Next-Generation Firewall
Configure a BGP Filtering Profile
Table of Contents
Configure a BGP Filtering Profile
Simultaneously apply multiple filters to a BGP peer group
or peer.
Contact your account team to enable Cloud Management for NGFWs using
Strata Cloud Manager.
| Where Can I Use This? | What Do I Need? |
|---|---|
|
One of these:
|
Configure a BGP filtering profile to apply multiple filters to a BGP peer group or to an
individual BGP peer. A BGP filtering profile allows you to:
- Accept routes that came from a specific AS Path (based on the AS Path access list).
- Advertise routes that have a specific AS Path (based on the AS Path access list).
- Accept routes to the local BGP RIB based on either a distribute list or prefix list (not both in the same filtering profile). A distribute list is based on source IP address with wildcard mask to get a prefix range. A prefix list is based on network address/prefix length.
- Advertise routes from the local BGP RIB based on a distribute list or prefix list (not both in the same filtering profile).
- Accept routes that meet the route map attribute criteria into the local BGP RIB, and optionally set attributes.
- Advertise routes that meet the route map attribute criteria, and optionally set attributes.
- Conditionally advertise routes that exist (satisfy exist criteria).
- Conditionally advertise routes other than those that meet criteria (satisfy nonexist criteria).
- Unsuppress dampened or summarized routes.
- Log in to Strata Cloud Manager.Select and select the Configuration Scope where you want to configure a BGP filtering profile for a BGP configuration.You can select a folder or firewall from your Folders or select Snippets to configure a BGP filtering profile for a BGP configuration in a snippet.Configure Routing Profiles.Advanced routing filters are required to populate the filter settings when you configure a BGP filtering profile.For Filtering Profiles, Add Profile.Enter a Name for the profile.The name must start with an alphanumeric character, underscore (_), or hyphen (-), and can contain a combination of alphanumeric characters, underscore, or hyphen. No dot (.) or space is supported.Select Unicast or Multicast.Both Unicast and Multicast can be configured.For the Inbound Filter List, select an AS Path access list to specify that, when receiving routes from peers, only routes with the same AS Path are imported from the peer group or peer and added to the local BGP RIB.For the Outbound Filter List, select an AS Path access list to specify that only routes with the same AS Path are advertised to a peer router.For the Unsuppressed Map, select a route map of routes that you don’t want to suppress.For example, because the routes were summarized and therefore suppressed.Configure the Network Filters settings.
- For the Inbound Distribute List, select an access list to filter BGP routing information that BGP receives.This list is mutually exclusive with the Inbound Prefix List in a BGP filtering profile.For the Inbound Prefix List, select a prefix list to filter BGP routing information that BGP receives based on the network prefix.This list is mutually exclusive with the Inbound Distribute List in a BGP filtering profile.For the Inbound Route Maps, select a route map to have additional control over which routes are allowed into the local BGP RIB and to set attributes for the routes.For example, you can add an inbound route map to control route preference by prepending an AS to the AS Path of the route.If an Inbound Route Map, along with an Inbound Distribute List or Inbound Prefix List, are both configured, the conditions of both the route map and the list must be met.For the Outbound Distribute List, select an access list to filter BGP routing information that BGP advertises based on the IP address of the destination.This list is mutually exclusive with the Outbound Prefix List in a BGP filtering profile.For the Outbound Prefix List, select a prefix list to filter BGP routing information that BGP advertises based on the network prefix.This list is mutually exclusive with the Outbound Distribute List in a BGP filtering profile.For the Outbound Route Maps, select a route map to have additional control over which routes BGP advertises and to set attributes for advertised routes.If an Outbound Route Map, along with an Outbound Distribute List or Outbound Prefix List, are both configured, the conditions of both the route map and the list must be met.Configure the Conditional Advertisement settings.This allows you to control what route to advertise in the event that a different route does exist or doesn’t exist in the local BGP RIB. A route not existing in the local BGP RIB can indicate a peering or reachability failure. Conditional advertisements are useful in cases where you want to try to force routes to one AS over another, such as when you have links to the internet through multiple ISPs and you want traffic to be routed to one provider instead of another, except when there’s a loss of connectivity to the preferred provider.
- For the Exist Map, select a route map to specify the match criteria for the conditional advertisement.Only the Match portion of the route map is considered the Set portion is ignored.For the Advertise Map, select a route map to specify the routes to advertise in the event the condition is met.Only the Match portion of the route map is considered the Set portion is ignored.For the Non-Exist Map, select a route map to specify the match criteria for which routes don’t exist in the local BGP RIB to conditionally advertise.Only the Match portion of the route map is considered the Set portion is ignored.For the Advertise List, select the route map to specify routes to advertise when the routes in the Non-Exist Map aren’t in the local BGP RIB.Only the Match portion of the route map is considered the Set portion is ignored.Save.
