1BGPD.CONF(5) BSD File Formats Manual BGPD.CONF(5)
2
4 bgpd.conf — BGP routing daemon configuration file
5
7 The bgpd(8) daemon implements the Border Gateway Protocol version 4 as
8 described in RFC 4271.
9 The bgpd.conf config file is divided into the following main sections:
11 MACROS
13 User-defined variables may be defined and used later, simplifying
14 the configuration file.
15 GLOBAL CONFIGURATION
17 Global settings for bgpd(8).
18 SET CONFIGURATION
20 Various lookup tables are defined in this section.
21 NETWORK AND FLOWSPEC ANNOUNCEMENTS
23 Networks which should be announced by bgpd(8) are set in this sec‐
24 tion.
25 MPLS VPN CONFIGURATION
27 The definition and properties for BGP MPLS VPNs are set in this
28 section.
29 NEIGHBORS AND GROUPS
31 bgpd(8) establishes sessions with neighbors. The neighbor defini‐
32 tion and properties are set in this section, as well as grouping
33 neighbors for the ease of configuration.
34 FILTER
36 Filter rules for incoming and outgoing UPDATES.
37 With the exception of macros, the sections should be grouped and appear
39 in bgpd.conf in the order shown above.
40 The current line can be extended over multiple lines using a backslash
42 (‘\’). Comments can be put anywhere in the file using a hash mark (‘#’),
43 and extend to the end of the current line. Care should be taken when
44 commenting out multi-line text: the comment is effective until the end of
45 the entire block.
46 Argument names not beginning with a letter, digit, or underscore must be
48 quoted.
49 Additional configuration files can be included with the include keyword,
51 for example:
52 include "/etc/bgpd/bgpd-10.0.0.1.filter"
54
56 Macros can be defined that will later be expanded in context. Macro
57 names must start with a letter, digit, or underscore, and may contain any
58 of those characters. Macro names may not be reserved words (for example,
59 AS, neighbor, or group). Macros are not expanded inside quotes.
60 For example:
62 peer1="1.2.3.4"
64 neighbor $peer1 {
65 remote-as 65001
66 }
67
69 These settings affect the operation of the bgpd(8) daemon as a whole.
70 AS as-number [as-number]
72 Set the local autonomous system number to as-number. A fallback
73 2-byte AS number may follow a 4-byte AS number for neighbors that
74 do not support 4-byte AS numbers. The standard and default fall‐
75 back AS number is 23456.
76 The AS numbers are assigned by local RIRs, such as:
78 AfriNIC for Africa
80 APNIC for Asia Pacific
81 ARIN for North America and parts of the Caribbean
82 LACNIC for Latin America and the Caribbean
83 RIPE NCC for Europe, the Middle East, and parts of Asia
84 The AS numbers 64512 – 65534 are designated for private use. The
86 AS number 23456 is reserved and should not be used. 4-byte AS
87 numbers may be specified in either the ASPLAIN format:
88 AS 196618
90 or in the older ASDOT format:
92 AS 3.10
94 connect-retry seconds
96 Set the number of seconds to wait before attempting to re-open a
97 connection. This timer should be sufficiently large in EBGP con‐
98 figurations. The default is 120 seconds.
99 dump [rib name] (table-v2|table-mp|table) file [interval]
101 dump (all|updates) (in|out) file [interval]
102 Dump the RIB, a.k.a. the routing information base, or dump ongo‐
103 ing BGP activity, in Multi-threaded Routing Toolkit (MRT) format.
104 The file is subject to strftime(3)-expansion.
105 The table-v2 and table-mp RIB formats store multi-protocol RIBs
107 correctly, but the table format does not. The latter two are
108 provided only to support third-party tools lacking support for
109 the recommended table-v2 format. Dump an alternative RIB by
110 specifying name. Specify an interval in seconds for periodic RIB
111 dumps.
112 The following will dump the entire RIB table, at startup and ev‐
114 ery 5 minutes thereafter, to a new file:
115 dump table-v2 "/tmp/rib-dump-%H%M" 300
117 Dumps of ongoing BGP activity include all BGP state transitions,
119 and all BGP messages in the specified direction. Use updates to
120 dump only BGP UPDATE messages, without state transitions. Spec‐
121 ify an interval in seconds to restart periodically with a new
122 file:
123 dump all in "/tmp/all-in-%H%M" 300
125 fib-priority prio
127 Set the routing priority to prio. The default is 48.
128 fib-update (yes|no)
130 If set to no, do not update the Forwarding Information Base,
131 a.k.a. the kernel routing table. The default is yes.
132 holdtime seconds
134 Set the announced holdtime in seconds. This is exchanged with a
135 neighbor upon connection establishment, in the OPEN message, and
136 the shortest holdtime governs the session.
137 The neighbor session is dropped if the session holdtime passes
139 without receipt of a KEEPALIVE or an UPDATE message from the
140 neighbor. The default is 90 seconds.
141 holdtime min seconds
143 The minimum acceptable holdtime in seconds. This value must be
144 at least 3.
145 listen on address [port port]
147 Specify the local IP address and optional port for bgpd(8) to
148 listen on. The default is to listen on all local addresses on
149 the current default routing domain.
150 log updates
152 Log sent and received BGP update messages.
153 nexthop qualify via (bgp|default)
155 If set to bgp, bgpd(8) may verify nexthops using BGP routes. If
156 set to default, bgpd(8) may verify nexthops using the default
157 route. By default bgpd(8) uses only static routes or routes
158 added by other routing daemons, such as ospfd(8).
159 rde evaluate (default|all)
161 If set to all, keep evaluating alternative paths in case the se‐
162 lected path is filtered out. By default if a path is filtered by
163 the output filters then no alternative path is sent to this peer.
164 rde med compare (always|strict)
166 If set to always, the MULTI_EXIT_DISC attributes will always be
167 compared. The default is strict, where the metric is only com‐
168 pared between peers belonging to the same AS.
169 rde rib name [no evaluate]
171 rde rib name [rtable number]
172 Create an additional RIB named name. The degree to which its
173 routes may be utilized is configurable. They may be excluded
174 from the decision process that selects usable routes with the no
175 evaluate flag, and this precludes their export to any kernel
176 routing table. By default its routes will be evaluated, but not
177 exported to the kernel. They may be both evaluated and exported
178 if associated with a given rtable number, which must belong to
179 the routing domain that bgpd(8) was started in. This table will
180 not be consulted during nexthop verification unless it is the one
181 that bgpd(8) was started in. It is unnecessary to create
182 Adj-RIB-In and Loc-RIB, which are created automatically and used
183 by default.
184 rde route-age (ignore|evaluate)
186 If set to evaluate, the route decision process will also consider
187 the age of the route in addition to its path attributes, giving
188 preference to the older, typically more stable, route. This ren‐
189 ders the decision process nondeterministic. The default is
190 ignore.
191 reject as-set (yes|no)
193 If set to yes, AS paths attributes containing AS_SET path seg‐
194 ments will be rejected and all prefixes will be treated as with‐
195 draws. The default is no.
196 router-id dotted-quad
198 Set the BGP router ID, which must be non-zero and should be
199 unique within the AS. By default, the router ID is the highest
200 IPv4 address assigned to the local machine.
201 router-id 10.0.0.1
203 rtable number
205 Work with the given kernel routing table instead of the default
206 table, which is the one bgpd(8) was started in. For nexthop ver‐
207 ification, bgpd(8) will always consult the default table. This
208 is the same as using the following syntax:
209 rde rib Loc-RIB rtable number
211 socket "path" [restricted]
213 Create a control socket at path. If restricted is specified, a
214 restricted control socket will be created. By default
215 /run/bgpd/bgpd.sock.<rdomain> is used where <rdomain> is the
216 routing domain in which bgpd(8) has been started. By default, no
217 restricted socket is created.
218 transparent-as (yes|no)
220 If set to yes, AS paths to EBGP neighbors are not prepended with
221 the local AS. The default is no.
222
224 bgpd(8) supports the efficient lookup of data within named sets. An
225 as-set, a prefix-set, and an origin-set store AS numbers, prefixes, and
226 prefixes/source-as pairs, respectively. Such sets may be referenced by
227 filter rules; see the FILTER section for details. It is more efficient
228 to evaluate a set than a long series of rules for filtering each of its
229 members.
230 One single roa-set may be defined, against which bgpd(8) will validate
232 the origin of each prefix. The roa-set and the aspa-set are merged with
233 the corresponding tables received via rtr sessions.
234 A set definition can span multiple lines, and an optional comma is al‐
236 lowed between elements. The same set can be defined more than once, in
237 this case the definitions are merged into one common set.
238 as-set name { as-number ... }
240 An as-set stores AS numbers, and can be used with the AS specific
241 parameter in FILTER rules.
242 aspa-set { customer-as as-number [expires seconds] provider-as {
244 as-number ... } ... }
245 The aspa-set holds a collection of Validated ASPA Payloads
246 (VAPs). Each as AS_PATH received from an eBGP peer is checked
247 against the aspa-set, and the ASPA Validation State (AVS) is set.
248 expires can be set to the seconds since Epoch until when this VAP
249 is valid.
250 aspa-set {
252 customer-as 64511 provider-as { 64496 65496 }
253 customer-as 64496 provider-as { 65496 64544 }
254 }
255 origin-set name { address/len maxlen mlen source-as asn ... }
257 An origin-set stores prefix/source-as pairs, and can be used to
258 filter on the combination by using the origin-set parameter in
259 FILTER rules.
260 origin-set private { 10.0.0.0/8 maxlen 24 source-as 64511
262 203.0.113.0/24 source-as 64496 }
263 prefix-set name { address/len ... }
265 A prefix-set stores network prefixes and can be used in place of
266 the prefix parameter in FILTER rules, and in network statements.
267 A prefix can be followed by the prefixlen operators listed for
268 the prefix parameter in the PARAMETERS section.
269 The first example below creates a set of prefixes called
271 “private”, to hold a number of RFC 1918 private network blocks.
272 The second example shows the use of prefixlen operators.
273 prefix-set private { 10.0.0.0/8, 172.16.0.0/12,
275 192.168.0.0/16, fc00::/7 }
276 prefix-set as64496set { 192.0.2.0/24 prefixlen >= 26,
277 2001:db8::/32 or-longer }
278 roa-set { address/len [maxlen mlen] source-as asn [expires seconds] ... }
280 The roa-set holds a collection of Validated ROA Payloads (VRPs).
281 Each received prefix is checked against the roa-set, and the Ori‐
282 gin Validation State (OVS) is set. expires can be set to the
283 seconds since Epoch until when this VRP is valid.
284 roa-set { 192.0.2.0/23 maxlen 24 source-as 64511
286 203.0.113.0/24 source-as 64496 }
287 rtr address { ... }
289 The rtr block specifies a RPKI to Router (RTR) session. RTR ses‐
290 sions provide another means to load VRP sets into bgpd(8).
291 Changes propagated via the RTR protocol do not need a config
292 reload and are immediately applied. The union of all VRP sets
293 received via rtr sessions and the entries in the roa-set is used
294 to validate the origin of routes. The rtr session properties are
295 as follows:
296 descr description
298 Add a description. The description is used in logging
299 and status reports, but has no further meaning for
300 bgpd(8).
301 local-address address
303 Bind to the specific IP address before opening the TCP
304 connection to the rtr server.
305 port number
307 Specify the TCP destination port for the rtr session. If
308 not specified, the default port is 323.
309
311 network statements specify the networks that bgpd(8) will announce as its
312 own. An announcement must also be permitted by the FILTER rules. By de‐
313 fault bgpd(8) announces no networks.
314 network address/prefix [set ...]
316 Announce the specified prefix as belonging to our AS.
317 network (inet|inet6) connected [set ...]
319 Announce routes to directly attached networks.
320 network prefix-set name [set ...]
322 Announce all networks in the prefix-set name.
323 network (inet|inet6) priority number [set ...]
325 Announce routes having the specified priority.
326 network (inet|inet6) rtlabel label [set ...]
328 Announce routes having the specified label.
329 network (inet|inet6) static [set ...]
331 Announce all static routes.
332 Each network statement may set default AS path attributes:
334 network 192.168.7.0/24 set localpref 220
336 See also the ATTRIBUTE SET section.
338 flowspec statements specify the flowspec rules that bgpd(8) will announce
340 as its own. By default bgpd(8) announces no flowspec rules.
341 flowspec (inet|inet6) rule [set ...]
343 Announce an IPv4 or IPv6 specific flowspec rule including the AS
344 path attributes specified by set.
345 The following rule parameters can be set. Most number arguments in the
347 below rules can be specified as a list of ranges enclosed in curly brack‐
348 ets using these operators:
349 = (equal, default)
351 != (unequal)
352 < (less than)
353 <= (less than or equal)
354 > (greater than)
355 >= (greater than or equal)
356 - (range including boundaries)
357 >< (except range)
358 ‘><’, and ‘-’ are binary operators (they take two arguments).
360 from source [port list]
362 to dest [port list]
363 This rule applies only to packets with the specified source or
364 destination addresses and ports. Addresses can be specified in
365 CIDR notation (matching netblocks) or using any to match any ad‐
366 dress. In most cases a to address must be specified and be part
367 of the announced networks.
368 Ports can be specified either by number or by name. For example,
370 port 80 can be specified as www. For a list of all port name to
371 number mappings see the file /etc/services.
372 flags a/b
373 This rule only applies to TCP packets that have the flags a set
374 out of set b. Flags not specified in b are ignored. The flags
375 are: (F)IN, (S)YN, (R)ST, (P)USH, (A)CK, (U)RG, (E)CE, and C(W)R.
376 fragment a/b
377 This rule only applies to fragmented packets which match the
378 specified flags. The flags are: (D)on't fragment, (I)s fragment,
379 (F)irst fragment, and (L)ast fragment.
380 icmp-type type [code code]
381 icmp6-type type [code code]
382 This rule only applies to ICMP or ICMP6 packets with the speci‐
383 fied type and code. Text names for ICMP types and codes are
384 listed in icmp(4) and icmp6(4).
385 length pktlen
386 This rule applies only to packets matching the specified pktlen.
387 proto protocol
388 This rule applies only to packets of this protocol. Common pro‐
389 tocols are ICMP, ICMP6, TCP, and UDP. For a list of all the pro‐
390 tocol name to number mappings see the file /etc/protocols.
391 tos string|number
392 This rule applies to packets with the specified TOS bits set.
393 string may be one of critical, inetcontrol, lowdelay, netcontrol,
394 throughput, reliability, or one of the DiffServ Code Points: ef,
395 af11 ... af43, cs0 ... cs7; number may be either a hex or decimal
396 number.
397 The action taken when a flowspec rules matches depends on extended commu‐
399 nities. For example to block all traffic either ext-community flow-rate
400 as-number:0 or ext-community flow-pps as-number:0 need to be set.
401
403 A vpn section configures a router to participate in an MPLS Virtual Pri‐
404 vate Network. It specifies an mpe(4) interface to use, a description,
405 and various properties of the VPN:
406 vpn "description" on mpe1 {
408 rd 65002:1
409 import-target rt 65002:42
410 export-target rt 65002:42
411 network 192.168.1/24
412 }
413 bgpd(8) will not exchange VPN routes with a neighbor by default, see the
415 NEIGHBORS AND GROUPS section. The description is used when logging but
416 has no further meaning to bgpd(8).
417 The mpe(4) interface will be used as the outgoing interface for routes to
419 the VPN, and local networks will be announced with the MPLS label speci‐
420 fied on the interface. The interface can provide VPN connectivity for
421 another rdomain by being configured in that rdomain. The required rdo‐
422 main must be configured on the interface before bgpd(8) uses it. Multi‐
423 ple VPNs may be connected to a single rdomain, including the rdomain that
424 bgpd(8) is running in.
425 An example hostname.if(5) configuration for an mpe(4) interface providing
427 connectivity to rdomain 1:
428 rdomain 1
430 mplslabel 2000
431 inet 192.198.0.1 255.255.255.255
432 up
433 The VPN properties are as follows:
435 export-target subtype as-number:local
437 export-target subtype IP:local
438 Classify announced networks by tagging them with an extended
439 community of the given arguments. The community subtype should
440 be a route target, rt, to ensure interoperability. The arguments
441 are further detailed in the ATTRIBUTE SET section. More than one
442 export-target can be specified.
443 fib-update (yes|no)
445 If set to no, do not update the Forwarding Information Base,
446 a.k.a. the kernel routing table. The default is yes.
447 import-target subtype as-number:local
449 import-target subtype IP:local
450 The rdomain imports only those prefixes tagged with an extended
451 community matching an import-target. The community subtype
452 should be a route target, rt, to ensure interoperability. The
453 arguments are further detailed in the ATTRIBUTE SET section.
454 More than one import-target can be specified.
455 network argument ...
457 Announce the given networks within this VPN; see the NETWORK
458 ANNOUNCEMENTS section.
459 rd as-number:local
461 rd IP:local
462 The Route Distinguisher rd supplies BGP with namespaces to disam‐
463 biguate VPN prefixes, as these needn't be globally unique. Un‐
464 like route targets, the rd neither identifies the origin of the
465 prefix nor controls into which VPNs the prefix is distributed.
466 The as-number or IP of a rd should be set to a number or IP that
467 was assigned by an appropriate authority, whereas local can be
468 chosen by the local operator.
469
471 bgpd(8) establishes TCP connections to other BGP speakers called
472 neighbors. A neighbor and its properties are specified by a neighbor
473 section:
474 neighbor 10.0.0.2 {
476 remote-as 65002
477 descr "a neighbor"
478 }
479 Neighbors placed within a group section inherit the properties common to
481 that group:
482 group "peering AS65002" {
484 remote-as 65002
485 neighbor 10.0.0.2 {
486 descr "AS65002-p1"
487 }
488 neighbor 10.0.0.3 {
489 descr "AS65002-p2"
490 }
491 }
492 An entire network of neighbors may be accommodated by specifying an ad‐
494 dress/netmask pair:
495 neighbor 10.0.0.0/8
497 This is a template that recognises as a neighbor any connection from
499 within the given network. Such neighbors inherit their template's prop‐
500 erties, except for their IP address. A template may omit remote-as;
501 bgpd(8) then accepts any AS presented by the neighbor in the OPEN mes‐
502 sage.
503 The neighbor properties are as follows:
505 announce (IPv4|IPv6) (none|unicast|vpn |flowspec)
507 For the given address family, control which subsequent address
508 families are announced during the capabilities negotiation. Only
509 routes for that address family and subsequent address families
510 will be announced and processed.
511 At the moment, only none, which disables the announcement of that
513 address family, unicast, vpn, which allows the distribution of
514 BGP MPLS VPNs, and flowspec, which allows the distribution of
515 Flow Specification Rules, are supported.
516 The default is unicast for the same address family of the ses‐
518 sion.
519 announce add-path recv (yes|no)
521 If set to yes, the receive add-path capability is announced,
522 which allows reception of multiple paths per prefix. The default
523 is no.
524 announce add-path send (no|all)
526 announce add-path send (best|ecmp |as-wide-best) [plus num] [max num]
527 If set to all, best, ecmp, or as-wide-best, the send add-path ca‐
528 pability is announced, which allows sending multiple paths per
529 prefix. The paths sent depend on which mode is selected:
530 no do not advertise add-path send capability
532 all send all valid paths
533 best send the best path
534 ecmp send paths with equal nexthop cost
535 as-wide-best send paths where the first 8 checks of the decision
536 process match
537 plus allows the inclusion of additional backup paths and works
539 for best, ecmp, and as-wide-best. max can be used to limit the
540 total amount of paths sent for ecmp and as-wide-best. Right now
541 ecmp and as-wide-best are equivalent. The default is no. If
542 add-path send is active then the setting of rde evaluate is ig‐
543 nored.
544 announce as-4byte (yes|no)
546 If set to no, the 4-byte AS capability is not announced and so
547 native 4-byte AS support is disabled. The default is yes.
548 announce capabilities (yes|no)
550 If set to no, capability negotiation is disabled during the es‐
551 tablishment of the session. This can be helpful to connect to
552 old or broken BGP implementations. The default is yes.
553 announce enhanced refresh (yes|no)
555 If set to yes, the enhanced route refresh capability is an‐
556 nounced. The default is no.
557 announce policy (yes|no|enforce)
559 If set to yes, add the open policy role capability. If the role
560 of the neighbor does not correspond to the expected role then the
561 session will be closed. If enforce is set the session will only
562 establish if the neighbor also announces the open policy capabil‐
563 ity. The default is no.
564 announce refresh (yes|no)
566 If set to no, the route refresh capability is not announced. The
567 default is yes.
568 announce restart (yes|no)
570 If set to no, the graceful restart capability is not announced.
571 Currently only the End-of-RIB marker is supported and announced
572 by the restart capability. The default is yes.
573 as-override (yes|no)
575 If set to yes, all occurrences of the neighbor AS in the AS path
576 will be replaced with the local AS before running the filters.
577 The Adj-RIB-In still holds the unmodified AS path. The default
578 value is no.
579 demote group
581 Increase the carp(4) demotion counter on the given interface
582 group, usually carp, when the session is not in state
583 ESTABLISHED. The demotion counter will be increased as soon as
584 bgpd(8) starts and decreased 60 seconds after the session went to
585 state ESTABLISHED. For neighbors added at runtime, the demotion
586 counter is only increased after the session has been ESTABLISHED
587 at least once before dropping.
588 For more information on interface groups, see the group keyword
590 in ifconfig(8).
591 depend on interface
593 The neighbor session will be kept in state IDLE as long as
594 interface reports no link. For carp(4) interfaces, no link means
595 that the interface is currently backup. This is primarily in‐
596 tended to be used with carp(4) to reduce failover times.
597 The state of the network interfaces on the system can be viewed
599 using the show interfaces command to bgpctl(8).
600 descr description
602 Add a description. The description is used when logging neighbor
603 events, in status reports, for specifying neighbors, etc., but
604 has no further meaning to bgpd(8).
605 down [reason]
607 Do not start the session when bgpd(8) comes up but stay in IDLE.
608 If the session is cleared at runtime, after a down reason was
609 configured at runtime, the reason is sent as Administrative Shut‐
610 down Communication. The reason cannot exceed 255 octets.
611 dump (all|updates) (in|out) file [interval]
613 Dump ongoing BGP activity for a particular neighbor. See also
614 the dump setting in GLOBAL CONFIGURATION.
615 enforce local-as (yes|no)
617 If set to no, AS paths will not be checked for AS loop detection.
618 This feature is similar to allowas-in in some other BGP implemen‐
619 tations. Since there is no AS path loop check, this feature is
620 dangerous, and requires you to add filters to prevent receiving
621 your own prefixes. The default value is yes.
622 enforce neighbor-as (yes|no)
624 If set to yes, AS paths whose leftmost AS is not equal to the
625 remote AS of the neighbor are rejected and a NOTIFICATION is sent
626 back. The default value for IBGP peers is no otherwise the de‐
627 fault is yes.
628 export (none|default-route)
630 If set to none, no UPDATE messages will be sent to the neighbor.
631 If set to default-route, only the default route will be announced
632 to the neighbor.
633 holdtime seconds
635 Set the holdtime in seconds. Inherited from the global configu‐
636 ration if not given.
637 holdtime min seconds
639 Set the minimal acceptable holdtime. Inherited from the global
640 configuration if not given.
641 ipsec (ah|esp) (in|out) spi spi-number authspec [encspec]
643 Enable IPsec with static keying. There must be at least two
644 ipsec statements per peer with manual keying, one per direction.
645 authspec specifies the authentication algorithm and key. It can
646 be
647 sha1 <key>
649 md5 <key>
650 encspec specifies the encryption algorithm and key. ah does not
652 support encryption. With esp, encryption is optional. encspec
653 can be
654 3des <key>
656 3des-cbc <key>
657 aes <key>
658 aes-128-cbc <key>
659 Keys must be given in hexadecimal format. After changing set‐
661 tings, a session needs to be reset to use the new keys. The
662 ipsec flows only work with session using the default port 179.
663 ipsec (ah|esp) ike
665 Enable IPsec with dynamic keying. In this mode, bgpd(8) sets up
666 the flows, and a key management daemon such as isakmpd(8) is re‐
667 sponsible for managing the session keys. With isakmpd(8), it is
668 sufficient to copy the peer's public key, found in
669 /etc/isakmpd/local.pub, to the local machine. It must be stored
670 in a file named after the peer's IP address and must be stored in
671 /etc/isakmpd/pubkeys/ipv4/. The local public key must be copied
672 to the peer in the same way. As bgpd(8) manages the flows on its
673 own, it is sufficient to restrict isakmpd(8) to only take care of
674 keying by specifying the flags -Ka. This can be done in
675 rc.conf.local(8). After starting the isakmpd(8) and bgpd(8) dae‐
676 mons on both sides, the session should be established. After
677 changing settings, a session needs to be reset to use the new
678 keys. The ipsec flows only work with session using the default
679 port 179.
680 local-address address
682 no local-address
683 When bgpd(8) initiates the TCP connection to the neighbor system,
684 it normally does not bind to a specific IP address. If a
685 local-address is given, bgpd(8) binds to this address first. no
686 local-address reverts back to the default.
687 local-as as-number [as-number]
689 Set the AS number sent to the remote system. Used as described
690 above under GLOBAL CONFIGURATION option AS.
691 Since there is no AS path loop check, this option is dangerous,
693 and requires you to add filters to prevent receiving your ASNs.
694 Intended to be used temporarily, for migrations to another AS.
695 log no Disable neighbor specific logging.
697 log updates
699 Log received and sent updates for this neighbor.
700 max-prefix number [restart number]
702 Terminate the session when the maximum number of prefixes re‐
703 ceived is exceeded (no such limit is imposed by default). If
704 restart is specified, the session will be restarted after number
705 minutes.
706 max-prefix number out [restart number]
708 Terminate the session when the maximum number of prefixes sent is
709 exceeded (no such limit is imposed by default). If restart is
710 specified, the session will be restarted after number minutes.
711 multihop hops
713 Neighbors not in the same AS as the local bgpd(8) normally have
714 to be directly connected to the local machine. If this is not
715 the case, the multihop statement defines the maximum hops the
716 neighbor may be away.
717 passive
719 Do not attempt to actively open a TCP connection to the neighbor
720 system.
721 port port
723 Connect to the peer using port instead of the default BGP port
724 179.
725 reject as-set (yes|no)
727 If set to yes, AS paths attributes containing AS_SET path seg‐
728 ments will be rejected and all prefixes will be treated as with‐
729 draws. The default is inherited from the global reject as-set
730 setting.
731 remote-as as-number
733 Set the AS number of the remote system.
734 rde evaluate (default|all)
736 If set to all, keep evaluating alternative paths in case the se‐
737 lected path is filtered out. By default if a path is filtered by
738 the output filters then no alternative path is sent to this peer.
739 The default is inherited from the global rde evaluate setting.
740 rib name
742 Bind the neighbor to the specified RIB.
743 role role
745 Set the local role for this eBGP session. Setting a role is re‐
746 quired for ASPA verification, the open policy role capability and
747 Only-To-Customer (OTC) attribute of RFC 9234. The role can be
748 one of none, provider, customer, rs, rs-client, or peer. If the
749 role is set to none the announce policy will also be disabled.
750 On iBGP session the role setting is ignored and forced to none.
751 route-reflector [address]
753 Act as an RFC 4456 route-reflector for this neighbor. An op‐
754 tional cluster ID can be specified; otherwise the BGP ID will be
755 used.
756 set attribute ...
758 Set the AS path attributes to some default per neighbor or group
759 block:
760 set localpref 300
762 See also the ATTRIBUTE SET section. Set parameters are applied
764 to the received prefixes; the only exceptions are prepend-self,
765 nexthop no-modify and nexthop self. These sets are rewritten
766 into filter rules and can be viewed with “bgpd -nv”.
767 tcp md5sig password secret
769 tcp md5sig key secret
770 Enable TCP MD5 signatures per RFC 2385. The shared secret can
771 either be given as a password or hexadecimal key.
772 tcp md5sig password mekmitasdigoat
774 tcp md5sig key deadbeef
775 After changing keys, a session needs to be reset to use the new
776 keys.
777 transparent-as (yes|no)
779 If set to yes, AS paths to EBGP neighbors are not prepended with
780 the local AS. The default is inherited from the global
781 transparent-as setting.
782 ttl-security (yes|no)
784 Enable or disable ttl-security. When enabled, outgoing packets
785 are sent using a TTL of 255 and a check is made against an incom‐
786 ing packet's TTL. For directly connected peers, incoming packets
787 are required to have a TTL of 255, ensuring they have not been
788 routed. For multihop peers, incoming packets are required to
789 have a TTL of 256 minus multihop distance, ensuring they have not
790 passed through more than the expected number of hops. The de‐
791 fault is no.
792
794 bgpd(8) filters all BGP UPDATE messages, including its own announcements,
795 and blocks them by default. Filter rules may match on neighbor, direc‐
796 tion, prefix or AS path attributes. Filter rules may also modify AS path
797 attributes.
798 For each UPDATE processed by the filter, the filter rules are evaluated
800 in sequential order, from first to last. The last matching allow or deny
801 rule decides what action is taken. The default action is to deny.
802 The following actions can be used in the filter:
804 allow The UPDATE is passed.
806 deny The UPDATE is blocked.
808 match Apply the filter attribute set without influencing the filter
810 decision.
811
813 The rule parameters specify the UPDATES to which a rule applies. An
814 UPDATE always comes from, or goes to, one neighbor. Most parameters are
815 optional, but each can appear at most once per rule. If a parameter is
816 specified, the rule only applies to packets with matching attributes.
817 as-type [operator] as-number
819 as-type as-set name
820 This rule applies only to UPDATES where the AS path matches. The
821 part of the AS path specified by the as-type is matched against
822 the as-number or the as-set name:
823 AS (any part)
825 peer-as (leftmost AS number)
826 source-as (rightmost AS number)
827 transit-as (all but the rightmost AS number)
828 as-number is an AS number as explained above under GLOBAL
830 CONFIGURATION. It may be set to neighbor-as, which is expanded
831 to the current neighbor remote AS number, or local-as, which is
832 expanded to the locally assigned AS number.
833 When specifying an as-set name, the AS path will instead be
835 matched against all the AS numbers in the set.
836 The operator can be unspecified (this case is identical to the
838 equality operator), or one of the numerical operators
839 = (equal)
841 != (unequal)
842 - (range including boundaries)
843 >< (except range)
844 >< and - are binary operators (they take two arguments); with
846 these, as-number cannot be set to neighbor-as.
847 Multiple as-number entries for a given type or as-type as-number
849 entries may also be specified, separated by commas or whitespace,
850 if enclosed in curly brackets:
851 deny from any AS { 1, 2, 3 }
853 deny from any { AS 1, source-as 2, transit-as 3 }
854 deny from any { AS { 1, 2, 3 }, source-as 4, transit-as 5 }
855 avs (valid | unknown | invalid)
857 This rule applies only to UPDATES where the ASPA Validation State
858 (AVS) matches.
859 community as-number:local
861 community name
862 This rule applies only to UPDATES where the community path attri‐
863 bute is present and matches. Communities are specified as
864 as-number:local, where as-number is an AS number and local is a
865 locally significant number between zero and 65535. Both
866 as-number and local may be set to ‘*’ to do wildcard matching.
867 Alternatively, well-known communities may be given by name in‐
868 stead and include BLACKHOLE, GRACEFUL_SHUTDOWN, NO_EXPORT,
869 NO_ADVERTISE, NO_EXPORT_SUBCONFED, and NO_PEER. Both as-number
870 and local may be set to neighbor-as, which is expanded to the
871 current neighbor remote AS number, or local-as, which is expanded
872 to the locally assigned AS number.
873 large-community as-number:local:local
875 This rule applies only to UPDATES where the Large community path
876 attribute is present and matches. Communities are specified as
877 as-number:local:local, where as-number is an AS number and local
878 is a locally significant number between zero and 4294967295.
879 Both as-number and local may be set to ‘*’ to do wildcard match‐
880 ing, neighbor-as, which is expanded to the current neighbor re‐
881 mote AS number, or local-as, which is expanded to the locally as‐
882 signed AS number.
883 ext-community subtype as-number:local
885 ext-community subtype IP:local
886 ext-community subtype numvalue
887 ext-community ovs (valid | not-found | invalid)
888 This rule applies only to UPDATES where the extended community
889 path attribute is present and matches. Extended Communities are
890 specified by a subtype and normally two values, a globally unique
891 part (e.g. the AS number) and a local part. Both as-number and
892 local may be set to neighbor-as, which is expanded to the current
893 neighbor remote AS number, or local-as, which is expanded to the
894 locally assigned AS number. Wildcard matching is supported for
895 local, numvalue and subtype. If wildcard matching is used on the
896 subtype then numvalue also needs to be set to ‘*’. See also the
897 ATTRIBUTE SET section for further information about the encoding.
898 (from|to) peer
900 This rule applies only to UPDATES coming from, or going to, this
901 particular neighbor. This parameter must be specified. peer is
902 one of the following:
903 any Any neighbor will be matched.
905 ibgp All IBGP neighbors will be matched.
906 ebgp All EBGP neighbors will be matched.
907 address Neighbors with this address will be matched.
908 group descr Neighbors in this group will be matched.
909 AS as-number
910 Neighbors with this AS will be matched.
911 Multiple peer entries may also be specified, separated by commas
913 or whitespace, if enclosed in curly brackets:
914 deny from { 128.251.16.1, 251.128.16.2, group hojo }
916 (inet|inet6)
918 Match only routes in the IPv4 or IPv6 address families, respec‐
919 tively. inet is an alias for "prefix 0.0.0.0/0 prefixlen >= 0";
920 inet6 is an alias for "prefix ::/0 prefixlen >= 0".
921 max-as-len len
923 This rule applies only to UPDATES where the AS path has more than
924 len elements.
925 max-as-seq len
927 This rule applies only to UPDATES where a single AS number is re‐
928 peated more than len times.
929 max-communities|max-large-communities|max-ext-communities num
931 This rule applies only to UPDATES where the Basic, Large, or
932 Extended Community attribute has more than num elements.
933 nexthop address
935 This rule applies only to UPDATES where the nexthop is equal to
936 address. The address can be set to neighbor in which case the
937 nexthop is compared against the address of the neighbor. Nexthop
938 filtering is not supported on locally announced networks and one
939 must take into consideration previous rules overwriting nexthops.
940 origin-set name
942 This rule applies only to UPDATES that match the given origin-set
943 name.
944 ovs (valid | not-found | invalid)
946 This rule applies only to UPDATES where the Origin Validation
947 State (OVS) matches.
948 prefix address/len
950 prefix address/len prefixlen range
951 prefix address/len or-longer
952 prefix address/len maxlen mlen
953 This rule applies only to UPDATES for the specified prefix.
954 Multiple entries may be specified, separated by commas or white‐
956 space, if enclosed in curly brackets:
957 deny from any prefix { 192.168.0.0/16, 10.0.0.0/8 or-longer }
959 Multiple lists can also be specified, which is useful for macro
961 expansion:
962 good="{ 192.168.0.0/16, 172.16.0.0/12, 10.0.0.0/8 }"
964 bad="{ 224.0.0.0/4 prefixlen >= 4, 240.0.0.0/4 prefixlen >= 4 }"
965 ugly="{ 127.0.0.1/8, 169.254.0.0/16 }"
966 deny from any prefix { $good $bad $ugly }
968 Prefix length ranges are specified by using these operators:
970 = (equal)
972 != (unequal)
973 < (less than)
974 <= (less than or equal)
975 > (greater than)
976 >= (greater than or equal)
977 - (range including boundaries)
978 >< (except range)
979 >< and - are binary operators (they take two arguments). For in‐
981 stance, to match all prefix lengths >= 8 and <= 12, and hence the
982 CIDR netmasks 8, 9, 10, 11 and 12:
983 prefixlen 8-12
985 Or, to match all prefix lengths < 8 or > 12, and hence the CIDR
987 netmasks 0–7 and 13–32:
988 prefixlen 8><12
990 This will match all prefixes in the 10.0.0.0/8 netblock with net‐
992 masks longer than 16:
993 prefix 10.0.0.0/8 prefixlen > 16
995 or-longer is a shorthand for:
997 prefix address/len prefixlen >= len
999 maxlen mlen is a shorthand for:
1001 prefix address/len prefixlen <= mlen
1003 prefix-set name [or-longer]
1005 This rule applies only to UPDATES that match the given prefix-set
1006 name. With or-longer, the UPDATES will match any prefix in the
1007 prefix-set where
1008 address/len prefixlen >= len
1010 quick If an UPDATE matches a rule which has the quick option set, this
1012 rule is considered the last matching rule, and evaluation of sub‐
1013 sequent rules is skipped.
1014 rib name
1016 Apply rule only to the specified RIB. This only applies for re‐
1017 ceived updates, so not for rules using the to peer parameter.
1018 set attribute ...
1020 All matching rules can set the AS path attributes to some de‐
1021 fault. The set of every matching rule is applied, not only the
1022 last matching one. See also the following section.
1023
1025 AS path attributes can be modified with set.
1026 set can be used on network statements, in neighbor or group blocks, and
1028 on filter rules. Attribute sets can be expressed as lists.
1029 The following attributes can be modified:
1031 community [delete] as-number:local
1033 community [delete] name
1034 Set or delete the COMMUNITIES AS path attribute. Communities are
1035 specified as as-number:local, where as-number is an AS number and
1036 local is a locally significant number between zero and 65535.
1037 Alternately, well-known communities may be specified by name:
1038 GRACEFUL_SHUTDOWN, NO_EXPORT, NO_ADVERTISE, NO_EXPORT_SUBCONFED,
1039 or NO_PEER. For delete, both as-number and local may be set to
1040 ‘*’ to do wildcard matching.
1041 large-community [delete] as-number:local:local
1043 large-community [delete] name
1044 Set or delete the Large Communities path attribute. Communities
1045 are specified as as-number:local:local, where as-number is an AS
1046 number and local is a locally significant number between zero and
1047 4294967295. For delete, both as-number and local may be set to
1048 ‘*’ to do wildcard matching.
1049 ext-community [delete] subtype as-number:local
1051 ext-community [delete] subtype IP:local
1052 ext-community [delete] subtype numvalue
1053 ext-community [delete] ovs (valid | not-found | invalid)
1054 Set or delete the Extended Community AS path attribute. Extended
1055 Communities are specified by a subtype and normally two values, a
1056 globally unique part (e.g. the AS number) and a local part. The
1057 type is selected depending on the encoding of the global part.
1058 Two-octet AS Specific Extended Communities and Four-octet AS Spe‐
1059 cific Extended Communities are encoded as as-number:local. Four-
1060 octet encoding is used if the as-number is bigger than 65535 or
1061 if the AS_DOT encoding is used. IPv4 Address Specific Extended
1062 Communities are encoded as IP:local. Opaque Extended Communities
1063 are encoded with a single numeric value. The ovs subtype can
1064 only be set to valid, not-found, or invalid. Currently the fol‐
1065 lowing subtypes are supported:
1066 bdc BGP Data Collection
1068 defgw Default Gateway
1069 esi-lab ESI Label
1070 esi-rt ES-Import Route Target
1071 l2vid L2VPN Identifier
1072 mac-mob MAC Mobility
1073 odi OSPF Domain Identifier
1074 ort OSPF Route Type
1075 ori OSPF Router ID
1076 ovs BGP Origin Validation State
1077 rt Route Target
1078 soo Route Origin / Source of Origin
1079 srcas Source AS
1080 vrfri VRF Route Import
1081 Not all type and subtype value pairs are allowed by IANA and the
1083 parser will ensure that no invalid combination is created.
1084 For delete, subtype, numvalue, or local, may be set to ‘*’ to do
1086 wildcard matching. If wildcard matching is used on the subtype
1087 then numvalue also needs to be set to ‘*’.
1088 localpref number
1090 Set the LOCAL_PREF AS path attribute. If number starts with a
1091 plus or minus sign, LOCAL_PREF will be adjusted by adding or sub‐
1092 tracting number; otherwise it will be set to number. The default
1093 is 100.
1094 med number
1096 metric number
1097 Set the MULTI_EXIT_DISC AS path attribute. If number starts with
1098 a plus or minus sign, MULTI_EXIT_DISC will be adjusted by adding
1099 or subtracting number; otherwise it will be set to number.
1100 origin (igp|egp|incomplete)
1102 Set the ORIGIN AS path attribute to mark the source of this route
1103 as being injected from an igp protocol, an egp protocol or being
1104 an aggregated route.
1105 nexthop (address|blackhole|reject|self|no-modify)
1107 Set the NEXTHOP AS path attribute to a different nexthop address
1108 or use blackhole or reject routes. blackhole and reject only af‐
1109 fect the FIB and will not alter the nexthop address. self forces
1110 the nexthop to be set to the local interface address. If set to
1111 no-modify, the nexthop attribute is not modified for EBGP multi‐
1112 hop sessions. By default EBGP multihop sessions use the local
1113 interface address. On other IBGP and directly connected EBGP
1114 sessions no-modify is ignored. The set address is used on IBGP
1115 session and on directly connected EBGP session if the address is
1116 part of the connected network. On EBGP multihop session
1117 no-modify has to be set to force the nexthop to address.
1118 set nexthop 192.168.0.1
1120 set nexthop blackhole
1121 set nexthop reject
1122 set nexthop no-modify
1123 set nexthop self
1124 pftable table
1126 Add the prefix in the update to the specified pf(4) table, re‐
1127 gardless of whether or not the path was selected for routing.
1128 This option may be useful in building realtime blacklists.
1129 prepend-neighbor number
1131 Prepend the neighbor's AS number times to the AS path.
1132 prepend-self number
1134 Prepend the local AS number times to the AS path.
1135 rtlabel label
1137 Add the prefix to the kernel routing table with the specified
1138 label.
1139 weight number
1141 The weight is used to tip prefixes with equally long AS paths in
1142 one or the other direction. A prefix is weighed at a very late
1143 stage in the decision process. If number starts with a plus or
1144 minus sign, the weight will be adjusted by adding or subtracting
1145 number; otherwise it will be set to number. Weight is a local
1146 non-transitive attribute, and is a bgpd(8)-specific extension.
1147 For prefixes with equally long paths, the prefix with the larger
1148 weight is selected.
1149
1151 /etc/bgpd.conf bgpd(8) configuration file.
1152
1154 strftime(3), ipsec(4), pf(4), rdomain(4), tcp(4), bgpctl(8), bgpd(8),
1155 ipsecctl(8), isakmpd(8), rc.conf.local(8)
1156
1158 The bgpd.conf file format first appeared in OpenBSD 3.5.
1159BSD August 16, 2023 BSD