What does maximum-prefix do, and how do you choose the value?
Show the answer
Say this first
neighbor x maximum-prefix N [threshold] [restart minutes | warning-only] caps how many prefixes I accept from
a peer. At the threshold percentage, 75 by default, it logs a warning. Above N it sends a NOTIFICATION (Cease,
maximum number of prefixes reached) and holds the session down until someone clears it or the restart timer
fires. It protects the router from a leak or a fat-fingered config at the peer. I set it from what I expect
plus headroom, and alert on the warning.
Go deeper
Sizing
| Peer | Expected | Reasonable limit |
|---|---|---|
| Customer with one /24 | 1 | 10 |
| ISP sending default plus partial | 800 | 2000 |
| ISP sending a full IPv4 table | about 1,000,000 | Comfortably above the table, reviewed as it grows |
The full-table case bites people: the internet grows, the limit does not, and one day every full-table session drops at once.
What it looks like when it trips
R1# show ip bgp summary | begin Neighbor
Neighbor V AS MsgRcvd MsgSent TblVer InQ OutQ Up/Down State/PfxRcd
192.0.2.1 4 64496 1520 233 0 0 0 00:01:12 Idle (PfxCt)
198.51.100.1 4 64497 8211 7998 3120 0 0 5d02h 1874The syslog shows %BGP-4-MAXPFX at the warning threshold and %BGP-3-MAXPFXEXCEED when the limit is crossed.
router bgp 64500
neighbor 192.0.2.1 maximum-prefix 2000 80 restart 15They will ask next
warning-only or restart?
On customer sessions at a provider, hard limits with a restart timer. On your own upstreams many teams use a hard limit too, because a leak toward you is exactly the case to stop.
warning-onlysuits peers where dropping the session is worse than the risk.It tripped. What do you do?
Do not just raise the number. Find out why the peer sent more: a leak, a new customer, a normal growth step. Then fix the cause or the limit, and clear the session.
Traps
- Setting a full-table limit once and never revisiting it.