I don't like how a lot of things got pushed into the global configuration
section in bgpd.conf.5 especially since some bits should be their own
sections. I see this for example for sets and for network statements.
My proposal is to add two new sections which gives us the following
structure:
Macros
Global Configuration
Set Configuration
Network Announcements
MPLS VPN Configuration
Neighbors and Groups
Filter
This allows also to write a bit more about sets and network statements
which is in my opinion a good thing. This is not perfect but IMO better
and a starting point for making this page even better.
--
:wq Claudio
Index: bgpd.conf.5
===================================================================
RCS file: /cvs/src/usr.sbin/bgpd/bgpd.conf.5,v
retrieving revision 1.179
diff -u -p -r1.179 bgpd.conf.5
--- bgpd.conf.5 3 Oct 2018 06:57:36 -0000 1.179
+++ bgpd.conf.5 3 Oct 2018 13:56:48 -0000
@@ -38,6 +38,12 @@ configuration file.
.It Sy Global Configuration
Global settings for
.Xr bgpd 8 .
+.It Sy Set Configuration
+The definition of various lookup tables are done in this section.
+.It Sy Network Announcements
+Networks which should be announced by
+.Xr bgpd 8
+are set in this section.
.It Sy MPLS VPN Configuration
The definition and properties for BGP MPLS VPNs are set in this section.
.It Sy Neighbors and Groups
@@ -144,19 +150,6 @@ or as a large number (ASPLAIN format), f
AS 196618
.Ed
.Pp
-.It Xo
-.Ic as-set Ar name
-.Ic { Ar as-number ... Ic }
-.Xc
-An
-.Ic as-set
-holds a collection of AS numbers and can be used with the AS specific
-parameter in
-.Sx FILTER
-rules.
-Lookups against as-sets are more efficient than a large number of rules
-which differ only in the AS number.
-.Pp
.It Ic connect-retry Ar seconds
Set the number of seconds before retrying to open a connection.
This timer should be sufficiently large in EBGP configurations.
@@ -267,73 +260,6 @@ listen on 127.0.0.1
Log received and sent updates.
.Pp
.It Xo
-.Ic network
-.Ar address Ns Li / Ns Ar prefix
-.Op Ic set ...\&
-.Xc
-.It Xo
-.Ic network
-.Pq Ic inet Ns | Ns Ic inet6
-.Ic static Op Ic set ...\&
-.Xc
-.It Xo
-.Ic network
-.Pq Ic inet Ns | Ns Ic inet6
-.Ic connected Op Ic set ...\&
-.Xc
-.It Xo
-.Ic network
-.Pq Ic inet Ns | Ns Ic inet6
-.Ic rtlabel Ar label Op Ic set ...\&
-.Xc
-.It Xo
-.Ic network
-.Pq Ic inet Ns | Ns Ic inet6
-.Ic priority Ar number Op Ic set ...\&
-.Xc
-.It Xo
-.Ic network prefix-set
-.Ar name
-.Op Ic set ...\&
-.Xc
-Announce the specified network as belonging to our AS.
-If set to
-.Ic connected ,
-routes to directly attached networks will be announced.
-If set to
-.Ic static ,
-all static routes will be announced.
-If set to
-.Ic rtlabel ,
-routes with the specified
-.Ar label
-will be announced.
-If set to
-.Ic priority ,
-routes with the specified
-.Ar priority
-will be announced.
-If a prefix-set
-.Ar name
-is specified, all networks in the prefix-set will be announced.
-.Bd -literal -offset indent
-network 192.168.7.0/24
-.Ed
-.Pp
-It is possible to set default
-.Em AS path attributes
-per
-.Ic network
-statement:
-.Bd -literal -offset indent
-network 192.168.7.0/24 set localpref 220
-.Ed
-.Pp
-See also the
-.Sx ATTRIBUTE SET
-section.
-.Pp
-.It Xo
.Ic nexthop
.Ic qualify
.Ic via
@@ -351,42 +277,6 @@ daemons like
.Xr ospfd 8 .
.Pp
.It Xo
-.Ic prefix-set Ar name
-.Ic { Ar address Ns Li / Ns Ar len ... Ic }
-.Xc
-A
-.Ic prefix-set
-holds a collection of prefixes and can be used in place
-of the
-.Ic prefix
-parameter in
-.Sx FILTER
-rules.
-.\" XXX not implemented
-.\" and
-.\".Ic network
-.\" statements.
-Lookups against prefix-sets are more efficient than a large number of rules
-which differ only in prefix.
-.Pp
-A prefix can be followed by the prefixlen operators listed for the
-.Ic prefix
-parameter in the
-.Sx PARAMETERS
-section.
-.Pp
-The first example creates a set of prefixes called
-.Dq private ,
-to hold a number of RFC 1918 private network blocks.
-The second example shows the use of prefixlen operators.
-.Bd -literal -offset indent
-prefix-set private { 10.0.0.0/8, 172.16.0.0/12,
- 192.168.0.0/16, fc00::/7 }
-prefix-set as64496set { 192.0.2.0/24 prefixlen >= 26,
- 2001:db8::/32 or-longer }
-.Ed
-.Pp
-.It Xo
.Ic rde
.Ic med
.Ic compare
@@ -445,21 +335,6 @@ The default is
.Ic ignore .
.Pp
.It Xo
-.Ic roa-set
-.Ic { Ar address Ns Li / Ns Ar len Ic maxlen Ar len Ic source-as Ar asn ... Ic
}
-.Xc
-An
-.Ic roa-set
-holds a collection of Validated ROA Payloads (VRP).
-Each received prefix is checked against the
-.Ic roa-set
-and the Origin Validation State (OVS) is set.
-.Bd -literal -offset indent
-roa-set { 192.0.2.0/24 maxlen 24 source-as 64511
- 203.0.113.0/24 source-as 64496 }
-.Ed
-.Pp
-.It Xo
.Ic route-collector
.Pq Ic yes Ns | Ns Ic no
.Xc
@@ -516,6 +391,171 @@ to EBGP neighbors are not prepended with
The default is
.Ic no .
.El
+.Sh SET CONFIGURATION
+.Xr bgpd 8
+supports sets for looking up collections in an efficent way.
+.Ic as-set ,
+.Ic prefix-set ,
+and
+.Ic origin-set
+are used to lookup AS numbers, prefixes and prefixes/source-as pairs
+respectively.
+See also the
+.Sx FILTER
+section on how these sets are used in filters.
+One single
+.Ic roa-set
+can be defined which will be used to validate the origin of each prefix
+against.
+The set collections can span multiple lines and an optional comma is allowed
+between elements.
+.Pp
+.Bl -tag -width Ds -compact
+.It Xo
+.Ic as-set Ar name
+.Ic { Ar as-number ... Ic }
+.Xc
+An
+.Ic as-set
+holds a collection of AS numbers and can be used with the AS specific
+parameter in
+.Sx FILTER
+rules.
+Lookups against as-sets are more efficient than a large number of rules
+which differ only in the AS number.
+.Pp
+.It Xo
+.Ic origin-set Ar name
+.Ic { Ar address Ns Li / Ns Ar len Ic maxlen Ar mlen Ic source-as Ar asn ...
Ic }
+.Xc
+An
+.Ic origin-set
+holds a collection of prefix/source-as pairs and can be used in place
+where a rules filter for source-as and prefix at the same time.
+.Bd -literal -offset indent
+origin-set private { 10.0.0.0/8 maxlen 24 source-as 64511
+ 203.0.113.0/24 source-as 64496 }
+.Ed
+.Pp
+.It Xo
+.Ic prefix-set Ar name
+.Ic { Ar address Ns Li / Ns Ar len ... Ic }
+.Xc
+A
+.Ic prefix-set
+holds a collection of prefixes and can be used in place
+of the
+.Ic prefix
+parameter in
+.Sx FILTER
+rules and
+.Ic network
+statements.
+Lookups against prefix-sets are more efficient than a large number of rules
+which differ only in prefix.
+.Pp
+A prefix can be followed by the prefixlen operators listed for the
+.Ic prefix
+parameter in the
+.Sx PARAMETERS
+section.
+.Pp
+The first example creates a set of prefixes called
+.Dq private ,
+to hold a number of RFC 1918 private network blocks.
+The second example shows the use of prefixlen operators.
+.Bd -literal -offset indent
+prefix-set private { 10.0.0.0/8, 172.16.0.0/12,
+ 192.168.0.0/16, fc00::/7 }
+prefix-set as64496set { 192.0.2.0/24 prefixlen >= 26,
+ 2001:db8::/32 or-longer }
+.Ed
+.Pp
+.It Xo
+.Ic roa-set
+.Ic { Ar address Ns Li / Ns Ar len Ic maxlen Ar mlen Ic source-as Ar asn ...
Ic }
+.Xc
+An
+.Ic roa-set
+holds a collection of Validated ROA Payloads (VRP).
+Each received prefix is checked against the
+.Ic roa-set
+and the Origin Validation State (OVS) is set.
+.Bd -literal -offset indent
+roa-set { 192.0.2.0/24 maxlen 24 source-as 64511
+ 203.0.113.0/24 source-as 64496 }
+.Ed
+.El
+.Sh NETWORK ANNOUNCEMENTS
+To announce a specific network as belonging to our AS a
+.Ic network
+statement is used.
+By default
+.Xr bgpd 8
+will not announce anything.
+Filter rules need to be in place to allow announcement of the right prefixes
+to each neighbor.
+.Pp
+.Bl -tag -width Ds -compact
+.It Xo
+.Ic network
+.Ar address Ns Li / Ns Ar prefix
+.Op Ic set ...\&
+.Xc
+Announce the specified prefix as belonging to our AS.
+.Pp
+.It Xo
+.Ic network
+.Pq Ic inet Ns | Ns Ic inet6
+.Ic connected Op Ic set ...\&
+.Xc
+Announce routes to directly attached networks.
+.Ar priority .
+.Pp
+.It Xo
+.Ic network prefix-set
+.Ar name
+.Op Ic set ...\&
+.Xc
+All networks in the prefix-set
+.Ar name
+will be announced.
+.Pp
+.It Xo
+.Ic network
+.Pq Ic inet Ns | Ns Ic inet6
+.Ic priority Ar number Op Ic set ...\&
+.Xc
+Announce routes with the specified
+.Pp
+.It Xo
+.Ic network
+.Pq Ic inet Ns | Ns Ic inet6
+.Ic rtlabel Ar label Op Ic set ...\&
+.Xc
+Announce routes with the specified
+.Ar label .
+.Pp
+.It Xo
+.Ic network
+.Pq Ic inet Ns | Ns Ic inet6
+.Ic static Op Ic set ...\&
+.Xc
+Announce all static routes.
+.El
+.Pp
+It is possible to set default
+.Em AS path attributes
+per
+.Ic network
+statement:
+.Bd -literal -offset indent
+network 192.168.7.0/24 set localpref 220
+.Ed
+.Pp
+See also the
+.Sx ATTRIBUTE SET
+section.
.Sh MPLS VPN CONFIGURATION
.Xr bgpd 8
supports the setup and distribution of Virtual Private Networks.
@@ -1402,6 +1442,12 @@ in which case the nexthop is compared ag
Nexthop filtering is not supported on locally announced networks and one must
take into consideration previous rules overwriting nexthops.
.Pp
+.It Ic origin-set Ar name
+This rule applies only to
+.Em UPDATES
+that match the given origin-set
+.Ar name .
+.Pp
.It Xo
.Ic ovs
.Pq Ic valid | not-found | invalid
@@ -1413,6 +1459,7 @@ where the Origin Validation State (OVS)
.It Ic prefix Ar address Ns Li / Ns Ar len
.It Ic prefix Ar address Ns Li / Ns Ar len Ic prefixlen Ar range
.It Ic prefix Ar address Ns Li / Ns Ar len Ic or-longer
+.It Ic prefix Ar address Ns Li / Ns Ar len Ic maxlen Ar mlen
This rule applies only to
.Em UPDATES
for the specified prefix.
@@ -1469,7 +1516,13 @@ prefix 10.0.0.0/8 prefixlen > 16
.Ic or-longer
is a shorthand for:
.Bd -literal -offset indent
-.Ic prefix Ar address Ns Li / Ns Ar len Ic prexiflen Ic >= Ar len
+.Ic prefix Ar address Ns Li / Ns Ar len Ic prefixlen Ic >= Ar len
+.Ed
+.Pp
+.Ic maxlen Ar mlen
+is a shorthand for:
+.Bd -literal -offset indent
+.Ic prefix Ar address Ns Li / Ns Ar len Ic prefixlen Ic <= Ar mlen
.Ed
.Pp
.It Ic prefix-set Ar name Op Ic or-longer
@@ -1483,7 +1536,7 @@ the
.Em UPDATES
will match any prefix in the prefix-set where
.Bd -literal -offset indent
-.Ic address Ns Li / Ns Ar len Ic prexiflen Ic >= Ar len
+.Ic address Ns Li / Ns Ar len Ic prefixlen Ic >= Ar len
.Ed
.Pp
.It Ic quick
