1BGPD.CONF(5) BSD File Formats Manual BGPD.CONF(5)
2
4 bgpd.conf — Border Gateway Protocol daemon configuration file
5
7 The bgpd(8) daemon implements the Border Gateway Protocol version 4 as
8 described in RFC 4271.
9 The bgpd.conf config file is divided into the following main sections:
11 MACROS
13 User-defined variables may be defined and used later, simplifying
14 the configuration file.
15 GLOBAL CONFIGURATION
17 Global settings for bgpd(8).
18 SET CONFIGURATION
20 Various lookup tables are defined in this section.
21 NETWORK ANNOUNCEMENTS
23 Networks which should be announced by bgpd(8) are set in this sec‐
24 tion.
25 MPLS VPN CONFIGURATION
27 The definition and properties for BGP MPLS VPNs are set in this
28 section.
29 NEIGHBORS AND GROUPS
31 bgpd(8) establishes sessions with neighbors. The neighbor defini‐
32 tion and properties are set in this section, as well as grouping
33 neighbors for the ease of configuration.
34 FILTER
36 Filter rules for incoming and outgoing UPDATES.
37 With the exception of macros, the sections should be grouped and appear
39 in bgpd.conf in the order shown above.
40 The current line can be extended over multiple lines using a backslash
42 (‘\’). Comments can be put anywhere in the file using a hash mark (‘#’),
43 and extend to the end of the current line. Care should be taken when
44 commenting out multi-line text: the comment is effective until the end of
45 the entire block.
46 Argument names not beginning with a letter, digit, or underscore must be
48 quoted.
49 Additional configuration files can be included with the include keyword,
51 for example:
52 include "/etc/bgpd/bgpd-10.0.0.1.filter"
54
56 Macros can be defined that will later be expanded in context. Macro
57 names must start with a letter, digit, or underscore, and may contain any
58 of those characters. Macro names may not be reserved words (for example,
59 AS, neighbor, or group). Macros are not expanded inside quotes.
60 For example:
62 peer1="1.2.3.4"
64 neighbor $peer1 {
65 remote-as 65001
66 }
67
69 These settings affect the operation of the bgpd(8) daemon as a whole.
70 AS as-number [as-number]
72 Set the local autonomous system number to as-number. A fallback
73 2-byte AS number may follow a 4-byte AS number for neighbors that
74 do not support 4-byte AS numbers. The standard and default fall‐
75 back AS number is 23456.
76 The AS numbers are assigned by local RIRs, such as:
78 AfriNIC for Africa
80 APNIC for Asia Pacific
81 ARIN for North America and parts of the Caribbean
82 LACNIC for Latin America and the Caribbean
83 RIPE NCC for Europe, the Middle East, and parts of Asia
84 The AS numbers 64512 – 65534 are designated for private use. The
86 AS number 23456 is reserved and should not be used. 4-byte AS
87 numbers may be specified in either the ASPLAIN format:
88 AS 196618
90 or in the older ASDOT format:
92 AS 3.10
94 connect-retry seconds
96 Set the number of seconds to wait before attempting to re-open a
97 connection. This timer should be sufficiently large in EBGP con‐
98 figurations. The default is 120 seconds.
99 dump [rib name] (table|table-mp|table-v2) file [interval]
101 dump (all|updates) (in|out) file [interval]
102 Dump the RIB, a.k.a. the routing information base, or dump ongo‐
103 ing BGP activity, in Multi-threaded Routing Toolkit (MRT) format.
104 The file is subject to strftime(3)-expansion.
105 The table-v2 and table-mp RIB formats store multi-protocol RIBs
107 correctly, but the table format does not. The latter two are
108 provided only to support third-party tools lacking support for
109 the recommended table-v2 format. Dump an alternative RIB by
110 specifying name. Specify an interval in seconds for periodic RIB
111 dumps.
112 The following will dump the entire RIB table, at startup and ev‐
114 ery 5 minutes thereafter, to a new file:
115 dump table-v2 "/tmp/rib-dump-%H%M" 300
117 Dumps of ongoing BGP activity include all BGP state transitions,
119 and all BGP messages in the specified direction. Use updates to
120 dump only BGP UPDATE messages, without state transitions. Spec‐
121 ify an interval in seconds to restart periodically with a new
122 file:
123 dump all in "/tmp/all-in-%H%M" 300
125 fib-priority prio
127 Set the routing priority to prio. The default is 48.
128 fib-update (yes|no)
130 If set to no, do not update the Forwarding Information Base,
131 a.k.a. the kernel routing table. The default is yes.
132 holdtime seconds
134 Set the announced holdtime in seconds. This is exchanged with a
135 neighbor upon connection establishment, in the OPEN message, and
136 the shortest holdtime governs the session.
137 The neighbor session is dropped if the session holdtime passes
139 without receipt of a KEEPALIVE or an UPDATE message from the
140 neighbor. The default is 90 seconds.
141 holdtime min seconds
143 The minimum acceptable holdtime in seconds. This value must be
144 at least 3.
145 listen on address
147 Specify the local IP address for bgpd(8) to listen on. The de‐
148 fault is to listen on all local addresses on the current default
149 routing domain.
150 log updates
152 Log sent and received BGP update messages.
153 nexthop qualify via (bgp|default)
155 If set to bgp, bgpd(8) may verify nexthops using BGP routes. If
156 set to default, bgpd(8) may verify nexthops using the default
157 route. By default bgpd(8) uses only static routes or routes
158 added by other routing daemons, such as ospfd(8).
159 rde evaluate (default|all)
161 If set to all keep evaluating alternative paths in case the se‐
162 lected path is filtered out. By default if a path is filtered by
163 the output filters then no alternative path is sent to this peer.
164 rde med compare (always|strict)
166 If set to always, the MULTI_EXIT_DISC attributes will always be
167 compared. The default is strict, where the metric is only com‐
168 pared between peers belonging to the same AS.
169 rde rib name [no evaluate]
171 rde rib name [rtable number]
172 Create an additional RIB named name. The degree to which its
173 routes may be utilized is configurable. They may be excluded
174 from the decision process that selects usable routes with the no
175 evaluate flag, and this precludes their export to any kernel
176 routing table. By default its routes will be evaluated, but not
177 exported to the kernel. They may be both evaluated and exported
178 if associated with a given rtable number, which must belong to
179 the routing domain that bgpd(8) was started in. This table will
180 not be consulted during nexthop verification unless it is the one
181 that bgpd(8) was started in. It is unnecessary to create
182 Adj-RIB-In and Loc-RIB, which are created automatically and used
183 by default.
184 rde route-age (ignore|evaluate)
186 If set to evaluate, the route decision process will also consider
187 the age of the route in addition to its path attributes, giving
188 preference to the older, typically more stable, route. This ren‐
189 ders the decision process nondeterministic. The default is
190 ignore.
191 reject as-set (yes|no)
193 If set to yes, AS paths attributes containing AS_SET path seg‐
194 ments will be rejected and all prefixes will be treated as with‐
195 draws. The default is no.
196 router-id dotted-quad
198 Set the BGP router ID, which must be non-zero and should be
199 unique within the AS. By default, the router ID is the highest
200 IPv4 address assigned to the local machine.
201 router-id 10.0.0.1
203 rtable number
205 Work with the given kernel routing table instead of the default
206 table, which is the one bgpd(8) was started in. For nexthop ver‐
207 ification, bgpd(8) will always consult the default table. This
208 is the same as using the following syntax:
209 rde rib Loc-RIB rtable number
211 socket "path" [restricted]
213 Create a control socket at path. If restricted is specified a
214 restricted control socket will be created. By default
215 /run/bgpd/bgpd.sock.<rdomain> is used where <rdomain> is the
216 routing domain in which bgpd(8) has been started. By default, no
217 restricted socket is created.
218 transparent-as (yes|no)
220 If set to yes, AS paths to EBGP neighbors are not prepended with
221 the local AS. The default is no.
222
224 bgpd(8) supports the efficient lookup of data within named sets. An
225 as-set, a prefix-set, and an origin-set store AS numbers, prefixes, and
226 prefixes/source-as pairs, respectively. Such sets may be referenced by
227 filter rules; see the FILTER section for details. It is more efficient
228 to evaluate a set than a long series of rules for filtering each of its
229 members.
230 One single roa-set may be defined, against which bgpd(8) will validate
232 the origin of each prefix.
233 A set definition can span multiple lines, and an optional comma is al‐
235 lowed between elements.
236 as-set name { as-number ... }
238 An as-set stores AS numbers, and can be used with the AS specific
239 parameter in FILTER rules.
240 origin-set name { address/len maxlen mlen source-as asn ... }
242 An origin-set stores prefix/source-as pairs, and can be used to
243 filter on the combination by using the origin-set parameter in
244 FILTER rules.
245 origin-set private { 10.0.0.0/8 maxlen 24 source-as 64511
247 203.0.113.0/24 source-as 64496 }
248 prefix-set name { address/len ... }
250 A prefix-set stores network prefixes and can be used in place of
251 the prefix parameter in FILTER rules, and in network statements.
252 A prefix can be followed by the prefixlen operators listed for
253 the prefix parameter in the PARAMETERS section.
254 The first example below creates a set of prefixes called
256 “private”, to hold a number of RFC 1918 private network blocks.
257 The second example shows the use of prefixlen operators.
258 prefix-set private { 10.0.0.0/8, 172.16.0.0/12,
260 192.168.0.0/16, fc00::/7 }
261 prefix-set as64496set { 192.0.2.0/24 prefixlen >= 26,
262 2001:db8::/32 or-longer }
263 roa-set { address/len maxlen mlen source-as asn ... }
265 The roa-set holds a collection of Validated Route Origin
266 Authorization Payloads (VRP). Each received prefix is checked
267 against the roa-set, and the Origin Validation State (OVS) is
268 set.
269 roa-set { 192.0.2.0/24 maxlen 24 source-as 64511
271 203.0.113.0/24 source-as 64496 }
272 rtr address { ... }
274 The rtr block specifies a RPKI to Router Protocol session. The
275 rtr session properties are as follows:
276 descr description
278 Add a description. The description is used in logging
279 and status reports, but has no further meaning for
280 bgpd(8).
281 local-address address
283 Bind to the specific IP address before opening the TCP
284 connection to the rtr server.
285 port number
287 Specify the TCP destination port for the rtr session. If
288 not specified the default port is 323.
289
291 network statements specify the networks that bgpd(8) will announce as its
292 own. An announcement must also be permitted by the FILTER rules. By de‐
293 fault bgpd(8) announces no networks.
294 network address/prefix [set ...]
296 Announce the specified prefix as belonging to our AS.
297 network (inet|inet6) connected [set ...]
299 Announce routes to directly attached networks.
300 network prefix-set name [set ...]
302 Announce all networks in the prefix-set name.
303 network (inet|inet6) priority number [set ...]
305 Announce routes having the specified priority.
306 network (inet|inet6) rtlabel label [set ...]
308 Announce routes having the specified label.
309 network (inet|inet6) static [set ...]
311 Announce all static routes.
312 Each network statement may set default AS path attributes:
314 network 192.168.7.0/24 set localpref 220
316 See also the ATTRIBUTE SET section.
318
320 A vpn section configures a router to participate in an MPLS Virtual Pri‐
321 vate Network. It specifies an mpe(4) interface to use, a description,
322 and various properties of the VPN:
323 vpn "description" on mpe1 {
325 rd 65002:1
326 import-target rt 65002:42
327 export-target rt 65002:42
328 network 192.168.1/24
329 }
330 bgpd(8) will not exchange VPN routes with a neighbor by default, see the
332 NEIGHBORS AND GROUPS section. The description is used when logging but
333 has no further meaning to bgpd(8).
334 The mpe(4) interface will be used as the outgoing interface for routes to
336 the VPN, and local networks will be announced with the MPLS label speci‐
337 fied on the interface. The interface can provide VPN connectivity for
338 another rdomain by being configured in that rdomain. The required rdo‐
339 main must be configured on the interface before bgpd(8) uses it. Multi‐
340 ple VPNs may be connected to a single rdomain, including the rdomain that
341 bgpd(8) is running in.
342 An example hostname.if(5) configuration for an mpe(4) interface providing
344 connectivity to rdomain 1:
345 rdomain 1
347 mplslabel 2000
348 inet 192.198.0.1 255.255.255.255
349 up
350 The VPN properties are as follows:
352 export-target subtype as-number:local
354 export-target subtype IP:local
355 Classify announced networks by tagging them with an extended
356 community of the given arguments. The community subtype should
357 be a route target, rt, to ensure interoperability. The arguments
358 are further detailed in the ATTRIBUTE SET section. More than one
359 export-target can be specified.
360 fib-update (yes|no)
362 If set to no, do not update the Forwarding Information Base,
363 a.k.a. the kernel routing table. The default is yes.
364 import-target subtype as-number:local
366 import-target subtype IP:local
367 The rdomain imports only those prefixes tagged with an extended
368 community matching an import-target. The community subtype
369 should be a route target, rt, to ensure interoperability. The
370 arguments are further detailed in the ATTRIBUTE SET section.
371 More than one import-target can be specified.
372 network arguments ...
374 Announce the given networks within this VPN; see the NETWORK
375 ANNOUNCEMENTS section.
376 rd as-number:local
378 rd IP:local
379 The Route Distinguisher rd supplies BGP with namespaces to disam‐
380 biguate VPN prefixes, as these needn't be globally unique. Un‐
381 like route targets, the rd neither identifies the origin of the
382 prefix nor controls into which VPNs the prefix is distributed.
383 The as-number or IP of a rd should be set to a number or IP that
384 was assigned by an appropriate authority, whereas local can be
385 chosen by the local operator.
386
388 bgpd(8) establishes TCP connections to other BGP speakers called
389 neighbors. A neighbor and its properties are specified by a neighbor
390 section:
391 neighbor 10.0.0.2 {
393 remote-as 65002
394 descr "a neighbor"
395 }
396 Neighbors placed within a group section inherit the properties common to
398 that group:
399 group "peering AS65002" {
401 remote-as 65002
402 neighbor 10.0.0.2 {
403 descr "AS65002-p1"
404 }
405 neighbor 10.0.0.3 {
406 descr "AS65002-p2"
407 }
408 }
409 An entire network of neighbors may be accommodated by specifying an ad‐
411 dress/netmask pair:
412 neighbor 10.0.0.0/8
414 This is a template that recognises as a neighbor any connection from
416 within the given network. Such neighbors inherit their template's prop‐
417 erties, except for their IP address. A template may omit remote-as;
418 bgpd(8) then accepts any AS presented by the neighbor in the OPEN mes‐
419 sage.
420 The neighbor properties are as follows:
422 announce (IPv4|IPv6) (none|unicast|vpn)
424 For the given address family, control which subsequent address
425 families are announced during the capabilities negotiation. Only
426 routes for that address family and subsequent address families
427 will be announced and processed.
428 At the moment, only none, which disables the announcement of that
430 address family, unicast, and vpn, which allows the distribution
431 of BGP MPLS VPNs, are supported.
432 The default is unicast for the same address family of the ses‐
434 sion.
435 announce as-4byte (yes|no)
437 If set to no, the 4-byte AS capability is not announced and so
438 native 4-byte AS support is disabled. The default is yes.
439 announce capabilities (yes|no)
441 If set to no, capability negotiation is disabled during the es‐
442 tablishment of the session. This can be helpful to connect to
443 old or broken BGP implementations. The default is yes.
444 announce refresh (yes|no)
446 If set to no, the route refresh capability is not announced. The
447 default is yes.
448 announce restart (yes|no)
450 If set to no, the graceful restart capability is not announced.
451 Currently only the End-of-RIB marker is supported and announced
452 by the restart capability. The default is yes.
453 as-override (yes|no)
455 If set to yes, all occurrences of the neighbor AS in the AS path
456 will be replaced with the local AS before running the filters.
457 The Adj-RIB-In still holds the unmodified AS path. The default
458 value is no.
459 demote group
461 Increase the carp(4) demotion counter on the given interface
462 group, usually carp, when the session is not in state
463 ESTABLISHED. The demotion counter will be increased as soon as
464 bgpd(8) starts and decreased 60 seconds after the session went to
465 state ESTABLISHED. For neighbors added at runtime, the demotion
466 counter is only increased after the session has been ESTABLISHED
467 at least once before dropping.
468 For more information on interface groups, see the group keyword
470 in ifconfig(8).
471 depend on interface
473 The neighbor session will be kept in state IDLE as long as
474 interface reports no link. For carp(4) interfaces, no link means
475 that the interface is currently backup. This is primarily in‐
476 tended to be used with carp(4) to reduce failover times.
477 The state of the network interfaces on the system can be viewed
479 using the show interfaces command to bgpctl(8).
480 descr description
482 Add a description. The description is used when logging neighbor
483 events, in status reports, for specifying neighbors, etc., but
484 has no further meaning to bgpd(8).
485 down [reason]
487 Do not start the session when bgpd(8) comes up but stay in IDLE.
488 If the session is cleared at runtime, after a down reason was
489 configured at runtime, the reason is sent as Administrative Shut‐
490 down Communication. The reason cannot exceed 255 octets.
491 dump (all|updates) (in|out) file [interval]
493 Dump ongoing BGP activity for a particular neighbor. See also
494 the dump setting in GLOBAL CONFIGURATION.
495 enforce local-as (yes|no)
497 If set to no, AS paths will not be checked for AS loop detection.
498 This feature is similar to allowas-in in some other BGP implemen‐
499 tations. Since there is no AS path loop check, this feature is
500 dangerous, and requires you to add filters to prevent receiving
501 your own prefixes. The default value is yes.
502 enforce neighbor-as (yes|no)
504 If set to yes, AS paths whose leftmost AS is not equal to the
505 remote AS of the neighbor are rejected and a NOTIFICATION is sent
506 back. The default value for IBGP peers is no otherwise the de‐
507 fault is yes.
508 export (none|default-route)
510 If set to none, no UPDATE messages will be sent to the neighbor.
511 If set to default-route, only the default route will be announced
512 to the neighbor. When export is modified the neighbor session
513 needs to be reset to become active.
514 holdtime seconds
516 Set the holdtime in seconds. Inherited from the global configu‐
517 ration if not given.
518 holdtime min seconds
520 Set the minimal acceptable holdtime. Inherited from the global
521 configuration if not given.
522 ipsec (ah|esp) (in|out) spi spi-number authspec [encspec]
524 Enable IPsec with static keying. There must be at least two
525 ipsec statements per peer with manual keying, one per direction.
526 authspec specifies the authentication algorithm and key. It can
527 be
528 sha1 <key>
530 md5 <key>
531 encspec specifies the encryption algorithm and key. ah does not
533 support encryption. With esp, encryption is optional. encspec
534 can be
535 3des <key>
537 3des-cbc <key>
538 aes <key>
539 aes-128-cbc <key>
540 Keys must be given in hexadecimal format. After changing set‐
542 tings a session needs to be reset to use the new keys.
543 ipsec (ah|esp) ike
545 Enable IPsec with dynamic keying. In this mode, bgpd(8) sets up
546 the flows, and a key management daemon such as isakmpd(8) is re‐
547 sponsible for managing the session keys. With isakmpd(8), it is
548 sufficient to copy the peer's public key, found in
549 /etc/isakmpd/local.pub, to the local machine. It must be stored
550 in a file named after the peer's IP address and must be stored in
551 /etc/isakmpd/pubkeys/ipv4/. The local public key must be copied
552 to the peer in the same way. As bgpd(8) manages the flows on its
553 own, it is sufficient to restrict isakmpd(8) to only take care of
554 keying by specifying the flags -Ka. This can be done in
555 rc.conf.local(8). After starting the isakmpd(8) and bgpd(8) dae‐
556 mons on both sides, the session should be established. After
557 changing settings a session needs to be reset to use the new
558 keys.
559 local-address address
561 no local-address
562 When bgpd(8) initiates the TCP connection to the neighbor system,
563 it normally does not bind to a specific IP address. If a
564 local-address is given, bgpd(8) binds to this address first. no
565 local-address reverts back to the default.
566 local-as as-number [as-number]
568 Set the AS number sent to the remote system. Used as described
569 above under GLOBAL CONFIGURATION option AS.
570 Since there is no AS path loop check, this option is dangerous,
572 and requires you to add filters to prevent receiving your ASNs.
573 Intended to be used temporarily, for migrations to another AS.
574 log no Disable neighbor specific logging.
576 log updates
578 Log received and sent updates for this neighbor.
579 max-prefix number [restart number]
581 Terminate the session when the maximum number of prefixes re‐
582 ceived is exceeded (no such limit is imposed by default). If
583 restart is specified, the session will be restarted after number
584 minutes.
585 max-prefix number out [restart number]
587 Terminate the session when the maximum number of prefixes sent is
588 exceeded (no such limit is imposed by default). If restart is
589 specified, the session will be restarted after number minutes.
590 multihop hops
592 Neighbors not in the same AS as the local bgpd(8) normally have
593 to be directly connected to the local machine. If this is not
594 the case, the multihop statement defines the maximum hops the
595 neighbor may be away.
596 passive
598 Do not attempt to actively open a TCP connection to the neighbor
599 system.
600 reject as-set (yes|no)
602 If set to yes, AS paths attributes containing AS_SET path seg‐
603 ments will be rejected and all prefixes will be treated as with‐
604 draws. The default is inherited from the global reject as-set
605 setting.
606 remote-as as-number
608 Set the AS number of the remote system.
609 rde evaluate (default|all)
611 If set to all keep evaluating alternative paths in case the se‐
612 lected path is filtered out. By default if a path is filtered by
613 the output filters then no alternative path is sent to this peer.
614 The default is inherited from the global rde evaluate setting.
615 rib name
617 Bind the neighbor to the specified RIB.
618 route-reflector [address]
620 Act as an RFC 4456 route-reflector for this neighbor. An op‐
621 tional cluster ID can be specified; otherwise the BGP ID will be
622 used.
623 set attribute ...
625 Set the AS path attributes to some default per neighbor or group
626 block:
627 set localpref 300
629 See also the ATTRIBUTE SET section. Set parameters are applied
631 to the received prefixes; the only exceptions are prepend-self,
632 nexthop no-modify and nexthop self. These sets are rewritten
633 into filter rules and can be viewed with “bgpd -nv”.
634 tcp md5sig password secret
636 tcp md5sig key secret
637 Enable TCP MD5 signatures per RFC 2385. The shared secret can
638 either be given as a password or hexadecimal key.
639 tcp md5sig password mekmitasdigoat
641 tcp md5sig key deadbeef
642 After changing keys a session needs to be reset to use the new
643 keys.
644 transparent-as (yes|no)
646 If set to yes, AS paths to EBGP neighbors are not prepended with
647 the local AS. The default is inherited from the global
648 transparent-as setting.
649 ttl-security (yes|no)
651 Enable or disable ttl-security. When enabled, outgoing packets
652 are sent using a TTL of 255 and a check is made against an incom‐
653 ing packet's TTL. For directly connected peers, incoming packets
654 are required to have a TTL of 255, ensuring they have not been
655 routed. For multihop peers, incoming packets are required to
656 have a TTL of 256 minus multihop distance, ensuring they have not
657 passed through more than the expected number of hops. The de‐
658 fault is no.
659
661 bgpd(8) filters all BGP UPDATE messages, including its own announcements,
662 and blocks them by default. Filter rules may match on neighbor, direc‐
663 tion, prefix or AS path attributes. Filter rules may also modify AS path
664 attributes.
665 For each UPDATE processed by the filter, the filter rules are evaluated
667 in sequential order, from first to last. The last matching allow or deny
668 rule decides what action is taken. The default action is to deny.
669 The following actions can be used in the filter:
671 allow The UPDATE is passed.
673 deny The UPDATE is blocked.
675 match Apply the filter attribute set without influencing the filter
677 decision.
678
680 The rule parameters specify the UPDATES to which a rule applies. An
681 UPDATE always comes from, or goes to, one neighbor. Most parameters are
682 optional, but each can appear at most once per rule. If a parameter is
683 specified, the rule only applies to packets with matching attributes.
684 as-type [operator] as-number
686 as-type as-set name
687 This rule applies only to UPDATES where the AS path matches. The
688 part of the AS path specified by the as-type is matched against
689 the as-number or the as-set name:
690 AS (any part)
692 peer-as (leftmost AS number)
693 source-as (rightmost AS number)
694 transit-as (all but the rightmost AS number)
695 as-number is an AS number as explained above under GLOBAL
697 CONFIGURATION. It may be set to neighbor-as, which is expanded
698 to the current neighbor remote AS number, or local-as, which is
699 expanded to the locally assigned AS number.
700 When specifying an as-set name the AS path will instead be
702 matched against all the AS numbers in the set.
703 The operator can be unspecified (this case is identical to the
705 equality operator), or one of the numerical operators
706 = (equal)
708 != (unequal)
709 - (range including boundaries)
710 >< (except range)
711 >< and - are binary operators (they take two arguments); with
713 these, as-number cannot be set to neighbor-as.
714 Multiple as-number entries for a given type or as-type as-number
716 entries may also be specified, separated by commas or whitespace,
717 if enclosed in curly brackets:
718 deny from any AS { 1, 2, 3 }
720 deny from any { AS 1, source-as 2, transit-as 3 }
721 deny from any { AS { 1, 2, 3 }, source-as 4, transit-as 5 }
722 community as-number:local
724 community name
725 This rule applies only to UPDATES where the community path attri‐
726 bute is present and matches. Communities are specified as
727 as-number:local, where as-number is an AS number and local is a
728 locally significant number between zero and 65535. Both
729 as-number and local may be set to ‘*’ to do wildcard matching.
730 Alternatively, well-known communities may be given by name in‐
731 stead and include BLACKHOLE, GRACEFUL_SHUTDOWN, NO_EXPORT,
732 NO_ADVERTISE, NO_EXPORT_SUBCONFED, and NO_PEER. Both as-number
733 and local may be set to neighbor-as, which is expanded to the
734 current neighbor remote AS number, or local-as, which is expanded
735 to the locally assigned AS number.
736 large-community as-number:local:local
738 This rule applies only to UPDATES where the Large community path
739 attribute is present and matches. Communities are specified as
740 as-number:local:local, where as-number is an AS number and local
741 is a locally significant number between zero and 4294967295.
742 Both as-number and local may be set to ‘*’ to do wildcard match‐
743 ing, neighbor-as, which is expanded to the current neighbor re‐
744 mote AS number, or local-as, which is expanded to the locally as‐
745 signed AS number.
746 ext-community subtype as-number:local
748 ext-community subtype IP:local
749 ext-community subtype numvalue
750 ext-community ovs (valid | not-found | invalid)
751 This rule applies only to UPDATES where the extended community
752 path attribute is present and matches. Extended Communities are
753 specified by a subtype and normally two values, a globally unique
754 part (e.g. the AS number) and a local part. Both as-number and
755 local may be set to neighbor-as, which is expanded to the current
756 neighbor remote AS number, or local-as, which is expanded to the
757 locally assigned AS number. Wildcard matching is supported for
758 local, numvalue and subtype. If wildcard matching is used on the
759 subtype then numvalue also needs to be set to ‘*’. See also the
760 ATTRIBUTE SET section for further information about the encoding.
761 (from|to) peer
763 This rule applies only to UPDATES coming from, or going to, this
764 particular neighbor. This parameter must be specified. peer is
765 one of the following:
766 any Any neighbor will be matched.
768 ibgp All IBGP neighbors will be matched.
769 ebgp All EBGP neighbors will be matched.
770 address Neighbors with this address will be matched.
771 group descr Neighbors in this group will be matched.
772 AS as-number
773 Neighbors with this AS will be matched.
774 Multiple peer entries may also be specified, separated by commas
776 or whitespace, if enclosed in curly brackets:
777 deny from { 128.251.16.1, 251.128.16.2, group hojo }
779 (inet|inet6)
781 Match only routes in the IPv4 or IPv6 address families, respec‐
782 tively. inet is an alias for "prefix 0.0.0.0/0 prefixlen >= 0";
783 inet6 is an alias for "prefix ::/0 prefixlen >= 0".
784 max-as-len len
786 This rule applies only to UPDATES where the AS path has more than
787 len elements.
788 max-as-seq len
790 This rule applies only to UPDATES where a single AS number is re‐
791 peated more than len times.
792 nexthop address
794 This rule applies only to UPDATES where the nexthop is equal to
795 address. The address can be set to neighbor in which case the
796 nexthop is compared against the address of the neighbor. Nexthop
797 filtering is not supported on locally announced networks and one
798 must take into consideration previous rules overwriting nexthops.
799 origin-set name
801 This rule applies only to UPDATES that match the given origin-set
802 name.
803 ovs (valid | not-found | invalid)
805 This rule applies only to UPDATES where the Origin Validation
806 State (OVS) matches.
807 prefix address/len
809 prefix address/len prefixlen range
810 prefix address/len or-longer
811 prefix address/len maxlen mlen
812 This rule applies only to UPDATES for the specified prefix.
813 Multiple entries may be specified, separated by commas or white‐
815 space, if enclosed in curly brackets:
816 deny from any prefix { 192.168.0.0/16, 10.0.0.0/8 or-longer }
818 Multiple lists can also be specified, which is useful for macro
820 expansion:
821 good="{ 192.168.0.0/16, 172.16.0.0/12, 10.0.0.0/8 }"
823 bad="{ 224.0.0.0/4 prefixlen >= 4, 240.0.0.0/4 prefixlen >= 4 }"
824 ugly="{ 127.0.0.1/8, 169.254.0.0/16 }"
825 deny from any prefix { $good $bad $ugly }
827 Prefix length ranges are specified by using these operators:
829 = (equal)
831 != (unequal)
832 < (less than)
833 <= (less than or equal)
834 > (greater than)
835 >= (greater than or equal)
836 - (range including boundaries)
837 >< (except range)
838 >< and - are binary operators (they take two arguments). For in‐
840 stance, to match all prefix lengths >= 8 and <= 12, and hence the
841 CIDR netmasks 8, 9, 10, 11 and 12:
842 prefixlen 8-12
844 Or, to match all prefix lengths < 8 or > 12, and hence the CIDR
846 netmasks 0–7 and 13–32:
847 prefixlen 8><12
849 This will match all prefixes in the 10.0.0.0/8 netblock with net‐
851 masks longer than 16:
852 prefix 10.0.0.0/8 prefixlen > 16
854 or-longer is a shorthand for:
856 prefix address/len prefixlen >= len
858 maxlen mlen is a shorthand for:
860 prefix address/len prefixlen <= mlen
862 prefix-set name [or-longer]
864 This rule applies only to UPDATES that match the given prefix-set
865 name. With or-longer, the UPDATES will match any prefix in the
866 prefix-set where
867 address/len prefixlen >= len
869 quick If an UPDATE matches a rule which has the quick option set, this
871 rule is considered the last matching rule, and evaluation of sub‐
872 sequent rules is skipped.
873 rib name
875 Apply rule only to the specified RIB. This only applies for re‐
876 ceived updates, so not for rules using the to peer parameter.
877 set attribute ...
879 All matching rules can set the AS path attributes to some de‐
880 fault. The set of every matching rule is applied, not only the
881 last matching one. See also the following section.
882
884 AS path attributes can be modified with set.
885 set can be used on network statements, in neighbor or group blocks, and
887 on filter rules. Attribute sets can be expressed as lists.
888 The following attributes can be modified:
890 community [delete] as-number:local
892 community [delete] name
893 Set or delete the COMMUNITIES AS path attribute. Communities are
894 specified as as-number:local, where as-number is an AS number and
895 local is a locally significant number between zero and 65535.
896 Alternately, well-known communities may be specified by name:
897 GRACEFUL_SHUTDOWN, NO_EXPORT, NO_ADVERTISE, NO_EXPORT_SUBCONFED,
898 or NO_PEER. For delete, both as-number and local may be set to
899 ‘*’ to do wildcard matching.
900 large-community [delete] as-number:local:local
902 large-community [delete] name
903 Set or delete the Large Communities path attribute. Communities
904 are specified as as-number:local:local, where as-number is an AS
905 number and local is a locally significant number between zero and
906 4294967295. For delete, both as-number and local may be set to
907 ‘*’ to do wildcard matching.
908 ext-community [delete] subtype as-number:local
910 ext-community [delete] subtype IP:local
911 ext-community [delete] subtype numvalue
912 ext-community [delete] ovs (valid | not-found | invalid)
913 Set or delete the Extended Community AS path attribute. Extended
914 Communities are specified by a subtype and normally two values, a
915 globally unique part (e.g. the AS number) and a local part. The
916 type is selected depending on the encoding of the global part.
917 Two-octet AS Specific Extended Communities and Four-octet AS Spe‐
918 cific Extended Communities are encoded as as-number:local. Four-
919 octet encoding is used if the as-number is bigger than 65535 or
920 if the AS_DOT encoding is used. IPv4 Address Specific Extended
921 Communities are encoded as IP:local. Opaque Extended Communities
922 are encoded with a single numeric value. The ovs subtype can
923 only be set to valid, not-found, or invalid. Currently the fol‐
924 lowing subtypes are supported:
925 bdc BGP Data Collection
927 defgw Default Gateway
928 esi-lab ESI Label
929 esi-rt ES-Import Route Target
930 l2vid L2VPN Identifier
931 mac-mob MAC Mobility
932 odi OSPF Domain Identifier
933 ort OSPF Route Type
934 ori OSPF Router ID
935 ovs BGP Origin Validation State
936 rt Route Target
937 soo Route Origin / Source of Origin
938 srcas Source AS
939 vrfri VRF Route Import
940 Not all type and subtype value pairs are allowed by IANA and the
942 parser will ensure that no invalid combination is created.
943 For delete, subtype, numvalue, or local, may be set to ‘*’ to do
945 wildcard matching. If wildcard matching is used on the subtype
946 then numvalue also needs to be set to ‘*’.
947 localpref number
949 Set the LOCAL_PREF AS path attribute. If number starts with a
950 plus or minus sign, LOCAL_PREF will be adjusted by adding or sub‐
951 tracting number; otherwise it will be set to number. The default
952 is 100.
953 med number
955 metric number
956 Set the MULTI_EXIT_DISC AS path attribute. If number starts with
957 a plus or minus sign, MULTI_EXIT_DISC will be adjusted by adding
958 or subtracting number; otherwise it will be set to number.
959 origin (igp|egp|incomplete)
961 Set the ORIGIN AS path attribute to mark the source of this route
962 as being injected from an igp protocol, an egp protocol or being
963 an aggregated route.
964 nexthop (address|blackhole|reject|self|no-modify)
966 Set the NEXTHOP AS path attribute to a different nexthop address
967 or use blackhole or reject routes. blackhole and reject only af‐
968 fect the FIB and will not alter the nexthop address. self forces
969 the nexthop to be set to the local interface address. If set to
970 no-modify, the nexthop attribute is not modified for EBGP multi‐
971 hop sessions. By default EBGP multihop sessions use the local
972 interface address. On other IBGP and directly connected EBGP
973 sessions no-modify is ignored. The set address is used on IBGP
974 session and on directly connected EBGP session if the address is
975 part of the connected network. On EBGP multihop session
976 no-modify has to be set to force the nexthop to address.
977 set nexthop 192.168.0.1
979 set nexthop blackhole
980 set nexthop reject
981 set nexthop no-modify
982 set nexthop self
983 pftable table
985 Add the prefix in the update to the specified pf(4) table, re‐
986 gardless of whether or not the path was selected for routing.
987 This option may be useful in building realtime blacklists.
988 prepend-neighbor number
990 Prepend the neighbor's AS number times to the AS path.
991 prepend-self number
993 Prepend the local AS number times to the AS path.
994 rtlabel label
996 Add the prefix to the kernel routing table with the specified
997 label.
998 weight number
1000 The weight is used to tip prefixes with equally long AS paths in
1001 one or the other direction. A prefix is weighed at a very late
1002 stage in the decision process. If number starts with a plus or
1003 minus sign, the weight will be adjusted by adding or subtracting
1004 number; otherwise it will be set to number. Weight is a local
1005 non-transitive attribute, and is a bgpd(8)-specific extension.
1006 For prefixes with equally long paths, the prefix with the larger
1007 weight is selected.
1008
1010 /etc/bgpd.conf bgpd(8) configuration file.
1011
1013 strftime(3), ipsec(4), pf(4), rdomain(4), tcp(4), bgpctl(8), bgpd(8),
1014 ipsecctl(8), isakmpd(8), rc.conf.local(8)
1015
1017 The bgpd.conf file format first appeared in OpenBSD 3.5.
1018BSD March 2, 2021 BSD