Документация
Документация VyOS
Маршрутизация в VyOS
BGP (Border Gateway Protocol)

BGP (Border Gateway Protocol)

BGP - протокол маршрутизации для обмена информацией о доступности сетей между автономными системами (AS) в интернете.

Обзор

BGP (RFC 4271) - path-vector протокол, являющийся стандартом де-факто для inter-domain маршрутизации.

Характеристики:

  • Протокол уровня приложений (TCP порт 179)
  • Path-vector алгоритм (использует AS path)
  • Policy-based routing
  • Масштабируемость (весь интернет)
  • Медленная конвергенция (стабильность важнее скорости)

Типы BGP:

  • eBGP (External BGP) - между разными AS
  • iBGP (Internal BGP) - внутри одной AS

Применение:

  • Подключение к интернет провайдеру (ISP)
  • Multi-homing (несколько ISP)
  • Transit AS
  • Enterprise с собственным ASN
  • Дата-центры (BGP в ЦОД)
  • Cloud connectivity (AWS, Azure, GCP)

Автономная система (AS)

AS - группа сетей под единым административным управлением с общей routing policy.

AS Number (ASN)

Диапазоны:

  • 1-64511 - публичные ASN (требуют регистрации в RIR)
  • 64512-65534 - приватные ASN (для internal use)
  • 65535 - зарезервирован
  • 4-byte ASN: 65536-4294967295 (RFC 6793)

Получение публичного ASN:

  • Через Regional Internet Registry (RIR)
  • Для России: RIPE NCC
  • Требует обоснование использования

Установка ASN 

set protocols bgp system-as 65001
commit

Обязательный параметр для запуска BGP.

Router ID

Уникальный идентификатор BGP маршрутизатора (формат IPv4 адреса).

set protocols bgp parameters router-id 10.0.0.1
commit

Выбор Router ID (если не настроен явно):

  1. Наибольший IP loopback интерфейса
  2. Наибольший IP физического интерфейса

Рекомендация: Всегда настраивайте router-id явно.

Базовая конфигурация

eBGP с одним ISP 

# AS configuration
set protocols bgp system-as 65001
set protocols bgp parameters router-id 10.0.0.1

# ISP neighbor
set protocols bgp neighbor 203.0.113.1 remote-as 65000
set protocols bgp neighbor 203.0.113.1 address-family ipv4-unicast

# Announce own network
set protocols bgp address-family ipv4-unicast network 192.0.2.0/24

commit
save

Проверка 

show ip bgp summary
show ip bgp neighbors
show ip bgp

Neighbor Configuration

Базовый neighbor

IPv4:

set protocols bgp neighbor 203.0.113.1 remote-as 65000
set protocols bgp neighbor 203.0.113.1 address-family ipv4-unicast
commit

IPv6:

set protocols bgp neighbor 2001:db8::1 remote-as 65000
set protocols bgp neighbor 2001:db8::1 address-family ipv6-unicast
commit

Remote AS

eBGP (разные AS):

set protocols bgp system-as 65001
set protocols bgp neighbor 203.0.113.1 remote-as 65000

iBGP (одна AS):

set protocols bgp system-as 65001
set protocols bgp neighbor 10.0.0.2 remote-as 65001

Update Source

Использовать конкретный интерфейс/IP для BGP соединения:

set protocols bgp neighbor 10.0.0.2 update-source 10.0.0.1
commit

Полезно для iBGP через loopback интерфейсы.

eBGP Multihop

Для eBGP через не-directly connected neighbors:

set protocols bgp neighbor 203.0.113.10 ebgp-multihop 2
commit

Значение - максимальное количество hops (по умолчанию eBGP работает только с directly connected).

Password Authentication

MD5 authentication для BGP сессии:

set protocols bgp neighbor 203.0.113.1 password 'SecurePassword123!'
commit

Пароль должен совпадать на обеих сторонах.

TTL Security

Защита от spoofing атак:

set protocols bgp neighbor 203.0.113.1 ttl-security hops 1
commit

Проверяет TTL пакета (должен быть 255 - hops).

Description 

set protocols bgp neighbor 203.0.113.1 description 'ISP1 - AS65000'
commit

Peer Groups

Группировка neighbors с общими параметрами.

Создание peer group 

set protocols bgp peer-group ISP-PEERS remote-as 65000
set protocols bgp peer-group ISP-PEERS address-family ipv4-unicast
set protocols bgp peer-group ISP-PEERS password 'SharedSecret!'
commit

Добавление neighbors в группу 

set protocols bgp neighbor 203.0.113.1 peer-group ISP-PEERS
set protocols bgp neighbor 203.0.113.2 peer-group ISP-PEERS
commit

Neighbors наследуют параметры от peer-group.

Override параметров 

set protocols bgp neighbor 203.0.113.1 peer-group ISP-PEERS
set protocols bgp neighbor 203.0.113.1 password 'DifferentPassword!'
commit

Индивидуальные параметры имеют приоритет.

Address Families

BGP поддерживает различные протоколы через Multiprotocol Extensions (RFC 4760).

IPv4 Unicast 

set protocols bgp neighbor 203.0.113.1 address-family ipv4-unicast
commit

По умолчанию включен для IPv4 neighbors.

IPv6 Unicast 

set protocols bgp neighbor 2001:db8::1 address-family ipv6-unicast
commit

Multiprotocol BGP

Анонс IPv4 через IPv6 соединение:

set protocols bgp neighbor 2001:db8::1 address-family ipv4-unicast
set protocols bgp neighbor 2001:db8::1 address-family ipv6-unicast
commit

Network Advertisement

Network Statement

Анонс конкретной сети:

set protocols bgp address-family ipv4-unicast network 192.0.2.0/24
commit

Требование: Сеть должна существовать в routing table (через connected, static, или другой протокол).

Добавление static route:

set protocols static route 192.0.2.0/24 blackhole distance 254
set protocols bgp address-family ipv4-unicast network 192.0.2.0/24
commit

Aggregate Address

Суммирование нескольких сетей:

set protocols bgp address-family ipv4-unicast aggregate-address 192.0.2.0/23
commit

Анонсирует суммарный префикс вместо более специфичных.

Summary-only

Анонсировать только суммарный префикс:

set protocols bgp address-family ipv4-unicast aggregate-address 192.0.2.0/23 summary-only
commit

Подавляет более специфичные префиксы.

Route Redistribution

Импорт маршрутов из других источников в BGP.

Redistribution источников

Connected interfaces:

set protocols bgp address-family ipv4-unicast redistribute connected
commit

Static routes:

set protocols bgp address-family ipv4-unicast redistribute static
commit

OSPF:

set protocols bgp address-family ipv4-unicast redistribute ospf
commit

Kernel routes:

set protocols bgp address-family ipv4-unicast redistribute kernel
commit

Selective Redistribution

С route-map для фильтрации:

set protocols bgp address-family ipv4-unicast redistribute connected route-map CONN-TO-BGP
commit

Route Filtering

Prefix Lists

Создание prefix-list:

set policy prefix-list ALLOW-CUSTOMER rule 10 action permit
set policy prefix-list ALLOW-CUSTOMER rule 10 prefix 192.0.2.0/24

set policy prefix-list ALLOW-CUSTOMER rule 20 action permit
set policy prefix-list ALLOW-CUSTOMER rule 20 prefix 198.51.100.0/24

commit

С диапазоном prefix length:

set policy prefix-list FILTER-SMALL rule 10 action deny
set policy prefix-list FILTER-SMALL rule 10 prefix 0.0.0.0/0
set policy prefix-list FILTER-SMALL rule 10 le 24

set policy prefix-list FILTER-SMALL rule 20 action permit
set policy prefix-list FILTER-SMALL rule 20 prefix 0.0.0.0/0
set policy prefix-list FILTER-SMALL rule 20 le 32

commit
  • le (less or equal) - максимальная длина префикса
  • ge (greater or equal) - минимальная длина префикса

Применение prefix-list к neighbor

Incoming (import):

set protocols bgp neighbor 203.0.113.1 address-family ipv4-unicast prefix-list import ALLOW-CUSTOMER
commit

Outgoing (export):

set protocols bgp neighbor 203.0.113.1 address-family ipv4-unicast prefix-list export MY-NETWORKS
commit

Route Maps

Более гибкая фильтрация и изменение атрибутов.

Базовый route-map 

set policy route-map BGP-IN rule 10 action permit
set policy route-map BGP-IN rule 10 match ip address prefix-list ALLOWED-PREFIXES

set policy route-map BGP-IN rule 20 action deny

commit

Изменение атрибутов

Local Preference:

set policy route-map PREFER-ISP1 rule 10 action permit
set policy route-map PREFER-ISP1 rule 10 set local-preference 150
commit

MED (Multi-Exit Discriminator):

set policy route-map SET-MED rule 10 action permit
set policy route-map SET-MED rule 10 set metric 100
commit

AS-path prepend:

set policy route-map PREPEND-PATH rule 10 action permit
set policy route-map PREPEND-PATH rule 10 set as-path prepend '65001 65001'
commit

Community:

set policy route-map TAG-ROUTES rule 10 action permit
set policy route-map TAG-ROUTES rule 10 set community '65001:100'
commit

Применение route-map

Import:

set protocols bgp neighbor 203.0.113.1 address-family ipv4-unicast route-map import BGP-IN
commit

Export:

set protocols bgp neighbor 203.0.113.1 address-family ipv4-unicast route-map export BGP-OUT
commit

BGP Attributes

Local Preference

Предпочтение маршрута для iBGP (выше = лучше).

set protocols bgp neighbor 10.0.0.2 address-family ipv4-unicast route-map import SET-LOCAL-PREF

set policy route-map SET-LOCAL-PREF rule 10 action permit
set policy route-map SET-LOCAL-PREF rule 10 set local-preference 200

commit

По умолчанию: 100.

Использование: Влиять на outbound traffic selection.

MED (Multi-Exit Discriminator)

Hint для соседних AS о предпочтительном входе (ниже = лучше).

set protocols bgp neighbor 203.0.113.1 address-family ipv4-unicast route-map export SET-MED

set policy route-map SET-MED rule 10 action permit
set policy route-map SET-MED rule 10 set metric 50

commit

По умолчанию: 0.

Использование: Влиять на inbound traffic от peer.

AS Path

Список AS через которые прошел маршрут.

Prepend (добавление своего AS):

set policy route-map PREPEND rule 10 action permit
set policy route-map PREPEND rule 10 set as-path prepend '65001 65001 65001'
commit

Используется для depreference маршрута (более длинный path = хуже).

Weight

Cisco-специфичный атрибут (в VyOS используется через route-map).

Установка weight:

set policy route-map SET-WEIGHT rule 10 action permit
set policy route-map SET-WEIGHT rule 10 set weight 100
commit

Выше = предпочтительнее. Локальное значение (не передается neighbors).

BGP Communities

Метки для группировки и фильтрации маршрутов.

Standard Communities

Формат: AS:VALUE (32-bit)

Добавление community:

set policy route-map TAG rule 10 action permit
set policy route-map TAG rule 10 set community '65001:100'
commit

Multiple communities:

set policy route-map TAG rule 10 set community '65001:100'
set policy route-map TAG rule 10 set community '65001:200' additive
commit

Well-known Communities

  • no-export (65535:65281) - не анонсировать в eBGP
  • no-advertise (65535:65282) - не анонсировать никому
  • local-as (65535:65283) - не анонсировать за пределы confederation
set policy route-map NO-EXPORT rule 10 action permit
set policy route-map NO-EXPORT rule 10 set community 'no-export'
commit

Community Lists

Фильтрация по community:

set policy community-list CUSTOMER-A rule 10 action permit
set policy community-list CUSTOMER-A rule 10 regex '65001:1.*'

set policy route-map FILTER-COMMUNITY rule 10 action permit
set policy route-map FILTER-COMMUNITY rule 10 match community community-list CUSTOMER-A

commit

Large Communities

RFC 8092 - формат: AS:VALUE1:VALUE2 (96-bit)

set policy route-map TAG-LARGE rule 10 action permit
set policy route-map TAG-LARGE rule 10 set large-community '65001:100:1'
commit

AS Path Filtering

Фильтрация на основе AS path.

AS Path List 

set policy as-path-list ALLOW-DIRECT rule 10 action permit
set policy as-path-list ALLOW-DIRECT rule 10 regex '^65000_'

set policy as-path-list DENY-TRANSIT rule 10 action deny
set policy as-path-list DENY-TRANSIT rule 10 regex '_65123_'

commit

Regex patterns:

  • ^ - начало
  • $ - конец
  • _ - separator (space, начало, или конец)
  • .* - любые символы
  • [0-9]+ - одна или более цифр

Применение AS Path Filter 

set policy route-map FILTER-AS rule 10 action permit
set policy route-map FILTER-AS rule 10 match as-path as-path-list ALLOW-DIRECT

set protocols bgp neighbor 203.0.113.1 address-family ipv4-unicast route-map import FILTER-AS

commit

iBGP

Internal BGP внутри одной AS.

Базовая iBGP конфигурация

Router 1:

set protocols bgp system-as 65001
set protocols bgp parameters router-id 10.0.0.1

set protocols bgp neighbor 10.0.0.2 remote-as 65001
set protocols bgp neighbor 10.0.0.2 update-source 10.0.0.1
set protocols bgp neighbor 10.0.0.2 address-family ipv4-unicast

commit

Router 2:

set protocols bgp system-as 65001
set protocols bgp parameters router-id 10.0.0.2

set protocols bgp neighbor 10.0.0.1 remote-as 65001
set protocols bgp neighbor 10.0.0.1 update-source 10.0.0.2
set protocols bgp neighbor 10.0.0.1 address-family ipv4-unicast

commit

iBGP Full Mesh

Для N роутеров требуется N(N-1)/2 сессий.

Проблема масштабирования:

  • 3 роутера = 3 сессии
  • 10 роутеров = 45 сессий
  • 100 роутеров = 4950 сессий

Решения: Route Reflector или Confederation.

Route Reflector

Снижает количество iBGP сессий.

Конфигурация Route Reflector

Route Reflector (RR):

set protocols bgp system-as 65001
set protocols bgp parameters router-id 10.0.0.1
set protocols bgp parameters cluster-id 10.0.0.1

# RR clients
set protocols bgp neighbor 10.0.0.10 remote-as 65001
set protocols bgp neighbor 10.0.0.10 address-family ipv4-unicast route-reflector-client

set protocols bgp neighbor 10.0.0.11 remote-as 65001
set protocols bgp neighbor 10.0.0.11 address-family ipv4-unicast route-reflector-client

commit

RR Client:

set protocols bgp system-as 65001
set protocols bgp parameters router-id 10.0.0.10

set protocols bgp neighbor 10.0.0.1 remote-as 65001
set protocols bgp neighbor 10.0.0.1 address-family ipv4-unicast

commit

Clients не нужна full mesh - только соединение с RR.

Multiple Route Reflectors

Для redundancy:

# Client
set protocols bgp neighbor 10.0.0.1 remote-as 65001
set protocols bgp neighbor 10.0.0.2 remote-as 65001
commit

Оба RR должны иметь один cluster-id.

BGP Confederation

Альтернатива Route Reflector - разделение AS на sub-AS.

Конфигурация

AS 65001 (public AS):

  • Sub-AS 65001.1 (private)
  • Sub-AS 65001.2 (private)

Router в Sub-AS 65001.1:

set protocols bgp system-as 65101
set protocols bgp parameters router-id 10.0.1.1

set protocols bgp parameters confederation identifier 65001
set protocols bgp parameters confederation peers 65102

# iBGP внутри sub-AS
set protocols bgp neighbor 10.0.1.2 remote-as 65101

# eBGP с другим sub-AS
set protocols bgp neighbor 10.0.2.1 remote-as 65102

commit

Router в Sub-AS 65001.2:

set protocols bgp system-as 65102
set protocols bgp parameters router-id 10.0.2.1

set protocols bgp parameters confederation identifier 65001
set protocols bgp parameters confederation peers 65101

set protocols bgp neighbor 10.0.1.1 remote-as 65101

commit

BFD Integration

Bidirectional Forwarding Detection для быстрого обнаружения отказов.

Включение BFD 

set protocols bgp neighbor 203.0.113.1 bfd
commit

Настройка BFD профиля 

set protocols bfd profile bgp-peers interval transmit 300
set protocols bfd profile bgp-peers interval receive 300
set protocols bfd profile bgp-peers interval multiplier 3

set protocols bgp neighbor 203.0.113.1 bfd profile bgp-peers

commit

BFD обнаруживает отказ за секунды вместо минут (BGP keepalive).

Timers

Keepalive и Hold Time 

set protocols bgp neighbor 203.0.113.1 timers keepalive 30
set protocols bgp neighbor 203.0.113.1 timers holdtime 90
commit

По умолчанию:

  • Keepalive: 60 секунд
  • Hold time: 180 секунд

Рекомендация: Hold time минимум в 3 раза больше keepalive.

Advertisement Interval 

set protocols bgp neighbor 203.0.113.1 advertisement-interval 30
commit

Минимальный интервал между update сообщениями.

Graceful Restart

Позволяет сохранить forwarding при restart BGP процесса.

set protocols bgp parameters graceful-restart
commit

Restart time:

set protocols bgp parameters graceful-restart restart-time 120
commit

Примеры конфигурации

Dual-homed к двум ISP 

# Local AS
set protocols bgp system-as 65001
set protocols bgp parameters router-id 10.0.0.1

# ISP1 (primary)
set protocols bgp neighbor 203.0.113.1 remote-as 65000
set protocols bgp neighbor 203.0.113.1 description 'ISP1 Primary'
set protocols bgp neighbor 203.0.113.1 address-family ipv4-unicast
set protocols bgp neighbor 203.0.113.1 address-family ipv4-unicast route-map import ISP1-IN
set protocols bgp neighbor 203.0.113.1 address-family ipv4-unicast route-map export MY-NETWORKS

# ISP2 (backup)
set protocols bgp neighbor 198.51.100.1 remote-as 65002
set protocols bgp neighbor 198.51.100.1 description 'ISP2 Backup'
set protocols bgp neighbor 198.51.100.1 address-family ipv4-unicast
set protocols bgp neighbor 198.51.100.1 address-family ipv4-unicast route-map import ISP2-IN
set protocols bgp neighbor 198.51.100.1 address-family ipv4-unicast route-map export MY-NETWORKS-PREPEND

# Announce networks
set protocols bgp address-family ipv4-unicast network 192.0.2.0/24

# Route-maps
set policy route-map ISP1-IN rule 10 action permit
set policy route-map ISP1-IN rule 10 set local-preference 200

set policy route-map ISP2-IN rule 10 action permit
set policy route-map ISP2-IN rule 10 set local-preference 100

set policy route-map MY-NETWORKS rule 10 action permit
set policy route-map MY-NETWORKS rule 10 match ip address prefix-list MY-PREFIXES

set policy route-map MY-NETWORKS-PREPEND rule 10 action permit
set policy route-map MY-NETWORKS-PREPEND rule 10 match ip address prefix-list MY-PREFIXES
set policy route-map MY-NETWORKS-PREPEND rule 10 set as-path prepend '65001 65001'

set policy prefix-list MY-PREFIXES rule 10 action permit
set policy prefix-list MY-PREFIXES rule 10 prefix 192.0.2.0/24

commit
save

iBGP с Route Reflector

Route Reflector:

set protocols bgp system-as 65001
set protocols bgp parameters router-id 10.255.255.1
set protocols bgp parameters cluster-id 10.255.255.1

# RR Clients
set protocols bgp neighbor 10.0.1.1 remote-as 65001
set protocols bgp neighbor 10.0.1.1 update-source 10.255.255.1
set protocols bgp neighbor 10.0.1.1 address-family ipv4-unicast route-reflector-client

set protocols bgp neighbor 10.0.1.2 remote-as 65001
set protocols bgp neighbor 10.0.1.2 update-source 10.255.255.1
set protocols bgp neighbor 10.0.1.2 address-family ipv4-unicast route-reflector-client

set protocols bgp neighbor 10.0.1.3 remote-as 65001
set protocols bgp neighbor 10.0.1.3 update-source 10.255.255.1
set protocols bgp neighbor 10.0.1.3 address-family ipv4-unicast route-reflector-client

commit
save

Client:

set protocols bgp system-as 65001
set protocols bgp parameters router-id 10.0.1.1

set protocols bgp neighbor 10.255.255.1 remote-as 65001
set protocols bgp neighbor 10.255.255.1 update-source 10.0.1.1
set protocols bgp neighbor 10.255.255.1 address-family ipv4-unicast

commit
save

BGP over IPsec VTI 

# IPsec VTI
set interfaces vti vti0 address 172.16.0.1/30

# BGP через VTI
set protocols bgp system-as 65001
set protocols bgp parameters router-id 10.0.0.1

set protocols bgp neighbor 172.16.0.2 remote-as 65002
set protocols bgp neighbor 172.16.0.2 address-family ipv4-unicast

set protocols bgp address-family ipv4-unicast network 192.168.1.0/24

commit
save

Enterprise с филиалами

HQ:

set protocols bgp system-as 65001
set protocols bgp parameters router-id 10.0.0.1

# ISP
set protocols bgp neighbor 203.0.113.1 remote-as 65000
set protocols bgp neighbor 203.0.113.1 address-family ipv4-unicast

# Branch offices (iBGP)
set protocols bgp neighbor 10.0.1.1 remote-as 65001
set protocols bgp neighbor 10.0.1.1 update-source 10.0.0.1
set protocols bgp neighbor 10.0.1.1 address-family ipv4-unicast

set protocols bgp neighbor 10.0.2.1 remote-as 65001
set protocols bgp neighbor 10.0.2.1 update-source 10.0.0.1
set protocols bgp neighbor 10.0.2.1 address-family ipv4-unicast

# Announce HQ network
set protocols bgp address-family ipv4-unicast network 192.168.1.0/24

# Redistribute connected branches
set protocols bgp address-family ipv4-unicast redistribute connected route-map BRANCHES

set policy route-map BRANCHES rule 10 action permit
set policy route-map BRANCHES rule 10 match interface vti0
set policy route-map BRANCHES rule 10 match interface vti1

commit
save

Операционные команды

BGP Summary 

show ip bgp summary

Вывод:

BGP router identifier 10.0.0.1, local AS number 65001
IPv4 Unicast Summary:
Neighbor        V    AS MsgRcvd MsgSent   Up/Down State/PfxRcd
203.0.113.1     4 65000    1234    1456  01:23:45        12345

BGP Neighbors 

show ip bgp neighbors

Детали конкретного neighbor:

show ip bgp neighbors 203.0.113.1

BGP Routes

Все BGP маршруты:

show ip bgp

Конкретный префикс:

show ip bgp 192.0.2.0/24

Received routes (до фильтрации):

show ip bgp neighbors 203.0.113.1 received-routes

Advertised routes:

show ip bgp neighbors 203.0.113.1 advertised-routes

BGP Statistics 

show ip bgp statistics

Clear BGP Session

Soft reset (без разрыва TCP):

clear ip bgp 203.0.113.1 soft

Hard reset:

clear ip bgp 203.0.113.1

All sessions:

clear ip bgp *

Troubleshooting

BGP session не устанавливается

Проверьте:

  1. TCP connectivity:

    ping 203.0.113.1
telnet 203.0.113.1 179

  2. Firewall:

    set firewall ipv4 input filter rule 100 action accept
set firewall ipv4 input filter rule 100 destination port 179
set firewall ipv4 input filter rule 100 protocol tcp
commit

  3. ASN совпадает:

    show configuration commands | grep "remote-as"

  4. Password (если настроен):

    show ip bgp neighbors 203.0.113.1

  5. Логи:

    show log | grep bgp

Routes не получаются

Проверьте:

  1. Address family активирована:

    show protocols bgp neighbor 203.0.113.1

  2. Prefix filters не блокируют:

    show ip bgp neighbors 203.0.113.1 received-routes

  3. Route-maps:

    show policy route-map

Routes не анонсируются

Проверьте:

  1. Network существует в routing table:

    show ip route 192.0.2.0/24

  2. Outbound filters:

    show ip bgp neighbors 203.0.113.1 advertised-routes

  3. Route-map export:

    show configuration commands | grep export

Субоптимальная маршрутизация

Проверьте:

  1. BGP attributes:

    show ip bgp 192.0.2.0/24

  2. Local Preference (для iBGP)

  3. MED (от peer)

  4. AS-path length

Используйте route-maps для изменения атрибутов.

Лучшие практики

  1. Всегда настраивайте router-id явно
  2. Используйте prefix-lists для фильтрации
  3. Password authentication для eBGP
  4. BFD для быстрого failover
  5. Route Reflector вместо full mesh iBGP (при > 5 роутеров)
  6. Loopback interfaces для iBGP update-source
  7. Maximum-prefix для защиты от route leak:
    set protocols bgp neighbor 203.0.113.1 address-family ipv4-unicast maximum-prefix 100000
  8. Документируйте каждого neighbor (description)
  9. Мониторинг состояния BGP сессий
  10. Graceful restart для плановых обслуживаний

Безопасность

Рекомендации

  1. TTL Security:

    set protocols bgp neighbor 203.0.113.1 ttl-security hops 1

  2. Password Authentication:

    set protocols bgp neighbor 203.0.113.1 password 'StrongPassword123!'

  3. Prefix Filtering:

    • Фильтруйте Bogon prefixes
    • Фильтруйте собственные префиксы на import
    • Анонсируйте только свои префиксы

  4. Maximum Prefix Limit:

    set protocols bgp neighbor 203.0.113.1 address-family ipv4-unicast maximum-prefix 1000

  5. AS Path Filtering:

    • Блокируйте private AS на eBGP
    • Блокируйте неожиданные AS paths

  6. Firewall:

    set firewall ipv4 input filter rule 100 action accept
set firewall ipv4 input filter rule 100 source address 203.0.113.1
set firewall ipv4 input filter rule 100 destination port 179
set firewall ipv4 input filter rule 100 protocol tcp

  7. Logging:

    set protocols bgp parameters log-neighbor-changes

  8. RPKI (Resource Public Key Infrastructure) для валидации origin AS

Bogon Filtering

Блокируйте reserved/private IP:

set policy prefix-list BOGONS rule 10 action deny
set policy prefix-list BOGONS rule 10 prefix 0.0.0.0/8 le 32
set policy prefix-list BOGONS rule 20 action deny
set policy prefix-list BOGONS rule 20 prefix 10.0.0.0/8 le 32
set policy prefix-list BOGONS rule 30 action deny
set policy prefix-list BOGONS rule 30 prefix 172.16.0.0/12 le 32
set policy prefix-list BOGONS rule 40 action deny
set policy prefix-list BOGONS rule 40 prefix 192.168.0.0/16 le 32
set policy prefix-list BOGONS rule 50 action deny
set policy prefix-list BOGONS rule 50 prefix 224.0.0.0/4 le 32

set policy prefix-list BOGONS rule 100 action permit
set policy prefix-list BOGONS rule 100 prefix 0.0.0.0/0 le 32

set protocols bgp neighbor 203.0.113.1 address-family ipv4-unicast prefix-list import BOGONS

commit

Следующие шаги

  • OSPF - для enterprise internal routing
  • Static Routes - backup для BGP
  • Route-maps - детальная фильтрация
  • BFD - быстрое обнаружение отказов
  • VRF - изоляция routing tables
Статическая маршрутизация (Static Routes)OSPF (Open Shortest Path First)