| BGPD.CONF(5) | AerieBSD 1.0 Refernce Manual | BGPD.CONF(5) |
include "/etc/bgpd/bgpd-10.0.0.1.filter"
peer1="1.2.3.4"
neighbor $peer1 {
remote-as 65001
}
AS 65001
sets the local AS to 65001. The AS numbers 64512 \(en 65534 are designated for private use. The AS number 23456 is a specially designated Autonomous System Number and should not be used. 4-byte AS numbers are specified as two numbers separated by a dot. For example:
AS 3.10
dump table "/tmp/rib-dump-%H%M" 300
Similar to the table dump, but this time all BGP messages and state transitions will be dumped to the specified file:
dump all in "/tmp/all-in-%H%M" 300
As before, but only the UPDATE messages will be dumped to the file:
dump updates in "/tmp/updates-in-%H%M" 300
It is also possible to dump outgoing messages:
dump all out "/tmp/all-out-%H%M" 300 # or dump updates out "/tmp/updates-out-%H%M" 300
listen on 127.0.0.1
network 192.168.7.0/24
It is possible to set default AS path attributes per network statement:
network 192.168.7.0/24 set localpref 220
See also the section.
router-id 10.0.0.1
If not given, the BGP ID is determined as the biggest IP address assigned to the local machine.
neighbor 10.0.0.2 {
remote-as 65002
descr "a neighbor"
}
Multiple neighbors can be grouped together by a group section. Each neighbor section within the group section inherits all properties from its group:
group "peering AS65002" {
remote-as 65002
neighbor 10.0.0.2 {
descr "AS65002-p1"
}
neighbor 10.0.0.3 {
descr "AS65002-p2"
}
}
Instead of the neighbor's IP address, an address/netmask pair may be given:
neighbor 10.0.0.0/8
In this case, the neighbor specification becomes a template, and if a neighbor connects from an IP address within the given network, the template is cloned, inheriting everything from the template but the remote address, which is replaced by the connecting neighbor's address. With a template specification it is valid to omit remote-as; bgpd(8) will then accept any AS the neighbor presents in the OPEN message. There are several neighbor properties:
sha1md5
encspec specifies the encryption algorithm and key. ah does not support encryption. With esp, encryption is optional. encspec can be
3des3des-cbc aes aes-128-cbc
Keys must be given in hexadecimal format.
set localpref 300
See also the section. Set parameters are applied to the received prefixes; the only exceptions are prepend-self, nexthopno-modify and nexthopself. These sets are rewritten into filter rules and can be viewed with “bgpd -nv”.
tcp md5sig password mekmidasdigoat tcp md5sig key deadbeef
deny from any AS { 1, 2, 3 }
deny from any { AS 1, source-as 2, transit-as 3 }
deny from any { AS { 1, 2, 3 }, source-as 4, transit-as 5 }
deny from { 128.251.16.1, 251.128.16.2, group hojo }
deny from any prefix { 192.168.0.0/16, 10.0.0.0/8 }
Multiple lists can also be specified, which is useful for macro expansion:
good="{ 192.168.0.0/16, 172.16.0.0/12, 10.0.0.0/8 }"
bad="{ 224.0.0.0/4, 240.0.0.0/4 }"
ugly="{ 127.0.0.1/8, 169.254.0.0/16 }"
deny from any prefix { $good $bad $ugly }
= (equal) != (unequal) < (less than) <= (less than or equal) > (greater than) >= (greater than or equal) - (range including boundaries) >< (except range)
>< and - are binary operators (they take two arguments). For instance, to match all prefix lengths >= 8 and <= 12, and hence the CIDR netmasks 8, 9, 10, 11 and 12:
prefixlen 8-12
Or, to match all prefix lengths < 8 or > 12, and hence the CIDR netmasks 0\(en7 and 13\(en32:
prefixlen 8><12
prefixlen can be used together with prefix. This will match all prefixes in the 10.0.0.0/8 netblock with netmasks longer than 16:
prefix 10.0.0.0/8 prefixlen > 16
set nexthop 192.168.0.1 set nexthop blackhole set nexthop reject set nexthop no-modify set nexthop self
| AerieBSD 1.0 Reference Manual | August 26 2008 | BGPD.CONF(5) |