topic Re: BGP Filter and Advertising in General Topics

BGP Filter and Advertising

melcu — Mon, 27 Oct 2025 18:07:09 GMT

Hi mates,

Again, missed me ? 😞

I have a requirement that kinds of blows me away.

SO .. 3 routers. A, B (Check Point) and C

B receives from C and advertise to A but with a "catch".

Routes from C are marked with a community of 1:1 (It's a Cisco).

On Check Point we need the following:

if routes are received from C with community 1:1 then redistribute them to A with a MED of 50

if routes have a different community (or no community) inject them in CKP routing table

If routes are received with community 1:2 then redistribute them to A with a MED of 200

This is where I'm stuck: Check Point doesn't do community in that format therefore I've asked the customer to create route-maps on Cisco and set for 1:1 100 and for 1:2 200

But know I have no idea how to do redistribution with different MEDs based on what's inbound.

In Cisco World will be simple but here it blows my mind and I have horse vision right now (I've struggled with it whole weekend)

Any advice is as usual really appreciated!!

Re: BGP Filter and Advertising

melcu — Mon, 27 Oct 2025 19:41:56 GMT

Update:

turning on bgp communities let's me use the community-match and it seems that route redistribution works as expected. If community is 1:1 - then redistribute, if it's something else don't.
But unfortunately only one med statement per bgp peer is allowed or I'm missing something. For community 1:2 do med 200

Re: BGP Filter and Advertising

Lari_Luoma — Mon, 27 Oct 2025 23:03:43 GMT

Hi!

Typically Cisco's representation of a community is in the format of ASN:value.

So 1:1 would mean AS 1 with value 1. They are not used that way as the AS value is not enforced and both numbers in the community tag just seem to be random numbers most likely because admins don't understand the real idea behind them.

In Check Point however, we match communities in route maps like this:
match community <Community ID> as <Community AS Number 1-65535> {on | off}

Example:

match community 1 as 1 on

This matches it to Cisco's 1:1 community.

Disclaimer: This is my understanding of how it works. I'm not a Cisco specialist, so I might be wrong, but this is the way however, how I have got them to match in the past.

Re: BGP Filter and Advertising

the_rock — Mon, 27 Oct 2025 23:08:58 GMT

Make sure ebgp multihop is enabled, thats main Cisco feature.

Re: BGP Filter and Advertising

Lari_Luoma — Mon, 27 Oct 2025 23:45:06 GMT

I just wrote this out of fun... Haven't tested it.
This redistributes routes that match community 1:1 to AS 400 setting MED as 200.

set routemap BGP-OUT id 10 on
set routemap BGP-OUT id 10 match community 1 as 1 on
set routemap BGP-OUT id 10 action metric 200
set bgp external remote-as 400 export-routemap BGP-OUT preference 1 family inet on

Re: BGP Filter and Advertising

melcu — Tue, 28 Oct 2025 18:44:40 GMT

Somehow with the routemap in place I receive all the routes on the other side but it sends them with 200

set routemap BGP-OUT id 10 allow
set routemap BGP-OUT id 10 match community 1 as 1 on
set routemap BGP-OUT id 10 match community exact on
set routemap BGP-OUT id 10 action metric value 200

On the other side:
Routing entry for 100.113.10.0/24
Known via "bgp", distance 20, metric 200, best
Last update 00:00:18 ago
* 10.144.82.150, via eth0, weight 1

And on CP I have them like this

Route: 10.144.12.0/23
Next Hop: 10.144.82.1, via eth1
MED: None
Local Preference: 100
Active Age: 5400
Age: 5192
Rank: 170
Weight: N/A
AS Path: (67000),64520,Incomplete.(Id-7),comm-1.1
Local AS: 67000
Peer AS: 64520
Origin: Incomplete
Originator ID: 192.168.170.2
BGP Next Hop Attribute: 10.144.82.1
Communities: 1:1

Route: 100.113.10.0/24
Next Hop: 10.144.70.100, via eth0
MED: None
Local Preference: 100
Active Age: 3448
Age: 3448
Rank: 170
Weight: N/A
AS Path: (67000),69000,Incomplete.(Id-8)
Local AS: 67000
Peer AS: 69000
Origin: Incomplete
Originator ID: 100.113.10.1
BGP Next Hop Attribute: 10.144.70.100

Still digging...

Re: BGP Filter and Advertising

the_rock — Tue, 28 Oct 2025 18:44:57 GMT

So which part is not working?

Re: BGP Filter and Advertising

melcu — Tue, 28 Oct 2025 18:47:44 GMT

The part where only community 1:1 is redistributed 🙂 not all of them.
There I have only two routes, but my customer has about 6500 ... and only 3 of them that are marked with 1:1 must be redistributed with a MED of 200 .

Re: BGP Filter and Advertising

the_rock — Tue, 28 Oct 2025 18:54:40 GMT

Do you have this line?

set routemap BGP-OUT id 10 match metric value 200

Re: BGP Filter and Advertising

melcu — Tue, 28 Oct 2025 18:58:25 GMT

The tiebreaker should be community 1:1

if route is received with community 1:1 (as in the above example with 10.144.12.0/23) then redistribute it to the upstream router.
if not (no community or other comunity) then don't redistribute it!
set bgp communities on
set routemap BGP-OUT id 10 on
set routemap BGP-OUT id 10 match community 1 as 1 on
set routemap BGP-OUT id 10 match community exact on
set routemap BGP-OUT id 10 action metric value 200
set bgp external remote-as 6900 export-routemap BGP-OUT preference 1 on

Re: BGP Filter and Advertising

the_rock — Tue, 28 Oct 2025 19:10:51 GMT

Maybe this?

set inbound-route-filter bgp-policy 1000 community-match 1 as 1 on

Re: BGP Filter and Advertising

melcu — Tue, 28 Oct 2025 19:13:03 GMT

I'm so stupid clicking on "Accept solution"!!!!
No, I don't want to filter inbound routes. From that peer I'm receiving all kind of routes with different community strings and other values.

I just want to export what is marked as community 1 as 1 but it seems that routemap redistributes everything, even the connected interface 🙂

B>* 10.144.12.0/23 [20/200] via 10.144.82.150, eth0, weight 1, 00:13:24
B>* 10.144.70.0/24 [20/200] via 10.144.82.150, eth0, weight 1, 00:13:24
B>* 100.113.10.0/24 [20/200] via 10.144.82.150, eth0, weight 1, 00:13:24

Re: BGP Filter and Advertising

Lari_Luoma — Tue, 28 Oct 2025 19:16:24 GMT

Also I don't have match protocol bgp as I assumed the source and target protocols are both BGP. You will need to match the protocol only if redistributing to a different protocol.

Use show bgp peer [ip] adj-rib-out to see what routes it's advertising.

Re: BGP Filter and Advertising

melcu — Tue, 28 Oct 2025 19:19:38 GMT

r82gwf> show bgp peer 10.144.82.151 adj-rib-out

---------------------- EBGP Peer 10.144.82.151 (AS 6900) -----------------------

IPv4 Route Nexthop
10.144.12.0/23 10.144.82.150
10.144.70.0/24 10.144.82.150
100.113.10.0/24 10.144.82.150

Everything. Something is wrong...I just can't figure out what.

Re: BGP Filter and Advertising

the_rock — Tue, 28 Oct 2025 19:21:10 GMT

Example from my lab...do you have line similar to it?

set routemap ospf-to-bgp-100 id 40 match protocol static

Re: BGP Filter and Advertising

melcu — Tue, 28 Oct 2025 19:22:27 GMT

No I don't as there's nothing 'static' here.

Re: BGP Filter and Advertising

the_rock — Tue, 28 Oct 2025 19:23:30 GMT

Its just an example, that command lets you put in different protocols.

Re: BGP Filter and Advertising

Lari_Luoma — Tue, 28 Oct 2025 19:24:28 GMT

Paste your route map here. Also verify that the routes have the community tag 1:1 as you want.

Re: BGP Filter and Advertising

melcu — Tue, 28 Oct 2025 19:27:21 GMT

Unfortunately in this case everything is BGP.

C redistributes to B via BGP
B redistributes to A via BGP

A and C being 3rd party and B being the CheckPoint firewall.

In can see the routes received from C one marked with 1:1 and the other without anything but for some unknown reason the routemap doesn't care about match community and just redistributes everything.

I can make it work by:
set route-redistribution to bgp-as 6900 community-match 1 as 1 on
set route-redistribution to bgp-as 6900 from bgp-as-number 64520 all-ipv4-routes on

but I need to have a different MED for 1:1 which is not achievable this way.

Re: BGP Filter and Advertising

melcu — Tue, 28 Oct 2025 19:29:39 GMT

set bgp communities on

set routemap BGP-OUT id 10 on
set routemap BGP-OUT id 10 match community 1 as 1 on
set routemap BGP-OUT id 10 match community exact on
set routemap BGP-OUT id 10 action metric value 200
set bgp external remote-as 6900 export-routemap BGP-OUT preference 1 on

r82gwf> show route bgp communities
Prefix Nexthop Communities

10.144.12.0/23 10.144.82.1 1:1

r82gwf> show route bgp detailed
Route: 10.144.12.0/23
Next Hop: 10.144.82.1, via eth1
MED: None
Local Preference: 100
Active Age: 8105
Age: 7897
Rank: 170
Weight: N/A
AS Path: (67000),64520,Incomplete.(Id-7),comm-1.1
Local AS: 67000
Peer AS: 64520
Origin: Incomplete
Originator ID: 192.168.170.2
BGP Next Hop Attribute: 10.144.82.1
Communities: 1:1

Route: 100.113.10.0/24
Next Hop: 10.144.70.100, via eth0
MED: None
Local Preference: 100
Active Age: 6153
Age: 6153
Rank: 170
Weight: N/A
AS Path: (67000),69000,Incomplete.(Id-8)
Local AS: 67000
Peer AS: 69000
Origin: Incomplete
Originator ID: 100.113.10.1
BGP Next Hop Attribute: 10.144.70.100

r82gwf>