topic How to remove one BGP-RIB Out in General Topics

How to remove one BGP-RIB Out

Sethupathi — Fri, 07 Feb 2020 09:55:14 GMT

Hi,

We've configured BGP between Paloalto to Azure by using EBGP. The bgp is established but in RIB Out noticed that prefix 0.0.0.0/0 advertised to the peer respective azure.

How to remove this, because due to this the users in bgp unable to access the internet.

If I enable the "reject default route" option does this help? or cause any problem with all other bgp connections?

can anyone help & give your valuable suggestion here.

Regards,

Sethupathi M

Re: How to remove one BGP-RIB Out

OtakarKlier — Fri, 07 Feb 2020 16:52:55 GMT

Hello,

This should work for you as it till not accept the default route advertised by the peer:

"Select to ignore any default routes that are advertised by BGP peers."

You can always open a TAC case to ask. While I'm not a BGP expert, I used OSPF quite extensively and have this option set on my PAN's that are boarder devices.

Regards,

Re: How to remove one BGP-RIB Out

rmfalconer — Tue, 11 Feb 2020 16:07:57 GMT

Do you have any import and/or export filters for BGP? Using filters is a pretty standard way to control prefix advertisement and learning.

Re: How to remove one BGP-RIB Out

aleksandar.astardzhiev — Wed, 12 Feb 2020 12:56:20 GMT

Hi @Sethupathi,

1. The "reject default route" from your screenshot is doing the opposite to what you want. This option will force the firewall to reject default route received by any BGP peer. To answer how it will affect your setup depends entirely of that how your firewall is receiving the default route (does it receive it via BGP or by other way static, ospf, etc). To answer will it solve your issue - definitely no. This option is to reject receiving default and you are trying to block advertisement (to specific peer)

2. The proper way to select/filter what you advertise to BGP peers is the Export rules. It is impotent to notice the following - from this document (which is not exactly what you need, but doesn't matter)

There is an implicit deny rule that is triggered once any rules are created in the export or import tabs (the same is true for OSPF export). Add an allow rule to make sure you are importing other prefixes. The Import tab should now appear like the following: