Controlling BGP Traffic With Cisco IOS

Others 2176 Hits > 2010-06-14 02:57:40


Controlling BGP Traffic With Cisco IOS
Controlling BGP Traffic With Cisco IOS

1. A peering session to another BGP speaking router is initiated in the config router bgp section:


router bgp 10143


neighbor x.x.92.57 remote-as nnn


2. The filter-list command is used to control which ASN's the router will accept and send:


router bgp 10143


neighbor x.x.92.57 remote-as nnn


neighbor x.x.92.57 filter-list 40 in


neighbor x.x.92.57 filter-list 3 out


2.1 The filter-list command reads the corresponding ip as-path access-list:


ip as-path access-list 3 permit ^$


ip as-path access-list 40 permit ^nnn_


Ip as-path access lists use unix-like regular expressions to match ASN's. ^$ matches the start and end of a line with nothing in it. ^nnn_ matches a line starting with nnn and anything following it.


3. The route-map command is used to apply one or more route-map rules to network addresses the router will accept or send. In most cases, it is used to control specific IP address blocks:


router bgp 10143


neighbor x.x.92.57 remote-as nnn


neighbor x.x.92.57 remove-private-as


neighbor x.x.92.57 filter-list 40 in


neighbor x.x.92.57 filter-list 3 out


neighbor x.x.92.57 route-map bgp-full-default-in in


neighbor x.x.92.57 route-map bgp-peer1-out out


3.1 The route-map command reads the corresponding route-map rules in numerical order:


route-map bgp-peer1-out permit 10


match ip address prefix-list bgp-peer1-out


route-map bgp-peer1-out permit 20


match ip address prefix-list bgp-peer1-out-prepend1


set as-path prepend 10143


route-map bgp-peer1-out permit 30


match ip address prefix-list bgp-peer1-out-prepend2


set as-path prepend 10143 10143


if the route-map instruction is 'permit', it will allow any network permitted in the prefix-list to be announced by bgp. If the instruction is 'deny' it will block any matching network permitted in the prefix-list.


3.2 The ip address prefix-list command reads the corresponding ip prefix-list of network addresses:


ip prefix-list bgp-peer1-out seq 1 permit x.x.128.0/17


ip prefix-list bgp-peer1-out seq 2 permit x.x.0.0/17


ip prefix-list bgp-peer1-out seq 3 permit x.x.0.0/17


ip prefix-list bgp-peer1-out seq 9 permit x.x.64.0/18


ip prefix-list bgp-peer1-out seq 19 permit x.x.0.0/24


ip prefix-list bgp-peer1-out seq 20 permit x.x.1.0/24


ip prefix-list bgp-peer1-out seq 21 permit x.x.5.0/24


ip prefix-list bgp-peer1-out seq 22 permit x.x.6.0/24


ip prefix-list bgp-peer1-out seq 23 permit x.x.7.0/24


ip prefix-list bgp-peer1-out seq 24 permit x.x.8.0/24


ip prefix-list bgp-peer1-out seq 100 permit x.x.236.0/24

....

ip prefix-list bgp-peer1-out seq 1000 deny 0.0.0.0/0 le 32


The last line of this prefix-list will match any network of any netmask length. In other words, any network not explicitly permitted, will be denied.


4. To summarize, in BGP:


* The filter-list command uses an ip as-path access-list to permit or deny AS numbers


* The route-map command uses a route-map apply route-map rules


* The route-map itself uses one or more ip address prefix-list to permit or deny network address blocks






Related Posts