BGPD.CONF(5)              OpenBSD Programmer's Manual             BGPD.CONF(5)

NAME
     bgpd.conf - Border Gateway Protocol daemon configuration file

DESCRIPTION
     The bgpd daemon implements the Border Gateway Protocol version 4 as de-
     scribed in RFC 1771.

SECTIONS
     The bgpd.conf config file is divided into four main sections.

     Macros
           User-defined variables may be defined and used later, simplifying
           the configuration file.

     Global configuration
           Global settings for the bgpd daemon.

     Neighbors and Groups
           bgpd establishes sessions with neighbors.  The neighbor definition
           and properties are set in this section, as well as grouping neigh-
           bors for the ease of configuration.

     Filter
           Filter rules for incoming and outgoing UPDATES.

     With the exception of macros the sections should be grouped and appear in
     bgpd.conf in the order shown above.

MACROS
     Much like cpp(1) or m4(1), macros can be defined that will later be ex-
     panded in context.  Macro names must start with a letter, and may contain
     letters, digits and underscores.  Macro names may not be reserved words
     (for example AS, neighbor, group).  Macros are not expanded inside
     quotes.

     For example,

           c7206="1.2.3.4"
           neighbor $c7206 {
                   remote-as 65001
           }

GLOBAL CONFIGURATION
     There are quite a few settings that affect the operation of the bgpd dae-
     mon globally.

     AS        Set the local Autonomous System number.  The AS numbers are as-
               signed by local RIRs, such as
               RIPE   for Europe,
               ARIN   for America and
               APNIC  for the Asian-Pacific region.

               For example,

                     AS 65001

               sets the local AS to 65001.

     dump      bgpd is capable of dumping the RIB, aka the Routing Information
               Base and all bgp messages in mrt format.  Dumping the RIB is
               normally an expensive operation, but it should not influence
               the session handling.  Dumping too often may result in a slow
               update speed.

               This will dump all 300 seconds of the RIB table to the
               strftime(3) expanded filename.  The timeout is optional.

                     dump table "/tmp/rib-dump-%H%M" 300

               Similar to the table dump but this time all bgp messages and
               state transitions are dumped to the specified file:

                     dump all in "/tmp/all-in-%H%M" 300

               As before, but only the UPDATE messages are dumped to the file:

                     dump updates in "/tmp/updates-in-%H%M" 300

               It is also possible to dump outgoing messages:

                     dump all out "/tmp/all-out-%H%M" 300

               or

                     dump updates out "/tmp/updates-out-%H%M" 300

     fib-update
               If set to no, do not update the Forward Information Base aka
               the kernel routing table.  The default is yes.

     holdtime  Sets the holdtime in seconds.  The holdtime is reset to its
               initial value every time either a KEEPALIVE or an UPDATE mes-
               sage is received from the neighbor.  If the holdtime expires
               the session is dropped.  The default is 90 seconds.  Neighbor-
               ing systems negotiate the holdtime used when the connection is
               established in the OPEN messages.  Each neighbor announces its
               configured holdtime, the smaller one is then agreed on.

     holdtime min
               The minimal accepted holdtime in seconds.  Must be greater or
               equal to 3.

     listen on
               Specify the local IP address the bgpd daemon should listen on.

                     listen on 127.0.0.1

     log updates
               Log received and sent updates.

     network   Announce the specified network as belonging to our AS.

                     network 192.168.7.0/24

               It is possible to set default AS path attributes per network
               statement:

                     network 192.168.7.0/24 set localpref 220

               See also the ATTRIBUTE SET section.

     route-collector
               If set to yes, the route selection process is turned off.  The
               default is no.

     router-id
               Set the router id to the given IP address which must be local
               to the machine.

                     router-id 10.0.0.1

               If not given the bgp id is determined as the biggest IP address
               assigned to the local machine.

NEIGHBORS AND GROUPS
     bgpd establishes TCP connections to other BGP speakers, called neighbors.
     Each neighbor is specified by a neighbor section, specifying properties
     for that neighbor:

           neighbor 10.0.0.2 {
                   remote-as 65002
                   descr "a neighbor"
           }

     Multiple neighbors can be grouped together by a group section.  Each
     neighbor statement within the group section inherits all properties from
     the group section.

           group "peering AS65002" {
                   remote-as 65002
                   neighbor 10.0.0.2 {
                           descr "AS65002-p1"
                   }
                   neighbor 10.0.0.3 {
                           descr "AS65002-p2"
                   }
           }

     There are several neighbor properties:

     announce  If set to none, no UPDATE messages will be sent to the neigh-
               bor.  If set to all, all generated UPDATE messages will be sent
               to the neighbor.  This is usually used for transit AS's and
               IBGP peers.  The default value for EBGP peers is self which
               limits the sent UPDATE messages to announcements of the local
               AS.  The default for IBGP peers is all.

     descr     Add a description.  The description is used when logging neigh-
               bor events and in status reports etc and has no further meaning
               to bgpd.

     dump      Do a peer specific mrt dump.  Peer specific dumps are limited
               to all and updates.  See also the dump section in GLOBAL
               CONFIGURATION.

     enforce neighbor-AS
               If set to yes, AS paths whose leftmost AS is not equal to the
               remote AS of the neighbor are rejected and a NOTIFICATION is
               sent back.  The default value for IBGP peers is no otherwise
               the default is yes.

     holdtime  Set the holdtime in seconds.  Inherited from the global config-
               uration if not given.

     holdtime min
               Set the minimal acceptable holdtime.  Inherited from the global
               configuration if not given.

     local-address
               When bgpd initiates the TCP connection to the neighbor system,
               it normally does not bind to a specific IP address.  If a lo-
               cal-address is given it binds to this address before.

     max-prefix
               Limit amount of prefixes received.  No such limit is imposed by
               default.

     multihop  Neighbors not in the same AS as the local bgpd normally have to
               be directly connected to the local machine.  If this is not the
               case, the multihop statement defines the maximum hops the
               neighbor may be away.

     passive   Do not attempt to actively open a TCP connection to the neigh-
               bor system.

     remote-as
               Set the AS number of the remote system.

     set       Set the AS path attributes to some default per neighbor or
               group statement:

                     set localpref 300

               See also the ATTRIBUTE SET section.

     tcp md5sig
               Enable TCP MD5 signatures per RFC 2385.  The shared secret can
               either be given as a password or hexadecimal key.

                     tcp md5sig password mekmidasdigoat
                     tcp md5sig key deadbeef

FILTER
     bgpd has the ability to allow and deny UPDATES based on prefix or AS path
     attributes.  In addition, UPDATES may also be modified by filter rules.

     For each UPDATE processed by the filter, the filter rules are evaluated
     in sequential order, from first to last.  The last matching allow or deny
     rule decides what action is taken.

     The following actions can be used in the filter:

     deny      The UPDATE is blocked.

     allow     The UPDATE is passed.

     match     Apply the filter attribute set without influencing the filter
               decision.

PARAMETERS
     The rule parameters specify the UPDATES to which a rule applies.  An
     UPDATE always comes from, or goes to, one neighbor.  Most parameters are
     optional.  If a parameter is specified, the rule only applies to packets
     with matching attributes.

     quick     If an UPDATE matches a rule which has the quick option set,
               this rule is considered the last matching rule, and evaluation
               of subsequent rules is skipped.

     from or to
               This rule applies to incoming or outgoing UPDATES.  Either one
               or the other must be specified.

     any

     <address>

     group <descr>
               This rule applies only to UPDATES comming from, or going to,
               this particular neighbor.  Neighbors can be matched against
               their address, the group description, or the token any can be
               used to match any neighbor.

     prefix <address>/<len>
               This rule applies only to UPDATES for the specified prefix.

     prefixlen <desc>
               This rule applies only to UPDATES for prefixes where the pre-
               fixlen matches.  Prefix length ranges are specified by using
               these operators:

                     =       (equal)
                     !=      (unequal)
                     <       (less than)
                     <=      (less than or equal)
                     >       (greater than)
                     >=      (greater than or equal)
                     -       (range including boundaries)
                     ><      (except range)

               >< and - are binary operators (they take two arguments).  For
               instance:

               prefixlen 8-12
                           means `all prefix lengths >= 8 and <= 12', hence
                           the CIDR netmasks 8, 9, 10, 11 and 12.

               prefixlen 8><12
                           means `all prefix lengths < 8 and > 12', hence the
                           CIDR netmasks 0-7 and 13-32.

               prefixlen can be used together with prefix.

               This will match all prefixes in the 10.0.0.0/8 netblock with
               netmasks longer than 16:

                     prefix 10.0.0.0/8 prefixlen > 16

     <astype> <asnum>
               This rule applies only to UPDATES where the AS path matches.
               The <asnum> is matched against a part of the AS path specified
               by the <astype>.  <astype> is one of the following operators:

                     AS              (any part)
                     source-AS       (rightmost AS number)
                     transit-AS      (all but the rightmost AS number)

     community <as>:<num>
               This rule applies only to UPDATES where the community path at-
               tribute is present and matches.  Both <as> and <num> may be set
               to `*' to do an ``anymatch''.

     set       All matching rules can set the AS path attributes to some de-
               fault.  The set of every matching rule is applied, not only the
               last matching one.  See also the following section.

ATTRIBUTE SET
     AS path attributes can be modified with set.

     set can be used on network statements, in neighbor or group blocks and on
     filter rules.  Attribute sets can be expressed as list.

     The following attributes can be modified:

     localpref
               Set the LOCAL_PREF AS path attribute.

     med       Set the MULTI_EXIT_DISC AS path attribute.

     nexthop   Set the NEXTHOP AS path attribute to a different nexthop ad-
               dress.

     prepend-self
               Prepend the local AS multiple times to the AS path.

FILES
     /etc/bgpd.conf  bgpd.conf configuration file.

SEE ALSO
     strftime(3), tcp(4), bgpd(8)

HISTORY
     The bgpd.conf file format first appeared in OpenBSD 3.5.

OpenBSD 3.5                     March 10, 2004                               6
