BGP Route filter
BGP updates can be controlled by using a numbers of different filtering methods. BGP updates can be filtered based on routes information, on paths information or on communities. All the methods will achieve the same results choosing one over the other depends on the specific network configuration.
You might need to control exactly which routes are advertised or redistribute or which paths are chosen. Advertise only some specific routes to neighbor (security reasons).Redistribute specific routes, preventing routing loops, Path manipulation of some specific routes.
Changing metric and metric-type for specific routes. Changing the administrative distance for specific routes with BGP controlling routes to be advertised to ISP. Control routes to get in to routing table Policy based routing.
lets see the methods of BGP route filtering:
- Distribution-list
- IP prefix-list
- Route map
Goal:
- configure the topology as per the diagram.
- configure EBGP as per the topology and advertise directly connected interfaces
- configure router 2 to block 30.1.1.1/8 networks. make sure router 2 do not install 30.1.1.1/8 network in its routing table.
- configure distribution list in order to block 30.1.1.1/8 network.
R1#show ip interface brief
Interface IP-Address OK? Method Status Protocol
FastEthernet0/0 10.1.1.1 YES manual up up
Serial3/0 1.1.1.1 YES manual up up
Serial3/3 4.1.1.2 YES manual up up
Loopback0 11.0.0.1 YES manual up up
Loopback1 11.0.1.1 YES manual up up
Loopback2 11.0.2.1 YES manual up up
Loopback3 11.0.3.1 YES manual up up
R2#show ip interface brief
Interface IP-Address OK? Method Status Protocol
FastEthernet0/0 20.1.1.1 YES manual up up
Serial3/0 1.1.1.2 YES manual up up
Serial3/1 2.1.1.1 YES manual up up
Loopback0 12.0.0.1 YES manual up up
Loopback1 12.0.1.1 YES manual up up
Loopback2 12.0.2.1 YES manual up up
Loopback3 12.0.3.1 YES manual up up
R3#show ip interface brief
Interface IP-Address OK? Method Status Protocol
FastEthernet0/0 30.1.1.1 YES manual up up
Serial3/1 2.1.1.2 YES manual up up
Serial3/2 3.1.1.1 YES manual up up
Loopback0 13.0.0.1 YES manual up up
Loopback1 13.0.1.1 YES manual up up
Loopback2 13.0.2.1 YES manual up up
Loopback3 13.0.3.1 YES manual up up
R4#show ip interface brief
Interface IP-Address OK? Method Status Protocol
FastEthernet0/0 40.1.1.1 YES manual up up
Serial3/2 3.1.1.2 YES manual up up
Serial3/3 4.1.1.1 YES manual up up
Loopback0 14.0.0.1 YES manual up up
Loopback1 14.0.1.1 YES manual up up
Loopback2 14.0.2.1 YES manual up up
Loopback3 14.0.3.1 YES manual up up
R1(config)#router bgp 650001
R1(config-router)#neighbor 1.1.1.2 remote-as 650002
R1(config-router)#neighbor 4.1.1.1 remote-as 650004
R1(config-router)#network 10.0.0.0
R1(config-router)#network 1.0.0.0
R1(config-router)#network 4.0.0.0
R1(config-router)#end
R2(config)#router bgp 650002
R2(config-router)#neighbor 1.1.1.1 remote-as 650001
*Mar 1 14:39:06.207: %BGP-5-ADJCHANGE: neighbor 1.1.1.1 Up
R2(config-router)#neighbor 2.1.1.2 remote-as 650003
*Mar 1 14:39:29.195: %BGP-5-ADJCHANGE: neighbor 2.1.1.2 Up
R2(config-router)#network 20.0.0.0
R2(config-router)#network 2.0.0.0
R2(config-router)#network 1.0.0.0
R2(config-router)#end
R3(config)#router bgp 650003
R3(config-router)#neighbor 2.1.1.1 remote-as 650002
R3(config-router)#neighbor 2.1.1. remote-as 650004
*Mar 1 14:34:49.651: %BGP-5-ADJCHANGE: neighbor 2.1.1.1 Up
R3(config-router)#neighbor 3.1.1.2 remote-as 650004
R3(config-router)#network 30.0.0.0
R3(config-router)#network 3.0.0.0
R3(config-router)#network 2.0.0.0
R3(config-router)#end
R4(config)#router bgp 650004
R4(config-router)#neighbor 3.1.1.1 remote-as 650003
*Mar 1 14:36:26.991: %BGP-5-ADJCHANGE: neighbor 3.1.1.1 Up
R4(config-router)#neighbor 4.1.1.2 remote-as 650001
*Mar 1 14:36:37.771: %BGP-5-ADJCHANGE: neighbor 4.1.1.2 Up
R4(config-router)#network 40.0.0.0
R4(config-router)#network 4.0.0.0
R4(config-router)#network 3.0.0.0
R4(config-router)#end
R1#show ip bgp
BGP table version is 16, local router ID is 11.0.3.1
Status codes: s suppressed, d damped, h history, * valid, > best, i - internal,
r RIB-failure, S Stale, m multipath, b backup-path, f RT-Filter,
x best-external, a additional-path, c RIB-compressed,
Origin codes: i - IGP, e - EGP, ? - incomplete
RPKI validation codes: V valid, I invalid, N Not found
Network Next Hop Metric LocPrf Weight Path
* 1.0.0.0 1.1.1.2 0 0 650002 i
*> 0.0.0.0 0 32768 i
*> 2.0.0.0 1.1.1.2 0 0 650002 i
* 4.1.1.1 0 650004 650003 i
* 3.0.0.0 1.1.1.2 0 650002 650003 i
*> 4.1.1.1 0 0 650004 i
*> 4.0.0.0 0.0.0.0 0 32768 i
*> 10.0.0.0 0.0.0.0 0 32768 i
*> 20.0.0.0 1.1.1.2 0 0 650002 i
* 30.0.0.0 1.1.1.2 0 650002 650003 i
*> 4.1.1.1 0 650004 650003 i
*> 40.0.0.0 4.1.1.1 0 0 650004 i
R2#show ip bgp
BGP table version is 14, local router ID is 12.0.3.1
Status codes: s suppressed, d damped, h history, * valid, > best, i - internal,
r RIB-failure, S Stale, m multipath, b backup-path, f RT-Filter,
x best-external, a additional-path, c RIB-compressed,
Origin codes: i - IGP, e - EGP, ? - incomplete
RPKI validation codes: V valid, I invalid, N Not found
Network Next Hop Metric LocPrf Weight Path
*> 1.0.0.0 0.0.0.0 0 32768 i
* 1.1.1.1 0 0 650001 i
*> 2.0.0.0 0.0.0.0 0 32768 i
* 2.1.1.2 0 0 650003 i
*> 3.0.0.0 2.1.1.2 0 0 650003 i
* 1.1.1.1 0 650001 650004 i
* 4.0.0.0 2.1.1.2 0 650003 650004 650001 i
*> 1.1.1.1 0 0 650001 i
* 10.0.0.0 2.1.1.2 0 650003 650004 650001 i
*> 1.1.1.1 0 0 650001 i
*> 20.0.0.0 0.0.0.0 0 32768 i
*> 30.0.0.0 2.1.1.2 0 0 650003 i
Network Next Hop Metric LocPrf Weight Path
* 1.1.1.1 0 650001 650004 650003 i
* 40.0.0.0 2.1.1.2 0 650003 650004 i
*> 1.1.1.1 0 650001 650004 i
R3#show ip bgp
BGP table version is 16, local router ID is 13.0.3.1
Status codes: s suppressed, d damped, h history, * valid, > best, i - internal,
r RIB-failure, S Stale, m multipath, b backup-path, f RT-Filter,
x best-external, a additional-path, c RIB-compressed,
Origin codes: i - IGP, e - EGP, ? - incomplete
RPKI validation codes: V valid, I invalid, N Not found
Network Next Hop Metric LocPrf Weight Path
*> 1.0.0.0 2.1.1.1 0 0 650002 i
* 3.1.1.2 0 650004 650001 i
* 2.0.0.0 2.1.1.1 0 0 650002 i
*> 0.0.0.0 0 32768 i
* 3.0.0.0 3.1.1.2 0 0 650004 i
*> 0.0.0.0 0 32768 i
* 4.0.0.0 2.1.1.1 0 650002 650001 i
*> 3.1.1.2 0 650004 650001 i
* 10.0.0.0 2.1.1.1 0 650002 650001 i
*> 3.1.1.2 0 650004 650001 i
* 20.0.0.0 3.1.1.2 0 650004 650001 650002 i
*> 2.1.1.1 0 0 650002 i
*> 30.0.0.0 0.0.0.0 0 32768 i
Network Next Hop Metric LocPrf Weight Path
* 40.0.0.0 2.1.1.1 0 650002 650001 650004 i
*> 3.1.1.2 0 0 650004 i
R4#show ip bgp
BGP table version is 15, local router ID is 14.0.3.1
Status codes: s suppressed, d damped, h history, * valid, > best, i - internal,
r RIB-failure, S Stale, m multipath, b backup-path, f RT-Filter,
x best-external, a additional-path, c RIB-compressed,
Origin codes: i - IGP, e - EGP, ? - incomplete
RPKI validation codes: V valid, I invalid, N Not found
Network Next Hop Metric LocPrf Weight Path
* 1.0.0.0 3.1.1.1 0 650003 650002 i
*> 4.1.1.2 0 0 650001 i
* 2.0.0.0 4.1.1.2 0 650001 650002 i
*> 3.1.1.1 0 0 650003 i
*> 3.0.0.0 0.0.0.0 0 32768 i
* 3.1.1.1 0 0 650003 i
*> 4.0.0.0 4.1.1.2 0 0 650001 i
*> 10.0.0.0 4.1.1.2 0 0 650001 i
* 20.0.0.0 3.1.1.1 0 650003 650002 i
*> 4.1.1.2 0 650001 650002 i
*> 30.0.0.0 3.1.1.1 0 0 650003 i
*> 40.0.0.0 0.0.0.0 0 32768 i
R2#show ip bgp 30.1.1.1
BGP routing table entry for 30.0.0.0/8, version 9
Paths: (2 available, best #1, table default)
Advertised to update-groups:
1
Refresh Epoch 2
650003
2.1.1.2 from 2.1.1.2 (13.0.3.1)
Origin IGP, metric 0, localpref 100, valid, external, best
rx pathid: 0, tx pathid: 0x0
Refresh Epoch 2
650001 650004 650003
1.1.1.1 from 1.1.1.1 (11.0.3.1)
Origin IGP, localpref 100, valid, external
rx pathid: 0, tx pathid: 0
(we are going block 30.1.1.1/8 network by using distribution list)
R2(config)#access-list 30 deny 30.1.1.1 0.255.255.255
R2(config)#access-list 30 permit any
R2(config)#exit
R2(config)#router bgp 650002
R2(config-router)#neighbor 2.1.1.2 distribute-list 30 in
R2(config-router)#neighbor 1.1.1.1 distribute-list 30 in
R2(config-router)#end
R2#clear ip bgp * soft
R2#show ip bgp 30.1.1.1
% Network not in table
let see another method of BGP route filtering. continuing previous configuration :
Topology
