How to use a Quagga BGP (Border Gateway Protocol) router to filter BGP routes

How to use a Quagga BGP (Border Gateway Protocol) router to filter BGP routes

In the previous article, we introduced how to use Quagga to convert a CentOS server into a BGP router, and also introduced BGP peer-to-peer and prefix switching settings. In this tutorial, we will focus on how to use prefix-list and route-map to control data injection and output respectively.

As mentioned in previous articles, BGP routing is determined to be prefix-based receiving and prefix-based broadcast. To avoid incorrect routes, you need to use filters to control the sending and receiving of these prefixes. For example, if one of your BGP peers starts to broadcast a prefix that does not belong to them, and you mistakenly receive these abnormal prefixes, it is also forwarded to the network, and the forwarding process will continue and never stop (the so-called "black hole" is generated in this way ). Therefore, you can use the prefix list and route ing to ensure that the prefix is not received or forwarded to any network. The former is a prefix-based filtering mechanism, and the latter is a more common prefix-based policy that can be used to fine-tune the filtering mechanism.

This article will show you how to use the prefix list and route ing in Quagga.

 

Topology and requirements

This tutorial uses the following topology.

Service provider A and supplier B have set the Peer to an eBGP peer for mutual communication. Their Autonomous System Numbers and prefixes are as follows.

• Peer segment: 192.168.1.0/24
• Service Supplier A: Autonomous System No. 100, Prefix: 10.10.0.0/16
• Service Supplier B: autonomous system number 200, Prefix: 10.255.0.0/16

In this scenario, Vendor B only wants to receive three prefixes from A: 10.10.10.0/23, 10.10.10.0/24, and 10.10.11.0/24.

 

Install Quagga and set BGP peer

In the previous tutorial, we have already written a method for installing Quagga and setting up BGP peers, so we will not detail it here, just briefly introduce BGP configuration and prefix broadcast:

It indicates that the BGP peer has been enabled. Router-A broadcasts multiple prefixes to router-B, while Router-B also broadcasts A prefix 10.255.0.0/16 to router-. Both routers can send and receive prefixes correctly.

 

Create prefix list

A vro can use the ACL or prefix list to filter out a prefix. Prefix lists are more commonly used than ACL because they have fewer processing steps and are easy to create and maintain.

1. ip prefix-list DEMO-PRFX permit 192.168.0.0/23

The above command created a list of prefixes named "DEMO-FRFX" that only allowed the existence of the 192.168.0.0/23 prefix.

Another powerful feature of the prefix list is that it supports subnet mask ranges. See the following example:

1. ip prefix-list DEMO-PRFX permit 192.168.0.0/23 le 24

The prefix list created by this command contains the prefix between 192.168.0.0/23 and/24, namely 192.168.0.0/23,192.168 .0.0/24 and 192.168.1.0/24. The operator "le" indicates less than or equal to. You can also use "ge" to indicate greater than or equal.

A prefix list statement can have multiple allow or deny operations. Each statement is automatically or manually assigned with a serial number.

If multiple prefix list statements exist, these statements are executed in sequence by serial number. When configuring the prefix list, you must note that all prefix list statements are followed by implicit denial statements, that is, all statements that are not explicitly allowed will be rejected.

To allow all prefixes, the prefix list statement is as follows:

1. ip prefix-list DEMO-PRFX permit 0.0.0.0/0 le 32

Now that we know how to create prefix list statements, we want to create a prefix list named "PRFX-LST" to meet the needs of our experiment scenario.

1. router-b# conf t
2. router-b(config)#ip prefix-list PRFX-LST permit 10.10.10.0/23 le 24

 

Create route ing

In addition to the prefix list and ACL, there is also another mechanism called routing ing. You can also control the prefix in the BGP router. In fact, the fine-tuning effect of Route ing on prefix matching is better than that of prefix list and ACL.

Similar to the prefix list, a route ing statement can also specify allow and deny operations. You also need to assign a serial number. Each route match can have multiple allow or deny operations. For example:

1. route-map DEMO-RMAP permit 10

The preceding statement creates a route ing named "DEMO-RMAP" and adds a permit operation with a serial number of 10. Now we use the match command for matching under the route ing corresponding to the serial number.

1. router-a(config-route-map)# match (press ?in the keyboard)

1. as-path Match BGP AS path list
2. community Match BGP community list
3. extcommunity Match BGP/VPN extended community list
4. interface match first hop interface of route
5. ip IP information
6. ipv6 IPv6 information
7. metric Match metric of route
8. origin BGP origin code
9. peer Match peer address
10. probability Match portion of routes defined by percentage value
11. tag Match tag of route

As you can see, the routing ing can match many attributes, and the prefix is matched in this tutorial.

1. route-map DEMO-RMAP permit 10
2. match ip address prefix-list DEMO-PRFX

The match command matches the IP addresses allowed in the previously created prefix list (I .e., 192.168.0.0/23,192.168 .0.0/24 and 192.168.1.0/24 ).

Next, we can use the set command to modify these attributes. Example:

1. route-map DEMO-RMAP permit 10
2. match ip address prefix-list DEMO-PRFX
3. set(press ?in keyboard)

1. aggregator BGP aggregator attribute
2. as-path Transform BGP AS-path attribute
3. atomic-aggregate BGP atomic aggregate attribute
4. comm-listset BGP community list(for deletion)
5. community BGP community attribute
6. extcommunity BGP extended community attribute
7. forwarding-address ForwardingAddress
8. ip IP information
9. ipv6 IPv6 information
10. local-preference BGP local preference path attribute
11. metric Metric value for destination routing protocol
12. metric-type Type of metric
13. origin BGP origin code
14. originator-id BGP originator ID attribute
15. src src address forroute
16. tag Tag value for routing protocol
17. vpnv4 VPNv4 information
18. weight BGP weight for routing table

As you can see, the set command can also modify many attributes. For demonstration, we need to modify the local-preference attribute of BGP.

1. route-map DEMO-RMAP permit 10
2. match ip address prefix-list DEMO-PRFX
3. setlocal-preference 500

As in the prefix list, there are also implicit denial operations at the end of the route ing statement. Therefore, we need to add another allow statement (using serial number 20) to allow all prefixes.

1. route-map DEMO-RMAP permit 10
2. match ip address prefix-list DEMO-PRFX
3. setlocal-preference 500
4. !
5. route-map DEMO-RMAP permit 20

No matching command is specified for serial number 20, so all prefixes are matched by default. In this route ing statement, all prefixes are allowed.

Recall that our requirement is to allow or deny only some prefixes, so the above set command should not exist in this scenario. We only need one allow statement, as shown below:

1. router-b# conf t
2. router-b(config)#route-map RMAP permit 10
3. router-b(config-route-map)# match ip address prefix-list PRFX-LST

This routing ing is what we need.

 

Application route ing

Note that the ACL, prefix list, and route ing will not take effect until it is applied to an interface or a BGP neighbor. Like the ACL and prefix list, a route ing statement can also be used by multiple interfaces or neighbors. However, an interface or a neighbor can only have one route ing statement applied to the input end, and one route ing statement applied to the output end.

Next, we apply this route ing statement to the BGP configuration of router-B and set the input prefix broadcast for the neighbor 192.168.1.1 of router-B.

1. router-b# conf terminal
2. router-b(config)# router bgp 200
3. router-b(config-router)# neighbor 192.168.1.1route-map RMAP in

Check the broadcast route and receive route.

Command for displaying broadcast routes:

1. show ip bgp neighbor-IP advertised-routes

The command for receiving routes is displayed:

1. show ip bgp neighbor-IP routes

As you can see, router-A has four route prefixes that reach router-B, while router-B only receives three. After checking the range, we can know that only the prefixes allowed by the route ing can be displayed on router-B. other prefixes are discarded.

TIPS: If the received prefix content is not refreshed, try to reset the BGP session and use this command:clear ip bgp neighbor-IP. The commands in this tutorial are as follows:

1. clearip bgp 192.168.1.1

We can see that the system has met our requirements. Next, we can create similar prefix lists and route ing statements on router-A and router-B to better control the prefix of input and output.

Here we will summarize the configuration process for ease of viewing.

1. router bgp 200
2. network 10.20.0.0/16
3. neighbor 192.168.1.1 remote-as100
4. neighbor 192.168.1.1route-map RMAP in
5. !
6. ip prefix-list PRFX-LST seq 5 permit 10.10.10.0/23 le 24
7. !
8. route-map RMAP permit 10
9. match ip address prefix-list PRFX-LST

 

Summary

In this tutorial, we demonstrate how to set the prefix list and route ing in Quagga to filter BGP routes. We also show how to combine the prefix list into the route ing to fine-tune the input prefix. You can refer to these methods to set the prefix list and route ing that meet your needs. These tools protect the network from routing poisoning and broadcast from the addresses in the internet route table.

I hope this article will help you.

This article permanently updates the link address: