For AI agents: the complete documentation index is available at https://docs.ovhcloud.com/en/llms.txt, the full documentation bundle is available at https://docs.ovhcloud.com/en/llms-full.txt, and this page is available as Markdown at https://docs.ovhcloud.com/en/guides/network/bgp-service/bgp-service-config.md.

BGP Service configuration

View as Markdown

Find out how to order and configure BGP Service in vRack Services and set up BGP sessions to announce your public IP blocks with ECMP and fast failover

Objective

BGP Service allows you to build highly available infrastructures by running standard BGP (Border Gateway Protocol) straight from your OVHcloud hosts. Your hosts establish private BGP sessions with OVHcloud routers over your vRack and announce your public IP blocks, either OVHcloud Additional IPs or your own IP addresses imported with Bring Your Own IP (BYOIP).

BGP Service is an option of vRack Services: you order it, configure it and manage it from the BGP Service tab of your selected vRack Services.

This guide explains how to order and configure BGP Service, and how to set up the BGP sessions on your hosts.

Info

BGP Service is currently in Beta and is free of charge during this phase. At general availability, it will be billed at a flat monthly price. Features and limits may change before general availability.

Requirements

  • A vRack private network and a vRack Services in one of the available regions. If your vRack Services is not yet linked to a vRack, you can select or create one while ordering BGP Service.
  • The servers or instances that will take part in the BGP peering (Bare Metal servers, Hosted Private Cloud VMware on OVHcloud virtual machines or Public Cloud instances), connected to the vRack and directly connected to the subnet you will use for BGP.
  • At least one public IP block to announce: an Additional IP block, or your own IP block imported with Bring Your Own IP (BYOIP).
  • Knowledge of IP networking, of the BGP routing protocol and of Linux network settings.

How BGP Service works

BGP Service adds Layer 3 routing on top of your vRack Services:

  • BGP Service: one per vRack Services, therefore one per region for a given vRack. It holds the ASNs used on both sides of the BGP sessions and the list of public IP blocks you are allowed to announce.
  • BGP range: a small block of private addresses (a /28 for IPv4, a /124 for IPv6) carved from a subnet of your vRack Services, therefore used within a vRack private network. It contains the peering IPs used on both ends of the BGP sessions: 4 OVHcloud peering IPs and 1 to 4 customer peering IPs. You configure one BGP range for IPv4 and, if you announce IPv6 blocks, one for IPv6.
  • Public IP blocks: the Additional IP or BYOIP blocks that OVHcloud accepts from your BGP sessions. A block that is not on this list cannot be announced.

Each of your peering hosts establishes a BGP session with each of the 4 OVHcloud peering IPs and announces your public IP blocks over these sessions. OVHcloud propagates them to the Internet and, in return, advertises a default route to your hosts. When the same block is announced by several hosts, incoming traffic is distributed between them (ECMP). If a host stops announcing the block, its traffic is rerouted to the remaining hosts within a few seconds (around 4 seconds with BFD: 500 ms interval, 8x multiplier), without any call to the OVHcloud API.

Service capabilities

  • One BGP Service per vRack Services: a vRack Services is regional, and a vRack can be linked to only one vRack Services per region.
  • Subnet: IPv4 and/or IPv6 subnet of your vRack Services, also used for BGP Service. These subnets must be untagged (no VLAN) and cannot be changed once configured.
  • BGP range: defines the part of a customer private subnet used to address the OVHcloud and customer peering hosts (next hops) or Route Servers: /28 for IPv4, /124 for IPv6.
  • OVHcloud peering IPs: exactly 4 per IP version, derived from the BGP range.
  • Customer peering IPs: 1 to 4 BGP peers (a maximum of 10 next-hop hosts in total) derived from the BGP range. If you need more than 4 BGP peering hosts, deploy Route Servers (see the Advanced BGP configuration use case).
  • ASNs: private ASNs only, between 64512 and 65534 for both the customer ASN (64512 by default) and the OVHcloud ASN (65534 by default). The two values must be different. The ASNs are shared by the IPv4 and IPv6 configurations.
  • Public IP blocks: up to 50 blocks per IP version, of which up to 32 per IP version can be actively announced at any given time, across all your peers.
  • Public IP block sizes:
SourceIPv4IPv6
Additional IP/24 to /30/56
BYOIP/19 to /24/56 (a larger imported block must be split into /56 blocks)
  • Announcement sizes: you can announce a whole public IP block or any subset of it, down to /32 for IPv4 and /64 for IPv6.
  • Dedicated IP blocks: a public IP block can be added to only one BGP Service at a time. Only Additional IP blocks that are not associated with any other service (Dedicated Server, Public Cloud instance, etc.) can be selected.
  • Routes received: OVHcloud advertises a default route only.
  • Bandwidth: 5,000 Mbps per BGP Service.
  • Not supported: MD5 authentication of the BGP sessions, public ASNs and anycast announcements. OVHcloud ignores the BGP communities attached to the routes your hosts announce.
  • OVHcloud maintenance: before a maintenance on its side, OVHcloud may tag the routes it advertises with the GRACEFUL_SHUTDOWN community (RFC 8326).
  • BFD support: Bidirectional Forwarding Detection (BFD) is enabled by default on the OVHcloud side, with fixed settings (500 ms interval, 8x multiplier). To use BFD, configure your hosts to match these values.

Potential use cases

The BGP Service supports a wide range of custom networking architectures; the following examples highlight some of the most frequent implementations:

  • Run your own routing stack (FRR/Bird/VMware NSX, etc.) on Bare Metal or virtual routers and establish standard BGP sessions directly with OVHcloud Edges.
  • Build high‑availability frontends: use BGP to move IPs between multiple servers (active/active or active/passive) by changing BGP announcements, enabling fast failover actions.
  • Set up ECMP / multi-path routing between your hosts and the OVHcloud backbone to increase resilience across multiple servers or VMs.
  • Replace the Additional IP failover mechanism: keep the same Additional IP block, but announce it with BGP to fail over in seconds and serve traffic from several hosts at once.
  • Design multi-tenant service nodes by replacing L2 proxy-ARP with native L3 routing, where customer IP prefixes are routed through your infrastructure as the next hop.

Instructions

Step 1: Preparing your public IP blocks

You need to either buy an Additional IP block from OVHcloud or import your own IP block with BYOIP. To import your IPs, follow our BYOIP documentation.

The block must be in the same region as your vRack Services.

Warning

An Additional IP block used with BGP Service must not be associated with any service (for example a Bare Metal server). Leave it unassigned (in parking): only unassigned blocks are offered when you configure BGP Service.

Step 2: Preparing your vRack and vRack Services

BGP Service runs on a vRack Services, in the region where your hosts are located. If you do not have one yet, create a vRack Services in this region and link it to the vRack that contains your hosts (see our vRack Services guide).

Info

The public IP block does not need to be attached to the vRack: it is announced through the BGP sessions, not through the vRack.

Step 3: Ordering BGP Service


OVHcloud Console Access

  • Direct link:
  • Navigation path: Bare Metal Cloud > vRack Services

Select your vRack Services, open the BGP Service tab, then click Order a BGP Service.

On the Order a BGP Service page:

  • If your vRack Services is not yet linked to a vRack, select the vRack to use. Only the vRacks that are not already linked to another vRack Services in the same region are offered. To use a new vRack, click Order a vRack: once the vRack is created, it is selected automatically.
  • Check the order summary, then click Continue my order and complete your order.

Once your BGP Service is delivered, the BGP Service tab shows its information and its status, Draft, until you configure it.

Step 4: Configuring IPv4 for BGP Service

In the BGP Service tab, open IPv4 Configuration and click Configure IPv4.

Fill in the form:

FieldDescription
SubnetThe vRack Services subnet in which the BGP sessions run. Only untagged subnets can be used. If your vRack Services has no suitable subnet, click Create a subnet and enter a Name (optional) and an IP address range (CIDR). The subnet cannot be changed once the configuration is saved.
BGP rangeA /28 block within the selected subnet, for example 10.35.0.16/28. It must not overlap the service range used by your Service Endpoints in this subnet.
Customer private ASNThe ASN of your hosts, between 64512 and 65534. The default value is 64512.
Customer Peering IPs1 to 4 IP addresses within the BGP range, comma-separated. These are the private IPs of your hosts (or Route Servers) that establish the BGP sessions.
OVHcloud private ASNThe ASN of the OVHcloud routers, between 64512 and 65534. Defaults to 65534 and must be different from your private ASN.
OVHcloud Peering IPsExactly 4 IP addresses within the BGP range, comma-separated. These are the private IPs of the OVHcloud routers.
Public IP blocksThe IPv4 blocks you want to announce. The list shows your unassigned IP blocks located in the same region as your vRack Services.

Once you have entered a valid BGP range, the form suggests peering IPs (shown in grey) derived from it. For example, with the BGP range 10.35.0.16/28:

AddressesUsage
10.35.0.16Network address (reserved)
10.35.0.17 to 10.35.0.20OVHcloud Peering IPs
10.35.0.21 to 10.35.0.24Customer Peering IPs
10.35.0.25 to 10.35.0.30Unused
10.35.0.31Broadcast address (reserved)

Click Save.

Once the configuration is applied, the Service Status of your BGP Service changes to Ready. If it remains Draft, hover over the information icon next to the status to see what is missing: No BGP range declared or No public IP blocks declared.

Step 5: Configuring IPv6 for BGP Service (optional)

To announce IPv6 blocks, open IPv6 Configuration in the BGP Service tab and click Configure IPv6.

The form is the same as for IPv4, with the following differences:

  • The subnet is an IPv6 subnet with private ULA addresses (fd00::/8), for example fd00::/64.
  • The BGP range is a /124 block within this subnet, for example fd00::10/124.
  • The public IP blocks are IPv6 /56 blocks.
  • The Customer private ASN and OVHcloud private ASN are shared with the IPv4 configuration.

Click Save.

Step 6: Configuring BGP on your hosts

You can now set up the BGP sessions on your side, using the values displayed in the Configuration section of the BGP Service tab:

Value in the BGP Service tabParameter in the configuration examples
Customer private ASNCUSTOMER_ASN
OVHcloud private ASNOVHcloud_ASN
Customer Peering IPsHOST_IPV4 / HOST_IPV6 (or RS_IPV4 / RS_IPV6 for Route Servers)
OVHcloud Peering IPsEDGE_IPV4 / EDGE_IPV6
Public IP blocksCUSTOMER_PREFIX_V4 / CUSTOMER_PREFIX_V6

Each customer peering IP must be configured on a host (or Route Server) directly connected to the BGP subnet.

The following use cases walk you through two typical setups: load balancing with up to 4 hosts, and a setup with Route Servers for up to 10 hosts.

Info

OVHcloud is not responsible for the configuration of the BGP daemon on your hosts. It is your responsibility to configure the BGP daemon on your hosts. The configurations below are examples for your consideration.

Use case: Basic BGP configuration - load balancing using BGP ECMP

This design is suitable for setups with up to 4 BGP peering hosts, as the number of customer peering IPs is limited to 4. If you need more than 4 hosts, use the Advanced BGP configuration using Route Servers use case described below.

Below is a simple architecture that allows you to perform load balancing of your traffic on 3 hosts:

BGPaaS Basic Architecture

To achieve this setup, you need to install a BGP daemon, like FRR, on each host, and configure it.

Configuration parameters

In your router configuration files, replace the following parameters with the values of your BGP Service configuration.

ParameterDescription
OVHcloud_ASNPrivate ASN used on OVHcloud Edges (OVHcloud private ASN)
CUSTOMER_ASNPrivate ASN used on your hosts (Customer private ASN)
CUSTOMER_PREFIX_V4
CUSTOMER_PREFIX_V6
Public prefixes allocated for IPv4 and IPv6 usages (Public IP blocks)
EDGE_IPV4
EDGE_IPV6
OVHcloud Edge IP addresses in private/ULA range used for BGP peering and connectivity inside the vRack (OVHcloud Peering IPs)
HOST_IPV4
HOST_IPV6
Customer host IP addresses in private/ULA range used as BGP next hop and peer inside the vRack (Customer Peering IPs)

Configuring a BGP daemon (FRR)

To configure the BGP sessions using FRR, follow these next steps.

Step 1: Install FRR

On a Debian-based system, install FRR with:

sudo apt update && sudo apt install frr frr-pythontools

Step 2: Configure FRR

Info

All of the following parameters should be present in the /etc/frr/frr.conf configuration file of the hosts.

Prefix list and route map configuration
Info

The configuration below is a suggested setup to prevent any unexpected announcement between BGP peers.

In the following example:

  • Hosts only accept default routes from OVHcloud Edges.
  • Hosts advertise customer's prefixes to OVHcloud Edges.

Related prefix lists and route maps to filter routes:

ip prefix-list PL_DEFAULT_ROUTE_V4 seq 10 permit 0.0.0.0/0

ip prefix-list PL_CUSTOMER_PREFIX_V4 seq 10 permit <CUSTOMER_PREFIX_V4> ge <length>
... <other sequences may be added depending on the customer setup>

ipv6 prefix-list PL_DEFAULT_ROUTE_V6 seq 10 permit ::/0

ipv6 prefix-list PL_CUSTOMER_PREFIX_V6 seq 10 permit <CUSTOMER_PREFIX_V6> eq <length>
... <other sequences may be added depending on the customer setup>


route-map RM_EDGE_V4_OUT permit 10
  match ip address prefix-list PL_CUSTOMER_PREFIX_V4
route-map RM_EDGE_V4_IN permit 10
  match ip address prefix-list PL_DEFAULT_ROUTE_V4

route-map RM_EDGE_V6_OUT permit 10
  match ipv6 address prefix-list PL_CUSTOMER_PREFIX_V6
route-map RM_EDGE_V6_IN permit 10
  match ipv6 address prefix-list PL_DEFAULT_ROUTE_V6
BFD configuration
Info

The configuration below is a suggested setup to improve BGP convergence time between Host and Edges over vRack.

bfd
 profile edge
  detect-multiplier 8
  receive-interval 500
  transmit-interval 500

 peer <EDGE_IPV4>
  profile edge
  no shutdown
...
 peer <EDGE_IPV6>
  profile edge
  no shutdown
...
BGP configuration

Global configuration:

router bgp <CUSTOMER_ASN>
 bgp router-id <HOST_IPV4>
 no bgp default ipv4-unicast
 maximum-paths 16
 maximum-paths ibgp 16

BGP peering with OVHcloud Edge:

router bgp <CUSTOMER_ASN>
 neighbor PG_EDGE_V4 peer-group
 neighbor PG_EDGE_V4 remote-as <OVHcloud_ASN>
 neighbor PG_EDGE_V4 bfd
 neighbor PG_EDGE_V6 peer-group
 neighbor PG_EDGE_V6 remote-as <OVHcloud_ASN>
 neighbor PG_EDGE_V6 bfd
 neighbor <EDGE_IPV4> peer-group PG_EDGE_V4
...
 neighbor <EDGE_IPV6> peer-group PG_EDGE_V6
...

 address-family ipv4 unicast
  neighbor PG_EDGE_V4 activate
  neighbor PG_EDGE_V4 route-map RM_EDGE_V4_IN in
  neighbor PG_EDGE_V4 route-map RM_EDGE_V4_OUT out
 address-family ipv6 unicast
  neighbor PG_EDGE_V6 activate
  neighbor PG_EDGE_V6 route-map RM_EDGE_V6_IN in
  neighbor PG_EDGE_V6 route-map RM_EDGE_V6_OUT out

Step 3: Restart FRR

After editing the configuration, restart FRR to apply changes:

sudo systemctl restart frr

Step 4: Verify BGP session

Check the status of your BGP sessions with:

vtysh -c 'show bgp summary'

The sessions with the OVHcloud Edges must be in the Established state.

Step 5: Verify ingress and egress connectivity

To ensure your BGP session is functioning correctly, test both inbound and outbound traffic:

  • Check ingress traffic

Use a remote server to ping or traceroute to your advertised IP prefix:

ping YOUR_ADVERTISED_IP
traceroute YOUR_ADVERTISED_IP

Verify that traffic reaches your network via the expected BGP paths.

  • Check egress traffic

From your server, check the routing table and ensure your BGP routes are in use:

ip route show
vtysh -c 'show ip route bgp'

Confirm that outbound traffic is following the correct BGP paths.

Use case: Advanced BGP configuration using Route Servers (RS)

If you want to use more than 4 hosts with BGP Service, you need to deploy and manage Route Servers (RS). This design allows you to scale up to 10 hosts/next hops. Each Route Server uses one of the 4 customer peering IPs, so you can deploy up to 4 Route Servers. The Route Server can be deployed either in-path or out-of-path, depending on your architecture requirements.

An RS peers with Edges and Hosts, establishing two sessions per peer (one for IPv4 and one for IPv6).

Here is an overview of the system:

BGPaaS RS Peering

And here is a detailed view of the BGP sessions between Edges, RS and Hosts:

BGPaaS sessions detail

To achieve this setup, you need to install a BGP daemon, like FRR, on each host, and configure it.

Configuration parameters

In your router configuration files, replace the following parameters with the values of your BGP Service configuration.

ParameterDescription
OVHcloud_ASNPrivate ASN used on OVHcloud Edges (OVHcloud private ASN)
CUSTOMER_ASNPrivate ASN used on your Route Servers and hosts (Customer private ASN)
CUSTOMER_PREFIX_V4
CUSTOMER_PREFIX_V6
Public prefixes allocated for IPv4 and IPv6 usages (Public IP blocks)
RS_IPV4
RS_IPV6
Customer RS IP addresses in private/ULA range used for BGP peering and connectivity inside the vRack (Customer Peering IPs)
EDGE_IPV4
EDGE_IPV6
OVHcloud Edge IP addresses in private/ULA range used for BGP peering and connectivity inside the vRack (OVHcloud Peering IPs)
HOST_IPV4
HOST_IPV6
Other customer host IP addresses in private/ULA range used as BGP next hop and peer inside the vRack. They must belong to the BGP subnet.

Configuring a BGP daemon (FRR)

To configure the BGP sessions using FRR, follow the steps below.

Step 1: Install FRR

On a Debian-based system, install FRR with:

sudo apt update && sudo apt install frr frr-pythontools

Step 2: Configure FRR

FRR configuration for Route Servers
Info

All of the following parameters should be present in the /etc/frr/frr.conf configuration file of the route server(s).

Prefix list and route map configuration
Info

The configuration below is a suggested setup to prevent any unexpected announcement between BGP peers.

Route Servers accept default routes from OVHcloud Edges and all routes from Hosts if they match the defined prefix length (see the allowed announcement sizes in the Service capabilities section). Route Servers advertise Hosts' routes to OVHcloud Edges and default routes to Hosts.

Related prefix lists and route maps to filter routes:

ip prefix-list PL_DEFAULT_ROUTE_V4 seq 10 permit 0.0.0.0/0

ip prefix-list PL_CUSTOMER_PREFIX_V4 seq 10 permit <CUSTOMER_PREFIX_V4> ge <length>
... <other sequences may be added depending on the customer setup>

ipv6 prefix-list PL_DEFAULT_ROUTE_V6 seq 10 permit ::/0

ipv6 prefix-list PL_CUSTOMER_PREFIX_V6 seq 10 permit <CUSTOMER_PREFIX_V6> eq <length>
... <other sequences may be added depending on the customer setup>


route-map RM_EDGE_V4_OUT deny 10
 match ip address prefix-list PL_DEFAULT_ROUTE_V4
route-map RM_EDGE_V4_OUT permit 20
  match ip address prefix-list PL_CUSTOMER_PREFIX_V4

route-map RM_EDGE_V4_IN permit 10
 match ip address prefix-list PL_DEFAULT_ROUTE_V4

route-map RM_HOST_V4_IN deny 10
  match ip address prefix-list PL_DEFAULT_ROUTE_V4
route-map RM_HOST_V4_IN permit 20
  match ip address prefix-list PL_CUSTOMER_PREFIX_V4

route-map RM_HOST_V4_OUT permit 10
 match ip address prefix-list PL_DEFAULT_ROUTE_V4


route-map RM_EDGE_V6_OUT deny 10
 match ipv6 address prefix-list PL_DEFAULT_ROUTE_V6
route-map RM_EDGE_V6_OUT permit 20
  match ipv6 address prefix-list PL_CUSTOMER_PREFIX_V6

route-map RM_EDGE_V6_IN permit 10
 match ipv6 address prefix-list PL_DEFAULT_ROUTE_V6

route-map RM_HOST_V6_IN deny 10
  match ipv6 address prefix-list PL_DEFAULT_ROUTE_V6
route-map RM_HOST_V6_IN permit 20
  match ipv6 address prefix-list PL_CUSTOMER_PREFIX_V6

route-map RM_HOST_V6_OUT permit 10
 match ipv6 address prefix-list PL_DEFAULT_ROUTE_V6
BFD configuration
Info

The configuration below is a suggested setup to improve BGP convergence time between RS and edges over vRack.

bfd
 profile edge
  detect-multiplier 8
  receive-interval 500
  transmit-interval 500

 peer <EDGE_IPV4>
  profile edge
  no shutdown
 peer <EDGE_IPV6>
  profile edge
  no shutdown
BGP configuration

Global configuration:

router bgp <CUSTOMER_ASN>
 bgp router-id <RS_IPV4>
 no bgp default ipv4-unicast

BGP peering with OVHcloud Edges:

router bgp <CUSTOMER_ASN>
 neighbor PG_EDGE_V4 peer-group
 neighbor PG_EDGE_V4 remote-as <OVHcloud_ASN>
 neighbor PG_EDGE_V4 bfd
 neighbor PG_EDGE_V6 peer-group
 neighbor PG_EDGE_V6 remote-as <OVHcloud_ASN>
 neighbor PG_EDGE_V6 bfd
 neighbor <EDGE_IPV4> peer-group PG_EDGE_V4
 neighbor <EDGE_IPV6> peer-group PG_EDGE_V6

 address-family ipv4 unicast
  neighbor PG_EDGE_V4 activate
  neighbor PG_EDGE_V4 addpath-tx-all-paths
  neighbor PG_EDGE_V4 attribute-unchanged next-hop
  neighbor PG_EDGE_V4 route-map RM_EDGE_V4_IN in
  neighbor PG_EDGE_V4 route-map RM_EDGE_V4_OUT out
 address-family ipv6 unicast
  neighbor PG_EDGE_V6 activate
  neighbor PG_EDGE_V6 addpath-tx-all-paths
  neighbor PG_EDGE_V6 attribute-unchanged next-hop
  neighbor PG_EDGE_V6 route-map RM_EDGE_V6_IN in
  neighbor PG_EDGE_V6 route-map RM_EDGE_V6_OUT out

BGP peering with Hosts:

router bgp <CUSTOMER_ASN>
 neighbor PG_HOST_V4 peer-group
 neighbor PG_HOST_V4 remote-as <CUSTOMER_ASN>
 neighbor PG_HOST_V6 peer-group
 neighbor PG_HOST_V6 remote-as <CUSTOMER_ASN>
 neighbor <HOST_IPV4> peer-group PG_HOST_V4
 neighbor <HOST_IPV6> peer-group PG_HOST_V6

 address-family ipv4 unicast
  neighbor PG_HOST_V4 activate
  neighbor PG_HOST_V4 addpath-tx-all-paths
  neighbor PG_HOST_V4 route-map RM_HOST_V4_IN in
  neighbor PG_HOST_V4 route-map RM_HOST_V4_OUT out
 address-family ipv6 unicast
  neighbor PG_HOST_V6 activate
  neighbor PG_HOST_V6 addpath-tx-all-paths
  neighbor PG_HOST_V6 route-map RM_HOST_V6_IN in
  neighbor PG_HOST_V6 route-map RM_HOST_V6_OUT out
FRR configuration for Hosts
Info

All of the following parameters should be present in the /etc/frr/frr.conf configuration file of the hosts.

Prefix list and route map configuration
Info

The configuration below is a suggested setup to prevent any unexpected announcement between BGP peers.

In the following example:

  • Hosts only accept default routes from RS.
  • Hosts only advertise customer's prefixes to RS.

Related prefix lists and route maps to filter routes:

ip prefix-list PL_DEFAULT_ROUTE_V4 seq 10 permit 0.0.0.0/0

ip prefix-list PL_CUSTOMER_PREFIX_V4 seq 10 permit <CUSTOMER_PREFIX_V4> ge <length>
... <other sequences may be added depending on the customer setup>

ipv6 prefix-list PL_DEFAULT_ROUTE_V6 seq 10 permit ::/0

ipv6 prefix-list PL_CUSTOMER_PREFIX_V6 seq 10 permit <CUSTOMER_PREFIX_V6> eq <length>
... <other sequences may be added depending on the customer setup>


route-map RM_RS_V4_OUT permit 10
  match ip address prefix-list PL_CUSTOMER_PREFIX_V4
route-map RM_RS_V4_IN permit 10
  match ip address prefix-list PL_DEFAULT_ROUTE_V4

route-map RM_RS_V6_OUT permit 10
  match ipv6 address prefix-list PL_CUSTOMER_PREFIX_V6
route-map RM_RS_V6_IN permit 10
  match ipv6 address prefix-list PL_DEFAULT_ROUTE_V6
BFD configuration
Info

The configuration below is a suggested setup to improve BGP convergence time between Hosts and RS over vRack.

The values below are just an example, and you may choose other values for your RS and Hosts.

bfd
 profile rs
  detect-multiplier 8
  receive-interval 500
  transmit-interval 500

 peer <RS_IPV4>
  profile rs
  no shutdown
...
 peer <RS_IPV6>
  profile rs
  no shutdown
...
BGP configuration

Global configuration:

router bgp <CUSTOMER_ASN>
 bgp router-id <HOST_IPV4>
 no bgp default ipv4-unicast
 maximum-paths 16
 maximum-paths ibgp 16

BGP peering with RS:

router bgp <CUSTOMER_ASN>
 neighbor PG_RS_V4 peer-group
 neighbor PG_RS_V4 remote-as <CUSTOMER_ASN>
 neighbor PG_RS_V4 bfd
 neighbor PG_RS_V6 peer-group
 neighbor PG_RS_V6 remote-as <CUSTOMER_ASN>
 neighbor PG_RS_V6 bfd
 neighbor <RS_IPV4> peer-group PG_RS_V4
...
 neighbor <RS_IPV6> peer-group PG_RS_V6
...

 address-family ipv4 unicast
  neighbor PG_RS_V4 activate
  neighbor PG_RS_V4 route-map RM_RS_V4_IN in
  neighbor PG_RS_V4 route-map RM_RS_V4_OUT out
 address-family ipv6 unicast
  neighbor PG_RS_V6 activate
  neighbor PG_RS_V6 route-map RM_RS_V6_IN in
  neighbor PG_RS_V6 route-map RM_RS_V6_OUT out

Step 3: Restart FRR

On each host/RS, after editing the configuration, restart FRR to apply changes:

sudo systemctl restart frr

Step 4: Verify BGP session

Check the status of your BGP sessions on your different hosts/RS with:

vtysh -c 'show bgp summary'

The sessions must be in the Established state.

Step 5: Verify ingress and egress connectivity

To ensure your BGP session is functioning correctly, test both inbound and outbound traffic:

  • Check ingress traffic

Use a remote server to ping or traceroute to your advertised IP prefix:

ping YOUR_ADVERTISED_IP
traceroute YOUR_ADVERTISED_IP

Verify that traffic reaches your network via the expected BGP paths.

  • Check egress traffic

From your server, check the routing table and ensure your BGP routes are in use:

ip route show
vtysh -c 'show ip route bgp'

Confirm that outbound traffic is following the correct BGP paths.

Managing your BGP Service

All the actions below are available in the BGP Service tab of your vRack Services.

Modifying a configuration

In the Configuration section, select IPv4 Configuration or IPv6 Configuration, then click Configure IPv4 (or Configure IPv6).

You can change the BGP range, the ASNs, the peering IPs and the public IP blocks. To remove a public IP block, click the cross on its label. The subnet cannot be changed.

Some changes restart the BGP sessions and may interrupt your traffic:

ChangeImpact
Change the customer or OVHcloud peering IPsThe BGP sessions restart
Add or remove a public IP block (at least one block remains)No interruption
Change the customer or OVHcloud ASNThe BGP sessions restart
Change the BGP rangeThe BGP sessions restart
Remove the last public IP blockThe announcement stops and the status returns to Draft

When you change an ASN or the BGP range, or remove the last public IP block, a banner warns you that the service will restart and lists the affected fields. Plan the changes that restart the BGP sessions during a maintenance window, then click Save.

Renaming your BGP Service

In the Information section, click the pencil icon next to the BGP Service Name, enter the new name, then save.

Terminating your BGP Service

In the Information section, click Terminate BGP Service, then confirm with Terminate.

The service stops at the end of the current billing period: your BGP sessions and prefix announcements are then terminated and the configuration is removed. The same happens if the service is not renewed. A termination cannot be undone. Before terminating, make sure your traffic no longer depends on the announced IP blocks.

Best practices for production

Maintenance of a host without traffic interruption

To take a host out of service for maintenance (e.g. OS update, hardware intervention), withdraw its announcements before stopping it. The OVHcloud peers ignore the communities your hosts send, so tagging the routes with GRACEFUL_SHUTDOWN does not drain the incoming traffic: the host must stop announcing the blocks.

With FRR, shut down all the BGP sessions of the host to be maintained:

vtysh -c 'configure terminal' -c 'router bgp <CUSTOMER_ASN>' -c 'bgp shutdown'

The host closes its sessions and its routes are withdrawn: incoming traffic moves to the remaining hosts announcing the same blocks. Withdrawing the routes before stopping the host avoids waiting for the failure detection (around 4 seconds with BFD). This does not mean that sessions (such as TCP) are maintained if they are not synchronized between the hosts announcing the route. Once traffic has moved (verify with the route tables of the other hosts or of the Route Server), proceed with the maintenance.

After the maintenance, re-enable the sessions:

vtysh -c 'configure terminal' -c 'router bgp <CUSTOMER_ASN>' -c 'no bgp shutdown'

The host re-establishes its sessions, announces its blocks again and starts receiving traffic.

Available regions

The product is available in the following regions:

Region LocationRegion NameRegion Type
Europe (France - Gravelines)eu-west-gra1-AZ
Europe (France - Roubaix)eu-west-rbx1-AZ
Europe (France - Strasbourg)eu-west-sbg1-AZ
Europe (Germany - Limburg)eu-west-lim1-AZ
Europe (Poland - Warsaw)eu-central-waw1-AZ
Europe (UK - Erith)eu-west-eri1-AZ
North America (Canada - East - Beauharnois)ca-east-bhs1-AZ
North America (Canada - East - Toronto)ca-east-tor1-AZ
Info

3-AZ regions and regions located in the US or APAC will be available at a later date.

Troubleshooting

If you encounter issues with your BGP Service:

  • The status remains Draft: hover over the information icon next to the status to see the reason. No BGP range declared means the configuration is incomplete; No public IP blocks declared means that no public IP block is selected.
  • A public IP block is not offered in the list: check that the block is in the same region as your vRack Services, that it is not associated with another service and that it is not already used by another BGP Service.
  • A BGP session does not reach the Established state: check that the host uses one of the customer peering IPs, that it is directly connected to the BGP subnet, and that the ASNs configured on the host match the Customer private ASN and OVHcloud private ASN values.
  • Your prefix is not reachable from the Internet: check that it belongs to one of your public IP blocks, that its size is allowed, and that there are no conflicting announcements.
  • Ensure your firewall and network policies allow BGP traffic (TCP port 179) and, if you use it, BFD (UDP ports 3784 and 3785).

If the issue persists, create a support request in our Help Centre.

Go further

Exposing a managed service on your vRack with vRack Services

Bring Your Own IP (BYOIP)

Join our community of users.

Was this page helpful?