1.\" $OpenBSD: bgpd.conf.5,v 1.237 2023/10/13 07:37:35 claudio Exp $ 2.\" 3.\" Copyright (c) 2004 Claudio Jeker <claudio@openbsd.org> 4.\" Copyright (c) 2003, 2004 Henning Brauer <henning@openbsd.org> 5.\" Copyright (c) 2002 Daniel Hartmeier <dhartmei@openbsd.org> 6.\" 7.\" Permission to use, copy, modify, and distribute this software for any 8.\" purpose with or without fee is hereby granted, provided that the above 9.\" copyright notice and this permission notice appear in all copies. 10.\" 11.\" THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES 12.\" WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF 13.\" MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR 14.\" ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES 15.\" WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN 16.\" ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF 17.\" OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. 18.\" 19.Dd $Mdocdate: October 13 2023 $ 20.Dt BGPD.CONF 5 21.Os 22.Sh NAME 23.Nm bgpd.conf 24.Nd BGP routing daemon configuration file 25.Sh DESCRIPTION 26The 27.Xr bgpd 8 28daemon implements the Border Gateway Protocol version 4 as described 29in RFC 4271. 30.Pp 31The 32.Nm 33config file is divided into the following main sections: 34.Bl -tag -width xxxx 35.It Sx MACROS 36User-defined variables may be defined and used later, simplifying the 37configuration file. 38.It Sx GLOBAL CONFIGURATION 39Global settings for 40.Xr bgpd 8 . 41.It Sx SET CONFIGURATION 42Various lookup tables are defined in this section. 43.It Sx NETWORK AND FLOWSPEC ANNOUNCEMENTS 44Networks which should be announced by 45.Xr bgpd 8 46are set in this section. 47.It Sx MPLS VPN CONFIGURATION 48The definition and properties for BGP MPLS VPNs are set in this section. 49.It Sx NEIGHBORS AND GROUPS 50.Xr bgpd 8 51establishes sessions with 52.Em neighbors . 53The neighbor definition and properties are set in this section, as well as 54grouping neighbors for the ease of configuration. 55.It Sx FILTER 56Filter rules for incoming and outgoing 57.Em UPDATES . 58.El 59.Pp 60With the exception of macros, 61the sections should be grouped and appear in 62.Nm 63in the order shown above. 64.Pp 65The current line can be extended over multiple lines using a backslash 66.Pq Sq \e . 67Comments can be put anywhere in the file using a hash mark 68.Pq Sq # , 69and extend to the end of the current line. 70Care should be taken when commenting out multi-line text: 71the comment is effective until the end of the entire block. 72.Pp 73Argument names not beginning with a letter, digit, or underscore 74must be quoted. 75.Pp 76Additional configuration files can be included with the 77.Ic include 78keyword, for example: 79.Bd -literal -offset indent 80include "/etc/bgpd/bgpd-10.0.0.1.filter" 81.Ed 82.Sh MACROS 83Macros can be defined that will later be expanded in context. 84Macro names must start with a letter, digit, or underscore, 85and may contain any of those characters. 86Macro names may not be reserved words (for example, 87.Ic AS , 88.Ic neighbor , 89or 90.Ic group ) . 91Macros are not expanded inside quotes. 92.Pp 93For example: 94.Bd -literal -offset indent 95peer1="1.2.3.4" 96neighbor $peer1 { 97 remote-as 65001 98} 99.Ed 100.Sh GLOBAL CONFIGURATION 101These settings affect the operation of the 102.Xr bgpd 8 103daemon as a whole. 104.Pp 105.Bl -tag -width Ds -compact 106.It Ic AS Ar as-number Op Ar as-number 107Set the local 108.Em autonomous system 109number to 110.Ar as-number . 111A fallback 2-byte AS number may follow a 4-byte AS number for neighbors that 112do not support 4-byte AS numbers. 113The standard and default fallback AS number is 23456. 114.Pp 115The AS numbers are assigned by local RIRs, such as: 116.Pp 117.Bl -tag -width xxxxxxxx -compact 118.It AfriNIC 119for Africa 120.It APNIC 121for Asia Pacific 122.It ARIN 123for North America and parts of the Caribbean 124.It LACNIC 125for Latin America and the Caribbean 126.It RIPE NCC 127for Europe, the Middle East, and parts of Asia 128.El 129.Pp 130The AS numbers 64512 \(en 65534 are designated for private use. 131The AS number 23456 is reserved and should not be used. 1324-byte AS numbers may be specified in either the ASPLAIN format: 133.Bd -literal -offset indent 134AS 196618 135.Ed 136.Pp 137or in the older ASDOT format: 138.Bd -literal -offset indent 139AS 3.10 140.Ed 141.Pp 142.It Ic connect-retry Ar seconds 143Set the number of seconds to wait before attempting to re-open 144a connection. 145This timer should be sufficiently large in EBGP configurations. 146The default is 120 seconds. 147.Pp 148.It Xo 149.Ic dump 150.Op Ic rib Ar name 151.Pq Ic table-v2 Ns | Ns Ic table-mp Ns | Ns Ic table 152.Ar file Op Ar interval 153.Xc 154.It Xo 155.Ic dump 156.Pq Ic all Ns | Ns Ic updates 157.Pq Ic in Ns | Ns Ic out 158.Ar file Op Ar interval 159.Xc 160Dump the RIB, a.k.a. the 161.Em routing information base , 162or dump ongoing BGP activity, in Multi-threaded Routing Toolkit (MRT) format. 163The 164.Ar file 165is subject to 166.Xr strftime 3 Ns -expansion. 167.Pp 168The 169.Ic table-v2 170and 171.Ic table-mp 172RIB formats store multi-protocol RIBs correctly, but the 173.Ic table 174format does not. 175The latter two are provided only to support third-party tools lacking 176support for the recommended 177.Ic table-v2 178format. 179Dump an alternative RIB by specifying 180.Ar name . 181Specify an 182.Ar interval 183in seconds for periodic RIB dumps. 184.Pp 185The following will dump the entire RIB table, at startup and every 1865 minutes thereafter, to a new file: 187.Bd -literal -offset indent 188dump table-v2 "/tmp/rib-dump-%H%M" 300 189.Ed 190.Pp 191Dumps of ongoing BGP activity include all BGP state transitions, and 192all BGP messages in the specified direction. 193Use 194.Ic updates 195to dump only BGP 196.Em UPDATE 197messages, without state transitions. 198Specify an 199.Ar interval 200in seconds to restart periodically with a new file: 201.Bd -literal -offset indent 202dump all in "/tmp/all-in-%H%M" 300 203.Ed 204.Pp 205.It Ic fib-priority Ar prio 206Set the routing priority to 207.Ar prio . 208The default is 48. 209.Pp 210.It Xo 211.Ic fib-update 212.Pq Ic yes Ns | Ns Ic no 213.Xc 214If set to 215.Ic no , 216do not update the Forwarding Information Base, a.k.a. the kernel 217routing table. 218The default is 219.Ic yes . 220.Pp 221.It Ic holdtime Ar seconds 222Set the announced holdtime in seconds. 223This is exchanged with a neighbor upon connection 224establishment, in the 225.Em OPEN 226message, and the shortest holdtime governs the session. 227.Pp 228The neighbor session is dropped if the session holdtime passes 229without receipt of a 230.Em KEEPALIVE 231or an 232.Em UPDATE 233message from the neighbor. 234The default is 90 seconds. 235.Pp 236.It Ic holdtime min Ar seconds 237The minimum acceptable holdtime in seconds. 238This value must be at least 3. 239.Pp 240.It Ic listen on Ar address Op Ic port Ar port 241Specify the local IP address and optional port for 242.Xr bgpd 8 243to listen on. 244The default is to listen on all local addresses on the current default 245routing domain. 246.Pp 247.It Ic log updates 248Log sent and received BGP update messages. 249.Pp 250.It Xo 251.Ic nexthop 252.Ic qualify 253.Ic via 254.Pq Ic bgp Ns | Ns Ic default 255.Xc 256If set to 257.Ic bgp , 258.Xr bgpd 8 259may verify nexthops using BGP routes. 260If set to 261.Ic default , 262.Xr bgpd 8 263may verify nexthops using the default route. 264By default 265.Xr bgpd 8 266uses only static routes or routes added by other routing 267daemons, such as 268.Xr ospfd 8 . 269.Pp 270.It Xo 271.Ic rde Ic evaluate 272.Pq Ic default Ns | Ns Ic all 273.Xc 274If set to 275.Ar all , 276keep evaluating alternative paths in case the selected path is filtered 277out. 278By default if a path is filtered by the output filters then no alternative 279path is sent to this peer. 280.Pp 281.It Xo 282.Ic rde Ic med Ic compare 283.Pq Ic always Ns | Ns Ic strict 284.Xc 285If set to 286.Ic always , 287the 288.Em MULTI_EXIT_DISC 289attributes will always be compared. 290The default is 291.Ic strict , 292where the metric is only compared between peers belonging to the same AS. 293.Pp 294.It Xo 295.Ic rde 296.Ic rib Ar name 297.Op Ic no evaluate 298.Xc 299.It Xo 300.Ic rde 301.Ic rib Ar name 302.Op Ic rtable Ar number 303.Xc 304Create an additional RIB named 305.Ar name . 306The degree to which its routes may be utilized is configurable. 307They may be excluded from the decision process that selects usable routes 308with the 309.Ic no evaluate 310flag, and this precludes their export to any kernel routing table. 311By default its routes will be evaluated, but not exported to the kernel. 312They may be both evaluated and exported if associated with a given 313.Ic rtable 314.Ar number , 315which must belong to the routing domain that 316.Xr bgpd 8 317was started in. 318This table will not be consulted during nexthop verification 319unless it is the one that 320.Xr bgpd 8 321was started in. 322It is unnecessary to create 323.Ic Adj-RIB-In 324and 325.Ic Loc-RIB , 326which are created automatically and used by default. 327.Pp 328.It Xo 329.Ic rde 330.Ic route-age 331.Pq Ic ignore Ns | Ns Ic evaluate 332.Xc 333If set to 334.Ic evaluate , 335the route decision process will also consider the age of the route in 336addition to its path attributes, giving preference to the older, 337typically more stable, route. 338This renders the decision process nondeterministic. 339The default is 340.Ic ignore . 341.Pp 342.It Xo 343.Ic reject Ic as-set 344.Pq Ic yes Ns | Ns Ic no 345.Xc 346If set to 347.Ic yes , 348.Em AS paths 349attributes containing 350.Em AS_SET 351path segments will be rejected and 352all prefixes will be treated as withdraws. 353The default is 354.Ic no . 355.Pp 356.It Ic router-id Ar dotted-quad 357Set the BGP router ID, which must be non-zero and should be unique 358within the AS. 359By default, the router ID is the highest IPv4 address assigned 360to the local machine. 361.Bd -literal -offset indent 362router-id 10.0.0.1 363.Ed 364.Pp 365.It Ic rtable Ar number 366Work with the given kernel routing table 367instead of the default table, which is the one 368.Xr bgpd 8 369was started in. 370For nexthop verification, 371.Xr bgpd 8 372will always consult the default table. 373This is the same as using the following syntax: 374.Bd -literal -offset indent 375rde rib Loc-RIB rtable number 376.Ed 377.Pp 378.It Ic socket Qo Ar path Qc Op Ic restricted 379Create a control socket at 380.Ar path . 381If 382.Ic restricted 383is specified, a restricted control socket will be created. 384By default 385.Pa /var/run/bgpd.sock.<rdomain> 386is used where 387.Ar <rdomain> 388is the routing domain in which 389.Xr bgpd 8 390has been started. 391By default, no restricted socket is created. 392.Pp 393.It Xo 394.Ic transparent-as 395.Pq Ic yes Ns | Ns Ic no 396.Xc 397If set to 398.Ic yes , 399.Em AS paths 400to EBGP neighbors are not prepended with the local AS. 401The default is 402.Ic no . 403.El 404.Sh SET CONFIGURATION 405.Xr bgpd 8 406supports the efficient lookup of data within named 407.Em sets . 408An 409.Ic as-set , 410a 411.Ic prefix-set , 412and an 413.Ic origin-set 414store AS numbers, prefixes, and prefixes/source-as pairs, 415respectively. 416Such sets may be referenced by filter rules; see the 417.Sx FILTER 418section for details. 419It is more efficient to evaluate a set than a long series of 420rules for filtering each of its members. 421.Pp 422One single 423.Ic roa-set 424may be defined, against which 425.Xr bgpd 8 426will validate the origin of each prefix. 427The 428.Ic roa-set 429and the 430.Ic aspa-set 431are merged with the corresponding tables received via 432.Ic rtr 433sessions. 434.Pp 435A set definition can span multiple lines, and an optional comma is allowed 436between elements. 437The same set can be defined more than once, in this case the definitions are 438merged into one common set. 439.Pp 440.Bl -tag -width Ds -compact 441.It Xo 442.Ic as-set Ar name 443.Ic { Ar as-number ... Ic } 444.Xc 445An 446.Ic as-set 447stores AS numbers, and can be used with the AS specific parameter in 448.Sx FILTER 449rules. 450.Pp 451.It Xo 452.Ic aspa-set 453.Ic { Ic customer-as Ar as-number 454.Op Ic expires Ar seconds 455.Ic provider-as Ic { Ar as-number 456.Ic ... Ic } ... Ic } 457.Xc 458The 459.Ic aspa-set 460holds a collection of 461.Em Validated ASPA Payloads Pq VAPs . 462Each as AS_PATH received from an eBGP peer is checked against the 463.Ic aspa-set , 464and the ASPA Validation State (AVS) is set. 465.Ic expires 466can be set to the seconds since Epoch until when this VAP is valid. 467.Bd -literal -offset indent 468aspa-set { 469 customer-as 64511 provider-as { 64496 65496 } 470 customer-as 64496 provider-as { 65496 64544 } 471} 472.Ed 473.Pp 474.It Xo 475.Ic origin-set Ar name 476.Ic { Ar address Ns Li / Ns Ar len Ic maxlen Ar mlen Ic source-as Ar asn ... Ic } 477.Xc 478An 479.Ic origin-set 480stores prefix/source-as pairs, and can be used to filter on the combination 481by using the 482.Ic origin-set 483parameter in 484.Sx FILTER 485rules. 486.Bd -literal -offset indent 487origin-set private { 10.0.0.0/8 maxlen 24 source-as 64511 488 203.0.113.0/24 source-as 64496 } 489.Ed 490.Pp 491.It Xo 492.Ic prefix-set Ar name 493.Ic { Ar address Ns Li / Ns Ar len ... Ic } 494.Xc 495A 496.Ic prefix-set 497stores network prefixes and can be used in place 498of the 499.Ic prefix 500parameter in 501.Sx FILTER 502rules, and in 503.Ic network 504statements. 505A prefix can be followed by the prefixlen operators listed for the 506.Ic prefix 507parameter in the 508.Sx PARAMETERS 509section. 510.Pp 511The first example below creates a set of prefixes called 512.Dq private , 513to hold a number of RFC 1918 private network blocks. 514The second example shows the use of prefixlen operators. 515.Bd -literal -offset indent 516prefix-set private { 10.0.0.0/8, 172.16.0.0/12, 517 192.168.0.0/16, fc00::/7 } 518prefix-set as64496set { 192.0.2.0/24 prefixlen >= 26, 519 2001:db8::/32 or-longer } 520.Ed 521.Pp 522.It Xo 523.Ic roa-set 524.Ic { Ar address Ns Li / Ns Ar len 525.Op Ic maxlen Ar mlen 526.Ic source-as Ar asn 527.Oo Ic expires Ar seconds Oc ... Ic } 528.Xc 529The 530.Ic roa-set 531holds a collection of 532.Em Validated ROA Payloads Pq VRPs . 533Each received prefix is checked against the 534.Ic roa-set , 535and the Origin Validation State (OVS) is set. 536.Ic expires 537can be set to the seconds since Epoch until when this VRP is valid. 538.Bd -literal -offset indent 539roa-set { 192.0.2.0/23 maxlen 24 source-as 64511 540 203.0.113.0/24 source-as 64496 } 541.Ed 542.Pp 543.It Xo 544.Ic rtr Ar address 545.Ic { Ar ... Ic } 546.Xc 547The 548.Ic rtr 549block specifies a 550.Em RPKI to Router Pq RTR 551session. 552.Em RTR 553sessions provide another means to load 554.Em VRP 555sets into 556.Xr bgpd 8 . 557Changes propagated via the RTR protocol do not need a config reload and are 558immediately applied. 559The union of all 560.Em VRP 561sets received via 562.Ic rtr 563sessions and the entries in the 564.Ic roa-set 565is used to validate the origin of routes. 566The rtr session properties are as follows: 567.Pp 568.Bl -tag -width Ds -compact 569.It Ic descr Ar description 570Add a description. 571The description is used in logging and status reports, but has no further 572meaning for 573.Xr bgpd 8 . 574.Pp 575.It Ic local-address Ar address 576Bind to the specific IP address before opening the TCP connection to the 577.Em rtr 578server. 579.Pp 580.It Ic port Ar number 581Specify the TCP destination port for the 582.Em rtr 583session. 584If not specified, the default 585.Ic port 586is 587.Em 323 . 588.El 589.El 590.Sh NETWORK AND FLOWSPEC ANNOUNCEMENTS 591.Ic network 592statements specify the networks that 593.Xr bgpd 8 594will announce as its own. 595An announcement must also be permitted by the 596.Sx FILTER 597rules. 598By default 599.Xr bgpd 8 600announces no networks. 601.Pp 602.Bl -tag -width Ds -compact 603.It Xo 604.Ic network 605.Ar address Ns Li / Ns Ar prefix 606.Op Ic set ... 607.Xc 608Announce the specified prefix as belonging to our AS. 609.Pp 610.It Xo 611.Ic network 612.Pq Ic inet Ns | Ns Ic inet6 613.Ic connected Op Ic set ... 614.Xc 615Announce routes to directly attached networks. 616.Pp 617.It Xo 618.Ic network prefix-set 619.Ar name 620.Op Ic set ... 621.Xc 622Announce all networks in the prefix-set 623.Ar name . 624.Pp 625.It Xo 626.Ic network 627.Pq Ic inet Ns | Ns Ic inet6 628.Ic priority Ar number Op Ic set ... 629.Xc 630Announce routes having the specified 631.Ar priority . 632.Pp 633.It Xo 634.Ic network 635.Pq Ic inet Ns | Ns Ic inet6 636.Ic rtlabel Ar label Op Ic set ... 637.Xc 638Announce routes having the specified 639.Ar label . 640.Pp 641.It Xo 642.Ic network 643.Pq Ic inet Ns | Ns Ic inet6 644.Ic static Op Ic set ... 645.Xc 646Announce all static routes. 647.El 648.Pp 649Each 650.Ic network 651statement may set default 652.Em AS path attributes : 653.Bd -literal -offset indent 654network 192.168.7.0/24 set localpref 220 655.Ed 656.Pp 657See also the 658.Sx ATTRIBUTE SET 659section. 660.Pp 661.Ic flowspec 662statements specify the flowspec rules that 663.Xr bgpd 8 664will announce as its own. 665.\"An announcement must also be permitted by the 666.\".Sx FILTER 667.\"rules. 668By default 669.Xr bgpd 8 670announces no flowspec rules. 671.Pp 672.Bl -tag -width Ds -compact 673.It Xo 674.Ic flowspec 675.Pq Ic inet Ns | Ns Ic inet6 676.Ar rule Op Ic set ... 677.Xc 678Announce an IPv4 or IPv6 specific flowspec 679.Ar rule 680including the 681.Em AS path attributes 682specified by 683.Ar set . 684.El 685.Pp 686The following rule parameters can be set. 687Most number arguments in the below rules can be specified as a 688list of ranges enclosed in curly brackets using these operators: 689.Bd -literal -offset indent 690= (equal, default) 691!= (unequal) 692< (less than) 693<= (less than or equal) 694> (greater than) 695>= (greater than or equal) 696- (range including boundaries) 697>< (except range) 698.Ed 699.Pp 700.Sq >< , 701and 702.Sq - 703are binary operators (they take two arguments). 704.Pp 705.Bl -tag -width Ds -compact 706.It Ic from Ar source Op Ic port Ar list 707.It Ic to Ar dest Op Ic port Ar list 708This rule applies only to packets with the specified source or 709destination addresses and ports. 710Addresses can be specified in CIDR notation (matching netblocks) or using 711.Cm any 712to match any address. 713In most cases a 714.Ic to 715address must be specified and be part of the announced networks. 716.Pp 717Ports can be specified either by number or by name. 718For example, port 80 can be specified as 719.Cm www . 720For a list of all port name to number mappings see the file 721.Pa /etc/services . 722.It Ic flags Ar a Ns / Ns Ar b 723This rule only applies to TCP packets that have the flags 724.Ar a 725set out of set 726.Ar b . 727Flags not specified in 728.Ar b 729are ignored. 730The flags are: (F)IN, (S)YN, (R)ST, (P)USH, (A)CK, (U)RG, (E)CE, and C(W)R. 731.It Ic fragment Ar a Ns / Ns Ar b 732This rule only applies to fragmented packets which match the specified flags. 733The flags are: (D)on't fragment, (I)s fragment, (F)irst fragment, and (L)ast 734fragment. 735.It Ic icmp-type Ar type Op Ic code Ar code 736.It Ic icmp6-type Ar type Op Ic code Ar code 737This rule only applies to ICMP or ICMP6 packets with the specified type 738and code. 739Text names for ICMP types and codes are listed in 740.Xr icmp 4 741and 742.Xr icmp6 4 . 743.It Ic length Ar pktlen 744This rule applies only to packets matching the specified 745.Ar pktlen . 746.It Ic proto Ar protocol 747This rule applies only to packets of this protocol. 748Common protocols are ICMP, ICMP6, TCP, and UDP. 749For a list of all the protocol name to number mappings see the file 750.Pa /etc/protocols . 751.It Ic tos Ar string Ns | Ns Ar number 752This rule applies to packets with the specified TOS bits set. 753.Ar string 754may be one of 755.Cm critical , 756.Cm inetcontrol , 757.Cm lowdelay , 758.Cm netcontrol , 759.Cm throughput , 760.Cm reliability , 761or one of the DiffServ Code Points: 762.Cm ef , 763.Cm af11 No ... Cm af43 , 764.Cm cs0 No ... Cm cs7 ; 765.Ar number 766may be either a hex or decimal number. 767.El 768.Pp 769The action taken when a flowspec rules matches depends on extended communities. 770For example to block all traffic either 771.Ic ext-community Ic flow-rate Ar as-number : Ns 0 772or 773.Ic ext-community Ic flow-pps Ar as-number : Ns 0 774need to be set. 775.Sh MPLS VPN CONFIGURATION 776A 777.Ic vpn 778section configures a router to participate in an MPLS Virtual Private Network. 779It specifies an 780.Xr mpe 4 781interface to use, a description, and various properties of the VPN: 782.Bd -literal -offset indent 783vpn "description" on mpe1 { 784 rd 65002:1 785 import-target rt 65002:42 786 export-target rt 65002:42 787 network 192.168.1/24 788} 789.Ed 790.Pp 791.Xr bgpd 8 792will not exchange VPN routes with a neighbor by default, see the 793.Sx NEIGHBORS AND GROUPS 794section. 795The description is used when logging but has no further meaning to 796.Xr bgpd 8 . 797.Pp 798The 799.Xr mpe 4 800interface will be used as the outgoing interface for routes to 801the VPN, and local networks will be announced with the MPLS label 802specified on the interface. 803The interface can provide VPN connectivity for another rdomain by 804being configured in that rdomain. 805The required rdomain must be configured on the interface before 806.Xr bgpd 8 807uses it. 808Multiple VPNs may be connected to a single rdomain, including the rdomain that 809.Xr bgpd 8 810is running in. 811.Pp 812An example 813.Xr hostname.if 5 814configuration for an 815.Xr mpe 4 816interface providing connectivity to rdomain 1: 817.Bd -literal -offset indent 818rdomain 1 819mplslabel 2000 820inet 192.198.0.1 255.255.255.255 821up 822.Ed 823.Pp 824The VPN properties are as follows: 825.Pp 826.Bl -tag -width Ds -compact 827.It Ic export-target Ar subtype as-number : Ns Ar local 828.It Ic export-target Ar subtype IP : Ns Ar local 829Classify announced networks by tagging them with an 830.Em extended community 831of the given arguments. 832The community 833.Ar subtype 834should be a 835.Em route target , 836.Ic rt , 837to ensure interoperability. 838The arguments are further detailed in the 839.Sx ATTRIBUTE SET 840section. 841More than one 842.Ic export-target 843can be specified. 844.Pp 845.It Xo 846.Ic fib-update 847.Pq Ic yes Ns | Ns Ic no 848.Xc 849If set to 850.Ic no , 851do not update the Forwarding Information Base, a.k.a. the kernel 852routing table. 853The default is 854.Ic yes . 855.Pp 856.It Ic import-target Ar subtype as-number : Ns Ar local 857.It Ic import-target Ar subtype IP : Ns Ar local 858The rdomain imports only those prefixes tagged with an 859.Em extended community 860matching an 861.Ic import-target . 862The community 863.Ar subtype 864should be a 865.Em route target , 866.Ic rt , 867to ensure interoperability. 868The arguments are further detailed in the 869.Sx ATTRIBUTE SET 870section. 871More than one 872.Ic import-target 873can be specified. 874.Pp 875.It Ic network Ar argument ... 876Announce the given networks within this VPN; 877see the 878.Sx NETWORK ANNOUNCEMENTS 879section. 880.Pp 881.It Ic rd Ar as-number : Ns Ar local 882.It Ic rd Ar IP : Ns Ar local 883The Route Distinguisher 884.Ic rd 885supplies BGP with namespaces to disambiguate VPN prefixes, as these needn't be 886globally unique. 887Unlike route targets, the 888.Ic rd 889neither identifies the origin of the prefix nor controls into 890which VPNs the prefix is distributed. 891The 892.Ar as-number 893or 894.Ar IP 895of a 896.Ic rd 897should be set to a number or IP that was assigned by an appropriate authority, 898whereas 899.Ar local 900can be chosen by the local operator. 901.El 902.Sh NEIGHBORS AND GROUPS 903.Xr bgpd 8 904establishes TCP connections to other BGP speakers called 905.Em neighbors . 906A neighbor and its properties are specified by a 907.Tg 908.Ic neighbor 909section: 910.Bd -literal -offset indent 911neighbor 10.0.0.2 { 912 remote-as 65002 913 descr "a neighbor" 914} 915.Ed 916.Pp 917Neighbors placed within a 918.Tg 919.Ic group 920section inherit the properties common to that group: 921.Bd -literal -offset indent 922group "peering AS65002" { 923 remote-as 65002 924 neighbor 10.0.0.2 { 925 descr "AS65002-p1" 926 } 927 neighbor 10.0.0.3 { 928 descr "AS65002-p2" 929 } 930} 931.Ed 932.Pp 933An entire network of neighbors may be accommodated by specifying an 934address/netmask pair: 935.Bd -literal -offset indent 936neighbor 10.0.0.0/8 937.Ed 938.Pp 939This is a 940.Em template 941that recognises as a neighbor any connection from within the given network. 942Such neighbors inherit their template's properties, except for their IP address. 943A template may omit 944.Ic remote-as ; 945.Xr bgpd 8 946then accepts any AS presented by the neighbor in the 947.Em OPEN 948message. 949.Pp 950The neighbor properties are as follows: 951.Pp 952.Bl -tag -width Ds -compact 953.It Xo 954.Ic announce 955.Pq Ic IPv4 Ns | Ns Ic IPv6 956.Pq Ic none Ns | Ns Ic unicast Ns | Ns Ic vpn Ns | Ns Ic flowspec 957.Xc 958For the given address family, control which 959.Em subsequent address families 960are announced during the capabilities negotiation. 961Only routes for that address family and subsequent address families will be 962announced and processed. 963.Pp 964At the moment, only 965.Ic none , 966which disables the announcement of that address family, 967.Ic unicast , 968.Ic vpn , 969which allows the distribution of BGP MPLS VPNs, and 970.Ic flowspec , 971which allows the distribution of Flow Specification Rules, 972are supported. 973.Pp 974The default is 975.Ic unicast 976for the same address family of the session. 977.Pp 978.It Xo 979.Ic announce add-path recv 980.Pq Ic yes Ns | Ns Ic no 981.Xc 982If set to 983.Ic yes , 984the receive add-path capability is announced, which allows reception of multiple 985paths per prefix. 986The default is 987.Ic no . 988.Pp 989.It Xo 990.Ic announce add-path send 991.Pq Ic no Ns | Ns Ic all 992.Xc 993.It Xo 994.Ic announce add-path send 995.Pq Ic best Ns | Ns Ic ecmp | Ns Ic as-wide-best 996.Op Ic plus Ar num 997.Op Ic max Ar num 998.Xc 999If set to 1000.Ic all , 1001.Ic best , 1002.Ic ecmp , 1003or 1004.Ic as-wide-best , 1005the send add-path capability is announced, which allows sending multiple paths 1006per prefix. 1007The paths sent depend on which mode is selected: 1008.Pp 1009.Bl -tag -width as-wide-best -compact 1010.It Ic no 1011do not advertise add-path send capability 1012.It Ic all 1013send all valid paths 1014.It Ic best 1015send the best path 1016.It Ic ecmp 1017send paths with equal nexthop cost 1018.It Ic as-wide-best 1019send paths where the first 8 checks of the decision process match 1020.El 1021.Pp 1022.Ic plus 1023allows the inclusion of additional backup paths and works for 1024.Ic best , 1025.Ic ecmp , 1026and 1027.Ic as-wide-best . 1028.Ic max 1029can be used to limit the total amount of paths sent for 1030.Ic ecmp 1031and 1032.Ic as-wide-best . 1033Right now 1034.Ic ecmp 1035and 1036.Ic as-wide-best 1037are equivalent. 1038The default is 1039.Ic no . 1040If 1041.Ic add-path Ic send 1042is active then the setting of 1043.Ic rde Ic evaluate 1044is ignored. 1045.Pp 1046.It Xo 1047.Ic announce as-4byte 1048.Pq Ic yes Ns | Ns Ic no 1049.Xc 1050If set to 1051.Ic no , 1052the 4-byte AS capability is not announced and so native 4-byte AS support is 1053disabled. 1054The default is 1055.Ic yes . 1056.Pp 1057.It Xo 1058.Ic announce capabilities 1059.Pq Ic yes Ns | Ns Ic no 1060.Xc 1061If set to 1062.Ic no , 1063capability negotiation is disabled during the establishment of the session. 1064This can be helpful to connect to old or broken BGP implementations. 1065The default is 1066.Ic yes . 1067.Pp 1068.It Xo 1069.Ic announce enhanced refresh 1070.Pq Ic yes Ns | Ns Ic no 1071.Xc 1072If set to 1073.Ic yes , 1074the enhanced route refresh capability is announced. 1075The default is 1076.Ic no . 1077.Pp 1078.It Xo 1079.Ic announce policy 1080.Pq Ic yes Ns | Ns Ic no Ns | Ns Ic enforce 1081.Xc 1082If set to 1083.Ic yes , 1084add the open policy role capability. 1085If the role of the neighbor does not correspond to the expected role then 1086the session will be closed. 1087If 1088.Ic enforce 1089is set the session will only establish if the neighbor also announces 1090the open policy capability. 1091The default is 1092.Ic no . 1093.Pp 1094.It Xo 1095.Ic announce refresh 1096.Pq Ic yes Ns | Ns Ic no 1097.Xc 1098If set to 1099.Ic no , 1100the route refresh capability is not announced. 1101The default is 1102.Ic yes . 1103.Pp 1104.It Xo 1105.Ic announce restart 1106.Pq Ic yes Ns | Ns Ic no 1107.Xc 1108If set to 1109.Ic no , 1110the graceful restart capability is not announced. 1111Currently only the End-of-RIB marker is supported and announced by the 1112.Ic restart 1113capability. 1114The default is 1115.Ic yes . 1116.Pp 1117.It Xo 1118.Ic as-override 1119.Pq Ic yes Ns | Ns Ic no 1120.Xc 1121If set to 1122.Ic yes , 1123all occurrences of the neighbor AS in the 1124.Em AS path 1125will be replaced with the local AS before running the filters. 1126The Adj-RIB-In still holds the unmodified AS path. 1127The default value is 1128.Ic no . 1129.Pp 1130.It Ic demote Ar group 1131Increase the 1132.Xr carp 4 1133demotion counter on the given interface group, usually 1134.Ar carp , 1135when the session is not in state 1136.Em ESTABLISHED . 1137The demotion counter will be increased as soon as 1138.Xr bgpd 8 1139starts and decreased 114060 seconds after the session went to state 1141.Em ESTABLISHED . 1142For neighbors added at runtime, the demotion counter is only increased after 1143the session has been 1144.Em ESTABLISHED 1145at least once before dropping. 1146.Pp 1147For more information on interface groups, 1148see the 1149.Ic group 1150keyword in 1151.Xr ifconfig 8 . 1152.Pp 1153.It Ic depend on Ar interface 1154The neighbor session will be kept in state 1155.Em IDLE 1156as long as 1157.Ar interface 1158reports no link. 1159For 1160.Xr carp 4 1161interfaces, no link means that the interface is currently 1162.Em backup . 1163This is primarily intended to be used with 1164.Xr carp 4 1165to reduce failover times. 1166.Pp 1167The state of the network interfaces on the system can be viewed 1168using the 1169.Cm show interfaces 1170command to 1171.Xr bgpctl 8 . 1172.Pp 1173.It Ic descr Ar description 1174Add a description. 1175The description is used when logging neighbor events, in status 1176reports, for specifying neighbors, etc., but has no further meaning to 1177.Xr bgpd 8 . 1178.Pp 1179.It Ic down Op Ar reason 1180Do not start the session when 1181.Xr bgpd 8 1182comes up but stay in 1183.Em IDLE . 1184If the session is cleared at runtime, after a 1185.Ic down 1186.Ar reason 1187was configured at runtime, the 1188.Ar reason 1189is sent as Administrative Shutdown Communication. 1190The 1191.Ar reason 1192cannot exceed 255 octets. 1193.Pp 1194.It Xo 1195.Ic dump 1196.Pq Ic all Ns | Ns Ic updates 1197.Pq Ic in Ns | Ns Ic out 1198.Ar file Op Ar interval 1199.Xc 1200Dump ongoing BGP activity for a particular neighbor. 1201See also the 1202.Ic dump 1203setting in 1204.Sx GLOBAL CONFIGURATION . 1205.Pp 1206.It Xo 1207.Ic enforce local-as 1208.Pq Ic yes Ns | Ns Ic no 1209.Xc 1210If set to 1211.Ic no , 1212.Em AS paths 1213will not be checked for AS loop detection. 1214This feature is similar to allowas-in in some other BGP implementations. 1215Since there is no AS path loop check, this feature is dangerous, and 1216requires you to add filters to prevent receiving your own prefixes. 1217The default value is 1218.Ic yes . 1219.Pp 1220.It Xo 1221.Ic enforce neighbor-as 1222.Pq Ic yes Ns | Ns Ic no 1223.Xc 1224If set to 1225.Ic yes , 1226.Em AS paths 1227whose 1228.Em leftmost AS 1229is not equal to the 1230.Em remote AS 1231of the neighbor are rejected and a 1232.Em NOTIFICATION 1233is sent back. 1234The default value for IBGP peers is 1235.Ic no 1236otherwise the default is 1237.Ic yes . 1238.Pp 1239.It Xo 1240.Ic export 1241.Sm off 1242.Pq Ic none | default-route 1243.Sm on 1244.Xc 1245If set to 1246.Ic none , 1247no 1248.Em UPDATE 1249messages will be sent to the neighbor. 1250If set to 1251.Ic default-route , 1252only the default route will be announced to the neighbor. 1253.Pp 1254.It Ic holdtime Ar seconds 1255Set the holdtime in seconds. 1256Inherited from the global configuration if not given. 1257.Pp 1258.It Ic holdtime min Ar seconds 1259Set the minimal acceptable holdtime. 1260Inherited from the global configuration if not given. 1261.Pp 1262.It Xo 1263.Ic ipsec 1264.Pq Ic ah Ns | Ns Ic esp 1265.Pq Ic in Ns | Ns Ic out 1266.Ic spi Ar spi-number authspec Op Ar encspec 1267.Xc 1268Enable IPsec with static keying. 1269There must be at least two 1270.Ic ipsec 1271statements per peer with manual keying, one per direction. 1272.Ar authspec 1273specifies the authentication algorithm and key. 1274It can be 1275.Bd -literal -offset indent 1276sha1 <key> 1277md5 <key> 1278.Ed 1279.Pp 1280.Ar encspec 1281specifies the encryption algorithm and key. 1282.Ic ah 1283does not support encryption. 1284With 1285.Ic esp , 1286encryption is optional. 1287.Ar encspec 1288can be 1289.Bd -literal -offset indent 12903des <key> 12913des-cbc <key> 1292aes <key> 1293aes-128-cbc <key> 1294.Ed 1295.Pp 1296Keys must be given in hexadecimal format. 1297After changing settings, a session needs to be reset to use the new keys. 1298The 1299.Ic ipsec 1300flows only work with session using the default port 179. 1301.Pp 1302.It Xo 1303.Ic ipsec 1304.Pq Ic ah Ns | Ns Ic esp 1305.Ic ike 1306.Xc 1307Enable IPsec with dynamic keying. 1308In this mode, 1309.Xr bgpd 8 1310sets up the flows, and a key management daemon such as 1311.Xr isakmpd 8 1312is responsible for managing the session keys. 1313With 1314.Xr isakmpd 8 , 1315it is sufficient to copy the peer's public key, found in 1316.Pa /etc/isakmpd/local.pub , 1317to the local machine. 1318It must be stored in a file 1319named after the peer's IP address and must be stored in 1320.Pa /etc/isakmpd/pubkeys/ipv4/ . 1321The local public key must be copied to the peer in the same way. 1322As 1323.Xr bgpd 8 1324manages the flows on its own, it is sufficient to restrict 1325.Xr isakmpd 8 1326to only take care of keying by specifying the flags 1327.Fl Ka . 1328This can be done in 1329.Xr rc.conf.local 8 . 1330After starting the 1331.Xr isakmpd 8 1332and 1333.Xr bgpd 8 1334daemons on both sides, the session should be established. 1335After changing settings, a session needs to be reset to use the new keys. 1336The 1337.Ic ipsec 1338flows only work with session using the default port 179. 1339.Pp 1340.It Ic local-address Ar address 1341.It Ic no local-address 1342When 1343.Xr bgpd 8 1344initiates the TCP connection to the neighbor system, it normally does not 1345bind to a specific IP address. 1346If a 1347.Ic local-address 1348is given, 1349.Xr bgpd 8 1350binds to this address first. 1351.Ic no local-address 1352reverts back to the default. 1353.Pp 1354.It Ic local-as Ar as-number Op Ar as-number 1355Set the AS number sent to the remote system. 1356Used as described above under 1357.Sx GLOBAL CONFIGURATION 1358option 1359.Ic AS . 1360.Pp 1361Since there is no AS path loop check, this option is dangerous, and 1362requires you to add filters to prevent receiving your ASNs. 1363Intended to be used temporarily, for migrations to another AS. 1364.Pp 1365.It Ic log no 1366Disable neighbor specific logging. 1367.Pp 1368.It Ic log updates 1369Log received and sent updates for this neighbor. 1370.Pp 1371.It Xo 1372.Ic max-prefix Ar number 1373.Op Ic restart Ar number 1374.Xc 1375Terminate the session when the maximum 1376.Ar number 1377of prefixes received is exceeded 1378(no such limit is imposed by default). 1379If 1380.Ic restart 1381is specified, the session will be restarted after 1382.Ar number 1383minutes. 1384.Pp 1385.It Xo 1386.Ic max-prefix Ar number Ic out 1387.Op Ic restart Ar number 1388.Xc 1389Terminate the session when the maximum 1390.Ar number 1391of prefixes sent is exceeded 1392(no such limit is imposed by default). 1393If 1394.Ic restart 1395is specified, the session will be restarted after 1396.Ar number 1397minutes. 1398.Pp 1399.It Ic multihop Ar hops 1400Neighbors not in the same AS as the local 1401.Xr bgpd 8 1402normally have to be directly connected to the local machine. 1403If this is not the case, the 1404.Ic multihop 1405statement defines the maximum hops the neighbor may be away. 1406.Pp 1407.It Ic passive 1408Do not attempt to actively open a TCP connection to the neighbor system. 1409.Pp 1410.It Ic port Ar port 1411Connect to the peer using 1412.Ar port 1413instead of the default BGP port 179. 1414.Pp 1415.It Xo 1416.Ic reject Ic as-set 1417.Pq Ic yes Ns | Ns Ic no 1418.Xc 1419If set to 1420.Ic yes , 1421.Em AS paths 1422attributes containing 1423.Em AS_SET 1424path segments will be rejected and 1425all prefixes will be treated as withdraws. 1426The default is inherited from the global 1427.Ic reject Ic as-set 1428setting. 1429.Pp 1430.It Ic remote-as Ar as-number 1431Set the AS number of the remote system. 1432.Pp 1433.It Xo 1434.Ic rde Ic evaluate 1435.Pq Ic default Ns | Ns Ic all 1436.Xc 1437If set to 1438.Ar all , 1439keep evaluating alternative paths in case the selected path is filtered 1440out. 1441By default if a path is filtered by the output filters then no alternative 1442path is sent to this peer. 1443The default is inherited from the global 1444.Ic rde Ic evaluate 1445setting. 1446.Pp 1447.It Ic rib Ar name 1448Bind the neighbor to the specified RIB. 1449.Pp 1450.It Ic role Ar role 1451Set the local role for this eBGP session. 1452Setting a role is required for ASPA verification, the open policy role 1453capability and Only-To-Customer (OTC) attribute of RFC 9234. 1454The role can be one of 1455.Ar none , 1456.Ar provider , 1457.Ar customer , 1458.Ar rs , 1459.Ar rs-client , 1460or 1461.Ar peer . 1462If the role is set to 1463.Ar none 1464the 1465.Ic announce Ic policy 1466will also be disabled. 1467On iBGP session the role setting is ignored and forced to 1468.Ar none . 1469.Pp 1470.It Ic route-reflector Op Ar address 1471Act as an RFC 4456 1472.Em route-reflector 1473for this neighbor. 1474An optional cluster ID can be specified; otherwise the BGP ID will be used. 1475.Pp 1476.It Ic set Ar attribute ... 1477Set the 1478.Em AS path attributes 1479to some default per 1480.Ic neighbor 1481or 1482.Ic group 1483block: 1484.Bd -literal -offset indent 1485set localpref 300 1486.Ed 1487.Pp 1488See also the 1489.Sx ATTRIBUTE SET 1490section. 1491Set parameters are applied to the received prefixes; the only exceptions are 1492.Ic prepend-self , 1493.Ic nexthop no-modify 1494and 1495.Ic nexthop self . 1496These sets are rewritten into filter rules and can be viewed with 1497.Dq bgpd -nv . 1498.Pp 1499.It Ic tcp md5sig password Ar secret 1500.It Ic tcp md5sig key Ar secret 1501Enable TCP MD5 signatures per RFC 2385. 1502The shared secret can either be given as a password or hexadecimal key. 1503.Bd -literal -offset indent 1504tcp md5sig password mekmitasdigoat 1505tcp md5sig key deadbeef 1506.Ed 1507After changing keys, a session needs to be reset to use the new keys. 1508.Pp 1509.It Xo 1510.Ic transparent-as 1511.Pq Ic yes Ns | Ns Ic no 1512.Xc 1513If set to 1514.Ic yes , 1515.Em AS paths 1516to EBGP neighbors are not prepended with the local AS. 1517The default is inherited from the global 1518.Ic transparent-as 1519setting. 1520.Pp 1521.It Xo 1522.Ic ttl-security 1523.Pq Ic yes Ns | Ns Ic no 1524.Xc 1525Enable or disable ttl-security. 1526When enabled, 1527outgoing packets are sent using a TTL of 255 1528and a check is made against an incoming packet's TTL. 1529For directly connected peers, 1530incoming packets are required to have a TTL of 255, 1531ensuring they have not been routed. 1532For multihop peers, 1533incoming packets are required to have a TTL of 256 minus multihop distance, 1534ensuring they have not passed through more than the expected number of hops. 1535The default is 1536.Ic no . 1537.El 1538.Sh FILTER 1539.Xr bgpd 8 1540filters all BGP 1541.Em UPDATE 1542messages, including its own announcements, and blocks them by default. 1543Filter rules may match on neighbor, direction, 1544.Em prefix 1545or 1546.Em AS path attributes . 1547Filter rules may also modify 1548.Em AS path attributes . 1549.Pp 1550For each 1551.Em UPDATE 1552processed by the filter, the filter rules are evaluated in sequential order, 1553from first to last. 1554The last matching 1555.Ic allow 1556or 1557.Ic deny 1558rule decides what action is taken. 1559The default action is to deny. 1560.Pp 1561The following actions can be used in the filter: 1562.Bl -tag -width xxxxxxxx 1563.It Ic allow 1564The 1565.Em UPDATE 1566is passed. 1567.It Ic deny 1568The 1569.Em UPDATE 1570is blocked. 1571.It Ic match 1572Apply the filter attribute set without influencing the filter decision. 1573.El 1574.Sh PARAMETERS 1575The rule parameters specify the 1576.Em UPDATES 1577to which a rule applies. 1578An 1579.Em UPDATE 1580always comes from, or goes to, one neighbor. 1581Most parameters are optional, but each can appear at most once per rule. 1582If a parameter is specified, the rule only applies to packets with 1583matching attributes. 1584.Pp 1585.Bl -tag -width Ds -compact 1586.It Xo 1587.Ar as-type Op Ar operator 1588.Ar as-number 1589.Xc 1590.It Ar as-type Ic as-set Ar name 1591This rule applies only to 1592.Em UPDATES 1593where the 1594.Em AS path 1595matches. 1596The 1597part of the 1598.Em AS path 1599specified by the 1600.Ar as-type 1601is matched against the 1602.Ar as-number 1603or the 1604.Ic as-set Ar name : 1605.Pp 1606.Bl -tag -width transmit-as -compact 1607.It Ic AS 1608(any part) 1609.It Ic peer-as 1610(leftmost AS number) 1611.It Ic source-as 1612(rightmost AS number) 1613.It Ic transit-as 1614(all but the rightmost AS number) 1615.El 1616.Pp 1617.Ar as-number 1618is an AS number as explained above under 1619.Sx GLOBAL CONFIGURATION . 1620It may be set to 1621.Ic neighbor-as , 1622which is expanded to the current neighbor remote AS number, or 1623.Ic local-as , 1624which is expanded to the locally assigned AS number. 1625.Pp 1626When specifying an 1627.Ic as-set Ar name , 1628the AS path will instead be matched against all the AS numbers in the set. 1629.Pp 1630The 1631.Ar operator 1632can be unspecified (this case is identical to the equality operator), or one 1633of the numerical operators 1634.Bd -literal -offset indent 1635= (equal) 1636!= (unequal) 1637- (range including boundaries) 1638>< (except range) 1639.Ed 1640.Pp 1641>< and - 1642are binary operators (they take two arguments); with these, 1643.Ar as-number 1644cannot be set to 1645.Ic neighbor-as . 1646.Pp 1647Multiple 1648.Ar as-number 1649entries for a given type or 1650.Ar as-type as-number 1651entries may also be specified, 1652separated by commas or whitespace, 1653if enclosed in curly brackets: 1654.Bd -literal -offset indent 1655deny from any AS { 1, 2, 3 } 1656deny from any { AS 1, source-as 2, transit-as 3 } 1657deny from any { AS { 1, 2, 3 }, source-as 4, transit-as 5 } 1658.Ed 1659.Pp 1660.It Xo 1661.Ic avs 1662.Pq Ic valid | unknown | invalid 1663.Xc 1664This rule applies only to 1665.Em UPDATES 1666where the ASPA Validation State (AVS) matches. 1667.Pp 1668.It Xo 1669.Ic community 1670.Ar as-number Ns Li \&: Ns Ar local 1671.Xc 1672.It Ic community Ar name 1673This rule applies only to 1674.Em UPDATES 1675where the 1676.Ic community 1677path attribute is present and matches. 1678Communities are specified as 1679.Ar as-number : Ns Ar local , 1680where 1681.Ar as-number 1682is an AS number and 1683.Ar local 1684is a locally significant number between zero and 1685.Li 65535 . 1686Both 1687.Ar as-number 1688and 1689.Ar local 1690may be set to 1691.Sq * 1692to do wildcard matching. 1693Alternatively, well-known communities may be given by name instead and 1694include 1695.Ic BLACKHOLE , 1696.Ic GRACEFUL_SHUTDOWN , 1697.Ic NO_EXPORT , 1698.Ic NO_ADVERTISE , 1699.Ic NO_EXPORT_SUBCONFED , 1700and 1701.Ic NO_PEER . 1702Both 1703.Ar as-number 1704and 1705.Ar local 1706may be set to 1707.Ic neighbor-as , 1708which is expanded to the current neighbor remote AS number, or 1709.Ic local-as , 1710which is expanded to the locally assigned AS number. 1711.Pp 1712.It Xo 1713.Ic large-community 1714.Ar as-number : Ns Ar local : Ns Ar local 1715.Xc 1716This rule applies only to 1717.Em UPDATES 1718where the 1719.Ic Large community 1720path attribute is present and matches. 1721Communities are specified as 1722.Ar as-number : Ns Ar local : Ns Ar local , 1723where 1724.Ar as-number 1725is an AS number and 1726.Ar local 1727is a locally significant number between zero and 1728.Li 4294967295 . 1729Both 1730.Ar as-number 1731and 1732.Ar local 1733may be set to 1734.Sq * 1735to do wildcard matching, 1736.Ic neighbor-as , 1737which is expanded to the current neighbor remote AS number, or 1738.Ic local-as , 1739which is expanded to the locally assigned AS number. 1740.Pp 1741.It Xo 1742.Ic ext-community 1743.Ar subtype as-number : Ns Ar local 1744.Xc 1745.It Xo 1746.Ic ext-community 1747.Ar subtype IP : Ns Ar local 1748.Xc 1749.It Xo 1750.Ic ext-community 1751.Ar subtype numvalue 1752.Xc 1753.It Xo 1754.Ic ext-community 1755.Ic ovs 1756.Pq Ic valid | not-found | invalid 1757.Xc 1758This rule applies only to 1759.Em UPDATES 1760where the 1761.Em extended community 1762path attribute is present and matches. 1763Extended Communities are specified by a 1764.Ar subtype 1765and normally two values, a globally unique part (e.g. the AS number) and a 1766local part. 1767Both 1768.Ar as-number 1769and 1770.Ar local 1771may be set to 1772.Ic neighbor-as , 1773which is expanded to the current neighbor remote AS number, or 1774.Ic local-as , 1775which is expanded to the locally assigned AS number. 1776Wildcard matching is supported for 1777.Ar local , 1778.Ar numvalue 1779and 1780.Ar subtype . 1781If wildcard matching is used on the 1782.Ar subtype 1783then 1784.Ar numvalue 1785also needs to be set to 1786.Sq * . 1787See also the 1788.Sx ATTRIBUTE SET 1789section for further information about the encoding. 1790.Pp 1791.It Xo 1792.Pq Ic from Ns | Ns Ic to 1793.Ar peer 1794.Xc 1795This rule applies only to 1796.Em UPDATES 1797coming from, or going to, this particular neighbor. 1798This parameter must be specified. 1799.Ar peer 1800is one of the following: 1801.Pp 1802.Bl -tag -width "group descr" -compact 1803.It Ic any 1804Any neighbor will be matched. 1805.It Ic ibgp 1806All 1807.Em IBGP 1808neighbors will be matched. 1809.It Ic ebgp 1810All 1811.Em EBGP 1812neighbors will be matched. 1813.It Ar address 1814Neighbors with this address will be matched. 1815.It Ic group Ar descr 1816Neighbors in this group will be matched. 1817.It Ic AS Ar as-number 1818Neighbors with this AS will be matched. 1819.El 1820.Pp 1821Multiple 1822.Ar peer 1823entries may also be specified, 1824separated by commas or whitespace, 1825if enclosed in curly brackets: 1826.Bd -literal -offset indent 1827deny from { 128.251.16.1, 251.128.16.2, group hojo } 1828.Ed 1829.Pp 1830.It Pq Ic inet Ns | Ns Ic inet6 1831Match only routes in the IPv4 or IPv6 address families, respectively. 1832.Ic inet 1833is an alias for 1834.Qq prefix 0.0.0.0/0 prefixlen >= 0 ; 1835.Ic inet6 1836is an alias for 1837.Qq prefix ::/0 prefixlen >= 0 . 1838.Pp 1839.It Ic max-as-len Ar len 1840This rule applies only to 1841.Em UPDATES 1842where the 1843.Em AS path 1844has more than 1845.Ar len 1846elements. 1847.Pp 1848.It Ic max-as-seq Ar len 1849This rule applies only to 1850.Em UPDATES 1851where a single 1852.Em AS number 1853is repeated more than 1854.Ar len 1855times. 1856.Pp 1857.It Ic max-communities Ns | Ns Ic max-large-communities Ns | \ 1858Ns Ic max-ext-communities Ar num 1859This rule applies only to 1860.Em UPDATES 1861where the 1862.Em Basic , 1863.Em Large , 1864or 1865.Em Extended Community 1866attribute has more than 1867.Ar num 1868elements. 1869.Pp 1870.It Ic nexthop Ar address 1871This rule applies only to 1872.Em UPDATES 1873where the nexthop is equal to 1874.Ar address . 1875The 1876.Ar address 1877can be set to 1878.Em neighbor 1879in which case the nexthop is compared against the address of the neighbor. 1880Nexthop filtering is not supported on locally announced networks and one must 1881take into consideration previous rules overwriting nexthops. 1882.Pp 1883.It Ic origin-set Ar name 1884This rule applies only to 1885.Em UPDATES 1886that match the given origin-set 1887.Ar name . 1888.Pp 1889.It Xo 1890.Ic ovs 1891.Pq Ic valid | not-found | invalid 1892.Xc 1893This rule applies only to 1894.Em UPDATES 1895where the Origin Validation State (OVS) matches. 1896.Pp 1897.It Ic prefix Ar address Ns Li / Ns Ar len 1898.It Ic prefix Ar address Ns Li / Ns Ar len Ic prefixlen Ar range 1899.It Ic prefix Ar address Ns Li / Ns Ar len Ic or-longer 1900.It Ic prefix Ar address Ns Li / Ns Ar len Ic maxlen Ar mlen 1901This rule applies only to 1902.Em UPDATES 1903for the specified prefix. 1904.Pp 1905Multiple entries may be specified, 1906separated by commas or whitespace, 1907if enclosed in curly brackets: 1908.Bd -literal -offset indent 1909deny from any prefix { 192.168.0.0/16, 10.0.0.0/8 or-longer } 1910.Ed 1911.Pp 1912Multiple lists can also be specified, which is useful for 1913macro expansion: 1914.Bd -literal -offset indent 1915good="{ 192.168.0.0/16, 172.16.0.0/12, 10.0.0.0/8 }" 1916bad="{ 224.0.0.0/4 prefixlen >= 4, 240.0.0.0/4 prefixlen >= 4 }" 1917ugly="{ 127.0.0.1/8, 169.254.0.0/16 }" 1918 1919deny from any prefix { $good $bad $ugly } 1920.Ed 1921.Pp 1922Prefix length ranges are specified by using these operators: 1923.Bd -literal -offset indent 1924= (equal) 1925!= (unequal) 1926< (less than) 1927<= (less than or equal) 1928> (greater than) 1929>= (greater than or equal) 1930- (range including boundaries) 1931>< (except range) 1932.Ed 1933.Pp 1934>< and - 1935are binary operators (they take two arguments). 1936For instance, to match all prefix lengths >= 8 and <= 12, and hence the 1937CIDR netmasks 8, 9, 10, 11 and 12: 1938.Bd -literal -offset indent 1939prefixlen 8-12 1940.Ed 1941.Pp 1942Or, to match all prefix lengths < 8 or > 12, and hence the CIDR netmasks 19430\(en7 and 13\(en32: 1944.Bd -literal -offset indent 1945prefixlen 8><12 1946.Ed 1947.Pp 1948This will match all prefixes in the 10.0.0.0/8 netblock with netmasks longer 1949than 16: 1950.Bd -literal -offset indent 1951prefix 10.0.0.0/8 prefixlen > 16 1952.Ed 1953.Pp 1954.Ic or-longer 1955is a shorthand for: 1956.Bd -literal -offset indent 1957.Ic prefix Ar address Ns Li / Ns Ar len Ic prefixlen >= Ar len 1958.Ed 1959.Pp 1960.Ic maxlen Ar mlen 1961is a shorthand for: 1962.Bd -literal -offset indent 1963.Ic prefix Ar address Ns Li / Ns Ar len Ic prefixlen <= Ar mlen 1964.Ed 1965.Pp 1966.It Ic prefix-set Ar name Op Ic or-longer 1967This rule applies only to 1968.Em UPDATES 1969that match the given prefix-set 1970.Ar name . 1971With 1972.Ic or-longer , 1973the 1974.Em UPDATES 1975will match any prefix in the prefix-set where 1976.Bd -literal -offset indent 1977.Ic address Ns Li / Ns Ar len Ic prefixlen >= Ar len 1978.Ed 1979.Pp 1980.It Ic quick 1981If an 1982.Em UPDATE 1983matches a rule which has the 1984.Ic quick 1985option set, this rule is considered the last matching rule, and evaluation 1986of subsequent rules is skipped. 1987.Pp 1988.It Ic rib Ar name 1989Apply rule only to the specified RIB. 1990This only applies for received updates, so not for rules using the 1991.Ar to peer 1992parameter. 1993.Pp 1994.It Ic set Ar attribute ... 1995All matching rules can set the 1996.Em AS path attributes 1997to some default. 1998The set of every matching rule is applied, not only the last matching one. 1999See also the following section. 2000.El 2001.Sh ATTRIBUTE SET 2002.Em AS path attributes 2003can be modified with 2004.Ic set . 2005.Pp 2006.Ic set 2007can be used on 2008.Ic network 2009statements, in 2010.Ic neighbor 2011or 2012.Ic group 2013blocks, and on filter rules. 2014Attribute sets can be expressed as lists. 2015.Pp 2016The following attributes can be modified: 2017.Pp 2018.Bl -tag -width Ds -compact 2019.It Xo 2020.Ic community Op Ar delete 2021.Ar as-number : Ns Ar local 2022.Xc 2023.It Xo 2024.Ic community Op Ar delete 2025.Ar name 2026.Xc 2027Set or delete the 2028.Em COMMUNITIES 2029AS path attribute. 2030Communities are specified as 2031.Ar as-number : Ns Ar local , 2032where 2033.Ar as-number 2034is an AS number and 2035.Ar local 2036is a locally significant number between zero and 2037.Li 65535 . 2038Alternately, well-known communities may be specified by name: 2039.Ic GRACEFUL_SHUTDOWN , 2040.Ic NO_EXPORT , 2041.Ic NO_ADVERTISE , 2042.Ic NO_EXPORT_SUBCONFED , 2043or 2044.Ic NO_PEER . 2045For 2046.Cm delete , 2047both 2048.Ar as-number 2049and 2050.Ar local 2051may be set to 2052.Sq * 2053to do wildcard matching. 2054.Pp 2055.It Xo 2056.Ic large-community Op Ar delete 2057.Ar as-number : Ns Ar local : Ns Ar local 2058.Xc 2059.It Xo 2060.Ic large-community Op Ar delete 2061.Ar name 2062.Xc 2063Set or delete the 2064.Em Large Communities 2065path attribute. 2066Communities are specified as 2067.Ar as-number : Ns Ar local : Ns Ar local , 2068where 2069.Ar as-number 2070is an AS number and 2071.Ar local 2072is a locally significant number between zero and 2073.Li 4294967295 . 2074For 2075.Cm delete , 2076both 2077.Ar as-number 2078and 2079.Ar local 2080may be set to 2081.Sq * 2082to do wildcard matching. 2083.Pp 2084.It Xo 2085.Ic ext-community Op Ar delete 2086.Ar subtype as-number : Ns Ar local 2087.Xc 2088.It Xo 2089.Ic ext-community Op Ar delete 2090.Ar subtype IP : Ns Ar local 2091.Xc 2092.It Xo 2093.Ic ext-community Op Ar delete 2094.Ar subtype numvalue 2095.Xc 2096.It Xo 2097.Ic ext-community Op Ar delete 2098.Ic ovs 2099.Pq Ic valid | not-found | invalid 2100.Xc 2101Set or delete the 2102.Em Extended Community 2103AS path attribute. 2104Extended Communities are specified by a 2105.Ar subtype 2106and normally two values, a globally unique part (e.g. the AS number) and a 2107local part. 2108The type is selected depending on the encoding of the global part. 2109Two-octet AS Specific Extended Communities and Four-octet AS Specific Extended 2110Communities are encoded as 2111.Ar as-number : Ns Ar local . 2112Four-octet encoding is used if the 2113.Ar as-number 2114is bigger than 65535 or if the AS_DOT encoding is used. 2115IPv4 Address Specific Extended Communities are encoded as 2116.Ar IP : Ns Ar local . 2117Opaque Extended Communities are encoded with a single numeric value. 2118The 2119.Ar ovs 2120subtype can only be set to 2121.Ar valid , 2122.Ar not-found , 2123or 2124.Ar invalid . 2125Currently the following subtypes are supported: 2126.Bd -literal -offset indent 2127bdc BGP Data Collection 2128defgw Default Gateway 2129esi-lab ESI Label 2130esi-rt ES-Import Route Target 2131l2vid L2VPN Identifier 2132mac-mob MAC Mobility 2133odi OSPF Domain Identifier 2134ort OSPF Route Type 2135ori OSPF Router ID 2136ovs BGP Origin Validation State 2137rt Route Target 2138soo Route Origin / Source of Origin 2139srcas Source AS 2140vrfri VRF Route Import 2141.Ed 2142.Pp 2143Not all type and subtype value pairs are allowed by IANA and the parser 2144will ensure that no invalid combination is created. 2145.Pp 2146For 2147.Cm delete , 2148.Ar subtype , 2149.Ar numvalue , 2150or 2151.Ar local , 2152may be set to 2153.Sq * 2154to do wildcard matching. 2155If wildcard matching is used on the 2156.Ar subtype 2157then 2158.Ar numvalue 2159also needs to be set to 2160.Sq * . 2161.Pp 2162.It Ic localpref Ar number 2163Set the 2164.Em LOCAL_PREF 2165AS path attribute. 2166If 2167.Ar number 2168starts with a plus or minus sign, 2169.Em LOCAL_PREF 2170will be adjusted by adding or subtracting 2171.Ar number ; 2172otherwise it will be set to 2173.Ar number . 2174The default is 100. 2175.Pp 2176.It Ic med Ar number 2177.It Ic metric Ar number 2178Set the 2179.Em MULTI_EXIT_DISC 2180AS path attribute. 2181If 2182.Ar number 2183starts with a plus or minus sign, 2184.Em MULTI_EXIT_DISC 2185will be adjusted by adding or subtracting 2186.Ar number ; 2187otherwise it will be set to 2188.Ar number . 2189.Pp 2190.It Xo 2191.Ic origin 2192.Sm off 2193.Pq Ic igp | egp | incomplete 2194.Sm on 2195.Xc 2196Set the 2197.Em ORIGIN 2198AS path attribute to mark the source of this 2199route as being injected from an igp protocol, an egp protocol 2200or being an aggregated route. 2201.Pp 2202.It Xo 2203.Ic nexthop 2204.Sm off 2205.Pq Ar address | Ic blackhole | reject | self | no-modify 2206.Sm on 2207.Xc 2208Set the 2209.Em NEXTHOP 2210AS path attribute 2211to a different nexthop address or use blackhole or reject routes. 2212.Em blackhole 2213and 2214.Em reject 2215only affect the FIB and will not alter the nexthop address. 2216.Em self 2217forces the nexthop to be set to the local interface address. 2218If set to 2219.Em no-modify , 2220the nexthop attribute is not modified for EBGP multihop sessions. 2221By default EBGP multihop sessions use the local interface address. 2222On other IBGP and directly connected EBGP sessions 2223.Em no-modify 2224is ignored. 2225The set 2226.Ar address 2227is used on IBGP session and on directly connected EBGP session if the 2228.Ar address 2229is part of the connected network. 2230On EBGP multihop session 2231.Em no-modify 2232has to be set to force the nexthop to 2233.Ar address . 2234.Bd -literal -offset indent 2235set nexthop 192.168.0.1 2236set nexthop blackhole 2237set nexthop reject 2238set nexthop no-modify 2239set nexthop self 2240.Ed 2241.Pp 2242.It Ic pftable Ar table 2243Add the prefix in the update to the specified 2244.Xr pf 4 2245table, regardless of whether or not the path was selected for routing. 2246This option may be useful in building realtime blacklists. 2247.Pp 2248.It Ic prepend-neighbor Ar number 2249Prepend the neighbor's AS 2250.Ar number 2251times to the 2252.Em AS path . 2253.Pp 2254.It Ic prepend-self Ar number 2255Prepend the local AS 2256.Ar number 2257times to the 2258.Em AS path . 2259.Pp 2260.It Ic rtlabel Ar label 2261Add the prefix to the kernel routing table with the specified 2262.Ar label . 2263.Pp 2264.It Ic weight Ar number 2265The 2266.Em weight 2267is used to tip prefixes with equally long AS paths in one or 2268the other direction. 2269A prefix is weighed at a very late stage in the decision process. 2270If 2271.Ar number 2272starts with a plus or minus sign, the 2273.Em weight 2274will be adjusted by adding or subtracting 2275.Ar number ; 2276otherwise it will be set to 2277.Ar number . 2278.Em Weight 2279is a local non-transitive attribute, and is a 2280.Xr bgpd 8 Ns -specific 2281extension. 2282For prefixes with equally long paths, the prefix with the larger weight 2283is selected. 2284.El 2285.Sh FILES 2286.Bl -tag -width "/etc/examples/bgpd.conf" -compact 2287.It Pa /etc/bgpd.conf 2288.Xr bgpd 8 2289configuration file. 2290.It Pa /etc/examples/bgpd.conf 2291Example configuration file. 2292.El 2293.Sh SEE ALSO 2294.Xr strftime 3 , 2295.Xr ipsec 4 , 2296.Xr pf 4 , 2297.Xr rdomain 4 , 2298.Xr tcp 4 , 2299.Xr bgpctl 8 , 2300.Xr bgpd 8 , 2301.Xr ipsecctl 8 , 2302.Xr isakmpd 8 , 2303.Xr rc.conf.local 8 2304.Sh HISTORY 2305The 2306.Nm 2307file format first appeared in 2308.Ox 3.5 . 2309