示例:使用 AS 路径正则表达式
自治系统 (AS) 路径是 BGP 使用的路由属性。AS 路径既用于路由选择,也用于防止潜在的路由环路。此示例说明如何使用带有 AS 路径号的正则表达式来定位一组路由。
要求
配置此示例之前,不需要除设备初始化之外的特殊配置。
概述
图 1 显示了通过外部 BGP (EBGP) 对等会话连接的多个 AS。每个设备都在其分配的地址空间内生成客户路由。
拓扑学
图 1 显示了示例网络。
![BGP 拓扑 AS 正则表达式](../../images/g041495.gif)
AS 64516 的管理员希望拒绝源自 AS 64513 和 AS 64514 的所有路由。在名为 reject-some-routes
的策略中创建并引用了两个 AS 路径正则表达式。orig-in-64513
orig-in-64514
然后,路由策略将作为导入策略应用到设备 R6 上。
#configuration488__policy-as-path-regex-st本节介绍设备 R2 和设备 R6 上的步骤。验证展示了如何将选项与设备 R2 上的命令一起使用aspath-regex
show route
,以使用正则表达式查找路由。
配置
CLI 快速配置
要快速配置此示例,请复制以下命令,将其粘贴到文本文件中,删除所有换行符,更改与您的网络配置匹配所需的任何详细信息,然后将命令复制并粘贴到层次结构级别的 CLI [edit]
中。
设备 R1
set interfaces fe-1/2/2 unit 0 description to-R2 set interfaces fe-1/2/2 unit 0 family inet address 10.2.0.2/30 set interfaces fe-1/2/3 unit 0 description to-R3 set interfaces fe-1/2/3 unit 0 family inet address 10.2.0.6/30 set interfaces fe-1/2/0 unit 0 description to-R5 set interfaces fe-1/2/0 unit 0 family inet address 10.0.0.2/30 set interfaces lo0 unit 0 family inet address 192.168.0.1/32 set protocols bgp export send-static set protocols bgp group 64512 type external set protocols bgp group 64512 peer-as 64512 set protocols bgp group 64512 neighbor 10.2.0.1 set protocols bgp group 64513 type external set protocols bgp group 64513 peer-as 64513 set protocols bgp group 64513 neighbor 10.2.0.5 set protocols bgp group 64515 type external set protocols bgp group 64515 peer-as 64515 set protocols bgp group 64515 neighbor 10.0.0.1 set policy-options policy-statement send-static term 1 from protocol static set policy-options policy-statement send-static term 1 then accept set routing-options static route 10.10.1.0/24 reject set routing-options static route 10.10.2.0/24 reject set routing-options static route 10.10.3.0/24 reject set routing-options autonomous-system 64511
设备 R2
set interfaces fe-1/2/2 unit 0 description to-R1 set interfaces fe-1/2/2 unit 0 family inet address 10.2.0.1/30 set interfaces lo0 unit 0 family inet address 192.168.0.2/32 set protocols bgp export send-static set protocols bgp group 64511 type external set protocols bgp group 64511 peer-as 64511 set protocols bgp group 64511 neighbor 10.2.0.2 set policy-options policy-statement send-static term 1 from protocol static set policy-options policy-statement send-static term 1 then accept set routing-options static route 10.20.1.0/24 reject set routing-options static route 10.20.2.0/24 reject set routing-options static route 10.20.3.0/24 reject set routing-options autonomous-system 64512
设备 R3
set interfaces fe-1/2/3 unit 0 description to-R1 set interfaces fe-1/2/3 unit 0 family inet address 10.2.0.5/30 set interfaces fe-1/2/2 unit 0 description to-R4 set interfaces fe-1/2/2 unit 0 family inet address 10.3.0.42/30 set interfaces lo0 unit 0 family inet address 192.168.0.3/32 set protocols bgp export send-static set protocols bgp group 64511 type external set protocols bgp group 64511 peer-as 64511 set protocols bgp group 64511 neighbor 10.2.0.6 set protocols bgp group 64514 type external set protocols bgp group 64514 peer-as 64514 set protocols bgp group 64514 neighbor 10.3.0.41 set policy-options policy-statement send-static term 1 from protocol static set policy-options policy-statement send-static term 1 then accept set routing-options static route 10.30.1.0/24 reject set routing-options static route 10.30.2.0/24 reject set routing-options static route 10.30.3.0/24 reject set routing-options autonomous-system 64513
设备 R4
set interfaces fe-1/2/2 unit 0 description to-R3 set interfaces fe-1/2/2 unit 0 family inet address 10.3.0.41/30 set interfaces lo0 unit 0 family inet address 192.168.0.4/32 set protocols bgp export send-static set protocols bgp group 64513 type external set protocols bgp group 64513 peer-as 64513 set protocols bgp group 64513 neighbor 10.3.0.42 set policy-options policy-statement send-static term 1 from protocol static set policy-options policy-statement send-static term 1 then accept set routing-options static route 10.40.1.0/24 reject set routing-options static route 10.40.2.0/24 reject set routing-options static route 10.40.3.0/24 reject set routing-options autonomous-system 64514
设备 R5
set interfaces fe-1/2/0 unit 0 description to-R1 set interfaces fe-1/2/0 unit 0 family inet address 10.0.0.1/30 set interfaces fe-1/2/1 unit 0 description to-R6 set interfaces fe-1/2/1 unit 0 family inet address 10.0.0.9/30 set interfaces lo0 unit 0 family inet address 192.168.0.5/32 set protocols bgp export send-static set protocols bgp group 64511 type external set protocols bgp group 64511 peer-as 64511 set protocols bgp group 64511 neighbor 10.0.0.2 set protocols bgp group 64516 type external set protocols bgp group 64516 peer-as 64516 set protocols bgp group 64516 neighbor 10.0.0.10 set policy-options policy-statement send-static term 1 from protocol static set policy-options policy-statement send-static term 1 then accept set routing-options static route 10.50.1.0/24 reject set routing-options static route 10.50.2.0/24 reject set routing-options static route 10.50.3.0/24 reject set routing-options autonomous-system 64515
设备 R6
set interfaces fe-1/2/1 unit 0 description to-R5 set interfaces fe-1/2/1 unit 0 family inet address 10.0.0.10/30 set interfaces lo0 unit 0 family inet address 192.168.0.6/32 set protocols bgp export send-static set protocols bgp group 64515 type external set protocols bgp group 64515 import reject-some-routes set protocols bgp group 64515 peer-as 64515 set protocols bgp group 64515 neighbor 10.0.0.9 set policy-options policy-statement send-static term 1 from protocol static set policy-options policy-statement send-static term 1 then accept set policy-options policy-statement reject-some-routes term find-routes from as-path orig-in-64513 set policy-options policy-statement reject-some-routes term find-routes from as-path orig-in-64514 set policy-options policy-statement reject-some-routes term find-routes then reject set policy-options as-path orig-in-64513 ".* 64513" set policy-options as-path orig-in-64514 ".* 64514" set routing-options static route 10.60.1.0/24 reject set routing-options static route 10.60.2.0/24 reject set routing-options static route 10.60.3.0/24 reject set routing-options autonomous-system 64516
程序
分步过程
以下示例要求您在配置层次结构中导航各个级别。有关导航 CLI 的信息,请参阅 在配置模式下使用 CLI 编辑器Junos OS CLI 用户指南。
要配置设备 R2:
配置设备接口。
[edit interfaces] user@R2# set fe-1/2/2 unit 0 description to-R1 user@R2# set fe-1/2/2 unit 0 family inet address 10.2.0.1/30 user@R2# set lo0 unit 0 family inet address 192.168.0.2/32
配置与设备 R1 的 EBGP 连接。
[edit protocols bgp] user@R2# set export send-static user@R2# set group 64511 type external user@R2# set group 64511 peer-as 64511 user@R2# set group 64511 neighbor 10.2.0.2
配置路由策略。
[edit policy-options policy-statement send-static term 1] user@R2# set from protocol static user@R2# set then accept
配置静态路由。
[edit routing-options static] user@R2# set route 10.20.1.0/24 reject user@R2# set route 10.20.2.0/24 reject user@R2# set route 10.20.3.0/24 reject
配置 AS 编号。
[edit routing-options] user@R2# set autonomous-system 64512
分步过程
以下示例要求您在配置层次结构中导航各个级别。有关导航 CLI 的信息,请参阅 在配置模式下使用 CLI 编辑器Junos OS CLI 用户指南。
要配置设备 R6:
配置设备接口。
[edit interfaces] user@R6# set fe-1/2/1 unit 0 description to-R5 user@R6# set fe-1/2/1 unit 0 family inet address 10.0.0.10/30 user@R6# set lo0 unit 0 family inet address 192.168.0.6/32
配置与设备 R5 的 EBGP 连接。
[edit protocols bgp] user@R6# set export send-static user@R6# set group 64515 type external user@R6# set group 64515 import reject-some-routes user@R6# set group 64515 peer-as 64515 user@R6# set group 64515 neighbor 10.0.0.9
配置发送静态路由的路由策略。
[edit policy-options policy-statement send-static term 1] user@R6# set from protocol static user@R6# set then accept
配置拒绝某些路由的路由策略。
[edit policy-options policy-statement reject-some-routes term find-routes] user@R6# set from as-path orig-in-64513 user@R6# set from as-path orig-in-64514 user@R6# set then reject [edit policy-options] user@R6# set as-path orig-in-64513 ".* 64513" user@R6# set as-path orig-in-64514 ".* 64514"
配置静态路由。
[edit routing-options static] user@R6# set route 10.60.1.0/24 reject user@R6# set route 10.60.2.0/24 reject user@R6# set route 10.60.3.0/24 reject
配置 AS 编号。
[edit routing-options] user@R6# set autonomous-system 64516
结果
在配置模式下,输入 show interfaces
、show protocols
、show policy-options
和 show routing-options
命令,以确认您的配置。如果输出未显示预期的配置,请重复此示例中的说明,以便进行更正。
设备 R2
user@R2# show interfaces fe-1/2/0 { unit 0 { description to-R1; family inet { address 10.2.0.1/30; } } } lo0 { unit 0 { family inet { address 192.168.0.2/32; } } }
user@R2# show protocols bgp { export send-static; group 64511 { type external; peer-as 64511; neighbor 10.2.0.2; } }
user@R2# show policy-options policy-statement send-static { term 1 { from protocol static; then accept; } }
user@R2# show routing-options static { route 10.20.1.0/24 reject; route 10.20.2.0/24 reject; route 10.20.3.0/24 reject; } autonomous-system 64512;
设备 R6
user@R6# show interfaces fe-1/2/0 { unit 0 { description to-R5; family inet { address 10.0.0.10/30; } } } lo0 { unit 0 { family inet { address 192.168.0.6/32; } } }
user@R6# show protocols bgp { export send-static; group 64515 { type external; import reject-some-routes; peer-as 64515; neighbor 10.0.0.9; } }
user@R6# show policy-options policy-statement reject-some-routes { term find-routes { from as-path [ orig-in-64513 orig-in-64514 ]; then reject; } } policy-statement send-static { term 1 { from protocol static; then accept; } } as-path orig-in-64513 ".* 64513"; as-path orig-in-64514 ".* 64514";
user@R6# show routing-options static { route 10.60.1.0/24 reject; route 10.60.2.0/24 reject; route 10.60.3.0/24 reject; } autonomous-system 64516;
如果完成设备配置,请从配置模式输入 commit
。
验证
确认配置工作正常。
在设备 R2 上查找路由
目的
在设备 R2 上,使用命令通过 show route aspath-regex
正则表达式定位路由。
操作
在 AS 64516 中查找由设备 R6 发起的路由。
user@R2> show route terse aspath-regex ".* 64516" inet.0: 21 destinations, 21 routes (21 active, 0 holddown, 0 hidden) + = Active Route, - = Last Active, * = Both A V Destination P Prf Metric 1 Metric 2 Next hop AS path * ? 10.60.1.0/24 B 170 100 64511 64515 64516 I unverified >10.2.0.2 * ? 10.60.2.0/24 B 170 100 64511 64515 64516 I unverified >10.2.0.2 * ? 10.60.3.0/24 B 170 100 64511 64515 64516 I unverified >10.2.0.2
查找源自 AS 64514 或 AS 64516 的路由。
user@R2> show route terse aspath-regex ".* (64514|64516)" inet.0: 21 destinations, 21 routes (21 active, 0 holddown, 0 hidden) + = Active Route, - = Last Active, * = Both A V Destination P Prf Metric 1 Metric 2 Next hop AS path * ? 10.40.1.0/24 B 170 100 64511 64513 64514 I unverified >10.2.0.2 * ? 10.40.2.0/24 B 170 100 64511 64513 64514 I unverified >10.2.0.2 * ? 10.40.3.0/24 B 170 100 64511 64513 64514 I unverified >10.2.0.2 * ? 10.60.1.0/24 B 170 100 64511 64515 64516 I unverified >10.2.0.2 * ? 10.60.2.0/24 B 170 100 64511 64515 64516 I unverified >10.2.0.2 * ? 10.60.3.0/24 B 170 100 64511 64515 64516 I unverified >10.2.0.2
查找使用 AS 64513 作为中转网络的路由。
user@R2> show route terse aspath-regex ".* 64513 .+" inet.0: 21 destinations, 21 routes (21 active, 0 holddown, 0 hidden) + = Active Route, - = Last Active, * = Both A V Destination P Prf Metric 1 Metric 2 Next hop AS path * ? 10.40.1.0/24 B 170 100 64511 64513 64514 I unverified >10.2.0.2 * ? 10.40.2.0/24 B 170 100 64511 64513 64514 I unverified >10.2.0.2 * ? 10.40.3.0/24 B 170 100 64511 64513 64514 I unverified
意义
输出显示与指定的 AS 路径正则表达式匹配的路由表条目。
确保在设备 R6 上排除路由
目的
在设备 R6 上,使用命令确保 show route and show route hidden
从设备 R6 的路由表中排除源自 AS 64513 和 AS 64514 的路由。
操作
user@R6> show route 10.30.0/22 inet.0: 21 destinations, 21 routes (15 active, 0 holddown, 6 hidden)
user@R6> show route 10.40.0/22 inet.0: 21 destinations, 21 routes (15 active, 0 holddown, 6 hidden)
user@R6> show route hidden inet.0: 21 destinations, 21 routes (15 active, 0 holddown, 6 hidden) + = Active Route, - = Last Active, * = Both 10.30.1.0/24 [BGP ] 02:24:47, localpref 100 AS path: 64515 64511 64513 I, validation-state: unverified > to 10.0.0.9 via fe-1/2/1.0 10.30.2.0/24 [BGP ] 02:24:47, localpref 100 AS path: 64515 64511 64513 I, validation-state: unverified > to 10.0.0.9 via fe-1/2/1.0 10.30.3.0/24 [BGP ] 02:24:47, localpref 100 AS path: 64515 64511 64513 I, validation-state: unverified > to 10.0.0.9 via fe-1/2/1.0 10.40.1.0/24 [BGP ] 02:24:47, localpref 100 AS path: 64515 64511 64513 64514 I, validation-state: unverified > to 10.0.0.9 via fe-1/2/1.0 10.40.2.0/24 [BGP ] 02:24:47, localpref 100 AS path: 64515 64511 64513 64514 I, validation-state: unverified > to 10.0.0.9 via fe-1/2/1.0 10.40.3.0/24 [BGP ] 02:24:47, localpref 100 AS path: 64515 64511 64513 64514 I, validation-state: unverified > to 10.0.0.9 via fe-1/2/1.0
意义
输出显示设备 R6 上的 10.30.0/22 和 10.40.0/22 路由被拒绝。