Peer templates in Cisco IOS
When you peer with lots of neighbors (as you should!) your bgp config in IOS is normally one of two things
- A spaghetti mess, lots of neighbors for the same remote-as, where you may unintentionally peer with the same organisation via different policies at different points
- Well organised, using peer groups.
Ok, so those are the opposite examples, but they don’t sit beyond the realms of possibility. I don’t like peer-groups because I don’t think they’re all that readable, and they are also not so scalable.
In steps the new way:peer templates. These are wonderful and allow you to put together a cascading peering policy for your routers. Templates support inheritance, so I can define in my router a global peering policy that I want every peer to have, and also a transit neighbor policy. Then you can define a template for each of your peered networks which inherits the global rules. Then the neighbor statement inherits the correct template for their AS.
In effect, you have global rules –> rules for a subset of networks –> rules for an AS –> a neighbor command.
To show the template system in action, this is what a peering session with the Cymru route-servers looks like using templates
router bgp 12345
template peer-session bogon-rs
remote-as 65333
description Peering with Team Cymru Bogons rs
password 7 094E176fakepassword271F
ebgp-multihop 255
exit-peer-session
!
no synchronization
bgp log-neighbor-changes
neighbor 194.109.21.101 inherit peer-session bogon-rs
neighbor 194.109.21.101 route-map CYMRUBOGONS in
neighbor 195.214.201.38 inherit peer-session bogon-rs
neighbor 195.214.201.38 route-map CYMRUBOGONS in
Global rules for the AS can be defined in just one place, so if I wanted to vary the max-prefix for an AS at every point where we meet, there is only one place to change the config. To use inheritance in the template peer-session section, use ‘inherit peer-session parent’ inside the ‘template peer-session’ section.
No more ugly, hard to read peer-groups.
Leave a Comment
Comments
Leave a Reply
You must be logged in to post a comment.