Skip to main content

Border Gateway Protocol (BGP)

The Anapaya appliance supports Border Gateway Protocol (BGP) only to BGP peers in the local network. There are two use cases for this:

  1. LAN connectivity: The local network is administered using BGP and the appliance needs to learn about reachable IP destinations in the local network via BGP.
  2. Route redistribution: The IP prefixes learned from local BGP peers are redistributed via SGRP to remote SCION ASes. Conversely, IP prefixes learned from remote SCION AS via SGRP are redistributed to local BGP peers. Accept- and announce-filters can be used to control which IP prefixes are redistributed.

For both use cases, the appliance needs to establish BGP sessions with local BGP peers. The BGP configuration is specified in the bgp section of the appliance configuration. The Configuration reference section provides the full configuration reference.

The BGP daemon configured in the bgp section receives and announces IP prefixes from and to peers on the internal network and peers connected via legacy IP networks. IP prefixes learned and accepted from SGRP peers in remote ASes are entered into the local routing table with a metric of 15 (the Administrative Distance of SGRP). The BGP service picks those routes and propagates them tp BGP peers in the local network. Similarly, routes learned from local BGP peers are picked up by the IP-in-SCION tunneling endpoint and propagated to SGRP peers in remote ASes while respecting the policies configured in the SCION tunneling section.

Configuration reference​

v0.40v0.39v0.38next

Anapaya appliance configuration (bgp only)

bgp object

Top-level configuration and state for the BGP router.

global object

Global configuration for the BGP router

asinteger<uint32>

Local BGP autonomous system number of the router. Uses the 32-bit as-number type from the model in RFC 6991.

networksstring<ip-prefix>[]

The list of network prefixes this BGP instance advertises.

router_idstring<dotted-quad>

Router id of the router - an unsigned 32-bit integer expressed in dotted quad notation.

src_addressstring<ip-address>

Set the preferred source address when installing routes in the kernel.

neighbors object[]

Configuration for BGP neighbors

  • Array [
    • auth_password_refstring<secret-ref>

    Reference to the MD5 authentication password for use with the neighboring device.

    bfd object

    BFD configuration parameters relating to the BGP neighbor

    desired_minimum_tx_intervalinteger<uint32>

    Minimum desired control packet transmission interval in milliseconds

    Possible values: >= 10 and <= 60000

    Default value: 300
    detection_multiplierinteger<uint8>

    Local session detection multiplier

    Possible values: >= 2

    Default value: 3
    enabledboolean

    Enable BFD for the BGP neighbor

    Default value: false
    local_addressstring<ip-address>

    Local address to use for BFD

    minimum_ttlinteger<uint8>

    For multihop sessions only: configure the minimum expected TTL for an incoming BFD control packet.

    Possible values: >= 1 and <= 254

    Default value: 254
    multihopboolean

    Enable BFD multihop

    Default value: false
    required_minimum_receiveinteger<uint32>

    Minimum required control packet receive interval in milliseconds

    Possible values: >= 10 and <= 60000

    Default value: 300
    descriptionstring

    An optional textual description of the neighbor.

    ebgp_multihopinteger<uint8>

    Specifying ebgp-multihop allows sessions with eBGP neighbors to establish when they are multiple hops away. When the neighbor is not directly connected and this setting is not enabled, the session will not establish.

    enabledboolean

    Whether the BGP peer is enabled. In cases where the enabled leaf is set to false, the local system will not initiate connections to the neighbor, and will not respond to TCP connections attempts from the neighbor. If the BGP session is established at the time that this property is set to false, the session will be ceased.

    Default value: true
    local_asinteger<uint32>

    The local BGP autonomous system number that is to be used when establishing sessions with the remote peer or peer group, if this differs from the global BGP router autonomous system number.

    neighbor_addressstring<ip-address>

    Address of the BGP peer, either IPv4 or IPv6.

    peer_asinteger<uint32>

    BGP autonomous system number of the peer.

    timers object

    Timers related to a BGP neighbor

    connect_retryinteger<int32>

    Time interval in seconds between attempts to establish a session with the peer.

    Default value: 30
    hold_timeinteger<int32>

    Time interval in seconds that a BGP session will be considered active in the absence of keepalive or other messages from the peer. The hold-time is typically set to 3x the keepalive-interval.

    Default value: 30
    keepalive_intervalinteger<int32>

    Time interval in seconds between transmission of keepalive messages to the neighbor. Typically set to 1/3 the hold-time.

    Default value: 10
    minimum_advertisement_intervalinteger<int32>

    Minimum time in seconds which must elapse between subsequent UPDATE messages relating to a common set of NLRI being transmitted to a peer. This timer is referred to as MinRouteAdvertisementIntervalTimer by RFC 4721 and serves to reduce the number of UPDATE messages transmitted when a particular set of NLRI exhibit instability.

    Default value: 30
    transport object

    Transport session parameters for the BGP neighbor

    local_addressstring<union>

    Set the local IPv4 address to be used for the session when sending BGP update messages. This may be expressed as either an IP address or the name of an interface.

    ttl_securityinteger<int32>

    BGP Time To Live (TTL) security check. Reference: RFC 5082: The Generalized TTL Security Mechanism (GTSM), RFC 7454: BGP Operations and Security.

  • ]

    • Example​

    The example below is a BGP configuration with one neighbor.

    Loading...
    Discrepancies between FRR and IP-in-SCION tunneling routes

    Due to an external bug in FRR, there can be cases of mismatch between routes received from the remote IP-in-SCION tunneling peers and the routes advertised to internal BGP peers. In such cases, a BGPUnexportedRoutes alert is fired. See Runbooks for further information on alerts.

    To fix it, run

    appliance-cli debug frr non-advertised-routes --fix

    To fix for a specific neighbor only the --neighbor flag.