The BGP Enhanced Attribute Error Handling feature prevents both iBGP and eBGP peer sessions from flapping when a BGP speaker receives the UPDATE message with the malformed attribute. The malformed Update is treat-as-withdraw and does not cause the BGP session to be reset. This feature is enabled by default, however it can be disabled with the help of a no bgp enhanced-error command. Thanks to BGP Enhanced Attribute Error Handling, valid routes exchanged over a session are not impacted because a BGP speaker does not reset a session when malformed BGP Update is received. RFC 7606 defines the error handling procedures for a number of existing attributes.
As for the matching attributes in an UPDATE message, there are several limitations in the configuration of attribute filtering. For instance, attributes 1, 2, 3, 4, 8, 14, 15, and 16 cannot be configured for both path treat-as-withdraw and discard attributes. Attribute type 5 (localpref), type 9 (Originator,) and type 10 (Cluster-id) can be configured for both treat-as-withdraw and discarattributes for eBGP neighbors only.
Let’s explain the differences between the actions treat-as-withdraw and discard for BGP Attribute Filtering using the network topology in Picture 1. The routers IOS-XR (AS 64500) and FRR (AS 64501) are configured to established eBGP session. The FRR router is running Core Linux 9.0 with the installed FRRouting IP routing protocol suite 5.0.2.
Picture 1: Network Topology
The FRR router advertises prefixes 192.168.1.0/24 and 192.168.2.0/24 towards IOS-XR. The community 64500:100 is attached only to the prefix 192.168.1.0/24.
interface eth0 ip address 10.0.0.2/30
The route-map Peer-XR is applied to an outbound route 192.168.1.0/24 for a neighbor 1.1.1.1 (IOS-XR).
router bgp 64501 bgp router-id 10.0.0.2 neighbor 1.1.1.1 remote-as 64500 neighbor 1.1.1.1 ebgp-multihop 2 address-family ipv4 unicast network 192.168.1.0/24 network 192.168.2.0/24 neighbor 1.1.1.1 route-map Peer-XR out
A static route to the loopback IP 1.1.1.1 (IOS-XR) is needed to peer with the router IOS-XR.
ip route 1.1.1.1/32 10.0.0.1
Static null routes are configured and presented in a routing table of FRR in order to advertise both routes toward the IOS-XR.
ip route 192.168.1.0/24 blackhole ip route 192.168.2.0/24 blackhole
The sequence 10 of the route-map Peers-XR matches network 192.168.1.0/24 and sets the community 64500:100 for this network. The sequence 20 is needed to permit advertisement of the network 192.168.2.0/24.
access-list 10 permit 192.168.1.0/24 route-map Peer-XR permit 10 match ip address 10 set community 64500:100 route-map Peer-XR permit 20
The IOS-XR router is running Cisco IOS XR Software, Version 6.1.3.
interface Loopback0 ipv4 address 1.1.1.1 255.255.255.255 interface GigabitEthernet0/0/0/0 ipv4 address 10.0.0.1 255.255.255.252
eBGP peers must have a Route-Policy (route-map) configured to permit routes in and out of them.
route-policy PASS pass router bgp 64500 bgp router-id 1.1.1.1 address-family ipv4 unicast neighbor 10.0.0.2 remote-as 64501 update-source Loopback0 address-family ipv4 unicast route-policy PASS in route-policy PASS out
The prefix 192.168.1.0 is received from the neighbor 10.0.0.2 (FRR) with the attached community 64500:100 (Picture 2).
RP/0/0/CPU0:ios# show bgp 192.168.1.0
Picture 2: Inspecting BGP Table of IOS-XR for 192.168.1.0/24
Now let’s configure an action treat-as-withdraw on IOS-XR for the attribute community. First, create attribute-filter group WITHDRAW. Then assign the attribute community to the group with the action treat-as-withdraw.
RP/0/0/CPU0:ios(config)# router bgp 64500 RP/0/0/CPU0:ios(config-bgp)# attribute-filter group WITHDRAW RP/0/0/CPU0:ios(config-bgp-attrfg)# attribute COMMUNITY treat-as-withdraw RP/0/0/CPU0:ios(config-bgp-attrfg)# exit
As the next step, configure the inbound BGP Update message handling for the 10.0.0.2 neighbor. Then assign the attribute-filtering group WITHDRAW to the neighbor.
RP/0/0/CPU0:ios(config-bgp)# neighbor 10.0.0.2 RP/0/0/CPU0:ios(config-bgp-nbr)# update in filtering RP/0/0/CPU0:ios(config-nbr-upd-filter)# attribute-filter group WITHDRAW
As the last step, commit the configuration.
RP/0/0/CPU0:ios(config-nbr-upd-filter)# commit
Once you commit the configuration, a logging message will inform you about filtering the attribute 8 – community from UPDATE message received from the neighbor 10.0.0.2 (Picture 3).
Picture 3: Routing-BGP-5-UPDATE_FILTERED Message generated by IOS-XR
The action treat-as-withdraw is taken for the 192.168.1.0/24 prefix, which means that the prefix is filtered from the BGP table of IOS-XR. Only the 192.168.2.0/24 prefix is presented in the BGP table (Picture 4).
RP/0/0/CPU0:ios# show bgp | begin BGP scan
Picture 4: BGP Table of IOS-XR
Below is the entire BGP configuration of IOS-XR for reference.
RP/0/0/CPU0:ios# show running-config | begin bgp router bgp 64500 attribute-filter group WITHDRAW attribute COMMUNITY treat-as-withdraw bgp router-id 1.1.1.1 address-family ipv4 unicast neighbor 10.0.0.2 remote-as 64501 update in filtering attribute-filter group WITHDRAW update-source Loopback0 address-family ipv4 unicast route-policy PASS in route-policy PASS out
We only change an action inside the group WITHDRAW from withdraw to discard. The filtering configuration under the neighbor 10.0.0.2 section remains the same.
RP/0/0/CPU0:ios(config)# router bgp 64500 RP/0/0/CPU0:ios(config-bgp)# attribute-filter group WITHDRAW RP/0/0/CPU0:ios(config-bgp-attrfg)# attribute COMMUNITY discard RP/0/0/CPU0:ios(config-bgp-attrfg)# exit
As the last step, commit the configuration.
RP/0/0/CPU0:ios(config-nbr-upd-filter)# commit
Once you commit the configuration, a logging message will inform you about filtering the attribute 8 – community from UPDATE message received from the neighbor 10.0.0.2 (Picture 5).
Picture 5: Routing-BGP-5-UPDATE_FILTERED Message generated by IOS-XR
The action discard is taken for the prefix 192.168.1.0/24 which means that the attribute community is filtered from the prefix. However, the 192.168.1.0 prefix remains presented in the BGP table of IOS-XR. (Picture 6).
The difference between an action treat-as-withdraw and discard is obvious. While treat-as-withdraw action purges an entire prefix from the BGP table when a particular path attribute is matched inside the UPDATE message, the action discard only removes the attribute and the prefix is kept present in the BGP table.
RP/0/0/CPU0:ios# show bgp 192.168.1.0
Picture 6: BGP Table of IOS-XR
Below is the entire BGP configuration of IOS-XR for reference.
router bgp 64500 attribute-filter group WITHDRAW attribute COMMUNITY discard bgp router-id 1.1.1.1 address-family ipv4 unicast neighbor 10.0.0.2 remote-as 64501 update in filtering attribute-filter group WITHDRAW update-source Loopback0 address-family ipv4 unicast route-policy PASS in route-policy PASS out
BGP Attribute Filtering provides an increased measure of security. If the specified path attribute is matched in an UPDATE message, the attribute is either dropped and the UPDATE message is processed normally (action discard) or prefix is removed from the routing table (action treat-as-withdraw). The BGP Enhanced Attribute Error Handling feature prevents peer sessions from flapping due to errors from a malformed update. The established sessions are maintained and the valid routes are exchanged but the routes in a malformed UPDATE message are removed. It helps to minimize the malformed UPDATE message impact on routing and significantly saves the resources.