Checklist and troubleshooting
Checklist
- A written community scheme: what your large communities mean, and which provider communities you use.
- Tag every route on import by source. Act on the tags in export and internal policy.
- Prepend in small steps (once, then twice), and check the result from outside with looking glasses. More than three or four prepends rarely helps.
- Know your providers' action communities (prepend-to-peers, don't-announce-to, local-pref changes) from their documentation or PeeringDB. They're more precise than prepending.
- RTBH: agreed with each provider in advance, tested before you need it, BLACKHOLE only (no NO_EXPORT from your side), export rule limited to /32s inside your own space, and a procedure for removing it.
- Check community-lists with
show bgp ipv4 community-list NAMEwhen they don't seem to match.
When it doesn't work
| Symptom | Look at | Usual cause |
|---|---|---|
| Tagged route not advertised | show bgp ipv4 <prefix> ("Not advertised") | NO_EXPORT on the route, or the export map denies it |
| Community-list matches nothing | show bgp ipv4 community-list NAME | Regex written against the number, but FRR matches the text form (blackhole, no-export) |
| Prepending has no effect on some networks | Their view in a looking glass | Local preference beats AS path: your provider's customers will still come straight in |
| Provider ignores the blackhole | Their acceptance rules | /32 outside your registered space, or the provider doesn't support RTBH on that session |
vyos@R1:~$ show configuration commands | match "policy|protocols bgp"
set policy community-list BLACKHOLE rule 10 action 'permit'
set policy community-list BLACKHOLE rule 10 regex 'blackhole'
set policy prefix-list OUR-HOSTS rule 10 action 'permit'
set policy prefix-list OUR-HOSTS rule 10 ge '32'
set policy prefix-list OUR-HOSTS rule 10 prefix '198.51.100.0/24'
set policy prefix-list OUR-PREFIXES rule 10 action 'permit'
set policy prefix-list OUR-PREFIXES rule 10 prefix '198.51.100.0/24'
set policy route-map RTBH rule 10 action 'permit'
set policy route-map RTBH rule 10 set community add '65535:666'
set policy route-map TRANSIT-A-IN rule 10 action 'permit'
set policy route-map TRANSIT-A-IN rule 10 set large-community add '64500:100:1'
set policy route-map TRANSIT-B-IN rule 10 action 'permit'
set policy route-map TRANSIT-B-IN rule 10 set large-community add '64500:100:2'
set policy route-map TRANSIT-B-OUT rule 10 action 'permit'
set policy route-map TRANSIT-B-OUT rule 10 match ip address prefix-list 'OUR-PREFIXES'
set policy route-map TRANSIT-B-OUT rule 10 set as-path prepend '64500 64500'
set policy route-map TRANSIT-B-OUT rule 100 action 'deny'
set policy route-map TRANSIT-OUT rule 10 action 'permit'
set policy route-map TRANSIT-OUT rule 10 match ip address prefix-list 'OUR-PREFIXES'
set policy route-map TRANSIT-OUT rule 20 action 'permit'
set policy route-map TRANSIT-OUT rule 20 match community community-list 'BLACKHOLE'
set policy route-map TRANSIT-OUT rule 20 match ip address prefix-list 'OUR-HOSTS'
set policy route-map TRANSIT-OUT rule 100 action 'deny'
set protocols bgp address-family ipv4-unicast network 198.51.100.0/24
set protocols bgp address-family ipv4-unicast network 198.51.100.10/32 route-map 'RTBH'
set protocols bgp neighbor 203.0.113.0 address-family ipv4-unicast route-map export 'TRANSIT-OUT'
set protocols bgp neighbor 203.0.113.0 address-family ipv4-unicast route-map import 'TRANSIT-A-IN'
set protocols bgp neighbor 203.0.113.0 description 'TRANSIT-A upstream1'
set protocols bgp neighbor 203.0.113.0 remote-as '64496'
set protocols bgp neighbor 203.0.113.2 address-family ipv4-unicast route-map export 'TRANSIT-B-OUT'
set protocols bgp neighbor 203.0.113.2 address-family ipv4-unicast route-map import 'TRANSIT-B-IN'
set protocols bgp neighbor 203.0.113.2 description 'TRANSIT-B upstream2'
set protocols bgp neighbor 203.0.113.2 remote-as '64497'
set protocols bgp parameters router-id '198.51.100.1'
set protocols bgp system-as '64500'
set system login operator-group default command-policy allow '*'- Line 1: Everything from this lesson, as committed.