Wanguard 6.2 User Guide
Appendix 4 – Network Integration Guideline for Wanguard Filter
router
. The guidelines provided in this section apply to the BGP configuration on any router from which
Filter
diverts traffic.
To simplify, the following examples are provided using eBGP (external BGPv4). This solution is not limited to
eBGP, iBGP may be considered as well, depending on existing network setup, case in which “
set nexthop-self
” feature
might be required.
The steps below have to be followed:
1. Configure BGPd on
Filter
with an easily recognizable autonomous system number. This can be a private
ASN for eBGP (e.g. ASN16bit 64512-65534) or your own public ASN in case you are using iBGP. The BGPd
sends routing information only when it diverts traffic. This route appears in the router's routing tables.
Using a recognizable value allows you to easily identify the
redirect-prefixes
in the router's routing
tables.
2. Configure additional precaution measures to prevent any undesirable routing behavior:
a. Configure
Filter
to not accept any prefix/advertisements from
Divert-from
router
b. Configure
Divert-from
router
to not advertise any prefix towards
Filter
c. Configure
Divert-from
router
to accept only redirect-prefixes from
Filter
(e.g. /32 prefixes)
d. Configure
Filter
to advertise the redirect-prefixes with well-known community
no-advertise
– this
would prevent redirect-prefixes/announcements to be propagated to other peers through BGP. The
no-export
community might be used in case redirect-prefix has to be advertised to additional
routers, or Route-Reflectors are used in-between
Filter
and
Divert-from
router. Both communities
will prevent BGP-redirect-announcements to be advertised towards upstream providers. However,
as a good practice is to mark this announcement with a dedicated BGP community to distinguish
between redirect and black hole announcements.
3. To ease the troubleshooting process, you may consider the
soft-reconfiguration inbound
command on
Divert-from
-
router
during the setup procedures.
Quagga bgpd Configuration
Wanguard is capable of sending and withdrawing BGP announcements to the BGPd daemon provided by the
Quagga routing software suite (
).
After installing Quagga, you will have to do few distribution-specific configuration changes:
On Red Hat or CentOS systems, edit /etc/sysconfig/quagga and replace
BGPD_OPTS="-A 127.0.0.1"
with
BGPD_OPTS=""
.
[root@localhost ~]# nano /etc/sysconfig/quagga
→
on Red Hat or CentOS systems
On Debian or Ubuntu systems, edit /etc/quagga/daemons and replace
bgpd=no
with
bgpd=yes
. Edit
/etc/quagga/debian.conf and replace
bgpd_options=" --daemon -A 127.0.0.1"
w i t h
bgpd_options="
--daemon"
.
[root@localhost ~]# nano /etc/quagga/daemons
→
on Debian or Ubuntu systems
[root@localhost ~]# nano /etc/quagga/debian.conf
→
on Debian or Ubuntu systems
- 114 -
Summary of Contents for wanguard 6.2
Page 1: ......
