To enable the router, set the following parameters in fastdpi.conf:

For each router_device, you must specify which subnets are diverted to the TAP (in fact, this diverts routing protocol packets to BIRD). SSG extracts traffic to these subnets from the general traffic on the device and sends all such packets to the corresponding TAP interface.

Subnets are set by the subnet (IPv4) and subnet6 (IPv6) parameters in the router_device description. Each subnet is set by a separate subnet/subnet6 parameter. A router_device description can contain up to 16 different subnet parameters and up to 16 different subnet6 parameters. For example, the configuration below sets two IPv4 subnets for device 41-00.1 to be diverted to the bng-w TAP interface, and one IPv6 subnet plus the link-local address of the interface BIRD communicates with.

router_device {
    device=41-00.1
    tap=bng-w
    peer=rib-w
    subnet=10.0.2.0/30
    subnet=8.8.8.0/29
    subnet6=2001::1/124
    subnet6=fe80::82d:cff:fe5f:9453/128
}

Where:

• device — device name from in_dev/out_dev.
• tap — TAP interface name for the device. Default — dpi + device name.
• peer — name of the peer TAP interface in the netns. Default — rib + device name.
• subnet — IPv4 subnet diverted to the TAP interface. There are two in the example: 10.0.2.0/30 and 8.8.8.0/29.
• subnet6 — IPv6 subnet diverted to the TAP interface. In the example, 2001::1/124 is an IPv6 subnet and fe80::82d:cff:fe5f:9453/128 is the link-local address of the interface BIRD communicates with.

Each subnet is set by a separate subnet or subnet6 parameter.

OSPF uses the multicast addresses 224.0.0.5 and 224.0.0.6, so if OSPF is used on a router_device, these addresses must also be specified in the router_device description:

router_device {
    device=41-00.1
    tap=bng-w
    peer=rib-w

    # OSPF multicast
    subnet=224.0.0.5/32
    subnet=224.0.0.6/32
}

All TAP interfaces associated with devices are described in fastdpi.conf:

router_device {
    device=
    #tap=
    #peer=
}

Where:

• device — device name from in_dev/out_dev. Mandatory parameter.
• tap — TAP interface name for the device. Optional parameter. Default — dpi + device name.
• peer — name of the peer TAP interface in the netns. Optional parameter. Default — rib + device name.

router_device section syntax rules:

• the opening brace { must be on the same line as the router_device section name;
• the closing brace } must be on a separate line.

For example, for this configuration:

in_dev=41-00.0
out_dev=41-00.1

where only out_dev is connected to the router, the description is:

in_dev=41-00.0
out_dev=41-00.1

router_device {
    device=41-00.1
    tap=bng-w
    peer=rib-w
}

Where:

• device=41-00.1 — the out_dev device connected to the router. In this example, in_dev is not connected to the router, so no router_device section is set for it.
• tap=bng-w — TAP interface name on the SSG side.
• peer=rib-w — peer interface name on the routing daemon side, in the netns.

You may omit the tap and peer names — the default names (‘dpi’/‘rib’ + device) are then used. However, we recommend always setting clear names explicitly, for example:

in_dev=41-00.0
out_dev=41-00.1

   # TAP for out_dev:
router_device {
    device=41-00.1
    tap=bng-w
    peer=rib-w
}

   # TAP for in_dev
router_device {
    device=41-00.0
    tap=bng-l
    peer=rib-l
}

Recommended TAP interface names (naming standard for all examples):

• for in_dev (LAN, subscriber side): on the SSG side — bng-l, on the routing daemon side — rib-l;
• for out_dev (WAN, uplink): on the SSG side — bng-w, on the routing daemon side — rib-w.

SSG provides a set of CLI commands for viewing the current router state. For the full list of commands, see

fdpi_cli help router

Also keep in mind that the routing table is built over BGP, OSPF, etc. by BIRD, which has its own command-line utility birdc and its own configuration file with an advanced command system for filtering, setting static routes, etc.

In addition, the standard Linux ip utility gives full control over the kernel route table. When using ip, remember to specify the correct netns (router_netns) and routing table number (router_kernel_table).

The router_netns and router_kernel_table settings define the default VRF and are used as defaults for the corresponding parameters when other VRFs are described.

When preparing fastDPI for router mode, the administrator must create the required netns and TAP interfaces for diverting traffic to the routing daemons. fastdpi.conf refers to netns and TAP interfaces that already exist; only in this case will SSG start.

Each VRF is set by a separate section in the router configuration:

router_vrf {
      id=
      netns=
      kernel_table=
      neighbor_cache=
}

router_default_vrf=

id — string, unique VRF id. A VRF can be specified for a subscriber in a RADIUS authorization VSA — that is this id. Maximum length — 15 characters.
netns — name of the netns the VRF is read from. If not set, it equals the router_netns option. The peer TAP interfaces for this VRF are located in this netns.
kernel_table — kernel routing table number for this VRF. If not set, it equals the router_kernel_table option.
router_default_vrf — string, id of the default VRF. The default VRF is used for subscribers that have no vrf_id property.
neighbor_cache — string, name of the ARP cache for this VRF. By default, each VRF has its own ARP/Neighbor cache isolated from the others. If several VRFs must share one ARP/Neighbor cache, set the same neighbor_cache value in their descriptions.

Parameters for this VRF:

max_ip4_route_count — maximum number of IPv4 routes.
max_ip6_route_count — maximum number of IPv6 routes.
multipath_page — maximum number of pages for multi-path route distribution. One page holds 64 different multi-path routes. One page can hold routes of several ECMP groups. One group can span several pages (if the group has more than 64 routes and the routing daemon does not limit the number of routes)
fib_refresh — FIB update interval.
arp_cache_size — ARP cache size.

These parameters define the required memory and update frequency for this VRF. You can keep the defaults (taken from the global options) or override them.

• If the configuration has no router_vrf sections, the previous operating mode is kept for backward compatibility: SSG has one VRF, which is the default one.
• If the configuration has router_vrf sections, VRF support mode is used. Exactly one VRF must be the default one, that is, the router_default_vrf=id option of the default VRF must be set.

bras_vrf_isolation — VRF isolation. By default, L2 BNG does not isolate subscribers from different VRFs; if this mode is enabled (1), subscribers from different VRFs are isolated from each other. Default: 0. When this option is enabled:

1. subscriber ARP to the gateway — processed by fastDPI only if the subscriber and the gateway are in the same VRF
2. gateway ICMP ping — processed by fastDPI only if the subscriber and the gateway are in the same VRF
3. local interconnect — applied only if both subscribers are in the same VRF

bras_egress_filtering — filtering of outgoing subs→inet traffic (bit mask). Disabled by default (0). When this option is enabled, a packet is dropped if all of the following conditions are met:

1. the subscriber IP address (srcIP) is unknown to L2 BNG
2. bras_term_by_as=0
3. the subscriber AS is not local

The VRF id is added to the router_device description. Description of one router interface:

router_device {
      device=
      tap=
      peer=
      vrf=
      subnet=
      subnet=
      subnet6=
      subnet6=
}

device — device name from in_dev/out_dev.
tap — TAP interface name for the device (default — dpi + device name).
peer — name of the peer TAP interface in the VRF netns (default — rib + device name).
vrf — id of the VRF that contains the peer. If not set, the default VRF is used.

subnet and subnet6 — subnets diverted from the general traffic to the TAP device. At least one subnet or subnet6 parameter must be set for a router_device!

subnet — IPv4 subnets diverted from the general traffic to the TAP device.
subnet6 — IPv6 subnets diverted from the general traffic to the TAP device.

Each IPv4 and IPv6 subnet is specified separately in a subnet or subnet6 parameter, respectively. One router_device can have no more than 16 subnet parameters and 16 subnet6 parameters.

The VRF ID is passed to fastDPI during authorization, in service 254.

VasExperts-Service-Profile = "254:VRF_ID"

Here VRF_ID is the VRF identifier from the id parameter of the router_vrf section.

For example, to place a subscriber in the vrf-iptv VRF from the full configuration example, the RADIUS response passes the attribute:

VasExperts-Service-Profile = "254:vrf-iptv"

If the attribute is not passed, the subscriber is placed in the default VRF (router_default_vrf). After authorization, the subscriber can be moved to another VRF via CoA with the same attribute.