1BGPD.CONF(5) BSD File Formats Manual BGPD.CONF(5)
2
4 bgpd.conf — Border Gateway Protocol daemon configuration file
5
7 The bgpd(8) daemon implements the Border Gateway Protocol version 4 as
8 described in RFC 4271.
9 The bgpd.conf config file is divided into the following main sections:
11 MACROS
13 User-defined variables may be defined and used later, simplifying
14 the configuration file.
15 GLOBAL CONFIGURATION
17 Global settings for bgpd(8).
18 SET CONFIGURATION
20 Various lookup tables are defined in this section.
21 NETWORK ANNOUNCEMENTS
23 Networks which should be announced by bgpd(8) are set in this sec‐
24 tion.
25 MPLS VPN CONFIGURATION
27 The definition and properties for BGP MPLS VPNs are set in this
28 section.
29 NEIGHBORS AND GROUPS
31 bgpd(8) establishes sessions with neighbors. The neighbor defini‐
32 tion and properties are set in this section, as well as grouping
33 neighbors for the ease of configuration.
34 FILTER
36 Filter rules for incoming and outgoing UPDATES.
37 With the exception of macros, the sections should be grouped and appear
39 in bgpd.conf in the order shown above.
40 The current line can be extended over multiple lines using a backslash
42 (‘\’). Comments can be put anywhere in the file using a hash mark (‘#’),
43 and extend to the end of the current line. Care should be taken when
44 commenting out multi-line text: the comment is effective until the end of
45 the entire block.
46 Argument names not beginning with a letter, digit, or underscore must be
48 quoted.
49 Additional configuration files can be included with the include keyword,
51 for example:
52 include "/etc/bgpd/bgpd-10.0.0.1.filter"
54
56 Macros can be defined that will later be expanded in context. Macro
57 names must start with a letter, digit, or underscore, and may contain any
58 of those characters. Macro names may not be reserved words (for example,
59 AS, neighbor, or group). Macros are not expanded inside quotes.
60 For example:
62 peer1="1.2.3.4"
64 neighbor $peer1 {
65 remote-as 65001
66 }
67
69 These settings affect the operation of the bgpd(8) daemon as a whole.
70 AS as-number [as-number]
72 Set the local autonomous system number to as-number. A fallback
73 2-byte AS number may follow a 4-byte AS number for neighbors that
74 do not support 4-byte AS numbers. The standard and default fall‐
75 back AS number is 23456.
76 The AS numbers are assigned by local RIRs, such as:
78 AfriNIC for Africa
80 APNIC for Asia Pacific
81 ARIN for North America and parts of the Caribbean
82 LACNIC for Latin America and the Caribbean
83 RIPE NCC for Europe, the Middle East, and parts of Asia
84 The AS numbers 64512 – 65534 are designated for private use. The
86 AS number 23456 is reserved and should not be used. 4-byte AS
87 numbers may be specified in either the ASPLAIN format:
88 AS 196618
90 or in the older ASDOT format:
92 AS 3.10
94 connect-retry seconds
96 Set the number of seconds to wait before attempting to re-open a
97 connection. This timer should be sufficiently large in EBGP con‐
98 figurations. The default is 120 seconds.
99 dump [rib name] (table-v2|table-mp|table) file [interval]
101 dump (all|updates) (in|out) file [interval]
102 Dump the RIB, a.k.a. the routing information base, or dump ongo‐
103 ing BGP activity, in Multi-threaded Routing Toolkit (MRT) format.
104 The file is subject to strftime(3)-expansion.
105 The table-v2 and table-mp RIB formats store multi-protocol RIBs
107 correctly, but the table format does not. The latter two are
108 provided only to support third-party tools lacking support for
109 the recommended table-v2 format. Dump an alternative RIB by
110 specifying name. Specify an interval in seconds for periodic RIB
111 dumps.
112 The following will dump the entire RIB table, at startup and ev‐
114 ery 5 minutes thereafter, to a new file:
115 dump table-v2 "/tmp/rib-dump-%H%M" 300
117 Dumps of ongoing BGP activity include all BGP state transitions,
119 and all BGP messages in the specified direction. Use updates to
120 dump only BGP UPDATE messages, without state transitions. Spec‐
121 ify an interval in seconds to restart periodically with a new
122 file:
123 dump all in "/tmp/all-in-%H%M" 300
125 fib-priority prio
127 Set the routing priority to prio. The default is 48.
128 fib-update (yes|no)
130 If set to no, do not update the Forwarding Information Base,
131 a.k.a. the kernel routing table. The default is yes.
132 holdtime seconds
134 Set the announced holdtime in seconds. This is exchanged with a
135 neighbor upon connection establishment, in the OPEN message, and
136 the shortest holdtime governs the session.
137 The neighbor session is dropped if the session holdtime passes
139 without receipt of a KEEPALIVE or an UPDATE message from the
140 neighbor. The default is 90 seconds.
141 holdtime min seconds
143 The minimum acceptable holdtime in seconds. This value must be
144 at least 3.
145 listen on address
147 Specify the local IP address for bgpd(8) to listen on. The de‐
148 fault is to listen on all local addresses on the current default
149 routing domain.
150 log updates
152 Log sent and received BGP update messages.
153 nexthop qualify via (bgp|default)
155 If set to bgp, bgpd(8) may verify nexthops using BGP routes. If
156 set to default, bgpd(8) may verify nexthops using the default
157 route. By default bgpd(8) uses only static routes or routes
158 added by other routing daemons, such as ospfd(8).
159 rde evaluate (default|all)
161 If set to all keep evaluating alternative paths in case the se‐
162 lected path is filtered out. By default if a path is filtered by
163 the output filters then no alternative path is sent to this peer.
164 rde med compare (always|strict)
166 If set to always, the MULTI_EXIT_DISC attributes will always be
167 compared. The default is strict, where the metric is only com‐
168 pared between peers belonging to the same AS.
169 rde rib name [no evaluate]
171 rde rib name [rtable number]
172 Create an additional RIB named name. The degree to which its
173 routes may be utilized is configurable. They may be excluded
174 from the decision process that selects usable routes with the no
175 evaluate flag, and this precludes their export to any kernel
176 routing table. By default its routes will be evaluated, but not
177 exported to the kernel. They may be both evaluated and exported
178 if associated with a given rtable number, which must belong to
179 the routing domain that bgpd(8) was started in. This table will
180 not be consulted during nexthop verification unless it is the one
181 that bgpd(8) was started in. It is unnecessary to create
182 Adj-RIB-In and Loc-RIB, which are created automatically and used
183 by default.
184 rde route-age (ignore|evaluate)
186 If set to evaluate, the route decision process will also consider
187 the age of the route in addition to its path attributes, giving
188 preference to the older, typically more stable, route. This ren‐
189 ders the decision process nondeterministic. The default is
190 ignore.
191 reject as-set (yes|no)
193 If set to yes, AS paths attributes containing AS_SET path seg‐
194 ments will be rejected and all prefixes will be treated as with‐
195 draws. The default is no.
196 router-id dotted-quad
198 Set the BGP router ID, which must be non-zero and should be
199 unique within the AS. By default, the router ID is the highest
200 IPv4 address assigned to the local machine.
201 router-id 10.0.0.1
203 rtable number
205 Work with the given kernel routing table instead of the default
206 table, which is the one bgpd(8) was started in. For nexthop ver‐
207 ification, bgpd(8) will always consult the default table. This
208 is the same as using the following syntax:
209 rde rib Loc-RIB rtable number
211 socket "path" [restricted]
213 Create a control socket at path. If restricted is specified a
214 restricted control socket will be created. By default
215 /run/bgpd/bgpd.sock.<rdomain> is used where <rdomain> is the
216 routing domain in which bgpd(8) has been started. By default, no
217 restricted socket is created.
218 transparent-as (yes|no)
220 If set to yes, AS paths to EBGP neighbors are not prepended with
221 the local AS. The default is no.
222
224 bgpd(8) supports the efficient lookup of data within named sets. An
225 as-set, a prefix-set, and an origin-set store AS numbers, prefixes, and
226 prefixes/source-as pairs, respectively. Such sets may be referenced by
227 filter rules; see the FILTER section for details. It is more efficient
228 to evaluate a set than a long series of rules for filtering each of its
229 members.
230 One single roa-set may be defined, against which bgpd(8) will validate
232 the origin of each prefix.
233 A set definition can span multiple lines, and an optional comma is al‐
235 lowed between elements.
236 as-set name { as-number ... }
238 An as-set stores AS numbers, and can be used with the AS specific
239 parameter in FILTER rules.
240 origin-set name { address/len maxlen mlen source-as asn ... }
242 An origin-set stores prefix/source-as pairs, and can be used to
243 filter on the combination by using the origin-set parameter in
244 FILTER rules.
245 origin-set private { 10.0.0.0/8 maxlen 24 source-as 64511
247 203.0.113.0/24 source-as 64496 }
248 prefix-set name { address/len ... }
250 A prefix-set stores network prefixes and can be used in place of
251 the prefix parameter in FILTER rules, and in network statements.
252 A prefix can be followed by the prefixlen operators listed for
253 the prefix parameter in the PARAMETERS section.
254 The first example below creates a set of prefixes called
256 “private”, to hold a number of RFC 1918 private network blocks.
257 The second example shows the use of prefixlen operators.
258 prefix-set private { 10.0.0.0/8, 172.16.0.0/12,
260 192.168.0.0/16, fc00::/7 }
261 prefix-set as64496set { 192.0.2.0/24 prefixlen >= 26,
262 2001:db8::/32 or-longer }
263 roa-set { address/len [maxlen mlen] source-as asn [expires seconds] ... }
265 The roa-set holds a collection of Validated Route Origin
266 Authorization Payloads (VRP). Each received prefix is checked
267 against the roa-set, and the Origin Validation State (OVS) is
268 set. expires can be set to the seconds since Epoch until when
269 this VRP is valid.
270 roa-set { 192.0.2.0/23 maxlen 24 source-as 64511
272 203.0.113.0/24 source-as 64496 }
273 rtr address { ... }
275 The rtr block specifies a RPKI to Router Protocol session. The
276 rtr session properties are as follows:
277 descr description
279 Add a description. The description is used in logging
280 and status reports, but has no further meaning for
281 bgpd(8).
282 local-address address
284 Bind to the specific IP address before opening the TCP
285 connection to the rtr server.
286 port number
288 Specify the TCP destination port for the rtr session. If
289 not specified the default port is 323.
290
292 network statements specify the networks that bgpd(8) will announce as its
293 own. An announcement must also be permitted by the FILTER rules. By de‐
294 fault bgpd(8) announces no networks.
295 network address/prefix [set ...]
297 Announce the specified prefix as belonging to our AS.
298 network (inet|inet6) connected [set ...]
300 Announce routes to directly attached networks.
301 network prefix-set name [set ...]
303 Announce all networks in the prefix-set name.
304 network (inet|inet6) priority number [set ...]
306 Announce routes having the specified priority.
307 network (inet|inet6) rtlabel label [set ...]
309 Announce routes having the specified label.
310 network (inet|inet6) static [set ...]
312 Announce all static routes.
313 Each network statement may set default AS path attributes:
315 network 192.168.7.0/24 set localpref 220
317 See also the ATTRIBUTE SET section.
319
321 A vpn section configures a router to participate in an MPLS Virtual Pri‐
322 vate Network. It specifies an mpe(4) interface to use, a description,
323 and various properties of the VPN:
324 vpn "description" on mpe1 {
326 rd 65002:1
327 import-target rt 65002:42
328 export-target rt 65002:42
329 network 192.168.1/24
330 }
331 bgpd(8) will not exchange VPN routes with a neighbor by default, see the
333 NEIGHBORS AND GROUPS section. The description is used when logging but
334 has no further meaning to bgpd(8).
335 The mpe(4) interface will be used as the outgoing interface for routes to
337 the VPN, and local networks will be announced with the MPLS label speci‐
338 fied on the interface. The interface can provide VPN connectivity for
339 another rdomain by being configured in that rdomain. The required rdo‐
340 main must be configured on the interface before bgpd(8) uses it. Multi‐
341 ple VPNs may be connected to a single rdomain, including the rdomain that
342 bgpd(8) is running in.
343 An example hostname.if(5) configuration for an mpe(4) interface providing
345 connectivity to rdomain 1:
346 rdomain 1
348 mplslabel 2000
349 inet 192.198.0.1 255.255.255.255
350 up
351 The VPN properties are as follows:
353 export-target subtype as-number:local
355 export-target subtype IP:local
356 Classify announced networks by tagging them with an extended
357 community of the given arguments. The community subtype should
358 be a route target, rt, to ensure interoperability. The arguments
359 are further detailed in the ATTRIBUTE SET section. More than one
360 export-target can be specified.
361 fib-update (yes|no)
363 If set to no, do not update the Forwarding Information Base,
364 a.k.a. the kernel routing table. The default is yes.
365 import-target subtype as-number:local
367 import-target subtype IP:local
368 The rdomain imports only those prefixes tagged with an extended
369 community matching an import-target. The community subtype
370 should be a route target, rt, to ensure interoperability. The
371 arguments are further detailed in the ATTRIBUTE SET section.
372 More than one import-target can be specified.
373 network arguments ...
375 Announce the given networks within this VPN; see the NETWORK
376 ANNOUNCEMENTS section.
377 rd as-number:local
379 rd IP:local
380 The Route Distinguisher rd supplies BGP with namespaces to disam‐
381 biguate VPN prefixes, as these needn't be globally unique. Un‐
382 like route targets, the rd neither identifies the origin of the
383 prefix nor controls into which VPNs the prefix is distributed.
384 The as-number or IP of a rd should be set to a number or IP that
385 was assigned by an appropriate authority, whereas local can be
386 chosen by the local operator.
387
389 bgpd(8) establishes TCP connections to other BGP speakers called
390 neighbors. A neighbor and its properties are specified by a neighbor
391 section:
392 neighbor 10.0.0.2 {
394 remote-as 65002
395 descr "a neighbor"
396 }
397 Neighbors placed within a group section inherit the properties common to
399 that group:
400 group "peering AS65002" {
402 remote-as 65002
403 neighbor 10.0.0.2 {
404 descr "AS65002-p1"
405 }
406 neighbor 10.0.0.3 {
407 descr "AS65002-p2"
408 }
409 }
410 An entire network of neighbors may be accommodated by specifying an ad‐
412 dress/netmask pair:
413 neighbor 10.0.0.0/8
415 This is a template that recognises as a neighbor any connection from
417 within the given network. Such neighbors inherit their template's prop‐
418 erties, except for their IP address. A template may omit remote-as;
419 bgpd(8) then accepts any AS presented by the neighbor in the OPEN mes‐
420 sage.
421 The neighbor properties are as follows:
423 announce (IPv4|IPv6) (none|unicast|vpn)
425 For the given address family, control which subsequent address
426 families are announced during the capabilities negotiation. Only
427 routes for that address family and subsequent address families
428 will be announced and processed.
429 At the moment, only none, which disables the announcement of that
431 address family, unicast, and vpn, which allows the distribution
432 of BGP MPLS VPNs, are supported.
433 The default is unicast for the same address family of the ses‐
435 sion.
436 announce add-path recv (yes|no)
438 If set to yes, the receive add-path capability is announced which
439 allows reception of multiple paths per prefix. The default is
440 no.
441 announce as-4byte (yes|no)
443 If set to no, the 4-byte AS capability is not announced and so
444 native 4-byte AS support is disabled. The default is yes.
445 announce capabilities (yes|no)
447 If set to no, capability negotiation is disabled during the es‐
448 tablishment of the session. This can be helpful to connect to
449 old or broken BGP implementations. The default is yes.
450 announce enhanced refresh (yes|no)
452 If set to yes, the enhanced route refresh capability is an‐
453 nounced. The default is no.
454 announce refresh (yes|no)
456 If set to no, the route refresh capability is not announced. The
457 default is yes.
458 announce restart (yes|no)
460 If set to no, the graceful restart capability is not announced.
461 Currently only the End-of-RIB marker is supported and announced
462 by the restart capability. The default is yes.
463 as-override (yes|no)
465 If set to yes, all occurrences of the neighbor AS in the AS path
466 will be replaced with the local AS before running the filters.
467 The Adj-RIB-In still holds the unmodified AS path. The default
468 value is no.
469 demote group
471 Increase the carp(4) demotion counter on the given interface
472 group, usually carp, when the session is not in state
473 ESTABLISHED. The demotion counter will be increased as soon as
474 bgpd(8) starts and decreased 60 seconds after the session went to
475 state ESTABLISHED. For neighbors added at runtime, the demotion
476 counter is only increased after the session has been ESTABLISHED
477 at least once before dropping.
478 For more information on interface groups, see the group keyword
480 in ifconfig(8).
481 depend on interface
483 The neighbor session will be kept in state IDLE as long as
484 interface reports no link. For carp(4) interfaces, no link means
485 that the interface is currently backup. This is primarily in‐
486 tended to be used with carp(4) to reduce failover times.
487 The state of the network interfaces on the system can be viewed
489 using the show interfaces command to bgpctl(8).
490 descr description
492 Add a description. The description is used when logging neighbor
493 events, in status reports, for specifying neighbors, etc., but
494 has no further meaning to bgpd(8).
495 down [reason]
497 Do not start the session when bgpd(8) comes up but stay in IDLE.
498 If the session is cleared at runtime, after a down reason was
499 configured at runtime, the reason is sent as Administrative Shut‐
500 down Communication. The reason cannot exceed 255 octets.
501 dump (all|updates) (in|out) file [interval]
503 Dump ongoing BGP activity for a particular neighbor. See also
504 the dump setting in GLOBAL CONFIGURATION.
505 enforce local-as (yes|no)
507 If set to no, AS paths will not be checked for AS loop detection.
508 This feature is similar to allowas-in in some other BGP implemen‐
509 tations. Since there is no AS path loop check, this feature is
510 dangerous, and requires you to add filters to prevent receiving
511 your own prefixes. The default value is yes.
512 enforce neighbor-as (yes|no)
514 If set to yes, AS paths whose leftmost AS is not equal to the
515 remote AS of the neighbor are rejected and a NOTIFICATION is sent
516 back. The default value for IBGP peers is no otherwise the de‐
517 fault is yes.
518 export (none|default-route)
520 If set to none, no UPDATE messages will be sent to the neighbor.
521 If set to default-route, only the default route will be announced
522 to the neighbor.
523 holdtime seconds
525 Set the holdtime in seconds. Inherited from the global configu‐
526 ration if not given.
527 holdtime min seconds
529 Set the minimal acceptable holdtime. Inherited from the global
530 configuration if not given.
531 ipsec (ah|esp) (in|out) spi spi-number authspec [encspec]
533 Enable IPsec with static keying. There must be at least two
534 ipsec statements per peer with manual keying, one per direction.
535 authspec specifies the authentication algorithm and key. It can
536 be
537 sha1 <key>
539 md5 <key>
540 encspec specifies the encryption algorithm and key. ah does not
542 support encryption. With esp, encryption is optional. encspec
543 can be
544 3des <key>
546 3des-cbc <key>
547 aes <key>
548 aes-128-cbc <key>
549 Keys must be given in hexadecimal format. After changing set‐
551 tings a session needs to be reset to use the new keys.
552 ipsec (ah|esp) ike
554 Enable IPsec with dynamic keying. In this mode, bgpd(8) sets up
555 the flows, and a key management daemon such as isakmpd(8) is re‐
556 sponsible for managing the session keys. With isakmpd(8), it is
557 sufficient to copy the peer's public key, found in
558 /etc/isakmpd/local.pub, to the local machine. It must be stored
559 in a file named after the peer's IP address and must be stored in
560 /etc/isakmpd/pubkeys/ipv4/. The local public key must be copied
561 to the peer in the same way. As bgpd(8) manages the flows on its
562 own, it is sufficient to restrict isakmpd(8) to only take care of
563 keying by specifying the flags -Ka. This can be done in
564 rc.conf.local(8). After starting the isakmpd(8) and bgpd(8) dae‐
565 mons on both sides, the session should be established. After
566 changing settings a session needs to be reset to use the new
567 keys.
568 local-address address
570 no local-address
571 When bgpd(8) initiates the TCP connection to the neighbor system,
572 it normally does not bind to a specific IP address. If a
573 local-address is given, bgpd(8) binds to this address first. no
574 local-address reverts back to the default.
575 local-as as-number [as-number]
577 Set the AS number sent to the remote system. Used as described
578 above under GLOBAL CONFIGURATION option AS.
579 Since there is no AS path loop check, this option is dangerous,
581 and requires you to add filters to prevent receiving your ASNs.
582 Intended to be used temporarily, for migrations to another AS.
583 log no Disable neighbor specific logging.
585 log updates
587 Log received and sent updates for this neighbor.
588 max-prefix number [restart number]
590 Terminate the session when the maximum number of prefixes re‐
591 ceived is exceeded (no such limit is imposed by default). If
592 restart is specified, the session will be restarted after number
593 minutes.
594 max-prefix number out [restart number]
596 Terminate the session when the maximum number of prefixes sent is
597 exceeded (no such limit is imposed by default). If restart is
598 specified, the session will be restarted after number minutes.
599 multihop hops
601 Neighbors not in the same AS as the local bgpd(8) normally have
602 to be directly connected to the local machine. If this is not
603 the case, the multihop statement defines the maximum hops the
604 neighbor may be away.
605 passive
607 Do not attempt to actively open a TCP connection to the neighbor
608 system.
609 reject as-set (yes|no)
611 If set to yes, AS paths attributes containing AS_SET path seg‐
612 ments will be rejected and all prefixes will be treated as with‐
613 draws. The default is inherited from the global reject as-set
614 setting.
615 remote-as as-number
617 Set the AS number of the remote system.
618 rde evaluate (default|all)
620 If set to all keep evaluating alternative paths in case the se‐
621 lected path is filtered out. By default if a path is filtered by
622 the output filters then no alternative path is sent to this peer.
623 The default is inherited from the global rde evaluate setting.
624 rib name
626 Bind the neighbor to the specified RIB.
627 route-reflector [address]
629 Act as an RFC 4456 route-reflector for this neighbor. An op‐
630 tional cluster ID can be specified; otherwise the BGP ID will be
631 used.
632 set attribute ...
634 Set the AS path attributes to some default per neighbor or group
635 block:
636 set localpref 300
638 See also the ATTRIBUTE SET section. Set parameters are applied
640 to the received prefixes; the only exceptions are prepend-self,
641 nexthop no-modify and nexthop self. These sets are rewritten
642 into filter rules and can be viewed with “bgpd -nv”.
643 tcp md5sig password secret
645 tcp md5sig key secret
646 Enable TCP MD5 signatures per RFC 2385. The shared secret can
647 either be given as a password or hexadecimal key.
648 tcp md5sig password mekmitasdigoat
650 tcp md5sig key deadbeef
651 After changing keys a session needs to be reset to use the new
652 keys.
653 transparent-as (yes|no)
655 If set to yes, AS paths to EBGP neighbors are not prepended with
656 the local AS. The default is inherited from the global
657 transparent-as setting.
658 ttl-security (yes|no)
660 Enable or disable ttl-security. When enabled, outgoing packets
661 are sent using a TTL of 255 and a check is made against an incom‐
662 ing packet's TTL. For directly connected peers, incoming packets
663 are required to have a TTL of 255, ensuring they have not been
664 routed. For multihop peers, incoming packets are required to
665 have a TTL of 256 minus multihop distance, ensuring they have not
666 passed through more than the expected number of hops. The de‐
667 fault is no.
668
670 bgpd(8) filters all BGP UPDATE messages, including its own announcements,
671 and blocks them by default. Filter rules may match on neighbor, direc‐
672 tion, prefix or AS path attributes. Filter rules may also modify AS path
673 attributes.
674 For each UPDATE processed by the filter, the filter rules are evaluated
676 in sequential order, from first to last. The last matching allow or deny
677 rule decides what action is taken. The default action is to deny.
678 The following actions can be used in the filter:
680 allow The UPDATE is passed.
682 deny The UPDATE is blocked.
684 match Apply the filter attribute set without influencing the filter
686 decision.
687
689 The rule parameters specify the UPDATES to which a rule applies. An
690 UPDATE always comes from, or goes to, one neighbor. Most parameters are
691 optional, but each can appear at most once per rule. If a parameter is
692 specified, the rule only applies to packets with matching attributes.
693 as-type [operator] as-number
695 as-type as-set name
696 This rule applies only to UPDATES where the AS path matches. The
697 part of the AS path specified by the as-type is matched against
698 the as-number or the as-set name:
699 AS (any part)
701 peer-as (leftmost AS number)
702 source-as (rightmost AS number)
703 transit-as (all but the rightmost AS number)
704 as-number is an AS number as explained above under GLOBAL
706 CONFIGURATION. It may be set to neighbor-as, which is expanded
707 to the current neighbor remote AS number, or local-as, which is
708 expanded to the locally assigned AS number.
709 When specifying an as-set name the AS path will instead be
711 matched against all the AS numbers in the set.
712 The operator can be unspecified (this case is identical to the
714 equality operator), or one of the numerical operators
715 = (equal)
717 != (unequal)
718 - (range including boundaries)
719 >< (except range)
720 >< and - are binary operators (they take two arguments); with
722 these, as-number cannot be set to neighbor-as.
723 Multiple as-number entries for a given type or as-type as-number
725 entries may also be specified, separated by commas or whitespace,
726 if enclosed in curly brackets:
727 deny from any AS { 1, 2, 3 }
729 deny from any { AS 1, source-as 2, transit-as 3 }
730 deny from any { AS { 1, 2, 3 }, source-as 4, transit-as 5 }
731 community as-number:local
733 community name
734 This rule applies only to UPDATES where the community path attri‐
735 bute is present and matches. Communities are specified as
736 as-number:local, where as-number is an AS number and local is a
737 locally significant number between zero and 65535. Both
738 as-number and local may be set to ‘*’ to do wildcard matching.
739 Alternatively, well-known communities may be given by name in‐
740 stead and include BLACKHOLE, GRACEFUL_SHUTDOWN, NO_EXPORT,
741 NO_ADVERTISE, NO_EXPORT_SUBCONFED, and NO_PEER. Both as-number
742 and local may be set to neighbor-as, which is expanded to the
743 current neighbor remote AS number, or local-as, which is expanded
744 to the locally assigned AS number.
745 large-community as-number:local:local
747 This rule applies only to UPDATES where the Large community path
748 attribute is present and matches. Communities are specified as
749 as-number:local:local, where as-number is an AS number and local
750 is a locally significant number between zero and 4294967295.
751 Both as-number and local may be set to ‘*’ to do wildcard match‐
752 ing, neighbor-as, which is expanded to the current neighbor re‐
753 mote AS number, or local-as, which is expanded to the locally as‐
754 signed AS number.
755 ext-community subtype as-number:local
757 ext-community subtype IP:local
758 ext-community subtype numvalue
759 ext-community ovs (valid | not-found | invalid)
760 This rule applies only to UPDATES where the extended community
761 path attribute is present and matches. Extended Communities are
762 specified by a subtype and normally two values, a globally unique
763 part (e.g. the AS number) and a local part. Both as-number and
764 local may be set to neighbor-as, which is expanded to the current
765 neighbor remote AS number, or local-as, which is expanded to the
766 locally assigned AS number. Wildcard matching is supported for
767 local, numvalue and subtype. If wildcard matching is used on the
768 subtype then numvalue also needs to be set to ‘*’. See also the
769 ATTRIBUTE SET section for further information about the encoding.
770 (from|to) peer
772 This rule applies only to UPDATES coming from, or going to, this
773 particular neighbor. This parameter must be specified. peer is
774 one of the following:
775 any Any neighbor will be matched.
777 ibgp All IBGP neighbors will be matched.
778 ebgp All EBGP neighbors will be matched.
779 address Neighbors with this address will be matched.
780 group descr Neighbors in this group will be matched.
781 AS as-number
782 Neighbors with this AS will be matched.
783 Multiple peer entries may also be specified, separated by commas
785 or whitespace, if enclosed in curly brackets:
786 deny from { 128.251.16.1, 251.128.16.2, group hojo }
788 (inet|inet6)
790 Match only routes in the IPv4 or IPv6 address families, respec‐
791 tively. inet is an alias for "prefix 0.0.0.0/0 prefixlen >= 0";
792 inet6 is an alias for "prefix ::/0 prefixlen >= 0".
793 max-as-len len
795 This rule applies only to UPDATES where the AS path has more than
796 len elements.
797 max-as-seq len
799 This rule applies only to UPDATES where a single AS number is re‐
800 peated more than len times.
801 nexthop address
803 This rule applies only to UPDATES where the nexthop is equal to
804 address. The address can be set to neighbor in which case the
805 nexthop is compared against the address of the neighbor. Nexthop
806 filtering is not supported on locally announced networks and one
807 must take into consideration previous rules overwriting nexthops.
808 origin-set name
810 This rule applies only to UPDATES that match the given origin-set
811 name.
812 ovs (valid | not-found | invalid)
814 This rule applies only to UPDATES where the Origin Validation
815 State (OVS) matches.
816 prefix address/len
818 prefix address/len prefixlen range
819 prefix address/len or-longer
820 prefix address/len maxlen mlen
821 This rule applies only to UPDATES for the specified prefix.
822 Multiple entries may be specified, separated by commas or white‐
824 space, if enclosed in curly brackets:
825 deny from any prefix { 192.168.0.0/16, 10.0.0.0/8 or-longer }
827 Multiple lists can also be specified, which is useful for macro
829 expansion:
830 good="{ 192.168.0.0/16, 172.16.0.0/12, 10.0.0.0/8 }"
832 bad="{ 224.0.0.0/4 prefixlen >= 4, 240.0.0.0/4 prefixlen >= 4 }"
833 ugly="{ 127.0.0.1/8, 169.254.0.0/16 }"
834 deny from any prefix { $good $bad $ugly }
836 Prefix length ranges are specified by using these operators:
838 = (equal)
840 != (unequal)
841 < (less than)
842 <= (less than or equal)
843 > (greater than)
844 >= (greater than or equal)
845 - (range including boundaries)
846 >< (except range)
847 >< and - are binary operators (they take two arguments). For in‐
849 stance, to match all prefix lengths >= 8 and <= 12, and hence the
850 CIDR netmasks 8, 9, 10, 11 and 12:
851 prefixlen 8-12
853 Or, to match all prefix lengths < 8 or > 12, and hence the CIDR
855 netmasks 0–7 and 13–32:
856 prefixlen 8><12
858 This will match all prefixes in the 10.0.0.0/8 netblock with net‐
860 masks longer than 16:
861 prefix 10.0.0.0/8 prefixlen > 16
863 or-longer is a shorthand for:
865 prefix address/len prefixlen >= len
867 maxlen mlen is a shorthand for:
869 prefix address/len prefixlen <= mlen
871 prefix-set name [or-longer]
873 This rule applies only to UPDATES that match the given prefix-set
874 name. With or-longer, the UPDATES will match any prefix in the
875 prefix-set where
876 address/len prefixlen >= len
878 quick If an UPDATE matches a rule which has the quick option set, this
880 rule is considered the last matching rule, and evaluation of sub‐
881 sequent rules is skipped.
882 rib name
884 Apply rule only to the specified RIB. This only applies for re‐
885 ceived updates, so not for rules using the to peer parameter.
886 set attribute ...
888 All matching rules can set the AS path attributes to some de‐
889 fault. The set of every matching rule is applied, not only the
890 last matching one. See also the following section.
891
893 AS path attributes can be modified with set.
894 set can be used on network statements, in neighbor or group blocks, and
896 on filter rules. Attribute sets can be expressed as lists.
897 The following attributes can be modified:
899 community [delete] as-number:local
901 community [delete] name
902 Set or delete the COMMUNITIES AS path attribute. Communities are
903 specified as as-number:local, where as-number is an AS number and
904 local is a locally significant number between zero and 65535.
905 Alternately, well-known communities may be specified by name:
906 GRACEFUL_SHUTDOWN, NO_EXPORT, NO_ADVERTISE, NO_EXPORT_SUBCONFED,
907 or NO_PEER. For delete, both as-number and local may be set to
908 ‘*’ to do wildcard matching.
909 large-community [delete] as-number:local:local
911 large-community [delete] name
912 Set or delete the Large Communities path attribute. Communities
913 are specified as as-number:local:local, where as-number is an AS
914 number and local is a locally significant number between zero and
915 4294967295. For delete, both as-number and local may be set to
916 ‘*’ to do wildcard matching.
917 ext-community [delete] subtype as-number:local
919 ext-community [delete] subtype IP:local
920 ext-community [delete] subtype numvalue
921 ext-community [delete] ovs (valid | not-found | invalid)
922 Set or delete the Extended Community AS path attribute. Extended
923 Communities are specified by a subtype and normally two values, a
924 globally unique part (e.g. the AS number) and a local part. The
925 type is selected depending on the encoding of the global part.
926 Two-octet AS Specific Extended Communities and Four-octet AS Spe‐
927 cific Extended Communities are encoded as as-number:local. Four-
928 octet encoding is used if the as-number is bigger than 65535 or
929 if the AS_DOT encoding is used. IPv4 Address Specific Extended
930 Communities are encoded as IP:local. Opaque Extended Communities
931 are encoded with a single numeric value. The ovs subtype can
932 only be set to valid, not-found, or invalid. Currently the fol‐
933 lowing subtypes are supported:
934 bdc BGP Data Collection
936 defgw Default Gateway
937 esi-lab ESI Label
938 esi-rt ES-Import Route Target
939 l2vid L2VPN Identifier
940 mac-mob MAC Mobility
941 odi OSPF Domain Identifier
942 ort OSPF Route Type
943 ori OSPF Router ID
944 ovs BGP Origin Validation State
945 rt Route Target
946 soo Route Origin / Source of Origin
947 srcas Source AS
948 vrfri VRF Route Import
949 Not all type and subtype value pairs are allowed by IANA and the
951 parser will ensure that no invalid combination is created.
952 For delete, subtype, numvalue, or local, may be set to ‘*’ to do
954 wildcard matching. If wildcard matching is used on the subtype
955 then numvalue also needs to be set to ‘*’.
956 localpref number
958 Set the LOCAL_PREF AS path attribute. If number starts with a
959 plus or minus sign, LOCAL_PREF will be adjusted by adding or sub‐
960 tracting number; otherwise it will be set to number. The default
961 is 100.
962 med number
964 metric number
965 Set the MULTI_EXIT_DISC AS path attribute. If number starts with
966 a plus or minus sign, MULTI_EXIT_DISC will be adjusted by adding
967 or subtracting number; otherwise it will be set to number.
968 origin (igp|egp|incomplete)
970 Set the ORIGIN AS path attribute to mark the source of this route
971 as being injected from an igp protocol, an egp protocol or being
972 an aggregated route.
973 nexthop (address|blackhole|reject|self|no-modify)
975 Set the NEXTHOP AS path attribute to a different nexthop address
976 or use blackhole or reject routes. blackhole and reject only af‐
977 fect the FIB and will not alter the nexthop address. self forces
978 the nexthop to be set to the local interface address. If set to
979 no-modify, the nexthop attribute is not modified for EBGP multi‐
980 hop sessions. By default EBGP multihop sessions use the local
981 interface address. On other IBGP and directly connected EBGP
982 sessions no-modify is ignored. The set address is used on IBGP
983 session and on directly connected EBGP session if the address is
984 part of the connected network. On EBGP multihop session
985 no-modify has to be set to force the nexthop to address.
986 set nexthop 192.168.0.1
988 set nexthop blackhole
989 set nexthop reject
990 set nexthop no-modify
991 set nexthop self
992 pftable table
994 Add the prefix in the update to the specified pf(4) table, re‐
995 gardless of whether or not the path was selected for routing.
996 This option may be useful in building realtime blacklists.
997 prepend-neighbor number
999 Prepend the neighbor's AS number times to the AS path.
1000 prepend-self number
1002 Prepend the local AS number times to the AS path.
1003 rtlabel label
1005 Add the prefix to the kernel routing table with the specified
1006 label.
1007 weight number
1009 The weight is used to tip prefixes with equally long AS paths in
1010 one or the other direction. A prefix is weighed at a very late
1011 stage in the decision process. If number starts with a plus or
1012 minus sign, the weight will be adjusted by adding or subtracting
1013 number; otherwise it will be set to number. Weight is a local
1014 non-transitive attribute, and is a bgpd(8)-specific extension.
1015 For prefixes with equally long paths, the prefix with the larger
1016 weight is selected.
1017
1019 /etc/bgpd.conf bgpd(8) configuration file.
1020
1022 strftime(3), ipsec(4), pf(4), rdomain(4), tcp(4), bgpctl(8), bgpd(8),
1023 ipsecctl(8), isakmpd(8), rc.conf.local(8)
1024
1026 The bgpd.conf file format first appeared in OpenBSD 3.5.
1027BSD September 1, 2021 BSD