What is the best way to redistribute all interfaces and Static routes into BGP?

[Austin_Ponten]

Hi, looking to optimize this BGP implementation for a customer, and I am doing this for the first time so I read these:

https://dl3.checkpoint.com/paid/f3/f313d7128484db88a73976b2d9e886ae/CP_R77.20.60_600_700_1100_1200R_...

https://support.checkpoint.com/results/sk/sk100501

https://community.checkpoint.com/t5/Security-Gateways/announcing-Routes-via-BGP/td-p/8154#

But I am having trouble understanding why my route maps and route-redistribution statements are not working and wondering if someone has a better guide to tell me how to simply advertise ALL connected interfaces and ALL static routes and I can work from there. 

So far I have tried SEVERAL variations of route maps but this is a general one:

set routemap bgp-inbound id 1 on

set routemap bgp-inbound id 1 allow

set routemap bgp-outbound id 1 on

set routemap bgp-outbound id 1 allow

set bgp external remote-as 65000 export-routemap bgp-outbound preference 1 on

set bgp external remote-as 65000 import-routemap bgp-inbound preference 1 on

set bgp internal import-routemap bgp-inbound preference 1 on

set bgp internal export-routemap bgp-outbound preference 1 on

set route-redistribution to bgp-as 65000 from interface all on

set route-redistribution to bgp-as 65000 from static-route all-ipv4-routes on

This 10.0.0.0/8 is the static route I would like to be distributed into BGP.

I dont see it advertised... 

What is the most optimal way to fix this? I don't want to advertise every single static route as per Lesley_Willems2 solution in https://community.checkpoint.com/t5/Security-Gateways/announcing-Routes-via-BGP/td-p/8154# 

Any help is appreciated, and Ill try to clarify things that I have overcomplicated 🙂

-A

[PhoneBoy]

Are you also redistributing kernel routes?
Pretty sure this is needed here.
See: https://sc1.checkpoint.com/documents/R81.10/WebAdminGuides/EN/CP_R81.10_Gaia_Advanced_Routing_AdminG... 

[JozkoMrkvicka · Accepted solution]

If you want to propagate ALL IPv4 directly connected interfaces AND also ALL IPv4 static routes:

set routemap bgp-outbound id 1 on
set routemap bgp-outbound id 1 allow
set routemap bgp-outbound id 1 match as 65000 on
set routemap bgp-outbound id 1 match protocol direct
set routemap bgp-outbound id 2 on
set routemap bgp-outbound id 2 allow
set routemap bgp-outbound id 2 match as 65000 on
set routemap bgp-outbound id 2 match protocol static
set bgp external remote-as 65000 export-routemap bgp-outbound preference 1 family inet on

Only static routes pointing to nexthop IP address of 0.0.0.0 (in your case only static route 10.0.0.0/8):

set routemap bgp-outbound id 1 on
set routemap bgp-outbound id 1 allow
set routemap bgp-outbound id 1 match as 65000 on
set routemap bgp-outbound id 1 match nexthop 0.0.0.0 on
set routemap bgp-outbound id 1 match protocol static
set bgp external remote-as 65000 export-routemap bgp-outbound preference 1 family inet on

Best practise is first restrict everything which is not desired to be propagated over BGP (sync, internal networks, default gateway, ...), and after that allow all what is really needed to be propagated.

[Austin_Ponten]

Wow, thanks for the detailed answer! 

I will test this and get back on the results when I have time.

-A

[Austin_Ponten]

Works right away!  Now I see what you mean by it advertises everything including the sync interface...

So should I then start with the restrictions like this? 

set routemap bgp-outbound id 1 on
set routemap bgp-outbound id 1 restrict
set routemap bgp-outbound id 1 match as 65000 on
set routemap bgp-outbound id 1 match interface Sync on

Thanks!