no-validate
Syntax
no-validate policy-name;
Hierarchy Level
[edit protocols bgp group group-name family (inet | inet flow)], [edit protocols bgp group group-name neighbor address family (inet | inet flow)], [edit routing-instances routing-instance-name protocols bgp group group-name family (inet | inet flow)], [edit routing-instances routing-instance-name protocols bgp group group-name neighbor address family (inet | inet flow)]
Description
When BGP is carrying flow-specification network
layer reachability information (NLRI) messages, the no-validate statement omits the flow route validation procedure after packets
are accepted by a policy.
The receiving BGP-enabled device accepts a flow route if it passes the following criteria:
The originator of a flow route matches the originator of the best match unicast route for the destination address that is embedded in the route.
There are no more specific unicast routes, when compared to the destination address of the flow route, for which the active route has been received from a different next-hop autonomous system.
The first criterion ensures that the filter is being advertised by the next-hop used by unicast forwarding for the destination address embedded in the flow route. For example, if a flow route is given as 10.1.1.1, proto=6, port=80, the receiving BGP-enabled device selects the more specific unicast route in the unicast routing table that matches the destination prefix 10.1.1.1/32. On a unicast routing table containing 10.1/16 and 10.1.1/24, the latter is chosen as the unicast route to compare against. Only the active unicast route entry is considered. This follows the concept that a flow route is valid if advertised by the originator of the best unicast route.
The second criterion addresses situations in which a given address block is allocated to different entities. Flows that resolve to a best-match unicast route that is an aggregate route are only accepted if they do not cover more specific routes that are being routed to different next-hop autonomous systems.
You can bypass the validation process and use your own specific
import policy. To disable the validation procedure and use an import
policy instead, include the no-validate statement in the
configuration.
Flow routes configured for VPNs with family inet-vpn are not automatically validated, so the no-validate statement
is not supported at the [edit protocols bgp group group-name family inet-vpn] hierarchy level. No validation is needed
if the flow routes are configured locally between devices in a single
AS.
Options
policy-name—Import policy to match NLRI messages.
Required Privilege Level
routing—To view this statement in the configuration.
routing-control—To add this statement to the configuration.
Release Information
Statement introduced before Junos OS Release 7.4.