You are dual-homed to two ISPs. How do you make sure you never become a transit AS?
Show the answer
Say this first
By advertising only my own prefixes. eBGP advertises every best route to every eBGP peer by default, so
without a filter, routes learned from ISP1 go to ISP2, and ISP2 might start sending ISP1-bound traffic across my
links. I filter outbound on both sessions with a prefix list of my own space, and back it up with an AS path
filter that permits only ^$, meaning routes originated inside my AS.
Go deeper
ip prefix-list OUR-PREFIXES seq 5 permit 203.0.113.0/24
ip as-path access-list 1 permit ^$
!
router bgp 64500
neighbor 192.0.2.1 prefix-list OUR-PREFIXES out
neighbor 192.0.2.1 filter-list 1 out
neighbor 198.51.100.1 prefix-list OUR-PREFIXES out
neighbor 198.51.100.1 filter-list 1 outThe outbound filter list sees the path as it is in my table, before my own AS is added on the way out, so my
prefixes match ^$.
Verify
R1# show ip bgp neighbors 198.51.100.1 advertised-routes | begin Network
Network Next Hop Metric LocPrf Weight Path
*> 203.0.113.0 0.0.0.0 0 32768 i
Total number of prefixes 1A third layer
Tag everything learned from either ISP with NO_EXPORT inbound. Even a broken outbound filter would then not send those routes to another AS.
They will ask next
Why both a prefix list and an AS path filter?
Each catches mistakes the other misses. The prefix list stops anything that is not my space. The AS path filter stops routes learned from other ASes even if someone widens the prefix list by mistake.
Will the ISPs not filter me anyway?
They should, but not all do. Leaks by customers that providers accepted have caused major outages. Filter your side regardless.
Traps
- Writing
^$and applying it inbound. On a received route the path is never empty.