BGP Route Filtering
ccnp-routing
Notes on filtering BGP updates per neighbor with prefix lists and route maps so that a customer AS does not become a transit AS.
- BGP allows the filtering of BGP Update messages on any BGP router. (In OSPF we could only have filtering on ABRs or ASBRs)
- The router can filter updates per neighbor (not per interface) for both inbound and outbound Update on any BGP router.
- BGP matches the NLRI but can also match the large set of BGP Path Attributes (PA).
- The filters must apply to specific neighbors with BGP. (BGP configuration does not allow filtering of all inbound or outbound updates.)
Why BGP filtering?
- From a service provider perspective we do not need filtering.
- From a customer perspective we need it because if we do not filter, our AS becomes a transit AS.
- In this case, we permit our public IP address to pass but we block any other addresses.
Scenario:
As we can see in the previous example, in R4 the route is selected from ISP2, which we expect. But let us remove R2 from the topology.R4#show ip bgp
BGP table version is 23, local router ID is 4.4.4.4
Status codes: s suppressed, d damped, h history, * valid, > best, i - internal,
r RIB-failure, S Stale, m multipath, b backup-path, f RT-Filter,
x best-external, a additional-path, c RIB-compressed,
Origin codes: i - IGP, e - EGP, ? - incomplete
RPKI validation codes: V valid, I invalid, N Not found
Network Next Hop Metric LocPrf Weight Path
*> 12.12.12.0/24 2.2.2.2 0 0 64500 i
* i 5.5.5.5 0 100 0 64500 i
*> 13.13.13.0/24 2.2.2.2 0 64500 i
* i 5.5.5.5 0 100 0 64500 i
* i 45.45.45.0/24 5.5.5.5 0 100 0 i
*> 0.0.0.0 0 32768 i
* 160.160.160.0/24 2.2.2.2 0 64500 64520 ?
*>i 5.5.5.5 0 100 0 64520 ?
We only permit public IP address block from R2 and R3 to R4, R5, and R6.
For R2, I show how to filter using a prefix-list. In R3, I show how to filter using a route-mapR2(config)#ip prefix-list public_only seq 10 permit 12.12.12.0/24 R2(config)#ip prefix-list public_only seq 20 permit 13.13.13.0/24 R2(config)#router bgp 64500 R2(config-router)#neighbor 4.4.4.4 prefix-list public_only out R2(config-router)#neighbor 5.5.5.5 prefix-list public_only outAs we can see below, in R4 we no longer have a path from
2.2.2.2 to reach R6’s LAN
R4#show ip bgp
BGP table version is 31, local router ID is 4.4.4.4
Status codes: s suppressed, d damped, h history, * valid, > best, i - internal,
r RIB-failure, S Stale, m multipath, b backup-path, f RT-Filter,
x best-external, a additional-path, c RIB-compressed,
Origin codes: i - IGP, e - EGP, ? - incomplete
RPKI validation codes: V valid, I invalid, N Not found
Network Next Hop Metric LocPrf Weight Path
*> 12.12.12.0/24 2.2.2.2 0 0 64500 i
* i 5.5.5.5 0 100 0 64500 i
*> 13.13.13.0/24 2.2.2.2 0 64500 i
* i 5.5.5.5 0 100 0 64500 i
* i 45.45.45.0/24 5.5.5.5 0 100 0 i
*> 0.0.0.0 0 32768 i
*>i 160.160.160.0/24 5.5.5.5 0 100 0 64520 ?
Here is another type of verification:
Before route filtering:R2(config-router)#do show ip bgp neighbor 4.4.4.4 advertised-routes
BGP table version is 5, local router ID is 2.2.2.2
Status codes: s suppressed, d damped, h history, * valid, > best, i - internal,
r RIB-failure, S Stale, m multipath, b backup-path, f RT-Filter,
x best-external, a additional-path, c RIB-compressed,
Origin codes: i - IGP, e - EGP, ? - incomplete
RPKI validation codes: V valid, I invalid, N Not found
Network Next Hop Metric LocPrf Weight Path
*> 12.12.12.0/24 0.0.0.0 0 32768 i
r>i 13.13.13.0/24 1.1.1.1 0 100 0 i
*>i 160.160.160.0/24 3.3.3.3 0 100 0 64520 ?
Total number of prefixes 3
After route filtering:
R2(config-router)#do show ip bgp neighbor 4.4.4.4 advertised-routes
BGP table version is 5, local router ID is 2.2.2.2
Status codes: s suppressed, d damped, h history, * valid, > best, i - internal,
r RIB-failure, S Stale, m multipath, b backup-path, f RT-Filter,
x best-external, a additional-path, c RIB-compressed,
Origin codes: i - IGP, e - EGP, ? - incomplete
RPKI validation codes: V valid, I invalid, N Not found
Network Next Hop Metric LocPrf Weight Path
*> 12.12.12.0/24 0.0.0.0 0 32768 i
r>i 13.13.13.0/24 1.1.1.1 0 100 0 i
Total number of prefixes 2
Let us go configure R3 using a route-map. Before we continue, let us see what prefixes R3 advertises to R6
R3(config-router)#do sho ip bgp nei 6.6.6.6 adv
BGP table version is 15, local router ID is 3.3.3.3
Status codes: s suppressed, d damped, h history, * valid, > best, i - internal,
r RIB-failure, S Stale, m multipath, b backup-path, f RT-Filter,
x best-external, a additional-path, c RIB-compressed,
Origin codes: i - IGP, e - EGP, ? - incomplete
RPKI validation codes: V valid, I invalid, N Not found
Network Next Hop Metric LocPrf Weight Path
r>i 12.12.12.0/24 1.1.1.1 0 100 0 i
*> 13.13.13.0/24 0.0.0.0 0 32768 i
*>i 45.45.45.0/24 2.2.2.2 0 100 0 64510 i
Let us allow R3 to advertise only 12.12.12.0/24 and 13.13.13.0/24, not 45.45.45.0/24
R3(config)#ip prefix-list public_only seq 10 permit 13.13.13.0/24 R3(config)#ip prefix-list public_only seq 20 permit 12.12.12.0/24 R3(config)#route-map bgp_public_only permit R3(config-route-map)#match ip address prefix-list public_only R3(config-router)#neighbor 6.6.6.6 route-map bgp_public_only outVerification:
R3#show ip bgp neighbors 6.6.6.6 advertised-routes
BGP table version is 15, local router ID is 3.3.3.3
Status codes: s suppressed, d damped, h history, * valid, > best, i - internal,
r RIB-failure, S Stale, m multipath, b backup-path, f RT-Filter,
x best-external, a additional-path, c RIB-compressed,
Origin codes: i - IGP, e - EGP, ? - incomplete
RPKI validation codes: V valid, I invalid, N Not found
Network Next Hop Metric LocPrf Weight Path
r>i 12.12.12.0/24 1.1.1.1 0 100 0 i
*> 13.13.13.0/24 0.0.0.0 0 32768 i
Total number of prefixes 2
Back to top