mirror of
https://github.com/vyos/vyos-documentation.git
synced 2025-12-19 20:12:07 +01:00
c25c40dfa9
* order workflows and add submodule * rename gitmodules file * delete docs/.gitignore * add vyos custom linter * correct __pycache__ in gitignore * add test-coverage.py * move draw.io folder * arrange changelog, install history and about * arrange: firewall * arrange: highavailability * arrange: loadbalancing * arrange: nat * arrange: services * sort configexamples and configuration interfaces * wireles: rename wireless * rearrange: Protocols and Policy * rearrange: Firewall and Zone Policy * rearrange: Interfaces * rearrange: Interfaces * rearrange: dynamic DNS * hostinfo: add page to index * rearrange: appendix * venv: add Pipfile * rearrange: contributing * index: remove debugging * rearrange: fix all figure and refs * rearrange: commandtree * fix: cli, openvpn, install headline level * protocols: change headline * firewall: move mss clamping * ip: separate ipv4 and ipv6 * arp: move to static page * igmp: rename multicast page * Update to year 2021
145 lines
5.2 KiB
ReStructuredText
145 lines
5.2 KiB
ReStructuredText
.. _routing-bgp:
|
|
|
|
Border Gateway Protocol (BGP)
|
|
-----------------------------
|
|
|
|
IPv4
|
|
^^^^
|
|
|
|
A simple eBGP configuration:
|
|
|
|
**Node 1:**
|
|
|
|
.. code-block:: none
|
|
|
|
set protocols bgp 65534 neighbor 192.168.0.2 ebgp-multihop '2'
|
|
set protocols bgp 65534 neighbor 192.168.0.2 remote-as '65535'
|
|
set protocols bgp 65534 neighbor 192.168.0.2 update-source '192.168.0.1'
|
|
set protocols bgp 65534 address-family ipv4-unicast network '172.16.0.0/16'
|
|
set protocols bgp 65534 parameters router-id '192.168.0.1'
|
|
|
|
**Node 2:**
|
|
|
|
.. code-block:: none
|
|
|
|
set protocols bgp 65535 neighbor 192.168.0.1 ebgp-multihop '2'
|
|
set protocols bgp 65535 neighbor 192.168.0.1 remote-as '65534'
|
|
set protocols bgp 65535 neighbor 192.168.0.1 update-source '192.168.0.2'
|
|
set protocols bgp 65535 address-family ipv4-unicast network '172.17.0.0/16'
|
|
set protocols bgp 65535 parameters router-id '192.168.0.2'
|
|
|
|
|
|
Don't forget, the CIDR declared in the network statement MUST **exist in your
|
|
routing table (dynamic or static), the best way to make sure that is true is
|
|
creating a static route:**
|
|
|
|
**Node 1:**
|
|
|
|
.. code-block:: none
|
|
|
|
set protocols static route 172.16.0.0/16 blackhole distance '254'
|
|
|
|
**Node 2:**
|
|
|
|
.. code-block:: none
|
|
|
|
set protocols static route 172.17.0.0/16 blackhole distance '254'
|
|
|
|
|
|
IPv6
|
|
^^^^
|
|
|
|
A simple BGP configuration via IPv6.
|
|
|
|
**Node 1:**
|
|
|
|
.. code-block:: none
|
|
|
|
set protocols bgp 65534 neighbor 2001:db8::2 ebgp-multihop '2'
|
|
set protocols bgp 65534 neighbor 2001:db8::2 remote-as '65535'
|
|
set protocols bgp 65534 neighbor 2001:db8::2 update-source '2001:db8::1'
|
|
set protocols bgp 65534 neighbor 2001:db8::2 address-family ipv6-unicast
|
|
set protocols bgp 65534 address-family ipv6-unicast network '2001:db8:1::/48'
|
|
set protocols bgp 65534 parameters router-id '10.1.1.1'
|
|
|
|
**Node 2:**
|
|
|
|
.. code-block:: none
|
|
|
|
set protocols bgp 65535 neighbor 2001:db8::1 ebgp-multihop '2'
|
|
set protocols bgp 65535 neighbor 2001:db8::1 remote-as '65534'
|
|
set protocols bgp 65535 neighbor 2001:db8::1 update-source '2001:db8::2'
|
|
set protocols bgp 65535 neighbor 2001:db8::1 address-family ipv6-unicast
|
|
set protocols bgp 65535 address-family ipv6-unicast network '2001:db8:2::/48'
|
|
set protocols bgp 65535 parameters router-id '10.1.1.2'
|
|
|
|
Don't forget, the CIDR declared in the network statement **MUST exist in your
|
|
routing table (dynamic or static), the best way to make sure that is true is
|
|
creating a static route:**
|
|
|
|
**Node 1:**
|
|
|
|
.. code-block:: none
|
|
|
|
set protocols static route6 2001:db8:1::/48 blackhole distance '254'
|
|
|
|
**Node 2:**
|
|
|
|
.. code-block:: none
|
|
|
|
set protocols static route6 2001:db8:2::/48 blackhole distance '254'
|
|
|
|
Route Filter
|
|
^^^^^^^^^^^^
|
|
|
|
Route filter can be applied using a route-map:
|
|
|
|
**Node1:**
|
|
|
|
.. code-block:: none
|
|
|
|
set policy prefix-list AS65535-IN rule 10 action 'permit'
|
|
set policy prefix-list AS65535-IN rule 10 prefix '172.16.0.0/16'
|
|
set policy prefix-list AS65535-OUT rule 10 action 'deny'
|
|
set policy prefix-list AS65535-OUT rule 10 prefix '172.16.0.0/16'
|
|
set policy prefix-list6 AS65535-IN rule 10 action 'permit'
|
|
set policy prefix-list6 AS65535-IN rule 10 prefix '2001:db8:2::/48'
|
|
set policy prefix-list6 AS65535-OUT rule 10 action 'deny'
|
|
set policy prefix-list6 AS65535-OUT rule 10 prefix '2001:db8:2::/48'
|
|
set policy route-map AS65535-IN rule 10 action 'permit'
|
|
set policy route-map AS65535-IN rule 10 match ip address prefix-list 'AS65535-IN'
|
|
set policy route-map AS65535-IN rule 10 match ipv6 address prefix-list 'AS65535-IN'
|
|
set policy route-map AS65535-IN rule 20 action 'deny'
|
|
set policy route-map AS65535-OUT rule 10 action 'deny'
|
|
set policy route-map AS65535-OUT rule 10 match ip address prefix-list 'AS65535-OUT'
|
|
set policy route-map AS65535-OUT rule 10 match ipv6 address prefix-list 'AS65535-OUT'
|
|
set policy route-map AS65535-OUT rule 20 action 'permit'
|
|
set protocols bgp 65534 neighbor 2001:db8::2 route-map export 'AS65535-OUT'
|
|
set protocols bgp 65534 neighbor 2001:db8::2 route-map import 'AS65535-IN'
|
|
|
|
**Node2:**
|
|
|
|
.. code-block:: none
|
|
|
|
set policy prefix-list AS65534-IN rule 10 action 'permit'
|
|
set policy prefix-list AS65534-IN rule 10 prefix '172.17.0.0/16'
|
|
set policy prefix-list AS65534-OUT rule 10 action 'deny'
|
|
set policy prefix-list AS65534-OUT rule 10 prefix '172.17.0.0/16'
|
|
set policy prefix-list6 AS65534-IN rule 10 action 'permit'
|
|
set policy prefix-list6 AS65534-IN rule 10 prefix '2001:db8:1::/48'
|
|
set policy prefix-list6 AS65534-OUT rule 10 action 'deny'
|
|
set policy prefix-list6 AS65534-OUT rule 10 prefix '2001:db8:1::/48'
|
|
set policy route-map AS65534-IN rule 10 action 'permit'
|
|
set policy route-map AS65534-IN rule 10 match ip address prefix-list 'AS65534-IN'
|
|
set policy route-map AS65534-IN rule 10 match ipv6 address prefix-list 'AS65534-IN'
|
|
set policy route-map AS65534-IN rule 20 action 'deny'
|
|
set policy route-map AS65534-OUT rule 10 action 'deny'
|
|
set policy route-map AS65534-OUT rule 10 match ip address prefix-list 'AS65534-OUT'
|
|
set policy route-map AS65534-OUT rule 10 match ipv6 address prefix-list 'AS65534-OUT'
|
|
set policy route-map AS65534-OUT rule 20 action 'permit'
|
|
set protocols bgp 65535 neighbor 2001:db8::1 route-map export 'AS65534-OUT'
|
|
set protocols bgp 65535 neighbor 2001:db8::1 route-map import 'AS65534-IN'
|
|
|
|
We could expand on this and also deny link local and multicast in the rule 20
|
|
action deny.
|