Linux, FreeBSD, Juniper, Cisco / Network security articles and troubleshooting guides

FAQ
It is currently Wed Oct 18, 2017 5:18 pm


Author Message
admin
Post  Post subject: JUNOS BGP: How to drain a BGP peering router gracefully without bgp session reset  |  Posted: Thu Sep 14, 2017 10:09 am
Site Admin

Joined: Mon Aug 03, 2009 8:43 am
Posts: 101

Offline
 

JUNOS BGP: How to drain a BGP peering router gracefully without bgp session reset

As many of us found out the hard way, certain export policy changes at neighbor level will hard reset the bgp session due to Junos internal architecture of update groups.

When a peering BGP router (or any bgp router for that matter) needs to be drained for maintenance, there aren't many obvious options:
1. disable bgp.
2. set import/export policies at neighbor level that reject everything.
3. disable interfaces towards bgp neighbors.

1st resets BGP sessions and maybe disturbs company agreements, 2nd could hard reset the session (same as 1st) and 3rd is the worst for obvious reasons.

Another hack is to use an empty routing policy with a default action "next policy" (no term, just default action) as the first import and export policy for that group. Something like below:
Code:
user@JUNOS-ROUTER# show policy-options policy-statement EMPTY-POLICY | display inheritance
then next policy;


This policy is applied first before any other policies for that bgp group. Due to "next policy" default action, it will do nothing, just instruct bgp prefix evaluation to proceed to next policy, but the important thing to note is that it is evaluated first.
Code:
[edit]
user@JUNOS-ROUTER# show protocols bgp
group test-bgp-group {
    type internal;
    import [ EMPTY-POLICY import-1 import-2 ];
    export [ EMPTY-POLICY import-1 import-2 ];
    peer-as 65530;
    neighbor 10.0.0.1;
}


When the BGP router needs to be drained, a JUNOS apply group will modify the empty policy adding a term to it:
Code:
[edit]
user@JUNOS-ROUTER# show groups
DRAIN {
    policy-options {
        policy-statement EMPTY-POLICY {
            term reject-term {
                then reject;
            }
        }
    }
}


Once we apply the DRAIN group, Junos adds the term to the empty policy and, as explained in documentation, inside a routing policy terms take precedence over default action.
Code:
[edit]
user@JUNOS-ROUTER# show policy-options policy-statement EMPTY-POLICY
then next policy;

[edit]
user@JUNOS-ROUTER# show policy-options policy-statement EMPTY-POLICY | display inheritance
##
## 'reject-term' was inherited from group 'DRAIN'
##
term reject-term {
    ##
    ## 'then' was inherited from group 'DRAIN'
    ## 'reject' was inherited from group 'DRAIN'
    ##
    then reject;
}
then next policy;

_________________
VPSie - SSD VPS servers in AMS-IX, LINX, DE-CIX
https://vpsie.com





Top
Display posts from previous:  Sort by  
E-mail friendPrint view

Topics related to - "JUNOS BGP: How to drain a BGP peering router gracefully without bgp session reset"
 Topics   Author   Replies   Views   Last post 
There are no new unread posts for this topic. Junos router advertisements - Unix IPv6 stateless autoconfiguration via SLAAC

admin

0

3042

Mon Jun 23, 2014 5:23 am

admin View the latest post

There are no new unread posts for this topic. Example of BGP update message sent from Junos for a VPLS circuit

mandrei99

0

719

Fri Jul 19, 2013 9:24 am

mandrei99 View the latest post

There are no new unread posts for this topic. How to configure Junos ipv6 default route

mandrei99

0

3204

Mon Feb 16, 2015 6:29 pm

mandrei99 View the latest post

There are no new unread posts for this topic. Junos VPLS Label Block Operations - Example with BGP signaling

mandrei99

0

1819

Thu Jul 04, 2013 7:44 am

mandrei99 View the latest post

There are no new unread posts for this topic. Junos: BGP label allocation failure: Need a nexthop address on LAN

mandrei99

1

1171

Mon Nov 10, 2014 4:28 am

mandrei99 View the latest post

There are no new unread posts for this topic. Example of BGP update message sent from Junos device when export policy is modified

mandrei99

0

624

Fri Jul 19, 2013 9:09 am

mandrei99 View the latest post

There are no new unread posts for this topic. Junos: error: VRF: vrf-import needs at least one target community or a reject policy for vrf in

mandrei99

0

941

Wed Jul 03, 2013 8:39 am

mandrei99 View the latest post

There are no new unread posts for this topic. Junos: GRE interface in VR with local tunnel endpoint in main routing instance

mandrei99

0

2755

Thu May 23, 2013 9:33 am

mandrei99 View the latest post

There are no new unread posts for this topic. Understanding the OSPF External NSSA LSA Metric Type 1 with JunOS examples

mandrei99

0

1532

Sun Mar 15, 2015 1:51 pm

mandrei99 View the latest post

There are no new unread posts for this topic. Junos VPLS Virtual circuit stuck in "VC-Dn" state

mandrei99

0

2017

Tue Jul 09, 2013 9:48 am

mandrei99 View the latest post

 

Who is online
Users browsing this forum: No registered users and 0 guests
You can post new topics in this forum
You can reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum
Jump to:  
News News Site map Site map SitemapIndex SitemapIndex RSS Feed RSS Feed Channel list Channel list


Delete all board cookies | The team | All times are UTC - 5 hours [ DST ]



phpBB SEO