1.\" $OpenBSD: bgpd.conf.5,v 1.249 2025/01/27 15:22:11 claudio Exp $ 2.\" 3.\" Copyright (c) 2004 Claudio Jeker <claudio@openbsd.org> 4.\" Copyright (c) 2003, 2004 Henning Brauer <henning@openbsd.org> 5.\" Copyright (c) 2002 Daniel Hartmeier <dhartmei@openbsd.org> 6.\" 7.\" Permission to use, copy, modify, and distribute this software for any 8.\" purpose with or without fee is hereby granted, provided that the above 9.\" copyright notice and this permission notice appear in all copies. 10.\" 11.\" THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES 12.\" WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF 13.\" MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR 14.\" ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES 15.\" WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN 16.\" ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF 17.\" OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. 18.\" 19.Dd $Mdocdate: January 27 2025 $ 20.Dt BGPD.CONF 5 21.Os 22.Sh NAME 23.Nm bgpd.conf 24.Nd BGP routing daemon configuration file 25.Sh DESCRIPTION 26The 27.Xr bgpd 8 28daemon implements the Border Gateway Protocol version 4 as described 29in RFC 4271. 30.Pp 31The 32.Nm 33config file is divided into the following main sections: 34.Bl -tag -width xxxx 35.It Sx MACROS 36User-defined variables may be defined and used later, simplifying the 37configuration file. 38.It Sx GLOBAL CONFIGURATION 39Global settings for 40.Xr bgpd 8 . 41.It Sx SET CONFIGURATION 42Various lookup tables are defined in this section. 43.It Sx NETWORK AND FLOWSPEC ANNOUNCEMENTS 44Networks which should be announced by 45.Xr bgpd 8 46are set in this section. 47.It Sx MPLS VPN CONFIGURATION 48The definition and properties for BGP MPLS VPNs are set in this section. 49.It Sx NEIGHBORS AND GROUPS 50.Xr bgpd 8 51establishes sessions with 52.Em neighbors . 53The neighbor definition and properties are set in this section, as well as 54grouping neighbors for the ease of configuration. 55.It Sx FILTER 56Filter rules for incoming and outgoing 57.Em UPDATES . 58.El 59.Pp 60With the exception of macros, 61the sections should be grouped and appear in 62.Nm 63in the order shown above. 64.Pp 65The current line can be extended over multiple lines using a backslash 66.Pq Sq \e . 67Comments can be put anywhere in the file using a hash mark 68.Pq Sq # , 69and extend to the end of the current line. 70Care should be taken when commenting out multi-line text: 71the comment is effective until the end of the entire block. 72.Pp 73Argument names not beginning with a letter, digit, or underscore 74must be quoted. 75.Pp 76Additional configuration files can be included with the 77.Ic include 78keyword, for example: 79.Bd -literal -offset indent 80include "/etc/bgpd/bgpd-10.0.0.1.filter" 81.Ed 82.Sh MACROS 83Macros can be defined that will later be expanded in context. 84Macro names must start with a letter, digit, or underscore, 85and may contain any of those characters. 86Macro names may not be reserved words (for example, 87.Ic AS , 88.Ic neighbor , 89or 90.Ic group ) . 91Macros are not expanded inside quotes. 92.Pp 93For example: 94.Bd -literal -offset indent 95peer1="1.2.3.4" 96neighbor $peer1 { 97 remote-as 65001 98} 99.Ed 100.Sh GLOBAL CONFIGURATION 101These settings affect the operation of the 102.Xr bgpd 8 103daemon as a whole. 104.Pp 105.Bl -tag -width Ds -compact 106.It Ic AS Ar as-number Op Ar as-number 107Set the local 108.Em autonomous system 109number to 110.Ar as-number . 111A fallback 2-byte AS number may follow a 4-byte AS number for neighbors that 112do not support 4-byte AS numbers. 113The standard and default fallback AS number is 23456. 114.Pp 115The AS numbers are assigned by local RIRs, such as: 116.Pp 117.Bl -tag -width xxxxxxxx -compact 118.It AfriNIC 119for Africa 120.It APNIC 121for Asia Pacific 122.It ARIN 123for North America and parts of the Caribbean 124.It LACNIC 125for Latin America and the Caribbean 126.It RIPE NCC 127for Europe, the Middle East, and parts of Asia 128.El 129.Pp 130The AS numbers 64512 \(en 65534 are designated for private use. 131The AS number 23456 is reserved and should not be used. 1324-byte AS numbers may be specified in either the ASPLAIN format: 133.Bd -literal -offset indent 134AS 196618 135.Ed 136.Pp 137or in the older ASDOT format: 138.Bd -literal -offset indent 139AS 3.10 140.Ed 141.Pp 142.It Ic connect-retry Ar seconds 143Set the number of seconds to wait before attempting to re-open 144a connection. 145This timer should be sufficiently large in EBGP configurations. 146The default is 120 seconds. 147.Pp 148.It Xo 149.Ic dump 150.Op Ic rib Ar name 151.Pq Ic table-v2 Ns | Ns Ic table-mp Ns | Ns Ic table 152.Ar file Op Ar interval 153.Xc 154.It Xo 155.Ic dump 156.Pq Ic all Ns | Ns Ic updates 157.Pq Ic in Ns | Ns Ic out 158.Ar file Op Ar interval 159.Xc 160Dump the RIB, a.k.a. the 161.Em routing information base , 162or dump ongoing BGP activity, in Multi-threaded Routing Toolkit (MRT) format. 163The 164.Ar file 165is subject to 166.Xr strftime 3 Ns -expansion. 167.Pp 168The 169.Ic table-v2 170and 171.Ic table-mp 172RIB formats store multi-protocol RIBs correctly, but the 173.Ic table 174format does not. 175The latter two are provided only to support third-party tools lacking 176support for the recommended 177.Ic table-v2 178format. 179Dump an alternative RIB by specifying 180.Ar name . 181Specify an 182.Ar interval 183in seconds for periodic RIB dumps. 184.Pp 185The following will dump the entire RIB table, at startup and every 1865 minutes thereafter, to a new file: 187.Bd -literal -offset indent 188dump table-v2 "/tmp/rib-dump-%H%M" 300 189.Ed 190.Pp 191Dumps of ongoing BGP activity include all BGP state transitions, and 192all BGP messages in the specified direction. 193Use 194.Ic updates 195to dump only BGP 196.Em UPDATE 197messages, without state transitions. 198Specify an 199.Ar interval 200in seconds to restart periodically with a new file: 201.Bd -literal -offset indent 202dump all in "/tmp/all-in-%H%M" 300 203.Ed 204.Pp 205.It Ic fib-priority Ar prio 206Set the routing priority to 207.Ar prio . 208The default is 48. 209.Pp 210.It Xo 211.Ic fib-update 212.Pq Ic yes Ns | Ns Ic no 213.Xc 214If set to 215.Ic no , 216do not update the Forwarding Information Base, a.k.a. the kernel 217routing table. 218The default is 219.Ic yes . 220.Pp 221.It Ic holdtime Ar seconds 222Set the announced holdtime in seconds. 223This is exchanged with a neighbor upon connection 224establishment, in the 225.Em OPEN 226message, and the shortest holdtime governs the session. 227.Pp 228The neighbor session is dropped if the session holdtime passes 229without receipt of a 230.Em KEEPALIVE 231or an 232.Em UPDATE 233message from the neighbor. 234The default is 90 seconds. 235.Pp 236.It Ic holdtime min Ar seconds 237The minimum acceptable holdtime in seconds. 238This value must be at least 3. 239.Pp 240.It Ic listen on Ar address Op Ic port Ar port 241Specify the local IP address and optional port for 242.Xr bgpd 8 243to listen on. 244The default is to listen on all local addresses on the current default 245routing domain. 246.Pp 247.It Ic log updates 248Log sent and received BGP update messages. 249.Pp 250.It Xo 251.Ic nexthop 252.Ic qualify 253.Ic via 254.Pq Ic bgp Ns | Ns Ic default 255.Xc 256If set to 257.Ic bgp , 258.Xr bgpd 8 259may verify nexthops using BGP routes. 260If set to 261.Ic default , 262.Xr bgpd 8 263may verify nexthops using the default route. 264By default 265.Xr bgpd 8 266uses only static routes or routes added by other routing 267daemons, such as 268.Xr ospfd 8 . 269.Pp 270.It Xo 271.Ic rde Ic evaluate 272.Pq Ic default Ns | Ns Ic all 273.Xc 274If set to 275.Ar all , 276keep evaluating alternative paths in case the selected path is filtered 277out. 278By default if a path is filtered by the output filters then no alternative 279path is sent to this peer. 280.Pp 281.It Xo 282.Ic rde Ic med Ic compare 283.Pq Ic always Ns | Ns Ic strict 284.Xc 285If set to 286.Ic always , 287the 288.Em MULTI_EXIT_DISC 289attributes will always be compared. 290The default is 291.Ic strict , 292where the metric is only compared between peers belonging to the same AS. 293.Pp 294.It Xo 295.Ic rde 296.Ic rib Ar name 297.Op Ic no evaluate 298.Xc 299.It Xo 300.Ic rde 301.Ic rib Ar name 302.Op Ic rtable Ar number 303.Xc 304Create an additional RIB named 305.Ar name . 306The degree to which its routes may be utilized is configurable. 307They may be excluded from the decision process that selects usable routes 308with the 309.Ic no evaluate 310flag, and this precludes their export to any kernel routing table. 311By default its routes will be evaluated, but not exported to the kernel. 312They may be both evaluated and exported if associated with a given 313.Ic rtable 314.Ar number , 315which must belong to the routing domain that 316.Xr bgpd 8 317was started in. 318This table will not be consulted during nexthop verification 319unless it is the one that 320.Xr bgpd 8 321was started in. 322It is unnecessary to create 323.Ic Adj-RIB-In 324and 325.Ic Loc-RIB , 326which are created automatically and used by default. 327.Pp 328.It Ic rde rib Loc-RIB include filtered 329Include filtered prefixes in the 330.Ic Loc-RIB . 331Filtered prefixes are not eligible by the decision process but can be 332displayed by 333.Xr bgpctl 8 . 334.Pp 335.It Xo 336.Ic rde 337.Ic route-age 338.Pq Ic ignore Ns | Ns Ic evaluate 339.Xc 340If set to 341.Ic evaluate , 342the route decision process will also consider the age of the route in 343addition to its path attributes, giving preference to the older, 344typically more stable, route. 345This renders the decision process nondeterministic. 346The default is 347.Ic ignore . 348.Pp 349.It Xo 350.Ic reject Ic as-set 351.Pq Ic yes Ns | Ns Ic no 352.Xc 353If set to 354.Ic yes , 355.Em AS paths 356attributes containing 357.Em AS_SET 358path segments will be rejected and 359all prefixes will be treated as withdraws. 360The default is 361.Ic yes . 362.Pp 363.It Ic router-id Ar dotted-quad 364Set the BGP router ID, which must be non-zero and should be unique 365within the AS. 366By default, the router ID is the highest IPv4 address assigned 367to the local machine. 368.Bd -literal -offset indent 369router-id 10.0.0.1 370.Ed 371.Pp 372.It Ic rtable Ar number 373Work with the given kernel routing table 374instead of the default table, which is the one 375.Xr bgpd 8 376was started in. 377For nexthop verification, 378.Xr bgpd 8 379will always consult the default table. 380This is the same as using the following syntax: 381.Bd -literal -offset indent 382rde rib Loc-RIB rtable number 383.Ed 384.Pp 385.It Ic socket Qo Ar path Qc Op Ic restricted 386Create a control socket at 387.Ar path . 388If 389.Ic restricted 390is specified, a restricted control socket will be created. 391By default 392.Pa /var/run/bgpd.sock.<rdomain> 393is used where 394.Ar <rdomain> 395is the routing domain in which 396.Xr bgpd 8 397has been started. 398By default, no restricted socket is created. 399.Pp 400.It Ic staletime Ar seconds 401Set the upper bound in seconds stale routes are kept during graceful restart. 402The default is 180 seconds. 403.Pp 404.It Xo 405.Ic transparent-as 406.Pq Ic yes Ns | Ns Ic no 407.Xc 408If set to 409.Ic yes , 410attribute transparency is enabled. 411.Em AS paths 412to EBGP neighbors are not prepended with the local AS. 413Additionally, the MULTI_EXIT_DISC attribute is passed transparently and 414automatic filtering based on the well-known communities 415.Ic NO_EXPORT , 416.Ic NO_ADVERTISE , 417and 418.Ic NO_EXPORT_SUBCONFED 419is disabled. 420The default is 421.Ic no . 422.El 423.Sh SET CONFIGURATION 424.Xr bgpd 8 425supports the efficient lookup of data within named 426.Em sets . 427An 428.Ic as-set , 429a 430.Ic prefix-set , 431and an 432.Ic origin-set 433store AS numbers, prefixes, and prefixes/source-as pairs, 434respectively. 435Such sets may be referenced by filter rules; see the 436.Sx FILTER 437section for details. 438It is more efficient to evaluate a set than a long series of 439rules for filtering each of its members. 440.Pp 441One single 442.Ic roa-set 443may be defined, against which 444.Xr bgpd 8 445will validate the origin of each prefix. 446The 447.Ic roa-set 448and the 449.Ic aspa-set 450are merged with the corresponding tables received via 451.Ic rtr 452sessions. 453.Pp 454A set definition can span multiple lines, and an optional comma is allowed 455between elements. 456The same set can be defined more than once, in this case the definitions are 457merged into one common set. 458.Pp 459.Bl -tag -width Ds -compact 460.It Xo 461.Ic as-set Ar name 462.Ic { Ar as-number ... Ic } 463.Xc 464An 465.Ic as-set 466stores AS numbers, and can be used with the AS specific parameter in 467.Sx FILTER 468rules. 469.Pp 470.It Xo 471.Ic aspa-set 472.Ic { Ic customer-as Ar as-number 473.Op Ic expires Ar seconds 474.Ic provider-as Ic { Ar as-number 475.Ic ... Ic } ... Ic } 476.Xc 477The 478.Ic aspa-set 479holds a collection of 480.Em Validated ASPA Payloads Pq VAPs . 481Each as AS_PATH received from an eBGP peer is checked against the 482.Ic aspa-set , 483and the ASPA Validation State (AVS) is set. 484.Ic expires 485can be set to the seconds since Epoch until when this VAP is valid. 486.Bd -literal -offset indent 487aspa-set { 488 customer-as 64511 provider-as { 64496 65496 } 489 customer-as 64496 provider-as { 65496 64544 } 490} 491.Ed 492.Pp 493.It Xo 494.Ic origin-set Ar name 495.Ic { Ar address Ns Li / Ns Ar len 496.Op Ic maxlen Ar mlen 497.Ic source-as Ar asn ... Ic } 498.Xc 499An 500.Ic origin-set 501stores prefix/source-as pairs, and can be used to filter on the combination 502by using the 503.Ic origin-set 504parameter in 505.Sx FILTER 506rules. 507.Bd -literal -offset indent 508origin-set private { 10.0.0.0/8 maxlen 24 source-as 64511 509 203.0.113.0/24 source-as 64496 } 510.Ed 511.Pp 512.It Xo 513.Ic prefix-set Ar name 514.Ic { Ar address Ns Li / Ns Ar len ... Ic } 515.Xc 516A 517.Ic prefix-set 518stores network prefixes and can be used in place 519of the 520.Ic prefix 521parameter in 522.Sx FILTER 523rules, and in 524.Ic network 525statements. 526A prefix can be followed by the prefixlen operators listed for the 527.Ic prefix 528parameter in the 529.Sx PARAMETERS 530section. 531.Pp 532The first example below creates a set of prefixes called 533.Dq private , 534to hold a number of RFC 1918 private network blocks. 535The second example shows the use of prefixlen operators. 536.Bd -literal -offset indent 537prefix-set private { 10.0.0.0/8, 172.16.0.0/12, 538 192.168.0.0/16, fc00::/7 } 539prefix-set as64496set { 192.0.2.0/24 prefixlen >= 26, 540 2001:db8::/32 or-longer } 541.Ed 542.Pp 543.It Xo 544.Ic roa-set 545.Ic { Ar address Ns Li / Ns Ar len 546.Op Ic maxlen Ar mlen 547.Ic source-as Ar asn 548.Oo Ic expires Ar seconds Oc ... Ic } 549.Xc 550The 551.Ic roa-set 552holds a collection of 553.Em Validated ROA Payloads Pq VRPs . 554Each received prefix is checked against the 555.Ic roa-set , 556and the Origin Validation State (OVS) is set. 557.Ic expires 558can be set to the seconds since Epoch until when this VRP is valid. 559.Bd -literal -offset indent 560roa-set { 192.0.2.0/23 maxlen 24 source-as 64511 561 203.0.113.0/24 source-as 64496 } 562.Ed 563.Pp 564.It Xo 565.Ic rtr Ar address 566.Ic { Ar ... Ic } 567.Xc 568The 569.Ic rtr 570block specifies a 571.Em RPKI to Router Pq RTR 572session. 573.Em RTR 574sessions provide another means to load 575.Em VRP 576sets into 577.Xr bgpd 8 . 578Changes propagated via the RTR protocol do not need a config reload and are 579immediately applied. 580The union of all 581.Em VRP 582sets received via 583.Ic rtr 584sessions and the entries in the 585.Ic roa-set 586is used to validate the origin of routes. 587The rtr session properties are as follows: 588.Pp 589.Bl -tag -width Ds -compact 590.It Ic descr Ar description 591Add a description. 592The description is used in logging and status reports, but has no further 593meaning for 594.Xr bgpd 8 . 595.Pp 596.It Ic local-address Ar address 597Bind to the specific IP address before opening the TCP connection to the 598.Em rtr 599server. 600.Pp 601.Ic min-version Ar number 602Require a minimal RTR version of 603.Ar number . 604To ensure that ASPA records are synchronised over RTR a minimal version 605of 2 is required. 606.Pp 607.It Ic port Ar number 608Specify the TCP destination port for the 609.Em rtr 610session. 611If not specified, the default 612.Ic port 613is 614.Em 323 . 615.El 616.El 617.Sh NETWORK AND FLOWSPEC ANNOUNCEMENTS 618.Ic network 619statements specify the networks that 620.Xr bgpd 8 621will announce as its own. 622An announcement must also be permitted by the 623.Sx FILTER 624rules. 625By default 626.Xr bgpd 8 627announces no networks. 628.Pp 629.Bl -tag -width Ds -compact 630.It Xo 631.Ic network 632.Ar address Ns Li / Ns Ar prefix 633.Op Ic set ... 634.Xc 635Announce the specified prefix as belonging to our AS. 636.Pp 637.It Xo 638.Ic network 639.Pq Ic inet Ns | Ns Ic inet6 640.Ic connected Op Ic set ... 641.Xc 642Announce routes to directly attached networks. 643.Pp 644.It Xo 645.Ic network prefix-set 646.Ar name 647.Op Ic set ... 648.Xc 649Announce all networks in the prefix-set 650.Ar name . 651.Pp 652.It Xo 653.Ic network 654.Pq Ic inet Ns | Ns Ic inet6 655.Ic priority Ar number Op Ic set ... 656.Xc 657Announce routes having the specified 658.Ar priority . 659.Pp 660.It Xo 661.Ic network 662.Pq Ic inet Ns | Ns Ic inet6 663.Ic rtlabel Ar label Op Ic set ... 664.Xc 665Announce routes having the specified 666.Ar label . 667.Pp 668.It Xo 669.Ic network 670.Pq Ic inet Ns | Ns Ic inet6 671.Ic static Op Ic set ... 672.Xc 673Announce all static routes. 674.El 675.Pp 676Each 677.Ic network 678statement may set default 679.Em AS path attributes : 680.Bd -literal -offset indent 681network 192.168.7.0/24 set localpref 220 682.Ed 683.Pp 684See also the 685.Sx ATTRIBUTE SET 686section. 687.Pp 688.Ic flowspec 689statements specify the flowspec rules that 690.Xr bgpd 8 691will announce as its own. 692.\"An announcement must also be permitted by the 693.\".Sx FILTER 694.\"rules. 695By default 696.Xr bgpd 8 697announces no flowspec rules. 698.Pp 699.Bl -tag -width Ds -compact 700.It Xo 701.Ic flowspec 702.Pq Ic inet Ns | Ns Ic inet6 703.Ar rule Op Ic set ... 704.Xc 705Announce an IPv4 or IPv6 specific flowspec 706.Ar rule 707including the 708.Em AS path attributes 709specified by 710.Ar set . 711.El 712.Pp 713The following rule parameters can be set. 714Most number arguments in the below rules can be specified as a 715list of ranges enclosed in curly brackets using these operators: 716.Bd -literal -offset indent 717= (equal, default) 718!= (unequal) 719< (less than) 720<= (less than or equal) 721> (greater than) 722>= (greater than or equal) 723- (range including boundaries) 724>< (except range) 725.Ed 726.Pp 727.Sq >< , 728and 729.Sq - 730are binary operators (they take two arguments). 731.Pp 732.Bl -tag -width Ds -compact 733.It Ic from Ar source Op Ic port Ar list 734.It Ic to Ar dest Op Ic port Ar list 735This rule applies only to packets with the specified source or 736destination addresses and ports. 737Addresses can be specified in CIDR notation (matching netblocks) or using 738.Cm any 739to match any address. 740In most cases a 741.Ic to 742address must be specified and be part of the announced networks. 743.Pp 744Ports can be specified either by number or by name. 745For example, port 80 can be specified as 746.Cm www . 747For a list of all port name to number mappings see the file 748.Pa /etc/services . 749.It Ic flags Ar a Ns / Ns Ar b 750This rule only applies to TCP packets that have the flags 751.Ar a 752set out of set 753.Ar b . 754Flags not specified in 755.Ar b 756are ignored. 757The flags are: (F)IN, (S)YN, (R)ST, (P)USH, (A)CK, (U)RG, (E)CE, and C(W)R. 758.It Ic fragment Ar a Ns / Ns Ar b 759This rule only applies to fragmented packets which match the specified flags. 760The flags are: (D)on't fragment, (I)s fragment, (F)irst fragment, and (L)ast 761fragment. 762.It Ic icmp-type Ar type Op Ic code Ar code 763.It Ic icmp6-type Ar type Op Ic code Ar code 764This rule only applies to ICMP or ICMP6 packets with the specified type 765and code. 766Text names for ICMP types and codes are listed in 767.Xr icmp 4 768and 769.Xr icmp6 4 . 770.It Ic length Ar pktlen 771This rule applies only to packets matching the specified 772.Ar pktlen . 773.It Ic proto Ar protocol 774This rule applies only to packets of this protocol. 775Common protocols are ICMP, ICMP6, TCP, and UDP. 776For a list of all the protocol name to number mappings see the file 777.Pa /etc/protocols . 778.It Ic tos Ar string Ns | Ns Ar number 779This rule applies to packets with the specified TOS bits set. 780.Ar string 781may be one of 782.Cm critical , 783.Cm inetcontrol , 784.Cm lowdelay , 785.Cm netcontrol , 786.Cm throughput , 787.Cm reliability , 788or one of the DiffServ Code Points: 789.Cm ef , 790.Cm af11 No ... Cm af43 , 791.Cm cs0 No ... Cm cs7 ; 792.Ar number 793may be either a hex or decimal number. 794.El 795.Pp 796The action taken when a flowspec rules matches depends on extended communities. 797For example to block all traffic either 798.Ic ext-community Ic flow-rate Ar as-number : Ns 0 799or 800.Ic ext-community Ic flow-pps Ar as-number : Ns 0 801need to be set. 802.Sh MPLS VPN CONFIGURATION 803A 804.Ic vpn 805section configures a router to participate in an MPLS Virtual Private Network. 806It specifies an 807.Xr mpe 4 808interface to use, a description, and various properties of the VPN: 809.Bd -literal -offset indent 810vpn "description" on mpe1 { 811 rd 65002:1 812 import-target rt 65002:42 813 export-target rt 65002:42 814 network 192.168.1/24 815} 816.Ed 817.Pp 818.Xr bgpd 8 819will not exchange VPN routes with a neighbor by default, see the 820.Sx NEIGHBORS AND GROUPS 821section. 822The description is used when logging but has no further meaning to 823.Xr bgpd 8 . 824.Pp 825The 826.Xr mpe 4 827interface will be used as the outgoing interface for routes to 828the VPN, and local networks will be announced with the MPLS label 829specified on the interface. 830The interface can provide VPN connectivity for another rdomain by 831being configured in that rdomain. 832The required rdomain must be configured on the interface before 833.Xr bgpd 8 834uses it. 835Multiple VPNs may be connected to a single rdomain, including the rdomain that 836.Xr bgpd 8 837is running in. 838.Pp 839An example 840.Xr hostname.if 5 841configuration for an 842.Xr mpe 4 843interface providing connectivity to rdomain 1: 844.Bd -literal -offset indent 845rdomain 1 846mplslabel 2000 847inet 192.198.0.1 255.255.255.255 848up 849.Ed 850.Pp 851The VPN properties are as follows: 852.Pp 853.Bl -tag -width Ds -compact 854.It Ic export-target Ar subtype as-number : Ns Ar local 855.It Ic export-target Ar subtype IP : Ns Ar local 856Classify announced networks by tagging them with an 857.Em extended community 858of the given arguments. 859The community 860.Ar subtype 861should be a 862.Em route target , 863.Ic rt , 864to ensure interoperability. 865The arguments are further detailed in the 866.Sx ATTRIBUTE SET 867section. 868More than one 869.Ic export-target 870can be specified. 871.Pp 872.It Xo 873.Ic fib-update 874.Pq Ic yes Ns | Ns Ic no 875.Xc 876If set to 877.Ic no , 878do not update the Forwarding Information Base, a.k.a. the kernel 879routing table. 880The default is 881.Ic yes . 882.Pp 883.It Ic import-target Ar subtype as-number : Ns Ar local 884.It Ic import-target Ar subtype IP : Ns Ar local 885The rdomain imports only those prefixes tagged with an 886.Em extended community 887matching an 888.Ic import-target . 889The community 890.Ar subtype 891should be a 892.Em route target , 893.Ic rt , 894to ensure interoperability. 895The arguments are further detailed in the 896.Sx ATTRIBUTE SET 897section. 898More than one 899.Ic import-target 900can be specified. 901.Pp 902.It Ic network Ar argument ... 903Announce the given networks within this VPN; 904see the 905.Sx NETWORK ANNOUNCEMENTS 906section. 907.Pp 908.It Ic rd Ar as-number : Ns Ar local 909.It Ic rd Ar IP : Ns Ar local 910The Route Distinguisher 911.Ic rd 912supplies BGP with namespaces to disambiguate VPN prefixes, as these needn't be 913globally unique. 914Unlike route targets, the 915.Ic rd 916neither identifies the origin of the prefix nor controls into 917which VPNs the prefix is distributed. 918The 919.Ar as-number 920or 921.Ar IP 922of a 923.Ic rd 924should be set to a number or IP that was assigned by an appropriate authority, 925whereas 926.Ar local 927can be chosen by the local operator. 928.El 929.Sh NEIGHBORS AND GROUPS 930.Xr bgpd 8 931establishes TCP connections to other BGP speakers called 932.Em neighbors . 933A neighbor and its properties are specified by a 934.Tg 935.Ic neighbor 936section: 937.Bd -literal -offset indent 938neighbor 10.0.0.2 { 939 remote-as 65002 940 descr "a neighbor" 941} 942.Ed 943.Pp 944Neighbors placed within a 945.Tg 946.Ic group 947section inherit the properties common to that group: 948.Bd -literal -offset indent 949group "peering AS65002" { 950 remote-as 65002 951 neighbor 10.0.0.2 { 952 descr "AS65002-p1" 953 } 954 neighbor 10.0.0.3 { 955 descr "AS65002-p2" 956 } 957} 958.Ed 959.Pp 960An entire network of neighbors may be accommodated by specifying an 961address/netmask pair: 962.Bd -literal -offset indent 963neighbor 10.0.0.0/8 964.Ed 965.Pp 966This is a 967.Em template 968that recognises as a neighbor any connection from within the given network. 969Such neighbors inherit their template's properties, except for their IP address. 970A template may omit 971.Ic remote-as ; 972.Xr bgpd 8 973then accepts any AS presented by the neighbor in the 974.Em OPEN 975message. 976.Pp 977The neighbor properties are as follows: 978.Pp 979.Bl -tag -width Ds -compact 980.It Xo 981.Ic announce 982.Pq Ic IPv4 Ns | Ns Ic IPv6 983.Pq Ic none Ns | Ns Ic unicast Ns | Ns Ic vpn Ns | Ns Ic flowspec 984.Op Ic enforce 985.Xc 986For the given address family, control which 987.Em subsequent address families 988are announced during the capabilities negotiation. 989Only routes for that address family and subsequent address families will be 990announced and processed. 991.Pp 992At the moment, only 993.Ic none , 994which disables the announcement of that address family, 995.Ic unicast , 996.Ic vpn , 997which allows the distribution of BGP MPLS VPNs, and 998.Ic flowspec , 999which allows the distribution of Flow Specification Rules, 1000are supported. 1001.Pp 1002The default is 1003.Ic unicast 1004for the same address family of the session. 1005.Pp 1006.It Xo 1007.Ic announce add-path recv 1008.Pq Ic yes Ns | Ns Ic no Ns | Ns Ic enforce 1009.Xc 1010If set to 1011.Ic yes , 1012the receive add-path capability is announced, which allows reception of multiple 1013paths per prefix. 1014The default is 1015.Ic no . 1016.Pp 1017.It Xo 1018.Ic announce add-path send 1019.Pq Ic no Ns | Ns Ic all 1020.Op Ic enforce 1021.Xc 1022.It Xo 1023.Ic announce add-path send 1024.Pq Ic best Ns | Ns Ic ecmp Ns | Ns Ic as-wide-best 1025.Op Ic plus Ar num 1026.Op Ic max Ar num 1027.Op Ic enforce 1028.Xc 1029If set to 1030.Ic all , 1031.Ic best , 1032.Ic ecmp , 1033or 1034.Ic as-wide-best , 1035the send add-path capability is announced, which allows sending multiple paths 1036per prefix. 1037The paths sent depend on which mode is selected: 1038.Pp 1039.Bl -tag -width as-wide-best -compact 1040.It Ic no 1041do not advertise add-path send capability 1042.It Ic all 1043send all valid paths 1044.It Ic best 1045send the best path 1046.It Ic ecmp 1047send paths with equal nexthop cost 1048.It Ic as-wide-best 1049send paths where the first 8 checks of the decision process match 1050.El 1051.Pp 1052.Ic plus 1053allows the inclusion of additional backup paths and works for 1054.Ic best , 1055.Ic ecmp , 1056and 1057.Ic as-wide-best . 1058.Ic max 1059can be used to limit the total amount of paths sent for 1060.Ic ecmp 1061and 1062.Ic as-wide-best . 1063Right now 1064.Ic ecmp 1065and 1066.Ic as-wide-best 1067are equivalent. 1068The default is 1069.Ic no . 1070If 1071.Ic add-path Ic send 1072is active then the setting of 1073.Ic rde Ic evaluate 1074is ignored. 1075.Pp 1076.It Xo 1077.Ic announce as-4byte 1078.Pq Ic yes Ns | Ns Ic no Ns | Ns Ic enforce 1079.Xc 1080If set to 1081.Ic no , 1082the 4-byte AS capability is not announced and so native 4-byte AS support is 1083disabled. 1084If 1085.Ic enforce 1086is set, the session will only be established if the neighbor also announces 1087the capability. 1088The default is 1089.Ic yes . 1090.Pp 1091.It Xo 1092.Ic announce enhanced refresh 1093.Pq Ic yes Ns | Ns Ic no Ns | Ns Ic enforce 1094.Xc 1095If set to 1096.Ic yes , 1097the enhanced route refresh capability is announced. 1098If 1099.Ic enforce 1100is set, the session will only be established if the neighbor also announces 1101the capability. 1102The default is 1103.Ic no . 1104.Pp 1105.It Xo 1106.Ic announce extended message 1107.Pq Ic yes Ns | Ns Ic no Ns | Ns Ic enforce 1108.Xc 1109If set to 1110.Ic yes , 1111the extended message capability is announced. 1112If negotiated, the default maximum message size is increased from 4096 to 65535 1113bytes. 1114If 1115.Ic enforce 1116is set, the session will only be established if the neighbor also announces 1117the capability. 1118The default is 1119.Ic no . 1120.Pp 1121.It Xo 1122.Ic announce extended nexthop 1123.Pq Ic yes Ns | Ns Ic no Ns | Ns Ic enforce 1124.Xc 1125If set to 1126.Ic yes , 1127the extended nexthop encoding capability is announced. 1128If negotiated, 1129.Ic IPv4 unicast 1130and 1131.Ic vpn 1132sessions can send paths with a IPv6 nexthop. 1133If 1134.Ic enforce 1135is set, the session will only be established if the neighbor also announces 1136the capability. 1137The default is 1138.Ic no . 1139.Pp 1140.It Xo 1141.Ic announce graceful notification 1142.Pq Ic yes Ns | Ns Ic no 1143.Xc 1144If set to 1145.Ic yes , 1146the graceful notification extension to graceful restart is announced. 1147The default is 1148.Ic no . 1149.Ic announce refresh 1150must be enabled to enable graceful notifications. 1151.Pp 1152.It Xo 1153.Ic announce policy 1154.Pq Ic yes Ns | Ns Ic no Ns | Ns Ic enforce 1155.Xc 1156If set to 1157.Ic yes , 1158add the open policy role capability. 1159If the role of the neighbor does not correspond to the expected role then 1160the session will be closed. 1161If 1162.Ic enforce 1163is set, the session will only be established if the neighbor also announces 1164the capability. 1165The default is 1166.Ic no . 1167.Pp 1168.It Xo 1169.Ic announce refresh 1170.Pq Ic yes Ns | Ns Ic no Ns | Ns Ic enforce 1171.Xc 1172If set to 1173.Ic no , 1174the route refresh capability is not announced. 1175If 1176.Ic enforce 1177is set, the session will only be established if the neighbor also announces 1178the capability. 1179The default is 1180.Ic yes . 1181.Pp 1182.It Xo 1183.Ic announce restart 1184.Pq Ic yes Ns | Ns Ic no Ns | Ns Ic enforce 1185.Xc 1186If set to 1187.Ic no , 1188the graceful restart capability is not announced. 1189Currently only the End-of-RIB marker is supported and announced by the 1190.Ic restart 1191capability. 1192If 1193.Ic enforce 1194is set, the session will only be established if the neighbor also announces 1195the capability. 1196The default is 1197.Ic yes . 1198.Pp 1199.It Xo 1200.Ic as-override 1201.Pq Ic yes Ns | Ns Ic no 1202.Xc 1203If set to 1204.Ic yes , 1205all occurrences of the neighbor AS in the 1206.Em AS path 1207will be replaced with the local AS before running the filters. 1208The Adj-RIB-In still holds the unmodified AS path. 1209The default value is 1210.Ic no . 1211.Pp 1212.It Ic demote Ar group 1213Increase the 1214.Xr carp 4 1215demotion counter on the given interface group, usually 1216.Ar carp , 1217when the session is not in state 1218.Em ESTABLISHED . 1219The demotion counter will be increased as soon as 1220.Xr bgpd 8 1221starts and decreased 122260 seconds after the session went to state 1223.Em ESTABLISHED . 1224For neighbors added at runtime, the demotion counter is only increased after 1225the session has been 1226.Em ESTABLISHED 1227at least once before dropping. 1228.Pp 1229For more information on interface groups, 1230see the 1231.Ic group 1232keyword in 1233.Xr ifconfig 8 . 1234.Pp 1235.It Ic depend on Ar interface 1236The neighbor session will be kept in state 1237.Em IDLE 1238as long as 1239.Ar interface 1240reports no link. 1241For 1242.Xr carp 4 1243interfaces, no link means that the interface is currently 1244.Em backup . 1245This is primarily intended to be used with 1246.Xr carp 4 1247to reduce failover times. 1248.Pp 1249The state of the network interfaces on the system can be viewed 1250using the 1251.Cm show interfaces 1252command to 1253.Xr bgpctl 8 . 1254.Pp 1255.It Ic descr Ar description 1256Add a description. 1257The description is used when logging neighbor events, in status 1258reports, for specifying neighbors, etc., but has no further meaning to 1259.Xr bgpd 8 . 1260.Pp 1261.It Ic down Op Ar reason 1262Do not start the session when 1263.Xr bgpd 8 1264comes up but stay in 1265.Em IDLE . 1266If the session is cleared at runtime, after a 1267.Ic down 1268.Ar reason 1269was configured at runtime, the 1270.Ar reason 1271is sent as Administrative Shutdown Communication. 1272The 1273.Ar reason 1274cannot exceed 255 octets. 1275.Pp 1276.It Xo 1277.Ic dump 1278.Pq Ic all Ns | Ns Ic updates 1279.Pq Ic in Ns | Ns Ic out 1280.Ar file Op Ar interval 1281.Xc 1282Dump ongoing BGP activity for a particular neighbor. 1283See also the 1284.Ic dump 1285setting in 1286.Sx GLOBAL CONFIGURATION . 1287.Pp 1288.It Xo 1289.Ic enforce local-as 1290.Pq Ic yes Ns | Ns Ic no 1291.Xc 1292If set to 1293.Ic no , 1294.Em AS paths 1295will not be checked for AS loop detection. 1296This feature is similar to allowas-in in some other BGP implementations. 1297Since there is no AS path loop check, this feature is dangerous, and 1298requires you to add filters to prevent receiving your own prefixes. 1299The default value is 1300.Ic yes . 1301.Pp 1302.It Xo 1303.Ic enforce neighbor-as 1304.Pq Ic yes Ns | Ns Ic no 1305.Xc 1306If set to 1307.Ic yes , 1308.Em AS paths 1309whose 1310.Em leftmost AS 1311is not equal to the 1312.Em remote AS 1313of the neighbor are rejected and a 1314.Em NOTIFICATION 1315is sent back. 1316The default value for IBGP peers is 1317.Ic no 1318otherwise the default is 1319.Ic yes . 1320.Pp 1321.It Xo 1322.Ic export 1323.Sm off 1324.Pq Ic none | default-route 1325.Sm on 1326.Xc 1327If set to 1328.Ic none , 1329no 1330.Em UPDATE 1331messages will be sent to the neighbor. 1332If set to 1333.Ic default-route , 1334only the default route will be announced to the neighbor. 1335.Pp 1336.It Ic holdtime Ar seconds 1337Set the holdtime in seconds. 1338Inherited from the global configuration if not given. 1339.Pp 1340.It Ic holdtime min Ar seconds 1341Set the minimal acceptable holdtime. 1342Inherited from the global configuration if not given. 1343.Pp 1344.It Xo 1345.Ic ipsec 1346.Pq Ic ah Ns | Ns Ic esp 1347.Pq Ic in Ns | Ns Ic out 1348.Ic spi Ar spi-number authspec Op Ar encspec 1349.Xc 1350Enable IPsec with static keying. 1351There must be at least two 1352.Ic ipsec 1353statements per peer with manual keying, one per direction. 1354.Ar authspec 1355specifies the authentication algorithm and key. 1356It can be 1357.Bd -literal -offset indent 1358sha1 <key> 1359md5 <key> 1360.Ed 1361.Pp 1362.Ar encspec 1363specifies the encryption algorithm and key. 1364.Ic ah 1365does not support encryption. 1366With 1367.Ic esp , 1368encryption is optional. 1369.Ar encspec 1370can be 1371.Bd -literal -offset indent 13723des <key> 13733des-cbc <key> 1374aes <key> 1375aes-128-cbc <key> 1376.Ed 1377.Pp 1378Keys must be given in hexadecimal format. 1379After changing settings, a session needs to be reset to use the new keys. 1380The 1381.Ic ipsec 1382flows only work with session using the default port 179. 1383.Pp 1384.It Xo 1385.Ic ipsec 1386.Pq Ic ah Ns | Ns Ic esp 1387.Ic ike 1388.Xc 1389Enable IPsec with dynamic keying. 1390In this mode, 1391.Xr bgpd 8 1392sets up the flows, and a key management daemon such as 1393.Xr isakmpd 8 1394is responsible for managing the session keys. 1395With 1396.Xr isakmpd 8 , 1397it is sufficient to copy the peer's public key, found in 1398.Pa /etc/isakmpd/local.pub , 1399to the local machine. 1400It must be stored in a file 1401named after the peer's IP address and must be stored in 1402.Pa /etc/isakmpd/pubkeys/ipv4/ . 1403The local public key must be copied to the peer in the same way. 1404As 1405.Xr bgpd 8 1406manages the flows on its own, it is sufficient to restrict 1407.Xr isakmpd 8 1408to only take care of keying by specifying the flags 1409.Fl Ka . 1410This can be done in 1411.Xr rc.conf.local 8 . 1412After starting the 1413.Xr isakmpd 8 1414and 1415.Xr bgpd 8 1416daemons on both sides, the session should be established. 1417After changing settings, a session needs to be reset to use the new keys. 1418The 1419.Ic ipsec 1420flows only work with session using the default port 179. 1421.Pp 1422.It Ic local-address Ar address 1423.It Ic no local-address 1424When 1425.Xr bgpd 8 1426initiates the TCP connection to the neighbor system, it normally does not 1427bind to a specific IP address. 1428If a 1429.Ic local-address 1430is given, 1431.Xr bgpd 8 1432binds to this address first. 1433.Ic no local-address 1434reverts back to the default. 1435.Pp 1436.It Ic local-as Ar as-number Op Ar as-number 1437Set the AS number sent to the remote system. 1438Used as described above under 1439.Sx GLOBAL CONFIGURATION 1440option 1441.Ic AS . 1442.Pp 1443Since there is no AS path loop check, this option is dangerous, and 1444requires you to add filters to prevent receiving your ASNs. 1445Intended to be used temporarily, for migrations to another AS. 1446.Pp 1447.It Ic log no 1448Disable neighbor specific logging. 1449.Pp 1450.It Ic log updates 1451Log received and sent updates for this neighbor. 1452.Pp 1453.It Xo 1454.Ic max-prefix Ar number 1455.Op Ic restart Ar number 1456.Xc 1457Terminate the session when the maximum 1458.Ar number 1459of prefixes received is exceeded 1460(no such limit is imposed by default). 1461If 1462.Ic restart 1463is specified, the session will be restarted after 1464.Ar number 1465minutes. 1466.Pp 1467.It Xo 1468.Ic max-prefix Ar number Ic out 1469.Op Ic restart Ar number 1470.Xc 1471Terminate the session when the maximum 1472.Ar number 1473of prefixes sent is exceeded 1474(no such limit is imposed by default). 1475If 1476.Ic restart 1477is specified, the session will be restarted after 1478.Ar number 1479minutes. 1480.Pp 1481.It Ic multihop Ar hops 1482Neighbors not in the same AS as the local 1483.Xr bgpd 8 1484normally have to be directly connected to the local machine. 1485If this is not the case, the 1486.Ic multihop 1487statement defines the maximum hops the neighbor may be away. 1488.Pp 1489.It Ic passive 1490Do not attempt to actively open a TCP connection to the neighbor system. 1491.Pp 1492.It Ic port Ar port 1493Connect to the peer using 1494.Ar port 1495instead of the default BGP port 179. 1496.Pp 1497.It Xo 1498.Ic reject Ic as-set 1499.Pq Ic yes Ns | Ns Ic no 1500.Xc 1501If set to 1502.Ic yes , 1503.Em AS paths 1504attributes containing 1505.Em AS_SET 1506path segments will be rejected and 1507all prefixes will be treated as withdraws. 1508The default is inherited from the global 1509.Ic reject Ic as-set 1510setting. 1511.Pp 1512.It Ic remote-as Ar as-number 1513Set the AS number of the remote system. 1514.Pp 1515.It Xo 1516.Ic rde Ic evaluate 1517.Pq Ic default Ns | Ns Ic all 1518.Xc 1519If set to 1520.Ar all , 1521keep evaluating alternative paths in case the selected path is filtered 1522out. 1523By default if a path is filtered by the output filters then no alternative 1524path is sent to this peer. 1525The default is inherited from the global 1526.Ic rde Ic evaluate 1527setting. 1528.Pp 1529.It Ic rib Ar name 1530Bind the neighbor to the specified RIB. 1531.Pp 1532.It Ic role Ar role 1533Set the local role for this eBGP session. 1534Setting a role is required for ASPA verification, the open policy role 1535capability and Only-To-Customer (OTC) attribute of RFC 9234. 1536The role can be one of 1537.Ar none , 1538.Ar provider , 1539.Ar customer , 1540.Ar rs , 1541.Ar rs-client , 1542or 1543.Ar peer . 1544If the role is set to 1545.Ar none 1546the 1547.Ic announce Ic policy 1548will also be disabled. 1549On iBGP session the role setting is ignored and forced to 1550.Ar none . 1551.Pp 1552.It Ic route-reflector Op Ar address 1553Act as an RFC 4456 1554.Em route-reflector 1555for this neighbor. 1556An optional cluster ID can be specified; otherwise the BGP ID will be used. 1557.Pp 1558.It Ic set Ar attribute ... 1559Set the 1560.Em AS path attributes 1561to some default per 1562.Ic neighbor 1563or 1564.Ic group 1565block: 1566.Bd -literal -offset indent 1567set localpref 300 1568.Ed 1569.Pp 1570See also the 1571.Sx ATTRIBUTE SET 1572section. 1573Set parameters are applied to the received prefixes; the only exceptions are 1574.Ic prepend-self , 1575.Ic nexthop no-modify 1576and 1577.Ic nexthop self . 1578These sets are rewritten into filter rules and can be viewed with 1579.Dq bgpd -nv . 1580.Pp 1581.It Ic staletime Ar seconds 1582Set the upper bound stale time in seconds for graceful restart. 1583Inherited from the global configuration if not given. 1584.Pp 1585.It Ic tcp md5sig password Ar secret 1586.It Ic tcp md5sig key Ar secret 1587Enable TCP MD5 signatures per RFC 2385. 1588The shared secret can either be given as a password or hexadecimal key. 1589.Bd -literal -offset indent 1590tcp md5sig password mekmitasdigoat 1591tcp md5sig key deadbeef 1592.Ed 1593After changing keys, a session needs to be reset to use the new keys. 1594.Pp 1595.It Xo 1596.Ic transparent-as 1597.Pq Ic yes Ns | Ns Ic no 1598.Xc 1599If set to 1600.Ic yes , 1601attribute transparency is enabled. 1602See also the 1603.Ic transparent-as 1604setting in 1605.Sx GLOBAL CONFIGURATION . 1606The default is inherited from the global 1607.Ic transparent-as 1608setting. 1609.Pp 1610.It Xo 1611.Ic ttl-security 1612.Pq Ic yes Ns | Ns Ic no 1613.Xc 1614Enable or disable ttl-security. 1615When enabled, 1616outgoing packets are sent using a TTL of 255 1617and a check is made against an incoming packet's TTL. 1618For directly connected peers, 1619incoming packets are required to have a TTL of 255, 1620ensuring they have not been routed. 1621For multihop peers, 1622incoming packets are required to have a TTL of 256 minus multihop distance, 1623ensuring they have not passed through more than the expected number of hops. 1624The default is 1625.Ic no . 1626.El 1627.Sh FILTER 1628.Xr bgpd 8 1629filters all BGP 1630.Em UPDATE 1631messages, including its own announcements, and blocks them by default. 1632Filter rules may match on neighbor, direction, 1633.Em prefix 1634or 1635.Em AS path attributes . 1636Filter rules may also modify 1637.Em AS path attributes . 1638.Pp 1639For each 1640.Em UPDATE 1641processed by the filter, the filter rules are evaluated in sequential order, 1642from first to last. 1643The last matching 1644.Ic allow 1645or 1646.Ic deny 1647rule decides what action is taken. 1648The default action is to deny. 1649.Pp 1650The following actions can be used in the filter: 1651.Bl -tag -width xxxxxxxx 1652.It Ic allow 1653The 1654.Em UPDATE 1655is passed. 1656.It Ic deny 1657The 1658.Em UPDATE 1659is blocked. 1660.It Ic match 1661Apply the filter attribute set without influencing the filter decision. 1662.El 1663.Sh PARAMETERS 1664The rule parameters specify the 1665.Em UPDATES 1666to which a rule applies. 1667An 1668.Em UPDATE 1669always comes from, or goes to, one neighbor. 1670Most parameters are optional, but each can appear at most once per rule. 1671If a parameter is specified, the rule only applies to packets with 1672matching attributes. 1673.Pp 1674.Bl -tag -width Ds -compact 1675.It Xo 1676.Ar as-type Op Ar operator 1677.Ar as-number 1678.Xc 1679.It Ar as-type Ic as-set Ar name 1680This rule applies only to 1681.Em UPDATES 1682where the 1683.Em AS path 1684matches. 1685The 1686part of the 1687.Em AS path 1688specified by the 1689.Ar as-type 1690is matched against the 1691.Ar as-number 1692or the 1693.Ic as-set Ar name : 1694.Pp 1695.Bl -tag -width transmit-as -compact 1696.It Ic AS 1697(any part) 1698.It Ic peer-as 1699(leftmost AS number) 1700.It Ic source-as 1701(rightmost AS number) 1702.It Ic transit-as 1703(all but the rightmost AS number) 1704.El 1705.Pp 1706.Ar as-number 1707is an AS number as explained above under 1708.Sx GLOBAL CONFIGURATION . 1709It may be set to 1710.Ic neighbor-as , 1711which is expanded to the current neighbor remote AS number, or 1712.Ic local-as , 1713which is expanded to the locally assigned AS number. 1714.Pp 1715When specifying an 1716.Ic as-set Ar name , 1717the AS path will instead be matched against all the AS numbers in the set. 1718.Pp 1719The 1720.Ar operator 1721can be unspecified (this case is identical to the equality operator), or one 1722of the numerical operators 1723.Bd -literal -offset indent 1724= (equal) 1725!= (unequal) 1726- (range including boundaries) 1727>< (except range) 1728.Ed 1729.Pp 1730>< and - 1731are binary operators (they take two arguments); with these, 1732.Ar as-number 1733cannot be set to 1734.Ic neighbor-as . 1735.Pp 1736Multiple 1737.Ar as-number 1738entries for a given type or 1739.Ar as-type as-number 1740entries may also be specified, 1741separated by commas or whitespace, 1742if enclosed in curly brackets: 1743.Bd -literal -offset indent 1744deny from any AS { 1, 2, 3 } 1745deny from any { AS 1, source-as 2, transit-as 3 } 1746deny from any { AS { 1, 2, 3 }, source-as 4, transit-as 5 } 1747.Ed 1748.Pp 1749.It Xo 1750.Ic avs 1751.Pq Ic valid | unknown | invalid 1752.Xc 1753This rule applies only to 1754.Em UPDATES 1755where the ASPA Validation State (AVS) matches. 1756.Pp 1757.It Xo 1758.Ic community 1759.Ar as-number Ns Li \&: Ns Ar local 1760.Xc 1761.It Ic community Ar name 1762This rule applies only to 1763.Em UPDATES 1764where the 1765.Ic community 1766path attribute is present and matches. 1767Communities are specified as 1768.Ar as-number : Ns Ar local , 1769where 1770.Ar as-number 1771is an AS number and 1772.Ar local 1773is a locally significant number between zero and 1774.Li 65535 . 1775Both 1776.Ar as-number 1777and 1778.Ar local 1779may be set to 1780.Sq * 1781to do wildcard matching. 1782Alternatively, well-known communities may be given by name instead and 1783include 1784.Ic BLACKHOLE , 1785.Ic GRACEFUL_SHUTDOWN , 1786.Ic NO_EXPORT , 1787.Ic NO_ADVERTISE , 1788.Ic NO_EXPORT_SUBCONFED , 1789and 1790.Ic NO_PEER . 1791Both 1792.Ar as-number 1793and 1794.Ar local 1795may be set to 1796.Ic neighbor-as , 1797which is expanded to the current neighbor remote AS number, or 1798.Ic local-as , 1799which is expanded to the locally assigned AS number. 1800.Pp 1801.It Xo 1802.Ic large-community 1803.Ar as-number : Ns Ar local : Ns Ar local 1804.Xc 1805This rule applies only to 1806.Em UPDATES 1807where the 1808.Ic Large community 1809path attribute is present and matches. 1810Communities are specified as 1811.Ar as-number : Ns Ar local : Ns Ar local , 1812where 1813.Ar as-number 1814is an AS number and 1815.Ar local 1816is a locally significant number between zero and 1817.Li 4294967295 . 1818Both 1819.Ar as-number 1820and 1821.Ar local 1822may be set to 1823.Sq * 1824to do wildcard matching, 1825.Ic neighbor-as , 1826which is expanded to the current neighbor remote AS number, or 1827.Ic local-as , 1828which is expanded to the locally assigned AS number. 1829.Pp 1830.It Xo 1831.Ic ext-community 1832.Ar subtype as-number : Ns Ar local 1833.Xc 1834.It Xo 1835.Ic ext-community 1836.Ar subtype IP : Ns Ar local 1837.Xc 1838.It Xo 1839.Ic ext-community 1840.Ar subtype numvalue 1841.Xc 1842.It Xo 1843.Ic ext-community 1844.Ic ovs 1845.Pq Ic valid | not-found | invalid 1846.Xc 1847This rule applies only to 1848.Em UPDATES 1849where the 1850.Em extended community 1851path attribute is present and matches. 1852Extended Communities are specified by a 1853.Ar subtype 1854and normally two values, a globally unique part (e.g. the AS number) and a 1855local part. 1856Both 1857.Ar as-number 1858and 1859.Ar local 1860may be set to 1861.Ic neighbor-as , 1862which is expanded to the current neighbor remote AS number, or 1863.Ic local-as , 1864which is expanded to the locally assigned AS number. 1865Wildcard matching is supported for 1866.Ar local , 1867.Ar numvalue 1868and 1869.Ar subtype . 1870If wildcard matching is used on the 1871.Ar subtype 1872then 1873.Ar numvalue 1874also needs to be set to 1875.Sq * . 1876See also the 1877.Sx ATTRIBUTE SET 1878section for further information about the encoding. 1879.Pp 1880.It Xo 1881.Pq Ic from Ns | Ns Ic to 1882.Ar peer 1883.Xc 1884This rule applies only to 1885.Em UPDATES 1886coming from, or going to, this particular neighbor. 1887This parameter must be specified. 1888.Ar peer 1889is one of the following: 1890.Pp 1891.Bl -tag -width "group descr" -compact 1892.It Ic any 1893Any neighbor will be matched. 1894.It Ic ibgp 1895All 1896.Em IBGP 1897neighbors will be matched. 1898.It Ic ebgp 1899All 1900.Em EBGP 1901neighbors will be matched. 1902.It Ar address 1903Neighbors with this address will be matched. 1904.It Ic group Ar descr 1905Neighbors in this group will be matched. 1906.It Ic AS Ar as-number 1907Neighbors with this AS will be matched. 1908.El 1909.Pp 1910Multiple 1911.Ar peer 1912entries may also be specified, 1913separated by commas or whitespace, 1914if enclosed in curly brackets: 1915.Bd -literal -offset indent 1916deny from { 128.251.16.1, 251.128.16.2, group hojo } 1917.Ed 1918.Pp 1919.It Pq Ic inet Ns | Ns Ic inet6 1920Match only routes in the IPv4 or IPv6 address families, respectively. 1921.Ic inet 1922is an alias for 1923.Qq prefix 0.0.0.0/0 prefixlen >= 0 ; 1924.Ic inet6 1925is an alias for 1926.Qq prefix ::/0 prefixlen >= 0 . 1927.Pp 1928.It Ic max-as-len Ar len 1929This rule applies only to 1930.Em UPDATES 1931where the 1932.Em AS path 1933has more than 1934.Ar len 1935elements. 1936.Pp 1937.It Ic max-as-seq Ar len 1938This rule applies only to 1939.Em UPDATES 1940where a single 1941.Em AS number 1942is repeated more than 1943.Ar len 1944times. 1945.Pp 1946.It Ic max-communities Ns | Ns Ic max-large-communities Ns | \ 1947Ns Ic max-ext-communities Ar num 1948This rule applies only to 1949.Em UPDATES 1950where the 1951.Em Basic , 1952.Em Large , 1953or 1954.Em Extended Community 1955attribute has more than 1956.Ar num 1957elements. 1958.Pp 1959.It Ic nexthop Ar address 1960This rule applies only to 1961.Em UPDATES 1962where the nexthop is equal to 1963.Ar address . 1964The 1965.Ar address 1966can be set to 1967.Em neighbor 1968in which case the nexthop is compared against the address of the neighbor. 1969Nexthop filtering is not supported on locally announced networks and one must 1970take into consideration previous rules overwriting nexthops. 1971.Pp 1972.It Ic origin-set Ar name 1973This rule applies only to 1974.Em UPDATES 1975that match the given origin-set 1976.Ar name . 1977.Pp 1978.It Xo 1979.Ic ovs 1980.Pq Ic valid | not-found | invalid 1981.Xc 1982This rule applies only to 1983.Em UPDATES 1984where the Origin Validation State (OVS) matches. 1985.Pp 1986.It Ic prefix Ar address Ns Li / Ns Ar len 1987.It Ic prefix Ar address Ns Li / Ns Ar len Ic prefixlen Ar range 1988.It Ic prefix Ar address Ns Li / Ns Ar len Ic or-longer 1989.It Ic prefix Ar address Ns Li / Ns Ar len Ic maxlen Ar mlen 1990This rule applies only to 1991.Em UPDATES 1992for the specified prefix. 1993.Pp 1994Multiple entries may be specified, 1995separated by commas or whitespace, 1996if enclosed in curly brackets: 1997.Bd -literal -offset indent 1998deny from any prefix { 192.168.0.0/16, 10.0.0.0/8 or-longer } 1999.Ed 2000.Pp 2001Multiple lists can also be specified, which is useful for 2002macro expansion: 2003.Bd -literal -offset indent 2004good="{ 192.168.0.0/16, 172.16.0.0/12, 10.0.0.0/8 }" 2005bad="{ 224.0.0.0/4 prefixlen >= 4, 240.0.0.0/4 prefixlen >= 4 }" 2006ugly="{ 127.0.0.1/8, 169.254.0.0/16 }" 2007 2008deny from any prefix { $good $bad $ugly } 2009.Ed 2010.Pp 2011Prefix length ranges are specified by using these operators: 2012.Bd -literal -offset indent 2013= (equal) 2014!= (unequal) 2015< (less than) 2016<= (less than or equal) 2017> (greater than) 2018>= (greater than or equal) 2019- (range including boundaries) 2020>< (except range) 2021.Ed 2022.Pp 2023>< and - 2024are binary operators (they take two arguments). 2025For instance, to match all prefix lengths >= 8 and <= 12, and hence the 2026CIDR netmasks 8, 9, 10, 11 and 12: 2027.Bd -literal -offset indent 2028prefixlen 8-12 2029.Ed 2030.Pp 2031Or, to match all prefix lengths < 8 or > 12, and hence the CIDR netmasks 20320\(en7 and 13\(en32: 2033.Bd -literal -offset indent 2034prefixlen 8><12 2035.Ed 2036.Pp 2037This will match all prefixes in the 10.0.0.0/8 netblock with netmasks longer 2038than 16: 2039.Bd -literal -offset indent 2040prefix 10.0.0.0/8 prefixlen > 16 2041.Ed 2042.Pp 2043.Ic or-longer 2044is a shorthand for: 2045.Bd -literal -offset indent 2046.Ic prefix Ar address Ns Li / Ns Ar len Ic prefixlen >= Ar len 2047.Ed 2048.Pp 2049.Ic maxlen Ar mlen 2050is a shorthand for: 2051.Bd -literal -offset indent 2052.Ic prefix Ar address Ns Li / Ns Ar len Ic prefixlen <= Ar mlen 2053.Ed 2054.Pp 2055.It Ic prefix-set Ar name Op Ic or-longer 2056This rule applies only to 2057.Em UPDATES 2058that match the given prefix-set 2059.Ar name . 2060With 2061.Ic or-longer , 2062the 2063.Em UPDATES 2064will match any prefix in the prefix-set where 2065.Bd -literal -offset indent 2066.Ic address Ns Li / Ns Ar len Ic prefixlen >= Ar len 2067.Ed 2068.Pp 2069.It Ic quick 2070If an 2071.Em UPDATE 2072matches a rule which has the 2073.Ic quick 2074option set, this rule is considered the last matching rule, and evaluation 2075of subsequent rules is skipped. 2076.Pp 2077.It Ic rib Ar name 2078Apply rule only to the specified RIB. 2079This only applies for received updates, so not for rules using the 2080.Ar to peer 2081parameter. 2082.Pp 2083.It Ic set Ar attribute ... 2084All matching rules can set the 2085.Em AS path attributes 2086to some default. 2087The set of every matching rule is applied, not only the last matching one. 2088See also the following section. 2089.El 2090.Sh ATTRIBUTE SET 2091.Em AS path attributes 2092can be modified with 2093.Ic set . 2094.Pp 2095.Ic set 2096can be used on 2097.Ic network 2098statements, in 2099.Ic neighbor 2100or 2101.Ic group 2102blocks, and on filter rules. 2103Attribute sets can be expressed as lists. 2104.Pp 2105The following attributes can be modified: 2106.Pp 2107.Bl -tag -width Ds -compact 2108.It Xo 2109.Ic community Op Ar delete 2110.Ar as-number : Ns Ar local 2111.Xc 2112.It Xo 2113.Ic community Op Ar delete 2114.Ar name 2115.Xc 2116Set or delete the 2117.Em COMMUNITIES 2118AS path attribute. 2119Communities are specified as 2120.Ar as-number : Ns Ar local , 2121where 2122.Ar as-number 2123is an AS number and 2124.Ar local 2125is a locally significant number between zero and 2126.Li 65535 . 2127Alternately, well-known communities may be specified by name: 2128.Ic GRACEFUL_SHUTDOWN , 2129.Ic NO_EXPORT , 2130.Ic NO_ADVERTISE , 2131.Ic NO_EXPORT_SUBCONFED , 2132or 2133.Ic NO_PEER . 2134For 2135.Cm delete , 2136both 2137.Ar as-number 2138and 2139.Ar local 2140may be set to 2141.Sq * 2142to do wildcard matching. 2143.Pp 2144.It Xo 2145.Ic large-community Op Ar delete 2146.Ar as-number : Ns Ar local : Ns Ar local 2147.Xc 2148.It Xo 2149.Ic large-community Op Ar delete 2150.Ar name 2151.Xc 2152Set or delete the 2153.Em Large Communities 2154path attribute. 2155Communities are specified as 2156.Ar as-number : Ns Ar local : Ns Ar local , 2157where 2158.Ar as-number 2159is an AS number and 2160.Ar local 2161is a locally significant number between zero and 2162.Li 4294967295 . 2163For 2164.Cm delete , 2165both 2166.Ar as-number 2167and 2168.Ar local 2169may be set to 2170.Sq * 2171to do wildcard matching. 2172.Pp 2173.It Xo 2174.Ic ext-community Op Ar delete 2175.Ar subtype as-number : Ns Ar local 2176.Xc 2177.It Xo 2178.Ic ext-community Op Ar delete 2179.Ar subtype IP : Ns Ar local 2180.Xc 2181.It Xo 2182.Ic ext-community Op Ar delete 2183.Ar subtype numvalue 2184.Xc 2185.It Xo 2186.Ic ext-community Op Ar delete 2187.Ic ovs 2188.Pq Ic valid | not-found | invalid 2189.Xc 2190Set or delete the 2191.Em Extended Community 2192AS path attribute. 2193Extended Communities are specified by a 2194.Ar subtype 2195and normally two values, a globally unique part (e.g. the AS number) and a 2196local part. 2197The type is selected depending on the encoding of the global part. 2198Two-octet AS Specific Extended Communities and Four-octet AS Specific Extended 2199Communities are encoded as 2200.Ar as-number : Ns Ar local . 2201Four-octet encoding is used if the 2202.Ar as-number 2203is bigger than 65535 or if the AS_DOT encoding is used. 2204IPv4 Address Specific Extended Communities are encoded as 2205.Ar IP : Ns Ar local . 2206Opaque Extended Communities are encoded with a single numeric value. 2207The 2208.Ar ovs 2209subtype can only be set to 2210.Ar valid , 2211.Ar not-found , 2212or 2213.Ar invalid . 2214Currently the following subtypes are supported: 2215.Bd -literal -offset indent 2216bdc BGP Data Collection 2217defgw Default Gateway 2218esi-lab ESI Label 2219esi-rt ES-Import Route Target 2220l2vid L2VPN Identifier 2221mac-mob MAC Mobility 2222odi OSPF Domain Identifier 2223ort OSPF Route Type 2224ori OSPF Router ID 2225ovs BGP Origin Validation State 2226rt Route Target 2227soo Route Origin / Source of Origin 2228srcas Source AS 2229vrfri VRF Route Import 2230.Ed 2231.Pp 2232Not all type and subtype value pairs are allowed by IANA and the parser 2233will ensure that no invalid combination is created. 2234.Pp 2235For 2236.Cm delete , 2237.Ar subtype , 2238.Ar numvalue , 2239or 2240.Ar local , 2241may be set to 2242.Sq * 2243to do wildcard matching. 2244If wildcard matching is used on the 2245.Ar subtype 2246then 2247.Ar numvalue 2248also needs to be set to 2249.Sq * . 2250.Pp 2251.It Ic localpref Ar number 2252Set the 2253.Em LOCAL_PREF 2254AS path attribute. 2255If 2256.Ar number 2257starts with a plus or minus sign, 2258.Em LOCAL_PREF 2259will be adjusted by adding or subtracting 2260.Ar number ; 2261otherwise it will be set to 2262.Ar number . 2263The default is 100. 2264.Pp 2265.It Ic med Ar number 2266.It Ic metric Ar number 2267Set the 2268.Em MULTI_EXIT_DISC 2269AS path attribute. 2270If 2271.Ar number 2272starts with a plus or minus sign, 2273.Em MULTI_EXIT_DISC 2274will be adjusted by adding or subtracting 2275.Ar number ; 2276otherwise it will be set to 2277.Ar number . 2278.Pp 2279.It Xo 2280.Ic origin 2281.Sm off 2282.Pq Ic igp | egp | incomplete 2283.Sm on 2284.Xc 2285Set the 2286.Em ORIGIN 2287AS path attribute to mark the source of this 2288route as being injected from an igp protocol, an egp protocol 2289or being an aggregated route. 2290.Pp 2291.It Xo 2292.Ic nexthop 2293.Sm off 2294.Pq Ar address | Ic blackhole | reject | self | no-modify 2295.Sm on 2296.Xc 2297Set the 2298.Em NEXTHOP 2299AS path attribute 2300to a different nexthop address or use blackhole or reject routes. 2301.Em blackhole 2302and 2303.Em reject 2304only affect the FIB and will not alter the nexthop address. 2305.Em self 2306forces the nexthop to be set to the local interface address. 2307If set to 2308.Em no-modify , 2309the nexthop attribute is not modified for EBGP multihop sessions. 2310By default EBGP multihop sessions use the local interface address. 2311On other IBGP and directly connected EBGP sessions 2312.Em no-modify 2313is ignored. 2314The set 2315.Ar address 2316is used on IBGP session and on directly connected EBGP session if the 2317.Ar address 2318is part of the connected network. 2319On EBGP multihop session 2320.Em no-modify 2321has to be set to force the nexthop to 2322.Ar address . 2323.Bd -literal -offset indent 2324set nexthop 192.168.0.1 2325set nexthop blackhole 2326set nexthop reject 2327set nexthop no-modify 2328set nexthop self 2329.Ed 2330.Pp 2331.It Ic pftable Ar table 2332Add the prefix in the update to the specified 2333.Xr pf 4 2334table, regardless of whether or not the path was selected for routing. 2335This option may be useful in building realtime blacklists. 2336.Pp 2337.It Ic prepend-neighbor Ar number 2338Prepend the neighbor's AS 2339.Ar number 2340times to the 2341.Em AS path . 2342.Pp 2343.It Ic prepend-self Ar number 2344Prepend the local AS 2345.Ar number 2346times to the 2347.Em AS path . 2348.Pp 2349.It Ic rtlabel Ar label 2350Add the prefix to the kernel routing table with the specified 2351.Ar label . 2352.Pp 2353.It Ic weight Ar number 2354The 2355.Em weight 2356is used to tip prefixes with equally long AS paths in one or 2357the other direction. 2358A prefix is weighed at a very late stage in the decision process. 2359If 2360.Ar number 2361starts with a plus or minus sign, the 2362.Em weight 2363will be adjusted by adding or subtracting 2364.Ar number ; 2365otherwise it will be set to 2366.Ar number . 2367.Em Weight 2368is a local non-transitive attribute, and is a 2369.Xr bgpd 8 Ns -specific 2370extension. 2371For prefixes with equally long paths, the prefix with the larger weight 2372is selected. 2373.El 2374.Sh FILES 2375.Bl -tag -width "/etc/examples/bgpd.conf" -compact 2376.It Pa /etc/bgpd.conf 2377.Xr bgpd 8 2378configuration file. 2379.It Pa /etc/examples/bgpd.conf 2380Example configuration file. 2381.El 2382.Sh SEE ALSO 2383.Xr strftime 3 , 2384.Xr ipsec 4 , 2385.Xr pf 4 , 2386.Xr rdomain 4 , 2387.Xr tcp 4 , 2388.Xr bgpctl 8 , 2389.Xr bgpd 8 , 2390.Xr ipsecctl 8 , 2391.Xr isakmpd 8 , 2392.Xr rc.conf.local 8 2393.Sh HISTORY 2394The 2395.Nm 2396file format first appeared in 2397.Ox 3.5 . 2398