BGP Path Filtering
Brian Wallingford
brian at meganet.net
Fri May 16 03:16:28 UTC 2003
I'd probably err on the most cautious side and use strict inbound prefix
filters, only using outbound as-path filters toward upstreams as a sanity
check.
Unless you're a legacy peer with large networks, chances are you'll be
expected to arrange for acl mods with your peers/upstreams to propagate
your clients' announcements anyway.
hth,
Brian
ps - you're correct - there doesn't appear to be a BCP. Common sense,
tempered by a healthy dose of skepticism regarding one's clients'
competency would seem to steer the solution :)
On Thu, 15 May 2003, Mark Radabaugh wrote:
:
:I'm having a hard time finding best practices for filtering outbound bgp
:announcements when providing transit to bgp-speaking customers. While we
:currently multi-home to several providers it appears we will soon need to
:provide transit for customers with their own AS's.
:
:I find lots of references (and understand) the basic
:
:ip as-path access-list 3 permit ^$
:
:and it would seem that should we wish to provide transit for a bgp customer
:AS12345 we would use:
:
:ip as-path access-list 3 permit ^12345$
:
:but I think this breaks if AS12345 prepends their advertisement.
:
:Next up is:
:
:ip as-path access-list 3 permit ^12345_[0-9]$*
:
:Which seems correct to me. Is this still best practice (or even correct)?
More information about the NANOG
mailing list