close
keyboard_arrow_left
Table of Contents
- play_arrow Configuring Firewall Filters
- play_arrow Understanding How Firewall Filters Protect Your Network
- Firewall Filters Overview
- Router Data Flow Overview
- Stateless Firewall Filter Overview
- Understanding How to Use Standard Firewall Filters
- Understanding How Firewall Filters Control Packet Flows
- Stateless Firewall Filter Components
- Stateless Firewall Filter Application Points
- How Standard Firewall Filters Evaluate Packets
- Understanding Firewall Filter Fast Lookup Filter
- Understanding Egress Firewall Filters with PVLANs
- Selective Class-based Filtering on PTX Routers
- Guidelines for Configuring Firewall Filters
- Guidelines for Applying Standard Firewall Filters
- Supported Standards for Filtering
- Monitoring Firewall Filter Traffic
- Troubleshooting Firewall Filters
- play_arrow Firewall Filter Match Conditions and Actions
- Overview of Firewall Filters (OCX Series)
- Overview of Firewall Filter Profiles on ACX Series Routers (Junos OS Evolved)
- Understanding Firewall Filter Match Conditions
- Understanding Firewall Filter Planning
- Understanding How Firewall Filters Are Evaluated
- Understanding Firewall Filter Match Conditions
- Firewall Filter Flexible Match Conditions
- Firewall Filter Nonterminating Actions
- Firewall Filter Terminating Actions
- Firewall Filter Match Conditions and Actions (ACX Series Routers)
- Firewall Filter Match Conditions and Actions in ACX Series Routers (Junos OS Evolved)
- Firewall Filter Match Conditions for Protocol-Independent Traffic
- Firewall Filter Match Conditions for IPv4 Traffic
- Firewall Filter Match Conditions for IPv6 Traffic
- Firewall Filter Match Conditions Based on Numbers or Text Aliases
- Firewall Filter Match Conditions Based on Bit-Field Values
- Firewall Filter Match Conditions Based on Address Fields
- Firewall Filter Match Conditions Based on Address Classes
- Understanding IP-Based Filtering and Selective Port Mirroring of MPLS Traffic
- Firewall Filter Match Conditions for MPLS Traffic
- Firewall Filter Match Conditions for MPLS-Tagged IPv4 or IPv6 Traffic
- Firewall Filter Match Conditions for VPLS Traffic
- Firewall Filter Match Conditions for Layer 2 CCC Traffic
- Firewall Filter Match Conditions for Layer 2 Bridging Traffic
- Firewall Filter Support on Loopback Interface
- play_arrow Applying Firewall Filters to Routing Engine Traffic
- Configuring Logical Units on the Loopback Interface for Routing Instances in Layer 3 VPNs
- Example: Configuring a Filter to Limit TCP Access to a Port Based On a Prefix List
- Example: Configuring a Stateless Firewall Filter to Accept Traffic from Trusted Sources
- Example: Configure a Filter to Block Telnet and SSH Access
- Example: Configuring a Filter to Block TFTP Access
- Example: Configuring a Filter to Accept Packets Based on IPv6 TCP Flags
- Example: Configuring a Filter to Block TCP Access to a Port Except from Specified BGP Peers
- Example: Configuring a Stateless Firewall Filter to Protect Against TCP and ICMP Floods
- Example: Protecting the Routing Engine with a Packets-Per-Second Rate Limiting Filter
- Example: Configuring a Filter to Exclude DHCPv6 and ICMPv6 Control Traffic for LAC Subscriber
- Port Number Requirements for DHCP Firewall Filters
- Example: Configuring a DHCP Firewall Filter to Protect the Routing Engine
- play_arrow Applying Firewall Filters to Transit Traffic
- Example: Configuring a Filter for Use as an Ingress Queuing Filter
- Example: Configuring a Filter to Match on IPv6 Flags
- Example: Configuring a Filter to Match on Port and Protocol Fields
- Example: Configuring a Filter to Count Accepted and Rejected Packets
- Example: Configuring a Filter to Count and Discard IP Options Packets
- Example: Configuring a Filter to Count IP Options Packets
- Example: Configuring a Filter to Count and Sample Accepted Packets
- Example: Configuring a Filter to Set the DSCP Bit to Zero
- Example: Configuring a Filter to Set the DSCP Bit to Zero
- Example: Configuring a Filter to Match on Two Unrelated Criteria
- Example: Configuring a Filter to Accept DHCP Packets Based on Address
- Example: Configuring a Filter to Accept OSPF Packets from a Prefix
- Example: Configuring a Stateless Firewall Filter to Handle Fragments
- Configuring a Firewall Filter to Prevent or Allow IPv4 Packet Fragmentation
- Configuring a Firewall Filter to Discard Ingress IPv6 Packets with a Mobility Extension Header
- Example: Configuring an Egress Filter Based on IPv6 Source or Destination IP Addresses
- Example: Configuring a Rate-Limiting Filter Based on Destination Class
- play_arrow Configuring Firewall Filters in Logical Systems
- Firewall Filters in Logical Systems Overview
- Guidelines for Configuring and Applying Firewall Filters in Logical Systems
- References from a Firewall Filter in a Logical System to Subordinate Objects
- References from a Firewall Filter in a Logical System to Nonfirewall Objects
- References from a Nonfirewall Object in a Logical System to a Firewall Filter
- Example: Configuring Filter-Based Forwarding
- Example: Configuring Filter-Based Forwarding on Logical Systems
- Example: Configuring a Stateless Firewall Filter to Protect a Logical System Against ICMP Floods
- Example: Configuring a Stateless Firewall Filter to Protect a Logical System Against ICMP Floods
- Unsupported Firewall Filter Statements for Logical Systems
- Unsupported Actions for Firewall Filters in Logical Systems
- Filter-Based Forwarding for Routing Instances
- Forwarding Table Filters for Routing Instances on ACX Series Routers
- Configuring Forwarding Table Filters
- play_arrow Configuring Firewall Filter Accounting and Logging
- play_arrow Attaching Multiple Firewall Filters to a Single Interface
- Applying Firewall Filters to Interfaces
- Configuring Firewall Filters
- Multifield Classifier Example: Configuring Multifield Classification
- Multifield Classifier for Ingress Queuing on MX Series Routers with MPC
- Assigning Multifield Classifiers in Firewall Filters to Specify Packet-Forwarding Behavior (CLI Procedure)
- Understanding Multiple Firewall Filters in a Nested Configuration
- Guidelines for Nesting References to Multiple Firewall Filters
- Understanding Multiple Firewall Filters Applied as a List
- Guidelines for Applying Multiple Firewall Filters as a List
- Example: Applying Lists of Multiple Firewall Filters
- Example: Nesting References to Multiple Firewall Filters
- Example: Filtering Packets Received on an Interface Set
- play_arrow Attaching a Single Firewall Filter to Multiple Interfaces
- Interface-Specific Firewall Filter Instances Overview
- Interface-Specific Firewall Filter Instances Overview
- Filtering Packets Received on a Set of Interface Groups Overview
- Filtering Packets Received on an Interface Set Overview
- Example: Configuring Interface-Specific Firewall Filter Counters
- Example: Configuring a Stateless Firewall Filter on an Interface Group
- play_arrow Configuring Filter-Based Tunneling Across IP Networks
- Understanding Filter-Based Tunneling Across IPv4 Networks
- Firewall Filter-Based L2TP Tunneling in IPv4 Networks Overview
- Interfaces That Support Filter-Based Tunneling Across IPv4 Networks
- Components of Filter-Based Tunneling Across IPv4 Networks
- Example: Transporting IPv6 Traffic Across IPv4 Using Filter-Based Tunneling
- play_arrow Configuring Service Filters
- Service Filter Overview
- How Service Filters Evaluate Packets
- Guidelines for Configuring Service Filters
- Guidelines for Applying Service Filters
- Example: Configuring and Applying Service Filters
- Service Filter Match Conditions for IPv4 or IPv6 Traffic
- Service Filter Nonterminating Actions
- Service Filter Terminating Actions
- play_arrow Configuring Simple Filters
- play_arrow Configuring Layer 2 Firewall Filters
- Understanding Firewall Filters Used to Control Traffic Within Bridge Domains and VPLS Instances
- Example: Configuring Filtering of Frames by MAC Address
- Example: Configuring Filtering of Frames by IEEE 802.1p Bits
- Example: Configuring Filtering of Frames by Packet Loss Priority
- Example: Configuring Policing and Marking of Traffic Entering a VPLS Core
- Understanding Firewall Filters on OVSDB-Managed Interfaces
- Example: Applying a Firewall Filter to OVSDB-Managed Interfaces
- play_arrow Configuring Firewall Filters for Forwarding, Fragments, and Policing
- Filter-Based Forwarding Overview
- Firewall Filters That Handle Fragmented Packets Overview
- Stateless Firewall Filters That Reference Policers Overview
- Example: Configuring Filter-Based Forwarding on the Source Address
- Example: Configuring Filter-Based Forwarding to a Specific Outgoing Interface or Destination IP Address
- play_arrow Configuring Firewall Filters (EX Series Switches)
- Firewall Filters for EX Series Switches Overview
- Understanding Planning of Firewall Filters
- Understanding Firewall Filter Match Conditions
- Understanding How Firewall Filters Control Packet Flows
- Understanding How Firewall Filters Are Evaluated
- Understanding Firewall Filter Processing Points for Bridged and Routed Packets on EX Series Switches
- Firewall Filter Match Conditions, Actions, and Action Modifiers for EX Series Switches
- Platform Support for Firewall Filter Match Conditions, Actions, and Action Modifiers on EX Series Switches
- Support for Match Conditions and Actions for Loopback Firewall Filters on Switches
- Configuring Firewall Filters (CLI Procedure)
- Understanding How Firewall Filters Test a Packet's Protocol
- Understanding Filter-Based Forwarding for EX Series Switches
- Example: Configuring Firewall Filters for Port, VLAN, and Router Traffic on EX Series Switches
- Example: Configuring a Firewall Filter on a Management Interface on an EX Series Switch
- Example: Using Filter-Based Forwarding to Route Application Traffic to a Security Device
- Example: Applying Firewall Filters to Multiple Supplicants on Interfaces Enabled for 802.1X or MAC RADIUS Authentication
- Verifying That Policers Are Operational
- Troubleshooting Firewall Filters
- play_arrow Configuring Firewall Filters (QFX Series Switches, EX4600 Switches, PTX Series Routers)
- Overview of Firewall Filters (QFX Series)
- Understanding Firewall Filter Planning
- Planning the Number of Firewall Filters to Create
- Firewall Filter Match Conditions and Actions (QFX and EX Series Switches)
- Firewall Filter Match Conditions and Actions (QFX10000 Switches)
- Firewall Filter Match Conditions and Actions (PTX Series Routers)
- Firewall and Policing Differences Between PTX Series Packet Transport Routers and T Series Matrix Routers
- Configuring Firewall Filters
- Applying Firewall Filters to Interfaces
- Overview of MPLS Firewall Filters on Loopback Interface
- Configuring MPLS Firewall Filters and Policers on Switches
- Configuring MPLS Firewall Filters and Policers on Routers
- Configuring MPLS Firewall Filters and Policers
- Understanding How a Firewall Filter Tests a Protocol
- Understanding Firewall Filter Processing Points for Bridged and Routed Packets
- Understanding Filter-Based Forwarding
- Example: Using Filter-Based Forwarding to Route Application Traffic to a Security Device
- Configuring a Firewall Filter to De-Encapsulate GRE or IPIP Traffic
- Verifying That Firewall Filters Are Operational
- Monitoring Firewall Filter Traffic
- Troubleshooting Firewall Filter Configuration
- play_arrow Configuring Firewall Filter Accounting and Logging (EX9200 Switches)
-
- play_arrow Configuring Traffic Policers
- play_arrow Understanding Traffic Policers
- Policer Implementation Overview
- ARP Policer Overview
- Example: Configuring ARP Policer
- Understanding the Benefits of Policers and Token Bucket Algorithms
- Determining Proper Burst Size for Traffic Policers
- Controlling Network Access Using Traffic Policing Overview
- Traffic Policer Types
- Order of Policer and Firewall Filter Operations
- Understanding the Frame Length for Policing Packets
- Supported Standards for Policing
- Hierarchical Policer Configuration Overview
- Understanding Enhanced Hierarchical Policers
- Packets-Per-Second (pps)-Based Policer Overview
- Guidelines for Applying Traffic Policers
- Policer Support for Aggregated Ethernet Interfaces Overview
- Example: Configuring a Physical Interface Policer for Aggregate Traffic at a Physical Interface
- Firewall and Policing Differences Between PTX Series Packet Transport Routers and T Series Matrix Routers
- Hierarchical Policers on ACX Series Routers Overview
- Guidelines for Configuring Hierarchical Policers on ACX Series Routers
- Hierarchical Policer Modes on ACX Series Routers
- Processing of Hierarchical Policers on ACX Series Routers
- Actions Performed for Hierarchical Policers on ACX Series Routers
- Configuring Aggregate Parent and Child Policers on ACX Series Routers
- play_arrow Configuring Policer Rate Limits and Actions
- play_arrow Configuring Layer 2 Policers
- Hierarchical Policers
- Configuring a Policer Overhead
- Two-Color and Three-Color Policers at Layer 2
- Layer 2 Traffic Policing at the Pseudowire Overview
- Configuring a Two-Color Layer 2 Policer for the Pseudowire
- Configuring a Three-Color Layer 2 Policer for the Pseudowire
- Applying the Policers to Dynamic Profile Interfaces
- Attaching Dynamic Profiles to Routing Instances
- Using Variables for Layer 2 Traffic Policing at the Pseudowire Overview
- Configuring a Policer for the Complex Configuration
- Creating a Dynamic Profile for the Complex Configuration
- Attaching Dynamic Profiles to Routing Instances for the Complex Configuration
- Verifying Layer 2 Traffic Policers on VPLS Connections
- Understanding Policers on OVSDB-Managed Interfaces
- Example: Applying a Policer to OVSDB-Managed Interfaces
- play_arrow Configuring Two-Color and Three-Color Traffic Policers at Layer 3
- Two-Color Policer Configuration Overview
- Basic Single-Rate Two-Color Policers
- Bandwidth Policers
- Prefix-Specific Counting and Policing Actions
- Policer Overhead to Account for Rate Shaping in the Traffic Manager
- Three-Color Policer Configuration Overview
- Applying Policers
- Three-Color Policer Configuration Guidelines
- Basic Single-Rate Three-Color Policers
- Basic Two-Rate Three-Color Policers
- Example: Configuring a Two-Rate Three-Color Policer
- play_arrow Configuring Logical and Physical Interface Traffic Policers at Layer 3
- play_arrow Configuring Policers on Switches
- Overview of Policers
- Traffic Policer Types
- Understanding the Use of Policers in Firewall Filters
- Understanding Tricolor Marking Architecture
- Configuring Policers to Control Traffic Rates (CLI Procedure)
- Configuring Tricolor Marking Policers
- Understanding Policers with Link Aggregation Groups
- Understanding Color-Blind Mode for Single-Rate Tricolor Marking
- Understanding Color-Aware Mode for Single-Rate Tricolor Marking
- Understanding Color-Blind Mode for Two-Rate Tricolor Marking
- Understanding Color-Aware Mode for Two-Rate Tricolor Marking
- Example: Using Two-Color Policers and Prefix Lists
- Example: Using Policers to Manage Oversubscription
- Assigning Forwarding Classes and Loss Priority
- Configuring Color-Blind Egress Policers for Medium-Low PLP
- Configuring Two-Color and Three-Color Policers to Control Traffic Rates
- Verifying That Two-Color Policers Are Operational
- Verifying That Three-Color Policers Are Operational
- Troubleshooting Policer Configuration
- Troubleshooting Policer Configuration
-
- play_arrow Configuration Statements and Operational Commands
- play_arrow Troubleshooting
- play_arrow Knowledge Base
-
list Table of Contents
ON THIS PAGE
Example: Configuring the Priority for Route Prefixes in the RPD Infrastructure
date_range
24-Nov-23
This example shows how to configure priority for route prefixes in the RPD infrastructure for the OSPF, LDP, and BGP protocols.
Requirements
This example uses the following hardware and software components:
Three routers in a combination of ACX Series, M Series, MX Series, PTX Series, and T Series.
Junos OS Release 16.1 or later running on all devices.
Before you begin:
Configure the device interfaces.
Configure the following protocols:
BGP
MPLS
OSPF
LDP
Overview
In a network with a large number of routes, it is sometimes
important to control the order in which routes get updated for better
convergence and to provide differentiated services. Prefix prioritization
helps users to prioritize certain routes/prefixes over others and
have control over the order in which routes get updated in the RIB
(routing table) and the FIB (forwarding table). In Junos OS Release
16.1 and later, you can control the order in which the routes get
updated from LDP/OSPF to rpd and rpd to kernel. You can specify a
priority of high or low through the existing
import policy in the protocols. In the event of a topology change,
high priority prefixes are updated in the routing table first, followed
by low priority prefixes. In general, routes that are not explicitly
assigned a priority are treated as medium priority. Within the same
priority level, routes will continue to be updated in lexicographic
order.
In this example, the routing device is in area 0.0.0.0, with interface ge-1/3/0 connected to the neighboring device. You configure three import routing policies: next-hop-self, ospf-prio, and prio_for_bgp. The routing policy next-hop-self accepts routes from BGP. For the OSPF routing policy, routes matching 172.16.25.3/32 are installed first because they have a priority of high. LDP imports routes from OSPF. For BGP prioritization, routes matching 172.16.50.1/32 are installed first because they have a priority of high. Routes associated with these prefixes are installed in the routing table in the order of the specified priority of the prefix.
Topology
Figure 1 shows the sample topology.
Figure 1: Priority for Route Prefixes in
the rpd Infrastructure
Configuration
CLI Quick Configuration
To quickly configure this example, copy the
following commands, paste them into a text file, remove any line breaks,
change any details necessary to match your network configuration,
copy and paste the commands into the CLI at the [edit] hierarchy level, and then enter commit from the configuration
mode.
R1
content_copy zoom_out_map
set interfaces ge-1/3/0 unit 0 family inet address 172.16.12.1/24 set interfaces ge-1/3/0 unit 0 family mpls set interfaces lo0 unit 0 family inet address 172.16.25.1/32 set protocols mpls interface ge-1/3/0.0 set protocols bgp group prio_internal type internal set protocols bgp group prio_internal local-address 172.16.25.1 set protocols bgp group prio_internal import prio_for_bgp set protocols bgp group prio_internal neighbor 172.16.25.3 family inet unicast set protocols bgp group prio_internal neighbor 172.16.25.3 export next-hop-self sset protocols ospf import ospf_prio set protocols ospf area 0.0.0.0 interface ge-1/3/0.0 set protocols ospf area 0.0.0.0 interface lo0.0 passive set protocols ldp interface ge-1/3/0.0 set protocols ldp interface lo0.0 set policy-options policy-statement next-hop-self term nhself from protocol bgp set policy-options policy-statement next-hop-self term nhself then next-hop self set policy-options policy-statement next-hop-self term nhself then accept set policy-options policy-statement ospf_prio term ospf_ldp from protocol ospf set policy-options policy-statement ospf_prio term ospf_ldp from route-filter 172.16.25.3/32 exact set policy-options policy-statement ospf_prio term ospf_ldp then priority high set policy-options policy-statement ospf_prio term ospf_ldp then accept set policy-options policy-statement prio_for_bgp term bgp_prio from protocol bgp set policy-options policy-statement prio_for_bgp term bgp_prio from route-filter 172.16.50.1/32 exact set policy-options policy-statement prio_for_bgp term bgp_prio then priority high set routing-options nonstop-routing set routing-options router-id 172.16.25.1 set routing-options autonomous-system 2525
R2
content_copy zoom_out_map
set interfaces ge-1/0/5 unit 0 family inet address 172.16.12.2/24 set interfaces ge-1/0/5 unit 0 family mpls set interfaces ge-1/3/0 unit 0 family inet address 172.16.23.2/24 set interfaces ge-1/3/0 unit 0 family mpls set interfaces lo0 unit 0 family inet address 172.16.25.2/32 set protocols mpls interface ge-1/0/5.0 set protocols mpls interface ge-1/3/0.0 set protocols ospf area 0.0.0.0 interface lo0.0 passive set protocols ospf area 0.0.0.0 interface ge-1/0/5.0 set protocols ospf area 0.0.0.0 interface ge-1/3/0.0 set protocols ldp interface ge-1/0/5.0 set protocols ldp interface ge-1/3/0.0 set protocols ldp interface lo0.0 set routing-options nonstop-routing set routing-options router-id 172.16.25.2 set routing-options autonomous-system 2525
R3
content_copy zoom_out_map
set interfaces ge-1/0/1 unit 0 family inet address 172.16.23.3/24 set interfaces ge-1/0/1 unit 0 family mpls set interfaces lo0 unit 0 family inet address 172.16.25.3/32 set protocols mpls interface ge-1/0/1.0 set protocols bgp group prio_internal type internal set protocols bgp group prio_internal local-address 172.16.25.3 set protocols bgp group prio_internal neighbor 172.16.25.1 family inet unicast set protocols bgp group prio_internal neighbor 172.16.25.1 export next-hop-self set protocols bgp group prio_internal neighbor 172.16.25.1 export static_to_bgp set protocols ospf area 0.0.0.0 interface lo0.0 passive set protocols ospf area 0.0.0.0 interface ge-1/0/1.0 set protocols ldp interface ge-1/0/1.0 set protocols ldp interface lo0.0 set policy-options policy-statement next-hop-self term nhself from protocol bgp set policy-options policy-statement next-hop-self term nhself then next-hop self set policy-options policy-statement next-hop-self term nhself then accept set policy-options policy-statement static_to_bgp term s_to_b from protocol static set policy-options policy-statement static_to_bgp term s_to_b from route-filter 172.16.50.1/32 exact set policy-options policy-statement static_to_bgp term s_to_b from route-filter 172.16.50.2/32 exact set policy-options policy-statement static_to_bgp term s_to_b then accept set routing-options nonstop-routing set routing-options static route 172.16.50.1/32 receive set routing-options static route 172.16.50.2/32 receive set routing-options router-id 172.16.25.3 set routing-options autonomous-system 2525
Configuring Device R1
Step-by-Step Procedure
The following example requires that you navigate various levels in the configuration hierarchy. For information about navigating the CLI, see Use the CLI Editor in Configuration Mode in the CLI User Guide.
To configure Device R1:
Configure the interfaces.
content_copy zoom_out_map[edit interfaces]user@R1# set interfaces ge-1/3/0 unit 0 family inet address 172.16.12.1/24 user@R1# set interfaces ge-1/3/0 unit 0 family mpls user@R1# set interfaces lo0 unit 0 family inet address 172.16.25.1/32Assign the loopback address to the device.
content_copy zoom_out_map[edit lo0 unit 0 family]user@R1# set address 172.16.25.1/32Configure MPLS.
content_copy zoom_out_map[edit protocols]user@R1# set protocols mpls interface ge-1/3/0.0Configure the router ID and autonomous system of Router R1.
content_copy zoom_out_map[edit routing-options]user@R1# set router-id 172.16.7.7 user@R1# set autonomous-system 100Enable OSPF on the interfaces of Router R1.
content_copy zoom_out_map[edit protocols]user@R1# set protocols ospf import ospf_prio user@R1# set protocols ospf area 0.0.0.0 interface ge-1/3/0.0 user@R1# set protocols ospf area 0.0.0.0 interface lo0.0 passiveConfigure LDP protocols on the interfaces.
content_copy zoom_out_map[edit protocols]user@R1# set protocols ldp interface ge-1/3/0.0 user@R1# set protocols ldp interface lo0.0Configure BGP.
content_copy zoom_out_map[edit protocols]user@R1# set protocols bgp group prio_internal type internal user@R1# set protocols bgp group prio_internal local-address 172.16.25.1 user@R1# set protocols bgp group prio_internal import prio_for_bgp user@R1# set protocols bgp group prio_internal neighbor 172.16.25.3 family inet unicast user@R1# set protocols bgp group prio_internal neighbor 172.16.25.3 export next-hop-selfConfigure the policy options to prioritize the routes. The policy next-hop-self accepts routes from BGP. You configure three import routing policies: next-hop-self, ospf-prio, and prio_for_bgp. The routing policy next-hop-self accepts routes from BGP. For the ospf-prio routing policy, routes matching 172.16.25.3/32 are installed first because they have a priority of high. LDP imports routes from OSPF. For prio_for_bgp policy, routes matching 172.16.50.1/32 are installed first because they have a priority of high.
content_copy zoom_out_map[edit policy-options policy-statement]user@R1# set policy-options policy-statement next-hop-self term nhself from protocol bgp user@R1# set policy-options policy-statement next-hop-self term nhself then next-hop self user@R1# set policy-options policy-statement next-hop-self term nhself then accept user@R1# set policy-options policy-statement ospf_prio term ospf_ldp from protocol ospf user@R1# set policy-options policy-statement ospf_prio term ospf_ldp from route-filter 172.16.25.3/32 exact set policy-options policy-statement ospf_prio term ospf_ldp then priority high set policy-options policy-statement ospf_prio term ospf_ldp then accept set policy-options policy-statement prio_for_bgp term bgp_prio from protocol bgp set policy-options policy-statement prio_for_bgp term bgp_prio from route-filter 172.16.50.1/32 exact set policy-options policy-statement prio_for_bgp term bgp_prio then priority high
Results
From configuration mode, confirm your configuration by entering the show interfaces, show protocols, show routing-options, and show policy-options commands. If the output does not display the intended configuration, repeat the instructions in this example to correct the configuration.
content_copy zoom_out_map
[edit]
user@R1# show interfaces
ge-1/3/0 {
unit 0 {
family inet {
address 172.16.12.1/24;
}
family mpls;
}
}
lo0 {
unit 0 {
family inet {
address address 172.16.25.1/32;
}
}
}
content_copy zoom_out_map
[edit]
user@R1# show protocols
mpls {
interface ge-1/3/0.0;
}
bgp {
group prio_internal {
type internal;
local-address 172.16.25.1;
import prio_for_bgp
neighbor 172.16.25.3 {
family inet {
unicast;
}
export next-hop-self;
}
}
}
ospf {
import ospf_prio;
area 0.0.0.0 {
interface ge-1/3/0.0;
interface lo0.0 {
passive;
}
}
}
ldp {
interface ge-1/3/0.0;
interface lo0.0;
}
}
content_copy zoom_out_map
[edit] user@R1# show routing-options nonstop-routing; router-id 172.16.25.1; autonomous-system 2525;
content_copy zoom_out_map
[edit]
user@R1# show policy-options
policy-statement next-hop-self {
term nhself {
from protocol bgp;
then {
next-hop self;
accept;
}
}
}
policy-statement ospf_prio {
term ospf_ldp {
from {
protocol ospf;
route-filter 172.16.25.3/32 exact;
}
then {
priority high;
accept;
}
}
}
policy-statement prio_for_bgp {
term bgp_prio {
from {
protocol bgp;
route-filter 172.16.50.1/32 exact;
}
then priority high;
}
}
If you are done configuring the device, enter commit from the configuration mode.
Verification
Confirm that the configuration is working properly.
- Verifying the Priority for OSPF Routes
- Verifying the Priority for LDP Routes
- Verifying the Priority for BGP Routes
Verifying the Priority for OSPF Routes
Purpose
Verify that the priority is set for the expected route in OSPF.
Action
On Device R1, from operational mode, run the show
ospf route 172.16.25.3/32 extensive command. A priority of high
is applied to OSPF route 172.16.25.3.
content_copy zoom_out_map
user@R1> show ospf route 172.16.25.3/32 extensive
Topology default Route Table:
Prefix Path Route NH Metric NextHop Nexthop
Type Type Type Interface Address/LSP
172.16.25.3 Intra Router IP 2 ge-1/3/0.0 172.16.12.2
area 0.0.0.0, origin 172.16.25.3, optional-capability 0x0
172.16.25.3/32 Intra Network IP 2 ge-1/3/0.0 172.16.12.2
area 0.0.0.0, origin 172.16.25.3, priority highMeaning
The output shows priority high is applied
for OSPF route 172.16.25.3.
Verifying the Priority for LDP Routes
Purpose
Verify if LDP inherits from OSPF.
Action
From operational mode, enter the show route 172.16.25.3 command to verify if LDP has inherited routes from OSPF.
content_copy zoom_out_map
user@R1> show route 172.16.25.3
inet.0: 24 destinations, 24 routes (24 active, 0 holddown, 0 hidden)
+ = Active Route, - = Last Active, * = Both
172.16.25.3/32 *[OSPF/10] 00:10:27, metric 2
> to 172.16.25.2 via ge-1/3/0.0
inet.3: 2 destinations, 2 routes (2 active, 0 holddown, 0 hidden)
+ = Active Route, - = Last Active, * = Both
172.16.25.3/32 *[LDP/9] 00:10:24, metric 1
> to 172.16.25.2 via ge-1/3/0.0, Push 299824
From operational mode, enter the show route 172.16.25.3
extensive command to verify if LDP has inherited priority.
content_copy zoom_out_map
user@R1> show route 172.16.25.3 extensive
inet.0: 24 destinations, 24 routes (24 active, 0 holddown, 0 hidden)
172.16.25.3/32 (1 entry, 1 announced)
State:<Flashall>
TSI:
KRT in-kernel 172.16.25.3/32 -> {172.16.12.2}
*OSPF Preference: 10
Next hop type: Router, Next hop index: 549
Address: 0xa463390
Next-hop reference count: 6
Next hop: 172.16.12.2 via ge-1/3/0.0, selected
Session Id: 0x0
State:<Active Int HighPriority>
Local AS: 2525
Age: 10:43 Metric: 2
Validation State: unverified
Area: 0.0.0.0
Task: OSPF
Announcement bits (4): 0-KRT 4-LDP 6-Resolve tree 2 7-Resolve_IGP_FRR task
AS path: I
inet.3: 2 destinations, 2 routes (2 active, 0 holddown, 0 hidden)
172.16.25.3/32 (1 entry, 1 announced)
State:<Flashall>
LDP Preference: 9
Next hop type: Router, Next hop index: 582
Address: 0xa477810
Next-hop reference count: 12
Next hop: 172.16.12.2 via ge-1/3/0.0, selected
Label operation: Push 299824
Label TTL action: prop-ttl
Load balance label: Label 299824: None;
Label element ptr: 0xa17ad00
Label parent element ptr: 0x0
Label element references: 1
Label element child references: 0
Label element lsp id: 0
Session Id: 0x0
State:<Active Int HighPriority>
Local AS: 2525
Age: 10:40 Metric: 1
Validation State: unverified
Task: LDP
Announcement bits (3): 2-Resolve tree 1 3-Resolve tree 2 4-Resolve_IGP_FRR task
AS path: I
Meaning
The output shows that LDP inherits priority high for route 172.16.25.3 from OSPF.
Verifying the Priority for BGP Routes
Purpose
Verify that priority is set for the expected route in BGP.
Action
On Device R1, from operational mode, run the show
route protocol bgp command to display the routes learned from
BGP.
content_copy zoom_out_map
user@R1> show route protocol bgp
inet.0: 24 destinations, 24 routes (24 active, 0 holddown, 0 hidden)
+ = Active Route, - = Last Active, * = Both
172.16.50.1/32 *[BGP/170] 00:11:24, localpref 100, from 172.16.25.3
AS path: I, validation-state: unverified
> to 172.16.12.2 via ge-1/3/0.0, Push 299824
172.16.50.2/32 *[BGP/170] 00:11:24, localpref 100, from 172.16.25.3
AS path: I, validation-state: unverified
> to 172.16.12.2 via ge-1/3/0.0, Push 299824
inet.3: 2 destinations, 2 routes (2 active, 0 holddown, 0 hidden)
mpls.0: 9 destinations, 9 routes (9 active, 0 holddown, 0 hidden)
On Device R1, from operational mode, run the show route
172.16.50.1 extensive command. High priority is applied for
BGP route 172.16.50.1.
content_copy zoom_out_map
user@R1> show route 172.16.50.1 extensive
inet.0: 24 destinations, 24 routes (24 active, 0 holddown, 0 hidden)
172.16.50.1/32 (1 entry, 1 announced)
TSI:
KRT in-kernel 172.16.50.1/32 -> {indirect(1048574)}
*BGP Preference: 170/-101
Next hop type: Indirect, Next hop index: 0
Address: 0xa487b10
Next-hop reference count: 4
Source: 172.16.25.3
Next hop type: Router, Next hop index: 582
Next hop: 172.16.12.2 via ge-1/3/0.0, selected
Label operation: Push 299824
Label TTL action: prop-ttl
Load balance label: Label 299824: None;
Label element ptr: 0xa17ad00
Label parent element ptr: 0x0
Label element references: 1
Label element child references: 0
Label element lsp id: 0
Session Id: 0x0
Protocol next hop: 172.16.25.3
Indirect next hop: 0xa4a9800 1048574 INH Session ID: 0x0
State: <Active Int Ext HighPriority>
Local AS: 2525 Peer AS: 2525
Age: 11:49 Metric2: 1
Validation State: unverified
Task: BGP_2525.172.16.25.3
Announcement bits (2): 0-KRT 6-Resolve tree 2
AS path: I (Atomic)
Accepted
Localpref: 100
Router ID: 172.16.25.3
Indirect next hops: 1
Protocol next hop: 172.16.25.3 Metric: 1
Indirect next hop: 0xa4a9800 1048574 INH Session ID: 0x0
Indirect path forwarding next hops: 1
Next hop type: Router
Next hop: 172.16.12.2 via ge-1/3/0.0
Session Id: 0x0
172.16.25.3/32 Originating RIB: inet.3
Metric: 1 Node path count: 1
Forwarding nexthops: 1
Nexthop: 172.16.12.2 via ge-1/3/0.0
Meaning
The output shows that priority high is applied
for BGP route 172.16.50.1.
