nested_policies - bstoll/featureprofiles GitHub Wiki
- A policy calling another policy to be attached to a neighbor's import-policy
- A policy calling another policy to be attached to a neighbor's export-policy
- Applicable to both IPv4 and IPv6 BGP neighbors
- Single level nesting is sufficient
For each section of configuration below, prepare a gnmi.SetBatch with all the configuration items appended to one SetBatch. Then apply the configuration to the DUT in one gnmi.Set using the replace
option
- Connect DUT port-1, 2 to ATE port-1, 2
- Configure IPv4/IPv6 addresses on the ports
- Create an IPv4 networks i.e.
ipv4-network-1 = 192.168.10.0/24
attached to ATE port-1 - Create an IPv6 networks i.e.
ipv6-network-1 = 2024:db8:128:128::/64
attached to ATE port-1 - Create an IPv4 networks i.e.
ipv4-network-2 = 192.168.20.0/24
attached to ATE port-2 - Create an IPv6 networks i.e.
ipv6-network-2 = 2024:db8:64:64::/64
attached to ATE port-2 - Configure IPv4 and IPv6 eBGP between DUT Port-1 and ATE Port-1
- Note: Nested policies will be applied to this eBGP session later in the test to validate the results
- /network-instances/network-instance/protocols/protocol/bgp/global/config
- /network-instances/network-instance/protocols/protocol/bgp/global/afi-safis/afi-safi/config/
- Advertise
ipv4-network-1 = 192.168.10.0/24
andipv6-network-1 = 2024:db8:128:128::/64
from ATE to DUT over the IPv4 and IPv6 eBGP session on port-1
- Configure IPv4 and IPv6 eBGP between DUT Port-2 and ATE Port-2
- Note: This eBGP session is only used to advertise prefixes to DUT and receive prefixes from DUT
- /network-instances/network-instance/protocols/protocol/bgp/global/config
- /network-instances/network-instance/protocols/protocol/bgp/global/afi-safis/afi-safi/config/
- Advertise
ipv4-network-2 = 192.168.20.0/24
andipv6-network-2 = 2024:db8:64:64::/64
from ATE to DUT over the IPv4 and IPv6 eBGP session on port-2 - Set default import and export policy to
NEXT_STATEMENT
for this eBGP session only- /network-instances/network-instance/protocols/protocol/bgp/neighbors/neighbor/afi-safis/afi-safi/apply-policy/config/default-import-policy
- /network-instances/network-instance/protocols/protocol/bgp/neighbors/neighbor/afi-safis/afi-safi/apply-policy/config/default-export-policy
- Configure an IPv4 route-policy definition with the name
lp-policy-v4
- /routing-policy/policy-definitions/policy-definition/config/name
- For routing-policy
lp-policy-v4
configure a statement with the namelp-statement-v4
- /routing-policy/policy-definitions/policy-definition/statements/statement/config/name
- For routing-policy
lp-policy-v4
statementlp-statement-v4
set policy-result asNEXT_STATEMENT
- /routing-policy/policy-definitions/policy-definition/statements/statement/actions/config/policy-result
- For routing-policy
lp-policy-v4
statementlp-statement-v4
set local-preference to200
- /routing-policy/policy-definitions/policy-definition/statements/statement/actions/bgp-actions/config/set-local-pref
- Configure an IPv4 route-policy definition with the name
match-policy-v4
- /routing-policy/policy-definitions/policy-definition/config/name
- For routing-policy
match-policy-v4
configure a statement with the namematch-statement-v4
- /routing-policy/policy-definitions/policy-definition/statements/statement/config/name
- For routing-policy
match-policy-v4
statementmatch-statement-v4
set policy-result asACCEPT_ROUTE
- /routing-policy/policy-definitions/policy-definition/statements/statement/actions/config/policy-result
- Configure a prefix-set with the name
prefix-set-v4
and modeIPV4
- /routing-policy/defined-sets/prefix-sets/prefix-set/config/name
- /routing-policy/defined-sets/prefix-sets/prefix-set/config/mode
- For prefix-set
prefix-set-v4
set the ip-prefix toipv4-network-1
i.e.192.168.10.0/24
and masklength toexact
- /routing-policy/defined-sets/prefix-sets/prefix-set/prefixes/prefix/config/ip-prefix
- /routing-policy/defined-sets/prefix-sets/prefix-set/prefixes/prefix/config/masklength-range
- For routing-policy
match-policy-v4
statementmatch-statement-v4
set match options toANY
- /routing-policy/policy-definitions/policy-definition/statements/statement/conditions/match-prefix-set/config/match-set-options
- For routing-policy
match-policy-v4
statementmatch-statement-v4
set prefix set toprefix-set-v4
- /routing-policy/policy-definitions/policy-definition/statements/statement/conditions/match-prefix-set/config/prefix-set
- For routing-policy
lp-policy-v4
call the policymatch-policy-v4
- /routing-policy/policy-definitions/policy-definition/statements/statement/conditions/config/call-policy
- Set default import policy to
REJECT_ROUTE
(Note: even though this is the OC default, the DUT should still accept this configuration)- /network-instances/network-instance/protocols/protocol/bgp/neighbors/neighbor/afi-safis/afi-safi/apply-policy/config/default-import-policy
- Apply the parent policy
lp-policy-v4
to the BGP neighbor- /network-instances/network-instance/protocols/protocol/bgp/neighbors/neighbor/afi-safis/afi-safi/apply-policy/config/import-policy
- Use gNMI
replace
to send the configuration to the DUT. - Use gNMI
subscribe
with modeonce
to retrieve the configurationstate
from the DUT. - Verify that the parent
lp-policy-v4
policy is successfully applied to the DUT BGP neighbor on ATE Port-1- /network-instances/network-instance/protocols/protocol/bgp/neighbors/neighbor/afi-safis/afi-safi/apply-policy/state/import-policy
- Verify that the parent
lp-policy-v4
policy has a child policymatch-policy-v4
attached- /routing-policy/policy-definitions/policy-definition/statements/statement/conditions/state/call-policy
- Validate that the DUT receives the prefix
ipv4-network-1
i.e.192.168.10.0/24
from BGP neighbor on ATE Port-1- /network-instances/network-instance/protocols/protocol/bgp/rib/afi-safis/afi-safi/ipv4-unicast/loc-rib/routes/route/prefix
- Validate that the prefix
ipv4-network-1
i.e.192.168.10.0/24
from BGP neighbor on ATE Port-1 has local preference set to 200- /network-instances/network-instance/protocols/protocol/bgp/rib/attr-sets/attr-set/state/med
- Initiate traffic from ATE Port-2 towards the DUT destined to
ipv4-network-1
i.e.192.168.10.0/24
- Validate that the traffic is received on ATE Port-1
- Configure an IPv4 route-policy definition with the name
asp-policy-v4
- /routing-policy/policy-definitions/policy-definition/config/name
- For routing-policy
asp-policy-v4
configure a statement with the nameasp-statement-v4
- /routing-policy/policy-definitions/policy-definition/statements/statement/config/name
- For routing-policy
asp-policy-v4
statementasp-statement-v4
set policy-result asNEXT_STATEMENT
- /routing-policy/policy-definitions/policy-definition/statements/statement/actions/config/policy-result
- For routing-policy
asp-policy-v4
statementasp-statement-v4
set AS-PATH prepend to the ASN of the DUT- /routing-policy/policy-definitions/policy-definition/statements/statement/actions/bgp-actions/set-as-path-prepend/config/asn
- Configure an IPv4 route-policy definition with the name
med-policy-v4
- /routing-policy/policy-definitions/policy-definition/config/name
- For routing-policy
med-policy-v4
configure a statement with the namemed-statement-v4
- /routing-policy/policy-definitions/policy-definition/statements/statement/config/name
- For routing-policy
med-policy-v4
statementmed-statement-v4
set policy-result asACCEPT_ROUTE
- /routing-policy/policy-definitions/policy-definition/statements/statement/actions/config/policy-result
- For routing-policy
med-policy-v4
statementmed-statement-v4
set MED to1000
- /routing-policy/policy-definitions/policy-definition/statements/statement/actions/bgp-actions/config/set-med
- For routing-policy
asp-policy-v4
attach the policymed-policy-v4
- /routing-policy/policy-definitions/policy-definition/statements/statement/conditions/config/call-policy
- Set default import policy to
REJECT_ROUTE
(Note: even though this is the OC default, the DUT should still accept this configuration)- /network-instances/network-instance/protocols/protocol/bgp/neighbors/neighbor/afi-safis/afi-safi/apply-policy/config/default-import-policy
- Apply the parent policy
asp-policy-v4
to the BGP neighbor- /network-instances/network-instance/protocols/protocol/bgp/neighbors/neighbor/afi-safis/afi-safi/apply-policy/config/import-policy
- Use gNMI
subscribe
with modeonce
to retrieve the configurationstate
from the DUT. - Verify that the parent
asp-policy-v4
policy is successfully applied to the DUT BGP neighbor on ATE Port-1- /network-instances/network-instance/protocols/protocol/bgp/neighbors/neighbor/afi-safis/afi-safi/apply-policy/state/import-policy
- Verify that the parent
asp-policy-v4
policy has a child policymed-policy-v4
attached- /routing-policy/policy-definitions/policy-definition/statements/statement/conditions/state/call-policy
- Validate that the ATE receives the prefix
ipv4-network-2
i.e.192.168.20.0/24
from BGP neighbor on DUT Port-1- /network-instances/network-instance/protocols/protocol/bgp/rib/afi-safis/afi-safi/ipv4-unicast/loc-rib/routes/route/prefix
- Validate that the prefix
ipv4-network-2
i.e.192.168.20.0/24
on ATE from BGP neighbor on DUT Port-1 has AS-PATH with the ASN of DUT occuring twice- /network-instances/network-instance/protocols/protocol/bgp/rib/attr-sets/attr-set/as-path/as-segment/state/member
- Validate that the prefix
ipv4-network-2
i.e.192.168.20.0/24
from BGP neighbor on DUT Port-1 has MED set to1000
- /network-instances/network-instance/protocols/protocol/bgp/rib/attr-sets/attr-set/state/med
- Initiate traffic from ATE Port-1 towards the DUT destined
ipv4-network-2
i.e.192.168.20.0/24
- Validate that the traffic is received on ATE Port-2
- Configure an IPv6 route-policy definition with the name
lp-policy-v6
- /routing-policy/policy-definitions/policy-definition/config/name
- For routing-policy
lp-policy-v6
configure a statement with the namelp-statement-v6
- /routing-policy/policy-definitions/policy-definition/statements/statement/config/name
- For routing-policy
lp-policy-v6
statementlp-statement-v6
set policy-result asNEXT_STATEMENT
- /routing-policy/policy-definitions/policy-definition/statements/statement/actions/config/policy-result
- For routing-policy
lp-policy-v6
statementlp-statement-v6
set local-preference to200
- /routing-policy/policy-definitions/policy-definition/statements/statement/actions/bgp-actions/config/set-local-pref
- Configure an IPv6 route-policy definition with the name
match-policy-v6
- /routing-policy/policy-definitions/policy-definition/config/name
- For routing-policy
match-policy-v6
configure a statement with the namematch-statement-v6
- /routing-policy/policy-definitions/policy-definition/statements/statement/config/name
- For routing-policy
match-policy-v6
statementmatch-statement-v6
set policy-result asACCEPT_ROUTE
- /routing-policy/policy-definitions/policy-definition/statements/statement/actions/config/policy-result
- Configure a prefix-set with the name
prefix-set-v6
and modeIPV6
- /routing-policy/defined-sets/prefix-sets/prefix-set/config/name
- /routing-policy/defined-sets/prefix-sets/prefix-set/config/mode
- For prefix-set
prefix-set-v6
set the ip-prefix toipv6-network-1
i.e.2024:db8:128:128::/64
and masklength toexact
- /routing-policy/defined-sets/prefix-sets/prefix-set/prefixes/prefix/config/ip-prefix
- /routing-policy/defined-sets/prefix-sets/prefix-set/prefixes/prefix/config/masklength-range
- For routing-policy
match-policy-v6
statementmatch-statement-v6
set match options toANY
- /routing-policy/policy-definitions/policy-definition/statements/statement/conditions/match-prefix-set/config/match-set-options
- For routing-policy
match-policy-v6
statementmatch-statement-v6
set prefix set toprefix-set-v6
- /routing-policy/policy-definitions/policy-definition/statements/statement/conditions/match-prefix-set/config/prefix-set
- For routing-policy
lp-policy-v6
call the policymatch-policy-v6
- /routing-policy/policy-definitions/policy-definition/statements/statement/conditions/config/call-policy
- Set default import policy to
REJECT_ROUTE
(Note: even though this is the OC default, the DUT should still accept this configuration)- /network-instances/network-instance/protocols/protocol/bgp/neighbors/neighbor/afi-safis/afi-safi/apply-policy/config/default-import-policy
- Apply the parent policy
lp-policy-v6
to the BGP neighbor- /network-instances/network-instance/protocols/protocol/bgp/neighbors/neighbor/afi-safis/afi-safi/apply-policy/config/import-policy
- Use gNMI
subscribe
with modeonce
to retrieve the configurationstate
from the DUT. - Verify that the parent
lp-policy-v6
policy is successfully applied to the DUT BGP neighbor on ATE Port-1- /network-instances/network-instance/protocols/protocol/bgp/neighbors/neighbor/afi-safis/afi-safi/apply-policy/state/import-policy
- Verify that the parent
lp-policy-v6
policy has a child policymatch-policy-v6
attached- /routing-policy/policy-definitions/policy-definition/statements/statement/conditions/state/call-policy
- Validate that the DUT receives the prefix
ipv6-network-1
i.e.2024:db8:128:128::/64
from BGP neighbor on ATE Port-1- /network-instances/network-instance/protocols/protocol/bgp/rib/afi-safis/afi-safi/ipv6-unicast/loc-rib/routes/route/prefix
- Validate that the prefix
ipv6-network-1
i.e.2024:db8:128:128::/64
from BGP neighbor on ATE Port-1 has local preference set to 200- /network-instances/network-instance/protocols/protocol/bgp/rib/attr-sets/attr-set/state/med
- Initiate traffic from ATE Port-2 towards the DUT destined to
ipv6-network-1
i.e.2024:db8:128:128::/64
- Validate that the traffic is received on ATE Port-1
- Configure an IPv6 route-policy definition with the name
asp-policy-v6
- /routing-policy/policy-definitions/policy-definition/config/name
- For routing-policy
asp-policy-v6
configure a statement with the nameasp-statement-v6
- /routing-policy/policy-definitions/policy-definition/statements/statement/config/name
- For routing-policy
asp-policy-v6
statementasp-statement-v6
set policy-result asNEXT_STATEMENT
- /routing-policy/policy-definitions/policy-definition/statements/statement/actions/config/policy-result
- For routing-policy
asp-policy-v6
statementasp-statement-v6
set AS-PATH prepend to the ASN of the DUT- /routing-policy/policy-definitions/policy-definition/statements/statement/actions/bgp-actions/set-as-path-prepend/config/asn
- Configure an IPv6 route-policy definition with the name
med-policy-v6
- /routing-policy/policy-definitions/policy-definition/config/name
- For routing-policy
med-policy-v6
configure a statement with the namemed-statement-v6
- /routing-policy/policy-definitions/policy-definition/statements/statement/config/name
- For routing-policy
med-policy-v6
statementmed-statement-v6
set policy-result asACCEPT_ROUTE
- /routing-policy/policy-definitions/policy-definition/statements/statement/actions/config/policy-result
- For routing-policy
med-policy-v6
statementmed-statement-v6
set MED to1000
- /routing-policy/policy-definitions/policy-definition/statements/statement/actions/bgp-actions/config/set-med
- For routing-policy
asp-policy-v6
call the policymed-policy-v6
- /routing-policy/policy-definitions/policy-definition/statements/statement/conditions/config/call-policy
- Set default import policy to
REJECT_ROUTE
(Note: even though this is the OC default, the DUT should still accept this configuration)- /network-instances/network-instance/protocols/protocol/bgp/neighbors/neighbor/afi-safis/afi-safi/apply-policy/config/default-import-policy
- Apply the parent policy
asp-policy-v6
to the BGP neighbor- /network-instances/network-instance/protocols/protocol/bgp/neighbors/neighbor/afi-safis/afi-safi/apply-policy/config/import-policy
- Use gNMI
subscribe
with modeonce
to retrieve the configurationstate
from the DUT. - Verify that the parent
asp-policy-v6
policy is successfully applied to the DUT BGP neighbor on ATE Port-1- /network-instances/network-instance/protocols/protocol/bgp/neighbors/neighbor/afi-safis/afi-safi/apply-policy/state/import-policy
- Verify that the parent
asp-policy-v6
policy has a child policymed-policy-v6
attached- /routing-policy/policy-definitions/policy-definition/statements/statement/conditions/state/call-policy
- Validate that the ATE receives the prefix
ipv6-network-2
i.e.2024:db8:64:64::/64
from BGP neighbor on DUT Port-1- /network-instances/network-instance/protocols/protocol/bgp/rib/afi-safis/afi-safi/ipv6-unicast/loc-rib/routes/route/prefix
- Validate that the prefix
ipv6-network-2
i.e.2024:db8:64:64::/64
on ATE from BGP neighbor on DUT Port-1 has AS-PATH with the ASN of DUT occuring twice- /network-instances/network-instance/protocols/protocol/bgp/rib/attr-sets/attr-set/as-path/as-segment/state/member
- Validate that the prefix
ipv6-network-2
i.e.2024:db8:64:64::/64
from BGP neighbor on DUT Port-1 has MED set to1000
- /network-instances/network-instance/protocols/protocol/bgp/rib/attr-sets/attr-set/state/med
- Initiate traffic from ATE Port-1 towards the DUT destined to
ipv6-network-1
i.e.2024:db8:64:64::/64
- Validate that the traffic is received on ATE Port-2
- /network-instances/network-instance/protocols/protocol/bgp/global/config
- /network-instances/network-instance/protocols/protocol/bgp/global/afi-safis/afi-safi/config/
- /routing-policy/policy-definitions/policy-definition/config/name
- /routing-policy/policy-definitions/policy-definition/statements/statement/config/name
- /routing-policy/policy-definitions/policy-definition/statements/statement/actions/config/policy-result
- /routing-policy/policy-definitions/policy-definition/statements/statement/conditions/config/call-policy
- /routing-policy/defined-sets/prefix-sets/prefix-set/config/name
- /routing-policy/defined-sets/prefix-sets/prefix-set/config/mode
- /routing-policy/defined-sets/prefix-sets/prefix-set/prefixes/prefix/config/ip-prefix
- /routing-policy/defined-sets/prefix-sets/prefix-set/prefixes/prefix/config/masklength-range
- /routing-policy/policy-definitions/policy-definition/statements/statement/conditions/match-prefix-set/config/match-set-options
- /routing-policy/policy-definitions/policy-definition/statements/statement/conditions/match-prefix-set/config/prefix-set
- /network-instances/network-instance/protocols/protocol/bgp/neighbors/neighbor/afi-safis/afi-safi/apply-policy/config/default-import-policy
- /network-instances/network-instance/protocols/protocol/bgp/neighbors/neighbor/afi-safis/afi-safi/apply-policy/config/import-policy
- /network-instances/network-instance/protocols/protocol/bgp/neighbors/neighbor/afi-safis/afi-safi/apply-policy/config/default-export-policy
- /network-instances/network-instance/protocols/protocol/bgp/neighbors/neighbor/afi-safis/afi-safi/apply-policy/config/export-policy
- /routing-policy/policy-definitions/policy-definition/statements/statement/conditions/state/call-policy
- /network-instances/network-instance/protocols/protocol/bgp/neighbors/neighbor/afi-safis/afi-safi/apply-policy/state/import-policy
- /network-instances/network-instance/protocols/protocol/bgp/neighbors/neighbor/afi-safis/afi-safi/apply-policy/state/export-policy
- /network-instances/network-instance/protocols/protocol/bgp/rib/attr-sets/attr-set/as-path/as-segment/state/member
- /network-instances/network-instance/protocols/protocol/bgp/rib/afi-safis/afi-safi/ipv6-unicast/loc-rib/routes/route/prefix
- /network-instances/network-instance/protocols/protocol/bgp/rib/afi-safis/afi-safi/ipv4-unicast/loc-rib/routes/route/prefix
- /network-instances/network-instance/protocols/protocol/bgp/rib/attr-sets/attr-set/state/med
rpcs:
gnmi:
gNMI.Get:
gNMI.Subscribe:
- vRX