BGP Filter bgp-as-path reject

RouterOS RouterOS beta
1

Hello,

Please help with the BGP filters in v7.

I want to reject 2 as numbers on a internet exchange.
I have the following but it isn’t working

if (bgp-as-path 11111|22222) {reject} else {set bgp-local-pref 120; accept;}

For example AS 11111 and 22222 blocking and accept all else routes.

2

From https://help.mikrotik.com/docs/pages/viewpage.action?pageId=74678285


bgp-as-path
    {regexp}

If the regexp follows normal syntax should the path not be written as “^(11111|22222) .*”?


if (bgp-as-path "^(11111|22222) .*") {reject} else {set bgp-local-pref 120; accept;}

Alternatively, could bgp-input-remote-as be another matching function you could use?

3

Did anyone find a working example of a bgp-as-path filter?
The writing of documentation was clearly interrupted halfway and it is not complete now.
There is a special paragraph that says:

There are two common ways how to operate with AS Path data:

    convert whole AS path to string and let regexp operate on the string (ROS v6 or Cisco style)
    let regexp operate on each entry in the AS path as a number (ROS v7, Juniper style)

The latter method is much faster and less resource-intensive than the string matching approach.

That is clear. We have to use a new method to look in AS path entries. I think that is reasonable, but nowhere it is specified how the match statements should look.
I need filter rules that match a certain AS at:

  • the begin of the AS path (this can probably be replaced with bgp-input-remote-as now)
  • the originating AS (this would be matched using " 1234$" in the v6 syntax but now we supposedly can match “the last item of the AS list” with a literal number. but how?)
  • some AS occurring anywhere in the path.

It should not be difficult to add examples for these cases to the documentation, and then the full capabilities can be documented later.

4

Documentation is work in progress.

In RC5 there might be problems with regex matcher. In RC6 it will work like this:

  • “^1234” match AS paths starting with 1234 ASN
  • “1234$” match originating ASN
  • “1234” match 1234 ASN appearence anywhere in the path
  • “.1234.” match 1234 ASN anywhere except beginning and the end.
5

Can you PLEASE post an example showing the syntax of a filter rule that does matching with bgp-as-path?
Is the above mentioned claim that v7 matches on separate entries of the path instead of on an ASCII string representing the entire path (already) true?

6

This does not work for me - but why?

if ( bgp-as-path "^65022" ) {
	accept;
}

This results, that the BGP-Announcements from AS65022 are not forwarded.
If i specifiy the IP-Network from that ASN, it will work.

So the RegEX is not working for me.
Screenshot 2023-09-29 003549.jpg
These Routes are not exported to my peers.

7

Okay, i have found the solution… When exporting the routes, and you are filtering as-path for “beginns with”, you have to add your own ASN in first position. So you do not check against the received protocol, it will check against what will sent out to the bgp-peer. That is strange to have to check for my own ASN.

if ( bgp-as-path "^65012 65022" ) {
	accept;
}

Where 65012 is my own ASN.

8

As I wrote above (at a time when all of this simply did not work due to bugs, that have been fixed now) there is a “bgp-input-remote-as” you can use for that.