Hedgehog Fabric uses Border Leaf concept to exchange VPC routes outside the Fabric and providing L3 connectivity.
External Peering feature allows to set up an external peering endpoint and to enforce several policies between
internal and external endpoints.
Hedgehog Fabric does not operate Edge side devices.
Traffic exit from the Fabric is done on Border Leafs that are connected with Edge devices. Border Leafs are suitable to terminate l2vpn connections and distinguish VPC L3 routable traffic towards Edge device as well as to land VPC servers. Border Leafs (or Borders) can connect to several Edge devices.
External Peering is only available on the switch devices that are capable for sub-interfaces.
Connect Border Leaf to Edge device
In order to distinguish VPC traffic Edge device should be capable for - Set up BGP IPv4 to advertise and receive routes from the Fabric - Connect to Fabric Border Leaf over Vlan - Be able to mark egress routes towards the Fabric with BGP Communities - Be able to filter ingress routes from the Fabric by BGP Communities
All other filtering and processing of L3 Routed Fabric traffic should be done on the Edge devices.
Fabric is sharing VPC routes with Edge devices via BGP. Peering is done over Vlan in IPv4 Unicast AFI/SAFI.
VPC L3 routable traffic will be tagged with Vlan and sent to Edge device. Later processing of VPC traffic (NAT, PBR, etc) should happen on Edge devices.
VPC access to Edge device
Each VPC within the Fabric can be allowed to access Edge devices. Additional filtering can be applied to the routes that VPC can export to Edge devices and import from the Edge devices.
API and implementation
General configuration starts with specification of
External objects. Each object of
External type can represent a
set of Edge devices, or a single BGP instance on Edge device, or any other united Edge entities that can be described
with following config
- Name of
- Inbound routes are marked with dedicated BGP community
- Outbound routes are required to be marked with dedicated community
External should be bound to some VPC IP Namespace, otherwise prefixes overlap may happen.
Connection of type
external is used to identify switch port on Border leaf that is cabled with an Edge device.
External Attachment is a definition of BGP Peering and traffic connectivity between a Border leaf and
Attachments are bound to
Connection with type
external and specify
Vlan that will be used to segregate particular
connection: # Name of the Connection with type external
external: # Name of the External to pick config
asn: # Edge device ASN
ip: # IP address of Edge device to peer with
ip: # IP Address on the Border Leaf to set up BGP peering
vlan: # Vlan ID to tag control and data traffic
External Attachment can be configured for the same
Connection but for different
External VPC Peering
To allow specific VPC have access to Edge devices VPC should be bound to specific
External object. This is done via
External Peering object.
name: # Name of ExternalPeering
name: # External Name
prefixes: # List of prefixes(routes) to be allowed to pick up from External
- # IPv4 Prefix
name: # VPC Name
subnets: # List of VPC subnets name to be allowed to have access to External (Edge)
- # Name of the subnet within VPC
Prefixes can be specified as
exact match or with mask range indicators
le is identifying prefixes lengths that are
less than or equal and
ge for prefixes lengths that are
greater than or equal.
Example: Allow ANY IPv4 prefix that came from
External - allow all prefixes that match default route with any prefix length
le can also be combined.
188.8.131.52/18 will be matched for given prefix rule above, but
This example will show peering with
External object with name
HedgeEdge given Fabric VPC with name
vpc-1 on the Border
switchBorder that has a cable between an Edge device on the port
vpc-1 is required to receive any prefixes
advertised from the
Fabric API configuration
Connection should be specified in the
Example Edge side BGP configuration based on SONiC OS
NOTE: Hedgehog does not recommend using following configuration for production. It's just as example of Edge Peer config
Created: December 20, 2023