Wanguard 6.2 User Guide
Appendix 4 – Network Integration Guideline for Wanguard Filter
Wanguard needs to connect to bgpd through the public IP of the server (even if the connection will be make
from the server itself, using the WANsupervisor service and the WANbgp package). This is why the “-A 127.0.0.1”,
used for binding bgpd to the loopback interface, must be deleted.
To be able to start the bgpd service, create a basic configuration file. Setting a passwo rd for the bgpd
daemon is usually enough to get it started. You should replace “bgppass” with your own password.
[root@localhost ~]# echo 'password
bgppass
' > /etc/quagga/bgpd.conf
[root@localhost ~]# chown quagga /etc/quagga/bgpd.conf
[root@localhost ~]# service bgpd start
→
on Red Hat or CentOS systems
[root@localhost ~]# service quagga start
→
on Debian or Ubuntu systems
It is a good idea to tighten the security of the bgpd daemon. Connect to the bgp daemon with telnet on
localhost port 2605 (default bgpd port) with the previously-defined password (“bgppass”). Issue the following
commands and replace “enablepass” with your own configuration-mode password.
[root@localhost ~]# telnet 127.0.0.1 2605
localhost> enable
localhost# config terminal
localhost(config)# service password-encryption
localhost(config)# enable password
enablepass
localhost(config)# write
Configure routing on BGPd using the commands shown in the following example. Please note that you can
use the prefix-list, route-map, or distribute-list method for filtering outgoing routing information about the router.
To have a uniform approach, the following example uses route-maps. Optionally, BGP authentication can be
configured to increase security and avoid any illegal BGP announcement which may lead to a security breach.
localhost(config)# router bgp
<Wanguard-Filter-AS-number>
localhost(config-router)# bgp router-id
<Wanguard-Filter-IP-address>
localhost(config-router)# neighbor
<Router-IP-address>
remote-as
<Router-AS-number>
localhost(config-router)# neighbor
<Router-IP-address>
description
<description>
localhost(config-router)# neighbor
<Router-IP-address>
password <
BGP MD5 password
>
localhost(config-router)# neighbor
<Router-IP-address>
route-map
Wanguard-Filter-in
in
localhost(config-router)# neighbor
<Router-IP-address>
route-map
Wanguard-Filter-out
out
localhost(config-router)# exit
localhost(config)# route-map
Wanguard-Filter-in
deny 10
localhost(config-route-map)# exit
localhost(config)# route-map
Wanguard-Filter-out
permit 10
localhost(config-route-map)# set community
no-advertise
<Wanguard-Filter-community>
localhost(config-route-map)# exit
localhost(config)# write
localhost(config)# exit
To display the router configuration, enter the
show running-config
command from the “enable” command
level. In the following example, the router's AS number is 1000, and the BGPd AS number is 65000.
The following partial sample output is displayed:
localhost# show running-config
... skipped ...
- 115 -
Summary of Contents for wanguard 6.2
Page 1: ......
