Skip to content
Register

My route reflector is reflecting routes I don't want reflected

Networking by haroldgsm 6 replies 404 views
haroldgsm

Member OP

Grumpy Old Sysadmin

3 #1

Running a pair of route reflectors for our iBGP mesh at two sites. Clean setup, or so I thought. Site A advertises 203.0.113.0/24 to its RR. Site B advertises 198.51.100.0/24 to its RR. Both RRs peer with each other, standard cluster.

The problem: Site A's RR is reflecting 203.0.113.0/24 to Site B's RR, and vice versa. I have prefix-lists applied on both RRs outbound to the other RR. The lists explicitly permit only the local site's prefix. Yet both prefixes show up everywhere.

ip prefix-list SITE-ONLY seq 5 permit 203.0.113.0/24
!
route-map OUTBOUND permit 10
 match ip address prefix-list SITE-ONLY
!
neighbor 10.0.0.2 route-map OUTBOUND out

Show ip bgp on the receiving RR still shows both prefixes. What am I missing? Back when we did this with static full meshes, at least you knew who to blame. Kids these days with their reflectors and their filters that don't filter.

Mark my words, it's something stupid. Twenty years in this business and I still fall for the obvious.

IPv4, IRC, and irssi — fight me
moebig

Member

RAID is not backup

#2

Wesh harold

The prefix-list is fine but check your direction, incha'allah the route map ain't "out" on the eBGP session by mistake? RRs are iBGP, don't mix them up

I seen this: the "out" filter on iBGP RR don't work like we think, the RR reflects before the filter or some shit like that

RAID 1: because paranoia pays
kenji3

Member

#3

Route reflectors process outbound route-maps differently. The reflector reflects routes to clients and non-clients before outbound filtering applies to the peering session itself. I encountered this in our Singapore POP.

You may need to filter at ingress from your clients, or use a different approach. What does your topology look like—are both RRs clients of each other, or is one the main reflector?

conbini > datacenter snacks
JA

Member

#4

He is the route map but he dont workkkkk

My filter he was wrong one time, nossa! Caramba! You check if le prefix-list he is right? More fast if you put the filter in the client, the RR he dont care about "out"

WH

Member

#5

Fink about ssource of routes no? Le RR he reflect before filter, yes? So you put filter on client ingress, not RR out no? Thanks for sharing, I learn ssometing new today

marchhopper

Member

#6

Prefix-lists on RR outbound? That's not where iBGP reflectors apply them.

MARIA3

Member

#7

Kenji's right, filter at ingress from the client instead.

siesta first, deploy later

Post a reply

You need an account to reply. Log in or register to join the conversation.

Post reply Preview Save draft