topic BGP Tunnel with Amazon in Firewall and Security Management

BGP Tunnel with Amazon

Shurik — Fri, 13 Oct 2023 02:16:29 GMT

Hello folks!

I created two BGP VPN tunnels with Amazon about a week ago. All worked fine, but at some point we started learning from them our networks...

After that I created import routemap, it solved the problem:

set routemap bgp_import id 10 on
set routemap bgp_import id 10 allow
set routemap bgp_import id 10 match network 10.10.1.0/24 exact
set routemap bgp_import id 10 match network 10.10.2.0/24 exact
set routemap bgp_import id 10 match network 10.10.3.0/24 exact
set bgp external remote-as 5555 import-routemap bgp_import preference 1 on

I have a few questions please.

1. Do I need to add restrict routemap here (in the example above)?

2. In webui (Route Redistribution) I have specified a number of networks (match type: exact), to advertise to AWS AS.

Do I need to create routemap export or route redistribution will be enough?

Our current version is R81

Thank you!

Re: BGP Tunnel with Amazon

the_rock — Fri, 13 Oct 2023 02:24:34 GMT

I dont believe you need to do anything in web UI, as routemaps would always take precedence anyway.

Andy

Re: BGP Tunnel with Amazon

Shurik — Fri, 13 Oct 2023 13:21:33 GMT

Right, but it was part of AWS procedure, to route redistributions (print screen above).

Any chance anyone has experience/best practice with that?

1. Do I need to add restrict routemap here (in the example above)?

2. In webui (Route Redistribution) I have specified a number of networks (match type: exact), to advertise to AWS AS.

Do I need to create routemap export or route redistribution will be enough?

Re: BGP Tunnel with Amazon

the_rock — Fri, 13 Oct 2023 13:41:56 GMT

I cant speak for other people, only from my own experience with this and what worked. So, to answer your ?s...

1. Do I need to add restrict routemap here (in the example above)?

I never had to

2. In webui (Route Redistribution) I have specified a number of networks (match type: exact), to advertise to AWS AS.

Do I need to create routemap export or route redistribution will be enough?

Route redistribution will work IF no routemap is configured. Otherwise, routemaps will take precedence.

Andy

Re: BGP Tunnel with Amazon

CheckPointerXL — Fri, 20 Oct 2023 14:31:11 GMT

easist way to fix that is by inbound route filter