BGP Outbound Route Filtering (ORF)


R1 advertise following networks to R2:
R2#sh ip bgp | b Network
   Network          Next Hop            Metric LocPrf Weight Path
*> 192.168.1.0      100.100.12.1             0             0 100 i
*> 192.168.2.0      100.100.12.1             0             0 100 i
*> 192.168.3.0      100.100.12.1             0             0 100 i
R2#

Then we add a prefix-list to deny 192.168.2.0 network:
R2(config)#do sh run | s prefix-list
ip prefix-list FROM-R1 seq 5 deny 192.168.2.0/24
ip prefix-list FROM-R1 seq 10 permit 0.0.0.0/0 le 32

R2(config)#do sh run | s bgp
router bgp 200
 bgp log-neighbor-changes
 neighbor 100.100.12.1 remote-as 100
 neighbor 100.100.12.1 prefix-list FROM-R1 in
R2(config)#

Then we can see the 192.168.2.0/24 is no longer in BGP table:
R2#clear ip bgp 100.100.12.1 in
R2#sh ip bgp | b Network
   Network          Next Hop            Metric LocPrf Weight Path
*> 192.168.1.0      100.100.12.1             0             0 100 i
*> 192.168.3.0      100.100.12.1             0             0 100 i
R2#

We will not be able to see the routes received before the filter without the "Inbound soft reconfiguration" is configured.
R2#sh ip bgp neighbors 100.100.12.1 received-routes
% Inbound soft reconfiguration not enabled on 100.100.12.1
R2#


The following command only shows the received routes after the filter applied. 
R2#sh ip bgp neighbors 100.100.12.1 routes
BGP table version is 69, local router ID is 100.100.12.2
Status codes: s suppressed, d damped, h history, * valid, > best, i - internal,
              r RIB-failure, S Stale, m multipath, b backup-path, x best-external, f RT-Filter
Origin codes: i - IGP, e - EGP, ? - incomplete

   Network          Next Hop            Metric LocPrf Weight Path
*> 192.168.1.0      100.100.12.1             0             0 100 i
*> 192.168.3.0      100.100.12.1             0             0 100 i

Total number of prefixes 2
R2#

Let's see what R1 advertised:
R1#sh ip bgp nei 100.100.12.2 advertised-routes | b Network
   Network          Next Hop            Metric LocPrf Weight Path
*> 192.168.1.0      0.0.0.0                  0         32768 i
*> 192.168.2.0      0.0.0.0                  0         32768 i
*> 192.168.3.0      0.0.0.0                  0         32768 i

Total number of prefixes 3
R1#


Now let's use orf, then we can see we received only 2 prefixes.
R2(config-router)#do sh run | s bgp
router bgp 200
 bgp log-neighbor-changes
 neighbor 100.100.12.1 remote-as 100
 neighbor 100.100.12.1 capability orf prefix-list send

 neighbor 100.100.12.1 prefix-list FROM-R1 in
R2(config-router)#


R2#sh ip bgp nei 100.100.12.1 | b ORF
    Outbound Route Filter (ORF) type (128) Prefix-list:
      Send-mode: advertised      Receive-mode: received
  Outbound Route Filter (ORF): sent;
  Incoming update prefix filter list is FROM-R1
  Slow-peer detection is disabled
  Slow-peer split-update-group dynamic is disabled
                                 Sent       Rcvd
  Prefix activity:               ----       ----
    Prefixes Current:               0          2 (Consumes 112 bytes)
    Prefixes Total:                 0          4
    Implicit Withdraw:              0          2
    Explicit Withdraw:              0          0
    Used as bestpath:             n/a          2
    Used as multipath:            n/a          0



R1(config-router)#do sh run | s bgp
router bgp 100
 bgp log-neighbor-changes
 network 1.1.1.1 mask 255.255.255.255
 network 192.168.1.0
 network 192.168.2.0
 network 192.168.3.0
 neighbor 100.100.12.2 remote-as 200
 neighbor 100.100.12.2 capability orf prefix-list receive

R1(config-router)#
R1#sh ip bgp nei 100.100.12.2 | b ORF
    Outbound Route Filter (ORF) type (128) Prefix-list:
      Send-mode: received
      Receive-mode: advertised
  Outbound Route Filter (ORF): received (2 entries)
  Slow-peer detection is disabled
  Slow-peer split-update-group dynamic is disabled
                                 Sent       Rcvd
  Prefix activity:               ----       ----
    Prefixes Current:               2          0
    Prefixes Total:                 2          0
    Implicit Withdraw:              0          0
    Explicit Withdraw:              1          0
    Used as bestpath:             n/a          0
    Used as multipath:            n/a          0


On R1, we only advertise two prefixes to R2
R1#sh ip bgp nei 100.100.12.2 advertised-routes | b Network
   Network          Next Hop            Metric LocPrf Weight Path
*> 192.168.1.0      0.0.0.0                  0         32768 i
*> 192.168.3.0      0.0.0.0                  0         32768 i

Total number of prefixes 2
R1#

Following command confirmed that R1 received the prefix-list.
R1#sh ip bgp nei 100.100.12.2 received prefix-filter
Address family: IPv4 Unicast
ip prefix-list 100.100.12.2: 2 entries
   seq 5 deny 192.168.2.0/24
   seq 10 permit 0.0.0.0/0 le 32
R1#

Conclusion: With ORF, downstream router can send inbound prefix-list filter to the upstream router, the upstream router then use it as an outbound prefix-list filter, so it can filter the routes before send them to downstream router, instead of letting downstream router filter them after receive them, this will save the bandwidth and resource on the downstream router.

Comments

Popular posts from this blog

Firepower FMC and FTD troubleshooting

ASA IKEv1 VPN troubleshooting Steps and Tips

Firepower 2100/1100 FTD/ASA initial setup, reimage, upgrade.