Description

This article provides information on Basic BGP prefix filtering within logical system

Symptoms

BGP is a path vector routing protocol used to exchange routing information among routers in same and different Autonomous Systems (AS).
BGP operates over TCP port 179. Exchanging routes on the Internet through BGP requires a fair bit of trust in the downstream organization to only send routes they are authoritative for.

Without proper filtering, anyone can announce Google's 8.8.8.0/24 route and potentially redirect this critical DNS traffic back to a rogue location.

 
Screenshot 2023-10-17 at 10.40.26 PM.png

Considering the above topology, the following step by step configuration enables basic BGP prefix filtering. Use it to deny all prefixes and only allow subnets properly authorized by the BGP neighbor.
 
Considering the above topology, the following step by step configuration enables basic BGP prefix filtering. Use it to deny all prefixes and only allow subnets properly authorized by the BGP neighbor.

Enabling Tunnel Services -
set chassis fpc 0 pic 0 tunnel-services bandwidth 10g 


Juniper vMX-1:LogicalSystem-1

set logical-systems LogicalSystem-1 interfaces lt-0/0/0 unit 101 description "LogicalSystem-2 P2P Interface"
set logical-systems LogicalSystem-1 interfaces lt-0/0/0 unit 101 encapsulation ethernet
set logical-systems LogicalSystem-1 interfaces lt-0/0/0 unit 101 peer-unit 201
set logical-systems LogicalSystem-1 interfaces lt-0/0/0 unit 101 family inet address 10.1.1.1/24    

Export in Bgp Group 

set logical-systems LogicalSystem-1 protocols bgp group remote-peers-group-b type external
set logical-systems LogicalSystem-1 protocols bgp group remote-peers-group-b export export-local-prefixes
set logical-systems LogicalSystem-1 protocols bgp group remote-peers-group-b neighbor 10.1.1.2 peer-as 64513

Prefix-list 

set logical-systems LogicalSystem-1 policy-options prefix-list local-prefixes 10.100.0.0/16
set logical-systems LogicalSystem-1 policy-options prefix-list local-prefixes 10.101.0.0/16
set logical-systems LogicalSystem-1 policy-options prefix-list local-prefixes 10.102.0.0/16
set logical-systems LogicalSystem-1 policy-options prefix-list local-prefixes 10.103.0.0/16
set logical-systems LogicalSystem-1 policy-options prefix-list local-prefixes 10.104.0.0/16
set logical-systems LogicalSystem-1 policy-options prefix-list local-prefixes 10.105.0.0/16

set logical-systems LogicalSystem-1 policy-options policy-statement export-local-prefixes term 1 from prefix-list local-prefixes
set logical-systems LogicalSystem-1 policy-options policy-statement export-local-prefixes term 1 then accept

Local-prefixes

set logical-systems LogicalSystem-1 routing-options static route 10.100.0.0/16 discard
set logical-systems LogicalSystem-1 routing-options static route 10.101.0.0/16 discard
set logical-systems LogicalSystem-1 routing-options static route 10.102.0.0/16 discard
set logical-systems LogicalSystem-1 routing-options static route 10.103.0.0/16 discard
set logical-systems LogicalSystem-1 routing-options static route 10.104.0.0/16 discard
set logical-systems LogicalSystem-1 routing-options static route 10.105.0.0/16 discard

set logical-systems LogicalSystem-1 routing-options autonomous-system 64512

Juniper vMX-1:LogicalSystem-2

set logical-systems LogicalSystem-2 interfaces lt-0/0/0 unit 201 description "LogicalSystem-1 P2P Interface"
set logical-systems LogicalSystem-2 interfaces lt-0/0/0 unit 201 encapsulation ethernet
set logical-systems LogicalSystem-2 interfaces lt-0/0/0 unit 201 peer-unit 101
set logical-systems LogicalSystem-2 interfaces lt-0/0/0 unit 201 family inet address 10.1.1.2/24

set logical-systems LogicalSystem-2 protocols bgp group remote-peers-group-a type external
set logical-systems LogicalSystem-2 protocols bgp group remote-peers-group-a neighbor 10.1.1.1 peer-as 64512

Prefix-list

set logical-systems LogicalSystem-2 policy-options prefix-list local-prefixes 10.200.0.0/16
set logical-systems LogicalSystem-2 policy-options prefix-list local-prefixes 10.201.0.0/16
set logical-systems LogicalSystem-2 policy-options prefix-list local-prefixes 10.202.0.0/16
set logical-systems LogicalSystem-2 policy-options prefix-list local-prefixes 10.203.0.0/16
set logical-systems LogicalSystem-2 policy-options prefix-list local-prefixes 10.204.0.0/16
set logical-systems LogicalSystem-2 policy-options prefix-list local-prefixes 10.205.0.0/16

Export in BGP Group

set logical-systems LogicalSystem-2 policy-options policy-statement export-local-prefixes term 1 from prefix-list local-prefixes
set logical-systems LogicalSystem-2 policy-options policy-statement export-local-prefixes term 1 then accept

set logical-systems LogicalSystem-2 routing-options static route 10.200.0.0/16 discard
set logical-systems LogicalSystem-2 routing-options static route 10.201.0.0/16 discard
set logical-systems LogicalSystem-2 routing-options static route 10.202.0.0/16 discard
set logical-systems LogicalSystem-2 routing-options static route 10.203.0.0/16 discard
set logical-systems LogicalSystem-2 routing-options static route 10.204.0.0/16 discard
set logical-systems LogicalSystem-2 routing-options static route 10.205.0.0/16 discard

set logical-systems LogicalSystem-2 routing-options autonomous-system 64513


Verification of exported routes :

user@juniper-vMX-1:LogicalSystem-1> show route advertising-protocol bgp 10.1.1.2

inet.0: 8 destinations, 8 routes (8 active, 0 holddown, 0 hidden)
  Prefix                  Nexthop              MED     Lclpref    AS path
* 10.100.0.0/16           Self                                    I
* 10.101.0.0/16           Self                                    I
* 10.102.0.0/16           Self                                    I
* 10.103.0.0/16           Self                                    I
* 10.104.0.0/16           Self                                    I
* 10.105.0.0/16           Self                                    I


user@juniper-vMX-1:LogicalSystem-2> show route advertising-protocol bgp 10.1.1.1

inet.0: 14 destinations, 14 routes (14 active, 0 holddown, 0 hidden)
  Prefix                  Nexthop              MED     Lclpref    AS path
* 10.200.0.0/16           Self                                    I
* 10.201.0.0/16           Self                                    I
* 10.202.0.0/16           Self                                    I
* 10.203.0.0/16           Self                                    I
* 10.204.0.0/16           Self                                    I
* 10.205.0.0/16           Self                                    I

Imported routes before BGP prefix filtering:

user@juniper-vMX-1:LogicalSystem-1> show route receive-protocol bgp 10.1.1.2 

inet.0: 14 destinations, 14 routes (14 active, 0 holddown, 0 hidden)
  Prefix                  Nexthop              MED     Lclpref    AS path
* 10.200.0.0/16           10.1.1.2                                64513 I
* 10.201.0.0/16           10.1.1.2                                64513 I
* 10.202.0.0/16           10.1.1.2                                64513 I
* 10.203.0.0/16           10.1.1.2                                64513 I
* 10.204.0.0/16           10.1.1.2                                64513 I
* 10.205.0.0/16           10.1.1.2                                64513 I

inet6.0: 1 destinations, 1 routes (1 active, 0 holddown, 0 hidden)


user@juniper-vMX-1:LogicalSystem-2> show route receive-protocol bgp 10.1.1.1

inet.0: 14 destinations, 14 routes (14 active, 0 holddown, 0 hidden)
  Prefix                  Nexthop              MED     Lclpref    AS path
* 10.100.0.0/16           10.1.1.1                                64512 I
* 10.101.0.0/16           10.1.1.1                                64512 I
* 10.102.0.0/16           10.1.1.1                                64512 I
* 10.103.0.0/16           10.1.1.1                                64512 I
* 10.104.0.0/16           10.1.1.1                                64512 I
* 10.105.0.0/16           10.1.1.1                                64512 I

inet6.0: 1 destinations, 1 routes (1 active, 0 holddown, 0 hidden)

Solution

For a service provider, it is critical to deny all inbound prefixes and only allow those which are properly authorized to do so.
The below configuration will filter the inbound and only allow those which are properly authorized.

Apply the import filter to a specific BGP neighbor

set logical-systems LogicalSystem-1 protocols bgp group remote-peers-group-b neighbor 10.1.1.2 import import-prefixes_10.1.1.1
  1. Create a prefix list of allowed routes to be imported
set logical-systems LogicalSystem-1 policy-options prefix-list import-prefixes_10.1.1.1 10.200.0.0/16
set logical-systems LogicalSystem-1 policy-options prefix-list import-prefixes_10.1.1.1 10.201.0.0/16
  1. Deny all routes by default, then allow prefixes from the prefix list
set logical-systems LogicalSystem-1 policy-options policy-statement import-prefixes_10.1.1.1  term 1 from protocol bgp
set logical-systems LogicalSystem-1 policy-options policy-statement import-prefixes_10.1.1.1  term 1 from prefix-list import-prefixes_10.1.1.1
set logical-systems LogicalSystem-1 policy-options policy-statement import-prefixes_10.1.1.1  term 1 then accept
  1. The default reject (statement mandatory)
set logical-systems LogicalSystem-1 policy-options policy-statement import-prefixes_10.1.1.1 term 2 then reject

Verification:

Below are the filtered prefixes: LogicalSystem-1

user@juniper-vMX-1:LogicalSystem-1> show route receive-protocol bgp 10.1.1.2   

inet.0: 14 destinations, 14 routes (10 active, 0 holddown, 4 hidden)
  Prefix                  Nexthop              MED     Lclpref    AS path
* 10.200.0.0/16           10.1.1.2                                64513 I
* 10.201.0.0/16           10.1.1.2                                64513 I

inet6.0: 1 destinations, 1 routes (1 active, 0 holddown, 0 hidden)

Hidden routes after inbound Prefixes filtered:
If your downstream customers are sending rogue routes, verify that there are more routes being sent than allowed through the filters.

user@juniper-vMX-1:LogicalSystem-1> show route receive-protocol bgp 10.1.1.2 hidden

inet.0: 14 destinations, 14 routes (10 active, 0 holddown, 4 hidden)
  Prefix                  Nexthop              MED     Lclpref    AS path
  10.202.0.0/16           10.1.1.2                                64513 I
  10.203.0.0/16           10.1.1.2                                64513 I
  10.204.0.0/16           10.1.1.2                                64513 I
  10.205.0.0/16           10.1.1.2                                64513 I

inet6.0: 1 destinations, 1 routes (1 active, 0 holddown, 0 hidden)
 

Modification History

9/6/2023 10:34 PM: Initial Draft

Related Information

https://www.juniper.net/documentation/us/en/software/junos/routing-policy/topics/example/policy-prefix-list.html