Set up BGP routing with FRRouting for dynamic network routing and failover

#!/usr/bin/env bash

set -euo pipefail

# FRRouting BGP Installation Script
# Usage: sudo ./install-frr-bgp.sh <router-ip> <as-number> [peer1-ip:peer1-as] [peer2-ip:peer2-as]

# Colors for output
RED='\033[0;31m'
GREEN='\033[0;32m'
YELLOW='\033[1;33m'
NC='\033[0m'

# Logging functions
log_info() { echo -e "${GREEN}[INFO]${NC} $1"; }
log_warn() { echo -e "${YELLOW}[WARN]${NC} $1"; }
log_error() { echo -e "${RED}[ERROR]${NC} $1"; }

# Usage message
usage() {
    echo "Usage: $0 <router-ip> <as-number> [peer1-ip:peer1-as] [peer2-ip:peer2-as]"
    echo "Example: $0 203.0.113.1 65001 203.0.113.10:65002 203.0.113.20:65003"
    exit 1
}

# Cleanup on error
cleanup() {
    log_error "Installation failed. Cleaning up..."
    systemctl stop frr 2>/dev/null || true
    systemctl disable frr 2>/dev/null || true
}

trap cleanup ERR

# Check arguments
if [ $# -lt 2 ]; then
    usage
fi

ROUTER_IP="$1"
AS_NUMBER="$2"
PEER1="${3:-}"
PEER2="${4:-}"

# Validate IP address
validate_ip() {
    if [[ ! $1 =~ ^[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}$ ]]; then
        log_error "Invalid IP address: $1"
        exit 1
    fi
}

validate_ip "$ROUTER_IP"

# Check prerequisites
if [ "$EUID" -ne 0 ]; then
    log_error "Please run as root or with sudo"
    exit 1
fi

# Auto-detect distribution
log_info "[1/8] Detecting distribution..."
if [ -f /etc/os-release ]; then
    . /etc/os-release
    case "$ID" in
        ubuntu|debian)
            PKG_MGR="apt"
            PKG_INSTALL="apt install -y"
            PKG_UPDATE="apt update && apt upgrade -y"
            ;;
        almalinux|rocky|centos|rhel|ol|fedora)
            PKG_MGR="dnf"
            PKG_INSTALL="dnf install -y"
            PKG_UPDATE="dnf update -y"
            ;;
        amzn)
            PKG_MGR="yum"
            PKG_INSTALL="yum install -y"
            PKG_UPDATE="yum update -y"
            ;;
        *)
            log_error "Unsupported distribution: $ID"
            exit 1
            ;;
    esac
else
    log_error "Cannot detect distribution"
    exit 1
fi

log_info "Detected distribution: $ID using $PKG_MGR"

# Update system packages
log_info "[2/8] Updating system packages..."
if [ "$PKG_MGR" = "apt" ]; then
    apt update && apt upgrade -y
else
    $PKG_UPDATE
fi

# Install FRRouting
log_info "[3/8] Installing FRRouting..."
if [ "$PKG_MGR" = "apt" ]; then
    # Add FRR repository for latest version
    curl -s https://deb.frrouting.org/frr/keys.asc | apt-key add -
    echo deb https://deb.frrouting.org/frr $(lsb_release -s -c) frr-stable | tee -a /etc/apt/sources.list.d/frr.list
    apt update
    $PKG_INSTALL frr frr-pythontools
else
    $PKG_INSTALL frr frr-pythontools
fi

# Configure FRRouting daemons
log_info "[4/8] Configuring FRRouting daemons..."
cat > /etc/frr/daemons << EOF
bgpd=yes
ospfd=no
ospf6d=no
ripd=no
ripngd=no
isisd=no
pimd=no
ldpd=no
nhrpd=no
eigrpd=no
babeld=no
sharpd=no
pbrd=no
staticd=yes
bfdd=no
fabricd=no
vrrpd=no
pathd=no
EOF

chown frr:frr /etc/frr/daemons
chmod 644 /etc/frr/daemons

# Enable IP forwarding
log_info "[5/8] Enabling IP forwarding..."
echo 'net.ipv4.ip_forward=1' >> /etc/sysctl.conf
echo 'net.ipv6.conf.all.forwarding=1' >> /etc/sysctl.conf
sysctl -p

# Start and enable FRRouting
log_info "[6/8] Starting FRRouting service..."
systemctl enable frr
systemctl start frr
sleep 3

# Configure BGP
log_info "[7/8] Configuring BGP..."
cat > /tmp/frr_config << EOF
configure terminal
router bgp ${AS_NUMBER}
bgp router-id ${ROUTER_IP}
bgp log-neighbor-changes
EOF

# Add BGP peers if provided
if [ -n "$PEER1" ]; then
    IFS=':' read -r PEER1_IP PEER1_AS <<< "$PEER1"
    validate_ip "$PEER1_IP"
    cat >> /tmp/frr_config << EOF
neighbor ${PEER1_IP} remote-as ${PEER1_AS}
neighbor ${PEER1_IP} description "BGP Peer 1"
neighbor ${PEER1_IP} update-source ${ROUTER_IP}
EOF
fi

if [ -n "$PEER2" ]; then
    IFS=':' read -r PEER2_IP PEER2_AS <<< "$PEER2"
    validate_ip "$PEER2_IP"
    cat >> /tmp/frr_config << EOF
neighbor ${PEER2_IP} remote-as ${PEER2_AS}
neighbor ${PEER2_IP} description "BGP Peer 2"
neighbor ${PEER2_IP} update-source ${ROUTER_IP}
EOF
fi

# Add basic prefix lists and route maps
cat >> /tmp/frr_config << EOF
exit
ip prefix-list ALLOW-LOCAL-NETS seq 10 permit 192.168.0.0/16 le 24
ip prefix-list ALLOW-LOCAL-NETS seq 20 permit 10.0.0.0/8 le 24
ip prefix-list DENY-DEFAULT seq 10 deny 0.0.0.0/0
ip prefix-list DENY-DEFAULT seq 20 permit any
route-map FILTER-OUT permit 10
match ip address prefix-list ALLOW-LOCAL-NETS
set local-preference 200
exit
route-map FILTER-IN permit 10
match ip address prefix-list DENY-DEFAULT
set weight 100
exit
write memory
EOF

# Apply configuration
vtysh < /tmp/frr_config
rm -f /tmp/frr_config

# Configure firewall
if command -v ufw >/dev/null 2>&1; then
    ufw allow 179/tcp comment "BGP"
elif command -v firewall-cmd >/dev/null 2>&1; then
    firewall-cmd --permanent --add-port=179/tcp
    firewall-cmd --reload
fi

# Verification
log_info "[8/8] Verifying installation..."
if systemctl is-active --quiet frr; then
    log_info "FRRouting service is running"
else
    log_error "FRRouting service is not running"
    exit 1
fi

# Check BGP status
BGP_STATUS=$(vtysh -c "show bgp summary" 2>/dev/null || echo "BGP not ready")
if [[ "$BGP_STATUS" == *"BGP router identifier"* ]]; then
    log_info "BGP is configured and running"
else
    log_warn "BGP may not be fully initialized yet"
fi

log_info "FRRouting BGP installation completed successfully!"
log_info "Router ID: $ROUTER_IP"
log_info "AS Number: $AS_NUMBER"
log_info ""
log_info "To configure additional settings, use: sudo vtysh"
log_info "To check BGP status: sudo vtysh -c 'show bgp summary'"
log_info "To view routes: sudo vtysh -c 'show ip route'"