How can I filter BGP routes in a Quagga BGP router?

How can I filter BGP routes in a Quagga BGP router?

In the previous tutorial, we demonstrated how to use Quagga to convert a CentOS device into a Border Gateway Protocol (BGP) router. We also discussed basic BGP peer-to-peer and prefix exchange settings. This tutorial describes how to use prefix-list and route-map to control inbound and outbound BGP prefixes.

As described in the previous tutorial, BGP routing decisions are made based on the prefix of the receipt/notification. To ensure that there are no routing errors, we recommend that you use a filtering mechanism to control these inbound and outbound prefixes. For example, if one of your BGP peers starts to advertise that they do not belong to their prefixes and you mistakenly receive such false prefixes, your traffic will be sent to the wrong neighbor, finally, I don't know where I am (this is the so-called "black hole "). To ensure that the prefix is not received or advertised to any neighbors, you can use the prefix list and route ing table. The former is a prefix-based filtering mechanism, while the latter is a general prefix-based policy mechanism for fine-tuning actions.

We will demonstrate how to use the prefix list and route ing table in Quagga.

Topology structure and requirements

In this tutorial, we assume that the following topology is used.

Service provider A has established an eBGP peer relationship with service provider B, and they exchange routing information between them. The AS and prefix are described AS follows.

• Peer block: 192.168.1.0/24

• Service Provider A: AS 100, Prefix: 10.10.0.0/16

• Service Provider B: AS 200, Prefix: 10.255.0.0/16

In this scenario, service provider B only needs to receive the three prefixes 10.10.10.0/23, 10.10.10.0/24, and 10.10.11.0/24 from provider.

Quagga installation and BGP peer-to-peer

In the previous tutorial, we discussed how to install Quagga and set BGP peer-to-peer. So we will not repeat the details here. However, I provide a summary of BGP configuration and prefix announcement:

The above output shows that BPG equivalence has been established. Vroa A notifies vrob B of multiple prefixes. On the other hand, vrob B notifies vroa A of A single prefix 10.255.0.0/16. Both routers can receive the prefix normally without any problems.

Create prefix list

In a vro, you can use the access control list (ACL) or prefix list to block the prefix. Prefix lists are often preferred to use prefix lists instead of ACL, because prefix lists do not consume as much processor resources as they do. In addition, it is easier to create and maintain the prefix list.

Ip prefix-list DEMO-PRFX permit 192.168.0.0/23

The preceding command creates a prefix list named "DEMO-FRFX" that only allows 192.168.0.0/23.

Another outstanding feature of the prefix list is that we can specify the subnet mask range. Take a look at the following example:

Ip prefix-list DEMO-PRFX permit 192.168.0.0/23 le 24

The above command creates a prefix list named "DEMO-PRFX" that allows prefixes between 192.168.0.0/23 and/24, including 192.168.0.0/23, 192.168.0.0/24, and 192.168.1.0/24. the "le" Operator means less than or equal. You can also use the "ge" operator to indicate greater than or equal.

A prefix list statement may have multiple allow/deny actions. Each statement is assigned a sequence number that can be automatically determined or manually specified.

Multiple prefix list statements are analyzed one by one in the ascending order of serial numbers. When configuring the prefix list, we should keep in mind that there is always an implicit denial (implicit deny) at the end of all prefix list statements ). This means that any prefix that is not explicitly allowed will be rejected.

To allow everything, we can use the following prefix list statement, which allows any Prefix: Starting from 0.0.0.0/0 until any address of subnet mask/32 is used.

Ip prefix-list DEMO-PRFX permit 0.0.0.0/0 le 32

Now that we know how to create a prefix list statement, we will create a prefix list named "PRFX-LST" to allow the prefix we need in the scenario.

Router-B # conf t

Router-B (config) # ip prefix-list PRFX-LST permit 10.10.10.0/23 le 24

Create a route ing table

In addition to the prefix list and ACL, there is also a mechanism named routing ing table, which can control the prefix in the BGP router. In fact, the routing ing table can be used for prefix matching with the ACL or prefix list to flexibly fine-tune the actions that may be appropriate.

Similar to the prefix list, the route ing TABLE statement specifies the allow or deny action, followed by the serial number. Each route ing TABLE statement may contain multiple allow/deny actions, such:

Route-map DEMO-RMAP permit 10

The preceding statement creates a route ing table named "DEMO-RMAP" and adds Order 10 to allow actions. Now we will use the match command in order 10.

Router-a (config-route-map) # match (press? In the keyboard)

As-path Matching bgp as path list

Community matches the list of BGP group attributes

Extcommunity matches the list of BGP/VPN extended group attributes

Interface matches the first interface of a route

Ip address information

Ipv6 Information

Metric matching routing metric

Origin BGP source code

Peer matching peer address

Route part defined by probability matching percentage value

Tag matching route tag

As we can see, the routing ing table can match many attributes. We will match the prefix in this tutorial.

Route-map DEMO-RMAP permit 10

Match ip address prefix-list DEMO-PRFX

The match command matches the IP addresses allowed by the previously created prefix list DEMO-PRFX (namely, the three prefixes 192.168.0.0/23, 192.168.0.0/24, and 192.168.1.0/24 ).

Next, we can use the set command to modify the attributes. The following example shows the possible use cases of set.

Route-map DEMO-RMAP permit 10

Match ip address prefix-list DEMO-PRFX

Set (press? In keyboard)

Aggregator BGP aggregation attributes

Change BGP as path attributes using AS-path

Atomic-aggregate BGP atomic aggregation attribute

Comm-list sets the list of BGP group attributes (used to delete)

Community BGP group attributes

Extcommunity BGP extended group attributes

Forwarding-address

Ip address information

Ipv6 Information

Local-preference BGP local preferred path attributes

Metric standard value for the destination Routing Protocol

Metric-type metric type

Origin BGP source code

Originator-id BGP initiator ID attribute

Src address of the src route

Tag value of the tag Routing Protocol

Vpnv4 VPNv4 Information

BGP weight of the weight route table

As we can see, the set command can be used to change many attributes. For demonstration, we will set BGP local preferences.

Route-map DEMO-RMAP permit 10

Match ip address prefix-list DEMO-PRFX

Set local-preference 500

Like the prefix list, all route ing table statements are implicitly rejected at the end. Therefore, we will add another allow statement in number 20 to allow all prefixes.

Route-map DEMO-RMAP permit 10

Match ip address prefix-list DEMO-PRFX

Set local-preference 500

!

Route-map DEMO-RMAP permit 20

Serial number 20 does not have a specific match command, so it matches everything by default. Because the decision is allowed, the route ing TABLE statement will allow everything.

If you still remember, our requirement is to only allow/deny some prefixes. So in our scenario, the set command is unnecessary. We will only use one allowed statement, as shown below.

Router-B # conf t

Router-B (config) # route-map RMAP permit 10

Router-B (config-route-map) # match ip address prefix-list PRFX-LST

This route ing TABLE statement should be able to get the desired results.

Use the route ing table

Keep in mind that the ACL, prefix list, and route ing table will not work unless it is used by an interface or BGP neighbor. Just like the ACL or prefix list, a single route ing TABLE statement can be used with any number of interfaces or neighbors. However, any interface or neighbor can only support one route ing TABLE statement for inbound traffic, and only one route ing TABLE statement for outbound traffic.

We will apply the newly created route ing table to the BGP configuration of vrob B for the neighbor 192.168.1.1 and use the inbound prefix to advertise.

Router-B # conf terminal

Router-B (config) # router bgp 200

Router-B (config-router) # neighbor 192.168.1.1 route-map RMAP in

Now, we use the following command to check the route advertised and received.

For advertised routes:

Show ip bgp neighbor-IP advertised-routes

For the received route:

Show ip bgp neighbor-IP routes

You can find that although vroa A notifies vrob B of four prefixes, vro receives only three prefixes. If we check the range, we can see that only the prefixes allowed by the route ing table are visible on vrob B. All other prefixes are discarded.

Tip: If the received prefix does not change, try to use the command "clear ip bgp neighbor-IP" to reset the BGP session. In our example:

Clear ip bgp 192.168.1.1

As we have seen, the requirements have been met. You can create A similar prefix list and route ing TABLE statement in Router A and router B to further control the inbound and outbound prefixes.

I summarized the configuration in one place so that you can see it at a glance.

Router bgp 200

Network 10.255.0.0/16

Neighbor 192.168.1.1 remote-as 100

Neighbor 192.168.1.1 route-map RMAP in

!

Ip prefix-list PRFX-LST seq 5 permit 10.10.10.0/23 le 24

!

Route-map RMAP permit 10

Match ip address prefix-list PRFX-LST

Conclusion

This tutorial demonstrates how to define a prefix list and a route ing table to filter BPG routes in Quagga. We also demonstrated how to combine the prefix list and route ing table to precisely control the inbound prefix. You can create your own prefix list and route ing table in a similar way to match your network requirements. These tools are one of the most effective ways to protect production networks from routing damages and announcements of fake routes.

I hope this article is helpful.

Create a router record using Quagga (Zebra) in Linux

This article permanently updates the link address: