Community discussions

MikroTik App
 
joi
just joined
Topic Author
Posts: 6
Joined: Wed Jun 05, 2024 5:38 am

How to prevent advertising routes from another BGP session, ROUTEROSv7?

Fri Jun 07, 2024 12:39 am

I have a BGP session, for example with AS1000, through which they send me the complete routing table. However, we are now going to connect to an IXP, let's say AS3000. The IXP is requesting that I do not advertise any routes learned from AS1000. Would the following filter be effective?
if(bgp-input-remote-as==1000){reject}
Would this be placed in the input filter?

I appreciate it in advance.
 
User avatar
sirbryan
Member
Member
Posts: 421
Joined: Fri May 29, 2020 6:40 pm
Location: Utah
Contact:

Re: How to prevent advertising routes from another BGP session, ROUTEROSv7?

Fri Jun 07, 2024 4:59 am

This is what I use to keep from leaking routes learned from other peers that I don't provide transit for:
if (bgp-as-path "(1234|5678|1000)") { reject; }

This keeps me from announcing routes learned from AS's 1234, 5678, and 1000, no matter where they are in the AS path.

On top of that, I have a filter for my IP block (changed to an urealistic example block):
if (dst in  123.456.789.0/23 && dst-len in 23-24) { accept; }

And finally, if you do provide transit for another AS, this is how I allow their announcements to go out:
if (bgp-as-path ^54321  && dst-len in 20-24) {   accept; }
 
nellicus
just joined
Posts: 5
Joined: Sat Nov 18, 2023 1:03 pm

Re: How to prevent advertising routes from another BGP session, ROUTEROSv7?

Fri Jun 07, 2024 5:06 am

To answer your question, yes. This filter would work. However, you would set this on the output filter chain used for your peering session with the IXP. As a good practice, you should consider reversing your logic, and creating a set of filters that allow you to export the prefixes you specify versus export everything and reject X. This is a safety measure to help prevent unintended route leaks. Also keep in mind, in ROS7, the default behavior is to reject routes. If you were trying to just have a single rule in the chain (assuming you ignore the suggestions above) then your rule would look something like this:
if ( bgp-input-remote-as==1000 ){ reject; } else { accept; }
 
joi
just joined
Topic Author
Posts: 6
Joined: Wed Jun 05, 2024 5:38 am

Re: How to prevent advertising routes from another BGP session, ROUTEROSv7?

Fri Jun 07, 2024 4:43 pm

Thank you so much for your help