1BGPD.CONF(5) BSD File Formats Manual BGPD.CONF(5)
2
4 bgpd.conf — Border Gateway Protocol daemon configuration file
5
7 The bgpd(8) daemon implements the Border Gateway Protocol version 4 as
8 described in RFC 4271.
9 The bgpd.conf config file is divided into the following main sections:
11 MACROS
13 User-defined variables may be defined and used later, simplifying
14 the configuration file.
15 GLOBAL CONFIGURATION
17 Global settings for bgpd(8).
18 SET CONFIGURATION
20 Various lookup tables are defined in this section.
21 NETWORK ANNOUNCEMENTS
23 Networks which should be announced by bgpd(8) are set in this sec‐
24 tion.
25 MPLS VPN CONFIGURATION
27 The definition and properties for BGP MPLS VPNs are set in this
28 section.
29 NEIGHBORS AND GROUPS
31 bgpd(8) establishes sessions with neighbors. The neighbor defini‐
32 tion and properties are set in this section, as well as grouping
33 neighbors for the ease of configuration.
34 FILTER
36 Filter rules for incoming and outgoing UPDATES.
37 With the exception of macros, the sections should be grouped and appear
39 in bgpd.conf in the order shown above.
40 The current line can be extended over multiple lines using a backslash
42 (‘\’). Comments can be put anywhere in the file using a hash mark (‘#’),
43 and extend to the end of the current line. Care should be taken when
44 commenting out multi-line text: the comment is effective until the end of
45 the entire block.
46 Argument names not beginning with a letter, digit, or underscore must be
48 quoted.
49 Additional configuration files can be included with the include keyword,
51 for example:
52 include "/etc/bgpd/bgpd-10.0.0.1.filter"
54
56 Macros can be defined that will later be expanded in context. Macro
57 names must start with a letter, digit, or underscore, and may contain any
58 of those characters. Macro names may not be reserved words (for example,
59 AS, neighbor, or group). Macros are not expanded inside quotes.
60 For example:
62 peer1="1.2.3.4"
64 neighbor $peer1 {
65 remote-as 65001
66 }
67
69 These settings affect the operation of the bgpd(8) daemon as a whole.
70 AS as-number [as-number]
72 Set the local autonomous system number to as-number. A fallback
73 2-byte AS number may follow a 4-byte AS number for neighbors that
74 do not support 4-byte AS numbers. The standard and default fall‐
75 back AS number is 23456.
76 The AS numbers are assigned by local RIRs, such as:
78 AfriNIC for Africa
80 APNIC for Asia Pacific
81 ARIN for North America and parts of the Caribbean
82 LACNIC for Latin America and the Caribbean
83 RIPE NCC for Europe, the Middle East, and parts of Asia
84 The AS numbers 64512 – 65534 are designated for private use. The
86 AS number 23456 is reserved and should not be used. 4-byte AS
87 numbers may be specified in either the ASPLAIN format:
88 AS 196618
90 or in the older ASDOT format:
92 AS 3.10
94 connect-retry seconds
96 Set the number of seconds to wait before attempting to re-open a
97 connection. This timer should be sufficiently large in EBGP con‐
98 figurations. The default is 120 seconds.
99 dump [rib name] (table-v2|table-mp|table) file [interval]
101 dump (all|updates) (in|out) file [interval]
102 Dump the RIB, a.k.a. the routing information base, or dump ongo‐
103 ing BGP activity, in Multi-threaded Routing Toolkit (MRT) format.
104 The file is subject to strftime(3)-expansion.
105 The table-v2 and table-mp RIB formats store multi-protocol RIBs
107 correctly, but the table format does not. The latter two are
108 provided only to support third-party tools lacking support for
109 the recommended table-v2 format. Dump an alternative RIB by
110 specifying name. Specify an interval in seconds for periodic RIB
111 dumps.
112 The following will dump the entire RIB table, at startup and ev‐
114 ery 5 minutes thereafter, to a new file:
115 dump table-v2 "/tmp/rib-dump-%H%M" 300
117 Dumps of ongoing BGP activity include all BGP state transitions,
119 and all BGP messages in the specified direction. Use updates to
120 dump only BGP UPDATE messages, without state transitions. Spec‐
121 ify an interval in seconds to restart periodically with a new
122 file:
123 dump all in "/tmp/all-in-%H%M" 300
125 fib-priority prio
127 Set the routing priority to prio. The default is 48.
128 fib-update (yes|no)
130 If set to no, do not update the Forwarding Information Base,
131 a.k.a. the kernel routing table. The default is yes.
132 holdtime seconds
134 Set the announced holdtime in seconds. This is exchanged with a
135 neighbor upon connection establishment, in the OPEN message, and
136 the shortest holdtime governs the session.
137 The neighbor session is dropped if the session holdtime passes
139 without receipt of a KEEPALIVE or an UPDATE message from the
140 neighbor. The default is 90 seconds.
141 holdtime min seconds
143 The minimum acceptable holdtime in seconds. This value must be
144 at least 3.
145 listen on address [port port]
147 Specify the local IP address and optional port for bgpd(8) to
148 listen on. The default is to listen on all local addresses on
149 the current default routing domain.
150 log updates
152 Log sent and received BGP update messages.
153 nexthop qualify via (bgp|default)
155 If set to bgp, bgpd(8) may verify nexthops using BGP routes. If
156 set to default, bgpd(8) may verify nexthops using the default
157 route. By default bgpd(8) uses only static routes or routes
158 added by other routing daemons, such as ospfd(8).
159 rde evaluate (default|all)
161 If set to all, keep evaluating alternative paths in case the se‐
162 lected path is filtered out. By default if a path is filtered by
163 the output filters then no alternative path is sent to this peer.
164 rde med compare (always|strict)
166 If set to always, the MULTI_EXIT_DISC attributes will always be
167 compared. The default is strict, where the metric is only com‐
168 pared between peers belonging to the same AS.
169 rde rib name [no evaluate]
171 rde rib name [rtable number]
172 Create an additional RIB named name. The degree to which its
173 routes may be utilized is configurable. They may be excluded
174 from the decision process that selects usable routes with the no
175 evaluate flag, and this precludes their export to any kernel
176 routing table. By default its routes will be evaluated, but not
177 exported to the kernel. They may be both evaluated and exported
178 if associated with a given rtable number, which must belong to
179 the routing domain that bgpd(8) was started in. This table will
180 not be consulted during nexthop verification unless it is the one
181 that bgpd(8) was started in. It is unnecessary to create
182 Adj-RIB-In and Loc-RIB, which are created automatically and used
183 by default.
184 rde route-age (ignore|evaluate)
186 If set to evaluate, the route decision process will also consider
187 the age of the route in addition to its path attributes, giving
188 preference to the older, typically more stable, route. This ren‐
189 ders the decision process nondeterministic. The default is
190 ignore.
191 reject as-set (yes|no)
193 If set to yes, AS paths attributes containing AS_SET path seg‐
194 ments will be rejected and all prefixes will be treated as with‐
195 draws. The default is no.
196 router-id dotted-quad
198 Set the BGP router ID, which must be non-zero and should be
199 unique within the AS. By default, the router ID is the highest
200 IPv4 address assigned to the local machine.
201 router-id 10.0.0.1
203 rtable number
205 Work with the given kernel routing table instead of the default
206 table, which is the one bgpd(8) was started in. For nexthop ver‐
207 ification, bgpd(8) will always consult the default table. This
208 is the same as using the following syntax:
209 rde rib Loc-RIB rtable number
211 socket "path" [restricted]
213 Create a control socket at path. If restricted is specified, a
214 restricted control socket will be created. By default
215 /run/bgpd/bgpd.sock.<rdomain> is used where <rdomain> is the
216 routing domain in which bgpd(8) has been started. By default, no
217 restricted socket is created.
218 transparent-as (yes|no)
220 If set to yes, AS paths to EBGP neighbors are not prepended with
221 the local AS. The default is no.
222
224 bgpd(8) supports the efficient lookup of data within named sets. An
225 as-set, a prefix-set, and an origin-set store AS numbers, prefixes, and
226 prefixes/source-as pairs, respectively. Such sets may be referenced by
227 filter rules; see the FILTER section for details. It is more efficient
228 to evaluate a set than a long series of rules for filtering each of its
229 members.
230 One single roa-set may be defined, against which bgpd(8) will validate
232 the origin of each prefix. The roa-set is merged with the tables re‐
233 ceived via rtr sessions.
234 A set definition can span multiple lines, and an optional comma is al‐
236 lowed between elements.
237 as-set name { as-number ... }
239 An as-set stores AS numbers, and can be used with the AS specific
240 parameter in FILTER rules.
241 origin-set name { address/len maxlen mlen source-as asn ... }
243 An origin-set stores prefix/source-as pairs, and can be used to
244 filter on the combination by using the origin-set parameter in
245 FILTER rules.
246 origin-set private { 10.0.0.0/8 maxlen 24 source-as 64511
248 203.0.113.0/24 source-as 64496 }
249 prefix-set name { address/len ... }
251 A prefix-set stores network prefixes and can be used in place of
252 the prefix parameter in FILTER rules, and in network statements.
253 A prefix can be followed by the prefixlen operators listed for
254 the prefix parameter in the PARAMETERS section.
255 The first example below creates a set of prefixes called
257 “private”, to hold a number of RFC 1918 private network blocks.
258 The second example shows the use of prefixlen operators.
259 prefix-set private { 10.0.0.0/8, 172.16.0.0/12,
261 192.168.0.0/16, fc00::/7 }
262 prefix-set as64496set { 192.0.2.0/24 prefixlen >= 26,
263 2001:db8::/32 or-longer }
264 roa-set { address/len [maxlen mlen] source-as asn [expires seconds] ... }
266 The roa-set holds a collection of Validated ROA Payloads (VRPs).
267 Each received prefix is checked against the roa-set, and the Ori‐
268 gin Validation State (OVS) is set. expires can be set to the
269 seconds since Epoch until when this VRP is valid.
270 roa-set { 192.0.2.0/23 maxlen 24 source-as 64511
272 203.0.113.0/24 source-as 64496 }
273 rtr address { ... }
275 The rtr block specifies a RPKI to Router (RTR) session. RTR ses‐
276 sions provide another means to load VRP sets into bgpd(8).
277 Changes propagated via the RTR protocol do not need a config
278 reload and are immediately applied. The union of all VRP sets
279 received via rtr sessions and the entries in the roa-set is used
280 to validate the origin of routes. The rtr session properties are
281 as follows:
282 descr description
284 Add a description. The description is used in logging
285 and status reports, but has no further meaning for
286 bgpd(8).
287 local-address address
289 Bind to the specific IP address before opening the TCP
290 connection to the rtr server.
291 port number
293 Specify the TCP destination port for the rtr session. If
294 not specified, the default port is 323.
295
297 network statements specify the networks that bgpd(8) will announce as its
298 own. An announcement must also be permitted by the FILTER rules. By de‐
299 fault bgpd(8) announces no networks.
300 network address/prefix [set ...]
302 Announce the specified prefix as belonging to our AS.
303 network (inet|inet6) connected [set ...]
305 Announce routes to directly attached networks.
306 network prefix-set name [set ...]
308 Announce all networks in the prefix-set name.
309 network (inet|inet6) priority number [set ...]
311 Announce routes having the specified priority.
312 network (inet|inet6) rtlabel label [set ...]
314 Announce routes having the specified label.
315 network (inet|inet6) static [set ...]
317 Announce all static routes.
318 Each network statement may set default AS path attributes:
320 network 192.168.7.0/24 set localpref 220
322 See also the ATTRIBUTE SET section.
324
326 A vpn section configures a router to participate in an MPLS Virtual Pri‐
327 vate Network. It specifies an mpe(4) interface to use, a description,
328 and various properties of the VPN:
329 vpn "description" on mpe1 {
331 rd 65002:1
332 import-target rt 65002:42
333 export-target rt 65002:42
334 network 192.168.1/24
335 }
336 bgpd(8) will not exchange VPN routes with a neighbor by default, see the
338 NEIGHBORS AND GROUPS section. The description is used when logging but
339 has no further meaning to bgpd(8).
340 The mpe(4) interface will be used as the outgoing interface for routes to
342 the VPN, and local networks will be announced with the MPLS label speci‐
343 fied on the interface. The interface can provide VPN connectivity for
344 another rdomain by being configured in that rdomain. The required rdo‐
345 main must be configured on the interface before bgpd(8) uses it. Multi‐
346 ple VPNs may be connected to a single rdomain, including the rdomain that
347 bgpd(8) is running in.
348 An example hostname.if(5) configuration for an mpe(4) interface providing
350 connectivity to rdomain 1:
351 rdomain 1
353 mplslabel 2000
354 inet 192.198.0.1 255.255.255.255
355 up
356 The VPN properties are as follows:
358 export-target subtype as-number:local
360 export-target subtype IP:local
361 Classify announced networks by tagging them with an extended
362 community of the given arguments. The community subtype should
363 be a route target, rt, to ensure interoperability. The arguments
364 are further detailed in the ATTRIBUTE SET section. More than one
365 export-target can be specified.
366 fib-update (yes|no)
368 If set to no, do not update the Forwarding Information Base,
369 a.k.a. the kernel routing table. The default is yes.
370 import-target subtype as-number:local
372 import-target subtype IP:local
373 The rdomain imports only those prefixes tagged with an extended
374 community matching an import-target. The community subtype
375 should be a route target, rt, to ensure interoperability. The
376 arguments are further detailed in the ATTRIBUTE SET section.
377 More than one import-target can be specified.
378 network arguments ...
380 Announce the given networks within this VPN; see the NETWORK
381 ANNOUNCEMENTS section.
382 rd as-number:local
384 rd IP:local
385 The Route Distinguisher rd supplies BGP with namespaces to disam‐
386 biguate VPN prefixes, as these needn't be globally unique. Un‐
387 like route targets, the rd neither identifies the origin of the
388 prefix nor controls into which VPNs the prefix is distributed.
389 The as-number or IP of a rd should be set to a number or IP that
390 was assigned by an appropriate authority, whereas local can be
391 chosen by the local operator.
392
394 bgpd(8) establishes TCP connections to other BGP speakers called
395 neighbors. A neighbor and its properties are specified by a neighbor
396 section:
397 neighbor 10.0.0.2 {
399 remote-as 65002
400 descr "a neighbor"
401 }
402 Neighbors placed within a group section inherit the properties common to
404 that group:
405 group "peering AS65002" {
407 remote-as 65002
408 neighbor 10.0.0.2 {
409 descr "AS65002-p1"
410 }
411 neighbor 10.0.0.3 {
412 descr "AS65002-p2"
413 }
414 }
415 An entire network of neighbors may be accommodated by specifying an ad‐
417 dress/netmask pair:
418 neighbor 10.0.0.0/8
420 This is a template that recognises as a neighbor any connection from
422 within the given network. Such neighbors inherit their template's prop‐
423 erties, except for their IP address. A template may omit remote-as;
424 bgpd(8) then accepts any AS presented by the neighbor in the OPEN mes‐
425 sage.
426 The neighbor properties are as follows:
428 announce (IPv4|IPv6) (none|unicast|vpn)
430 For the given address family, control which subsequent address
431 families are announced during the capabilities negotiation. Only
432 routes for that address family and subsequent address families
433 will be announced and processed.
434 At the moment, only none, which disables the announcement of that
436 address family, unicast, and vpn, which allows the distribution
437 of BGP MPLS VPNs, are supported.
438 The default is unicast for the same address family of the ses‐
440 sion.
441 announce add-path recv (yes|no)
443 If set to yes, the receive add-path capability is announced,
444 which allows reception of multiple paths per prefix. The default
445 is no.
446 announce add-path send (no|all)
448 announce add-path send (best|ecmp |as-wide-best) [plus num] [max num]
449 If set to all, best, ecmp, or as-wide-best, the send add-path ca‐
450 pability is announced, which allows sending multiple paths per
451 prefix. The paths sent depend on which mode is selected:
452 no do not advertise add-path send capability
454 all send all valid paths
455 best send the best path
456 ecmp send paths with equal nexthop cost
457 as-wide-best send paths where the first 8 checks of the decision
458 process match
459 plus allows the inclusion of additional backup paths and works
461 for best, ecmp, and as-wide-best. max can be used to limit the
462 total amount of paths sent for ecmp and as-wide-best. Right now
463 ecmp and as-wide-best are equivalent. The default is no. If
464 add-path send is active then the setting of rde evaluate is ig‐
465 nored.
466 announce as-4byte (yes|no)
468 If set to no, the 4-byte AS capability is not announced and so
469 native 4-byte AS support is disabled. The default is yes.
470 announce capabilities (yes|no)
472 If set to no, capability negotiation is disabled during the es‐
473 tablishment of the session. This can be helpful to connect to
474 old or broken BGP implementations. The default is yes.
475 announce enhanced refresh (yes|no)
477 If set to yes, the enhanced route refresh capability is an‐
478 nounced. The default is no.
479 announce policy (no|role) [enforce]
481 If set to no, do not add the open policy role capability. The
482 role can be one of provider, customer, rs, rs-client, or peer.
483 If the role of the neighbor does not correspond to the expected
484 role then the session will be closed. If enforce is set the ses‐
485 sion will only establish if the neighbor also announces the open
486 policy capability. The default is no.
487 announce refresh (yes|no)
489 If set to no, the route refresh capability is not announced. The
490 default is yes.
491 announce restart (yes|no)
493 If set to no, the graceful restart capability is not announced.
494 Currently only the End-of-RIB marker is supported and announced
495 by the restart capability. The default is yes.
496 as-override (yes|no)
498 If set to yes, all occurrences of the neighbor AS in the AS path
499 will be replaced with the local AS before running the filters.
500 The Adj-RIB-In still holds the unmodified AS path. The default
501 value is no.
502 demote group
504 Increase the carp(4) demotion counter on the given interface
505 group, usually carp, when the session is not in state
506 ESTABLISHED. The demotion counter will be increased as soon as
507 bgpd(8) starts and decreased 60 seconds after the session went to
508 state ESTABLISHED. For neighbors added at runtime, the demotion
509 counter is only increased after the session has been ESTABLISHED
510 at least once before dropping.
511 For more information on interface groups, see the group keyword
513 in ifconfig(8).
514 depend on interface
516 The neighbor session will be kept in state IDLE as long as
517 interface reports no link. For carp(4) interfaces, no link means
518 that the interface is currently backup. This is primarily in‐
519 tended to be used with carp(4) to reduce failover times.
520 The state of the network interfaces on the system can be viewed
522 using the show interfaces command to bgpctl(8).
523 descr description
525 Add a description. The description is used when logging neighbor
526 events, in status reports, for specifying neighbors, etc., but
527 has no further meaning to bgpd(8).
528 down [reason]
530 Do not start the session when bgpd(8) comes up but stay in IDLE.
531 If the session is cleared at runtime, after a down reason was
532 configured at runtime, the reason is sent as Administrative Shut‐
533 down Communication. The reason cannot exceed 255 octets.
534 dump (all|updates) (in|out) file [interval]
536 Dump ongoing BGP activity for a particular neighbor. See also
537 the dump setting in GLOBAL CONFIGURATION.
538 enforce local-as (yes|no)
540 If set to no, AS paths will not be checked for AS loop detection.
541 This feature is similar to allowas-in in some other BGP implemen‐
542 tations. Since there is no AS path loop check, this feature is
543 dangerous, and requires you to add filters to prevent receiving
544 your own prefixes. The default value is yes.
545 enforce neighbor-as (yes|no)
547 If set to yes, AS paths whose leftmost AS is not equal to the
548 remote AS of the neighbor are rejected and a NOTIFICATION is sent
549 back. The default value for IBGP peers is no otherwise the de‐
550 fault is yes.
551 export (none|default-route)
553 If set to none, no UPDATE messages will be sent to the neighbor.
554 If set to default-route, only the default route will be announced
555 to the neighbor.
556 holdtime seconds
558 Set the holdtime in seconds. Inherited from the global configu‐
559 ration if not given.
560 holdtime min seconds
562 Set the minimal acceptable holdtime. Inherited from the global
563 configuration if not given.
564 ipsec (ah|esp) (in|out) spi spi-number authspec [encspec]
566 Enable IPsec with static keying. There must be at least two
567 ipsec statements per peer with manual keying, one per direction.
568 authspec specifies the authentication algorithm and key. It can
569 be
570 sha1 <key>
572 md5 <key>
573 encspec specifies the encryption algorithm and key. ah does not
575 support encryption. With esp, encryption is optional. encspec
576 can be
577 3des <key>
579 3des-cbc <key>
580 aes <key>
581 aes-128-cbc <key>
582 Keys must be given in hexadecimal format. After changing set‐
584 tings, a session needs to be reset to use the new keys. The
585 ipsec flows only work with session using the default port 179.
586 ipsec (ah|esp) ike
588 Enable IPsec with dynamic keying. In this mode, bgpd(8) sets up
589 the flows, and a key management daemon such as isakmpd(8) is re‐
590 sponsible for managing the session keys. With isakmpd(8), it is
591 sufficient to copy the peer's public key, found in
592 /etc/isakmpd/local.pub, to the local machine. It must be stored
593 in a file named after the peer's IP address and must be stored in
594 /etc/isakmpd/pubkeys/ipv4/. The local public key must be copied
595 to the peer in the same way. As bgpd(8) manages the flows on its
596 own, it is sufficient to restrict isakmpd(8) to only take care of
597 keying by specifying the flags -Ka. This can be done in
598 rc.conf.local(8). After starting the isakmpd(8) and bgpd(8) dae‐
599 mons on both sides, the session should be established. After
600 changing settings, a session needs to be reset to use the new
601 keys. The ipsec flows only work with session using the default
602 port 179.
603 local-address address
605 no local-address
606 When bgpd(8) initiates the TCP connection to the neighbor system,
607 it normally does not bind to a specific IP address. If a
608 local-address is given, bgpd(8) binds to this address first. no
609 local-address reverts back to the default.
610 local-as as-number [as-number]
612 Set the AS number sent to the remote system. Used as described
613 above under GLOBAL CONFIGURATION option AS.
614 Since there is no AS path loop check, this option is dangerous,
616 and requires you to add filters to prevent receiving your ASNs.
617 Intended to be used temporarily, for migrations to another AS.
618 log no Disable neighbor specific logging.
620 log updates
622 Log received and sent updates for this neighbor.
623 max-prefix number [restart number]
625 Terminate the session when the maximum number of prefixes re‐
626 ceived is exceeded (no such limit is imposed by default). If
627 restart is specified, the session will be restarted after number
628 minutes.
629 max-prefix number out [restart number]
631 Terminate the session when the maximum number of prefixes sent is
632 exceeded (no such limit is imposed by default). If restart is
633 specified, the session will be restarted after number minutes.
634 multihop hops
636 Neighbors not in the same AS as the local bgpd(8) normally have
637 to be directly connected to the local machine. If this is not
638 the case, the multihop statement defines the maximum hops the
639 neighbor may be away.
640 passive
642 Do not attempt to actively open a TCP connection to the neighbor
643 system.
644 port port
646 Connect to the peer using port instead of the default BGP port
647 179.
648 reject as-set (yes|no)
650 If set to yes, AS paths attributes containing AS_SET path seg‐
651 ments will be rejected and all prefixes will be treated as with‐
652 draws. The default is inherited from the global reject as-set
653 setting.
654 remote-as as-number
656 Set the AS number of the remote system.
657 rde evaluate (default|all)
659 If set to all, keep evaluating alternative paths in case the se‐
660 lected path is filtered out. By default if a path is filtered by
661 the output filters then no alternative path is sent to this peer.
662 The default is inherited from the global rde evaluate setting.
663 rib name
665 Bind the neighbor to the specified RIB.
666 route-reflector [address]
668 Act as an RFC 4456 route-reflector for this neighbor. An op‐
669 tional cluster ID can be specified; otherwise the BGP ID will be
670 used.
671 set attribute ...
673 Set the AS path attributes to some default per neighbor or group
674 block:
675 set localpref 300
677 See also the ATTRIBUTE SET section. Set parameters are applied
679 to the received prefixes; the only exceptions are prepend-self,
680 nexthop no-modify and nexthop self. These sets are rewritten
681 into filter rules and can be viewed with “bgpd -nv”.
682 tcp md5sig password secret
684 tcp md5sig key secret
685 Enable TCP MD5 signatures per RFC 2385. The shared secret can
686 either be given as a password or hexadecimal key.
687 tcp md5sig password mekmitasdigoat
689 tcp md5sig key deadbeef
690 After changing keys, a session needs to be reset to use the new
691 keys.
692 transparent-as (yes|no)
694 If set to yes, AS paths to EBGP neighbors are not prepended with
695 the local AS. The default is inherited from the global
696 transparent-as setting.
697 ttl-security (yes|no)
699 Enable or disable ttl-security. When enabled, outgoing packets
700 are sent using a TTL of 255 and a check is made against an incom‐
701 ing packet's TTL. For directly connected peers, incoming packets
702 are required to have a TTL of 255, ensuring they have not been
703 routed. For multihop peers, incoming packets are required to
704 have a TTL of 256 minus multihop distance, ensuring they have not
705 passed through more than the expected number of hops. The de‐
706 fault is no.
707
709 bgpd(8) filters all BGP UPDATE messages, including its own announcements,
710 and blocks them by default. Filter rules may match on neighbor, direc‐
711 tion, prefix or AS path attributes. Filter rules may also modify AS path
712 attributes.
713 For each UPDATE processed by the filter, the filter rules are evaluated
715 in sequential order, from first to last. The last matching allow or deny
716 rule decides what action is taken. The default action is to deny.
717 The following actions can be used in the filter:
719 allow The UPDATE is passed.
721 deny The UPDATE is blocked.
723 match Apply the filter attribute set without influencing the filter
725 decision.
726
728 The rule parameters specify the UPDATES to which a rule applies. An
729 UPDATE always comes from, or goes to, one neighbor. Most parameters are
730 optional, but each can appear at most once per rule. If a parameter is
731 specified, the rule only applies to packets with matching attributes.
732 as-type [operator] as-number
734 as-type as-set name
735 This rule applies only to UPDATES where the AS path matches. The
736 part of the AS path specified by the as-type is matched against
737 the as-number or the as-set name:
738 AS (any part)
740 peer-as (leftmost AS number)
741 source-as (rightmost AS number)
742 transit-as (all but the rightmost AS number)
743 as-number is an AS number as explained above under GLOBAL
745 CONFIGURATION. It may be set to neighbor-as, which is expanded
746 to the current neighbor remote AS number, or local-as, which is
747 expanded to the locally assigned AS number.
748 When specifying an as-set name, the AS path will instead be
750 matched against all the AS numbers in the set.
751 The operator can be unspecified (this case is identical to the
753 equality operator), or one of the numerical operators
754 = (equal)
756 != (unequal)
757 - (range including boundaries)
758 >< (except range)
759 >< and - are binary operators (they take two arguments); with
761 these, as-number cannot be set to neighbor-as.
762 Multiple as-number entries for a given type or as-type as-number
764 entries may also be specified, separated by commas or whitespace,
765 if enclosed in curly brackets:
766 deny from any AS { 1, 2, 3 }
768 deny from any { AS 1, source-as 2, transit-as 3 }
769 deny from any { AS { 1, 2, 3 }, source-as 4, transit-as 5 }
770 community as-number:local
772 community name
773 This rule applies only to UPDATES where the community path attri‐
774 bute is present and matches. Communities are specified as
775 as-number:local, where as-number is an AS number and local is a
776 locally significant number between zero and 65535. Both
777 as-number and local may be set to ‘*’ to do wildcard matching.
778 Alternatively, well-known communities may be given by name in‐
779 stead and include BLACKHOLE, GRACEFUL_SHUTDOWN, NO_EXPORT,
780 NO_ADVERTISE, NO_EXPORT_SUBCONFED, and NO_PEER. Both as-number
781 and local may be set to neighbor-as, which is expanded to the
782 current neighbor remote AS number, or local-as, which is expanded
783 to the locally assigned AS number.
784 large-community as-number:local:local
786 This rule applies only to UPDATES where the Large community path
787 attribute is present and matches. Communities are specified as
788 as-number:local:local, where as-number is an AS number and local
789 is a locally significant number between zero and 4294967295.
790 Both as-number and local may be set to ‘*’ to do wildcard match‐
791 ing, neighbor-as, which is expanded to the current neighbor re‐
792 mote AS number, or local-as, which is expanded to the locally as‐
793 signed AS number.
794 ext-community subtype as-number:local
796 ext-community subtype IP:local
797 ext-community subtype numvalue
798 ext-community ovs (valid | not-found | invalid)
799 This rule applies only to UPDATES where the extended community
800 path attribute is present and matches. Extended Communities are
801 specified by a subtype and normally two values, a globally unique
802 part (e.g. the AS number) and a local part. Both as-number and
803 local may be set to neighbor-as, which is expanded to the current
804 neighbor remote AS number, or local-as, which is expanded to the
805 locally assigned AS number. Wildcard matching is supported for
806 local, numvalue and subtype. If wildcard matching is used on the
807 subtype then numvalue also needs to be set to ‘*’. See also the
808 ATTRIBUTE SET section for further information about the encoding.
809 (from|to) peer
811 This rule applies only to UPDATES coming from, or going to, this
812 particular neighbor. This parameter must be specified. peer is
813 one of the following:
814 any Any neighbor will be matched.
816 ibgp All IBGP neighbors will be matched.
817 ebgp All EBGP neighbors will be matched.
818 address Neighbors with this address will be matched.
819 group descr Neighbors in this group will be matched.
820 AS as-number
821 Neighbors with this AS will be matched.
822 Multiple peer entries may also be specified, separated by commas
824 or whitespace, if enclosed in curly brackets:
825 deny from { 128.251.16.1, 251.128.16.2, group hojo }
827 (inet|inet6)
829 Match only routes in the IPv4 or IPv6 address families, respec‐
830 tively. inet is an alias for "prefix 0.0.0.0/0 prefixlen >= 0";
831 inet6 is an alias for "prefix ::/0 prefixlen >= 0".
832 max-as-len len
834 This rule applies only to UPDATES where the AS path has more than
835 len elements.
836 max-as-seq len
838 This rule applies only to UPDATES where a single AS number is re‐
839 peated more than len times.
840 max-communities|max-large-communities|max-ext-communities num
842 This rule applies only to UPDATES where the Basic, Large, or
843 Extended Community attribute has more than num elements.
844 nexthop address
846 This rule applies only to UPDATES where the nexthop is equal to
847 address. The address can be set to neighbor in which case the
848 nexthop is compared against the address of the neighbor. Nexthop
849 filtering is not supported on locally announced networks and one
850 must take into consideration previous rules overwriting nexthops.
851 origin-set name
853 This rule applies only to UPDATES that match the given origin-set
854 name.
855 ovs (valid | not-found | invalid)
857 This rule applies only to UPDATES where the Origin Validation
858 State (OVS) matches.
859 prefix address/len
861 prefix address/len prefixlen range
862 prefix address/len or-longer
863 prefix address/len maxlen mlen
864 This rule applies only to UPDATES for the specified prefix.
865 Multiple entries may be specified, separated by commas or white‐
867 space, if enclosed in curly brackets:
868 deny from any prefix { 192.168.0.0/16, 10.0.0.0/8 or-longer }
870 Multiple lists can also be specified, which is useful for macro
872 expansion:
873 good="{ 192.168.0.0/16, 172.16.0.0/12, 10.0.0.0/8 }"
875 bad="{ 224.0.0.0/4 prefixlen >= 4, 240.0.0.0/4 prefixlen >= 4 }"
876 ugly="{ 127.0.0.1/8, 169.254.0.0/16 }"
877 deny from any prefix { $good $bad $ugly }
879 Prefix length ranges are specified by using these operators:
881 = (equal)
883 != (unequal)
884 < (less than)
885 <= (less than or equal)
886 > (greater than)
887 >= (greater than or equal)
888 - (range including boundaries)
889 >< (except range)
890 >< and - are binary operators (they take two arguments). For in‐
892 stance, to match all prefix lengths >= 8 and <= 12, and hence the
893 CIDR netmasks 8, 9, 10, 11 and 12:
894 prefixlen 8-12
896 Or, to match all prefix lengths < 8 or > 12, and hence the CIDR
898 netmasks 0–7 and 13–32:
899 prefixlen 8><12
901 This will match all prefixes in the 10.0.0.0/8 netblock with net‐
903 masks longer than 16:
904 prefix 10.0.0.0/8 prefixlen > 16
906 or-longer is a shorthand for:
908 prefix address/len prefixlen >= len
910 maxlen mlen is a shorthand for:
912 prefix address/len prefixlen <= mlen
914 prefix-set name [or-longer]
916 This rule applies only to UPDATES that match the given prefix-set
917 name. With or-longer, the UPDATES will match any prefix in the
918 prefix-set where
919 address/len prefixlen >= len
921 quick If an UPDATE matches a rule which has the quick option set, this
923 rule is considered the last matching rule, and evaluation of sub‐
924 sequent rules is skipped.
925 rib name
927 Apply rule only to the specified RIB. This only applies for re‐
928 ceived updates, so not for rules using the to peer parameter.
929 set attribute ...
931 All matching rules can set the AS path attributes to some de‐
932 fault. The set of every matching rule is applied, not only the
933 last matching one. See also the following section.
934
936 AS path attributes can be modified with set.
937 set can be used on network statements, in neighbor or group blocks, and
939 on filter rules. Attribute sets can be expressed as lists.
940 The following attributes can be modified:
942 community [delete] as-number:local
944 community [delete] name
945 Set or delete the COMMUNITIES AS path attribute. Communities are
946 specified as as-number:local, where as-number is an AS number and
947 local is a locally significant number between zero and 65535.
948 Alternately, well-known communities may be specified by name:
949 GRACEFUL_SHUTDOWN, NO_EXPORT, NO_ADVERTISE, NO_EXPORT_SUBCONFED,
950 or NO_PEER. For delete, both as-number and local may be set to
951 ‘*’ to do wildcard matching.
952 large-community [delete] as-number:local:local
954 large-community [delete] name
955 Set or delete the Large Communities path attribute. Communities
956 are specified as as-number:local:local, where as-number is an AS
957 number and local is a locally significant number between zero and
958 4294967295. For delete, both as-number and local may be set to
959 ‘*’ to do wildcard matching.
960 ext-community [delete] subtype as-number:local
962 ext-community [delete] subtype IP:local
963 ext-community [delete] subtype numvalue
964 ext-community [delete] ovs (valid | not-found | invalid)
965 Set or delete the Extended Community AS path attribute. Extended
966 Communities are specified by a subtype and normally two values, a
967 globally unique part (e.g. the AS number) and a local part. The
968 type is selected depending on the encoding of the global part.
969 Two-octet AS Specific Extended Communities and Four-octet AS Spe‐
970 cific Extended Communities are encoded as as-number:local. Four-
971 octet encoding is used if the as-number is bigger than 65535 or
972 if the AS_DOT encoding is used. IPv4 Address Specific Extended
973 Communities are encoded as IP:local. Opaque Extended Communities
974 are encoded with a single numeric value. The ovs subtype can
975 only be set to valid, not-found, or invalid. Currently the fol‐
976 lowing subtypes are supported:
977 bdc BGP Data Collection
979 defgw Default Gateway
980 esi-lab ESI Label
981 esi-rt ES-Import Route Target
982 l2vid L2VPN Identifier
983 mac-mob MAC Mobility
984 odi OSPF Domain Identifier
985 ort OSPF Route Type
986 ori OSPF Router ID
987 ovs BGP Origin Validation State
988 rt Route Target
989 soo Route Origin / Source of Origin
990 srcas Source AS
991 vrfri VRF Route Import
992 Not all type and subtype value pairs are allowed by IANA and the
994 parser will ensure that no invalid combination is created.
995 For delete, subtype, numvalue, or local, may be set to ‘*’ to do
997 wildcard matching. If wildcard matching is used on the subtype
998 then numvalue also needs to be set to ‘*’.
999 localpref number
1001 Set the LOCAL_PREF AS path attribute. If number starts with a
1002 plus or minus sign, LOCAL_PREF will be adjusted by adding or sub‐
1003 tracting number; otherwise it will be set to number. The default
1004 is 100.
1005 med number
1007 metric number
1008 Set the MULTI_EXIT_DISC AS path attribute. If number starts with
1009 a plus or minus sign, MULTI_EXIT_DISC will be adjusted by adding
1010 or subtracting number; otherwise it will be set to number.
1011 origin (igp|egp|incomplete)
1013 Set the ORIGIN AS path attribute to mark the source of this route
1014 as being injected from an igp protocol, an egp protocol or being
1015 an aggregated route.
1016 nexthop (address|blackhole|reject|self|no-modify)
1018 Set the NEXTHOP AS path attribute to a different nexthop address
1019 or use blackhole or reject routes. blackhole and reject only af‐
1020 fect the FIB and will not alter the nexthop address. self forces
1021 the nexthop to be set to the local interface address. If set to
1022 no-modify, the nexthop attribute is not modified for EBGP multi‐
1023 hop sessions. By default EBGP multihop sessions use the local
1024 interface address. On other IBGP and directly connected EBGP
1025 sessions no-modify is ignored. The set address is used on IBGP
1026 session and on directly connected EBGP session if the address is
1027 part of the connected network. On EBGP multihop session
1028 no-modify has to be set to force the nexthop to address.
1029 set nexthop 192.168.0.1
1031 set nexthop blackhole
1032 set nexthop reject
1033 set nexthop no-modify
1034 set nexthop self
1035 pftable table
1037 Add the prefix in the update to the specified pf(4) table, re‐
1038 gardless of whether or not the path was selected for routing.
1039 This option may be useful in building realtime blacklists.
1040 prepend-neighbor number
1042 Prepend the neighbor's AS number times to the AS path.
1043 prepend-self number
1045 Prepend the local AS number times to the AS path.
1046 rtlabel label
1048 Add the prefix to the kernel routing table with the specified
1049 label.
1050 weight number
1052 The weight is used to tip prefixes with equally long AS paths in
1053 one or the other direction. A prefix is weighed at a very late
1054 stage in the decision process. If number starts with a plus or
1055 minus sign, the weight will be adjusted by adding or subtracting
1056 number; otherwise it will be set to number. Weight is a local
1057 non-transitive attribute, and is a bgpd(8)-specific extension.
1058 For prefixes with equally long paths, the prefix with the larger
1059 weight is selected.
1060
1062 /etc/bgpd.conf bgpd(8) configuration file.
1063
1065 strftime(3), ipsec(4), pf(4), rdomain(4), tcp(4), bgpctl(8), bgpd(8),
1066 ipsecctl(8), isakmpd(8), rc.conf.local(8)
1067
1069 The bgpd.conf file format first appeared in OpenBSD 3.5.
1070BSD July 21, 2022 BSD