Documentation
VyOS Documentation
Routing in VyOS
BGP (Border Gateway Protocol)

BGP (Border Gateway Protocol)

BGP is a routing protocol used to exchange network reachability information between autonomous systems (AS) on the internet.

Overview

BGP (RFC 4271) is a path-vector protocol and the de facto standard for inter-domain routing.

Characteristics:

  • Application-layer protocol (TCP port 179)
  • Path-vector algorithm (uses the AS path)
  • Policy-based routing
  • Scalability (the entire internet)
  • Slow convergence (stability matters more than speed)

BGP types:

  • eBGP (External BGP) - between different AS
  • iBGP (Internal BGP) - within a single AS

Use cases:

  • Connecting to an internet service provider (ISP)
  • Multi-homing (multiple ISPs)
  • Transit AS
  • Enterprise with its own ASN
  • Data centers (BGP in the DC)
  • Cloud connectivity (AWS, Azure, GCP)

Autonomous system (AS)

An AS is a group of networks under a single administrative authority with a common routing policy.

AS Number (ASN)

Ranges:

  • 1-64511 - public ASNs (require registration with an RIR)
  • 64512-65534 - private ASNs (for internal use)
  • 65535 - reserved
  • 4-byte ASN: 65536-4294967295 (RFC 6793)

Obtaining a public ASN:

  • Through a Regional Internet Registry (RIR)
  • For Russia: RIPE NCC
  • Requires justification of use

Setting the ASN

set protocols bgp system-as 65001
commit

A mandatory parameter to start BGP.

Router ID

A unique identifier for the BGP router (in IPv4 address format).

set protocols bgp parameters router-id 10.0.0.1
commit

Router ID selection (if not set explicitly):

  1. Highest loopback interface IP
  2. Highest physical interface IP

Recommendation: Always configure the router-id explicitly.

Basic configuration

eBGP with a single ISP

# AS configuration
set protocols bgp system-as 65001
set protocols bgp parameters router-id 10.0.0.1

# ISP neighbor
set protocols bgp neighbor 203.0.113.1 remote-as 65000
set protocols bgp neighbor 203.0.113.1 address-family ipv4-unicast

# Announce own network
set protocols bgp address-family ipv4-unicast network 192.0.2.0/24

commit
save

Verification

show ip bgp summary
show ip bgp neighbors
show ip bgp

Neighbor Configuration

Basic neighbor

IPv4:

set protocols bgp neighbor 203.0.113.1 remote-as 65000
set protocols bgp neighbor 203.0.113.1 address-family ipv4-unicast
commit

IPv6:

set protocols bgp neighbor 2001:db8::1 remote-as 65000
set protocols bgp neighbor 2001:db8::1 address-family ipv6-unicast
commit

Remote AS

eBGP (different AS):

set protocols bgp system-as 65001
set protocols bgp neighbor 203.0.113.1 remote-as 65000

iBGP (same AS):

set protocols bgp system-as 65001
set protocols bgp neighbor 10.0.0.2 remote-as 65001

Update Source

Use a specific interface/IP for the BGP connection:

set protocols bgp neighbor 10.0.0.2 update-source 10.0.0.1
commit

Useful for iBGP over loopback interfaces.

eBGP Multihop

For eBGP over neighbors that are not directly connected:

set protocols bgp neighbor 203.0.113.10 ebgp-multihop 2
commit

The value is the maximum number of hops (by default eBGP works only with directly connected peers).

Password Authentication

MD5 authentication for the BGP session:

set protocols bgp neighbor 203.0.113.1 password 'SecurePassword123!'
commit

The password must match on both sides.

TTL Security

Protection against spoofing attacks:

set protocols bgp neighbor 203.0.113.1 ttl-security hops 1
commit

Checks the packet TTL (it must be 255 - hops).

Description

set protocols bgp neighbor 203.0.113.1 description 'ISP1 - AS65000'
commit

Peer Groups

Grouping neighbors that share common parameters.

Creating a peer group

set protocols bgp peer-group ISP-PEERS remote-as 65000
set protocols bgp peer-group ISP-PEERS address-family ipv4-unicast
set protocols bgp peer-group ISP-PEERS password 'SharedSecret!'
commit

Adding neighbors to the group

set protocols bgp neighbor 203.0.113.1 peer-group ISP-PEERS
set protocols bgp neighbor 203.0.113.2 peer-group ISP-PEERS
commit

Neighbors inherit parameters from the peer-group.

Overriding parameters

set protocols bgp neighbor 203.0.113.1 peer-group ISP-PEERS
set protocols bgp neighbor 203.0.113.1 password 'DifferentPassword!'
commit

Individual parameters take precedence.

Address Families

BGP supports various protocols through Multiprotocol Extensions (RFC 4760).

IPv4 Unicast

set protocols bgp neighbor 203.0.113.1 address-family ipv4-unicast
commit

Enabled by default for IPv4 neighbors.

IPv6 Unicast

set protocols bgp neighbor 2001:db8::1 address-family ipv6-unicast
commit

Multiprotocol BGP

Announcing IPv4 over an IPv6 connection:

set protocols bgp neighbor 2001:db8::1 address-family ipv4-unicast
set protocols bgp neighbor 2001:db8::1 address-family ipv6-unicast
commit

Network Advertisement

Network Statement

Announcing a specific network:

set protocols bgp address-family ipv4-unicast network 192.0.2.0/24
commit

Requirement: The network must exist in the routing table (via connected, static, or another protocol).

Adding a static route:

set protocols static route 192.0.2.0/24 blackhole distance 254
set protocols bgp address-family ipv4-unicast network 192.0.2.0/24
commit

Aggregate Address

Summarizing multiple networks:

set protocols bgp address-family ipv4-unicast aggregate-address 192.0.2.0/23
commit

Announces the summary prefix instead of the more specific ones.

Summary-only

Announce only the summary prefix:

set protocols bgp address-family ipv4-unicast aggregate-address 192.0.2.0/23 summary-only
commit

Suppresses the more specific prefixes.

Route Redistribution

Importing routes from other sources into BGP.

Redistribution sources

Connected interfaces:

set protocols bgp address-family ipv4-unicast redistribute connected
commit

Static routes:

set protocols bgp address-family ipv4-unicast redistribute static
commit

OSPF:

set protocols bgp address-family ipv4-unicast redistribute ospf
commit

Kernel routes:

set protocols bgp address-family ipv4-unicast redistribute kernel
commit

Selective Redistribution

With a route-map for filtering:

set protocols bgp address-family ipv4-unicast redistribute connected route-map CONN-TO-BGP
commit

Route Filtering

Prefix Lists

Creating a prefix-list:

set policy prefix-list ALLOW-CUSTOMER rule 10 action permit
set policy prefix-list ALLOW-CUSTOMER rule 10 prefix 192.0.2.0/24

set policy prefix-list ALLOW-CUSTOMER rule 20 action permit
set policy prefix-list ALLOW-CUSTOMER rule 20 prefix 198.51.100.0/24

commit

With a prefix length range:

set policy prefix-list FILTER-SMALL rule 10 action deny
set policy prefix-list FILTER-SMALL rule 10 prefix 0.0.0.0/0
set policy prefix-list FILTER-SMALL rule 10 le 24

set policy prefix-list FILTER-SMALL rule 20 action permit
set policy prefix-list FILTER-SMALL rule 20 prefix 0.0.0.0/0
set policy prefix-list FILTER-SMALL rule 20 le 32

commit
  • le (less or equal) - maximum prefix length
  • ge (greater or equal) - minimum prefix length

Applying a prefix-list to a neighbor

Incoming (import):

set protocols bgp neighbor 203.0.113.1 address-family ipv4-unicast prefix-list import ALLOW-CUSTOMER
commit

Outgoing (export):

set protocols bgp neighbor 203.0.113.1 address-family ipv4-unicast prefix-list export MY-NETWORKS
commit

Route Maps

More flexible filtering and attribute modification.

Basic route-map

set policy route-map BGP-IN rule 10 action permit
set policy route-map BGP-IN rule 10 match ip address prefix-list ALLOWED-PREFIXES

set policy route-map BGP-IN rule 20 action deny

commit

Modifying attributes

Local Preference:

set policy route-map PREFER-ISP1 rule 10 action permit
set policy route-map PREFER-ISP1 rule 10 set local-preference 150
commit

MED (Multi-Exit Discriminator):

set policy route-map SET-MED rule 10 action permit
set policy route-map SET-MED rule 10 set metric 100
commit

AS-path prepend:

set policy route-map PREPEND-PATH rule 10 action permit
set policy route-map PREPEND-PATH rule 10 set as-path prepend '65001 65001'
commit

Community:

set policy route-map TAG-ROUTES rule 10 action permit
set policy route-map TAG-ROUTES rule 10 set community '65001:100'
commit

Applying a route-map

Import:

set protocols bgp neighbor 203.0.113.1 address-family ipv4-unicast route-map import BGP-IN
commit

Export:

set protocols bgp neighbor 203.0.113.1 address-family ipv4-unicast route-map export BGP-OUT
commit

BGP Attributes

Local Preference

Route preference for iBGP (higher = better).

set protocols bgp neighbor 10.0.0.2 address-family ipv4-unicast route-map import SET-LOCAL-PREF

set policy route-map SET-LOCAL-PREF rule 10 action permit
set policy route-map SET-LOCAL-PREF rule 10 set local-preference 200

commit

Default: 100.

Use: Influence outbound traffic selection.

MED (Multi-Exit Discriminator)

A hint to neighboring AS about the preferred entry point (lower = better).

set protocols bgp neighbor 203.0.113.1 address-family ipv4-unicast route-map export SET-MED

set policy route-map SET-MED rule 10 action permit
set policy route-map SET-MED rule 10 set metric 50

commit

Default: 0.

Use: Influence inbound traffic from a peer.

AS Path

The list of AS the route has traversed.

Prepend (adding your own AS):

set policy route-map PREPEND rule 10 action permit
set policy route-map PREPEND rule 10 set as-path prepend '65001 65001 65001'
commit

Used to depreference a route (a longer path = worse).

Weight

A Cisco-specific attribute (used in VyOS through a route-map).

Setting weight:

set policy route-map SET-WEIGHT rule 10 action permit
set policy route-map SET-WEIGHT rule 10 set weight 100
commit

Higher = preferred. A local value (not passed to neighbors).

BGP Communities

Tags for grouping and filtering routes.

Standard Communities

Format: AS:VALUE (32-bit)

Adding a community:

set policy route-map TAG rule 10 action permit
set policy route-map TAG rule 10 set community '65001:100'
commit

Multiple communities:

set policy route-map TAG rule 10 set community '65001:100'
set policy route-map TAG rule 10 set community '65001:200' additive
commit

Well-known Communities

  • no-export (65535:65281) - do not advertise into eBGP
  • no-advertise (65535:65282) - do not advertise to anyone
  • local-as (65535:65283) - do not advertise beyond the confederation
set policy route-map NO-EXPORT rule 10 action permit
set policy route-map NO-EXPORT rule 10 set community 'no-export'
commit

Community Lists

Filtering by community:

set policy community-list CUSTOMER-A rule 10 action permit
set policy community-list CUSTOMER-A rule 10 regex '65001:1.*'

set policy route-map FILTER-COMMUNITY rule 10 action permit
set policy route-map FILTER-COMMUNITY rule 10 match community community-list CUSTOMER-A

commit

Large Communities

RFC 8092 - format: AS:VALUE1:VALUE2 (96-bit)

set policy route-map TAG-LARGE rule 10 action permit
set policy route-map TAG-LARGE rule 10 set large-community '65001:100:1'
commit

AS Path Filtering

Filtering based on the AS path.

AS Path List

set policy as-path-list ALLOW-DIRECT rule 10 action permit
set policy as-path-list ALLOW-DIRECT rule 10 regex '^65000_'

set policy as-path-list DENY-TRANSIT rule 10 action deny
set policy as-path-list DENY-TRANSIT rule 10 regex '_65123_'

commit

Regex patterns:

  • ^ - start
  • $ - end
  • _ - separator (space, start, or end)
  • .* - any characters
  • [0-9]+ - one or more digits

Applying an AS Path Filter

set policy route-map FILTER-AS rule 10 action permit
set policy route-map FILTER-AS rule 10 match as-path as-path-list ALLOW-DIRECT

set protocols bgp neighbor 203.0.113.1 address-family ipv4-unicast route-map import FILTER-AS

commit

iBGP

Internal BGP within a single AS.

Basic iBGP configuration

Router 1:

set protocols bgp system-as 65001
set protocols bgp parameters router-id 10.0.0.1

set protocols bgp neighbor 10.0.0.2 remote-as 65001
set protocols bgp neighbor 10.0.0.2 update-source 10.0.0.1
set protocols bgp neighbor 10.0.0.2 address-family ipv4-unicast

commit

Router 2:

set protocols bgp system-as 65001
set protocols bgp parameters router-id 10.0.0.2

set protocols bgp neighbor 10.0.0.1 remote-as 65001
set protocols bgp neighbor 10.0.0.1 update-source 10.0.0.2
set protocols bgp neighbor 10.0.0.1 address-family ipv4-unicast

commit

iBGP Full Mesh

For N routers, N(N-1)/2 sessions are required.

Scaling problem:

  • 3 routers = 3 sessions
  • 10 routers = 45 sessions
  • 100 routers = 4950 sessions

Solutions: Route Reflector or Confederation.

Route Reflector

Reduces the number of iBGP sessions.

Route Reflector configuration

Route Reflector (RR):

set protocols bgp system-as 65001
set protocols bgp parameters router-id 10.0.0.1
set protocols bgp parameters cluster-id 10.0.0.1

# RR clients
set protocols bgp neighbor 10.0.0.10 remote-as 65001
set protocols bgp neighbor 10.0.0.10 address-family ipv4-unicast route-reflector-client

set protocols bgp neighbor 10.0.0.11 remote-as 65001
set protocols bgp neighbor 10.0.0.11 address-family ipv4-unicast route-reflector-client

commit

RR Client:

set protocols bgp system-as 65001
set protocols bgp parameters router-id 10.0.0.10

set protocols bgp neighbor 10.0.0.1 remote-as 65001
set protocols bgp neighbor 10.0.0.1 address-family ipv4-unicast

commit

Clients do not need a full mesh - only a connection to the RR.

Multiple Route Reflectors

For redundancy:

# Client
set protocols bgp neighbor 10.0.0.1 remote-as 65001
set protocols bgp neighbor 10.0.0.2 remote-as 65001
commit

Both RRs must have the same cluster-id.

BGP Confederation

An alternative to Route Reflector - splitting the AS into sub-AS.

Configuration

AS 65001 (public AS):

  • Sub-AS 65001.1 (private)
  • Sub-AS 65001.2 (private)

Router in Sub-AS 65001.1:

set protocols bgp system-as 65101
set protocols bgp parameters router-id 10.0.1.1

set protocols bgp parameters confederation identifier 65001
set protocols bgp parameters confederation peers 65102

# iBGP within the sub-AS
set protocols bgp neighbor 10.0.1.2 remote-as 65101

# eBGP with the other sub-AS
set protocols bgp neighbor 10.0.2.1 remote-as 65102

commit

Router in Sub-AS 65001.2:

set protocols bgp system-as 65102
set protocols bgp parameters router-id 10.0.2.1

set protocols bgp parameters confederation identifier 65001
set protocols bgp parameters confederation peers 65101

set protocols bgp neighbor 10.0.1.1 remote-as 65101

commit

BFD Integration

Bidirectional Forwarding Detection for fast failure detection.

Enabling BFD

set protocols bgp neighbor 203.0.113.1 bfd
commit

Configuring a BFD profile

set protocols bfd profile bgp-peers interval transmit 300
set protocols bfd profile bgp-peers interval receive 300
set protocols bfd profile bgp-peers interval multiplier 3

set protocols bgp neighbor 203.0.113.1 bfd profile bgp-peers

commit

BFD detects a failure in seconds instead of minutes (BGP keepalive).

Timers

Keepalive and Hold Time

set protocols bgp neighbor 203.0.113.1 timers keepalive 30
set protocols bgp neighbor 203.0.113.1 timers holdtime 90
commit

Defaults:

  • Keepalive: 60 seconds
  • Hold time: 180 seconds

Recommendation: Hold time should be at least three times the keepalive.

Advertisement Interval

set protocols bgp neighbor 203.0.113.1 advertisement-interval 30
commit

The minimum interval between update messages.

Graceful Restart

Allows forwarding to be preserved when the BGP process restarts.

set protocols bgp parameters graceful-restart
commit

Restart time:

set protocols bgp parameters graceful-restart restart-time 120
commit

Configuration examples

Dual-homed to two ISPs

# Local AS
set protocols bgp system-as 65001
set protocols bgp parameters router-id 10.0.0.1

# ISP1 (primary)
set protocols bgp neighbor 203.0.113.1 remote-as 65000
set protocols bgp neighbor 203.0.113.1 description 'ISP1 Primary'
set protocols bgp neighbor 203.0.113.1 address-family ipv4-unicast
set protocols bgp neighbor 203.0.113.1 address-family ipv4-unicast route-map import ISP1-IN
set protocols bgp neighbor 203.0.113.1 address-family ipv4-unicast route-map export MY-NETWORKS

# ISP2 (backup)
set protocols bgp neighbor 198.51.100.1 remote-as 65002
set protocols bgp neighbor 198.51.100.1 description 'ISP2 Backup'
set protocols bgp neighbor 198.51.100.1 address-family ipv4-unicast
set protocols bgp neighbor 198.51.100.1 address-family ipv4-unicast route-map import ISP2-IN
set protocols bgp neighbor 198.51.100.1 address-family ipv4-unicast route-map export MY-NETWORKS-PREPEND

# Announce networks
set protocols bgp address-family ipv4-unicast network 192.0.2.0/24

# Route-maps
set policy route-map ISP1-IN rule 10 action permit
set policy route-map ISP1-IN rule 10 set local-preference 200

set policy route-map ISP2-IN rule 10 action permit
set policy route-map ISP2-IN rule 10 set local-preference 100

set policy route-map MY-NETWORKS rule 10 action permit
set policy route-map MY-NETWORKS rule 10 match ip address prefix-list MY-PREFIXES

set policy route-map MY-NETWORKS-PREPEND rule 10 action permit
set policy route-map MY-NETWORKS-PREPEND rule 10 match ip address prefix-list MY-PREFIXES
set policy route-map MY-NETWORKS-PREPEND rule 10 set as-path prepend '65001 65001'

set policy prefix-list MY-PREFIXES rule 10 action permit
set policy prefix-list MY-PREFIXES rule 10 prefix 192.0.2.0/24

commit
save

iBGP with a Route Reflector

Route Reflector:

set protocols bgp system-as 65001
set protocols bgp parameters router-id 10.255.255.1
set protocols bgp parameters cluster-id 10.255.255.1

# RR Clients
set protocols bgp neighbor 10.0.1.1 remote-as 65001
set protocols bgp neighbor 10.0.1.1 update-source 10.255.255.1
set protocols bgp neighbor 10.0.1.1 address-family ipv4-unicast route-reflector-client

set protocols bgp neighbor 10.0.1.2 remote-as 65001
set protocols bgp neighbor 10.0.1.2 update-source 10.255.255.1
set protocols bgp neighbor 10.0.1.2 address-family ipv4-unicast route-reflector-client

set protocols bgp neighbor 10.0.1.3 remote-as 65001
set protocols bgp neighbor 10.0.1.3 update-source 10.255.255.1
set protocols bgp neighbor 10.0.1.3 address-family ipv4-unicast route-reflector-client

commit
save

Client:

set protocols bgp system-as 65001
set protocols bgp parameters router-id 10.0.1.1

set protocols bgp neighbor 10.255.255.1 remote-as 65001
set protocols bgp neighbor 10.255.255.1 update-source 10.0.1.1
set protocols bgp neighbor 10.255.255.1 address-family ipv4-unicast

commit
save

BGP over IPsec VTI

# IPsec VTI
set interfaces vti vti0 address 172.16.0.1/30

# BGP over the VTI
set protocols bgp system-as 65001
set protocols bgp parameters router-id 10.0.0.1

set protocols bgp neighbor 172.16.0.2 remote-as 65002
set protocols bgp neighbor 172.16.0.2 address-family ipv4-unicast

set protocols bgp address-family ipv4-unicast network 192.168.1.0/24

commit
save

Enterprise with branch offices

HQ:

set protocols bgp system-as 65001
set protocols bgp parameters router-id 10.0.0.1

# ISP
set protocols bgp neighbor 203.0.113.1 remote-as 65000
set protocols bgp neighbor 203.0.113.1 address-family ipv4-unicast

# Branch offices (iBGP)
set protocols bgp neighbor 10.0.1.1 remote-as 65001
set protocols bgp neighbor 10.0.1.1 update-source 10.0.0.1
set protocols bgp neighbor 10.0.1.1 address-family ipv4-unicast

set protocols bgp neighbor 10.0.2.1 remote-as 65001
set protocols bgp neighbor 10.0.2.1 update-source 10.0.0.1
set protocols bgp neighbor 10.0.2.1 address-family ipv4-unicast

# Announce HQ network
set protocols bgp address-family ipv4-unicast network 192.168.1.0/24

# Redistribute connected branches
set protocols bgp address-family ipv4-unicast redistribute connected route-map BRANCHES

set policy route-map BRANCHES rule 10 action permit
set policy route-map BRANCHES rule 10 match interface vti0
set policy route-map BRANCHES rule 10 match interface vti1

commit
save

Operational commands

BGP Summary

show ip bgp summary

Output:

BGP router identifier 10.0.0.1, local AS number 65001
IPv4 Unicast Summary:
Neighbor        V    AS MsgRcvd MsgSent   Up/Down State/PfxRcd
203.0.113.1     4 65000    1234    1456  01:23:45        12345

BGP Neighbors

show ip bgp neighbors

Details for a specific neighbor:

show ip bgp neighbors 203.0.113.1

BGP Routes

All BGP routes:

show ip bgp

A specific prefix:

show ip bgp 192.0.2.0/24

Received routes (before filtering):

show ip bgp neighbors 203.0.113.1 received-routes

Advertised routes:

show ip bgp neighbors 203.0.113.1 advertised-routes

BGP Statistics

show ip bgp statistics

Clear BGP Session

Soft reset (without tearing down TCP):

clear ip bgp 203.0.113.1 soft

Hard reset:

clear ip bgp 203.0.113.1

All sessions:

clear ip bgp *

Troubleshooting

BGP session does not come up

Check:

  1. TCP connectivity:

    ping 203.0.113.1
telnet 203.0.113.1 179

  2. Firewall:

    set firewall ipv4 input filter rule 100 action accept
set firewall ipv4 input filter rule 100 destination port 179
set firewall ipv4 input filter rule 100 protocol tcp
commit

  3. ASN matches:

    show configuration commands | grep "remote-as"

  4. Password (if configured):

    show ip bgp neighbors 203.0.113.1

  5. Logs:

    show log | grep bgp

Routes are not received

Check:

  1. Address family is enabled:

    show protocols bgp neighbor 203.0.113.1

  2. Prefix filters are not blocking:

    show ip bgp neighbors 203.0.113.1 received-routes

  3. Route-maps:

    show policy route-map

Routes are not advertised

Check:

  1. Network exists in the routing table:

    show ip route 192.0.2.0/24

  2. Outbound filters:

    show ip bgp neighbors 203.0.113.1 advertised-routes

  3. Route-map export:

    show configuration commands | grep export

Suboptimal routing

Check:

  1. BGP attributes:

    show ip bgp 192.0.2.0/24

  2. Local Preference (for iBGP)

  3. MED (from a peer)

  4. AS-path length

Use route-maps to modify the attributes.

Best practices

  1. Always configure the router-id explicitly
  2. Use prefix-lists for filtering
  3. Password authentication for eBGP
  4. BFD for fast failover
  5. Route Reflector instead of iBGP full mesh (when > 5 routers)
  6. Loopback interfaces for the iBGP update-source
  7. Maximum-prefix to protect against route leaks:
    set protocols bgp neighbor 203.0.113.1 address-family ipv4-unicast maximum-prefix 100000
  8. Document every neighbor (description)
  9. Monitor the state of BGP sessions
  10. Graceful restart for planned maintenance

Security

Recommendations

  1. TTL Security:

    set protocols bgp neighbor 203.0.113.1 ttl-security hops 1

  2. Password Authentication:

    set protocols bgp neighbor 203.0.113.1 password 'StrongPassword123!'

  3. Prefix Filtering:

    • Filter Bogon prefixes
    • Filter your own prefixes on import
    • Announce only your own prefixes

  4. Maximum Prefix Limit:

    set protocols bgp neighbor 203.0.113.1 address-family ipv4-unicast maximum-prefix 1000

  5. AS Path Filtering:

    • Block private AS on eBGP
    • Block unexpected AS paths

  6. Firewall:

    set firewall ipv4 input filter rule 100 action accept
set firewall ipv4 input filter rule 100 source address 203.0.113.1
set firewall ipv4 input filter rule 100 destination port 179
set firewall ipv4 input filter rule 100 protocol tcp

  7. Logging:

    set protocols bgp parameters log-neighbor-changes

  8. RPKI (Resource Public Key Infrastructure) for origin AS validation

Bogon Filtering

Block reserved/private IP:

set policy prefix-list BOGONS rule 10 action deny
set policy prefix-list BOGONS rule 10 prefix 0.0.0.0/8 le 32
set policy prefix-list BOGONS rule 20 action deny
set policy prefix-list BOGONS rule 20 prefix 10.0.0.0/8 le 32
set policy prefix-list BOGONS rule 30 action deny
set policy prefix-list BOGONS rule 30 prefix 172.16.0.0/12 le 32
set policy prefix-list BOGONS rule 40 action deny
set policy prefix-list BOGONS rule 40 prefix 192.168.0.0/16 le 32
set policy prefix-list BOGONS rule 50 action deny
set policy prefix-list BOGONS rule 50 prefix 224.0.0.0/4 le 32

set policy prefix-list BOGONS rule 100 action permit
set policy prefix-list BOGONS rule 100 prefix 0.0.0.0/0 le 32

set protocols bgp neighbor 203.0.113.1 address-family ipv4-unicast prefix-list import BOGONS

commit

Next steps

Reviewed by OpenNix LLC · Last updated on
Static Routing (Static Routes)OSPF (Open Shortest Path First)