Linux, FreeBSD, Juniper, Cisco / Network security articles and troubleshooting guides

FAQ
It is currently Fri Oct 18, 2019 5:22 am


Username:
Subject:
Message body:
Enter your message here, it may contain no more than 60000 characters. 

Smilies
:D :) ;) :( :o :shock: :? 8-) :lol: :x :P :oops: :cry: :evil: :twisted: :roll: :!: :?: :idea: :arrow: :| :mrgreen: :geek: :ugeek:
Font size:
 
Font colour
Options:
BBCode is ON
[img] is ON
[flash] is OFF
[url] is ON
Smilies are ON
Disable BBCode
Disable smilies
Do not automatically parse URLs
Confirmation code
Confirmation code:
In an effort to prevent automatic submissions, we require that you enter both of the words displayed into the text field underneath.
     

Topic review - JUNOS BGP: How to drain a BGP peering router gracefully without bgp session reset
Author Message
Post subject: JUNOS BGP: How to drain a BGP peering router gracefully without bgp session reset  |  Post Posted: Thu Sep 14, 2017 10:09 am
As many of us found out the hard way, certain export policy changes at neighbor level will hard reset the bgp session due to Junos internal architecture of update groups.

When a peering BGP router (or any bgp router for that matter) needs to be drained for maintenance, there aren't many obvious options:
1. disable bgp.
2. set import/export policies at neighbor level that reject everything.
3. disable interfaces towards bgp neighbors.

1st resets BGP sessions and maybe disturbs company agreements, 2nd could hard reset the session (same as 1st) and 3rd is the worst for obvious reasons.

Another hack is to use an empty routing policy with a default action "next policy" (no term, just default action) as the first import and export policy for that group. Something like below:
Code:
user@JUNOS-ROUTER# show policy-options policy-statement EMPTY-POLICY | display inheritance
then next policy;


This policy is applied first before any other policies for that bgp group. Due to "next policy" default action, it will do nothing, just instruct bgp prefix evaluation to proceed to next policy, but the important thing to note is that it is evaluated first.
Code:
[edit]
user@JUNOS-ROUTER# show protocols bgp
group test-bgp-group {
    type internal;
    import [ EMPTY-POLICY import-1 import-2 ];
    export [ EMPTY-POLICY import-1 import-2 ];
    peer-as 65530;
    neighbor 10.0.0.1;
}


When the BGP router needs to be drained, a JUNOS apply group will modify the empty policy adding a term to it:
Code:
[edit]
user@JUNOS-ROUTER# show groups
DRAIN {
    policy-options {
        policy-statement EMPTY-POLICY {
            term reject-term {
                then reject;
            }
        }
    }
}


Once we apply the DRAIN group, Junos adds the term to the empty policy and, as explained in documentation, inside a routing policy terms take precedence over default action.
Code:
[edit]
user@JUNOS-ROUTER# show policy-options policy-statement EMPTY-POLICY
then next policy;

[edit]
user@JUNOS-ROUTER# show policy-options policy-statement EMPTY-POLICY | display inheritance
##
## 'reject-term' was inherited from group 'DRAIN'
##
term reject-term {
    ##
    ## 'then' was inherited from group 'DRAIN'
    ## 'reject' was inherited from group 'DRAIN'
    ##
    then reject;
}
then next policy;
Jump to:  
News News Site map Site map SitemapIndex SitemapIndex RSS Feed RSS Feed Channel list Channel list


Delete all board cookies | The team | All times are UTC - 5 hours [ DST ]



phpBB SEO