Fireware How To Dynamic Routing

Transcription

1 Fireware How To Dynamic Routing How do I configure my Firebox to use BGP? Introduction A routing protocol is the language a router speaks with other routers to share information about the status of network routing tables. With static routing, routing tables are set and do not change. If a router on the remote path fails, a packet cannot get to its destination. Dynamic routing lets routing tables in routers change as the routes change. If the best path to a destination cannot be used, dynamic routing protocols change routing tables when necessary to keep your network traffic moving. Fireware Pro gives support to RIP v1 and v2, OSPF, and BGP v4 dynamic routing protocols. The Border Gateway Protocol (BGP) is a scalable dynamic routing protocol used by groups of routers to share routing information. BGP is the routing protocol used on the Internet. BGP uses route parameters or attributes to define routing policies and create a stable routing environment. BGP allows you to advertise multiple paths to and from the Internet to your network and the resources you host. This offers you redundant paths and can increase your uptime. Hosts using BGP use TCP to send updated routing table information when one host finds a change. The host sends only the part of the routing table that has the change. BGP uses classless interdomain routing (CIDR) to reduce the size of the Internet routing tables. The size of the BGP routing table in Fireware Pro is set at 32K. The size of the typical WatchGuard customer wide area network (WAN) is best suited for OSPF dynamic routing, not BGP. A WAN can also use external border gateway protocol (EBGP) when more than one gateway to the Internet is available. EBGP allows you to take full advantage of the redundancy possible with a multi-homed network. To participate in EBGP with an ISP you must have an autonomous system number (ASN). You must get an ASN from one of the regional registries in the table below. After you are assigned your own ASN you must contact each ISP to get their ASNs and other necessary information. Region Registry Name Web Site North America ARIN Europe RIPE NCC Asia Pacific APNIC Latin America LACNIC Africa AfriNIC Is there anything I need to know before I start? To use any of the dynamic routing protocols with Fireware, you must import or type a dynamic routing configuration file for the routing daemon you choose. This configuration file includes information such as a password and log file name. You can find a sample BGP configuration file in this FAQ: Notes about configuration files: The! and the # characters are comment characters. If the first character of the word is one of the comment characters, then the rest of the line is interpreted as a comment. If the comment character is not the first character of the word, it is interpreted as a command. Usually, you can use the word no at the beginning of the line to disable a command. For example: no network /24 area disables the backbone area on the specified network. All BGP configuration parameters should come from your ISP. Do not implement any commands that are not directed by your ISP as this protocol can cause problems if a mistake is made. 1

2 Supported BGP routing commands to use in your routing daemon configuration file To create or modify a routing configuration file, here is a catalog of supported routing commands. The sections must appear in the configuration file in the same order they appear in this table. Section Command Description Configure BGP Routing Daemon router bgp [ASN] network [A.B.C.D/M] Set Neighbor Properties Community Lists Peer Filtering no network [A.B.C.D/M] neighbor [A.B.C.D] remote-as [ASN] neighbor [A.B.C.D] ebgp-multihop neighbor [A.B.C.D] version 4+ neighbor [A.B.C.D] update-source [WORD] neighbor [A.B.C.D] default-originate neighbor [A.B.C.D] port 189 neighbor [A.B.C.D] send-community neighbor [A.B.C.D] weight 1000 Redistribute Routes to BGP neighbor [A.B.C.D] maximum-prefix [NUMBER] ip community-list [<1-99> < >] permit AA:NN neighbor [A.B.C.D] distribute-list [LISTNAME] [IN OUT] neighbor [A.B.C.D] prefix-list [LISTNAME] [IN OUT] neighbor [A.B.C.D] filter-list [LISTNAME] [IN OUT] neighbor [A.B.C.D] route-map [MAPNAME] [IN OUT] redistribute kernel redistribute rip redistribute ospf Enable BGP daemon and set autonomous system number (ASN); this is supplied by your ISP Announce BGP on network A.B.C.D/M Disable BGP announcements on network A.B.C.D/M Set neighbor as member of remote ASN Set neighbor on another network using EBGP multi-hop Set BGP version (4, 4+, 4-) for communication with neighbor; default is 4 Set the BGP session to use a specific interface for TCP connections Announce default route to BGP neighbor [A.B.C.D] Set custom TCP port to communicate with BGP neighbor [A.B.C.D] Set peer send-community Set a default weight for neighbor s [A.B.C.D] routes Set maximum number of prefixes allowed from this neighbor Specify community to accept autonomous system number and network number separated by a colon are entered as the new community format. Set distribute list and direction for peer To apply a prefix list to be matched to incoming advertisements or outgoing advertisements to that neighbor To match an autonomous system path access list to incoming routes or outgoing routes To apply a route map to incoming or outgoing routes Redistribute static routes to BGP Redistribute RIP routes to BGP Redistribute OSPF routes to BGP 2

3 Configuring Fireware to use BGP Section Command Description Route Reflection bgp cluster-id A.B.C.D neighbor [W.X.Y.Z] route-reflector-client Access Lists and IP Prefix Lists ip prefix-list PRELIST permit A.B.C.D/E access-list NAME [deny allow] A.B.C.D/E route-map [MAPNAME] permit [N] match ip address prefix-list [LISTNAME] set community [A:B] match community [N] set local-preference [N] Configuring Fireware to use BGP 1 From Policy Manager, select Network > Dynamic Routing. The Dynamic Routing Setup dialog box appears. To configure the cluster ID if the BGP cluster has more than one route reflector To configure the router as a BGP route reflector and configure the specified neighbor as its client Set prefix list Set access list In conjunction with the match and set commands, this defines the conditions and actions for redistributing routes Matches the specified access_list Set the BGP community attribute Matches the specified community_list Set the preference value for the autonomous system path 2 Click the BGP tab. 3 Click Enable Dynamic Routing and Enable BGP.

4 4 Click Import to import a routing daemon configuration file, or type your configuration parameters in the text box. If you click Import, you can browse to the location of the BGP daemon configuration file. It is located in C:\Documents and Settings\My Documents\My WatchGuard. 5 Click Select a BGP Configuration file. Click OK. Allowing BGP traffic through the Firebox You must add and configure a policy to allow BGP traffic to the Firebox from the approved networks. These networks must be the same networks you defined in your BGP configuration file. 1 From Policy Manager, select Edit > Add Policies. From the list of packet filters, select BGP. Click Add. The New Policy Properties window appears for BGP. 2 In the New Policy Properties dialog box, configure the policy to allow traffic from the IP or network address of the router using BGP to the Firebox interface it connects to. Click OK. SUPPORT: U.S. and Canada All Other Countries COPYRIGHT 2006 WatchGuard Technologies, Inc. All rights reserved. WatchGuard, the WatchGuard logo, Firebox, and Core are registered trademarks or trademarks of WatchGuard Technologies, Inc. in the United States and/or other countries. 4

5 Frequently Asked Questions About This Procedure Frequently Asked Questions About This Procedure What s the best way to get started? To get started, you only need three commands in your BGP configuration file. These three commands, in this order, will start the BGP process: router BGP <BGP autonomous system number supplied by your ISP> network <network IP address that you want to advertise a route to from the Internet> neighbor <IP address of neighboring BGP router> remote-as <BGP autonomous number> With these three commands, you set up a peer relationship with the ISP and create a route for a network to the Internet. You must also add a BGP policy to your Firebox configuration to allow the BGP traffic to pass through the Firebox.

6 6