1

The AS-path policy for this eBGP neighbor is receive/send routes with maximum 3 AS paths away from/to us/customer. The issue is we found out from traffic analysis that this neighbor also route traffic beyond the 2 AS paths away from us. In other words, we have become transit without any intention to be that and without our permission.

The only possible solution that I can think of is my eBGP router that peering to that eBGP neighbor should have only BGP routes that have maximum 2 AS paths and no default route in IP routing table. So, traffic with destination beyond IGP and 2 AS paths away will be dropped by my router.

Any other solution? It seems impossible with access list.

Improve this question
6
  • Route maps can use more than address ACLs. You can craft a route map to do this, but it would seem to be a better option to not advertise routes learned from one ISP to another, in either direction, and that would prevent you from being a transit AS.
    – Ron Maupin ♦
    Oct 7, 2015 at 17:16
  • @Maupin That's what has been done as stated above (unless my statement is not clear). My router advertises to this neighbor maximum 3 AS paths including our own AS and also filter received routes from this neighbor maximum 3 AS paths away from us.
    – Ron Vince
    Oct 7, 2015 at 23:54
  • If you advertise routes from one external neighbor to another, you are going to be a transit AS since your AS will be used to get from one neighbor to the other. A neighbor cannot advertise to you routes it does not have in its routing table. You should include a drawing, configurations, BGP and route tables, etc.
    – Ron Maupin ♦
    Oct 8, 2015 at 0:26
  • @Maupin Yes, I am a transit for maximum 2 AS paths away from me, not beyond that. That is what advertised to that neighbor by filtering the AS path. As per said, through traffic analysis, we found out that incoming traffic from this neighbor has destinations beyond 2 AS paths away from us. I cannot see why it is not possible for the neighbor to make default route to us in their network by using static route and then use default originate to advertise the default route.
    – Ron Vince
    Oct 8, 2015 at 5:49
  • The thing about a foreign AS is that you have absolutely no control or say in the way it is run, else it would be your AS. The way this sort of thing is normally corrected is that the neighbor gets blocked until it decides to comply with your wishes, and that is the real leverage you have over the rogue neighbor. BGP neighbor relationships are about cooperation. Remind the non-compliant neighbor of the old saying, "Good fences make good neighbors." Also, don't advertise anything beyond two hops, or, if you do, prepend a bunch of AS hops to try to make it less desireable.
    – Ron Maupin ♦
    Oct 8, 2015 at 13:56

2 Answers 2

Reset to default
1

You can avoid become a transit AS using the next configuration:

Create an as-path access list match YOUR OWNS NETWORKS and only advertise that.

Router(config)#ip as-path access-list X permit ^$

Router(config-router)#neighbor x.x.x.x filter-list X out
Router(config-router)#neighbor y.y.y.y filter-list X out
....

On that form, you can be sure that all your providers only will go to you, to reach YOUR NETWORKS

Improve this answer
4
  • Of course my eBGP router peering with that neighbor advertises maximum 2 AS paths away (3 when including our own AS) and that be done using AS path access list. The problem is the neighbor, I suspect, routed to us for traffic not in their routing table. My router do not advertise default route.
    – Ron Vince
    Oct 7, 2015 at 23:43
  • Then you can create access-list and apply then on interfaces level, permiting only traffic destinated to your networks, and denying all the others networks. Then, if for some reason, your neighbor has a defalut route to you, sorry for then, that traffic will be blackholed on your edge.
    – Orlando Gaetano
    Oct 8, 2015 at 12:31
  • With BGP routes which dynamically change time to time, it seems not a viable solution
    – Ron Vince
    Oct 8, 2015 at 13:44
  • I don´t understand?. Are you some TIER-x, ISP or some organization?? If you are some organization, you only advertise some networks, and peers just need came to you to reach thats networks, nothing more,
    – Orlando Gaetano
    Oct 8, 2015 at 14:26
1

Three options:

  • apply an access-list to deny traffic to destinations not advertised to the neighbor. You don't have to make this perfect. Only include destinations that will never be advertised, and enough of them that will make them rethink their routing. Give warning though in case they are litigious. "We noticed you are sending traffic to destinations you have not contracted for/we see your theft of service. We will filter this traffic starting on xxx."

  • move the connection to a router that only has the routes you advertise. This way any traffic to destinations besides what's advertised won't have anywhere to go and will get dropped. Basically, add the filtering one hop up.

  • move the connection into a VRF and only import routes into the VRF that are what you want to advertise. Same effect as the above option, but logically not physically. One way is to use an export-map and only match the routes of interest to a special route-target then import that rt into the neighbor's VRF. Export the neighbor's routes and import that into the VRF you use for all other traffic.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.