juniper routers
Closed, ResolvedPublic
Actions

Assigned To

Authored By

	ayounsi
	Jun 22 2023, 12:44 PM

Tags

Referenced Files

None

Subscribers

MoritzMuehlenhoff

Description

To workaround {T340095} and possible future issues. At least on the external facing sessions but seems safe to have it on all of them.

https://www.juniper.net/documentation/us/en/software/junos/bgp/topics/ref/statement/bgp-error-tolerance.html
https://www.juniper.net/documentation/us/en/software/junos/bgp/topics/topic-map/bgp-error-messages.html

Details

	Subject	Repo	Branch	Lines +/-
	cr: set bgp-error-tolerance on all sessions	operations/homer/public	master	+1 -0

Customize query in gerrit

Event Timeline

ayounsi created this task.Jun 22 2023, 12:44 PM

Restricted Application added a project: Infrastructure-Foundations. · View Herald TranscriptJun 22 2023, 12:44 PM

Restricted Application added a subscriber: Aklapper. · View Herald Transcript

Maintenance_bot added a project: SRE.Jun 22 2023, 12:45 PM

ayounsi moved this task from Backlog to Next quarter on the netops board.Jun 22 2023, 12:45 PM

ayounsi moved this task from Next quarter to This quarter on the netops board.Jul 11 2023, 9:00 AM

FYI, same mitigation applies to https://supportportal.juniper.net/s/article/2023-08-29-Out-of-Cycle-Security-Bulletin-Junos-OS-and-Junos-OS-Evolved-A-crafted-BGP-UPDATE-message-allows-a-remote-attacker-to-de-peer-reset-BGP-sessions-CVE-2023-4481?language=en_US, released yesterday

Change 953509 had a related patch set uploaded (by Ayounsi; author: Ayounsi):

[operations/homer/public@master] cr: set bgp-error-tolerance on all sessions

https://gerrit.wikimedia.org/r/953509

gerritbot added a project: Patch-For-Review.Aug 30 2023, 6:07 AM

cmooney subscribed.Aug 30 2023, 8:33 AM

Change 953509 merged by jenkins-bot:

[operations/homer/public@master] cr: set bgp-error-tolerance on all sessions

https://gerrit.wikimedia.org/r/953509

cmooney added a comment.Aug 30 2023, 8:34 AM

This comment was removed by cmooney.

Mentioned in SAL (#wikimedia-operations) [2023-08-30T08:38:51Z] <XioNoX> set bgp-error-tolerance on all sessions - T340111

Maintenance_bot removed a project: Patch-For-Review.Aug 30 2023, 9:10 AM

All done.

Relevant: https://blog.benjojo.co.uk/post/bgp-path-attributes-grave-error-handling