Aggregate RoutesBy nxos

[admin@atrinnet.net]

Hi if add to uplink switch

router bgp 65000

address-family ipv4 unicast

addreggate address 192.168.0.0/24

On all uplink Must be aggregate routes subnet 192.168.0.0/24 and only

One route announce to uplink 192.168.0.0./24

Announce to uplink all routes include this subnet

*>e192.168.0.0/24 172.18.14.250 0 64555 64556 i
*>e192.168.0.0/28 172.18.14.230 0 64555 65110 i

Cannot used prefix-list (only 24 permit )for my DDOS service work for /32

How can Aggregate that only announce supernet 192.168.0.0/24 to uplink ?

[balaji.bandi]

Based on the information, i suggest below command  :

router bgp 65000
 aggregate-address 192.168.0.0 255.255.255.0 summary-only

 check

show ip bgp neighbor x.x.x.x advertised-routes

you can refer to the document if needed :

https://www.cisco.com/c/en/us/support/docs/ip/border-gateway-protocol-bgp/5441-aggregation.html#toc-hId-237939006

[admin@atrinnet.net]

If used aggregate 192.168.0.0/24  0.0.0.0  

If used summary only next-hop of ip Learn still from bgp ? for example show ip route 192.168.0.0/24 172.18.20.74

[Cristian Matei]

Hi,

    You have three options:

1. use "summary-only" keyword when defining your aggregate, to advertise only the aggregate, however this aggregate will be advertised out to all your BGP neighbors

2. use a route-map out filter where you match on your aggregate, any other subnets within the aggregate and apply it in out direction to BGP neighbors you want this filter to be applied

3. use both the aggregate and the route-map filter, which is what I recommend

Here's the config sample:

ip prefix-list DENY_BGP_AGGREGATE_SUBNETS seq 5 permit 192.168.0.0/24 le 32 
ip prefix-list PERMIT_BGP_AGGREGATE permit 192.168.0.0/24
!
route-map BGP_EGRESS_FILTER permit 10
  match ip address prefix-list PERMIT_BGP_AGGREGATE
route-map BGP_EGRESS_FILTER deny 20
  match ip address prefix-list DENY_BGP_AGGREGATE_SUBNETS
route-map BGP_EGRESS_FILTER permit 30
!
router bgp 100
  address-family ipv4 unicast
    aggregate-address 192.168.0.0/24 summary-only
  neighbor x.x.x.x
    address-family ipv4 unicast
      route-map BGP_EGRESS_FILTER out

 To your aggregate command you can also use the "attribute-map" keyword and attach a route-map where you set specific BGP attributes that your aggregate will be advertised with.

Thanks,

Cristian.

[Giuseppe Larosa]

Hello admin@atrinnet.net ,

you need to add the summary-only in aggregate-address command

as it is explained here:

https://www.cisco.com/c/en/us/td/docs/switches/datacenter/nexus3000/sw/unicast/93x/configuration/guide/b-cisco-nexus-3000-series-nx-os-unicast-routing-configuration-guide-93x/b-cisco-nexus-3000-series-nx-os-unicast-routing-configuration-guide-93x_cha...

Hope to help

Giuseppe