1.\" $OpenBSD: bgpd.conf.5,v 1.209 2021/03/02 09:45:07 claudio Exp $ 2.\" 3.\" Copyright (c) 2004 Claudio Jeker <claudio@openbsd.org> 4.\" Copyright (c) 2003, 2004 Henning Brauer <henning@openbsd.org> 5.\" Copyright (c) 2002 Daniel Hartmeier <dhartmei@openbsd.org> 6.\" 7.\" Permission to use, copy, modify, and distribute this software for any 8.\" purpose with or without fee is hereby granted, provided that the above 9.\" copyright notice and this permission notice appear in all copies. 10.\" 11.\" THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES 12.\" WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF 13.\" MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR 14.\" ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES 15.\" WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN 16.\" ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF 17.\" OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. 18.\" 19.Dd $Mdocdate: March 2 2021 $ 20.Dt BGPD.CONF 5 21.Os 22.Sh NAME 23.Nm bgpd.conf 24.Nd Border Gateway Protocol daemon configuration file 25.Sh DESCRIPTION 26The 27.Xr bgpd 8 28daemon implements the Border Gateway Protocol version 4 as described 29in RFC 4271. 30.Pp 31The 32.Nm 33config file is divided into the following main sections: 34.Bl -tag -width xxxx 35.It Sx MACROS 36User-defined variables may be defined and used later, simplifying the 37configuration file. 38.It Sx GLOBAL CONFIGURATION 39Global settings for 40.Xr bgpd 8 . 41.It Sx SET CONFIGURATION 42Various lookup tables are defined in this section. 43.It Sx NETWORK ANNOUNCEMENTS 44Networks which should be announced by 45.Xr bgpd 8 46are set in this section. 47.It Sx MPLS VPN CONFIGURATION 48The definition and properties for BGP MPLS VPNs are set in this section. 49.It Sx NEIGHBORS AND GROUPS 50.Xr bgpd 8 51establishes sessions with 52.Em neighbors . 53The neighbor definition and properties are set in this section, as well as 54grouping neighbors for the ease of configuration. 55.It Sx FILTER 56Filter rules for incoming and outgoing 57.Em UPDATES . 58.El 59.Pp 60With the exception of macros, 61the sections should be grouped and appear in 62.Nm 63in the order shown above. 64.Pp 65The current line can be extended over multiple lines using a backslash 66.Pq Sq \e . 67Comments can be put anywhere in the file using a hash mark 68.Pq Sq # , 69and extend to the end of the current line. 70Care should be taken when commenting out multi-line text: 71the comment is effective until the end of the entire block. 72.Pp 73Argument names not beginning with a letter, digit, or underscore 74must be quoted. 75.Pp 76Additional configuration files can be included with the 77.Ic include 78keyword, for example: 79.Bd -literal -offset indent 80include "/etc/bgpd/bgpd-10.0.0.1.filter" 81.Ed 82.Sh MACROS 83Macros can be defined that will later be expanded in context. 84Macro names must start with a letter, digit, or underscore, 85and may contain any of those characters. 86Macro names may not be reserved words (for example, 87.Ic AS , 88.Ic neighbor , 89or 90.Ic group ) . 91Macros are not expanded inside quotes. 92.Pp 93For example: 94.Bd -literal -offset indent 95peer1="1.2.3.4" 96neighbor $peer1 { 97 remote-as 65001 98} 99.Ed 100.Sh GLOBAL CONFIGURATION 101These settings affect the operation of the 102.Xr bgpd 8 103daemon as a whole. 104.Pp 105.Bl -tag -width Ds -compact 106.It Ic AS Ar as-number Op Ar as-number 107Set the local 108.Em autonomous system 109number to 110.Ar as-number . 111A fallback 2-byte AS number may follow a 4-byte AS number for neighbors that 112do not support 4-byte AS numbers. 113The standard and default fallback AS number is 23456. 114.Pp 115The AS numbers are assigned by local RIRs, such as: 116.Pp 117.Bl -tag -width xxxxxxxx -compact 118.It AfriNIC 119for Africa 120.It APNIC 121for Asia Pacific 122.It ARIN 123for North America and parts of the Caribbean 124.It LACNIC 125for Latin America and the Caribbean 126.It RIPE NCC 127for Europe, the Middle East, and parts of Asia 128.El 129.Pp 130The AS numbers 64512 \(en 65534 are designated for private use. 131The AS number 23456 is reserved and should not be used. 1324-byte AS numbers may be specified in either the ASPLAIN format: 133.Bd -literal -offset indent 134AS 196618 135.Ed 136.Pp 137or in the older ASDOT format: 138.Bd -literal -offset indent 139AS 3.10 140.Ed 141.Pp 142.It Ic connect-retry Ar seconds 143Set the number of seconds to wait before attempting to re-open 144a connection. 145This timer should be sufficiently large in EBGP configurations. 146The default is 120 seconds. 147.Pp 148.It Xo 149.Ic dump 150.Op Ic rib Ar name 151.Pq Ic table Ns | Ns Ic table-mp Ns | Ns Ic table-v2 152.Ar file Op Ar interval 153.Xc 154.It Xo 155.Ic dump 156.Pq Ic all Ns | Ns Ic updates 157.Pq Ic in Ns | Ns Ic out 158.Ar file Op Ar interval 159.Xc 160Dump the RIB, a.k.a. the 161.Em routing information base , 162or dump ongoing BGP activity, in Multi-threaded Routing Toolkit (MRT) format. 163The 164.Ar file 165is subject to 166.Xr strftime 3 Ns -expansion. 167.Pp 168The 169.Ic table-v2 170and 171.Ic table-mp 172RIB formats store multi-protocol RIBs correctly, but the 173.Ic table 174format does not. 175The latter two are provided only to support third-party tools lacking 176support for the recommended 177.Ic table-v2 178format. 179Dump an alternative RIB by specifying 180.Ar name . 181Specify an 182.Ar interval 183in seconds for periodic RIB dumps. 184.Pp 185The following will dump the entire RIB table, at startup and every 1865 minutes thereafter, to a new file: 187.Bd -literal -offset indent 188dump table-v2 "/tmp/rib-dump-%H%M" 300 189.Ed 190.Pp 191Dumps of ongoing BGP activity include all BGP state transitions, and 192all BGP messages in the specified direction. 193Use 194.Ic updates 195to dump only BGP 196.Em UPDATE 197messages, without state transitions. 198Specify an 199.Ar interval 200in seconds to restart periodically with a new file: 201.Bd -literal -offset indent 202dump all in "/tmp/all-in-%H%M" 300 203.Ed 204.Pp 205.It Ic fib-priority Ar prio 206Set the routing priority to 207.Ar prio . 208The default is 48. 209.Pp 210.It Xo 211.Ic fib-update 212.Pq Ic yes Ns | Ns Ic no 213.Xc 214If set to 215.Ic no , 216do not update the Forwarding Information Base, a.k.a. the kernel 217routing table. 218The default is 219.Ic yes . 220.Pp 221.It Ic holdtime Ar seconds 222Set the announced holdtime in seconds. 223This is exchanged with a neighbor upon connection 224establishment, in the 225.Em OPEN 226message, and the shortest holdtime governs the session. 227.Pp 228The neighbor session is dropped if the session holdtime passes 229without receipt of a 230.Em KEEPALIVE 231or an 232.Em UPDATE 233message from the neighbor. 234The default is 90 seconds. 235.Pp 236.It Ic holdtime min Ar seconds 237The minimum acceptable holdtime in seconds. 238This value must be at least 3. 239.Pp 240.It Ic listen on Ar address 241Specify the local IP address for 242.Xr bgpd 8 243to listen on. 244The default is to listen on all local addresses on the current default 245routing domain. 246.Pp 247.It Ic log updates 248Log sent and received BGP update messages. 249.Pp 250.It Xo 251.Ic nexthop 252.Ic qualify 253.Ic via 254.Pq Ic bgp Ns | Ns Ic default 255.Xc 256If set to 257.Ic bgp , 258.Xr bgpd 8 259may verify nexthops using BGP routes. 260If set to 261.Ic default , 262.Xr bgpd 8 263may verify nexthops using the default route. 264By default 265.Xr bgpd 8 266uses only static routes or routes added by other routing 267daemons, such as 268.Xr ospfd 8 . 269.Pp 270.It Xo 271.Ic rde Ic evaluate 272.Pq Ic default Ns | Ns Ic all 273.Xc 274If set to 275.Ar all 276keep evaluating alternative paths in case the selected path is filtered 277out. 278By default if a path is filtered by the output filters then no alternative 279path is sent to this peer. 280.Pp 281.It Xo 282.Ic rde Ic med Ic compare 283.Pq Ic always Ns | Ns Ic strict 284.Xc 285If set to 286.Ic always , 287the 288.Em MULTI_EXIT_DISC 289attributes will always be compared. 290The default is 291.Ic strict , 292where the metric is only compared between peers belonging to the same AS. 293.Pp 294.It Xo 295.Ic rde 296.Ic rib Ar name 297.Op Ic no evaluate 298.Xc 299.It Xo 300.Ic rde 301.Ic rib Ar name 302.Op Ic rtable Ar number 303.Xc 304Create an additional RIB named 305.Ar name . 306The degree to which its routes may be utilized is configurable. 307They may be excluded from the decision process that selects usable routes 308with the 309.Ic no evaluate 310flag, and this precludes their export to any kernel routing table. 311By default its routes will be evaluated, but not exported to the kernel. 312They may be both evaluated and exported if associated with a given 313.Ic rtable 314.Ar number , 315which must belong to the routing domain that 316.Xr bgpd 8 317was started in. 318This table will not be consulted during nexthop verification 319unless it is the one that 320.Xr bgpd 8 321was started in. 322It is unnecessary to create 323.Ic Adj-RIB-In 324and 325.Ic Loc-RIB , 326which are created automatically and used by default. 327.Pp 328.It Xo 329.Ic rde 330.Ic route-age 331.Pq Ic ignore Ns | Ns Ic evaluate 332.Xc 333If set to 334.Ic evaluate , 335the route decision process will also consider the age of the route in 336addition to its path attributes, giving preference to the older, 337typically more stable, route. 338This renders the decision process nondeterministic. 339The default is 340.Ic ignore . 341.Pp 342.It Xo 343.Ic reject Ic as-set 344.Pq Ic yes Ns | Ns Ic no 345.Xc 346If set to 347.Ic yes , 348.Em AS paths 349attributes containing 350.Em AS_SET 351path segments will be rejected and 352all prefixes will be treated as withdraws. 353The default is 354.Ic no . 355.Pp 356.It Ic router-id Ar dotted-quad 357Set the BGP router ID, which must be non-zero and should be unique 358within the AS. 359By default, the router ID is the highest IPv4 address assigned 360to the local machine. 361.Bd -literal -offset indent 362router-id 10.0.0.1 363.Ed 364.Pp 365.It Ic rtable Ar number 366Work with the given kernel routing table 367instead of the default table, which is the one 368.Xr bgpd 8 369was started in. 370For nexthop verification, 371.Xr bgpd 8 372will always consult the default table. 373This is the same as using the following syntax: 374.Bd -literal -offset indent 375rde rib Loc-RIB rtable number 376.Ed 377.Pp 378.It Ic socket Qo Ar path Qc Op Ic restricted 379Create a control socket at 380.Ar path . 381If 382.Ic restricted 383is specified a restricted control socket will be created. 384By default 385.Pa /var/run/bgpd.sock.<rdomain> 386is used where 387.Ar <rdomain> 388is the routing domain in which 389.Xr bgpd 8 390has been started. 391By default, no restricted socket is created. 392.Pp 393.It Xo 394.Ic transparent-as 395.Pq Ic yes Ns | Ns Ic no 396.Xc 397If set to 398.Ic yes , 399.Em AS paths 400to EBGP neighbors are not prepended with the local AS. 401The default is 402.Ic no . 403.El 404.Sh SET CONFIGURATION 405.Xr bgpd 8 406supports the efficient lookup of data within named 407.Em sets . 408An 409.Ic as-set , 410a 411.Ic prefix-set , 412and an 413.Ic origin-set 414store AS numbers, prefixes, and prefixes/source-as pairs, 415respectively. 416Such sets may be referenced by filter rules; see the 417.Sx FILTER 418section for details. 419It is more efficient to evaluate a set than a long series of 420rules for filtering each of its members. 421.Pp 422One single 423.Ic roa-set 424may be defined, against which 425.Xr bgpd 8 426will validate the origin of each prefix. 427.Pp 428A set definition can span multiple lines, and an optional comma is allowed 429between elements. 430.Pp 431.Bl -tag -width Ds -compact 432.It Xo 433.Ic as-set Ar name 434.Ic { Ar as-number ... Ic } 435.Xc 436An 437.Ic as-set 438stores AS numbers, and can be used with the AS specific parameter in 439.Sx FILTER 440rules. 441.Pp 442.It Xo 443.Ic origin-set Ar name 444.Ic { Ar address Ns Li / Ns Ar len Ic maxlen Ar mlen Ic source-as Ar asn ... Ic } 445.Xc 446An 447.Ic origin-set 448stores prefix/source-as pairs, and can be used to filter on the combination 449by using the 450.Ic origin-set 451parameter in 452.Sx FILTER 453rules. 454.Bd -literal -offset indent 455origin-set private { 10.0.0.0/8 maxlen 24 source-as 64511 456 203.0.113.0/24 source-as 64496 } 457.Ed 458.Pp 459.It Xo 460.Ic prefix-set Ar name 461.Ic { Ar address Ns Li / Ns Ar len ... Ic } 462.Xc 463A 464.Ic prefix-set 465stores network prefixes and can be used in place 466of the 467.Ic prefix 468parameter in 469.Sx FILTER 470rules, and in 471.Ic network 472statements. 473A prefix can be followed by the prefixlen operators listed for the 474.Ic prefix 475parameter in the 476.Sx PARAMETERS 477section. 478.Pp 479The first example below creates a set of prefixes called 480.Dq private , 481to hold a number of RFC 1918 private network blocks. 482The second example shows the use of prefixlen operators. 483.Bd -literal -offset indent 484prefix-set private { 10.0.0.0/8, 172.16.0.0/12, 485 192.168.0.0/16, fc00::/7 } 486prefix-set as64496set { 192.0.2.0/24 prefixlen >= 26, 487 2001:db8::/32 or-longer } 488.Ed 489.Pp 490.It Xo 491.Ic roa-set 492.Ic { Ar address Ns Li / Ns Ar len Ic maxlen Ar mlen Ic source-as Ar asn ... Ic } 493.Xc 494The 495.Ic roa-set 496holds a collection of Validated 497.Em Route Origin Authorization 498Payloads (VRP). 499Each received prefix is checked against the 500.Ic roa-set , 501and the Origin Validation State (OVS) is set. 502.Bd -literal -offset indent 503roa-set { 192.0.2.0/24 maxlen 24 source-as 64511 504 203.0.113.0/24 source-as 64496 } 505.Ed 506.Pp 507.It Xo 508.Ic rtr Ar address 509.Ic { Ar ... Ic } 510.Xc 511The 512.Ic rtr 513block specifies a 514.Em RPKI to Router Protocol 515session. 516The rtr session properties are as follows: 517.Pp 518.Bl -tag -width Ds -compact 519.It Ic descr Ar description 520Add a description. 521The description is used in logging and status reports, but has no further 522meaning for 523.Xr bgpd 8 . 524.Pp 525.It Ic local-address Ar address 526Bind to the specific IP address before opening the TCP connection to the 527.Em rtr 528server. 529.Pp 530.It Ic port Ar number 531Specify the TCP destination port for the 532.Em rtr 533session. 534If not specified the default 535.Ic port 536is 537.Em 323 . 538.El 539.El 540.Sh NETWORK ANNOUNCEMENTS 541.Ic network 542statements specify the networks that 543.Xr bgpd 8 544will announce as its own. 545An announcement must also be permitted by the 546.Sx FILTER 547rules. 548By default 549.Xr bgpd 8 550announces no networks. 551.Pp 552.Bl -tag -width Ds -compact 553.It Xo 554.Ic network 555.Ar address Ns Li / Ns Ar prefix 556.Op Ic set ...\& 557.Xc 558Announce the specified prefix as belonging to our AS. 559.Pp 560.It Xo 561.Ic network 562.Pq Ic inet Ns | Ns Ic inet6 563.Ic connected Op Ic set ...\& 564.Xc 565Announce routes to directly attached networks. 566.Pp 567.It Xo 568.Ic network prefix-set 569.Ar name 570.Op Ic set ...\& 571.Xc 572Announce all networks in the prefix-set 573.Ar name . 574.Pp 575.It Xo 576.Ic network 577.Pq Ic inet Ns | Ns Ic inet6 578.Ic priority Ar number Op Ic set ...\& 579.Xc 580Announce routes having the specified 581.Ar priority . 582.Pp 583.It Xo 584.Ic network 585.Pq Ic inet Ns | Ns Ic inet6 586.Ic rtlabel Ar label Op Ic set ...\& 587.Xc 588Announce routes having the specified 589.Ar label . 590.Pp 591.It Xo 592.Ic network 593.Pq Ic inet Ns | Ns Ic inet6 594.Ic static Op Ic set ...\& 595.Xc 596Announce all static routes. 597.El 598.Pp 599Each 600.Ic network 601statement may set default 602.Em AS path attributes : 603.Bd -literal -offset indent 604network 192.168.7.0/24 set localpref 220 605.Ed 606.Pp 607See also the 608.Sx ATTRIBUTE SET 609section. 610.Sh MPLS VPN CONFIGURATION 611A 612.Ic vpn 613section configures a router to participate in an MPLS Virtual Private Network. 614It specifies an 615.Xr mpe 4 616interface to use, a description, and various properties of the VPN: 617.Bd -literal -offset indent 618vpn "description" on mpe1 { 619 rd 65002:1 620 import-target rt 65002:42 621 export-target rt 65002:42 622 network 192.168.1/24 623} 624.Ed 625.Pp 626.Xr bgpd 8 627will not exchange VPN routes with a neighbor by default, see the 628.Sx NEIGHBORS AND GROUPS 629section. 630The description is used when logging but has no further meaning to 631.Xr bgpd 8 . 632.Pp 633The 634.Xr mpe 4 635interface will be used as the outgoing interface for routes to 636the VPN, and local networks will be announced with the MPLS label 637specified on the interface. 638The interface can provide VPN connectivity for another rdomain by 639being configured in that rdomain. 640The required rdomain must be configured on the interface before 641.Xr bgpd 8 642uses it. 643Multiple VPNs may be connected to a single rdomain, including the rdomain that 644.Xr bgpd 8 645is running in. 646.Pp 647An example 648.Xr hostname.if 5 649configuration for an 650.Xr mpe 4 651interface providing connectivity to rdomain 1: 652.Bd -literal -offset indent 653rdomain 1 654mplslabel 2000 655inet 192.198.0.1 255.255.255.255 656up 657.Ed 658.Pp 659The VPN properties are as follows: 660.Pp 661.Bl -tag -width Ds -compact 662.It Ic export-target Ar subtype as-number : Ns Ar local 663.It Ic export-target Ar subtype IP : Ns Ar local 664Classify announced networks by tagging them with an 665.Em extended community 666of the given arguments. 667The community 668.Ar subtype 669should be a 670.Em route target , 671.Ic rt , 672to ensure interoperability. 673The arguments are further detailed in the 674.Sx ATTRIBUTE SET 675section. 676More than one 677.Ic export-target 678can be specified. 679.Pp 680.It Xo 681.Ic fib-update 682.Pq Ic yes Ns | Ns Ic no 683.Xc 684If set to 685.Ic no , 686do not update the Forwarding Information Base, a.k.a. the kernel 687routing table. 688The default is 689.Ic yes . 690.Pp 691.It Ic import-target Ar subtype as-number : Ns Ar local 692.It Ic import-target Ar subtype IP : Ns Ar local 693The rdomain imports only those prefixes tagged with an 694.Em extended community 695matching an 696.Ic import-target . 697The community 698.Ar subtype 699should be a 700.Em route target , 701.Ic rt , 702to ensure interoperability. 703The arguments are further detailed in the 704.Sx ATTRIBUTE SET 705section. 706More than one 707.Ic import-target 708can be specified. 709.Pp 710.It Ic network Ar arguments ... 711Announce the given networks within this VPN; 712see the 713.Sx NETWORK ANNOUNCEMENTS 714section. 715.Pp 716.It Ic rd Ar as-number : Ns Ar local 717.It Ic rd Ar IP : Ns Ar local 718The Route Distinguisher 719.Ic rd 720supplies BGP with namespaces to disambiguate VPN prefixes, as these needn't be 721globally unique. 722Unlike route targets, the 723.Ic rd 724neither identifies the origin of the prefix nor controls into 725which VPNs the prefix is distributed. 726The 727.Ar as-number 728or 729.Ar IP 730of a 731.Ic rd 732should be set to a number or IP that was assigned by an appropriate authority, 733whereas 734.Ar local 735can be chosen by the local operator. 736.El 737.Sh NEIGHBORS AND GROUPS 738.Xr bgpd 8 739establishes TCP connections to other BGP speakers called 740.Em neighbors . 741A neighbor and its properties are specified by a 742.Tg 743.Ic neighbor 744section: 745.Bd -literal -offset indent 746neighbor 10.0.0.2 { 747 remote-as 65002 748 descr "a neighbor" 749} 750.Ed 751.Pp 752Neighbors placed within a 753.Tg 754.Ic group 755section inherit the properties common to that group: 756.Bd -literal -offset indent 757group "peering AS65002" { 758 remote-as 65002 759 neighbor 10.0.0.2 { 760 descr "AS65002-p1" 761 } 762 neighbor 10.0.0.3 { 763 descr "AS65002-p2" 764 } 765} 766.Ed 767.Pp 768An entire network of neighbors may be accommodated by specifying an 769address/netmask pair: 770.Bd -literal -offset indent 771neighbor 10.0.0.0/8 772.Ed 773.Pp 774This is a 775.Em template 776that recognises as a neighbor any connection from within the given network. 777Such neighbors inherit their template's properties, except for their IP address. 778A template may omit 779.Ic remote-as ; 780.Xr bgpd 8 781then accepts any AS presented by the neighbor in the 782.Em OPEN 783message. 784.Pp 785The neighbor properties are as follows: 786.Pp 787.Bl -tag -width Ds -compact 788.It Xo 789.Ic announce 790.Pq Ic IPv4 Ns | Ns Ic IPv6 791.Pq Ic none Ns | Ns Ic unicast Ns | Ns Ic vpn 792.Xc 793For the given address family, control which 794.Em subsequent address families 795are announced during the capabilities negotiation. 796Only routes for that address family and subsequent address families will be 797announced and processed. 798.Pp 799At the moment, only 800.Ic none , 801which disables the announcement of that address family, 802.Ic unicast , 803and 804.Ic vpn , 805which allows the distribution of BGP MPLS VPNs, are supported. 806.Pp 807The default is 808.Ic unicast 809for the same address family of the session. 810.Pp 811.It Xo 812.Ic announce as-4byte 813.Pq Ic yes Ns | Ns Ic no 814.Xc 815If set to 816.Ic no , 817the 4-byte AS capability is not announced and so native 4-byte AS support is 818disabled. 819The default is 820.Ic yes . 821.Pp 822.It Xo 823.Ic announce capabilities 824.Pq Ic yes Ns | Ns Ic no 825.Xc 826If set to 827.Ic no , 828capability negotiation is disabled during the establishment of the session. 829This can be helpful to connect to old or broken BGP implementations. 830The default is 831.Ic yes . 832.Pp 833.It Xo 834.Ic announce refresh 835.Pq Ic yes Ns | Ns Ic no 836.Xc 837If set to 838.Ic no , 839the route refresh capability is not announced. 840The default is 841.Ic yes . 842.Pp 843.It Xo 844.Ic announce restart 845.Pq Ic yes Ns | Ns Ic no 846.Xc 847If set to 848.Ic no , 849the graceful restart capability is not announced. 850Currently only the End-of-RIB marker is supported and announced by the 851.Ic restart 852capability. 853The default is 854.Ic yes . 855.Pp 856.It Xo 857.Ic as-override 858.Pq Ic yes Ns | Ns Ic no 859.Xc 860If set to 861.Ic yes , 862all occurrences of the neighbor AS in the 863.Em AS path 864will be replaced with the local AS before running the filters. 865The Adj-RIB-In still holds the unmodified AS path. 866The default value is 867.Ic no . 868.Pp 869.It Ic demote Ar group 870Increase the 871.Xr carp 4 872demotion counter on the given interface group, usually 873.Ar carp , 874when the session is not in state 875.Em ESTABLISHED . 876The demotion counter will be increased as soon as 877.Xr bgpd 8 878starts and decreased 87960 seconds after the session went to state 880.Em ESTABLISHED . 881For neighbors added at runtime, the demotion counter is only increased after 882the session has been 883.Em ESTABLISHED 884at least once before dropping. 885.Pp 886For more information on interface groups, 887see the 888.Ic group 889keyword in 890.Xr ifconfig 8 . 891.Pp 892.It Ic depend on Ar interface 893The neighbor session will be kept in state 894.Em IDLE 895as long as 896.Ar interface 897reports no link. 898For 899.Xr carp 4 900interfaces, no link means that the interface is currently 901.Em backup . 902This is primarily intended to be used with 903.Xr carp 4 904to reduce failover times. 905.Pp 906The state of the network interfaces on the system can be viewed 907using the 908.Cm show interfaces 909command to 910.Xr bgpctl 8 . 911.Pp 912.It Ic descr Ar description 913Add a description. 914The description is used when logging neighbor events, in status 915reports, for specifying neighbors, etc., but has no further meaning to 916.Xr bgpd 8 . 917.Pp 918.It Ic down Op Ar reason 919Do not start the session when 920.Xr bgpd 8 921comes up but stay in 922.Em IDLE . 923If the session is cleared at runtime, after a 924.Ic down 925.Ar reason 926was configured at runtime, the 927.Ar reason 928is sent as Administrative Shutdown Communication. 929The 930.Ar reason 931cannot exceed 255 octets. 932.Pp 933.It Xo 934.Ic dump 935.Pq Ic all Ns | Ns Ic updates 936.Pq Ic in Ns | Ns Ic out 937.Ar file Op Ar interval 938.Xc 939Dump ongoing BGP activity for a particular neighbor. 940See also the 941.Ic dump 942setting in 943.Sx GLOBAL CONFIGURATION . 944.Pp 945.It Xo 946.Ic enforce local-as 947.Pq Ic yes Ns | Ns Ic no 948.Xc 949If set to 950.Ic no , 951.Em AS paths 952will not be checked for AS loop detection. 953This feature is similar to allowas-in in some other BGP implementations. 954Since there is no AS path loop check, this feature is dangerous, and 955requires you to add filters to prevent receiving your own prefixes. 956The default value is 957.Ic yes . 958.Pp 959.It Xo 960.Ic enforce neighbor-as 961.Pq Ic yes Ns | Ns Ic no 962.Xc 963If set to 964.Ic yes , 965.Em AS paths 966whose 967.Em leftmost AS 968is not equal to the 969.Em remote AS 970of the neighbor are rejected and a 971.Em NOTIFICATION 972is sent back. 973The default value for IBGP peers is 974.Ic no 975otherwise the default is 976.Ic yes . 977.Pp 978.It Xo 979.Ic export 980.Sm off 981.Pq Ic none | default-route 982.Sm on 983.Xc 984If set to 985.Ic none , 986no 987.Em UPDATE 988messages will be sent to the neighbor. 989If set to 990.Ic default-route , 991only the default route will be announced to the neighbor. 992When 993.Ic export 994is modified the neighbor session needs to be reset to become active. 995.Pp 996.It Ic holdtime Ar seconds 997Set the holdtime in seconds. 998Inherited from the global configuration if not given. 999.Pp 1000.It Ic holdtime min Ar seconds 1001Set the minimal acceptable holdtime. 1002Inherited from the global configuration if not given. 1003.Pp 1004.It Xo 1005.Ic ipsec 1006.Pq Ic ah Ns | Ns Ic esp 1007.Pq Ic in Ns | Ns Ic out 1008.Ic spi Ar spi-number authspec Op Ar encspec 1009.Xc 1010Enable IPsec with static keying. 1011There must be at least two 1012.Ic ipsec 1013statements per peer with manual keying, one per direction. 1014.Ar authspec 1015specifies the authentication algorithm and key. 1016It can be 1017.Bd -literal -offset indent 1018sha1 <key> 1019md5 <key> 1020.Ed 1021.Pp 1022.Ar encspec 1023specifies the encryption algorithm and key. 1024.Ic ah 1025does not support encryption. 1026With 1027.Ic esp , 1028encryption is optional. 1029.Ar encspec 1030can be 1031.Bd -literal -offset indent 10323des <key> 10333des-cbc <key> 1034aes <key> 1035aes-128-cbc <key> 1036.Ed 1037.Pp 1038Keys must be given in hexadecimal format. 1039After changing settings a session needs to be reset to use the new keys. 1040.Pp 1041.It Xo 1042.Ic ipsec 1043.Pq Ic ah Ns | Ns Ic esp 1044.Ic ike 1045.Xc 1046Enable IPsec with dynamic keying. 1047In this mode, 1048.Xr bgpd 8 1049sets up the flows, and a key management daemon such as 1050.Xr isakmpd 8 1051is responsible for managing the session keys. 1052With 1053.Xr isakmpd 8 , 1054it is sufficient to copy the peer's public key, found in 1055.Pa /etc/isakmpd/local.pub , 1056to the local machine. 1057It must be stored in a file 1058named after the peer's IP address and must be stored in 1059.Pa /etc/isakmpd/pubkeys/ipv4/ . 1060The local public key must be copied to the peer in the same way. 1061As 1062.Xr bgpd 8 1063manages the flows on its own, it is sufficient to restrict 1064.Xr isakmpd 8 1065to only take care of keying by specifying the flags 1066.Fl Ka . 1067This can be done in 1068.Xr rc.conf.local 8 . 1069After starting the 1070.Xr isakmpd 8 1071and 1072.Xr bgpd 8 1073daemons on both sides, the session should be established. 1074After changing settings a session needs to be reset to use the new keys. 1075.Pp 1076.It Ic local-address Ar address 1077.It Ic no local-address 1078When 1079.Xr bgpd 8 1080initiates the TCP connection to the neighbor system, it normally does not 1081bind to a specific IP address. 1082If a 1083.Ic local-address 1084is given, 1085.Xr bgpd 8 1086binds to this address first. 1087.Ic no local-address 1088reverts back to the default. 1089.Pp 1090.It Ic local-as Ar as-number Op Ar as-number 1091Set the AS number sent to the remote system. 1092Used as described above under 1093.Sx GLOBAL CONFIGURATION 1094option 1095.Ic AS . 1096.Pp 1097Since there is no AS path loop check, this option is dangerous, and 1098requires you to add filters to prevent receiving your ASNs. 1099Intended to be used temporarily, for migrations to another AS. 1100.Pp 1101.It Ic log no 1102Disable neighbor specific logging. 1103.Pp 1104.It Ic log updates 1105Log received and sent updates for this neighbor. 1106.Pp 1107.It Xo 1108.Ic max-prefix Ar number 1109.Op Ic restart Ar number 1110.Xc 1111Terminate the session when the maximum 1112.Ar number 1113of prefixes received is exceeded 1114(no such limit is imposed by default). 1115If 1116.Ic restart 1117is specified, the session will be restarted after 1118.Ar number 1119minutes. 1120.Pp 1121.It Xo 1122.Ic max-prefix Ar number Ic out 1123.Op Ic restart Ar number 1124.Xc 1125Terminate the session when the maximum 1126.Ar number 1127of prefixes sent is exceeded 1128(no such limit is imposed by default). 1129If 1130.Ic restart 1131is specified, the session will be restarted after 1132.Ar number 1133minutes. 1134.Pp 1135.It Ic multihop Ar hops 1136Neighbors not in the same AS as the local 1137.Xr bgpd 8 1138normally have to be directly connected to the local machine. 1139If this is not the case, the 1140.Ic multihop 1141statement defines the maximum hops the neighbor may be away. 1142.Pp 1143.It Ic passive 1144Do not attempt to actively open a TCP connection to the neighbor system. 1145.Pp 1146.It Xo 1147.Ic reject Ic as-set 1148.Pq Ic yes Ns | Ns Ic no 1149.Xc 1150If set to 1151.Ic yes , 1152.Em AS paths 1153attributes containing 1154.Em AS_SET 1155path segments will be rejected and 1156all prefixes will be treated as withdraws. 1157The default is inherited from the global 1158.Ic reject Ic as-set 1159setting. 1160.Pp 1161.It Ic remote-as Ar as-number 1162Set the AS number of the remote system. 1163.Pp 1164.It Xo 1165.Ic rde Ic evaluate 1166.Pq Ic default Ns | Ns Ic all 1167.Xc 1168If set to 1169.Ar all 1170keep evaluating alternative paths in case the selected path is filtered 1171out. 1172By default if a path is filtered by the output filters then no alternative 1173path is sent to this peer. 1174The default is inherited from the global 1175.Ic rde Ic evaluate 1176setting. 1177.Pp 1178.It Ic rib Ar name 1179Bind the neighbor to the specified RIB. 1180.Pp 1181.It Ic route-reflector Op Ar address 1182Act as an RFC 4456 1183.Em route-reflector 1184for this neighbor. 1185An optional cluster ID can be specified; otherwise the BGP ID will be used. 1186.Pp 1187.It Ic set Ar attribute ... 1188Set the 1189.Em AS path attributes 1190to some default per 1191.Ic neighbor 1192or 1193.Ic group 1194block: 1195.Bd -literal -offset indent 1196set localpref 300 1197.Ed 1198.Pp 1199See also the 1200.Sx ATTRIBUTE SET 1201section. 1202Set parameters are applied to the received prefixes; the only exceptions are 1203.Ic prepend-self , 1204.Ic nexthop no-modify 1205and 1206.Ic nexthop self . 1207These sets are rewritten into filter rules and can be viewed with 1208.Dq bgpd -nv . 1209.Pp 1210.It Ic tcp md5sig password Ar secret 1211.It Ic tcp md5sig key Ar secret 1212Enable TCP MD5 signatures per RFC 2385. 1213The shared secret can either be given as a password or hexadecimal key. 1214.Bd -literal -offset indent 1215tcp md5sig password mekmitasdigoat 1216tcp md5sig key deadbeef 1217.Ed 1218After changing keys a session needs to be reset to use the new keys. 1219.Pp 1220.It Xo 1221.Ic transparent-as 1222.Pq Ic yes Ns | Ns Ic no 1223.Xc 1224If set to 1225.Ic yes , 1226.Em AS paths 1227to EBGP neighbors are not prepended with the local AS. 1228The default is inherited from the global 1229.Ic transparent-as 1230setting. 1231.Pp 1232.It Xo 1233.Ic ttl-security 1234.Pq Ic yes Ns | Ns Ic no 1235.Xc 1236Enable or disable ttl-security. 1237When enabled, 1238outgoing packets are sent using a TTL of 255 1239and a check is made against an incoming packet's TTL. 1240For directly connected peers, 1241incoming packets are required to have a TTL of 255, 1242ensuring they have not been routed. 1243For multihop peers, 1244incoming packets are required to have a TTL of 256 minus multihop distance, 1245ensuring they have not passed through more than the expected number of hops. 1246The default is 1247.Ic no . 1248.El 1249.Sh FILTER 1250.Xr bgpd 8 1251filters all BGP 1252.Em UPDATE 1253messages, including its own announcements, and blocks them by default. 1254Filter rules may match on neighbor, direction, 1255.Em prefix 1256or 1257.Em AS path attributes . 1258Filter rules may also modify 1259.Em AS path attributes . 1260.Pp 1261For each 1262.Em UPDATE 1263processed by the filter, the filter rules are evaluated in sequential order, 1264from first to last. 1265The last matching 1266.Ic allow 1267or 1268.Ic deny 1269rule decides what action is taken. 1270The default action is to deny. 1271.Pp 1272The following actions can be used in the filter: 1273.Bl -tag -width xxxxxxxx 1274.It Ic allow 1275The 1276.Em UPDATE 1277is passed. 1278.It Ic deny 1279The 1280.Em UPDATE 1281is blocked. 1282.It Ic match 1283Apply the filter attribute set without influencing the filter decision. 1284.El 1285.Sh PARAMETERS 1286The rule parameters specify the 1287.Em UPDATES 1288to which a rule applies. 1289An 1290.Em UPDATE 1291always comes from, or goes to, one neighbor. 1292Most parameters are optional, but each can appear at most once per rule. 1293If a parameter is specified, the rule only applies to packets with 1294matching attributes. 1295.Pp 1296.Bl -tag -width Ds -compact 1297.It Xo 1298.Ar as-type Op Ar operator 1299.Ar as-number 1300.Xc 1301.It Ar as-type Ic as-set Ar name 1302This rule applies only to 1303.Em UPDATES 1304where the 1305.Em AS path 1306matches. 1307The 1308part of the 1309.Em AS path 1310specified by the 1311.Ar as-type 1312is matched against the 1313.Ar as-number 1314or the 1315.Ic as-set Ar name : 1316.Pp 1317.Bl -tag -width transmit-as -compact 1318.It Ic AS 1319(any part) 1320.It Ic peer-as 1321(leftmost AS number) 1322.It Ic source-as 1323(rightmost AS number) 1324.It Ic transit-as 1325(all but the rightmost AS number) 1326.El 1327.Pp 1328.Ar as-number 1329is an AS number as explained above under 1330.Sx GLOBAL CONFIGURATION . 1331It may be set to 1332.Ic neighbor-as , 1333which is expanded to the current neighbor remote AS number, or 1334.Ic local-as , 1335which is expanded to the locally assigned AS number. 1336.Pp 1337When specifying an 1338.Ic as-set Ar name 1339the AS path will instead be matched against all the AS numbers in the set. 1340.Pp 1341The 1342.Ar operator 1343can be unspecified (this case is identical to the equality operator), or one 1344of the numerical operators 1345.Bd -literal -offset indent 1346= (equal) 1347!= (unequal) 1348- (range including boundaries) 1349>< (except range) 1350.Ed 1351.Pp 1352>< and - 1353are binary operators (they take two arguments); with these, 1354.Ar as-number 1355cannot be set to 1356.Ic neighbor-as . 1357.Pp 1358Multiple 1359.Ar as-number 1360entries for a given type or 1361.Ar as-type as-number 1362entries may also be specified, 1363separated by commas or whitespace, 1364if enclosed in curly brackets: 1365.Bd -literal -offset indent 1366deny from any AS { 1, 2, 3 } 1367deny from any { AS 1, source-as 2, transit-as 3 } 1368deny from any { AS { 1, 2, 3 }, source-as 4, transit-as 5 } 1369.Ed 1370.Pp 1371.It Xo 1372.Ic community 1373.Ar as-number Ns Li \&: Ns Ar local 1374.Xc 1375.It Ic community Ar name 1376This rule applies only to 1377.Em UPDATES 1378where the 1379.Ic community 1380path attribute is present and matches. 1381Communities are specified as 1382.Ar as-number : Ns Ar local , 1383where 1384.Ar as-number 1385is an AS number and 1386.Ar local 1387is a locally significant number between zero and 1388.Li 65535 . 1389Both 1390.Ar as-number 1391and 1392.Ar local 1393may be set to 1394.Sq * 1395to do wildcard matching. 1396Alternatively, well-known communities may be given by name instead and 1397include 1398.Ic BLACKHOLE , 1399.Ic GRACEFUL_SHUTDOWN , 1400.Ic NO_EXPORT , 1401.Ic NO_ADVERTISE , 1402.Ic NO_EXPORT_SUBCONFED , 1403and 1404.Ic NO_PEER . 1405Both 1406.Ar as-number 1407and 1408.Ar local 1409may be set to 1410.Ic neighbor-as , 1411which is expanded to the current neighbor remote AS number, or 1412.Ic local-as , 1413which is expanded to the locally assigned AS number. 1414.Pp 1415.It Xo 1416.Ic large-community 1417.Ar as-number : Ns Ar local : Ns Ar local 1418.Xc 1419This rule applies only to 1420.Em UPDATES 1421where the 1422.Ic Large community 1423path attribute is present and matches. 1424Communities are specified as 1425.Ar as-number : Ns Ar local : Ns Ar local , 1426where 1427.Ar as-number 1428is an AS number and 1429.Ar local 1430is a locally significant number between zero and 1431.Li 4294967295 . 1432Both 1433.Ar as-number 1434and 1435.Ar local 1436may be set to 1437.Sq * 1438to do wildcard matching, 1439.Ic neighbor-as , 1440which is expanded to the current neighbor remote AS number, or 1441.Ic local-as , 1442which is expanded to the locally assigned AS number. 1443.Pp 1444.It Xo 1445.Ic ext-community 1446.Ar subtype as-number : Ns Ar local 1447.Xc 1448.It Xo 1449.Ic ext-community 1450.Ar subtype IP : Ns Ar local 1451.Xc 1452.It Xo 1453.Ic ext-community 1454.Ar subtype numvalue 1455.Xc 1456.It Xo 1457.Ic ext-community 1458.Ic ovs 1459.Pq Ic valid | not-found | invalid 1460.Xc 1461This rule applies only to 1462.Em UPDATES 1463where the 1464.Em extended community 1465path attribute is present and matches. 1466Extended Communities are specified by a 1467.Ar subtype 1468and normally two values, a globally unique part (e.g. the AS number) and a 1469local part. 1470Both 1471.Ar as-number 1472and 1473.Ar local 1474may be set to 1475.Ic neighbor-as , 1476which is expanded to the current neighbor remote AS number, or 1477.Ic local-as , 1478which is expanded to the locally assigned AS number. 1479Wildcard matching is supported for 1480.Ar local , 1481.Ar numvalue 1482and 1483.Ar subtype . 1484If wildcard matching is used on the 1485.Ar subtype 1486then 1487.Ar numvalue 1488also needs to be set to 1489.Sq * . 1490See also the 1491.Sx ATTRIBUTE SET 1492section for further information about the encoding. 1493.Pp 1494.It Xo 1495.Pq Ic from Ns | Ns Ic to 1496.Ar peer 1497.Xc 1498This rule applies only to 1499.Em UPDATES 1500coming from, or going to, this particular neighbor. 1501This parameter must be specified. 1502.Ar peer 1503is one of the following: 1504.Pp 1505.Bl -tag -width "group descr" -compact 1506.It Ic any 1507Any neighbor will be matched. 1508.It Ic ibgp 1509All 1510.Em IBGP 1511neighbors will be matched. 1512.It Ic ebgp 1513All 1514.Em EBGP 1515neighbors will be matched. 1516.It Ar address 1517Neighbors with this address will be matched. 1518.It Ic group Ar descr 1519Neighbors in this group will be matched. 1520.It Ic AS Ar as-number 1521Neighbors with this AS will be matched. 1522.El 1523.Pp 1524Multiple 1525.Ar peer 1526entries may also be specified, 1527separated by commas or whitespace, 1528if enclosed in curly brackets: 1529.Bd -literal -offset indent 1530deny from { 128.251.16.1, 251.128.16.2, group hojo } 1531.Ed 1532.Pp 1533.It Pq Ic inet Ns | Ns Ic inet6 1534Match only routes in the IPv4 or IPv6 address families, respectively. 1535.Ic inet 1536is an alias for 1537.Qq prefix 0.0.0.0/0 prefixlen >= 0 ; 1538.Ic inet6 1539is an alias for 1540.Qq prefix ::/0 prefixlen >= 0 . 1541.Pp 1542.It Ic max-as-len Ar len 1543This rule applies only to 1544.Em UPDATES 1545where the 1546.Em AS path 1547has more than 1548.Ar len 1549elements. 1550.Pp 1551.It Ic max-as-seq Ar len 1552This rule applies only to 1553.Em UPDATES 1554where a single 1555.Em AS number 1556is repeated more than 1557.Ar len 1558times. 1559.Pp 1560.It Ic nexthop Ar address 1561This rule applies only to 1562.Em UPDATES 1563where the nexthop is equal to 1564.Ar address . 1565The 1566.Ar address 1567can be set to 1568.Em neighbor 1569in which case the nexthop is compared against the address of the neighbor. 1570Nexthop filtering is not supported on locally announced networks and one must 1571take into consideration previous rules overwriting nexthops. 1572.Pp 1573.It Ic origin-set Ar name 1574This rule applies only to 1575.Em UPDATES 1576that match the given origin-set 1577.Ar name . 1578.Pp 1579.It Xo 1580.Ic ovs 1581.Pq Ic valid | not-found | invalid 1582.Xc 1583This rule applies only to 1584.Em UPDATES 1585where the Origin Validation State (OVS) matches. 1586.Pp 1587.It Ic prefix Ar address Ns Li / Ns Ar len 1588.It Ic prefix Ar address Ns Li / Ns Ar len Ic prefixlen Ar range 1589.It Ic prefix Ar address Ns Li / Ns Ar len Ic or-longer 1590.It Ic prefix Ar address Ns Li / Ns Ar len Ic maxlen Ar mlen 1591This rule applies only to 1592.Em UPDATES 1593for the specified prefix. 1594.Pp 1595Multiple entries may be specified, 1596separated by commas or whitespace, 1597if enclosed in curly brackets: 1598.Bd -literal -offset indent 1599deny from any prefix { 192.168.0.0/16, 10.0.0.0/8 or-longer } 1600.Ed 1601.Pp 1602Multiple lists can also be specified, which is useful for 1603macro expansion: 1604.Bd -literal -offset indent 1605good="{ 192.168.0.0/16, 172.16.0.0/12, 10.0.0.0/8 }" 1606bad="{ 224.0.0.0/4 prefixlen >= 4, 240.0.0.0/4 prefixlen >= 4 }" 1607ugly="{ 127.0.0.1/8, 169.254.0.0/16 }" 1608 1609deny from any prefix { $good $bad $ugly } 1610.Ed 1611.Pp 1612Prefix length ranges are specified by using these operators: 1613.Bd -literal -offset indent 1614= (equal) 1615!= (unequal) 1616< (less than) 1617<= (less than or equal) 1618> (greater than) 1619>= (greater than or equal) 1620- (range including boundaries) 1621>< (except range) 1622.Ed 1623.Pp 1624>< and - 1625are binary operators (they take two arguments). 1626For instance, to match all prefix lengths >= 8 and <= 12, and hence the 1627CIDR netmasks 8, 9, 10, 11 and 12: 1628.Bd -literal -offset indent 1629prefixlen 8-12 1630.Ed 1631.Pp 1632Or, to match all prefix lengths < 8 or > 12, and hence the CIDR netmasks 16330\(en7 and 13\(en32: 1634.Bd -literal -offset indent 1635prefixlen 8><12 1636.Ed 1637.Pp 1638This will match all prefixes in the 10.0.0.0/8 netblock with netmasks longer 1639than 16: 1640.Bd -literal -offset indent 1641prefix 10.0.0.0/8 prefixlen > 16 1642.Ed 1643.Pp 1644.Ic or-longer 1645is a shorthand for: 1646.Bd -literal -offset indent 1647.Ic prefix Ar address Ns Li / Ns Ar len Ic prefixlen >= Ar len 1648.Ed 1649.Pp 1650.Ic maxlen Ar mlen 1651is a shorthand for: 1652.Bd -literal -offset indent 1653.Ic prefix Ar address Ns Li / Ns Ar len Ic prefixlen <= Ar mlen 1654.Ed 1655.Pp 1656.It Ic prefix-set Ar name Op Ic or-longer 1657This rule applies only to 1658.Em UPDATES 1659that match the given prefix-set 1660.Ar name . 1661With 1662.Ic or-longer , 1663the 1664.Em UPDATES 1665will match any prefix in the prefix-set where 1666.Bd -literal -offset indent 1667.Ic address Ns Li / Ns Ar len Ic prefixlen >= Ar len 1668.Ed 1669.Pp 1670.It Ic quick 1671If an 1672.Em UPDATE 1673matches a rule which has the 1674.Ic quick 1675option set, this rule is considered the last matching rule, and evaluation 1676of subsequent rules is skipped. 1677.Pp 1678.It Ic rib Ar name 1679Apply rule only to the specified RIB. 1680This only applies for received updates, so not for rules using the 1681.Ar to peer 1682parameter. 1683.Pp 1684.It Ic set Ar attribute ... 1685All matching rules can set the 1686.Em AS path attributes 1687to some default. 1688The set of every matching rule is applied, not only the last matching one. 1689See also the following section. 1690.El 1691.Sh ATTRIBUTE SET 1692.Em AS path attributes 1693can be modified with 1694.Ic set . 1695.Pp 1696.Ic set 1697can be used on 1698.Ic network 1699statements, in 1700.Ic neighbor 1701or 1702.Ic group 1703blocks, and on filter rules. 1704Attribute sets can be expressed as lists. 1705.Pp 1706The following attributes can be modified: 1707.Pp 1708.Bl -tag -width Ds -compact 1709.It Xo 1710.Ic community Op Ar delete 1711.Ar as-number : Ns Ar local 1712.Xc 1713.It Xo 1714.Ic community Op Ar delete 1715.Ar name 1716.Xc 1717Set or delete the 1718.Em COMMUNITIES 1719AS path attribute. 1720Communities are specified as 1721.Ar as-number : Ns Ar local , 1722where 1723.Ar as-number 1724is an AS number and 1725.Ar local 1726is a locally significant number between zero and 1727.Li 65535 . 1728Alternately, well-known communities may be specified by name: 1729.Ic GRACEFUL_SHUTDOWN , 1730.Ic NO_EXPORT , 1731.Ic NO_ADVERTISE , 1732.Ic NO_EXPORT_SUBCONFED , 1733or 1734.Ic NO_PEER . 1735For 1736.Cm delete , 1737both 1738.Ar as-number 1739and 1740.Ar local 1741may be set to 1742.Sq * 1743to do wildcard matching. 1744.Pp 1745.It Xo 1746.Ic large-community Op Ar delete 1747.Ar as-number : Ns Ar local : Ns Ar local 1748.Xc 1749.It Xo 1750.Ic large-community Op Ar delete 1751.Ar name 1752.Xc 1753Set or delete the 1754.Em Large Communities 1755path attribute. 1756Communities are specified as 1757.Ar as-number : Ns Ar local : Ns Ar local , 1758where 1759.Ar as-number 1760is an AS number and 1761.Ar local 1762is a locally significant number between zero and 1763.Li 4294967295 . 1764For 1765.Cm delete , 1766both 1767.Ar as-number 1768and 1769.Ar local 1770may be set to 1771.Sq * 1772to do wildcard matching. 1773.Pp 1774.It Xo 1775.Ic ext-community Op Ar delete 1776.Ar subtype as-number : Ns Ar local 1777.Xc 1778.It Xo 1779.Ic ext-community Op Ar delete 1780.Ar subtype IP : Ns Ar local 1781.Xc 1782.It Xo 1783.Ic ext-community Op Ar delete 1784.Ar subtype numvalue 1785.Xc 1786.It Xo 1787.Ic ext-community Op Ar delete 1788.Ic ovs 1789.Pq Ic valid | not-found | invalid 1790.Xc 1791Set or delete the 1792.Em Extended Community 1793AS path attribute. 1794Extended Communities are specified by a 1795.Ar subtype 1796and normally two values, a globally unique part (e.g. the AS number) and a 1797local part. 1798The type is selected depending on the encoding of the global part. 1799Two-octet AS Specific Extended Communities and Four-octet AS Specific Extended 1800Communities are encoded as 1801.Ar as-number : Ns Ar local . 1802Four-octet encoding is used if the 1803.Ar as-number 1804is bigger than 65535 or if the AS_DOT encoding is used. 1805IPv4 Address Specific Extended Communities are encoded as 1806.Ar IP : Ns Ar local . 1807Opaque Extended Communities are encoded with a single numeric value. 1808The 1809.Ar ovs 1810subtype can only be set to 1811.Ar valid , 1812.Ar not-found , 1813or 1814.Ar invalid . 1815Currently the following subtypes are supported: 1816.Bd -literal -offset indent 1817bdc BGP Data Collection 1818defgw Default Gateway 1819esi-lab ESI Label 1820esi-rt ES-Import Route Target 1821l2vid L2VPN Identifier 1822mac-mob MAC Mobility 1823odi OSPF Domain Identifier 1824ort OSPF Route Type 1825ori OSPF Router ID 1826ovs BGP Origin Validation State 1827rt Route Target 1828soo Route Origin / Source of Origin 1829srcas Source AS 1830vrfri VRF Route Import 1831.Ed 1832.Pp 1833Not all type and subtype value pairs are allowed by IANA and the parser 1834will ensure that no invalid combination is created. 1835.Pp 1836For 1837.Cm delete , 1838.Ar subtype , 1839.Ar numvalue , 1840or 1841.Ar local , 1842may be set to 1843.Sq * 1844to do wildcard matching. 1845If wildcard matching is used on the 1846.Ar subtype 1847then 1848.Ar numvalue 1849also needs to be set to 1850.Sq * . 1851.Pp 1852.It Ic localpref Ar number 1853Set the 1854.Em LOCAL_PREF 1855AS path attribute. 1856If 1857.Ar number 1858starts with a plus or minus sign, 1859.Em LOCAL_PREF 1860will be adjusted by adding or subtracting 1861.Ar number ; 1862otherwise it will be set to 1863.Ar number . 1864The default is 100. 1865.Pp 1866.It Ic med Ar number 1867.It Ic metric Ar number 1868Set the 1869.Em MULTI_EXIT_DISC 1870AS path attribute. 1871If 1872.Ar number 1873starts with a plus or minus sign, 1874.Em MULTI_EXIT_DISC 1875will be adjusted by adding or subtracting 1876.Ar number ; 1877otherwise it will be set to 1878.Ar number . 1879.Pp 1880.It Xo 1881.Ic origin 1882.Sm off 1883.Pq Ic igp | egp | incomplete 1884.Sm on 1885.Xc 1886Set the 1887.Em ORIGIN 1888AS path attribute to mark the source of this 1889route as being injected from an igp protocol, an egp protocol 1890or being an aggregated route. 1891.Pp 1892.It Xo 1893.Ic nexthop 1894.Sm off 1895.Pq Ar address | Ic blackhole | reject | self | no-modify 1896.Sm on 1897.Xc 1898Set the 1899.Em NEXTHOP 1900AS path attribute 1901to a different nexthop address or use blackhole or reject routes. 1902.Em blackhole 1903and 1904.Em reject 1905only affect the FIB and will not alter the nexthop address. 1906.Em self 1907forces the nexthop to be set to the local interface address. 1908If set to 1909.Em no-modify , 1910the nexthop attribute is not modified for EBGP multihop sessions. 1911By default EBGP multihop sessions use the local interface address. 1912On other IBGP and directly connected EBGP sessions 1913.Em no-modify 1914is ignored. 1915The set 1916.Ar address 1917is used on IBGP session and on directly connected EBGP session if the 1918.Ar address 1919is part of the connected network. 1920On EBGP multihop session 1921.Em no-modify 1922has to be set to force the nexthop to 1923.Ar address . 1924.Bd -literal -offset indent 1925set nexthop 192.168.0.1 1926set nexthop blackhole 1927set nexthop reject 1928set nexthop no-modify 1929set nexthop self 1930.Ed 1931.Pp 1932.It Ic pftable Ar table 1933Add the prefix in the update to the specified 1934.Xr pf 4 1935table, regardless of whether or not the path was selected for routing. 1936This option may be useful in building realtime blacklists. 1937.Pp 1938.It Ic prepend-neighbor Ar number 1939Prepend the neighbor's AS 1940.Ar number 1941times to the 1942.Em AS path . 1943.Pp 1944.It Ic prepend-self Ar number 1945Prepend the local AS 1946.Ar number 1947times to the 1948.Em AS path . 1949.Pp 1950.It Ic rtlabel Ar label 1951Add the prefix to the kernel routing table with the specified 1952.Ar label . 1953.Pp 1954.It Ic weight Ar number 1955The 1956.Em weight 1957is used to tip prefixes with equally long AS paths in one or 1958the other direction. 1959A prefix is weighed at a very late stage in the decision process. 1960If 1961.Ar number 1962starts with a plus or minus sign, the 1963.Em weight 1964will be adjusted by adding or subtracting 1965.Ar number ; 1966otherwise it will be set to 1967.Ar number . 1968.Em Weight 1969is a local non-transitive attribute, and is a 1970.Xr bgpd 8 Ns -specific 1971extension. 1972For prefixes with equally long paths, the prefix with the larger weight 1973is selected. 1974.El 1975.Sh FILES 1976.Bl -tag -width "/etc/examples/bgpd.conf" -compact 1977.It Pa /etc/bgpd.conf 1978.Xr bgpd 8 1979configuration file. 1980.It Pa /etc/examples/bgpd.conf 1981Example configuration file. 1982.El 1983.Sh SEE ALSO 1984.Xr strftime 3 , 1985.Xr ipsec 4 , 1986.Xr pf 4 , 1987.Xr rdomain 4 , 1988.Xr tcp 4 , 1989.Xr bgpctl 8 , 1990.Xr bgpd 8 , 1991.Xr ipsecctl 8 , 1992.Xr isakmpd 8 , 1993.Xr rc.conf.local 8 1994.Sh HISTORY 1995The 1996.Nm 1997file format first appeared in 1998.Ox 3.5 . 1999