1# built by ARouteServer 2AS 999 3router-id 192.0.2.2 4 5fib-update no 6log updates 7 8nexthop qualify via default 9 10rde evaluate all 11 12INTCOMM_PREF_OK_ROA="soo 65535:1" 13INTCOMM_ROUTE_OK_WL="soo 65535:2" 14 15INTCOMM_ORIGIN_OK="soo 65535:4" 16INTCOMM_ORIGIN_KO="soo 65535:5" 17INTCOMM_PREFIX_OK="soo 65535:6" 18INTCOMM_PREFIX_KO="soo 65535:7" 19INTCOMM_IRR_REJECT="soo 65535:8" 20 21INTCOMM_RPKI_UNKNOWN="soo 65535:9" 22INTCOMM_RPKI_INVALID="soo 65535:10" 23INTCOMM_RPKI_VALID="soo 65535:11" 24 25INTCOMM_PROCESS_PREPEND_COMMS="soo 65535:13" 26 27INTCOMM_NO_EXPORT="soo 65535:65281" 28INTCOMM_NO_ADVERTISE="soo 65535:65282" 29 30# --------------------------------------------------------- 31# IRRDB 32 33# AS2, used by client AS2_1 34# no origin ASNs found for AS2 35# no prefixes found for AS2 36 37# AS-AS1, AS-AS1_CUSTOMERS, used by client AS1_1 38as-set "AS_SET_AS_AS1_AS_AS1_CUSTOMERS_asns" { 39 1 101 103 104 40} 41prefix-set "AS_SET_AS_AS1_AS_AS1_CUSTOMERS_prefixes" { 42 1.0.0.0/8 prefixlen 8 - 32 43 128.0.0.0/7 prefixlen 7 - 32 44 101.0.0.0/16 prefixlen 16 - 32 45 103.0.0.0/16 prefixlen 16 - 32 46} 47 48# AS-AS2, AS-AS2_CUSTOMERS, used by client AS2_1 49as-set "AS_SET_AS_AS2_AS_AS2_CUSTOMERS_asns" { 50 2 101 103 51} 52prefix-set "AS_SET_AS_AS2_AS_AS2_CUSTOMERS_prefixes" { 53 2.0.0.0/16 prefixlen 16 - 32 54 101.0.0.0/16 prefixlen 16 - 32 55 103.0.0.0/16 prefixlen 16 - 32 56} 57 58# AS1, used by client AS1_1 59# no origin ASNs found for AS1 60# no prefixes found for AS1 61 62# WHITE_LIST_AS1_1, used by client AS1_1 white list 63as-set "AS_SET_WHITE_LIST_AS1_1_asns" { 64 1011 65} 66prefix-set "AS_SET_WHITE_LIST_AS1_1_prefixes" { 67 11.1.0.0/16 prefixlen 16 - 32 68} 69 70# --------------------------------------------------------- 71# ROAs source 72 73 74roa-set { 75 2.0.3.0/24 source-as 2 76 2.0.4.0/24 source-as 0 77} 78 79# --------------------------------------------------------- 80# MEMBERS 81 82group "clients" { 83 transparent-as yes 84 rde evaluate all 85 86 neighbor 192.0.2.11 { 87 remote-as 1 88 descr "AS1_1 client" 89 } 90 91 neighbor 192.0.2.21 { 92 remote-as 2 93 descr "AS2_1 client" 94 } 95 96 neighbor 192.0.2.31 { 97 remote-as 3 98 descr "AS3_1 client" 99 } 100 101 neighbor 192.0.2.41 { 102 remote-as 4 103 descr "AS4_1 client" 104 } 105} 106 107# --------------------------------------------------------- 108# FILTERS 109 110# NO_ADVERTISE usage notes. 111# The NO_ADVERTISE well-know community is used here to handle 112# filters that span over multiple steps. At first it is added 113# to any route, then it is removed as filters conditions are 114# satisfied. Finally, if it is still present, it means that 115# the route should be discarded. 116 117 118 119 120prefix-set "global_black_list_pref" { 121 192.0.2.0/24 prefixlen 24 - 32 122 2.0.7.0/24 prefixlen 24 - 32 123} 124 125prefix-set "bogons" { 126 0.0.0.0/0 127 0.0.0.0/8 prefixlen 8 - 32 128 10.0.0.0/8 prefixlen 8 - 32 129 127.0.0.0/8 prefixlen 8 - 32 130 169.254.0.0/16 prefixlen 16 - 32 131 172.16.0.0/12 prefixlen 12 - 32 132 192.0.2.0/24 prefixlen 24 - 32 133 192.88.99.0/24 prefixlen 24 - 32 134 192.168.0.0/16 prefixlen 16 - 32 135 198.18.0.0/15 prefixlen 15 - 32 136 198.51.100.0/24 prefixlen 24 - 32 137 203.0.113.0/24 prefixlen 24 - 32 138 224.0.0.0/3 prefixlen 3 - 32 139 100.64.0.0/10 prefixlen 10 - 32 140 ::/0 141 ::/8 prefixlen 8 - 128 142 64:ff9b::/96 prefixlen 96 - 128 143 100::/8 prefixlen 8 - 128 144 200::/7 prefixlen 7 - 128 145 400::/6 prefixlen 6 - 128 146 800::/5 prefixlen 5 - 128 147 1000::/4 prefixlen 4 - 128 148 2001::/33 prefixlen 33 - 128 149 2001:0:8000::/33 prefixlen 33 - 128 150 2001:2::/48 prefixlen 48 - 128 151 2001:3::/32 prefixlen 32 - 128 152 2001:10::/28 prefixlen 28 - 128 153 2001:20::/28 prefixlen 28 - 128 154 2001:db8::/32 prefixlen 32 - 128 155 2002::/16 prefixlen 16 - 128 156 3ffe::/16 prefixlen 16 - 128 157 4000::/3 prefixlen 3 - 128 158 5f00::/8 prefixlen 8 - 128 159 6000::/3 prefixlen 3 - 128 160 8000::/3 prefixlen 3 - 128 161 a000::/3 prefixlen 3 - 128 162 c000::/3 prefixlen 3 - 128 163 e000::/4 prefixlen 4 - 128 164 f000::/5 prefixlen 5 - 128 165 f800::/6 prefixlen 6 - 128 166 fc00::/7 prefixlen 7 - 128 167 fe80::/10 prefixlen 10 - 128 168 fec0::/10 prefixlen 10 - 128 169 ff00::/8 prefixlen 8 - 128 170 171} 172 173# never via route-servers ASNs 174as-set "neverviarouteserver" { 175 666, 777 176} 177 178# ===================================================================================== 179# Global rules. 180 181# This part of configuration is processed at the beginning of the filters. 182# The rules defined in this part are applied to all the clients, and not on a 183# client-by-client basis (see the 'match from group clients'), so only global policies 184# can be implemented here, that is no client-level configuration are allowed. 185 186 187 188# Scrub communities from inbound routes 189# origin_not_present_in_as_set 190match from group clients set community delete 65530:0 191match from group clients set large-community delete 999:65530:0 192 193# origin_present_in_as_set 194match from group clients set community delete 65530:1 195match from group clients set large-community delete 999:65530:1 196 197# prefix_validated_via_arin_whois_db_dump 198match from group clients set community delete 65530:3 199match from group clients set large-community delete 999:65530:3 200 201# prefix_validated_via_rpki_roas 202match from group clients set community delete 65530:2 203match from group clients set large-community delete 999:65530:2 204 205# reject_cause 206match from group clients set community delete 65520:* 207 208# rejected_route_announced_by 209match from group clients set community delete 65524:* 210match from group clients set ext-community delete rt 65524:* 211 212# rpki_bgp_origin_validation_not_performed 213match from group clients set community delete 65530:4 214match from group clients set large-community delete 999:65530:4 215 216 217# Scrub internal communities from inbound routes 218match from group clients set { 219 ext-community delete $INTCOMM_PREF_OK_ROA 220 ext-community delete $INTCOMM_ROUTE_OK_WL 221 ext-community delete $INTCOMM_ORIGIN_OK 222 ext-community delete $INTCOMM_ORIGIN_KO 223 ext-community delete $INTCOMM_PREFIX_OK 224 ext-community delete $INTCOMM_PREFIX_KO 225 ext-community delete $INTCOMM_IRR_REJECT 226 ext-community delete $INTCOMM_RPKI_UNKNOWN 227 ext-community delete $INTCOMM_RPKI_INVALID 228 ext-community delete $INTCOMM_RPKI_VALID 229 ext-community delete $INTCOMM_NO_EXPORT 230 ext-community delete $INTCOMM_NO_ADVERTISE 231 ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS 232 233} 234 235 236 237# The main goal of this block is to enrich routes received from clients by attaching to them 238# internal informational communities which are used later by the rest of the filter rules. 239 240# Internal communities used for RFC1997 well-known communities handling 241 242# Transform NO_EXPORT into $INTCOMM_NO_EXPORT 243match from group clients community NO_EXPORT set { ext-community $INTCOMM_NO_EXPORT community delete NO_EXPORT } 244 245# Transform NO_ADVERTISE into $INTCOMM_NO_ADVERTISE 246match from group clients community NO_ADVERTISE set { ext-community $INTCOMM_NO_ADVERTISE community delete NO_ADVERTISE } 247 248 249# --------------------------------------------------------- 250# RPKI-based Origin Validation 251 252# Add $INTCOMM_RPKI_UNKNOWN, $INTCOMM_RPKI_INVALID and $INTCOMM_RPKI_VALID 253# ext community on the basis of ovs. 254match from group clients ovs not-found set { 255 ext-community $INTCOMM_RPKI_UNKNOWN 256 ext-community ovs not-found 257 258} 259match from group clients ovs valid set { 260 ext-community $INTCOMM_RPKI_VALID 261 ext-community ovs valid 262 263} 264match from group clients ovs invalid set { 265 ext-community $INTCOMM_RPKI_INVALID 266 ext-community ovs invalid 267 268} 269 270 271# --------------------------------------------------------- 272# RPKI ROAs used as route objects. 273 274# Add the $INTCOMM_PREF_OK_ROA ext community to routes whose 275# origin ASN has a ROA for the announced prefix. 276# It will be used later during IRRDB validation in 277# case the origin ASN is authorized by a client's 278# AS-SET but the prefix is not. 279 280# Since RPKI-based Origin Validation is already performed above, 281# use the origin validation state to identify valid routes. 282match from group clients ovs valid set ext-community $INTCOMM_PREF_OK_ROA 283 284 285# Set the 'rejected_route_announced_by' community for all the clients. 286# It will be removed later if the route is not invalid 287match from 192.0.2.11 set community 65524:1 288match from 192.0.2.11 set ext-community rt 65524:1 289 290match from 192.0.2.21 set community 65524:2 291match from 192.0.2.21 set ext-community rt 65524:2 292 293match from 192.0.2.31 set community 65524:3 294match from 192.0.2.31 set ext-community rt 65524:3 295 296match from 192.0.2.41 set community 65524:4 297match from 192.0.2.41 set ext-community rt 65524:4 298 299 300# AS_PATH: length 301# Reject inbound routes when 'from group clients max-as-len 6' - reject code: 1 302allow quick from group clients max-as-len 6 set { 303 localpref 1 304 community 65520:0 305 community 65520:1 306 community delete NO_ADVERTISE 307 ext-community delete $INTCOMM_PREF_OK_ROA 308 ext-community delete $INTCOMM_ROUTE_OK_WL 309 ext-community delete $INTCOMM_ORIGIN_OK 310 ext-community delete $INTCOMM_ORIGIN_KO 311 ext-community delete $INTCOMM_PREFIX_OK 312 ext-community delete $INTCOMM_PREFIX_KO 313 ext-community delete $INTCOMM_IRR_REJECT 314 ext-community delete $INTCOMM_RPKI_UNKNOWN 315 ext-community delete $INTCOMM_RPKI_INVALID 316 ext-community delete $INTCOMM_RPKI_VALID 317 ext-community delete $INTCOMM_NO_EXPORT 318 ext-community delete $INTCOMM_NO_ADVERTISE 319 ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS 320 321} 322 323 324# Prefix: global blacklist 325# Reject inbound routes when 'from group clients prefix-set global_black_list_pref' - reject code: 3 326allow quick from group clients prefix-set global_black_list_pref set { 327 localpref 1 328 community 65520:0 329 community 65520:3 330 community delete NO_ADVERTISE 331 ext-community delete $INTCOMM_PREF_OK_ROA 332 ext-community delete $INTCOMM_ROUTE_OK_WL 333 ext-community delete $INTCOMM_ORIGIN_OK 334 ext-community delete $INTCOMM_ORIGIN_KO 335 ext-community delete $INTCOMM_PREFIX_OK 336 ext-community delete $INTCOMM_PREFIX_KO 337 ext-community delete $INTCOMM_IRR_REJECT 338 ext-community delete $INTCOMM_RPKI_UNKNOWN 339 ext-community delete $INTCOMM_RPKI_INVALID 340 ext-community delete $INTCOMM_RPKI_VALID 341 ext-community delete $INTCOMM_NO_EXPORT 342 ext-community delete $INTCOMM_NO_ADVERTISE 343 ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS 344 345} 346 347 348# Prefix: bogon 349# Reject inbound routes when 'from group clients prefix-set bogons' - reject code: 2 350allow quick from group clients prefix-set bogons set { 351 localpref 1 352 community 65520:0 353 community 65520:2 354 community delete NO_ADVERTISE 355 ext-community delete $INTCOMM_PREF_OK_ROA 356 ext-community delete $INTCOMM_ROUTE_OK_WL 357 ext-community delete $INTCOMM_ORIGIN_OK 358 ext-community delete $INTCOMM_ORIGIN_KO 359 ext-community delete $INTCOMM_PREFIX_OK 360 ext-community delete $INTCOMM_PREFIX_KO 361 ext-community delete $INTCOMM_IRR_REJECT 362 ext-community delete $INTCOMM_RPKI_UNKNOWN 363 ext-community delete $INTCOMM_RPKI_INVALID 364 ext-community delete $INTCOMM_RPKI_VALID 365 ext-community delete $INTCOMM_NO_EXPORT 366 ext-community delete $INTCOMM_NO_ADVERTISE 367 ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS 368 369} 370 371 372 373 374# ===================================================================================== 375# Per client rules. 376 377 378# --------------------------------------------- 379# client AS1_1, inbound 380 381 382 383# NEXT_HOP 384match from 192.0.2.11 set community NO_ADVERTISE 385match from 192.0.2.11 nexthop 192.0.2.11 set community delete NO_ADVERTISE 386# Reject inbound routes when 'from 192.0.2.11 community NO_ADVERTISE' - reject code: 5 387allow quick from 192.0.2.11 community NO_ADVERTISE set { 388 localpref 1 389 community 65520:0 390 community 65520:5 391 community delete NO_ADVERTISE 392 ext-community delete $INTCOMM_PREF_OK_ROA 393 ext-community delete $INTCOMM_ROUTE_OK_WL 394 ext-community delete $INTCOMM_ORIGIN_OK 395 ext-community delete $INTCOMM_ORIGIN_KO 396 ext-community delete $INTCOMM_PREFIX_OK 397 ext-community delete $INTCOMM_PREFIX_KO 398 ext-community delete $INTCOMM_IRR_REJECT 399 ext-community delete $INTCOMM_RPKI_UNKNOWN 400 ext-community delete $INTCOMM_RPKI_INVALID 401 ext-community delete $INTCOMM_RPKI_VALID 402 ext-community delete $INTCOMM_NO_EXPORT 403 ext-community delete $INTCOMM_NO_ADVERTISE 404 ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS 405 406} 407 408 409# AS_PATH: invalid ASNs 410# Reject inbound routes when 'from 192.0.2.11 AS 23456' - reject code: 7 411allow quick from 192.0.2.11 AS 23456 set { 412 localpref 1 413 community 65520:0 414 community 65520:7 415 community delete NO_ADVERTISE 416 ext-community delete $INTCOMM_PREF_OK_ROA 417 ext-community delete $INTCOMM_ROUTE_OK_WL 418 ext-community delete $INTCOMM_ORIGIN_OK 419 ext-community delete $INTCOMM_ORIGIN_KO 420 ext-community delete $INTCOMM_PREFIX_OK 421 ext-community delete $INTCOMM_PREFIX_KO 422 ext-community delete $INTCOMM_IRR_REJECT 423 ext-community delete $INTCOMM_RPKI_UNKNOWN 424 ext-community delete $INTCOMM_RPKI_INVALID 425 ext-community delete $INTCOMM_RPKI_VALID 426 ext-community delete $INTCOMM_NO_EXPORT 427 ext-community delete $INTCOMM_NO_ADVERTISE 428 ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS 429 430} 431 432# Reject inbound routes when 'from 192.0.2.11 AS 64496 - 131071' - reject code: 7 433allow quick from 192.0.2.11 AS 64496 - 131071 set { 434 localpref 1 435 community 65520:0 436 community 65520:7 437 community delete NO_ADVERTISE 438 ext-community delete $INTCOMM_PREF_OK_ROA 439 ext-community delete $INTCOMM_ROUTE_OK_WL 440 ext-community delete $INTCOMM_ORIGIN_OK 441 ext-community delete $INTCOMM_ORIGIN_KO 442 ext-community delete $INTCOMM_PREFIX_OK 443 ext-community delete $INTCOMM_PREFIX_KO 444 ext-community delete $INTCOMM_IRR_REJECT 445 ext-community delete $INTCOMM_RPKI_UNKNOWN 446 ext-community delete $INTCOMM_RPKI_INVALID 447 ext-community delete $INTCOMM_RPKI_VALID 448 ext-community delete $INTCOMM_NO_EXPORT 449 ext-community delete $INTCOMM_NO_ADVERTISE 450 ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS 451 452} 453 454# Reject inbound routes when 'from 192.0.2.11 AS 4200000000 - 4294967295' - reject code: 7 455allow quick from 192.0.2.11 AS 4200000000 - 4294967295 set { 456 localpref 1 457 community 65520:0 458 community 65520:7 459 community delete NO_ADVERTISE 460 ext-community delete $INTCOMM_PREF_OK_ROA 461 ext-community delete $INTCOMM_ROUTE_OK_WL 462 ext-community delete $INTCOMM_ORIGIN_OK 463 ext-community delete $INTCOMM_ORIGIN_KO 464 ext-community delete $INTCOMM_PREFIX_OK 465 ext-community delete $INTCOMM_PREFIX_KO 466 ext-community delete $INTCOMM_IRR_REJECT 467 ext-community delete $INTCOMM_RPKI_UNKNOWN 468 ext-community delete $INTCOMM_RPKI_INVALID 469 ext-community delete $INTCOMM_RPKI_VALID 470 ext-community delete $INTCOMM_NO_EXPORT 471 ext-community delete $INTCOMM_NO_ADVERTISE 472 ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS 473 474} 475 476 477# AS_PATH: transit-free ASNs 478# Reject inbound routes when 'from 192.0.2.11 AS { 3, 174 }' - reject code: 8 479allow quick from 192.0.2.11 AS { 3, 174 } set { 480 localpref 1 481 community 65520:0 482 community 65520:8 483 community delete NO_ADVERTISE 484 ext-community delete $INTCOMM_PREF_OK_ROA 485 ext-community delete $INTCOMM_ROUTE_OK_WL 486 ext-community delete $INTCOMM_ORIGIN_OK 487 ext-community delete $INTCOMM_ORIGIN_KO 488 ext-community delete $INTCOMM_PREFIX_OK 489 ext-community delete $INTCOMM_PREFIX_KO 490 ext-community delete $INTCOMM_IRR_REJECT 491 ext-community delete $INTCOMM_RPKI_UNKNOWN 492 ext-community delete $INTCOMM_RPKI_INVALID 493 ext-community delete $INTCOMM_RPKI_VALID 494 ext-community delete $INTCOMM_NO_EXPORT 495 ext-community delete $INTCOMM_NO_ADVERTISE 496 ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS 497 498} 499 500 501# AS_PATH: never via route-servers ASNs 502# Reject inbound routes when 'from 192.0.2.11 AS as-set neverviarouteserver' - reject code: 15 503allow quick from 192.0.2.11 AS as-set neverviarouteserver set { 504 localpref 1 505 community 65520:0 506 community 65520:15 507 community delete NO_ADVERTISE 508 ext-community delete $INTCOMM_PREF_OK_ROA 509 ext-community delete $INTCOMM_ROUTE_OK_WL 510 ext-community delete $INTCOMM_ORIGIN_OK 511 ext-community delete $INTCOMM_ORIGIN_KO 512 ext-community delete $INTCOMM_PREFIX_OK 513 ext-community delete $INTCOMM_PREFIX_KO 514 ext-community delete $INTCOMM_IRR_REJECT 515 ext-community delete $INTCOMM_RPKI_UNKNOWN 516 ext-community delete $INTCOMM_RPKI_INVALID 517 ext-community delete $INTCOMM_RPKI_VALID 518 ext-community delete $INTCOMM_NO_EXPORT 519 ext-community delete $INTCOMM_NO_ADVERTISE 520 ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS 521 522} 523 524 525# client's white list 526# Add the $INTCOMM_ROUTE_OK_WL ext community to routes which 527# are validated by a client's white list entry. 528# It will be used later during IRRDB validation in 529# case the route is not authorized by a client's 530# AS-SET. 531match from 192.0.2.11 prefix 11.3.0.0/16 source-as 1011 set ext-community $INTCOMM_ROUTE_OK_WL # None 532match from 192.0.2.11 prefix 11.4.0.0/16 prefixlen 16 - 32 set ext-community $INTCOMM_ROUTE_OK_WL # None 533 534match from 192.0.2.11 set ext-community $INTCOMM_IRR_REJECT 535 536# AS_PATH: check origin via AS-SET 537# IRRDB filters for AS1_1, AS1: asns 538# add $INTCOMM_ORIGIN_KO to any; it will be removed later if at least one AS-SET authorizes this object 539match from 192.0.2.11 set ext-community $INTCOMM_ORIGIN_KO 540# verifying if object is authorized by AS-SETs 541match from 192.0.2.11 source-as as-set AS_SET_AS_AS1_AS_AS1_CUSTOMERS_asns set { 542 ext-community delete $INTCOMM_ORIGIN_KO 543 ext-community $INTCOMM_ORIGIN_OK 544} # AS_AS1_AS_AS1_CUSTOMERS 545# AS-SET AS1 referenced but empty. 546match from 192.0.2.11 source-as as-set AS_SET_WHITE_LIST_AS1_1_asns set { 547 ext-community delete $INTCOMM_ORIGIN_KO 548 ext-community $INTCOMM_ORIGIN_OK 549} # WHITE_LIST_AS1_1 550 551 552# Prefix: check prefix via AS-SET 553# IRRDB filters for AS1_1, AS1: prefixes 554# add $INTCOMM_PREFIX_KO to any; it will be removed later if at least one AS-SET authorizes this object 555match from 192.0.2.11 set ext-community $INTCOMM_PREFIX_KO 556# verifying if object is authorized by AS-SETs 557match from 192.0.2.11 prefix-set AS_SET_AS_AS1_AS_AS1_CUSTOMERS_prefixes set { 558 ext-community delete $INTCOMM_PREFIX_KO 559 ext-community $INTCOMM_PREFIX_OK 560} # AS_AS1_AS_AS1_CUSTOMERS 561# AS-SET AS1 referenced but empty. 562match from 192.0.2.11 prefix-set AS_SET_WHITE_LIST_AS1_1_prefixes set { 563 ext-community delete $INTCOMM_PREFIX_KO 564 ext-community $INTCOMM_PREFIX_OK 565} # WHITE_LIST_AS1_1 566 567 568# routes tagged with $INTCOMM_PREF_OK_ROA community have the prefix validated by a ROA; origin ASN previously validated ($INTCOMM_ORIGIN_OK) 569match from 192.0.2.11 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set ext-community delete $INTCOMM_IRR_REJECT 570 571# route authorized by a client's white list? 572match from 192.0.2.11 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ROUTE_OK_WL set ext-community delete $INTCOMM_IRR_REJECT 573 574# enforcing: origin ASN 575# Reject inbound routes when 'from 192.0.2.11 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ORIGIN_KO' - reject code: 9 576allow quick from 192.0.2.11 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ORIGIN_KO set { 577 localpref 1 578 community 65520:0 579 community 65520:9 580 community delete NO_ADVERTISE 581 ext-community delete $INTCOMM_PREF_OK_ROA 582 ext-community delete $INTCOMM_ROUTE_OK_WL 583 ext-community delete $INTCOMM_ORIGIN_OK 584 ext-community delete $INTCOMM_ORIGIN_KO 585 ext-community delete $INTCOMM_PREFIX_OK 586 ext-community delete $INTCOMM_PREFIX_KO 587 ext-community delete $INTCOMM_IRR_REJECT 588 ext-community delete $INTCOMM_RPKI_UNKNOWN 589 ext-community delete $INTCOMM_RPKI_INVALID 590 ext-community delete $INTCOMM_RPKI_VALID 591 ext-community delete $INTCOMM_NO_EXPORT 592 ext-community delete $INTCOMM_NO_ADVERTISE 593 ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS 594 595} 596 597# enforcing: prefix 598# Reject inbound routes when 'from 192.0.2.11 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_PREFIX_KO' - reject code: 12 599allow quick from 192.0.2.11 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_PREFIX_KO set { 600 localpref 1 601 community 65520:0 602 community 65520:12 603 community delete NO_ADVERTISE 604 ext-community delete $INTCOMM_PREF_OK_ROA 605 ext-community delete $INTCOMM_ROUTE_OK_WL 606 ext-community delete $INTCOMM_ORIGIN_OK 607 ext-community delete $INTCOMM_ORIGIN_KO 608 ext-community delete $INTCOMM_PREFIX_OK 609 ext-community delete $INTCOMM_PREFIX_KO 610 ext-community delete $INTCOMM_IRR_REJECT 611 ext-community delete $INTCOMM_RPKI_UNKNOWN 612 ext-community delete $INTCOMM_RPKI_INVALID 613 ext-community delete $INTCOMM_RPKI_VALID 614 ext-community delete $INTCOMM_NO_EXPORT 615 ext-community delete $INTCOMM_NO_ADVERTISE 616 ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS 617 618} 619 620 621# Blackhole request? 622match from 192.0.2.11 set community delete 65524:1 623match from 192.0.2.11 set ext-community delete rt 65524:1 624 625 626# Remove internal communities before accepting the route 627match from 192.0.2.11 community BLACKHOLE set { 628 ext-community delete $INTCOMM_RPKI_INVALID 629 ext-community delete $INTCOMM_PREF_OK_ROA 630 ext-community delete $INTCOMM_ROUTE_OK_WL 631 ext-community delete $INTCOMM_ORIGIN_OK 632 ext-community delete $INTCOMM_ORIGIN_KO 633 ext-community delete $INTCOMM_PREFIX_OK 634 ext-community delete $INTCOMM_PREFIX_KO 635 ext-community delete $INTCOMM_IRR_REJECT 636 ext-community delete $INTCOMM_RPKI_UNKNOWN 637 ext-community delete $INTCOMM_RPKI_VALID 638 ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS 639 640} 641allow from 192.0.2.11 community 65534:0 set { 642 ext-community delete $INTCOMM_RPKI_INVALID 643 ext-community delete $INTCOMM_PREF_OK_ROA 644 ext-community delete $INTCOMM_ROUTE_OK_WL 645 ext-community delete $INTCOMM_ORIGIN_OK 646 ext-community delete $INTCOMM_ORIGIN_KO 647 ext-community delete $INTCOMM_PREFIX_OK 648 ext-community delete $INTCOMM_PREFIX_KO 649 ext-community delete $INTCOMM_IRR_REJECT 650 ext-community delete $INTCOMM_RPKI_UNKNOWN 651 ext-community delete $INTCOMM_RPKI_VALID 652 ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS 653 654} 655allow from 192.0.2.11 large-community 65534:0:0 set { 656 ext-community delete $INTCOMM_RPKI_INVALID 657 ext-community delete $INTCOMM_PREF_OK_ROA 658 ext-community delete $INTCOMM_ROUTE_OK_WL 659 ext-community delete $INTCOMM_ORIGIN_OK 660 ext-community delete $INTCOMM_ORIGIN_KO 661 ext-community delete $INTCOMM_PREFIX_OK 662 ext-community delete $INTCOMM_PREFIX_KO 663 ext-community delete $INTCOMM_IRR_REJECT 664 ext-community delete $INTCOMM_RPKI_UNKNOWN 665 ext-community delete $INTCOMM_RPKI_VALID 666 ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS 667 668} 669 670 671# Add the rpki_bgp_origin_validation_not_performed community 672match from 192.0.2.11 community BLACKHOLE set community 65530:4 673match from 192.0.2.11 community BLACKHOLE set large-community 999:65530:4 674 675match from 192.0.2.11 community 65534:0 set { community 65530:4 large-community 999:65530:4} 676match from 192.0.2.11 large-community 65534:0:0 set { community 65530:4 large-community 999:65530:4} 677 678 679allow quick from 192.0.2.11 community BLACKHOLE 680allow quick from 192.0.2.11 community 65534:0 681allow quick from 192.0.2.11 large-community 65534:0:0 682 683 684match from 192.0.2.11 set community 65524:1 685match from 192.0.2.11 set ext-community rt 65524:1 686 687 688# RPKI-based Origin Validation 689# Reject inbound routes when 'from 192.0.2.11 ext-community $INTCOMM_RPKI_INVALID' - reject code: 14 690allow quick from 192.0.2.11 ext-community $INTCOMM_RPKI_INVALID set { 691 localpref 1 692 community 65520:0 693 community 65520:14 694 community delete NO_ADVERTISE 695 ext-community delete $INTCOMM_PREF_OK_ROA 696 ext-community delete $INTCOMM_ROUTE_OK_WL 697 ext-community delete $INTCOMM_ORIGIN_OK 698 ext-community delete $INTCOMM_ORIGIN_KO 699 ext-community delete $INTCOMM_PREFIX_OK 700 ext-community delete $INTCOMM_PREFIX_KO 701 ext-community delete $INTCOMM_IRR_REJECT 702 ext-community delete $INTCOMM_RPKI_UNKNOWN 703 ext-community delete $INTCOMM_RPKI_INVALID 704 ext-community delete $INTCOMM_RPKI_VALID 705 ext-community delete $INTCOMM_NO_EXPORT 706 ext-community delete $INTCOMM_NO_ADVERTISE 707 ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS 708 709} 710 711 712# Prefix: length 713# Reject inbound routes when 'from 192.0.2.11 prefix 0.0.0.0/0 prefixlen 8 >< 24' - reject code: 13 714allow quick from 192.0.2.11 prefix 0.0.0.0/0 prefixlen 8 >< 24 set { 715 localpref 1 716 community 65520:0 717 community 65520:13 718 community delete NO_ADVERTISE 719 ext-community delete $INTCOMM_PREF_OK_ROA 720 ext-community delete $INTCOMM_ROUTE_OK_WL 721 ext-community delete $INTCOMM_ORIGIN_OK 722 ext-community delete $INTCOMM_ORIGIN_KO 723 ext-community delete $INTCOMM_PREFIX_OK 724 ext-community delete $INTCOMM_PREFIX_KO 725 ext-community delete $INTCOMM_IRR_REJECT 726 ext-community delete $INTCOMM_RPKI_UNKNOWN 727 ext-community delete $INTCOMM_RPKI_INVALID 728 ext-community delete $INTCOMM_RPKI_VALID 729 ext-community delete $INTCOMM_NO_EXPORT 730 ext-community delete $INTCOMM_NO_ADVERTISE 731 ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS 732 733} 734 735 736# Graceful shutdown 737match from 192.0.2.11 community GRACEFUL_SHUTDOWN set localpref 5 738 739# Remove internal communities before accepting the route 740match from 192.0.2.11 set { 741 ext-community delete $INTCOMM_PREF_OK_ROA 742 ext-community delete $INTCOMM_ROUTE_OK_WL 743 ext-community delete $INTCOMM_ORIGIN_OK 744 ext-community delete $INTCOMM_ORIGIN_KO 745 ext-community delete $INTCOMM_PREFIX_OK 746 ext-community delete $INTCOMM_PREFIX_KO 747 ext-community delete $INTCOMM_IRR_REJECT 748 ext-community delete $INTCOMM_RPKI_UNKNOWN 749 ext-community delete $INTCOMM_RPKI_VALID 750 ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS 751 752} 753 754match from 192.0.2.11 set community delete 65524:1 755match from 192.0.2.11 set ext-community delete rt 65524:1 756 757 758 759allow quick from 192.0.2.11 760 761 762 763# --------------------------------------------- 764# client AS1_1, outbound 765 766deny quick to 192.0.2.11 community 65520:0 767 768 769 770# Blackhole request? 771# Configured policy: rewrite-next-hop 772match to 192.0.2.11 community 65534:0 set community BLACKHOLE 773match to 192.0.2.11 large-community 65534:0:0 set community BLACKHOLE 774 775match to 192.0.2.11 community BLACKHOLE set community NO_EXPORT 776match to 192.0.2.11 community BLACKHOLE set nexthop 192.0.2.66 777 778 779# RPKI-based Origin Validation 780# Do not announce INVALID to clients 781deny quick to 192.0.2.11 ext-community $INTCOMM_RPKI_INVALID 782 783# NO_EXPORT and NO_ADVERTISE communities 784# add_noexport_to_any 785match to 192.0.2.11 community 65507:999 set community NO_EXPORT 786match to 192.0.2.11 ext-community rt 65507:999 set community NO_EXPORT 787match to 192.0.2.11 large-community 999:65507:999 set community NO_EXPORT 788 789# add_noadvertise_to_any 790match to 192.0.2.11 community 65508:999 set community NO_ADVERTISE 791match to 192.0.2.11 ext-community rt 65508:999 set community NO_ADVERTISE 792match to 192.0.2.11 large-community 999:65508:999 set community NO_ADVERTISE 793 794# add_noexport_to_peer 795match to 192.0.2.11 community 65509:1 set community NO_EXPORT 796match to 192.0.2.11 ext-community rt 65509:1 set community NO_EXPORT 797match to 192.0.2.11 large-community 999:65509:1 set community NO_EXPORT 798 799# add_noadvertise_to_peer 800match to 192.0.2.11 community 65510:1 set community NO_ADVERTISE 801match to 192.0.2.11 ext-community rt 65510:1 set community NO_ADVERTISE 802match to 192.0.2.11 large-community 999:65510:1 set community NO_ADVERTISE 803 804 805# BGP control communities 806allow to 192.0.2.11 807 808# do_not_announce_to_any 809deny to 192.0.2.11 community 0:999 810deny to 192.0.2.11 ext-community rt 0:999 811deny to 192.0.2.11 large-community 999:0:999 812 813# do_not_announce_to_peer 814deny quick to 192.0.2.11 community 0:1 815deny quick to 192.0.2.11 ext-community rt 0:1 816deny quick to 192.0.2.11 large-community 999:0:1 817 818# announce_to_peer 819allow to 192.0.2.11 community 65501:1 820allow to 192.0.2.11 ext-community rt 65501:1 821allow to 192.0.2.11 large-community 999:65501:1 822 823 824# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities 825# for prepending can be processed. As soon as one prepending action is performed, 826# this internal community is removed, so that further actions are not processed. 827match to 192.0.2.11 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS 828 829# prepend_once_to_peer AS1; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions 830match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65521:1 set { 831 prepend-neighbor 1 832 ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS 833} 834match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65521:1 set { 835 prepend-neighbor 1 836 ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS 837} 838match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65521:1 set { 839 prepend-neighbor 1 840 ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS 841} 842 843# prepend_twice_to_peer AS1; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions 844match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65522:1 set { 845 prepend-neighbor 2 846 ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS 847} 848match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65522:1 set { 849 prepend-neighbor 2 850 ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS 851} 852match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65522:1 set { 853 prepend-neighbor 2 854 ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS 855} 856 857# prepend_thrice_to_peer AS1; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions 858match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65523:1 set { 859 prepend-neighbor 3 860 ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS 861} 862match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65523:1 set { 863 prepend-neighbor 3 864 ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS 865} 866match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65523:1 set { 867 prepend-neighbor 3 868 ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS 869} 870 871 872# prepend_once_to_any; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions 873match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65521:65521 set { 874 prepend-neighbor 1 875 ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS 876} 877match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65521:65521 set { 878 prepend-neighbor 1 879 ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS 880} 881match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65521:65521 set { 882 prepend-neighbor 1 883 ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS 884} 885 886# prepend_twice_to_any; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions 887match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65522:65522 set { 888 prepend-neighbor 2 889 ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS 890} 891match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65522:65522 set { 892 prepend-neighbor 2 893 ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS 894} 895match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65522:65522 set { 896 prepend-neighbor 2 897 ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS 898} 899 900# prepend_thrice_to_any; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions 901match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65523:65523 set { 902 prepend-neighbor 3 903 ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS 904} 905match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65523:65523 set { 906 prepend-neighbor 3 907 ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS 908} 909match to 192.0.2.11 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65523:65523 set { 910 prepend-neighbor 3 911 ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS 912} 913 914 915 916# --------------------------------------------- 917# client AS2_1, inbound 918 919 920 921# NEXT_HOP 922match from 192.0.2.21 set community NO_ADVERTISE 923match from 192.0.2.21 nexthop 192.0.2.21 set community delete NO_ADVERTISE 924match from 192.0.2.21 nexthop 192.0.2.22 set community delete NO_ADVERTISE 925# Reject inbound routes when 'from 192.0.2.21 community NO_ADVERTISE' - reject code: 5 926allow quick from 192.0.2.21 community NO_ADVERTISE set { 927 localpref 1 928 community 65520:0 929 community 65520:5 930 community delete NO_ADVERTISE 931 ext-community delete $INTCOMM_PREF_OK_ROA 932 ext-community delete $INTCOMM_ROUTE_OK_WL 933 ext-community delete $INTCOMM_ORIGIN_OK 934 ext-community delete $INTCOMM_ORIGIN_KO 935 ext-community delete $INTCOMM_PREFIX_OK 936 ext-community delete $INTCOMM_PREFIX_KO 937 ext-community delete $INTCOMM_IRR_REJECT 938 ext-community delete $INTCOMM_RPKI_UNKNOWN 939 ext-community delete $INTCOMM_RPKI_INVALID 940 ext-community delete $INTCOMM_RPKI_VALID 941 ext-community delete $INTCOMM_NO_EXPORT 942 ext-community delete $INTCOMM_NO_ADVERTISE 943 ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS 944 945} 946 947 948# AS_PATH: invalid ASNs 949# Reject inbound routes when 'from 192.0.2.21 AS 23456' - reject code: 7 950allow quick from 192.0.2.21 AS 23456 set { 951 localpref 1 952 community 65520:0 953 community 65520:7 954 community delete NO_ADVERTISE 955 ext-community delete $INTCOMM_PREF_OK_ROA 956 ext-community delete $INTCOMM_ROUTE_OK_WL 957 ext-community delete $INTCOMM_ORIGIN_OK 958 ext-community delete $INTCOMM_ORIGIN_KO 959 ext-community delete $INTCOMM_PREFIX_OK 960 ext-community delete $INTCOMM_PREFIX_KO 961 ext-community delete $INTCOMM_IRR_REJECT 962 ext-community delete $INTCOMM_RPKI_UNKNOWN 963 ext-community delete $INTCOMM_RPKI_INVALID 964 ext-community delete $INTCOMM_RPKI_VALID 965 ext-community delete $INTCOMM_NO_EXPORT 966 ext-community delete $INTCOMM_NO_ADVERTISE 967 ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS 968 969} 970 971# Reject inbound routes when 'from 192.0.2.21 AS 64496 - 131071' - reject code: 7 972allow quick from 192.0.2.21 AS 64496 - 131071 set { 973 localpref 1 974 community 65520:0 975 community 65520:7 976 community delete NO_ADVERTISE 977 ext-community delete $INTCOMM_PREF_OK_ROA 978 ext-community delete $INTCOMM_ROUTE_OK_WL 979 ext-community delete $INTCOMM_ORIGIN_OK 980 ext-community delete $INTCOMM_ORIGIN_KO 981 ext-community delete $INTCOMM_PREFIX_OK 982 ext-community delete $INTCOMM_PREFIX_KO 983 ext-community delete $INTCOMM_IRR_REJECT 984 ext-community delete $INTCOMM_RPKI_UNKNOWN 985 ext-community delete $INTCOMM_RPKI_INVALID 986 ext-community delete $INTCOMM_RPKI_VALID 987 ext-community delete $INTCOMM_NO_EXPORT 988 ext-community delete $INTCOMM_NO_ADVERTISE 989 ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS 990 991} 992 993# Reject inbound routes when 'from 192.0.2.21 AS 4200000000 - 4294967295' - reject code: 7 994allow quick from 192.0.2.21 AS 4200000000 - 4294967295 set { 995 localpref 1 996 community 65520:0 997 community 65520:7 998 community delete NO_ADVERTISE 999 ext-community delete $INTCOMM_PREF_OK_ROA 1000 ext-community delete $INTCOMM_ROUTE_OK_WL 1001 ext-community delete $INTCOMM_ORIGIN_OK 1002 ext-community delete $INTCOMM_ORIGIN_KO 1003 ext-community delete $INTCOMM_PREFIX_OK 1004 ext-community delete $INTCOMM_PREFIX_KO 1005 ext-community delete $INTCOMM_IRR_REJECT 1006 ext-community delete $INTCOMM_RPKI_UNKNOWN 1007 ext-community delete $INTCOMM_RPKI_INVALID 1008 ext-community delete $INTCOMM_RPKI_VALID 1009 ext-community delete $INTCOMM_NO_EXPORT 1010 ext-community delete $INTCOMM_NO_ADVERTISE 1011 ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS 1012 1013} 1014 1015 1016# AS_PATH: transit-free ASNs 1017# Reject inbound routes when 'from 192.0.2.21 AS { 3, 174 }' - reject code: 8 1018allow quick from 192.0.2.21 AS { 3, 174 } set { 1019 localpref 1 1020 community 65520:0 1021 community 65520:8 1022 community delete NO_ADVERTISE 1023 ext-community delete $INTCOMM_PREF_OK_ROA 1024 ext-community delete $INTCOMM_ROUTE_OK_WL 1025 ext-community delete $INTCOMM_ORIGIN_OK 1026 ext-community delete $INTCOMM_ORIGIN_KO 1027 ext-community delete $INTCOMM_PREFIX_OK 1028 ext-community delete $INTCOMM_PREFIX_KO 1029 ext-community delete $INTCOMM_IRR_REJECT 1030 ext-community delete $INTCOMM_RPKI_UNKNOWN 1031 ext-community delete $INTCOMM_RPKI_INVALID 1032 ext-community delete $INTCOMM_RPKI_VALID 1033 ext-community delete $INTCOMM_NO_EXPORT 1034 ext-community delete $INTCOMM_NO_ADVERTISE 1035 ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS 1036 1037} 1038 1039 1040# AS_PATH: never via route-servers ASNs 1041# Reject inbound routes when 'from 192.0.2.21 AS as-set neverviarouteserver' - reject code: 15 1042allow quick from 192.0.2.21 AS as-set neverviarouteserver set { 1043 localpref 1 1044 community 65520:0 1045 community 65520:15 1046 community delete NO_ADVERTISE 1047 ext-community delete $INTCOMM_PREF_OK_ROA 1048 ext-community delete $INTCOMM_ROUTE_OK_WL 1049 ext-community delete $INTCOMM_ORIGIN_OK 1050 ext-community delete $INTCOMM_ORIGIN_KO 1051 ext-community delete $INTCOMM_PREFIX_OK 1052 ext-community delete $INTCOMM_PREFIX_KO 1053 ext-community delete $INTCOMM_IRR_REJECT 1054 ext-community delete $INTCOMM_RPKI_UNKNOWN 1055 ext-community delete $INTCOMM_RPKI_INVALID 1056 ext-community delete $INTCOMM_RPKI_VALID 1057 ext-community delete $INTCOMM_NO_EXPORT 1058 ext-community delete $INTCOMM_NO_ADVERTISE 1059 ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS 1060 1061} 1062 1063 1064 1065match from 192.0.2.21 set ext-community $INTCOMM_IRR_REJECT 1066 1067# AS_PATH: check origin via AS-SET 1068# IRRDB filters for AS2_1, AS2: asns 1069# add $INTCOMM_ORIGIN_KO to any; it will be removed later if at least one AS-SET authorizes this object 1070match from 192.0.2.21 set ext-community $INTCOMM_ORIGIN_KO 1071# verifying if object is authorized by AS-SETs 1072# AS-SET AS2 referenced but empty. 1073match from 192.0.2.21 source-as as-set AS_SET_AS_AS2_AS_AS2_CUSTOMERS_asns set { 1074 ext-community delete $INTCOMM_ORIGIN_KO 1075 ext-community $INTCOMM_ORIGIN_OK 1076} # AS_AS2_AS_AS2_CUSTOMERS 1077 1078 1079# Prefix: check prefix via AS-SET 1080# IRRDB filters for AS2_1, AS2: prefixes 1081# add $INTCOMM_PREFIX_KO to any; it will be removed later if at least one AS-SET authorizes this object 1082match from 192.0.2.21 set ext-community $INTCOMM_PREFIX_KO 1083# verifying if object is authorized by AS-SETs 1084# AS-SET AS2 referenced but empty. 1085match from 192.0.2.21 prefix-set AS_SET_AS_AS2_AS_AS2_CUSTOMERS_prefixes set { 1086 ext-community delete $INTCOMM_PREFIX_KO 1087 ext-community $INTCOMM_PREFIX_OK 1088} # AS_AS2_AS_AS2_CUSTOMERS 1089 1090 1091# routes tagged with $INTCOMM_PREF_OK_ROA community have the prefix validated by a ROA; origin ASN previously validated ($INTCOMM_ORIGIN_OK) 1092match from 192.0.2.21 ext-community $INTCOMM_ORIGIN_OK ext-community $INTCOMM_PREF_OK_ROA set ext-community delete $INTCOMM_IRR_REJECT 1093 1094# enforcing: origin ASN 1095# Reject inbound routes when 'from 192.0.2.21 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ORIGIN_KO' - reject code: 9 1096allow quick from 192.0.2.21 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_ORIGIN_KO set { 1097 localpref 1 1098 community 65520:0 1099 community 65520:9 1100 community delete NO_ADVERTISE 1101 ext-community delete $INTCOMM_PREF_OK_ROA 1102 ext-community delete $INTCOMM_ROUTE_OK_WL 1103 ext-community delete $INTCOMM_ORIGIN_OK 1104 ext-community delete $INTCOMM_ORIGIN_KO 1105 ext-community delete $INTCOMM_PREFIX_OK 1106 ext-community delete $INTCOMM_PREFIX_KO 1107 ext-community delete $INTCOMM_IRR_REJECT 1108 ext-community delete $INTCOMM_RPKI_UNKNOWN 1109 ext-community delete $INTCOMM_RPKI_INVALID 1110 ext-community delete $INTCOMM_RPKI_VALID 1111 ext-community delete $INTCOMM_NO_EXPORT 1112 ext-community delete $INTCOMM_NO_ADVERTISE 1113 ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS 1114 1115} 1116 1117# enforcing: prefix 1118# Reject inbound routes when 'from 192.0.2.21 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_PREFIX_KO' - reject code: 12 1119allow quick from 192.0.2.21 ext-community $INTCOMM_IRR_REJECT ext-community $INTCOMM_PREFIX_KO set { 1120 localpref 1 1121 community 65520:0 1122 community 65520:12 1123 community delete NO_ADVERTISE 1124 ext-community delete $INTCOMM_PREF_OK_ROA 1125 ext-community delete $INTCOMM_ROUTE_OK_WL 1126 ext-community delete $INTCOMM_ORIGIN_OK 1127 ext-community delete $INTCOMM_ORIGIN_KO 1128 ext-community delete $INTCOMM_PREFIX_OK 1129 ext-community delete $INTCOMM_PREFIX_KO 1130 ext-community delete $INTCOMM_IRR_REJECT 1131 ext-community delete $INTCOMM_RPKI_UNKNOWN 1132 ext-community delete $INTCOMM_RPKI_INVALID 1133 ext-community delete $INTCOMM_RPKI_VALID 1134 ext-community delete $INTCOMM_NO_EXPORT 1135 ext-community delete $INTCOMM_NO_ADVERTISE 1136 ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS 1137 1138} 1139 1140 1141# Blackhole request? 1142match from 192.0.2.21 set community delete 65524:2 1143match from 192.0.2.21 set ext-community delete rt 65524:2 1144 1145 1146# Remove internal communities before accepting the route 1147match from 192.0.2.21 community BLACKHOLE set { 1148 ext-community delete $INTCOMM_RPKI_INVALID 1149 ext-community delete $INTCOMM_PREF_OK_ROA 1150 ext-community delete $INTCOMM_ROUTE_OK_WL 1151 ext-community delete $INTCOMM_ORIGIN_OK 1152 ext-community delete $INTCOMM_ORIGIN_KO 1153 ext-community delete $INTCOMM_PREFIX_OK 1154 ext-community delete $INTCOMM_PREFIX_KO 1155 ext-community delete $INTCOMM_IRR_REJECT 1156 ext-community delete $INTCOMM_RPKI_UNKNOWN 1157 ext-community delete $INTCOMM_RPKI_VALID 1158 ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS 1159 1160} 1161allow from 192.0.2.21 community 65534:0 set { 1162 ext-community delete $INTCOMM_RPKI_INVALID 1163 ext-community delete $INTCOMM_PREF_OK_ROA 1164 ext-community delete $INTCOMM_ROUTE_OK_WL 1165 ext-community delete $INTCOMM_ORIGIN_OK 1166 ext-community delete $INTCOMM_ORIGIN_KO 1167 ext-community delete $INTCOMM_PREFIX_OK 1168 ext-community delete $INTCOMM_PREFIX_KO 1169 ext-community delete $INTCOMM_IRR_REJECT 1170 ext-community delete $INTCOMM_RPKI_UNKNOWN 1171 ext-community delete $INTCOMM_RPKI_VALID 1172 ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS 1173 1174} 1175allow from 192.0.2.21 large-community 65534:0:0 set { 1176 ext-community delete $INTCOMM_RPKI_INVALID 1177 ext-community delete $INTCOMM_PREF_OK_ROA 1178 ext-community delete $INTCOMM_ROUTE_OK_WL 1179 ext-community delete $INTCOMM_ORIGIN_OK 1180 ext-community delete $INTCOMM_ORIGIN_KO 1181 ext-community delete $INTCOMM_PREFIX_OK 1182 ext-community delete $INTCOMM_PREFIX_KO 1183 ext-community delete $INTCOMM_IRR_REJECT 1184 ext-community delete $INTCOMM_RPKI_UNKNOWN 1185 ext-community delete $INTCOMM_RPKI_VALID 1186 ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS 1187 1188} 1189 1190 1191# Add the rpki_bgp_origin_validation_not_performed community 1192match from 192.0.2.21 community BLACKHOLE set community 65530:4 1193match from 192.0.2.21 community BLACKHOLE set large-community 999:65530:4 1194 1195match from 192.0.2.21 community 65534:0 set { community 65530:4 large-community 999:65530:4} 1196match from 192.0.2.21 large-community 65534:0:0 set { community 65530:4 large-community 999:65530:4} 1197 1198 1199allow quick from 192.0.2.21 community BLACKHOLE 1200allow quick from 192.0.2.21 community 65534:0 1201allow quick from 192.0.2.21 large-community 65534:0:0 1202 1203 1204match from 192.0.2.21 set community 65524:2 1205match from 192.0.2.21 set ext-community rt 65524:2 1206 1207 1208# RPKI-based Origin Validation 1209# Reject inbound routes when 'from 192.0.2.21 ext-community $INTCOMM_RPKI_INVALID' - reject code: 14 1210allow quick from 192.0.2.21 ext-community $INTCOMM_RPKI_INVALID set { 1211 localpref 1 1212 community 65520:0 1213 community 65520:14 1214 community delete NO_ADVERTISE 1215 ext-community delete $INTCOMM_PREF_OK_ROA 1216 ext-community delete $INTCOMM_ROUTE_OK_WL 1217 ext-community delete $INTCOMM_ORIGIN_OK 1218 ext-community delete $INTCOMM_ORIGIN_KO 1219 ext-community delete $INTCOMM_PREFIX_OK 1220 ext-community delete $INTCOMM_PREFIX_KO 1221 ext-community delete $INTCOMM_IRR_REJECT 1222 ext-community delete $INTCOMM_RPKI_UNKNOWN 1223 ext-community delete $INTCOMM_RPKI_INVALID 1224 ext-community delete $INTCOMM_RPKI_VALID 1225 ext-community delete $INTCOMM_NO_EXPORT 1226 ext-community delete $INTCOMM_NO_ADVERTISE 1227 ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS 1228 1229} 1230 1231 1232# Prefix: length 1233# Reject inbound routes when 'from 192.0.2.21 prefix 0.0.0.0/0 prefixlen 8 >< 24' - reject code: 13 1234allow quick from 192.0.2.21 prefix 0.0.0.0/0 prefixlen 8 >< 24 set { 1235 localpref 1 1236 community 65520:0 1237 community 65520:13 1238 community delete NO_ADVERTISE 1239 ext-community delete $INTCOMM_PREF_OK_ROA 1240 ext-community delete $INTCOMM_ROUTE_OK_WL 1241 ext-community delete $INTCOMM_ORIGIN_OK 1242 ext-community delete $INTCOMM_ORIGIN_KO 1243 ext-community delete $INTCOMM_PREFIX_OK 1244 ext-community delete $INTCOMM_PREFIX_KO 1245 ext-community delete $INTCOMM_IRR_REJECT 1246 ext-community delete $INTCOMM_RPKI_UNKNOWN 1247 ext-community delete $INTCOMM_RPKI_INVALID 1248 ext-community delete $INTCOMM_RPKI_VALID 1249 ext-community delete $INTCOMM_NO_EXPORT 1250 ext-community delete $INTCOMM_NO_ADVERTISE 1251 ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS 1252 1253} 1254 1255 1256# Graceful shutdown 1257match from 192.0.2.21 community GRACEFUL_SHUTDOWN set community delete GRACEFUL_SHUTDOWN 1258 1259# Remove internal communities before accepting the route 1260match from 192.0.2.21 set { 1261 ext-community delete $INTCOMM_PREF_OK_ROA 1262 ext-community delete $INTCOMM_ROUTE_OK_WL 1263 ext-community delete $INTCOMM_ORIGIN_OK 1264 ext-community delete $INTCOMM_ORIGIN_KO 1265 ext-community delete $INTCOMM_PREFIX_OK 1266 ext-community delete $INTCOMM_PREFIX_KO 1267 ext-community delete $INTCOMM_IRR_REJECT 1268 ext-community delete $INTCOMM_RPKI_UNKNOWN 1269 ext-community delete $INTCOMM_RPKI_VALID 1270 ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS 1271 1272} 1273 1274match from 192.0.2.21 set community delete 65524:2 1275match from 192.0.2.21 set ext-community delete rt 65524:2 1276 1277 1278 1279allow quick from 192.0.2.21 1280 1281 1282 1283# --------------------------------------------- 1284# client AS2_1, outbound 1285 1286deny quick to 192.0.2.21 community 65520:0 1287 1288 1289 1290# Blackhole request? 1291# Configured policy: rewrite-next-hop 1292match to 192.0.2.21 community 65534:0 set community BLACKHOLE 1293match to 192.0.2.21 large-community 65534:0:0 set community BLACKHOLE 1294 1295match to 192.0.2.21 community BLACKHOLE set community NO_EXPORT 1296match to 192.0.2.21 community BLACKHOLE set nexthop 192.0.2.66 1297 1298 1299# RPKI-based Origin Validation 1300# Do not announce INVALID to clients 1301deny quick to 192.0.2.21 ext-community $INTCOMM_RPKI_INVALID 1302 1303# NO_EXPORT and NO_ADVERTISE communities 1304# add_noexport_to_any 1305match to 192.0.2.21 community 65507:999 set community NO_EXPORT 1306match to 192.0.2.21 ext-community rt 65507:999 set community NO_EXPORT 1307match to 192.0.2.21 large-community 999:65507:999 set community NO_EXPORT 1308 1309# add_noadvertise_to_any 1310match to 192.0.2.21 community 65508:999 set community NO_ADVERTISE 1311match to 192.0.2.21 ext-community rt 65508:999 set community NO_ADVERTISE 1312match to 192.0.2.21 large-community 999:65508:999 set community NO_ADVERTISE 1313 1314# add_noexport_to_peer 1315match to 192.0.2.21 community 65509:2 set community NO_EXPORT 1316match to 192.0.2.21 ext-community rt 65509:2 set community NO_EXPORT 1317match to 192.0.2.21 large-community 999:65509:2 set community NO_EXPORT 1318 1319# add_noadvertise_to_peer 1320match to 192.0.2.21 community 65510:2 set community NO_ADVERTISE 1321match to 192.0.2.21 ext-community rt 65510:2 set community NO_ADVERTISE 1322match to 192.0.2.21 large-community 999:65510:2 set community NO_ADVERTISE 1323 1324 1325# BGP control communities 1326allow to 192.0.2.21 1327 1328# do_not_announce_to_any 1329deny to 192.0.2.21 community 0:999 1330deny to 192.0.2.21 ext-community rt 0:999 1331deny to 192.0.2.21 large-community 999:0:999 1332 1333# do_not_announce_to_peer 1334deny quick to 192.0.2.21 community 0:2 1335deny quick to 192.0.2.21 ext-community rt 0:2 1336deny quick to 192.0.2.21 large-community 999:0:2 1337 1338# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities 1339# for prepending can be processed. As soon as one prepending action is performed, 1340# this internal community is removed, so that further actions are not processed. 1341match to 192.0.2.21 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS 1342 1343# prepend_once_to_peer AS2; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions 1344match to 192.0.2.21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65521:2 set { 1345 prepend-neighbor 1 1346 ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS 1347} 1348match to 192.0.2.21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65521:2 set { 1349 prepend-neighbor 1 1350 ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS 1351} 1352match to 192.0.2.21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65521:2 set { 1353 prepend-neighbor 1 1354 ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS 1355} 1356 1357# prepend_twice_to_peer AS2; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions 1358match to 192.0.2.21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65522:2 set { 1359 prepend-neighbor 2 1360 ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS 1361} 1362match to 192.0.2.21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65522:2 set { 1363 prepend-neighbor 2 1364 ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS 1365} 1366match to 192.0.2.21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65522:2 set { 1367 prepend-neighbor 2 1368 ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS 1369} 1370 1371# prepend_thrice_to_peer AS2; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions 1372match to 192.0.2.21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65523:2 set { 1373 prepend-neighbor 3 1374 ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS 1375} 1376match to 192.0.2.21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65523:2 set { 1377 prepend-neighbor 3 1378 ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS 1379} 1380match to 192.0.2.21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65523:2 set { 1381 prepend-neighbor 3 1382 ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS 1383} 1384 1385 1386# prepend_once_to_any; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions 1387match to 192.0.2.21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65521:65521 set { 1388 prepend-neighbor 1 1389 ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS 1390} 1391match to 192.0.2.21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65521:65521 set { 1392 prepend-neighbor 1 1393 ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS 1394} 1395match to 192.0.2.21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65521:65521 set { 1396 prepend-neighbor 1 1397 ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS 1398} 1399 1400# prepend_twice_to_any; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions 1401match to 192.0.2.21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65522:65522 set { 1402 prepend-neighbor 2 1403 ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS 1404} 1405match to 192.0.2.21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65522:65522 set { 1406 prepend-neighbor 2 1407 ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS 1408} 1409match to 192.0.2.21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65522:65522 set { 1410 prepend-neighbor 2 1411 ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS 1412} 1413 1414# prepend_thrice_to_any; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions 1415match to 192.0.2.21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65523:65523 set { 1416 prepend-neighbor 3 1417 ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS 1418} 1419match to 192.0.2.21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65523:65523 set { 1420 prepend-neighbor 3 1421 ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS 1422} 1423match to 192.0.2.21 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65523:65523 set { 1424 prepend-neighbor 3 1425 ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS 1426} 1427 1428 1429 1430# --------------------------------------------- 1431# client AS3_1, inbound 1432 1433 1434 1435# NEXT_HOP 1436match from 192.0.2.31 set community NO_ADVERTISE 1437match from 192.0.2.31 nexthop 192.0.2.31 set community delete NO_ADVERTISE 1438# Reject inbound routes when 'from 192.0.2.31 community NO_ADVERTISE' - reject code: 5 1439allow quick from 192.0.2.31 community NO_ADVERTISE set { 1440 localpref 1 1441 community 65520:0 1442 community 65520:5 1443 community delete NO_ADVERTISE 1444 ext-community delete $INTCOMM_PREF_OK_ROA 1445 ext-community delete $INTCOMM_ROUTE_OK_WL 1446 ext-community delete $INTCOMM_ORIGIN_OK 1447 ext-community delete $INTCOMM_ORIGIN_KO 1448 ext-community delete $INTCOMM_PREFIX_OK 1449 ext-community delete $INTCOMM_PREFIX_KO 1450 ext-community delete $INTCOMM_IRR_REJECT 1451 ext-community delete $INTCOMM_RPKI_UNKNOWN 1452 ext-community delete $INTCOMM_RPKI_INVALID 1453 ext-community delete $INTCOMM_RPKI_VALID 1454 ext-community delete $INTCOMM_NO_EXPORT 1455 ext-community delete $INTCOMM_NO_ADVERTISE 1456 ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS 1457 1458} 1459 1460 1461# AS_PATH: invalid ASNs 1462# Reject inbound routes when 'from 192.0.2.31 AS 23456' - reject code: 7 1463allow quick from 192.0.2.31 AS 23456 set { 1464 localpref 1 1465 community 65520:0 1466 community 65520:7 1467 community delete NO_ADVERTISE 1468 ext-community delete $INTCOMM_PREF_OK_ROA 1469 ext-community delete $INTCOMM_ROUTE_OK_WL 1470 ext-community delete $INTCOMM_ORIGIN_OK 1471 ext-community delete $INTCOMM_ORIGIN_KO 1472 ext-community delete $INTCOMM_PREFIX_OK 1473 ext-community delete $INTCOMM_PREFIX_KO 1474 ext-community delete $INTCOMM_IRR_REJECT 1475 ext-community delete $INTCOMM_RPKI_UNKNOWN 1476 ext-community delete $INTCOMM_RPKI_INVALID 1477 ext-community delete $INTCOMM_RPKI_VALID 1478 ext-community delete $INTCOMM_NO_EXPORT 1479 ext-community delete $INTCOMM_NO_ADVERTISE 1480 ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS 1481 1482} 1483 1484# Reject inbound routes when 'from 192.0.2.31 AS 64496 - 131071' - reject code: 7 1485allow quick from 192.0.2.31 AS 64496 - 131071 set { 1486 localpref 1 1487 community 65520:0 1488 community 65520:7 1489 community delete NO_ADVERTISE 1490 ext-community delete $INTCOMM_PREF_OK_ROA 1491 ext-community delete $INTCOMM_ROUTE_OK_WL 1492 ext-community delete $INTCOMM_ORIGIN_OK 1493 ext-community delete $INTCOMM_ORIGIN_KO 1494 ext-community delete $INTCOMM_PREFIX_OK 1495 ext-community delete $INTCOMM_PREFIX_KO 1496 ext-community delete $INTCOMM_IRR_REJECT 1497 ext-community delete $INTCOMM_RPKI_UNKNOWN 1498 ext-community delete $INTCOMM_RPKI_INVALID 1499 ext-community delete $INTCOMM_RPKI_VALID 1500 ext-community delete $INTCOMM_NO_EXPORT 1501 ext-community delete $INTCOMM_NO_ADVERTISE 1502 ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS 1503 1504} 1505 1506# Reject inbound routes when 'from 192.0.2.31 AS 4200000000 - 4294967295' - reject code: 7 1507allow quick from 192.0.2.31 AS 4200000000 - 4294967295 set { 1508 localpref 1 1509 community 65520:0 1510 community 65520:7 1511 community delete NO_ADVERTISE 1512 ext-community delete $INTCOMM_PREF_OK_ROA 1513 ext-community delete $INTCOMM_ROUTE_OK_WL 1514 ext-community delete $INTCOMM_ORIGIN_OK 1515 ext-community delete $INTCOMM_ORIGIN_KO 1516 ext-community delete $INTCOMM_PREFIX_OK 1517 ext-community delete $INTCOMM_PREFIX_KO 1518 ext-community delete $INTCOMM_IRR_REJECT 1519 ext-community delete $INTCOMM_RPKI_UNKNOWN 1520 ext-community delete $INTCOMM_RPKI_INVALID 1521 ext-community delete $INTCOMM_RPKI_VALID 1522 ext-community delete $INTCOMM_NO_EXPORT 1523 ext-community delete $INTCOMM_NO_ADVERTISE 1524 ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS 1525 1526} 1527 1528 1529# AS_PATH: transit-free ASNs 1530# Reject inbound routes when 'from 192.0.2.31 AS { 174 }' - reject code: 8 1531allow quick from 192.0.2.31 AS { 174 } set { 1532 localpref 1 1533 community 65520:0 1534 community 65520:8 1535 community delete NO_ADVERTISE 1536 ext-community delete $INTCOMM_PREF_OK_ROA 1537 ext-community delete $INTCOMM_ROUTE_OK_WL 1538 ext-community delete $INTCOMM_ORIGIN_OK 1539 ext-community delete $INTCOMM_ORIGIN_KO 1540 ext-community delete $INTCOMM_PREFIX_OK 1541 ext-community delete $INTCOMM_PREFIX_KO 1542 ext-community delete $INTCOMM_IRR_REJECT 1543 ext-community delete $INTCOMM_RPKI_UNKNOWN 1544 ext-community delete $INTCOMM_RPKI_INVALID 1545 ext-community delete $INTCOMM_RPKI_VALID 1546 ext-community delete $INTCOMM_NO_EXPORT 1547 ext-community delete $INTCOMM_NO_ADVERTISE 1548 ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS 1549 1550} 1551 1552 1553# AS_PATH: never via route-servers ASNs 1554# Reject inbound routes when 'from 192.0.2.31 AS as-set neverviarouteserver' - reject code: 15 1555allow quick from 192.0.2.31 AS as-set neverviarouteserver set { 1556 localpref 1 1557 community 65520:0 1558 community 65520:15 1559 community delete NO_ADVERTISE 1560 ext-community delete $INTCOMM_PREF_OK_ROA 1561 ext-community delete $INTCOMM_ROUTE_OK_WL 1562 ext-community delete $INTCOMM_ORIGIN_OK 1563 ext-community delete $INTCOMM_ORIGIN_KO 1564 ext-community delete $INTCOMM_PREFIX_OK 1565 ext-community delete $INTCOMM_PREFIX_KO 1566 ext-community delete $INTCOMM_IRR_REJECT 1567 ext-community delete $INTCOMM_RPKI_UNKNOWN 1568 ext-community delete $INTCOMM_RPKI_INVALID 1569 ext-community delete $INTCOMM_RPKI_VALID 1570 ext-community delete $INTCOMM_NO_EXPORT 1571 ext-community delete $INTCOMM_NO_ADVERTISE 1572 ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS 1573 1574} 1575 1576 1577 1578 1579 1580# Prefix: client's blacklist 1581prefix-set "client_AS3_1_black_list_pref_ipv4" { 1582 3.0.1.0/24 prefixlen 24 - 32 1583 1584} 1585# Reject inbound routes when 'from 192.0.2.31 prefix-set client_AS3_1_black_list_pref_ipv4' - reject code: 11 1586allow quick from 192.0.2.31 prefix-set client_AS3_1_black_list_pref_ipv4 set { 1587 localpref 1 1588 community 65520:0 1589 community 65520:11 1590 community delete NO_ADVERTISE 1591 ext-community delete $INTCOMM_PREF_OK_ROA 1592 ext-community delete $INTCOMM_ROUTE_OK_WL 1593 ext-community delete $INTCOMM_ORIGIN_OK 1594 ext-community delete $INTCOMM_ORIGIN_KO 1595 ext-community delete $INTCOMM_PREFIX_OK 1596 ext-community delete $INTCOMM_PREFIX_KO 1597 ext-community delete $INTCOMM_IRR_REJECT 1598 ext-community delete $INTCOMM_RPKI_UNKNOWN 1599 ext-community delete $INTCOMM_RPKI_INVALID 1600 ext-community delete $INTCOMM_RPKI_VALID 1601 ext-community delete $INTCOMM_NO_EXPORT 1602 ext-community delete $INTCOMM_NO_ADVERTISE 1603 ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS 1604 1605} 1606 1607 1608 1609 1610# Blackhole request? 1611match from 192.0.2.31 set community delete 65524:3 1612match from 192.0.2.31 set ext-community delete rt 65524:3 1613 1614 1615# Remove internal communities before accepting the route 1616match from 192.0.2.31 community BLACKHOLE set { 1617 ext-community delete $INTCOMM_RPKI_INVALID 1618 ext-community delete $INTCOMM_PREF_OK_ROA 1619 ext-community delete $INTCOMM_ROUTE_OK_WL 1620 ext-community delete $INTCOMM_ORIGIN_OK 1621 ext-community delete $INTCOMM_ORIGIN_KO 1622 ext-community delete $INTCOMM_PREFIX_OK 1623 ext-community delete $INTCOMM_PREFIX_KO 1624 ext-community delete $INTCOMM_IRR_REJECT 1625 ext-community delete $INTCOMM_RPKI_UNKNOWN 1626 ext-community delete $INTCOMM_RPKI_VALID 1627 ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS 1628 1629} 1630allow from 192.0.2.31 community 65534:0 set { 1631 ext-community delete $INTCOMM_RPKI_INVALID 1632 ext-community delete $INTCOMM_PREF_OK_ROA 1633 ext-community delete $INTCOMM_ROUTE_OK_WL 1634 ext-community delete $INTCOMM_ORIGIN_OK 1635 ext-community delete $INTCOMM_ORIGIN_KO 1636 ext-community delete $INTCOMM_PREFIX_OK 1637 ext-community delete $INTCOMM_PREFIX_KO 1638 ext-community delete $INTCOMM_IRR_REJECT 1639 ext-community delete $INTCOMM_RPKI_UNKNOWN 1640 ext-community delete $INTCOMM_RPKI_VALID 1641 ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS 1642 1643} 1644allow from 192.0.2.31 large-community 65534:0:0 set { 1645 ext-community delete $INTCOMM_RPKI_INVALID 1646 ext-community delete $INTCOMM_PREF_OK_ROA 1647 ext-community delete $INTCOMM_ROUTE_OK_WL 1648 ext-community delete $INTCOMM_ORIGIN_OK 1649 ext-community delete $INTCOMM_ORIGIN_KO 1650 ext-community delete $INTCOMM_PREFIX_OK 1651 ext-community delete $INTCOMM_PREFIX_KO 1652 ext-community delete $INTCOMM_IRR_REJECT 1653 ext-community delete $INTCOMM_RPKI_UNKNOWN 1654 ext-community delete $INTCOMM_RPKI_VALID 1655 ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS 1656 1657} 1658 1659 1660# Add the rpki_bgp_origin_validation_not_performed community 1661match from 192.0.2.31 community BLACKHOLE set community 65530:4 1662match from 192.0.2.31 community BLACKHOLE set large-community 999:65530:4 1663 1664match from 192.0.2.31 community 65534:0 set { community 65530:4 large-community 999:65530:4} 1665match from 192.0.2.31 large-community 65534:0:0 set { community 65530:4 large-community 999:65530:4} 1666 1667 1668allow quick from 192.0.2.31 community BLACKHOLE 1669allow quick from 192.0.2.31 community 65534:0 1670allow quick from 192.0.2.31 large-community 65534:0:0 1671 1672 1673match from 192.0.2.31 set community 65524:3 1674match from 192.0.2.31 set ext-community rt 65524:3 1675 1676 1677# RPKI-based Origin Validation 1678# Reject inbound routes when 'from 192.0.2.31 ext-community $INTCOMM_RPKI_INVALID' - reject code: 14 1679allow quick from 192.0.2.31 ext-community $INTCOMM_RPKI_INVALID set { 1680 localpref 1 1681 community 65520:0 1682 community 65520:14 1683 community delete NO_ADVERTISE 1684 ext-community delete $INTCOMM_PREF_OK_ROA 1685 ext-community delete $INTCOMM_ROUTE_OK_WL 1686 ext-community delete $INTCOMM_ORIGIN_OK 1687 ext-community delete $INTCOMM_ORIGIN_KO 1688 ext-community delete $INTCOMM_PREFIX_OK 1689 ext-community delete $INTCOMM_PREFIX_KO 1690 ext-community delete $INTCOMM_IRR_REJECT 1691 ext-community delete $INTCOMM_RPKI_UNKNOWN 1692 ext-community delete $INTCOMM_RPKI_INVALID 1693 ext-community delete $INTCOMM_RPKI_VALID 1694 ext-community delete $INTCOMM_NO_EXPORT 1695 ext-community delete $INTCOMM_NO_ADVERTISE 1696 ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS 1697 1698} 1699 1700 1701# Prefix: length 1702# Reject inbound routes when 'from 192.0.2.31 prefix 0.0.0.0/0 prefixlen 8 >< 24' - reject code: 13 1703allow quick from 192.0.2.31 prefix 0.0.0.0/0 prefixlen 8 >< 24 set { 1704 localpref 1 1705 community 65520:0 1706 community 65520:13 1707 community delete NO_ADVERTISE 1708 ext-community delete $INTCOMM_PREF_OK_ROA 1709 ext-community delete $INTCOMM_ROUTE_OK_WL 1710 ext-community delete $INTCOMM_ORIGIN_OK 1711 ext-community delete $INTCOMM_ORIGIN_KO 1712 ext-community delete $INTCOMM_PREFIX_OK 1713 ext-community delete $INTCOMM_PREFIX_KO 1714 ext-community delete $INTCOMM_IRR_REJECT 1715 ext-community delete $INTCOMM_RPKI_UNKNOWN 1716 ext-community delete $INTCOMM_RPKI_INVALID 1717 ext-community delete $INTCOMM_RPKI_VALID 1718 ext-community delete $INTCOMM_NO_EXPORT 1719 ext-community delete $INTCOMM_NO_ADVERTISE 1720 ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS 1721 1722} 1723 1724 1725# Graceful shutdown 1726match from 192.0.2.31 community GRACEFUL_SHUTDOWN set localpref 5 1727 1728# Remove internal communities before accepting the route 1729match from 192.0.2.31 set { 1730 ext-community delete $INTCOMM_PREF_OK_ROA 1731 ext-community delete $INTCOMM_ROUTE_OK_WL 1732 ext-community delete $INTCOMM_ORIGIN_OK 1733 ext-community delete $INTCOMM_ORIGIN_KO 1734 ext-community delete $INTCOMM_PREFIX_OK 1735 ext-community delete $INTCOMM_PREFIX_KO 1736 ext-community delete $INTCOMM_IRR_REJECT 1737 ext-community delete $INTCOMM_RPKI_UNKNOWN 1738 ext-community delete $INTCOMM_RPKI_VALID 1739 ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS 1740 1741} 1742 1743match from 192.0.2.31 set community delete 65524:3 1744match from 192.0.2.31 set ext-community delete rt 65524:3 1745 1746 1747 1748allow quick from 192.0.2.31 1749 1750 1751 1752# --------------------------------------------- 1753# client AS3_1, outbound 1754 1755deny quick to 192.0.2.31 community 65520:0 1756 1757 1758 1759# Blackhole request? 1760# Configured policy: rewrite-next-hop 1761match to 192.0.2.31 community 65534:0 set community BLACKHOLE 1762match to 192.0.2.31 large-community 65534:0:0 set community BLACKHOLE 1763 1764match to 192.0.2.31 community BLACKHOLE set community NO_EXPORT 1765match to 192.0.2.31 community BLACKHOLE set nexthop 192.0.2.66 1766 1767 1768# RPKI-based Origin Validation 1769# Do not announce INVALID to clients 1770deny quick to 192.0.2.31 ext-community $INTCOMM_RPKI_INVALID 1771 1772# NO_EXPORT and NO_ADVERTISE communities 1773# add_noexport_to_any 1774match to 192.0.2.31 community 65507:999 set community NO_EXPORT 1775match to 192.0.2.31 ext-community rt 65507:999 set community NO_EXPORT 1776match to 192.0.2.31 large-community 999:65507:999 set community NO_EXPORT 1777 1778# add_noadvertise_to_any 1779match to 192.0.2.31 community 65508:999 set community NO_ADVERTISE 1780match to 192.0.2.31 ext-community rt 65508:999 set community NO_ADVERTISE 1781match to 192.0.2.31 large-community 999:65508:999 set community NO_ADVERTISE 1782 1783# add_noexport_to_peer 1784match to 192.0.2.31 community 65509:3 set community NO_EXPORT 1785match to 192.0.2.31 ext-community rt 65509:3 set community NO_EXPORT 1786match to 192.0.2.31 large-community 999:65509:3 set community NO_EXPORT 1787 1788# add_noadvertise_to_peer 1789match to 192.0.2.31 community 65510:3 set community NO_ADVERTISE 1790match to 192.0.2.31 ext-community rt 65510:3 set community NO_ADVERTISE 1791match to 192.0.2.31 large-community 999:65510:3 set community NO_ADVERTISE 1792 1793 1794# BGP control communities 1795allow to 192.0.2.31 1796 1797# do_not_announce_to_any 1798deny to 192.0.2.31 community 0:999 1799deny to 192.0.2.31 ext-community rt 0:999 1800deny to 192.0.2.31 large-community 999:0:999 1801 1802# do_not_announce_to_peer 1803deny quick to 192.0.2.31 community 0:3 1804deny quick to 192.0.2.31 ext-community rt 0:3 1805deny quick to 192.0.2.31 large-community 999:0:3 1806 1807# announce_to_peer 1808allow to 192.0.2.31 community 65501:3 1809allow to 192.0.2.31 ext-community rt 65501:3 1810allow to 192.0.2.31 large-community 999:65501:3 1811 1812 1813# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities 1814# for prepending can be processed. As soon as one prepending action is performed, 1815# this internal community is removed, so that further actions are not processed. 1816match to 192.0.2.31 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS 1817 1818# prepend_once_to_peer AS3; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions 1819match to 192.0.2.31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65521:3 set { 1820 prepend-neighbor 1 1821 ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS 1822} 1823match to 192.0.2.31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65521:3 set { 1824 prepend-neighbor 1 1825 ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS 1826} 1827match to 192.0.2.31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65521:3 set { 1828 prepend-neighbor 1 1829 ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS 1830} 1831 1832# prepend_twice_to_peer AS3; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions 1833match to 192.0.2.31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65522:3 set { 1834 prepend-neighbor 2 1835 ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS 1836} 1837match to 192.0.2.31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65522:3 set { 1838 prepend-neighbor 2 1839 ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS 1840} 1841match to 192.0.2.31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65522:3 set { 1842 prepend-neighbor 2 1843 ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS 1844} 1845 1846# prepend_thrice_to_peer AS3; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions 1847match to 192.0.2.31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65523:3 set { 1848 prepend-neighbor 3 1849 ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS 1850} 1851match to 192.0.2.31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65523:3 set { 1852 prepend-neighbor 3 1853 ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS 1854} 1855match to 192.0.2.31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65523:3 set { 1856 prepend-neighbor 3 1857 ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS 1858} 1859 1860 1861# prepend_once_to_any; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions 1862match to 192.0.2.31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65521:65521 set { 1863 prepend-neighbor 1 1864 ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS 1865} 1866match to 192.0.2.31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65521:65521 set { 1867 prepend-neighbor 1 1868 ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS 1869} 1870match to 192.0.2.31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65521:65521 set { 1871 prepend-neighbor 1 1872 ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS 1873} 1874 1875# prepend_twice_to_any; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions 1876match to 192.0.2.31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65522:65522 set { 1877 prepend-neighbor 2 1878 ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS 1879} 1880match to 192.0.2.31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65522:65522 set { 1881 prepend-neighbor 2 1882 ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS 1883} 1884match to 192.0.2.31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65522:65522 set { 1885 prepend-neighbor 2 1886 ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS 1887} 1888 1889# prepend_thrice_to_any; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions 1890match to 192.0.2.31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65523:65523 set { 1891 prepend-neighbor 3 1892 ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS 1893} 1894match to 192.0.2.31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65523:65523 set { 1895 prepend-neighbor 3 1896 ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS 1897} 1898match to 192.0.2.31 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65523:65523 set { 1899 prepend-neighbor 3 1900 ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS 1901} 1902 1903 1904 1905# --------------------------------------------- 1906# client AS4_1, inbound 1907 1908 1909 1910# NEXT_HOP 1911match from 192.0.2.41 set community NO_ADVERTISE 1912match from 192.0.2.41 nexthop 192.0.2.41 set community delete NO_ADVERTISE 1913# Reject inbound routes when 'from 192.0.2.41 community NO_ADVERTISE' - reject code: 5 1914allow quick from 192.0.2.41 community NO_ADVERTISE set { 1915 localpref 1 1916 community 65520:0 1917 community 65520:5 1918 community delete NO_ADVERTISE 1919 ext-community delete $INTCOMM_PREF_OK_ROA 1920 ext-community delete $INTCOMM_ROUTE_OK_WL 1921 ext-community delete $INTCOMM_ORIGIN_OK 1922 ext-community delete $INTCOMM_ORIGIN_KO 1923 ext-community delete $INTCOMM_PREFIX_OK 1924 ext-community delete $INTCOMM_PREFIX_KO 1925 ext-community delete $INTCOMM_IRR_REJECT 1926 ext-community delete $INTCOMM_RPKI_UNKNOWN 1927 ext-community delete $INTCOMM_RPKI_INVALID 1928 ext-community delete $INTCOMM_RPKI_VALID 1929 ext-community delete $INTCOMM_NO_EXPORT 1930 ext-community delete $INTCOMM_NO_ADVERTISE 1931 ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS 1932 1933} 1934 1935 1936# AS_PATH: invalid ASNs 1937# Reject inbound routes when 'from 192.0.2.41 AS 23456' - reject code: 7 1938allow quick from 192.0.2.41 AS 23456 set { 1939 localpref 1 1940 community 65520:0 1941 community 65520:7 1942 community delete NO_ADVERTISE 1943 ext-community delete $INTCOMM_PREF_OK_ROA 1944 ext-community delete $INTCOMM_ROUTE_OK_WL 1945 ext-community delete $INTCOMM_ORIGIN_OK 1946 ext-community delete $INTCOMM_ORIGIN_KO 1947 ext-community delete $INTCOMM_PREFIX_OK 1948 ext-community delete $INTCOMM_PREFIX_KO 1949 ext-community delete $INTCOMM_IRR_REJECT 1950 ext-community delete $INTCOMM_RPKI_UNKNOWN 1951 ext-community delete $INTCOMM_RPKI_INVALID 1952 ext-community delete $INTCOMM_RPKI_VALID 1953 ext-community delete $INTCOMM_NO_EXPORT 1954 ext-community delete $INTCOMM_NO_ADVERTISE 1955 ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS 1956 1957} 1958 1959# Reject inbound routes when 'from 192.0.2.41 AS 64496 - 131071' - reject code: 7 1960allow quick from 192.0.2.41 AS 64496 - 131071 set { 1961 localpref 1 1962 community 65520:0 1963 community 65520:7 1964 community delete NO_ADVERTISE 1965 ext-community delete $INTCOMM_PREF_OK_ROA 1966 ext-community delete $INTCOMM_ROUTE_OK_WL 1967 ext-community delete $INTCOMM_ORIGIN_OK 1968 ext-community delete $INTCOMM_ORIGIN_KO 1969 ext-community delete $INTCOMM_PREFIX_OK 1970 ext-community delete $INTCOMM_PREFIX_KO 1971 ext-community delete $INTCOMM_IRR_REJECT 1972 ext-community delete $INTCOMM_RPKI_UNKNOWN 1973 ext-community delete $INTCOMM_RPKI_INVALID 1974 ext-community delete $INTCOMM_RPKI_VALID 1975 ext-community delete $INTCOMM_NO_EXPORT 1976 ext-community delete $INTCOMM_NO_ADVERTISE 1977 ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS 1978 1979} 1980 1981# Reject inbound routes when 'from 192.0.2.41 AS 4200000000 - 4294967295' - reject code: 7 1982allow quick from 192.0.2.41 AS 4200000000 - 4294967295 set { 1983 localpref 1 1984 community 65520:0 1985 community 65520:7 1986 community delete NO_ADVERTISE 1987 ext-community delete $INTCOMM_PREF_OK_ROA 1988 ext-community delete $INTCOMM_ROUTE_OK_WL 1989 ext-community delete $INTCOMM_ORIGIN_OK 1990 ext-community delete $INTCOMM_ORIGIN_KO 1991 ext-community delete $INTCOMM_PREFIX_OK 1992 ext-community delete $INTCOMM_PREFIX_KO 1993 ext-community delete $INTCOMM_IRR_REJECT 1994 ext-community delete $INTCOMM_RPKI_UNKNOWN 1995 ext-community delete $INTCOMM_RPKI_INVALID 1996 ext-community delete $INTCOMM_RPKI_VALID 1997 ext-community delete $INTCOMM_NO_EXPORT 1998 ext-community delete $INTCOMM_NO_ADVERTISE 1999 ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS 2000 2001} 2002 2003 2004# AS_PATH: transit-free ASNs 2005# Reject inbound routes when 'from 192.0.2.41 AS { 3, 174 }' - reject code: 8 2006allow quick from 192.0.2.41 AS { 3, 174 } set { 2007 localpref 1 2008 community 65520:0 2009 community 65520:8 2010 community delete NO_ADVERTISE 2011 ext-community delete $INTCOMM_PREF_OK_ROA 2012 ext-community delete $INTCOMM_ROUTE_OK_WL 2013 ext-community delete $INTCOMM_ORIGIN_OK 2014 ext-community delete $INTCOMM_ORIGIN_KO 2015 ext-community delete $INTCOMM_PREFIX_OK 2016 ext-community delete $INTCOMM_PREFIX_KO 2017 ext-community delete $INTCOMM_IRR_REJECT 2018 ext-community delete $INTCOMM_RPKI_UNKNOWN 2019 ext-community delete $INTCOMM_RPKI_INVALID 2020 ext-community delete $INTCOMM_RPKI_VALID 2021 ext-community delete $INTCOMM_NO_EXPORT 2022 ext-community delete $INTCOMM_NO_ADVERTISE 2023 ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS 2024 2025} 2026 2027 2028# AS_PATH: never via route-servers ASNs 2029# Reject inbound routes when 'from 192.0.2.41 AS as-set neverviarouteserver' - reject code: 15 2030allow quick from 192.0.2.41 AS as-set neverviarouteserver set { 2031 localpref 1 2032 community 65520:0 2033 community 65520:15 2034 community delete NO_ADVERTISE 2035 ext-community delete $INTCOMM_PREF_OK_ROA 2036 ext-community delete $INTCOMM_ROUTE_OK_WL 2037 ext-community delete $INTCOMM_ORIGIN_OK 2038 ext-community delete $INTCOMM_ORIGIN_KO 2039 ext-community delete $INTCOMM_PREFIX_OK 2040 ext-community delete $INTCOMM_PREFIX_KO 2041 ext-community delete $INTCOMM_IRR_REJECT 2042 ext-community delete $INTCOMM_RPKI_UNKNOWN 2043 ext-community delete $INTCOMM_RPKI_INVALID 2044 ext-community delete $INTCOMM_RPKI_VALID 2045 ext-community delete $INTCOMM_NO_EXPORT 2046 ext-community delete $INTCOMM_NO_ADVERTISE 2047 ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS 2048 2049} 2050 2051 2052 2053 2054 2055 2056 2057 2058# Blackhole request? 2059match from 192.0.2.41 set community delete 65524:4 2060match from 192.0.2.41 set ext-community delete rt 65524:4 2061 2062 2063# Remove internal communities before accepting the route 2064match from 192.0.2.41 community BLACKHOLE set { 2065 ext-community delete $INTCOMM_RPKI_INVALID 2066 ext-community delete $INTCOMM_PREF_OK_ROA 2067 ext-community delete $INTCOMM_ROUTE_OK_WL 2068 ext-community delete $INTCOMM_ORIGIN_OK 2069 ext-community delete $INTCOMM_ORIGIN_KO 2070 ext-community delete $INTCOMM_PREFIX_OK 2071 ext-community delete $INTCOMM_PREFIX_KO 2072 ext-community delete $INTCOMM_IRR_REJECT 2073 ext-community delete $INTCOMM_RPKI_UNKNOWN 2074 ext-community delete $INTCOMM_RPKI_VALID 2075 ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS 2076 2077} 2078allow from 192.0.2.41 community 65534:0 set { 2079 ext-community delete $INTCOMM_RPKI_INVALID 2080 ext-community delete $INTCOMM_PREF_OK_ROA 2081 ext-community delete $INTCOMM_ROUTE_OK_WL 2082 ext-community delete $INTCOMM_ORIGIN_OK 2083 ext-community delete $INTCOMM_ORIGIN_KO 2084 ext-community delete $INTCOMM_PREFIX_OK 2085 ext-community delete $INTCOMM_PREFIX_KO 2086 ext-community delete $INTCOMM_IRR_REJECT 2087 ext-community delete $INTCOMM_RPKI_UNKNOWN 2088 ext-community delete $INTCOMM_RPKI_VALID 2089 ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS 2090 2091} 2092allow from 192.0.2.41 large-community 65534:0:0 set { 2093 ext-community delete $INTCOMM_RPKI_INVALID 2094 ext-community delete $INTCOMM_PREF_OK_ROA 2095 ext-community delete $INTCOMM_ROUTE_OK_WL 2096 ext-community delete $INTCOMM_ORIGIN_OK 2097 ext-community delete $INTCOMM_ORIGIN_KO 2098 ext-community delete $INTCOMM_PREFIX_OK 2099 ext-community delete $INTCOMM_PREFIX_KO 2100 ext-community delete $INTCOMM_IRR_REJECT 2101 ext-community delete $INTCOMM_RPKI_UNKNOWN 2102 ext-community delete $INTCOMM_RPKI_VALID 2103 ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS 2104 2105} 2106 2107 2108# Add the rpki_bgp_origin_validation_not_performed community 2109match from 192.0.2.41 community BLACKHOLE set community 65530:4 2110match from 192.0.2.41 community BLACKHOLE set large-community 999:65530:4 2111 2112match from 192.0.2.41 community 65534:0 set { community 65530:4 large-community 999:65530:4} 2113match from 192.0.2.41 large-community 65534:0:0 set { community 65530:4 large-community 999:65530:4} 2114 2115 2116allow quick from 192.0.2.41 community BLACKHOLE 2117allow quick from 192.0.2.41 community 65534:0 2118allow quick from 192.0.2.41 large-community 65534:0:0 2119 2120 2121match from 192.0.2.41 set community 65524:4 2122match from 192.0.2.41 set ext-community rt 65524:4 2123 2124 2125# RPKI-based Origin Validation 2126# Reject inbound routes when 'from 192.0.2.41 ext-community $INTCOMM_RPKI_INVALID' - reject code: 14 2127allow quick from 192.0.2.41 ext-community $INTCOMM_RPKI_INVALID set { 2128 localpref 1 2129 community 65520:0 2130 community 65520:14 2131 community delete NO_ADVERTISE 2132 ext-community delete $INTCOMM_PREF_OK_ROA 2133 ext-community delete $INTCOMM_ROUTE_OK_WL 2134 ext-community delete $INTCOMM_ORIGIN_OK 2135 ext-community delete $INTCOMM_ORIGIN_KO 2136 ext-community delete $INTCOMM_PREFIX_OK 2137 ext-community delete $INTCOMM_PREFIX_KO 2138 ext-community delete $INTCOMM_IRR_REJECT 2139 ext-community delete $INTCOMM_RPKI_UNKNOWN 2140 ext-community delete $INTCOMM_RPKI_INVALID 2141 ext-community delete $INTCOMM_RPKI_VALID 2142 ext-community delete $INTCOMM_NO_EXPORT 2143 ext-community delete $INTCOMM_NO_ADVERTISE 2144 ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS 2145 2146} 2147 2148 2149# Prefix: length 2150# Reject inbound routes when 'from 192.0.2.41 prefix 0.0.0.0/0 prefixlen 8 >< 24' - reject code: 13 2151allow quick from 192.0.2.41 prefix 0.0.0.0/0 prefixlen 8 >< 24 set { 2152 localpref 1 2153 community 65520:0 2154 community 65520:13 2155 community delete NO_ADVERTISE 2156 ext-community delete $INTCOMM_PREF_OK_ROA 2157 ext-community delete $INTCOMM_ROUTE_OK_WL 2158 ext-community delete $INTCOMM_ORIGIN_OK 2159 ext-community delete $INTCOMM_ORIGIN_KO 2160 ext-community delete $INTCOMM_PREFIX_OK 2161 ext-community delete $INTCOMM_PREFIX_KO 2162 ext-community delete $INTCOMM_IRR_REJECT 2163 ext-community delete $INTCOMM_RPKI_UNKNOWN 2164 ext-community delete $INTCOMM_RPKI_INVALID 2165 ext-community delete $INTCOMM_RPKI_VALID 2166 ext-community delete $INTCOMM_NO_EXPORT 2167 ext-community delete $INTCOMM_NO_ADVERTISE 2168 ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS 2169 2170} 2171 2172 2173# Graceful shutdown 2174match from 192.0.2.41 community GRACEFUL_SHUTDOWN set localpref 5 2175 2176# Remove internal communities before accepting the route 2177match from 192.0.2.41 set { 2178 ext-community delete $INTCOMM_PREF_OK_ROA 2179 ext-community delete $INTCOMM_ROUTE_OK_WL 2180 ext-community delete $INTCOMM_ORIGIN_OK 2181 ext-community delete $INTCOMM_ORIGIN_KO 2182 ext-community delete $INTCOMM_PREFIX_OK 2183 ext-community delete $INTCOMM_PREFIX_KO 2184 ext-community delete $INTCOMM_IRR_REJECT 2185 ext-community delete $INTCOMM_RPKI_UNKNOWN 2186 ext-community delete $INTCOMM_RPKI_VALID 2187 ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS 2188 2189} 2190 2191match from 192.0.2.41 set community delete 65524:4 2192match from 192.0.2.41 set ext-community delete rt 65524:4 2193 2194 2195 2196allow quick from 192.0.2.41 2197 2198 2199 2200# --------------------------------------------- 2201# client AS4_1, outbound 2202 2203deny quick to 192.0.2.41 community 65520:0 2204 2205 2206 2207# Blackhole request? 2208# Configured policy: rewrite-next-hop 2209match to 192.0.2.41 community 65534:0 set community BLACKHOLE 2210match to 192.0.2.41 large-community 65534:0:0 set community BLACKHOLE 2211 2212match to 192.0.2.41 community BLACKHOLE set community NO_EXPORT 2213match to 192.0.2.41 community BLACKHOLE set nexthop 192.0.2.66 2214 2215 2216# RPKI-based Origin Validation 2217# Do not announce INVALID to clients 2218deny quick to 192.0.2.41 ext-community $INTCOMM_RPKI_INVALID 2219 2220# NO_EXPORT and NO_ADVERTISE communities 2221# add_noexport_to_any 2222match to 192.0.2.41 community 65507:999 set community NO_EXPORT 2223match to 192.0.2.41 ext-community rt 65507:999 set community NO_EXPORT 2224match to 192.0.2.41 large-community 999:65507:999 set community NO_EXPORT 2225 2226# add_noadvertise_to_any 2227match to 192.0.2.41 community 65508:999 set community NO_ADVERTISE 2228match to 192.0.2.41 ext-community rt 65508:999 set community NO_ADVERTISE 2229match to 192.0.2.41 large-community 999:65508:999 set community NO_ADVERTISE 2230 2231# add_noexport_to_peer 2232match to 192.0.2.41 community 65509:4 set community NO_EXPORT 2233match to 192.0.2.41 ext-community rt 65509:4 set community NO_EXPORT 2234match to 192.0.2.41 large-community 999:65509:4 set community NO_EXPORT 2235 2236# add_noadvertise_to_peer 2237match to 192.0.2.41 community 65510:4 set community NO_ADVERTISE 2238match to 192.0.2.41 ext-community rt 65510:4 set community NO_ADVERTISE 2239match to 192.0.2.41 large-community 999:65510:4 set community NO_ADVERTISE 2240 2241 2242# BGP control communities 2243allow to 192.0.2.41 2244 2245# do_not_announce_to_any 2246deny to 192.0.2.41 community 0:999 2247deny to 192.0.2.41 ext-community rt 0:999 2248deny to 192.0.2.41 large-community 999:0:999 2249 2250# do_not_announce_to_peer 2251deny quick to 192.0.2.41 community 0:4 2252deny quick to 192.0.2.41 ext-community rt 0:4 2253deny quick to 192.0.2.41 large-community 999:0:4 2254 2255 2256# announce_to_peer 2257allow to 192.0.2.41 community 65501:4 2258allow to 192.0.2.41 ext-community rt 65501:4 2259allow to 192.0.2.41 large-community 999:65501:4 2260 2261 2262# Add the $INTCOMM_PROCESS_PREPEND_COMMS ext community to signal that communities 2263# for prepending can be processed. As soon as one prepending action is performed, 2264# this internal community is removed, so that further actions are not processed. 2265match to 192.0.2.41 set ext-community $INTCOMM_PROCESS_PREPEND_COMMS 2266 2267# prepend_once_to_peer AS4; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions 2268match to 192.0.2.41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65521:4 set { 2269 prepend-neighbor 1 2270 ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS 2271} 2272match to 192.0.2.41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65521:4 set { 2273 prepend-neighbor 1 2274 ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS 2275} 2276match to 192.0.2.41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65521:4 set { 2277 prepend-neighbor 1 2278 ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS 2279} 2280 2281# prepend_twice_to_peer AS4; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions 2282match to 192.0.2.41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65522:4 set { 2283 prepend-neighbor 2 2284 ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS 2285} 2286match to 192.0.2.41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65522:4 set { 2287 prepend-neighbor 2 2288 ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS 2289} 2290match to 192.0.2.41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65522:4 set { 2291 prepend-neighbor 2 2292 ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS 2293} 2294 2295# prepend_thrice_to_peer AS4; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions 2296match to 192.0.2.41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65523:4 set { 2297 prepend-neighbor 3 2298 ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS 2299} 2300match to 192.0.2.41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65523:4 set { 2301 prepend-neighbor 3 2302 ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS 2303} 2304match to 192.0.2.41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65523:4 set { 2305 prepend-neighbor 3 2306 ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS 2307} 2308 2309 2310# prepend_once_to_any; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions 2311match to 192.0.2.41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65521:65521 set { 2312 prepend-neighbor 1 2313 ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS 2314} 2315match to 192.0.2.41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65521:65521 set { 2316 prepend-neighbor 1 2317 ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS 2318} 2319match to 192.0.2.41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65521:65521 set { 2320 prepend-neighbor 1 2321 ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS 2322} 2323 2324# prepend_twice_to_any; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions 2325match to 192.0.2.41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65522:65522 set { 2326 prepend-neighbor 2 2327 ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS 2328} 2329match to 192.0.2.41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65522:65522 set { 2330 prepend-neighbor 2 2331 ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS 2332} 2333match to 192.0.2.41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65522:65522 set { 2334 prepend-neighbor 2 2335 ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS 2336} 2337 2338# prepend_thrice_to_any; remove INTCOMM_PROCESS_PREPEND_COMMS to prevent further prepending actions 2339match to 192.0.2.41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS community 65523:65523 set { 2340 prepend-neighbor 3 2341 ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS 2342} 2343match to 192.0.2.41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS ext-community rt 65523:65523 set { 2344 prepend-neighbor 3 2345 ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS 2346} 2347match to 192.0.2.41 ext-community $INTCOMM_PROCESS_PREPEND_COMMS large-community 999:65523:65523 set { 2348 prepend-neighbor 3 2349 ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS 2350} 2351 2352 2353 2354# Scrub communities from outbound routes 2355# add_noadvertise_to_any 2356match to group clients set community delete 65508:999 2357match to group clients set ext-community delete rt 65508:999 2358match to group clients set large-community delete 999:65508:999 2359 2360# add_noadvertise_to_peer 2361match to group clients set community delete 65510:* 2362match to group clients set ext-community delete rt 65510:* 2363match to group clients set large-community delete 999:65510:* 2364 2365# add_noexport_to_any 2366match to group clients set community delete 65507:999 2367match to group clients set ext-community delete rt 65507:999 2368match to group clients set large-community delete 999:65507:999 2369 2370# add_noexport_to_peer 2371match to group clients set community delete 65509:* 2372match to group clients set ext-community delete rt 65509:* 2373match to group clients set large-community delete 999:65509:* 2374 2375# announce_to_peer 2376match to group clients set community delete 65501:* 2377match to group clients set ext-community delete rt 65501:* 2378match to group clients set large-community delete 999:65501:* 2379 2380# blackholing 2381match to group clients set community delete 65534:0 2382match to group clients set large-community delete 65534:0:0 2383 2384# do_not_announce_to_any 2385match to group clients set community delete 0:999 2386match to group clients set ext-community delete rt 0:999 2387match to group clients set large-community delete 999:0:999 2388 2389# do_not_announce_to_peer 2390match to group clients set community delete 0:* 2391match to group clients set ext-community delete rt 0:* 2392match to group clients set large-community delete 999:0:* 2393 2394# prepend_once_to_any 2395match to group clients set community delete 65521:65521 2396match to group clients set ext-community delete rt 65521:65521 2397match to group clients set large-community delete 999:65521:65521 2398 2399# prepend_once_to_peer 2400match to group clients set community delete 65521:* 2401match to group clients set ext-community delete rt 65521:* 2402match to group clients set large-community delete 999:65521:* 2403 2404# prepend_thrice_to_any 2405match to group clients set community delete 65523:65523 2406match to group clients set ext-community delete rt 65523:65523 2407match to group clients set large-community delete 999:65523:65523 2408 2409# prepend_thrice_to_peer 2410match to group clients set community delete 65523:* 2411match to group clients set ext-community delete rt 65523:* 2412match to group clients set large-community delete 999:65523:* 2413 2414# prepend_twice_to_any 2415match to group clients set community delete 65522:65522 2416match to group clients set ext-community delete rt 65522:65522 2417match to group clients set large-community delete 999:65522:65522 2418 2419# prepend_twice_to_peer 2420match to group clients set community delete 65522:* 2421match to group clients set ext-community delete rt 65522:* 2422match to group clients set large-community delete 999:65522:* 2423 2424# reject_cause 2425match to group clients set community delete 65520:* 2426 2427# rejected_route_announced_by 2428match to group clients set community delete 65524:* 2429match to group clients set ext-community delete rt 65524:* 2430 2431 2432# Scrub prepending communities 2433match to group clients set { 2434 community delete 65521:65521 2435 ext-community delete rt 65521:65521 2436 large-community delete 999:65521:65521 2437 2438} 2439match to group clients set { 2440 community delete 65521:* 2441 ext-community delete rt 65521:* 2442 large-community delete 999:65521:* 2443 2444} 2445match to group clients set { 2446 community delete 64537:* 2447 ext-community delete rt 64537:* 2448 large-community delete 999:64537:* 2449 2450} 2451match to group clients set { 2452 community delete 64534:* 2453 ext-community delete rt 64534:* 2454 large-community delete 999:64534:* 2455 2456} 2457match to group clients set { 2458 community delete 65523:65523 2459 ext-community delete rt 65523:65523 2460 large-community delete 999:65523:65523 2461 2462} 2463match to group clients set { 2464 community delete 65523:* 2465 ext-community delete rt 65523:* 2466 large-community delete 999:65523:* 2467 2468} 2469match to group clients set { 2470 community delete 64539:* 2471 ext-community delete rt 64539:* 2472 large-community delete 999:64539:* 2473 2474} 2475match to group clients set { 2476 community delete 64536:* 2477 ext-community delete rt 64536:* 2478 large-community delete 999:64536:* 2479 2480} 2481match to group clients set { 2482 community delete 65522:65522 2483 ext-community delete rt 65522:65522 2484 large-community delete 999:65522:65522 2485 2486} 2487match to group clients set { 2488 community delete 65522:* 2489 ext-community delete rt 65522:* 2490 large-community delete 999:65522:* 2491 2492} 2493match to group clients set { 2494 community delete 64538:* 2495 ext-community delete rt 64538:* 2496 large-community delete 999:64538:* 2497 2498} 2499match to group clients set { 2500 community delete 64535:* 2501 ext-community delete rt 64535:* 2502 large-community delete 999:64535:* 2503 2504} 2505 2506 2507# RFC1997 NO_EXPORT/NO_ADVERTISE received from clients and propagated because of pass-through policy 2508match to group clients ext-community $INTCOMM_NO_EXPORT set community NO_EXPORT 2509match to group clients ext-community $INTCOMM_NO_ADVERTISE set community NO_ADVERTISE 2510 2511# Remove internal communities before announcing the route 2512match to group clients set { 2513 ext-community delete $INTCOMM_PREF_OK_ROA 2514 ext-community delete $INTCOMM_ROUTE_OK_WL 2515 ext-community delete $INTCOMM_ORIGIN_OK 2516 ext-community delete $INTCOMM_ORIGIN_KO 2517 ext-community delete $INTCOMM_PREFIX_OK 2518 ext-community delete $INTCOMM_PREFIX_KO 2519 ext-community delete $INTCOMM_IRR_REJECT 2520 ext-community delete $INTCOMM_RPKI_UNKNOWN 2521 ext-community delete $INTCOMM_RPKI_INVALID 2522 ext-community delete $INTCOMM_RPKI_VALID 2523 ext-community delete $INTCOMM_NO_EXPORT 2524 ext-community delete $INTCOMM_NO_ADVERTISE 2525 ext-community delete $INTCOMM_PROCESS_PREPEND_COMMS 2526 2527} 2528 2529