A session with another network is a trust relationship, and mistakes cross it. A neighbour can send you far too many routes, a stranger can spoof packets to your BGP port, and your own AS number can appear in a path you need to accept.
Advanced · 13 min read
You'll learn to configure maximum-prefix, ttl-security, allowas-in and as-override, and explain what each one protects or fixes.
Three problems, three tools
A BGP configuration that works is not necessarily safe. This lesson covers the settings that stop a neighbour from overwhelming you, stop an outsider from reaching your session, and handle the special case where loop prevention rejects a route you want.
The safeguards in this lesson
On small screens, swipe sideways or focus the diagram and use the arrow keys.
The first two protect your router. The last two work around loop prevention for a specific design.
maximum-prefix: a limit on what a neighbour can send
What maximum-prefix does as the count grows
On small screens, swipe sideways or focus the diagram and use the arrow keys.
The warning threshold gives you time to react before the session closes. A restart interval brings the session back on its own after a set number of minutes, which suits a neighbour that might recover.
A customer who leaks the full internet table to you can fill your routing table and memory in seconds. A prefix limit makes the session fail before that happens. You set the number, an optional warning percentage and what to do on the breach.
R1. Logs a warning at 80 percent of 1000 prefixes and closes the session when the limit is passed. The default warning threshold is 75 percent.
What the router does as prefixes arrive
On small screens, swipe sideways or focus the diagram and use the arrow keys.
After the Cease, the state shows Idle (PfxCt) until cleared or restarted.
Illustrative Cisco IOS XE output written for this lesson, not a router capture
R1#show ip bgp summary
Neighbor V AS MsgRcvd MsgSent TblVer InQ OutQ Up/Down State/PfxRcd
192.0.2.1 4 64501 1120 310 42 0 0 00:00:12 Idle (PfxCt)
Idle (PfxCt) means the session was shut because the prefix count exceeded the limit. Fix the neighbour first, then clear ip bgp 192.0.2.1, or configure restart 5 to retry after five minutes automatically.
Choose how strict to be
On small screens, swipe sideways or focus the diagram and use the arrow keys.
warning-only is useful while you measure a neighbour. Enforcement is the safe default for customers.
ttl-security: only directly connected neighbours
How TTL security tells a neighbour from an attacker
On small screens, swipe sideways or focus the diagram and use the arrow keys.
An attacker cannot make a packet arrive with a higher TTL than it was sent with. That is why checking the arriving TTL proves the sender is within the configured number of hops.
BGP runs over TCP port 179, so anyone who can send packets to your router can try to disturb the session. Normally eBGP packets are sent with a TTL of 1 because the peer is next door. The Generalized TTL Security Mechanism (GTSM, RFC 5082) turns that around: both sides send with a TTL of 255 and each discards anything that arrives with a lower value. A packet from a host several hops away cannot reach 255 on arrival, so it is dropped before BGP sees it.
How GTSM filters packets
On small screens, swipe sideways or focus the diagram and use the arrow keys.
An attacker can set any TTL on a packet, but cannot make it higher than 255 minus the hops it crosses.
R1. Both routers must be configured. hops 1 means the peer must be directly connected. A larger value allows a peer that many hops away.
When your own AS is in the path
Loop prevention rejects any route whose AS path already contains the AS number of the router receiving it. That is right on the internet. It is a problem when one customer uses the same AS number at two sites that connect through a provider.
Why Site 2 rejects a route from Site 1
On small screens, swipe sideways or focus the diagram and use the arrow keys.
Loop prevention cannot tell a real loop from two sites that share an AS number. allowas-in on Site 2, or as-override on the provider, resolves it.
Site 1 advertises a prefix. The provider passes it to Site 2 with the path 64501 64500, and Site 2, which is also AS 64500, sees its own number and drops the route. Two ways to solve this:
Fix it on the receiver or on the sender
On small screens, swipe sideways or focus the diagram and use the arrow keys.
Use as-override when you control the provider side. Use allowas-in when you control only the customer router.
A customer leaks 400000 routes to a router that has maximum-prefix 1000 80 configured with no other options. What does the session do?
Predict · scenario 2
You configure ttl-security hops 1 on R1 only. What is the likely result?
Predict · scenario 3
Two sites share AS 64500 through a provider. Site 2 drops routes from Site 1. Which provider-side setting fixes this?
FAQ
What happens when maximum-prefix is exceeded?
By default the router sends a Cease NOTIFICATION and closes the session. It stays down until you clear it, unless you configured a restart interval, or warning-only to log without closing.
Can I use ttl-security with ebgp-multihop?
No. They are mutually exclusive. ttl-security hops N already allows a peer up to N hops away.
What is the difference between allowas-in and as-override?
allowas-in is configured on the receiver and accepts routes that contain its own AS. as-override is configured on the sender and replaces the receiver's AS in the path, so the route is never rejected.