BGP的路由过滤和社团属性

目录

一、BGP的路由过滤

二、BGP的社团属性（打标记）

---

一、BGP的路由过滤

1.使用前缀列表进行过滤

配置命令: [r1]ip ip-prefix aa deny 192.168.1.0 24

[r1]ip ip-prefix aa permit 0.0.0.0 0 less-equal 32

[r1-bgp]peer 12.0.0.2 ip-prefix aa export

2.使用路由策略进行过滤

配置命令：[r2]ip ip-prefix aa permit 192.168.2.0 24

[r2]route-policy aa deny node 10

Info: New Sequence of this List.

[r2-route-policy]if-match ip-prefix aa

[r2-route-policy]q

[r2]route-policy aa permit node 20

Info: New Sequence of this List.

[r2-route-policy]q

[r2-bgp]peer 12.0.0.1 route-policy aa import

3.使用filter-policy（过滤列表）进行过滤

配置命令：[r3-acl-basic-2000]rule deny source 192.168.3.0 0—注意：使用过滤列表时，抓取流量的列表必须使用拒绝动作

[r3-acl-basic-2000]rule permit source any—注意：对于不需要过滤的流量，一定要进行放通

[r3-bgp]peer 13.0.0.1 filter-policy 2000 import

二、BGP的社团属性（打标记）

社团属性—由32位二进制构成（四个字节）—使用十进制表示或AS：NN—一条路由条目可以同时打多个社团属性

公有社团属性：①0X00000000（十六进制）—0—“internet”—所有的BGP路由默认都打上了名称为“internet”的社团属性（补充：0b—二进制、0o—八进制）

              ②0XFFFFFF02—“no-advertise”—如果BGP路由打上该社团属性，则代表不允许通告给其他的BGP对等体

              ③0XFFFFFF01—“no-export”—如果BGP路由打上该社团属性，则将不允许通告给自己的EBGP对等体（不包括联邦的EBGP对等体）

              ④0XFFFFFF03—“no-export-subconfed”—如果BGP路由打上该社团属性，则将不允许通告给自己的EBGP对等体（包括联邦的EBGP对等体）

[r1]route-policy com permit node 10

Info: New Sequence of this List.

[r1-route-policy]apply community ?

INTEGER<0-4294967295> Specify community number

STRING<3-11> Specify aa<0-65535>:nn<0-65535>

internet Internet(well-known community attributes)

no-advertise Do not advertise to any peer (well-known community

attributes)

no-export Do not export to external peers(well-known community

attributes)

no-export-subconfed Do not send outside a sub-confederation(well-known

community attributes)

none No community attribute

[r1-route-policy]apply community no-advertise

[r1-route-policy]q

[r1-bgp]peer 12.0.0.2 route-policy com export

[r1-bgp]peer 12.0.0.2 advertise-community—开启社团属性的传递功能

需求：AS1中分别创建

172.16.0.0/24，172.16.1.0/24，172.16.2.0/24,172.16.3.0/24

0.0和1.0带上1：11的社团属性，2.0和3.0带上1：22的社团属性

要求：1：11社团的路由不传递；1：22的路由no_export

①做社团属性的策略

[r1]route-policy com1 permit node 10

Info: New Sequence of this List.

[r1-route-policy]apply community 1:11

[r1-route-policy]q

[r1]route-policy com2 permit node 10

Info: New Sequence of this List.

[r1-route-policy]apply community 1:22

②发布路由

network 172.16.0.0 255.255.255.0 route-policy com1

network 172.16.1.0 255.255.255.0 route-policy com1

network 172.16.2.0 255.255.255.0 route-policy com2

network 172.16.3.0 255.255.255.0 route-policy com2

③依靠社团属性抓取流量—community-filter

[r1]ip community-filter 1 permit 1:11

[r1]ip community-filter 2 permit 1:22

④做路由策略

[r1]route-policy aaa deny node 10

Info: New Sequence of this List.

[r1-route-policy]if-match community-filter 1

[r1-route-policy]q

[r1]route-policy aaa permit node 20

Info: New Sequence of this List.

[r1-route-policy]if-match community-filter 2

[r1-route-policy]apply community no-export ?

INTEGER<0-4294967295> Specify community number

STRING<3-11> Specify aa<0-65535>:nn<0-65535>

additive Add to the existing community

internet Internet(well-known community attributes)

no-advertise Do not advertise to any peer (well-known community

attributes)

no-export Do not export to external peers(well-known community

attributes)

no-export-subconfed Do not send outside a sub-confederation(well-known

community attributes)

<cr> Please press ENTER to execute command

[r1-route-policy]apply community no-export additive

[r1-route-policy]q

[r1]route-policy aaa permit node 30

[r1-route-policy]q

⑤调用

[r1-bgp]peer 12.0.0.2 route-policy aaa export