O'Reilly logo

ScreenOS Cookbook by Sunil Wadhwa, Joe Kelly, Ken Draper, David Delcourt, Vik Davar, Stefan Brunner

Stay ahead with the world's most comprehensive technology and business learning platform.

With Safari, you learn the way you learn best. Get unlimited access to videos, live online training, learning paths, books, tutorials, and more.

Start Free Trial

No credit card required

17.9. Filter Route Announcements from BGP Peers

Problem

You want to filter the route announcements from a BGP peer.

Solution

This solution builds on the EBGP configuration from Recipe 17.6 and applies a route map in ScreenOS to filter the prefixes received from an EBGP peer, as shown in Figure 17-8.

Filtering inbound BGP route announcements

Figure 17-8. Filtering inbound BGP route announcements

First, make sure you have correctly assigned the interface zone, IP address, and mode on the ScreenOS firewall's BGP-speaking interface:

	External_fw-> set interface ethernet0/0 zone Untrust
	External_fw-> set interface ethernet0/0 ip 10.0.0.1/24
	External_fw->set interface ethernet0/0 route

Next, define the router ID, enable BGP with the correct local AS number, and define the set of networks that this BGP instance can advertise to its peers:

	External_fw-> set vrouter trust-vr
	External_fw(trust-vr)-> set router-id 10.1.1.1
	External_fw(trust-vr)-> set protocol bgp 64515
	External_fw(trust-vr/bgp)-> set enable
	External_fw(trust-vr/bgp)->exit

Then, define the access list that specifies the prefixes that will be accepted from the ISP router peer and a route map that references the access list:

	External_fw(trust-vr)-> set access-list 3 permit ip 10.9.8.0/24 1
	External_fw(trust-vr)-> set access-list 3 permit default-route 2
	External_fw(trust-vr)-> set route-map name inbound-from-isp permit 10
	External_fw(trust-vr/inbound-from-isp-10)-> set match ip ...

With Safari, you learn the way you learn best. Get unlimited access to videos, live online training, learning paths, books, interactive tutorials, and more.

Start Free Trial

No credit card required