Creating a dynamic route server
Dynamic Route Server for VPC is a beta feature that is available for evaluation and testing purposes to select customers. Access is restricted to allowlisted accounts.
You can create a dynamic route server to enable policy-driven, dynamic routing between your VPC and connected networks by exchanging routes with external peers by using BGP. You can add members to a dynamic route server to deploy routing appliances across availability zones, providing high availability and resilience for BGP route exchange.
A dynamic route server instance contains one or more members and defines the routing scope for peers and policies. A member is a routing appliance that is deployed as a virtual server instance and runs the BGP routing stack. Members establish BGP sessions with peers. A dynamic route server instance can have one to three members for high availability.
Before you begin
Before you create a dynamic route server:
- Make sure that you have the required level of access to create VPC services. For more information, see Getting started with Virtual Private Cloud and Managing IAM access for VPC Infrastructure Services.
- Review Planning considerations for dynamic route servers.
- Review Known issues for dynamic route servers.
Creating a dynamic route server in the console
To create a dynamic route server in the console, follow these steps:
- From your browser, open the IBM Cloud console and log in to your account.
- Select the Navigation menu
, and then click Infrastructure
> Network > Dynamic route servers.
- On the Dynamic route servers for VPC page, click Create.
- Specify the following information:
- Location - Select the location where the dynamic route server is provisioned.
- Name - Enter a name for the dynamic route server, such as
my-dynamic-route-server. - Resource group - Select a resource group for the dynamic route server.
- Tags - Optionally, add tags to identify this dynamic route server.
- Access management tags - Optionally, add access management tags to resources to help organize access control relationships. The only supported format for access management tags is
key:value. For more information, see Controlling access to resources by using tags. - Virtual private cloud - Select the VPC for the dynamic route server.
- ASN - Enter an ASN value. An ASN is a numeric identifier for the dynamic route server, which identifies your local network for BGP peering and is used to set up a BGP session with other peers.
- Create a dynamic route server member and click Create dynamic route server in the Summary panel.
Creating dynamic route server members
To create a dynamic route server member in the console, follow these steps:
- In the dynamic route server members section, click Create. Dynamic route server members require a virtual network interface (VNI) to establish BGP sessions. You can attach an existing VNI or create a new one. For more information, see About virtual network interfaces.
- Enter a name for the dynamic route server member, such as
my-drs-mem. - Select the location where the member is created.
- If you already have a VNI, select one from the list. If you don't have one, follow these steps:
- In the Details section, click Create and enter a name for the virtual network interface.
- Select the resource group to which it belongs.
- Select the subnet that you want to use for the member.
- Add the Network and IP information
- Click Next
- In the Network configuration section, complete the following information:
-
Allow IP spoofing: Select the switch to disable IP spoofing.
-
Infrastructure NAT: Select the switch to enable infrastructure NAT.
Infrastructure NAT is enabled when IP spoofing is enabled and must be enabled for the dynamic route server member.
-
Protocol state filtering mode: Select a radio button to set the mode. For the dynamic route server, it must be set to Auto or Enabled.
-
Security groups: Select at least one and at most five security groups to control traffic at the networking level. You can select security groups from the list, or create one by clicking Create. For more information about creating a security group, see Creating security groups.
-
- In the IP section, keep the default setting. A dynamic route server member VNI must have one primary IP address.
- Review the information in the Summary panel, and click Create.
- In the Details section, click Create and enter a name for the virtual network interface.
Creating a dynamic route server from the CLI
To create a dynamic route server from the CLI, follow these steps:
-
Log in to your CLI environment. After you enter the password, the system prompts which account and region that you want to use:
ibmcloud login --sso -
Enable the following feature flag:
export IBMCLOUD_IS_FEATURE_DYNAMIC_ROUTE_SERVER=true -
Run the following command:
ibmcloud is dynamic-route-server-create --local-asn LOCAL_ASN (--members MEMBERS_JSON | @MEMBERS_JSON_FILE) [--name NAME] [--resource-group-id RESOURCE_GROUP_ID | --resource-group-name RESOURCE_GROUP_NAME] [--output JSON] [-q, --quiet]
Where:
--local-asn- The local autonomous system number (ASN).
--members- A JSON payload that defines the dynamic route server members. You can specify a minimum of one and a maximum of three members. For the data schema, see the
membersproperty in the API documentation. @MEMBERS_JSON_FILE- A file that contains the members JSON payload.
--name- The name of the dynamic route server.
--resource-group-id- The ID of the resource group. This option is mutually exclusive with
--resource-group-name. --resource-group-name- The name of the resource group. This option is mutually exclusive with
--resource-group-id. --output- Output in JSON format.
-q, --quiet- Suppresses verbose output.
To create a dynamic route server member from the CLI, run the following command:
ibmcloud is dynamic-route-server-member-create DYNAMIC_ROUTE_SERVER (--vni VNI | (--vni-auto-delete true | false [--vni-psfm auto | enabled | disabled] --vni-name VNI_NAME [--vni-rip VNI_RIP | (--vni-rip-address VNI_RIP_ADDRESS --vni-rip-auto-delete true | false --vni-rip-name VNI_RIP_NAME)] --vni-subnet VNI_SUBNET [--vpc VPC] --vni-sgs VNI_SGS --vni-ais false | true --vni-ein true | false --vni-ips VNI_RESERVED_IPS_JSON | @VNI_RESERVED_IPS_JSON_FILE --resource-group-id RESOURCE_GROUP_ID | --resource-group-name RESOURCE_GROUP_NAME)) [--name NAME] [--output JSON] [-q, --quiet]
Where:
DYNAMIC_ROUTE_SERVER- The dynamic route server identifier.
--vni- The ID or name of the VNI.
--vni-auto-delete- Indicates whether the VNI is automatically deleted when its target is deleted. One of:
trueorfalse. --vni-psfm- The protocol state filtering mode for the VNI. If
auto, protocol state packet filtering is enabled or disabled based on thetargetresource type of the VNI. One of:auto,enabled, ordisabled. The default isauto. --vni-name- The name of the VNI.
--vni-rip- The ID or name of the reserved IP to bind to the VNI. Required if you don't specify a subnet.
--vni-rip-address- The IP address of the reserved IP to bind to the VNI. Requires a subnet.
--vni-rip-auto-delete- Indicates whether the reserved IP is automatically deleted when its target is deleted or when the reserved IP is unbound. One of:
trueorfalse. --vni-rip-name- The name of the reserved IP to bind to the VNI.
--vni-subnet- The ID or name of the subnet. If you specify a name, use
--vpcto specify the VPC for name resolution. --vpc- The ID or name of the VPC. Required for subnet name resolution.
--vni-sgs- A comma-separated list of the IDs or names of the security groups for the VNI.
--vni-ais- Allow IP spoofing. Indicates whether source IP spoofing is allowed on the VNI. One of:
falseortrue. The default isfalse. --vni-ein- Enable infrastructure NAT. Indicates whether the VPC infrastructure performs any needed NAT operations. One of:
trueorfalse. The default istrue. --vni-ips- A JSON payload that defines the secondary reserved IP addresses to bind to the VNI.
@VNI_RESERVED_IPS_JSON_FILE- A file that contains the secondary reserved IP addresses JSON payload.
--resource-group-id- The ID of the resource group. This option is mutually exclusive with
--resource-group-name. --resource-group-name- The name of the resource group. This option is mutually exclusive with
--resource-group-id. --name- The name of the dynamic route server member.
--output- Output in JSON format.
-q, --quiet- Suppresses verbose output.
Command examples
-
To create a dynamic route server with local ASN and one member, run the following command:
ibmcloud is dynamic-route-server-create --local-asn 64514 --members '[{"name":"drs-member-1","virtual_network_interfaces":[{"id":"0717-3c8a9f81-b1a0-4c92-9a38-1d9c2f9d1234"}]}]' --name my-dynamic-route-server --resource-group-name default --output JSON -
To create a dynamic route server member, run the following command:
ibmcloud is dynamic-route-server-member-create 0717-drs-12345678 --vni-auto-delete false --vni-psfm auto --vni-name drs-member-vni-1 --vni-rip-address 10.0.1.5 --vni-rip-auto-delete false --vni-rip-name drs-member-rip-1 --vni-subnet 0717-subnet-abc12345 --vpc 0717-vpc-9f8e7d6c --vni-sgs 0717-sg-111aaa22,0717-sg-333bbb44 --vni-ais false --vni-ein true --resource-group-name default --name drs-member-2 --output JSON
Creating a dynamic route server with the API
To create a dynamic route server with the API, follow these steps:
-
Set up your API environment with the required variables.
-
Store any additional variables to use in the API commands. For example:
ResourceGroupId- Find the resource group ID by using theget resource groupscommand and then populate the variable:
export ResourceGroupId=<your_resourcegroup_id> -
When all variables are set, create the dynamic route server:
curl -X POST \ "$vpc_api_endpoint/v1/dynamic_route_servers?version=$api_version&generation=2" \ -H "Authorization: Bearer $iam_token" \ -H "Content-Type: application/json" \ -d '{ "name": "my-drs", "local_asn": 64514, "members": [ { "name": "my-drs-member", "virtual_network_interfaces": [ { "id": "VNI_ID" } ] } ], "resource_group": { "id": "abcd1234-5678" } }'
Next steps
Now that your dynamic route server is provisioned, consider these next steps:
- Create a peer group to group and add similar peers.