1BGPD.CONF(5) BSD File Formats Manual BGPD.CONF(5)
2
4 bgpd.conf — Border Gateway Protocol daemon configuration file
5
7 The bgpd(8) daemon implements the Border Gateway Protocol version 4 as
8 described in RFC 4271.
9 The bgpd.conf config file is divided into the following main sections:
11 MACROS
13 User-defined variables may be defined and used later, simplifying
14 the configuration file.
15 GLOBAL CONFIGURATION
17 Global settings for bgpd(8).
18 SET CONFIGURATION
20 Various lookup tables are defined in this section.
21 NETWORK ANNOUNCEMENTS
23 Networks which should be announced by bgpd(8) are set in this sec‐
24 tion.
25 MPLS VPN CONFIGURATION
27 The definition and properties for BGP MPLS VPNs are set in this
28 section.
29 NEIGHBORS AND GROUPS
31 bgpd(8) establishes sessions with neighbors. The neighbor defini‐
32 tion and properties are set in this section, as well as grouping
33 neighbors for the ease of configuration.
34 FILTER
36 Filter rules for incoming and outgoing UPDATES.
37 With the exception of macros, the sections should be grouped and appear
39 in bgpd.conf in the order shown above.
40 The current line can be extended over multiple lines using a backslash
42 (‘\’). Comments can be put anywhere in the file using a hash mark (‘#’),
43 and extend to the end of the current line. Care should be taken when
44 commenting out multi-line text: the comment is effective until the end of
45 the entire block.
46 Argument names not beginning with a letter, digit, or underscore must be
48 quoted.
49 Additional configuration files can be included with the include keyword,
51 for example:
52 include "/etc/bgpd/bgpd-10.0.0.1.filter"
54
56 Macros can be defined that will later be expanded in context. Macro
57 names must start with a letter, digit, or underscore, and may contain any
58 of those characters. Macro names may not be reserved words (for example,
59 AS, neighbor, or group). Macros are not expanded inside quotes.
60 For example:
62 peer1="1.2.3.4"
64 neighbor $peer1 {
65 remote-as 65001
66 }
67
69 These settings affect the operation of the bgpd(8) daemon as a whole.
70 AS as-number [as-number]
72 Set the local autonomous system number to as-number. A fallback
73 2-byte AS number may follow a 4-byte AS number for neighbors that
74 do not support 4-byte AS numbers. The standard and default fall‐
75 back AS number is 23456.
76 The AS numbers are assigned by local RIRs, such as:
78 AfriNIC for Africa
80 APNIC for Asia Pacific
81 ARIN for North America and parts of the Caribbean
82 LACNIC for Latin America and the Caribbean
83 RIPE NCC for Europe, the Middle East, and parts of Asia
84 The AS numbers 64512 – 65534 are designated for private use. The
86 AS number 23456 is reserved and should not be used. 4-byte AS
87 numbers may be specified in either the ASPLAIN format:
88 AS 196618
90 or in the older ASDOT format:
92 AS 3.10
94 connect-retry seconds
96 Set the number of seconds to wait before attempting to re-open a
97 connection. This timer should be sufficiently large in EBGP con‐
98 figurations. The default is 120 seconds.
99 dump [rib name] (table-v2|table-mp|table) file [interval]
101 dump (all|updates) (in|out) file [interval]
102 Dump the RIB, a.k.a. the routing information base, or dump ongo‐
103 ing BGP activity, in Multi-threaded Routing Toolkit (MRT) format.
104 The file is subject to strftime(3)-expansion.
105 The table-v2 and table-mp RIB formats store multi-protocol RIBs
107 correctly, but the table format does not. The latter two are
108 provided only to support third-party tools lacking support for
109 the recommended table-v2 format. Dump an alternative RIB by
110 specifying name. Specify an interval in seconds for periodic RIB
111 dumps.
112 The following will dump the entire RIB table, at startup and ev‐
114 ery 5 minutes thereafter, to a new file:
115 dump table-v2 "/tmp/rib-dump-%H%M" 300
117 Dumps of ongoing BGP activity include all BGP state transitions,
119 and all BGP messages in the specified direction. Use updates to
120 dump only BGP UPDATE messages, without state transitions. Spec‐
121 ify an interval in seconds to restart periodically with a new
122 file:
123 dump all in "/tmp/all-in-%H%M" 300
125 fib-priority prio
127 Set the routing priority to prio. The default is 48.
128 fib-update (yes|no)
130 If set to no, do not update the Forwarding Information Base,
131 a.k.a. the kernel routing table. The default is yes.
132 holdtime seconds
134 Set the announced holdtime in seconds. This is exchanged with a
135 neighbor upon connection establishment, in the OPEN message, and
136 the shortest holdtime governs the session.
137 The neighbor session is dropped if the session holdtime passes
139 without receipt of a KEEPALIVE or an UPDATE message from the
140 neighbor. The default is 90 seconds.
141 holdtime min seconds
143 The minimum acceptable holdtime in seconds. This value must be
144 at least 3.
145 listen on address [port port]
147 Specify the local IP address and optional port for bgpd(8) to
148 listen on. The default is to listen on all local addresses on
149 the current default routing domain.
150 log updates
152 Log sent and received BGP update messages.
153 nexthop qualify via (bgp|default)
155 If set to bgp, bgpd(8) may verify nexthops using BGP routes. If
156 set to default, bgpd(8) may verify nexthops using the default
157 route. By default bgpd(8) uses only static routes or routes
158 added by other routing daemons, such as ospfd(8).
159 rde evaluate (default|all)
161 If set to all, keep evaluating alternative paths in case the se‐
162 lected path is filtered out. By default if a path is filtered by
163 the output filters then no alternative path is sent to this peer.
164 rde med compare (always|strict)
166 If set to always, the MULTI_EXIT_DISC attributes will always be
167 compared. The default is strict, where the metric is only com‐
168 pared between peers belonging to the same AS.
169 rde rib name [no evaluate]
171 rde rib name [rtable number]
172 Create an additional RIB named name. The degree to which its
173 routes may be utilized is configurable. They may be excluded
174 from the decision process that selects usable routes with the no
175 evaluate flag, and this precludes their export to any kernel
176 routing table. By default its routes will be evaluated, but not
177 exported to the kernel. They may be both evaluated and exported
178 if associated with a given rtable number, which must belong to
179 the routing domain that bgpd(8) was started in. This table will
180 not be consulted during nexthop verification unless it is the one
181 that bgpd(8) was started in. It is unnecessary to create
182 Adj-RIB-In and Loc-RIB, which are created automatically and used
183 by default.
184 rde route-age (ignore|evaluate)
186 If set to evaluate, the route decision process will also consider
187 the age of the route in addition to its path attributes, giving
188 preference to the older, typically more stable, route. This ren‐
189 ders the decision process nondeterministic. The default is
190 ignore.
191 reject as-set (yes|no)
193 If set to yes, AS paths attributes containing AS_SET path seg‐
194 ments will be rejected and all prefixes will be treated as with‐
195 draws. The default is no.
196 router-id dotted-quad
198 Set the BGP router ID, which must be non-zero and should be
199 unique within the AS. By default, the router ID is the highest
200 IPv4 address assigned to the local machine.
201 router-id 10.0.0.1
203 rtable number
205 Work with the given kernel routing table instead of the default
206 table, which is the one bgpd(8) was started in. For nexthop ver‐
207 ification, bgpd(8) will always consult the default table. This
208 is the same as using the following syntax:
209 rde rib Loc-RIB rtable number
211 socket "path" [restricted]
213 Create a control socket at path. If restricted is specified, a
214 restricted control socket will be created. By default
215 /run/bgpd/bgpd.sock.<rdomain> is used where <rdomain> is the
216 routing domain in which bgpd(8) has been started. By default, no
217 restricted socket is created.
218 transparent-as (yes|no)
220 If set to yes, AS paths to EBGP neighbors are not prepended with
221 the local AS. The default is no.
222
224 bgpd(8) supports the efficient lookup of data within named sets. An
225 as-set, a prefix-set, and an origin-set store AS numbers, prefixes, and
226 prefixes/source-as pairs, respectively. Such sets may be referenced by
227 filter rules; see the FILTER section for details. It is more efficient
228 to evaluate a set than a long series of rules for filtering each of its
229 members.
230 One single roa-set may be defined, against which bgpd(8) will validate
232 the origin of each prefix. The roa-set is merged with the tables re‐
233 ceived via rtr sessions.
234 A set definition can span multiple lines, and an optional comma is al‐
236 lowed between elements.
237 as-set name { as-number ... }
239 An as-set stores AS numbers, and can be used with the AS specific
240 parameter in FILTER rules.
241 origin-set name { address/len maxlen mlen source-as asn ... }
243 An origin-set stores prefix/source-as pairs, and can be used to
244 filter on the combination by using the origin-set parameter in
245 FILTER rules.
246 origin-set private { 10.0.0.0/8 maxlen 24 source-as 64511
248 203.0.113.0/24 source-as 64496 }
249 prefix-set name { address/len ... }
251 A prefix-set stores network prefixes and can be used in place of
252 the prefix parameter in FILTER rules, and in network statements.
253 A prefix can be followed by the prefixlen operators listed for
254 the prefix parameter in the PARAMETERS section.
255 The first example below creates a set of prefixes called
257 “private”, to hold a number of RFC 1918 private network blocks.
258 The second example shows the use of prefixlen operators.
259 prefix-set private { 10.0.0.0/8, 172.16.0.0/12,
261 192.168.0.0/16, fc00::/7 }
262 prefix-set as64496set { 192.0.2.0/24 prefixlen >= 26,
263 2001:db8::/32 or-longer }
264 roa-set { address/len [maxlen mlen] source-as asn [expires seconds] ... }
266 The roa-set holds a collection of Validated ROA Payloads (VRPs).
267 Each received prefix is checked against the roa-set, and the Ori‐
268 gin Validation State (OVS) is set. expires can be set to the
269 seconds since Epoch until when this VRP is valid.
270 roa-set { 192.0.2.0/23 maxlen 24 source-as 64511
272 203.0.113.0/24 source-as 64496 }
273 rtr address { ... }
275 The rtr block specifies a RPKI to Router (RTR) session. RTR ses‐
276 sions provide another means to load VRP sets into bgpd(8).
277 Changes propagated via the RTR protocol do not need a config
278 reload and are immediately applied. The union of all VRP sets
279 received via rtr sessions and the entries in the roa-set is used
280 to validate the orgin of routes. The rtr session properties are
281 as follows:
282 descr description
284 Add a description. The description is used in logging
285 and status reports, but has no further meaning for
286 bgpd(8).
287 local-address address
289 Bind to the specific IP address before opening the TCP
290 connection to the rtr server.
291 port number
293 Specify the TCP destination port for the rtr session. If
294 not specified, the default port is 323.
295
297 network statements specify the networks that bgpd(8) will announce as its
298 own. An announcement must also be permitted by the FILTER rules. By de‐
299 fault bgpd(8) announces no networks.
300 network address/prefix [set ...]
302 Announce the specified prefix as belonging to our AS.
303 network (inet|inet6) connected [set ...]
305 Announce routes to directly attached networks.
306 network prefix-set name [set ...]
308 Announce all networks in the prefix-set name.
309 network (inet|inet6) priority number [set ...]
311 Announce routes having the specified priority.
312 network (inet|inet6) rtlabel label [set ...]
314 Announce routes having the specified label.
315 network (inet|inet6) static [set ...]
317 Announce all static routes.
318 Each network statement may set default AS path attributes:
320 network 192.168.7.0/24 set localpref 220
322 See also the ATTRIBUTE SET section.
324
326 A vpn section configures a router to participate in an MPLS Virtual Pri‐
327 vate Network. It specifies an mpe(4) interface to use, a description,
328 and various properties of the VPN:
329 vpn "description" on mpe1 {
331 rd 65002:1
332 import-target rt 65002:42
333 export-target rt 65002:42
334 network 192.168.1/24
335 }
336 bgpd(8) will not exchange VPN routes with a neighbor by default, see the
338 NEIGHBORS AND GROUPS section. The description is used when logging but
339 has no further meaning to bgpd(8).
340 The mpe(4) interface will be used as the outgoing interface for routes to
342 the VPN, and local networks will be announced with the MPLS label speci‐
343 fied on the interface. The interface can provide VPN connectivity for
344 another rdomain by being configured in that rdomain. The required rdo‐
345 main must be configured on the interface before bgpd(8) uses it. Multi‐
346 ple VPNs may be connected to a single rdomain, including the rdomain that
347 bgpd(8) is running in.
348 An example hostname.if(5) configuration for an mpe(4) interface providing
350 connectivity to rdomain 1:
351 rdomain 1
353 mplslabel 2000
354 inet 192.198.0.1 255.255.255.255
355 up
356 The VPN properties are as follows:
358 export-target subtype as-number:local
360 export-target subtype IP:local
361 Classify announced networks by tagging them with an extended
362 community of the given arguments. The community subtype should
363 be a route target, rt, to ensure interoperability. The arguments
364 are further detailed in the ATTRIBUTE SET section. More than one
365 export-target can be specified.
366 fib-update (yes|no)
368 If set to no, do not update the Forwarding Information Base,
369 a.k.a. the kernel routing table. The default is yes.
370 import-target subtype as-number:local
372 import-target subtype IP:local
373 The rdomain imports only those prefixes tagged with an extended
374 community matching an import-target. The community subtype
375 should be a route target, rt, to ensure interoperability. The
376 arguments are further detailed in the ATTRIBUTE SET section.
377 More than one import-target can be specified.
378 network arguments ...
380 Announce the given networks within this VPN; see the NETWORK
381 ANNOUNCEMENTS section.
382 rd as-number:local
384 rd IP:local
385 The Route Distinguisher rd supplies BGP with namespaces to disam‐
386 biguate VPN prefixes, as these needn't be globally unique. Un‐
387 like route targets, the rd neither identifies the origin of the
388 prefix nor controls into which VPNs the prefix is distributed.
389 The as-number or IP of a rd should be set to a number or IP that
390 was assigned by an appropriate authority, whereas local can be
391 chosen by the local operator.
392
394 bgpd(8) establishes TCP connections to other BGP speakers called
395 neighbors. A neighbor and its properties are specified by a neighbor
396 section:
397 neighbor 10.0.0.2 {
399 remote-as 65002
400 descr "a neighbor"
401 }
402 Neighbors placed within a group section inherit the properties common to
404 that group:
405 group "peering AS65002" {
407 remote-as 65002
408 neighbor 10.0.0.2 {
409 descr "AS65002-p1"
410 }
411 neighbor 10.0.0.3 {
412 descr "AS65002-p2"
413 }
414 }
415 An entire network of neighbors may be accommodated by specifying an ad‐
417 dress/netmask pair:
418 neighbor 10.0.0.0/8
420 This is a template that recognises as a neighbor any connection from
422 within the given network. Such neighbors inherit their template's prop‐
423 erties, except for their IP address. A template may omit remote-as;
424 bgpd(8) then accepts any AS presented by the neighbor in the OPEN mes‐
425 sage.
426 The neighbor properties are as follows:
428 announce (IPv4|IPv6) (none|unicast|vpn)
430 For the given address family, control which subsequent address
431 families are announced during the capabilities negotiation. Only
432 routes for that address family and subsequent address families
433 will be announced and processed.
434 At the moment, only none, which disables the announcement of that
436 address family, unicast, and vpn, which allows the distribution
437 of BGP MPLS VPNs, are supported.
438 The default is unicast for the same address family of the ses‐
440 sion.
441 announce add-path recv (yes|no)
443 If set to yes, the receive add-path capability is announced which
444 allows reception of multiple paths per prefix. The default is
445 no.
446 announce as-4byte (yes|no)
448 If set to no, the 4-byte AS capability is not announced and so
449 native 4-byte AS support is disabled. The default is yes.
450 announce capabilities (yes|no)
452 If set to no, capability negotiation is disabled during the es‐
453 tablishment of the session. This can be helpful to connect to
454 old or broken BGP implementations. The default is yes.
455 announce enhanced refresh (yes|no)
457 If set to yes, the enhanced route refresh capability is an‐
458 nounced. The default is no.
459 announce refresh (yes|no)
461 If set to no, the route refresh capability is not announced. The
462 default is yes.
463 announce restart (yes|no)
465 If set to no, the graceful restart capability is not announced.
466 Currently only the End-of-RIB marker is supported and announced
467 by the restart capability. The default is yes.
468 as-override (yes|no)
470 If set to yes, all occurrences of the neighbor AS in the AS path
471 will be replaced with the local AS before running the filters.
472 The Adj-RIB-In still holds the unmodified AS path. The default
473 value is no.
474 demote group
476 Increase the carp(4) demotion counter on the given interface
477 group, usually carp, when the session is not in state
478 ESTABLISHED. The demotion counter will be increased as soon as
479 bgpd(8) starts and decreased 60 seconds after the session went to
480 state ESTABLISHED. For neighbors added at runtime, the demotion
481 counter is only increased after the session has been ESTABLISHED
482 at least once before dropping.
483 For more information on interface groups, see the group keyword
485 in ifconfig(8).
486 depend on interface
488 The neighbor session will be kept in state IDLE as long as
489 interface reports no link. For carp(4) interfaces, no link means
490 that the interface is currently backup. This is primarily in‐
491 tended to be used with carp(4) to reduce failover times.
492 The state of the network interfaces on the system can be viewed
494 using the show interfaces command to bgpctl(8).
495 descr description
497 Add a description. The description is used when logging neighbor
498 events, in status reports, for specifying neighbors, etc., but
499 has no further meaning to bgpd(8).
500 down [reason]
502 Do not start the session when bgpd(8) comes up but stay in IDLE.
503 If the session is cleared at runtime, after a down reason was
504 configured at runtime, the reason is sent as Administrative Shut‐
505 down Communication. The reason cannot exceed 255 octets.
506 dump (all|updates) (in|out) file [interval]
508 Dump ongoing BGP activity for a particular neighbor. See also
509 the dump setting in GLOBAL CONFIGURATION.
510 enforce local-as (yes|no)
512 If set to no, AS paths will not be checked for AS loop detection.
513 This feature is similar to allowas-in in some other BGP implemen‐
514 tations. Since there is no AS path loop check, this feature is
515 dangerous, and requires you to add filters to prevent receiving
516 your own prefixes. The default value is yes.
517 enforce neighbor-as (yes|no)
519 If set to yes, AS paths whose leftmost AS is not equal to the
520 remote AS of the neighbor are rejected and a NOTIFICATION is sent
521 back. The default value for IBGP peers is no otherwise the de‐
522 fault is yes.
523 export (none|default-route)
525 If set to none, no UPDATE messages will be sent to the neighbor.
526 If set to default-route, only the default route will be announced
527 to the neighbor.
528 holdtime seconds
530 Set the holdtime in seconds. Inherited from the global configu‐
531 ration if not given.
532 holdtime min seconds
534 Set the minimal acceptable holdtime. Inherited from the global
535 configuration if not given.
536 ipsec (ah|esp) (in|out) spi spi-number authspec [encspec]
538 Enable IPsec with static keying. There must be at least two
539 ipsec statements per peer with manual keying, one per direction.
540 authspec specifies the authentication algorithm and key. It can
541 be
542 sha1 <key>
544 md5 <key>
545 encspec specifies the encryption algorithm and key. ah does not
547 support encryption. With esp, encryption is optional. encspec
548 can be
549 3des <key>
551 3des-cbc <key>
552 aes <key>
553 aes-128-cbc <key>
554 Keys must be given in hexadecimal format. After changing set‐
556 tings, a session needs to be reset to use the new keys. The
557 ipsec flows only work with session using the default port 179.
558 ipsec (ah|esp) ike
560 Enable IPsec with dynamic keying. In this mode, bgpd(8) sets up
561 the flows, and a key management daemon such as isakmpd(8) is re‐
562 sponsible for managing the session keys. With isakmpd(8), it is
563 sufficient to copy the peer's public key, found in
564 /etc/isakmpd/local.pub, to the local machine. It must be stored
565 in a file named after the peer's IP address and must be stored in
566 /etc/isakmpd/pubkeys/ipv4/. The local public key must be copied
567 to the peer in the same way. As bgpd(8) manages the flows on its
568 own, it is sufficient to restrict isakmpd(8) to only take care of
569 keying by specifying the flags -Ka. This can be done in
570 rc.conf.local(8). After starting the isakmpd(8) and bgpd(8) dae‐
571 mons on both sides, the session should be established. After
572 changing settings, a session needs to be reset to use the new
573 keys. The ipsec flows only work with session using the default
574 port 179.
575 local-address address
577 no local-address
578 When bgpd(8) initiates the TCP connection to the neighbor system,
579 it normally does not bind to a specific IP address. If a
580 local-address is given, bgpd(8) binds to this address first. no
581 local-address reverts back to the default.
582 local-as as-number [as-number]
584 Set the AS number sent to the remote system. Used as described
585 above under GLOBAL CONFIGURATION option AS.
586 Since there is no AS path loop check, this option is dangerous,
588 and requires you to add filters to prevent receiving your ASNs.
589 Intended to be used temporarily, for migrations to another AS.
590 log no Disable neighbor specific logging.
592 log updates
594 Log received and sent updates for this neighbor.
595 max-prefix number [restart number]
597 Terminate the session when the maximum number of prefixes re‐
598 ceived is exceeded (no such limit is imposed by default). If
599 restart is specified, the session will be restarted after number
600 minutes.
601 max-prefix number out [restart number]
603 Terminate the session when the maximum number of prefixes sent is
604 exceeded (no such limit is imposed by default). If restart is
605 specified, the session will be restarted after number minutes.
606 multihop hops
608 Neighbors not in the same AS as the local bgpd(8) normally have
609 to be directly connected to the local machine. If this is not
610 the case, the multihop statement defines the maximum hops the
611 neighbor may be away.
612 passive
614 Do not attempt to actively open a TCP connection to the neighbor
615 system.
616 port port
618 Connect to the peer using port instead of the default BGP port
619 179.
620 reject as-set (yes|no)
622 If set to yes, AS paths attributes containing AS_SET path seg‐
623 ments will be rejected and all prefixes will be treated as with‐
624 draws. The default is inherited from the global reject as-set
625 setting.
626 remote-as as-number
628 Set the AS number of the remote system.
629 rde evaluate (default|all)
631 If set to all, keep evaluating alternative paths in case the se‐
632 lected path is filtered out. By default if a path is filtered by
633 the output filters then no alternative path is sent to this peer.
634 The default is inherited from the global rde evaluate setting.
635 rib name
637 Bind the neighbor to the specified RIB.
638 route-reflector [address]
640 Act as an RFC 4456 route-reflector for this neighbor. An op‐
641 tional cluster ID can be specified; otherwise the BGP ID will be
642 used.
643 set attribute ...
645 Set the AS path attributes to some default per neighbor or group
646 block:
647 set localpref 300
649 See also the ATTRIBUTE SET section. Set parameters are applied
651 to the received prefixes; the only exceptions are prepend-self,
652 nexthop no-modify and nexthop self. These sets are rewritten
653 into filter rules and can be viewed with “bgpd -nv”.
654 tcp md5sig password secret
656 tcp md5sig key secret
657 Enable TCP MD5 signatures per RFC 2385. The shared secret can
658 either be given as a password or hexadecimal key.
659 tcp md5sig password mekmitasdigoat
661 tcp md5sig key deadbeef
662 After changing keys, a session needs to be reset to use the new
663 keys.
664 transparent-as (yes|no)
666 If set to yes, AS paths to EBGP neighbors are not prepended with
667 the local AS. The default is inherited from the global
668 transparent-as setting.
669 ttl-security (yes|no)
671 Enable or disable ttl-security. When enabled, outgoing packets
672 are sent using a TTL of 255 and a check is made against an incom‐
673 ing packet's TTL. For directly connected peers, incoming packets
674 are required to have a TTL of 255, ensuring they have not been
675 routed. For multihop peers, incoming packets are required to
676 have a TTL of 256 minus multihop distance, ensuring they have not
677 passed through more than the expected number of hops. The de‐
678 fault is no.
679
681 bgpd(8) filters all BGP UPDATE messages, including its own announcements,
682 and blocks them by default. Filter rules may match on neighbor, direc‐
683 tion, prefix or AS path attributes. Filter rules may also modify AS path
684 attributes.
685 For each UPDATE processed by the filter, the filter rules are evaluated
687 in sequential order, from first to last. The last matching allow or deny
688 rule decides what action is taken. The default action is to deny.
689 The following actions can be used in the filter:
691 allow The UPDATE is passed.
693 deny The UPDATE is blocked.
695 match Apply the filter attribute set without influencing the filter
697 decision.
698
700 The rule parameters specify the UPDATES to which a rule applies. An
701 UPDATE always comes from, or goes to, one neighbor. Most parameters are
702 optional, but each can appear at most once per rule. If a parameter is
703 specified, the rule only applies to packets with matching attributes.
704 as-type [operator] as-number
706 as-type as-set name
707 This rule applies only to UPDATES where the AS path matches. The
708 part of the AS path specified by the as-type is matched against
709 the as-number or the as-set name:
710 AS (any part)
712 peer-as (leftmost AS number)
713 source-as (rightmost AS number)
714 transit-as (all but the rightmost AS number)
715 as-number is an AS number as explained above under GLOBAL
717 CONFIGURATION. It may be set to neighbor-as, which is expanded
718 to the current neighbor remote AS number, or local-as, which is
719 expanded to the locally assigned AS number.
720 When specifying an as-set name, the AS path will instead be
722 matched against all the AS numbers in the set.
723 The operator can be unspecified (this case is identical to the
725 equality operator), or one of the numerical operators
726 = (equal)
728 != (unequal)
729 - (range including boundaries)
730 >< (except range)
731 >< and - are binary operators (they take two arguments); with
733 these, as-number cannot be set to neighbor-as.
734 Multiple as-number entries for a given type or as-type as-number
736 entries may also be specified, separated by commas or whitespace,
737 if enclosed in curly brackets:
738 deny from any AS { 1, 2, 3 }
740 deny from any { AS 1, source-as 2, transit-as 3 }
741 deny from any { AS { 1, 2, 3 }, source-as 4, transit-as 5 }
742 community as-number:local
744 community name
745 This rule applies only to UPDATES where the community path attri‐
746 bute is present and matches. Communities are specified as
747 as-number:local, where as-number is an AS number and local is a
748 locally significant number between zero and 65535. Both
749 as-number and local may be set to ‘*’ to do wildcard matching.
750 Alternatively, well-known communities may be given by name in‐
751 stead and include BLACKHOLE, GRACEFUL_SHUTDOWN, NO_EXPORT,
752 NO_ADVERTISE, NO_EXPORT_SUBCONFED, and NO_PEER. Both as-number
753 and local may be set to neighbor-as, which is expanded to the
754 current neighbor remote AS number, or local-as, which is expanded
755 to the locally assigned AS number.
756 large-community as-number:local:local
758 This rule applies only to UPDATES where the Large community path
759 attribute is present and matches. Communities are specified as
760 as-number:local:local, where as-number is an AS number and local
761 is a locally significant number between zero and 4294967295.
762 Both as-number and local may be set to ‘*’ to do wildcard match‐
763 ing, neighbor-as, which is expanded to the current neighbor re‐
764 mote AS number, or local-as, which is expanded to the locally as‐
765 signed AS number.
766 ext-community subtype as-number:local
768 ext-community subtype IP:local
769 ext-community subtype numvalue
770 ext-community ovs (valid | not-found | invalid)
771 This rule applies only to UPDATES where the extended community
772 path attribute is present and matches. Extended Communities are
773 specified by a subtype and normally two values, a globally unique
774 part (e.g. the AS number) and a local part. Both as-number and
775 local may be set to neighbor-as, which is expanded to the current
776 neighbor remote AS number, or local-as, which is expanded to the
777 locally assigned AS number. Wildcard matching is supported for
778 local, numvalue and subtype. If wildcard matching is used on the
779 subtype then numvalue also needs to be set to ‘*’. See also the
780 ATTRIBUTE SET section for further information about the encoding.
781 (from|to) peer
783 This rule applies only to UPDATES coming from, or going to, this
784 particular neighbor. This parameter must be specified. peer is
785 one of the following:
786 any Any neighbor will be matched.
788 ibgp All IBGP neighbors will be matched.
789 ebgp All EBGP neighbors will be matched.
790 address Neighbors with this address will be matched.
791 group descr Neighbors in this group will be matched.
792 AS as-number
793 Neighbors with this AS will be matched.
794 Multiple peer entries may also be specified, separated by commas
796 or whitespace, if enclosed in curly brackets:
797 deny from { 128.251.16.1, 251.128.16.2, group hojo }
799 (inet|inet6)
801 Match only routes in the IPv4 or IPv6 address families, respec‐
802 tively. inet is an alias for "prefix 0.0.0.0/0 prefixlen >= 0";
803 inet6 is an alias for "prefix ::/0 prefixlen >= 0".
804 max-as-len len
806 This rule applies only to UPDATES where the AS path has more than
807 len elements.
808 max-as-seq len
810 This rule applies only to UPDATES where a single AS number is re‐
811 peated more than len times.
812 max-communities|max-large-communities|max-ext-communities num
814 This rule applies only to UPDATES where the Basic, Large, or
815 Extended Community attribute has more than num elements.
816 nexthop address
818 This rule applies only to UPDATES where the nexthop is equal to
819 address. The address can be set to neighbor in which case the
820 nexthop is compared against the address of the neighbor. Nexthop
821 filtering is not supported on locally announced networks and one
822 must take into consideration previous rules overwriting nexthops.
823 origin-set name
825 This rule applies only to UPDATES that match the given origin-set
826 name.
827 ovs (valid | not-found | invalid)
829 This rule applies only to UPDATES where the Origin Validation
830 State (OVS) matches.
831 prefix address/len
833 prefix address/len prefixlen range
834 prefix address/len or-longer
835 prefix address/len maxlen mlen
836 This rule applies only to UPDATES for the specified prefix.
837 Multiple entries may be specified, separated by commas or white‐
839 space, if enclosed in curly brackets:
840 deny from any prefix { 192.168.0.0/16, 10.0.0.0/8 or-longer }
842 Multiple lists can also be specified, which is useful for macro
844 expansion:
845 good="{ 192.168.0.0/16, 172.16.0.0/12, 10.0.0.0/8 }"
847 bad="{ 224.0.0.0/4 prefixlen >= 4, 240.0.0.0/4 prefixlen >= 4 }"
848 ugly="{ 127.0.0.1/8, 169.254.0.0/16 }"
849 deny from any prefix { $good $bad $ugly }
851 Prefix length ranges are specified by using these operators:
853 = (equal)
855 != (unequal)
856 < (less than)
857 <= (less than or equal)
858 > (greater than)
859 >= (greater than or equal)
860 - (range including boundaries)
861 >< (except range)
862 >< and - are binary operators (they take two arguments). For in‐
864 stance, to match all prefix lengths >= 8 and <= 12, and hence the
865 CIDR netmasks 8, 9, 10, 11 and 12:
866 prefixlen 8-12
868 Or, to match all prefix lengths < 8 or > 12, and hence the CIDR
870 netmasks 0–7 and 13–32:
871 prefixlen 8><12
873 This will match all prefixes in the 10.0.0.0/8 netblock with net‐
875 masks longer than 16:
876 prefix 10.0.0.0/8 prefixlen > 16
878 or-longer is a shorthand for:
880 prefix address/len prefixlen >= len
882 maxlen mlen is a shorthand for:
884 prefix address/len prefixlen <= mlen
886 prefix-set name [or-longer]
888 This rule applies only to UPDATES that match the given prefix-set
889 name. With or-longer, the UPDATES will match any prefix in the
890 prefix-set where
891 address/len prefixlen >= len
893 quick If an UPDATE matches a rule which has the quick option set, this
895 rule is considered the last matching rule, and evaluation of sub‐
896 sequent rules is skipped.
897 rib name
899 Apply rule only to the specified RIB. This only applies for re‐
900 ceived updates, so not for rules using the to peer parameter.
901 set attribute ...
903 All matching rules can set the AS path attributes to some de‐
904 fault. The set of every matching rule is applied, not only the
905 last matching one. See also the following section.
906
908 AS path attributes can be modified with set.
909 set can be used on network statements, in neighbor or group blocks, and
911 on filter rules. Attribute sets can be expressed as lists.
912 The following attributes can be modified:
914 community [delete] as-number:local
916 community [delete] name
917 Set or delete the COMMUNITIES AS path attribute. Communities are
918 specified as as-number:local, where as-number is an AS number and
919 local is a locally significant number between zero and 65535.
920 Alternately, well-known communities may be specified by name:
921 GRACEFUL_SHUTDOWN, NO_EXPORT, NO_ADVERTISE, NO_EXPORT_SUBCONFED,
922 or NO_PEER. For delete, both as-number and local may be set to
923 ‘*’ to do wildcard matching.
924 large-community [delete] as-number:local:local
926 large-community [delete] name
927 Set or delete the Large Communities path attribute. Communities
928 are specified as as-number:local:local, where as-number is an AS
929 number and local is a locally significant number between zero and
930 4294967295. For delete, both as-number and local may be set to
931 ‘*’ to do wildcard matching.
932 ext-community [delete] subtype as-number:local
934 ext-community [delete] subtype IP:local
935 ext-community [delete] subtype numvalue
936 ext-community [delete] ovs (valid | not-found | invalid)
937 Set or delete the Extended Community AS path attribute. Extended
938 Communities are specified by a subtype and normally two values, a
939 globally unique part (e.g. the AS number) and a local part. The
940 type is selected depending on the encoding of the global part.
941 Two-octet AS Specific Extended Communities and Four-octet AS Spe‐
942 cific Extended Communities are encoded as as-number:local. Four-
943 octet encoding is used if the as-number is bigger than 65535 or
944 if the AS_DOT encoding is used. IPv4 Address Specific Extended
945 Communities are encoded as IP:local. Opaque Extended Communities
946 are encoded with a single numeric value. The ovs subtype can
947 only be set to valid, not-found, or invalid. Currently the fol‐
948 lowing subtypes are supported:
949 bdc BGP Data Collection
951 defgw Default Gateway
952 esi-lab ESI Label
953 esi-rt ES-Import Route Target
954 l2vid L2VPN Identifier
955 mac-mob MAC Mobility
956 odi OSPF Domain Identifier
957 ort OSPF Route Type
958 ori OSPF Router ID
959 ovs BGP Origin Validation State
960 rt Route Target
961 soo Route Origin / Source of Origin
962 srcas Source AS
963 vrfri VRF Route Import
964 Not all type and subtype value pairs are allowed by IANA and the
966 parser will ensure that no invalid combination is created.
967 For delete, subtype, numvalue, or local, may be set to ‘*’ to do
969 wildcard matching. If wildcard matching is used on the subtype
970 then numvalue also needs to be set to ‘*’.
971 localpref number
973 Set the LOCAL_PREF AS path attribute. If number starts with a
974 plus or minus sign, LOCAL_PREF will be adjusted by adding or sub‐
975 tracting number; otherwise it will be set to number. The default
976 is 100.
977 med number
979 metric number
980 Set the MULTI_EXIT_DISC AS path attribute. If number starts with
981 a plus or minus sign, MULTI_EXIT_DISC will be adjusted by adding
982 or subtracting number; otherwise it will be set to number.
983 origin (igp|egp|incomplete)
985 Set the ORIGIN AS path attribute to mark the source of this route
986 as being injected from an igp protocol, an egp protocol or being
987 an aggregated route.
988 nexthop (address|blackhole|reject|self|no-modify)
990 Set the NEXTHOP AS path attribute to a different nexthop address
991 or use blackhole or reject routes. blackhole and reject only af‐
992 fect the FIB and will not alter the nexthop address. self forces
993 the nexthop to be set to the local interface address. If set to
994 no-modify, the nexthop attribute is not modified for EBGP multi‐
995 hop sessions. By default EBGP multihop sessions use the local
996 interface address. On other IBGP and directly connected EBGP
997 sessions no-modify is ignored. The set address is used on IBGP
998 session and on directly connected EBGP session if the address is
999 part of the connected network. On EBGP multihop session
1000 no-modify has to be set to force the nexthop to address.
1001 set nexthop 192.168.0.1
1003 set nexthop blackhole
1004 set nexthop reject
1005 set nexthop no-modify
1006 set nexthop self
1007 pftable table
1009 Add the prefix in the update to the specified pf(4) table, re‐
1010 gardless of whether or not the path was selected for routing.
1011 This option may be useful in building realtime blacklists.
1012 prepend-neighbor number
1014 Prepend the neighbor's AS number times to the AS path.
1015 prepend-self number
1017 Prepend the local AS number times to the AS path.
1018 rtlabel label
1020 Add the prefix to the kernel routing table with the specified
1021 label.
1022 weight number
1024 The weight is used to tip prefixes with equally long AS paths in
1025 one or the other direction. A prefix is weighed at a very late
1026 stage in the decision process. If number starts with a plus or
1027 minus sign, the weight will be adjusted by adding or subtracting
1028 number; otherwise it will be set to number. Weight is a local
1029 non-transitive attribute, and is a bgpd(8)-specific extension.
1030 For prefixes with equally long paths, the prefix with the larger
1031 weight is selected.
1032
1034 /etc/bgpd.conf bgpd(8) configuration file.
1035
1037 strftime(3), ipsec(4), pf(4), rdomain(4), tcp(4), bgpctl(8), bgpd(8),
1038 ipsecctl(8), isakmpd(8), rc.conf.local(8)
1039
1041 The bgpd.conf file format first appeared in OpenBSD 3.5.
1042BSD May 31, 2022 BSD