Cisco Guard BGP流量牵引配置

 

网络拓扑

 

Guard BGP 配置模板

router(config)# router bgp

router(config-router)# bgp router-id

router(config-router)# redistribute guard

router(config-router)# neighbor remote-as

router(config-router)# neighbor description

router(config-router)# neighbor soft-reconfiguration inbound

router(config-router)# neighbor distribute-list nothing-in in

router(config-router)# neighbor route-map Guard-out out

router(config-router)# exit

router(config)# access-list nothing-in deny any

router(config)# route-map Guard-out permit 10

router(config-route-map)# set community no-export no-advertise

 

 

Example：

router# show running-config

... ... ...

router bgp 64555

bgp router-id 192.168.8.8

redistribute guard

neighbor 192.168.8.1 remote-as 100

neighbor 192.168.8.1 description divert-from router

neighbor 192.168.8.1 soft-reconfiguration inbound

neighbor 192.168.8.1 distribute-list nothing-in in

neighbor 192.168.8.1 route-map Guard-out out

!

access-list nothing-in deny any

!

route-map Guard-out permit 10

set community 100:64555 no-export no-advertise

 

 

 

牵引路由器BGP配置模板

 

R7200(config)# router bgp

R7200(config-router)# bgp log-neighbor-changes

R7200(config-router)# neighbor remote-as GuardAS

R7200(config-router)# neighbor description

R7200(config-router)# neighbor soft-reconfiguration inbound

R7200(config-router)# neighbor distribute-list routesToGuard out

R7200(config-router)# neighbor route-map Guard-in in

R7200(config-router)# no synchronization

R7200(config-router)# exit

R7200(config)# ip bgp-community new-format

R7200(config)# ip community-list expanded permit no-export

no-advertise

R7200(config)# route-map Guard-in permit 10

R7200(config-route-map)# match community exact match

R7200(config-route-map)# exit

R7200(config)# ip access-list standard routestoGuard

R7200(config-std-nacl)# deny any

 

 

Example：

R7200# show running-config

... ... ...

router bgp 100

bgp log-neighbor-changes

neighbor 192.168.8.8 remote-as 64555

neighbor 192.168.8.8 description Guard

neighbor 192.168.8.8 soft-reconfiguration inbound

neighbor 192.168.8.8 distribute-list routesToGuard out

neighbor 192.168.8.8 route-map Guard-in in

no synchronization

!

ip bgp-community new-format

ip community-list expanded Guard permit 100:64555 no-export no- advertise

!

route-map Guard-in permit 10

match community Guard exact match

ip access-list standard routesToGuard

 deny any