FRRouting - BGP and OSPF Routing Suite

This is a repackaged open source software product wherein additional charges apply for cloudimg support services.

## Overview

FRRouting (FRR) is the Linux Foundation's successor to Quagga and is widely deployed in production networks worldwide. This AMI delivers FRR 10.7.0 fully installed and running under systemd as a hardened routing node, so you have a dynamic-routing speaker serving within minutes of launch, with no compilation, no dependency chasing and no manual hardening. It is installed from the official FRR stable APT repository with the signing key pinned by fingerprint, and the FRR origin is added to the unattended-upgrades allow-list so your instance keeps receiving security updates automatically.

## Routing Protocol Suite

The zebra routing manager runs with the bgpd and ospfd daemons enabled and supervised by watchfrr, all managed through the integrated vtysh shell so a single frr.conf is the source of truth. bgpd ships running and ready for you to add your own BGP neighbours; ospfd runs a live OSPF instance. Add IS-IS, RIP, PIM, LDP, BFD or the other daemons by flipping a flag in /etc/frr/daemons. Kernel IP forwarding is enabled and persisted so the image is a correct router from the start.

## Secure by Default

Every routing daemon binds its telnet VTY to the loopback interface only, so the VTY ports are never reachable off the instance. The suite is managed locally as root with vtysh over a root-only unix socket. No VTY or enable password is baked into the image, and no shared or default routing credential ships. The instance security group opens SSH only; you open the specific protocol ports to your own peers when ready.

## Self-Contained OSPF Demonstration

The image ships a genuinely functional OSPF demonstration that runs on a single instance with no external peers: a virtual link joins the main router to a lightweight peer router in an isolated network namespace, OSPF forms a real Full adjacency across the link, and the peer originates a route that the main router learns via OSPF. Run show ip ospf neighbor to see the Full adjacency and show ip route to see the OSPF-learned route from the moment the instance boots. Replace the demo configuration with your own topology when you are ready.

## Secure First Boot

On the first boot of every deployed instance a one-shot service asserts the VTY is loopback-only, brings up the routing daemons, waits for the demo adjacency and learned route, resolves the instance public IP, and records the per-instance node details in a file only the root user can read. There is no shared secret to rotate because the suite has no network login.

## Why This AMI Instead of a Manual Install

Installing FRR from source or bare packages typically means resolving build dependencies, compiling, writing systemd unit files, hardening the VTY bindings, enabling IP forwarding and testing, which is easily an hour or more of engineering time per instance. This AMI eliminates that entire workflow and ships with security defaults that many manual installs overlook.

## cloudimg Support

24/7 technical support by email and chat. We can help with deployment, BGP and OSPF peering design, route reflectors and route servers, connecting dynamic routing to on-premises networks over a tunnel, and upgrade planning.

## Use Cases

• A BGP route reflector or route server inside your VPC.
• A dynamic-routing speaker that exchanges routes with an on-premises network across a VPN or Direct Connect tunnel.
• A learning and testing lab for BGP, OSPF, IS-IS and the other protocols.
• A software router for overlay and lab topologies.

Note that FRR on an instance is a routing speaker and control plane, and complements rather than replaces the AWS VPC route table for steering traffic between subnets.

FRRouting and FRR are trademarks of their respective holders. This product is not affiliated with, sponsored by, or endorsed by The FRRouting Project or the Linux Foundation. All other product and company names are trademarks or registered trademarks of their respective holders; use of them does not imply any affiliation with or endorsement by them.