28.06.2014 Views

Discussion

Discussion

Discussion

SHOW MORE
SHOW LESS

You also want an ePaper? Increase the reach of your titles

YUMPU automatically turns print PDFs into web optimized ePapers that Google loves.

This configuration assumes that you use community 65500:1234 as a standard way to<br />

suppress announcements of these routes outside your AS. The community is included<br />

as a precaution to provide a backup method to make sure that the routes stay within<br />

your AS in case, for some reason, the NO_EXPORT action fails.<br />

Then define a simple regular expression to match the Team Cymru private AS number:<br />

[edit policy-options]<br />

aviva@RouterF# set as-path cymru-private-asn 65333<br />

The following routing policy for the EBGP peering session accepts the bogon route<br />

updates:<br />

[edit policy-options]<br />

aviva@RouterF# edit policy-statement cymru-bogon-list<br />

[edit policy-options policy-statement cymru-bogon-list]<br />

aviva@RouterF# set term 1 from protocol bgp<br />

aviva@RouterF# set term 1 from as-path cymru-private-asn<br />

aviva@RouterF# set term 1 from community cymru-bogon-community<br />

aviva@RouterF# set term 1 then community add dont-announce<br />

aviva@RouterF# set term 1 then next-hop 192.0.2.1<br />

aviva@RouterF# set term 1 then accept<br />

aviva@RouterF# set then reject<br />

The from clause matches BGP routes from the AS path defined in cymru-private-asn<br />

(that is, from AS number 65333) and that contain the community string defined in<br />

cymru-bogon-community (that is, 65333:888). The then clause performs two actions on<br />

any matching routes before accepting them. The set then community add dont-announce<br />

command attaches the community string 65500:1234 to the routes to ensure that the<br />

routes are never forwarded outside the local AS. (This is the community you defined<br />

with the set community dont-announce command.) The second action in the then<br />

clause sets the route’s next hop to 192.0.1.2, which is a reserved network prefix.<br />

This next hop maps the bogons to a remotely triggered black hole, which acts as a filter<br />

for the bogons, discarding them and explicitly stating that they are never to be readvertised.<br />

You define this prefix as a static route in the routing table:<br />

[edit routing-options]<br />

aviva@RouterF# set static route 192.0.2.1/32 discard<br />

aviva@RouterF# set static route 192.0.2.1/32 no-readvertise<br />

aviva@RouterF# set static route 192.0.2.1/32 retain<br />

The discard option on the static route prevents it from being forwarded, noreadvertise<br />

prevents it from being readvertised to anyone else, and retain keeps the<br />

route in the forwarding table if the JUNOS routing process restarts normally.<br />

If you are using the default JUNOS martians, 192.0.2.1/32 is a martian and will be<br />

rejected, so you need to explicitly allow the routing table to accept it:<br />

[edit routing-options]<br />

aviva@RouterF# set martians 192.0.2.1/32 exact allow<br />

468 | Chapter 13: BGP<br />

This is the Title of the Book, eMatter Edition<br />

Copyright © 2008 O’Reilly & Associates, Inc. All rights reserved.

Hooray! Your file is uploaded and ready to be published.

Saved successfully!

Ooh no, something went wrong!