BGP Policy Configuration in a Multi-AS Juniper Lab

This document walks through the configuration and validation of BGP policy behaviour in a Junos-based multi-AS lab containing 6 vMX routers running Junos OS 21.1R3.11. The focus is on implementing:

• iBGP route distribution inside AS64522
• Controlled EBGP export of loopbacks only
• Community tagging for AS-origin identification
• Preventing AS64533 from becoming a transit AS

All commands, configurations, and outputs are reproduced exactly as observed in the lab.

Lab Topology Summary

Devices: 6× vMX routers IGP: OSPF Area 0 inside each AS EGP: eBGP between AS64522, AS64533, AS64544 Addressing: 10.100.x.x/24 Loopbacks: 10.100.100.x/32

I am using the lab from Juniper vLabs

1. iBGP in AS64522: Initial Setup and Route Flow

On R1, the iBGP group IBGP uses the policy SEND_ALL, which redistributes all local (direct) and OSPF routes into iBGP.

jcluser@vMX1> show configuration protocols bgp                           
group IBGP {
    type internal;
    local-address 10.100.100.1;
    export SEND_ALL;
    neighbor 10.100.100.2;
    neighbor 10.100.100.3;
}

SEND_ALL policy:

jcluser@vMX1> show configuration | display set | match SEND_ALL 
set policy-options policy-statement SEND_ALL term 1 from protocol ospf
set policy-options policy-statement SEND_ALL term 1 then accept
set policy-options policy-statement SEND_ALL term 2 from protocol direct
set policy-options policy-statement SEND_ALL term 2 then accept
set policy-options policy-statement SEND_ALL term 3 then reject
set protocols bgp group IBGP export SEND_ALL

Verification that R1 is advertising routes to R2:

jcluser@vMX1> show route advertising-protocol bgp 10.100.100.2 detail 

inet.0: 12 destinations, 12 routes (12 active, 0 holddown, 0 hidden)
* 10.100.12.0/24 (1 entry, 1 announced)
 BGP group IBGP type Internal
     Nexthop: Self
     Localpref: 100
     AS path: [64522] I 
* 10.100.13.0/24 (1 entry, 1 announced)
 BGP group IBGP type Internal
     Nexthop: Self
     Localpref: 100
     AS path: [64522] I 
* 10.100.23.0/24 (1 entry, 1 announced)
 BGP group IBGP type Internal
     Nexthop: 10.100.13.2
     MED: 2
     Localpref: 100
     AS path: [64522] I 
* 10.100.100.1/32 (1 entry, 1 announced)
 BGP group IBGP type Internal
     Nexthop: Self
     Localpref: 100
     AS path: [64522] I 

* 10.100.100.2/32 (1 entry, 1 announced)
 BGP group IBGP type Internal
     Nexthop: 10.100.12.2
     MED: 1
     Localpref: 100
     AS path: [64522] I 
* 10.100.100.3/32 (1 entry, 1 announced)
 BGP group IBGP type Internal
     Nexthop: 10.100.13.2
     MED: 1
     Localpref: 100
     AS path: [64522] I 
* 100.123.0.0/16 (1 entry, 1 announced)
 BGP group IBGP type Internal
     Nexthop: Self
     Localpref: 100
     AS path: [64522] I

2. Missing Routes from R2: Root Cause: No Export Policy

R3 shows that it receives no BGP routes from R2:

jcluser@vMX3> show route receive-protocol bgp 10.100.100.2 detail    

inet.0: 16 destinations, 23 routes (16 active, 0 holddown, 2 hidden)
inet6.0: 1 destinations, 1 routes (1 active, 0 holddown, 0 hidden)

Since R2 had no export policy, it advertised nothing.

The policy applied to R3:

jcluser@vMX3# show | compare 
[edit]
+  policy-options {
+      policy-statement SEND_ALL {
+          term 1 {
+              from protocol ospf;
+              then accept;
+          }
+          term 2 {
+              from protocol direct;
+              then accept;
+          }
+          term 3 {
+              then reject;
+          }
+      }
+  }
[edit protocols bgp group IBGP]
+    export SEND_ALL;
[edit]

Verification after configuration:

jcluser@vMX3> show route receive-protocol bgp 10.100.100.2 detail 

inet.0: 18 destinations, 32 routes (18 active, 0 holddown, 4 hidden)
  10.100.12.0/24 (3 entries, 1 announced)
     Accepted
     Nexthop: 10.100.100.2
     Localpref: 100
     AS path: I 

  10.100.23.0/24 (3 entries, 1 announced)
     Accepted
     Nexthop: 10.100.100.2
     Localpref: 100
     AS path: I 

* 10.100.24.0/24 (1 entry, 1 announced)
     Accepted
     Nexthop: 10.100.100.2
     Localpref: 100
     AS path: I 
<snipped>

3. Problem 1: AS64522 to AS64533 Export Control

Required outcome:

• Only loopback /32 prefixes are exported to AS64533 and AS64544
• All exported loopbacks tagged with community 64522:100
• No GE-subnets or OSPF routes exported

R3 BGP config before applying loopback-only policy:

jcluser@vMX3> show configuration protocols bgp 
group IBGP {
    type internal;
    local-address 10.100.100.3;
    export SEND_ALL;
    neighbor 10.100.100.1;
    neighbor 10.100.100.2;
}
group to-AS64533 {
    type external;
    peer-as 64533;
    neighbor 10.100.34.2;
}
group to-AS64544 {
    type external;
    peer-as 64544;
    neighbor 10.100.35.2;
}

Policy applied on R2 and R3:

jcluser@vMX2# show | compare                                                               
[edit policy-options]
+   policy-statement ONLY_LOOPBACK {
+       term LOOPBACKS {
+           from {
+               route-filter 0.0.0.0/0 prefix-length-range /32-/32;
+           }
+           then accept;
+       }
+       term reject {
+           then reject;
+       }
+   }
[edit protocols bgp group to-AS64533]
+    export ONLY_LOOPBACK;
[edit protocols bgp group to-AS64544]
+    export ONLY_LOOPBACK;

Verification on R2:

jcluser@vMX2> show route advertising-protocol bgp 10.100.24.2 

inet.0: 18 destinations, 32 routes (18 active, 0 holddown, 2 hidden)
  Prefix                  Nexthop              MED     Lclpref    AS path
* 10.100.100.1/32         Self                 1                  I
* 10.100.100.2/32         Self                                    I
* 10.100.100.3/32         Self                 1                  I

Same on R3:

jcluser@vMX3> show route advertising-protocol bgp 10.100.35.2     

inet.0: 18 destinations, 32 routes (18 active, 0 holddown, 4 hidden)
  Prefix                  Nexthop              MED     Lclpref    AS path
* 10.100.100.1/32         Self                 1                  I
* 10.100.100.2/32         Self                 1                  I
* 10.100.100.3/32         Self                                    I

Community tagging added:

set policy-options policy-statement ONLY_LOOPBACK term LOOPBACKS then community add AS64522
set policy-options community AS64522 members 64522:100

Verification:

jcluser@vMX2> show route advertising-protocol bgp 10.100.24.2 10.100.100.1/32 extensive 

inet.0: 18 destinations, 32 routes (18 active, 0 holddown, 2 hidden)
* 10.100.100.1/32 (3 entries, 1 announced)
 BGP group to-AS64533 type External
     Nexthop: Self
     MED: 1
     AS path: [64522] I 
     Communities: 64522:100

After applying the same to R3:

Before:

jcluser@vMX3> show route advertising-protocol bgp 10.100.34.2 10.100.100.1/32 extensive 

inet.0: 18 destinations, 32 routes (18 active, 0 holddown, 4 hidden)
* 10.100.100.1/32 (3 entries, 1 announced)
 BGP group to-AS64533 type External
     Nexthop: Self
     MED: 1
     AS path: [64522] I 

After:

jcluser@vMX3> show route advertising-protocol bgp 10.100.34.2 10.100.100.1/32 extensive    

inet.0: 18 destinations, 32 routes (18 active, 0 holddown, 4 hidden)
* 10.100.100.1/32 (3 entries, 1 announced)
 BGP group to-AS64533 type External
     Nexthop: Self
     MED: 1
     AS path: [64522] I 
     Communities: 64522:100

4. Problem 2: AS64533 Transit Prevention

Requirement: AS64533 must NOT act as a transit AS between AS64522 and AS64544.

Initially, R6 receives AS64522 loopbacks via R4:

jcluser@vMX6> show route receive-protocol bgp 10.100.46.1 detail 

inet.0: 13 destinations, 16 routes (13 active, 0 holddown, 0 hidden)
  10.100.100.1/32 (2 entries, 1 announced)
     Accepted
     Nexthop: 10.100.46.1
     AS path: 64533 64522 I 
     Communities: 64522:100

  10.100.100.2/32 (2 entries, 1 announced)
     Accepted
     Nexthop: 10.100.46.1
     AS path: 64533 64522 I 
     Communities: 64522:100

  10.100.100.3/32 (2 entries, 1 announced)
     Accepted
     Nexthop: 10.100.46.1
     AS path: 64533 64522 I 
     Communities: 64522:100

inet6.0: 1 destinations, 1 routes (1 active, 0 holddown, 0 hidden)

Fix: Export only locally originated loopback from R4 and R5

jcluser@vMX4# show | compare 
[edit]
+  policy-options {
+      policy-statement SEND_LOCAL_LOOBACK {
+          term 1 {
+              from {
+                  protocol direct;
+                  route-filter 0.0.0.0/32 prefix-length-range /32-/32;
+              }
+              then accept;
+          }
+          term 2 {
+              then reject;
+          }
+      }
+  }
[edit protocols bgp group to-AS64544]
+    export SEND_LOCAL_LOOBACK;

Verification on R6:

jcluser@vMX6> show route receive-protocol bgp 10.100.46.1 detail    

inet.0: 14 destinations, 15 routes (14 active, 0 holddown, 0 hidden)
* 10.100.100.4/32 (2 entries, 1 announced)
     Accepted
     Nexthop: 10.100.46.1
     AS path: 64533 I 

inet6.0: 1 destinations, 1 routes (1 active, 0 holddown, 0 hidden)

AS64533 now advertises only its own loopback.