Wednesday, February 17, 2021

BIRD RPKI validation policy based on community

Coming from a Juniper shop, creating a simple route server using BIRD for a looking glass. Having an issue getting it to match extended bgp community that our Juniper router is sending to BIRD for validation state.

Need some help with the BIRD equivalent of the below config (from Juniper) be?

show policy-options policy-statement validation-ibgp { term valid { from community origin-validation-state-valid; then validation-state valid; } term invalid { from community origin-validation-state-invalid; then validation-state invalid; } term unknown { from community origin-validation-state-unknown; then validation-state unknown; } } community origin-validation-state-invalid members 0x4300:0.0.0.0:2; community origin-validation-state-unknown members 0x4300:0.0.0.0:1; community origin-validation-state-valid members 0x4300:0.0.0.0:0; } 

It receives the community fine, but obviously not doing anything with it, validation wise:

Table master4: 8.8.8.0/24 unicast [core_rt1 07:22:31.151 from 0.0.0.0] * (100) [AS15169i] Type: BGP univ BGP.origin: IGP BGP.as_path: 15169 BGP.next_hop: 0.0.0.0 BGP.med: 0 BGP.local_pref: 110 BGP.ext_community: (generic, 0x43000000, 0x0) BGP.large_community: (53339, 11, 1) (53339, 11, 3) (53339, 11, 5) 

Looking for it to output BGP.ext_community: (RPKI Origin Validation State: valid)



No comments:

Post a Comment