I have a BGP session, for example with AS1000, through which they send me the complete routing table. However, we are now going to connect to an IXP, let’s say AS3000. The IXP is requesting that I do not advertise any routes learned from AS1000. Would the following filter be effective?
if(bgp-input-remote-as==1000){reject}
Would this be placed in the input filter?
I appreciate it in advance.
This is what I use to keep from leaking routes learned from other peers that I don’t provide transit for:
if (bgp-as-path "(1234|5678|1000)") { reject; }
This keeps me from announcing routes learned from AS’s 1234, 5678, and 1000, no matter where they are in the AS path.
On top of that, I have a filter for my IP block (changed to an urealistic example block):
if (dst in 123.456.789.0/23 && dst-len in 23-24) { accept; }
And finally, if you do provide transit for another AS, this is how I allow their announcements to go out:
if (bgp-as-path ^54321 && dst-len in 20-24) { accept; }
To answer your question, yes. This filter would work. However, you would set this on the output filter chain used for your peering session with the IXP. As a good practice, you should consider reversing your logic, and creating a set of filters that allow you to export the prefixes you specify versus export everything and reject X. This is a safety measure to help prevent unintended route leaks. Also keep in mind, in ROS7, the default behavior is to reject routes. If you were trying to just have a single rule in the chain (assuming you ignore the suggestions above) then your rule would look something like this:
if ( bgp-input-remote-as==1000 ){ reject; } else { accept; }
Thank you so much for your help