...
| Блок кода |
|---|
esr(config)# interface gi1/0/2 esr(config-if-gi)# security-zone LAN esr(config-if-gi)# ip address 192.168.100.2/30 esr(config-if-gi)# exit |
| Scroll Pagebreak |
|---|
...
| Якорь | ||||
|---|---|---|---|---|
|
BGP configuration
BGP protocol is designed to exchange subnet reachability information among autonomous systems (AS), i.e. device groups united under a single technical control that uses interdomain routing protocol for defining packet delivery routes to other AS. Transmitted information includes a list of AS that are accessible through this system. Selection of the optimal routes is based on effective rules for the network.
...
Step | Description | Command | Keys |
|---|---|---|---|
1 | Configure BGP precedence for the main routing table (optional). | esr(config)# ip protocols bgp preference <VALUE> | <VALUE> – protocol precedence, takes values in the range of [1..255]. Default value: BGP (170). |
2 | Configure the BGP routing table capacity (not required when using the global routing table). | esr(config)# ip protocols bgp max-routes <VALUE> | <VALUE> – amount of BGP routes in the routing table, takes values in the range of:
The default value for the global routing table:
Default value for VRF: 0. |
esr(config)# ipv6 protocols bgp max-routes <VALUE> | |||
esr(config-vrf)# ip protocols bgp max-routes <VALUE> | |||
esr(config-vrf)# ipv6 protocols bgp max-routes <VALUE> | |||
3 | Enable the output of BGP neighbor state information (optional). | esr(config)# router bgp log-neighbor-changes | |
esr(config)# ipv6 router bgp log-neighbor-changes | |||
4 | Enable ECMP and define the maximum amount of equal routes to a destination point. | esr(config)# router bgp maximum-paths <VALUE> | <VALUE> – amount of valid equal routes to the target, takes the values of [1..16]. |
5 | Select the filtering method for the information transmitted between routers (mandatory when configuring eBGP to announce subnets). | ||
If route-map-based filtering method is selected, create a list of rules that will be used to filter the advertised and received IP routes in the future. | esr(config)# route-map <NAME> | <NAME> – configured routing rule name, set by the string of up to 31 characters. | |
Create rule | (config-route-map)# rule <ORDER> | <ORDER> – rule number, takes values of [1..10000]. | |
Define the list of subnets affected by the rule. | esr(config-route-map-rule)#match ip address { <ADDR/LEN> | object-group <OBJ-GRP-NETNAME> } [ { eq <LEN> | le <LEN> | ge <LEN 1> [ le <LEN 2> ] } ] | <ADDR/LEN> – IP address and subnet mask, in the format of. AAA.BBB.CCC.DDD/EE – network IP address with prefix mask, where AAA-DDD take values of [0..255] and EE takes values of [1..32]; <IPV6-ADDR/LEN> – IPv6 address and subnet mask, in the format of: X:X:X:X::X/EE, where each X part takes values in hexadecimal format [0..FFFF] and EE takes values of [1..128]; <OBJ-GRP-NETNAME> – IP addresses profile name, set by the string of up to 31 characters*; <LEN>, <LEN 1>, <LEN 2> – prefix length, may take values [1..32] in prefix IP lists for IPv4 and [1..128] for IPv6; eq – when specifying the command, the prefix length mast match the specified one; le – when specifying the command, the prefix length mast be less than or match the specified one; ge – when specifying the command, the prefix length mast be more than or match the specified one; ge <LEN 1> le <LEN 2> – When specifying a command, the prefix length must be greater than or equal to <LEN> but less than or equal to <LEN1>. * When using object-group filtering, they must be created in advance. | |
esr(config-route-map-rule)#match ipv6 address { <IPV6-ADDR/LEN> | object-group <OBJ-GRP-NETNAME> } [ { eq <LEN> | le <LEN> | ge <LEN 1> [ le <LEN 2> ] } ] | |||
Permit or deny action for the specified subnets in the rule. | esr(config-route-map-rule)# action {deny | permit} | ||
If prefix-list-based filtering method is selected, create a list of IP networks that will be used to filter the advertised and received IP routes in the future. | esr(config)# ip prefix-list <NAME> | <NAME> – name of a subnet list being configured, set by the string of up to 31 characters. | |
esr(config)# ipv6 prefix-list <NAME> | |||
Permit or deny the prefixes lists. | esr(config-pl)# permit { <ADDR/LEN> | object-group <OBJ-GRP-NETNAME>} [ { eq <LEN> | le <LEN> | ge <LEN 1> [ le <LEN 2> ] } ] | <ADDR/LEN> – IP address and subnet mask, in the format of. AAA.BBB.CCC.DDD/EE – network IP address with prefix mask, where AAA-DDD take values of [0..255] and EE takes values of [1..32]; <IPV6-ADDR/LEN> – IPv6 address and subnet mask, in the format of: X:X:X:X::X/EE, where each X part takes values in hexadecimal format [0..FFFF] and EE takes values of [1..128]; <OBJ-GRP-NETNAME> – IP addresses profile name, set by the string of up to 31 characters*; <LEN>, <LEN 1>, <LEN 2> – prefix length, may take values [1..32] in prefix IP lists for IPv4 and [1..128] for IPv6; eq – when specifying the command, the prefix length mast match the specified one; le – when specifying the command, the prefix length mast be less than or match the specified one; ge – when specifying the command, the prefix length mast be more than or match the specified one; ge <LEN 1> le <LEN 2> – When specifying a command, the prefix length must be greater than or equal to <LEN> but less than or equal to <LEN1>. * When using object-group filtering, they must be created in advance. | |
esr(config-pl)# deny {<ADDR/LEN> | object-group <OBJ-GRP-NETNAME>} [ { eq <LEN> | le <LEN> | ge <LEN 1> [ le <LEN 2> ] } ] | |||
esr(config-ipv6-pl)# permit { <IPV6-ADDR/LEN> | object-group <OBJ-GRP-NETNAME>} [ { eq <LEN> | le <LEN> | ge <LEN 1> [ le <LEN 2> ] } ] | |||
esr(config-ipv6-pl)# deny {<IPV6-ADDR/LEN> | object-group <OBJ-GRP-NETNAME> } [ { eq <LEN> | le <LEN> | ge <LEN 1> [ le <LEN 2> ] } ] | |||
6 | Add BGP process to the system and switch to the BGP process parameters configuration mode. | esr(config)# router bgp <AS> | <AS> – stand alone system number, takes values of [1..4294967295]. |
7 | Set the router identifier. | esr(config-bgp)# router-id { <ID> | <IF> | <TUN> } | <ID> – router identifier, defined as AAA.BBB.CCC.DDD where each part takes values of [0..255]. <IF> – interface. <TUN> – tunnel name. |
8 | Set the Route-Reflector identifier of the cluster to which the router BGP process belongs (if necessary). | esr(config-bgp)# cluster-id <ID> | <ID> – Route-Reflector cluster identifier, defined as AAA.BBB.CCC.DDD where each part takes values of [0..255]. |
9 | Enable generation and sending of a default route, if the default route is in the FIB routing table (optional). | esr(config-bgp)# default-information-originate | |
10 | Set the time interval after which the connection with the opposing party is checked (optional). | esr(config-bgp-af)# timers keepalive <TIME> | <TIME> – time in seconds, takes values of [1..65535]. Default value: 60 seconds. |
11 | Set time interval after which the opposing party is considered to be unavailable (optional). | esr(config-bgp-af)# timers holdtime <TIME> | <TIME> – time in seconds, takes values of [1..65535]. Default value: 180 seconds. |
12 | Set the time of minimum and maximum delay during which it is prohibited to establish a connection in order to prevent frequent disconnections (optional). | esr(config-bgp-af)# timers error-wait <TIME1> <TIME2> | <TIME1> – minimum delay time in seconds, takes values of [1..65535]. <TIME2> – maximum delay time in seconds, takes values of [1..65535]. |
13 | Define the global algorithm of neighbor authentication (if necessary). | esr(config-bgp)# authentication algorithm <ALGORITHM> | <ALGORITHM> – encryption algorithm:
Default value: encryption is not used. |
14 | Set a global password for authentication with neighbors (used in conjunction with 'authentication algorithm'). | esr(config-bgp)# authentication key ascii-text { <CLEAR-TEXT> | encrypted <ENCRYPTED-TEXT> } | <CLEAR-TEXT> – password, set by the string of 8 to 16 characters; <ENCRYPTED-TEXT> – encrypted password of 8 to 16 bytes (from 16 to 32 characters) in hexadecimal format (0xYYYY ...) or (YYYY ...). |
15 | Enable BGP process. | esr(config-bgp)# enable | |
16 | Define the type of configured routing information and switch to this configuration mode. | esr(config-bgp)# address-family { ipv4 | ipv6 } unicast | ipv 4 – IPv4 family; ipv 6 – IPv6 family; |
17 | Enable route advertising by BGP process obtained alternatively (if necessary). | esr(config-bgp-af)# redistribute static [ route-map <NAME> ] | <NAME> – name of the route map that will be used for advertised static routes filtration and modification, set by the string of up to 31 characters. |
esr(config-bgp-af)# redistribute connected [ route-map <NAME> ] | <NAME> – name of the route map that will be used for filtration and modification of advertised directly connected subnets, set by the string of up to 31 characters. | ||
esr(config-bgp-af)# redistribute rip [ route-map <NAME> ] | <NAME> – name of the route map that will be used for advertised RIP routes filtration and modification, set by the string of up to 31 characters. | ||
esr(config-bgp-af)# redistribute ospf <ID> <ROUTE-TYPE 1> [<ROUTE-TYPE 2>] [<ROUTE-TYPE 3>] [<ROUTE-TYPE 4>] [ route-map <NAME> ] | <ID> – process number, takes values of {1..65535}; <ROUTE-TYPE> – route type:
<NAME> – name of the route map that will be used for advertised OSFP routes filtration and modification, set by the string of up to 31 characters. | ||
esr(config-bgp-af)# redistribute bgp <AS> [ route-map <NAME> ] | <AS> – stand alone system number, takes values of [1..4294967295]. <NAME> – name of the route map that will be used for advertised BGP routes filtration and modification, set by the string of up to 31 characters. | ||
18 | Enable subnets advertising. | esr(config-bgp-af)# network <ADDR/LEN> | <ADDR/LEN> – subnet address, set in one of the following formats:
|
19 | Exit global BGP process route information advertisement configuration mode. | esr(config-bgp-af)# exit | |
20 | Add BGP neighbor and switch to the BGP process parameters configuration mode. | esr(config-bgp)# neighbor <ADDR>|<IPV6-ADDR> | <ADDR> – neighbor’s IP address, defined as AAA.BBB.CCC.DDD where each part takes values of [0..255]; <IPV6-ADDR> – client IPv6 address, defined as X:X:X:X::X where each part takes values in hexadecimal format [0..FFFF]. |
21 | Specify neighbor description (optional). | esr(config-bgp-neighbor)# description <DESCRIPTION> | <DESCRIPTION> – neighbor description, set by the string of up to 255 characters. |
22 | Set the time interval after which the connection with the opposing party is checked (optional). | esr(config-bgp-neighbor)# timers keepalive <TIME> | <TIME> – time in seconds, takes values of [1..65535]. Default value: 60 seconds. |
23 | Set time interval after which the opposing party is considered to be unavailable (optional). | esr(config-bgp- neighbor)# timers holdtime <TIME> | <TIME> – time in seconds, takes values of [1..65535]. Default value: 180 seconds. |
24 | Set the time of minimum and maximum delay during which it is prohibited to establish a connection in order to prevent frequent disconnections (optional). | esr(config-bgp-af)# timers error-wait <TIME1> <TIME2> | <TIME1> – minimum delay time in seconds, takes values of [1..65535]. <TIME2> – maximum delay time in seconds, takes values of [1..65535]. Default value: 60 and 300 seconds |
25 | Set the number of BGP neighbor stand alone system. | esr(config-bgp-neighbor)# remote-as <AS> | <AS> – stand alone system number, takes values of [1..4294967295]. |
26 | Allow connections to neighbors that are located not in directly connected subnets (optional). | esr(config-bgp-neighbor)# ebgp-multihop <NUM> | <NUM> – maximum amount of hops when installing EBGP (used for TTL). |
27 | Specify BGP neighbor as a Route-Reflector client (optional). | esr(config-bgp-neighbor)# route-reflector-client | |
28 | Set IP/IPv6 router address that will be used as source IP/IPv6 address in transmitted BGP route information updates (optional). | esr(config-bgp-neighbor)# update-source { <ADDR> | <IPV6-ADDR> } | <ADDR> – source IP address, defined as AAA.BBB.CCC.DDD where each part takes values of [0..255]; <IPV6-ADDR> – source IPv6 address, defined as X:X:X:X::X where each part takes values in hexadecimal format [0..FFFF]. <IF> – interface. <TUN> – tunnel name. |
29 | Enable the mode in which the reception of routes in the BGP attribute, AS Path of which includes the numbers of process stand alone system, is allowed (optional). | esr(config-bgp-neighbor)# allow-local-as <NUMBER> | <NUMBER> – threshold amount of instances of autonomous system number in the AS Path attribute at which the route will be accepted, the range of acceptable values [1..10]. |
30 | Enable the BFD protocol on the configured BGP neighbor (optional, used in conjunction with the update-source parameter). | esr(config-bgp-neighbor)# bfd-enable | |
31 | Specify neighbor authentication algorithm (optional). | esr(config-bgp-neighbor)# authentication algorithm <ALGORITHM> | <ALGORITHM> – encryption algorithm: md5 – password is encrypted by md5 algorithm. |
32 | Set the password for neighbor authentication (optional). | esr(config-bgp-neighbor)# authentication key ascii-text { <CLEAR-TEXT> | encrypted <ENCRYPTED-TEXT> } | <CLEAR-TEXT> – password, set by the string of 8 to 16 characters; <ENCRYPTED-TEXT> – encrypted password of 8 to 16 bytes (from 16 to 32 characters) in hexadecimal format (0xYYYY ...) or (YYYY ...). |
33 | Make neighborhood active. | esr(config-bgp-neighbor)# enable | |
34 | Define the type of neighbor configured routing information and switch to this configuration mode. | esr(config-bgp-neighbor)# address-family { ipv4 | ipv6 | vpnv4 } unicast | ipv 4 – IPv4 family; ipv 6 – IPv6 family; vpnv4 – VPNv4 family. |
35 | If prefix list filtering mode is selected, add subnet filtering in incoming or outgoing updates ( Mandatory when configuring eBGP for subnet advertisement). | esr(config-bgp-neighbor-af)# prefix-list <PREFIX-LIST-NAME> { in | out } | <PREFIX-LIST-NAME> – name of a subnet list being configured, set by the string of up to 31 characters. in – incoming routes filtering; out – outgoing routes filtering. |
36 | Set the mode in which the default route is always sent to the BGP neighbor in the update along with other routes (optional, none for vpnv4). | esr(config-bgp-neighbor-af)# default-originate | |
37 | Set the mode in which all updates are sent to BGP neighbor with the IP address of a local router outgoing interface as the next-hop (optional, none for vpnv4). | esr(config-bgp-neighbor-af)# next-hop-self | |
38 | Define the precedence of the routes received from a neighbor (optional). | esr(config-bgp-neighbor-af)# preference <VALUE> | <VALUE> – neighbor routes precedence, takes values in the range of [1..255]. Default value: 170. |
39 | Set the mode in which private numbers of autonomous systems are removed from the AS Path routes BGP attribute before sending an update (in accordance with RFC 6996) (optional, none for vpnv4). | esr(config-bgp-neighbor-af)# remove-private-as [ { all | nearest | replace } ] | all – remove all private AS number from AS-path; nearest – replace the nearest private AS in the AS-path with a nearby public AS; replace – replace all private AS numbers with the number of the current BGP process. Default value: all. |
40 | Enable routing information exchange. | esr(config-bgp-neighbor-af)# enable |
...
When configuring iBGP, it is common to have multiple BGP neighbors with the same parameters within a single BGP process. To avoid configuration redundancy, it is recommended to use BGP peer-group in which common parameters can be described and it is easy to identify the BGP peer-group membership in the BGP neighbor configuration.
...
| Блок кода |
|---|
esr(config)# security zone-pair vrf-sec vrf-sec esr(config-zone-pair)# rule 1 esr(config-zone-rule)# match source-address any esr(config-zone-rule)# match destination-address any esr(config-zone-rule)# match protocol udp esr(config-zone-rule)# match source-port any esr(config-zone-rule)# match destination-port any esr(config-zone-rule)# action permit esr(config-zone-rule)# enable esr(config-zone-rule)# exit esr(config-zone-pair)# rule 2 esr(config-zone-rule)# match source-address any esr(config-zone-rule)# match destination-address any esr(config-zone-rule)# match protocol tcp esr(config-zone-rule)# match source-port any esr(config-zone-rule)# match destination-port any esr(config-zone-rule)# action permit esr(config-zone-rule)# enable esr(config-zone-rule)# exit |
...
Create interface mapping, assign IP addresses, specify an inherence to a security zone:
...