There is a knob called "allow" under the Border Gateway Protocol (BGP) protocol group <> stanza. This knob enables BGP to accept sessions initiated by the remote peer in a specified subnet. Sometimes, this feature can be mixed up with the firewall filter for incoming BGP sessions. However, it is not designed for filtering purposes.
This article explains how this option works with the help of an example.
Refer to the BGP Feature Guide for more details.
In the configuration statement below, 2 BGP peers are configured; one follows the neighbor knob, the other follows the allow knob. Although peer IP address is identical, the configuration works independently and does not share attributes or the other property of the session.
set protocols bgp group BGP neighbor 10.10.10.22 metric-out 900 set protocols bgp group BGP allow 10.10.10.22/32
The sample configuration below has metric-out configured in the statement with "neighbor". A parameter in metric-out becomes effective only when configuration with "neighbor" is in use and it does not when configuration with "allow" is in use. (With the configuration above, consequent BGP session depends on how BGP session is initiated.)
root@switch> show bgp neighbor Peer: 10.10.10.22+49436 AS 65001 Local: 10.10.10.1+179 AS 65000 <-- Local listens on port 179, this is established by "allow" knob. Type: External State: Established Flags: <Unconfigured Sync> Last State: OpenConfirm Last Event: RecvKeepAlive Last Error: None Options: <Preference PeerAS Refresh> Holdtime: 90 Preference: 170 <-- No MED parameter used because setting was only in 'neighbor' line. Number of flaps: 0 Peer ID: 172.16.0.2 Local ID: 172.16.0.1 Active Holdtime: 90 Keepalive Interval: 30 Group index: 0 Peer index: 0 BFD: disabled, down Local Interface: ge-0/0/0.0 NLRI for restart configured on peer: inet-unicast NLRI advertised by peer: inet-unicast NLRI for this session: inet-unicast Peer supports Refresh capability (2) Stale routes from peer are kept for: 300 Peer does not support Restarter functionality NLRI that restart is negotiated for: inet-unicast NLRI of received end-of-rib markers: inet-unicast NLRI of all end-of-rib markers sent: inet-unicast Peer supports 4 byte AS extension (peer-as 65001) Peer does not support Addpath Table inet.0 Bit: 10000 RIB State: BGP restart is complete Send state: in sync Active prefixes: 0 Received prefixes: 0 Accepted prefixes: 0 Suppressed due to damping: 0 Advertised prefixes: 0 Last traffic (seconds): Received 17 Sent 23 Checked 60 Input messages: Total 31 Updates 1 Refreshes 0 Octets 637 Output messages: Total 32 Updates 0 Refreshes 0 Octets 671 Output Queue[0]: 0 Trace options: all Trace file: /var/log/BGP-TRACE size 131072 files 10
With the allow option, BGP always works in a passive manner because this configuration is to accept dynamic BGP sessions. The behavior is similar to the "passive" knob, but the Flag is different. See the example below.
Note: This is the normal output, without "allow" or "passive".
set protocols bgp group BGP-GROUP peer-as 65001 set protocols bgp group BGP-GROUP neighbor 10.10.10.22 root@switch> show bgp neighbor Peer: 10.10.10.22+49436 AS 65001 Local: 10.10.10.1+179 AS 65000 Type: External State: Established Flags: <Sync> <-- Flag shows "Sync". Last State: OpenConfirm Last Event: RecvKeepAlive Last Error: None Options: <Preference PeerAS Refresh> Holdtime: 90 Preference: 170 Number of flaps: 0 Peer ID: 172.16.0.2 Local ID: 172.16.0.1 Active Holdtime: 90 Keepalive Interval: 30 Group index: 0 Peer index: 0 BFD: disabled, down Local Interface: ge-0/0/0.0 NLRI for restart configured on peer: inet-unicast NLRI advertised by peer: inet-unicast NLRI for this session: inet-unicast Peer supports Refresh capability (2) Stale routes from peer are kept for: 300 Peer does not support Restarter functionality NLRI that restart is negotiated for: inet-unicast NLRI of received end-of-rib markers: inet-unicast NLRI of all end-of-rib markers sent: inet-unicast Peer supports 4 byte AS extension (peer-as 65001) Peer does not support Addpath Table inet.0 Bit: 10000 RIB State: BGP restart is complete Send state: in sync Active prefixes: 0 Received prefixes: 0 Accepted prefixes: 0 Suppressed due to damping: 0 Advertised prefixes: 0 Last traffic (seconds): Received 3 Sent 15 Checked 15 Input messages: Total 90 Updates 1 Refreshes 0 Octets 1758 Output messages: Total 90 Updates 0 Refreshes 0 Octets 1773 Output Queue[0]: 0 Trace options: all Trace file: /var/log/BGP-TRACE size 131072 files 10
set protocols bgp group BGP-EXT peer-as 65000 set protocols bgp group BGP-EXT allow 10.10.10.0/24 root@switch-2> show bgp neighbor Peer: 10.10.10.1+179 AS 65000 Local: 10.10.10.22+49436 AS 65001 Group: BGP-EXT Routing-Instance: master Forwarding routing-instance: master Type: External State: Established Flags: <Unconfigured Sync> <-- Flag shows "Unconfigured Sync". Last State: OpenConfirm Last Event: RecvKeepAlive Last Error: None Options: <PeerAS Refresh> Options: <GracefulShutdownRcv> Holdtime: 90 Preference: 170 Graceful Shutdown Receiver local-preference: 0 Number of flaps: 0 Peer ID: 172.16.0.1 Local ID: 172.16.0.2 Active Holdtime: 90 Keepalive Interval: 30 Group index: 0 Peer index: 0 SNMP index: 0 I/O Session Thread: bgpio-0 State: Enabled BFD: disabled, down Local Interface: ge-0/0/0.0 NLRI for restart configured on peer: inet-unicast NLRI advertised by peer: inet-unicast NLRI for this session: inet-unicast Peer supports Refresh capability (2) Stale routes from peer are kept for: 300 Peer does not support Restarter functionality NLRI that restart is negotiated for: inet-unicast NLRI of received end-of-rib markers: inet-unicast NLRI of all end-of-rib markers sent: inet-unicast Peer does not support LLGR Restarter or Receiver functionality Peer supports 4 byte AS extension (peer-as 65000) Peer does not support Addpath NLRI(s) enabled for color nexthop resolution: inet-unicast Table inet.0 Bit: 20000 RIB State: BGP restart is complete Send state: in sync Active prefixes: 0 Received prefixes: 0 Accepted prefixes: 0 Suppressed due to damping: 0 Advertised prefixes: 0 Last traffic (seconds): Received 9 Sent 21 Checked 2709 Input messages: Total 103 Updates 1 Refreshes 0 Octets 1961 Output messages: Total 102 Updates 0 Refreshes 0 Octets 1942 Output Queue[1]: 0 (inet.0, inet-unicast)
set protocols bgp group BGP-EXT peer-as 65000 set protocols bgp group BGP-EXT neighbor 10.10.10.1 passive root@switch-2> show bgp neighbor Peer: 10.10.10.1+179 AS 65000 Local: 10.10.10.22+49436 AS 65001 Group: BGP-EXT Routing-Instance: master Forwarding routing-instance: master Type: External State: Established Flags: <Sync> <-- Flag shows "Sync"; same as plain configuration Last State: OpenConfirm Last Event: RecvKeepAlive Last Error: None Options: <Passive PeerAS Refresh> <-- Options field has "Passive" parameter Options: <GracefulShutdownRcv> Holdtime: 90 Preference: 170 Graceful Shutdown Receiver local-preference: 0 Number of flaps: 0 Peer ID: 172.16.0.1 Local ID: 172.16.0.2 Active Holdtime: 90 Keepalive Interval: 30 Group index: 0 Peer index: 0 SNMP index: 0 I/O Session Thread: bgpio-0 State: Enabled BFD: disabled, down Local Interface: ge-0/0/0.0 NLRI for restart configured on peer: inet-unicast NLRI advertised by peer: inet-unicast NLRI for this session: inet-unicast Peer supports Refresh capability (2) Stale routes from peer are kept for: 300 Peer does not support Restarter functionality NLRI that restart is negotiated for: inet-unicast NLRI of received end-of-rib markers: inet-unicast NLRI of all end-of-rib markers sent: inet-unicast Peer does not support LLGR Restarter or Receiver functionality Peer supports 4 byte AS extension (peer-as 65000) Peer does not support Addpath NLRI(s) enabled for color nexthop resolution: inet-unicast Table inet.0 Bit: 20000 RIB State: BGP restart is complete Send state: in sync Active prefixes: 0 Received prefixes: 0 Accepted prefixes: 0 Suppressed due to damping: 0 Advertised prefixes: 0 Last traffic (seconds): Received 3 Sent 6 Checked 3328 Input messages: Total 126 Updates 1 Refreshes 0 Octets 2398 Output messages: Total 125 Updates 0 Refreshes 0 Octets 2379 Output Queue[1]: 0 (inet.0, inet-unicast)
If the neighbors' IP address is out of range of the subnet specified in the "allow" setting, BGP sends a notification with the reason "Connection attempt from unconfigured neighbor".
Note: This is the correct scenario traceoptions log. The neighbor is in the correct range.
set protocols bgp group BGP-EXT peer-as 65000 set protocols bgp group BGP-EXT allow 10.10.10.0/24 root@switch-2> show log BGP-TRACE Aug 8 11:19:23.006187 task_process_events_internal: accept ready for BGP_Listen.0.0.0.0+179 Aug 8 11:19:23.006312 task_accept: task BGP_Listen.0.0.0.0+179 socket 76 addr 0.0.0.0+179 Aug 8 11:19:23.007738 task_alloc: allocated task block for BGP_Proto priority 50 Aug 8 11:19:23.007781 bgp_listen_accept: Connection with incoming ifl 0x60bc880 instance 0x5158000(master) Aug 8 11:19:23.007833 task_set_option_internal: task BGP_Proto.10.10.10.1+55323 socket 78 option TOS(16) value 192 Aug 8 11:19:23.007930 bgp_listen_accept: accepting connection from 10.10.10.1+55323 (local 10.10.10.22+179) Aug 8 11:19:23.007961 task_set_socket: task BGP_Proto.10.10.10.1+55323 socket 78 Aug 8 11:19:23.008327 task_create: BGP_Proto.10.10.10.1+55323 socket 78 Aug 8 11:19:23.008379 task_set_option_internal: task BGP_Proto.10.10.10.1+55323 socket 78 option NonBlocking(8) value 1 Aug 8 11:19:23.008416 task_set_option_internal: task BGP_Proto.10.10.10.1+55323 socket 78 option RecvBuffer(0) value 16384 Aug 8 11:19:23.008445 task_set_option_internal: task BGP_Proto.10.10.10.1+55323 socket 78 option SendBuffer(1) value 16384 Aug 8 11:19:23.008475 task_set_option_internal: task BGP_Proto.10.10.10.1+55323 socket 78 option Linger(2) value { 0, 0 } Aug 8 11:19:23.008550 task_timer_ucreate: created timer BGP_Proto.10.10.10.1+55323_Task parent flags <> Aug 8 11:19:23.008580 task_timer_ucreate: created timer BGP_Proto.10.10.10.1+55323_OpenTimeOut flags <> Aug 8 11:19:23.008642 task_timer_uset: timer BGP_Proto.10.10.10.1+55323_OpenTimeOut <Touched> set to interval 1:30 with jitter 0 at 11:20:53.008580 Aug 8 11:19:23.008718 task_process_events_internal: recv ready for BGP_Proto.10.10.10.1+55323 Aug 8 11:19:23.008797 task_process_events_internal: recv ready for BGP_Proto.10.10.10.1+55323 Aug 8 11:19:23.008888 Aug 8 11:19:23.008888 BGP RECV 10.10.10.1+55323 -> 10.10.10.22+179 Aug 8 11:19:23.008933 BGP RECV message type 1 (Open) length 59 Aug 8 11:19:23.010437 BGP RECV version 4 as 65000 holdtime 90 id 172.16.0.1 parmlen 30 Aug 8 11:19:23.010581 BGP RECV MP capability AFI=1, SAFI=1 Aug 8 11:19:23.010642 BGP RECV Refresh capability, code=128 Aug 8 11:19:23.010669 BGP RECV Refresh capability, code=2 Aug 8 11:19:23.010697 BGP RECV Restart capability, code=64, time=120, flags= Aug 8 11:19:23.010727 BGP RECV 4 Byte AS-Path capability (65), as_num 65000 Aug 8 11:19:23.010822 bgp_parse_4byte_aspath_cap():253 AS4-Peer (RECV): 4 byte AS capability received, AS 65000 Aug 8 11:19:23.011171 bgp_ifachange_sharedif_register: ifachange: inst master, ifaddr (NULL) ifachange: inst master, ifaddr(0x5c064c0), link ge-0/0/0.0, 10.10.10.22/24, local 10.10.10.22 idx 2147453976: Register for sharedif
Note: This is the wrong scenario traceoptions log. The router does not accept the out-of-range address and sends a notification. The following messages will be seen:
set protocols bgp group test peer-as 1 set protocols bgp group test allow 10.10.10.0 /29 Sep 17 13:01:44.636812 bgp_listen_accept: Connection attempt from unconfigured neighbor: 10.10.10.11+51498 Sep 17 13:01:44.637047 BGP SEND 10.10.10.22+179 -> 10.10.10.11+51498 Sep 17 13:01:44.637049 BGP SEND message type 3 (Notification) length 21 Sep 17 13:01:44.637056 BGP SEND Notification code 6 (Cease) subcode 5 (Connection Rejected) Sep 17 13:01:44.637085 bgp_listen_accept:5276: NOTIFICATION sent to 10.10.10.11+51498 (proto): code 6 (Cease) subcode 5 ( Connection Rejected ), Reason: Connection attempt from unconfigured neighbor: 10.10.10.11+51498 Sep 17 13:01:44.637088 Notify sent to 10.10.10.11+51498 (proto), code 6, subcode 5
2022-09-12: Validated lab, and modified IPs for RFC compliance. Article is valid and relevant.