Step 1

Choose Devices > Device Management, and edit the threat defense device.

Step 2

Select Routing.

Step 3

(For a virtual-router-aware device) Under General Settings, click BGP.

Step 4

Check the Enable BGP check box to enable the BGP routing process.

Step 5

In the AS Number field, enter the autonomous system (AS) number for the BGP process. The AS number internally includes multiple autonomous numbers. The AS number can be from 1 to 4294967295 or from 1.0 to 65535.65535. The AS number is a uniquely assigned value, that identifies each network on the Internet.

Step 6

In the Router ID drop-down list, choose Automatic or Manual (appears for non-cluster and a cluster in spanned etherchannel mode) or Cluster Pool (appears for a cluster in individual interface mode). If you choose Automatic, the highest-level IP address on the threat defense device is used as the router ID. If you choose Manual, enter the IP address in the IP Address field. If you choose Cluster Pool, enter the cluster pool value in the Cluster Pool field. For information on creating the cluster pool address, see Address Pools.

Step 7

To use a fixed router ID, choose Manual and enter an IPv4 address in the IP Address field. The default value is Automatic. For a virtual router-aware device, you can override the router ID settings in the Virtual Routers > BGP page.

Step 8

(Optional) Edit the various BGP settings, starting with General. The defaults for these settings are appropriate in most cases, but you can adjust them to fit the needs of your network. Click Edit () to edit the settings in the group:

1. Enter a Scanning Interval for BGP routers for next-hop validation. Valid values are from 5 to 60 seconds. The default value is 60.

2. Enter the Number of AS numbers in AS_PATH attribute. An AS _PATH attribute is a sequence of intermediate AS numbers between source and destination routers that form a directed route for packets to travel. Valid values are between 1 and 254. The default value is None.

3. Check the Log Neighbor Changes check box to enable logging of BGP neighbor changes (up or down) and resets. This helps in troubleshooting network connectivity problems and measuring network stability. This is enabled by default.

4. Check the Use TCP Path MTU Discovery check box to use the Path MTU determining technique to determine the maximum transmission unit (MTU) size on the network path between two IP hosts. This avoids IP fragmentation. This is enabled by default.

5. Check the Reset session upon Failover check box to reset the external BGP session immediately upon link failure. This is enabled by default.

6. Check the Enforce that the first AS is peer’s AS for EBGP routes check box to discard incoming updates received from external BGP peers that do not list their AS number as the first segment in the AS_PATH attribute. This prevents a mis-configured or unauthorized peer from misdirecting traffic by advertising a route as if it was sourced from another autonomous system. This is enabled by default.

7. Check the Use dot notation for AS number check box to split the full binary 4-byte AS number into two words of 16 bits each, separated by a dot. AS numbers from 0-65553 are represented as decimal numbers and AS numbers larger than 65535 are represented using the dot notation. This is disabled by default.

8. Click OK.

Step 9

(Optional) Edit the Best Path Selection section:

1. Enter a value for Default Local Preference between 0 and 4294967295. The default value is 100. Higher values indicate higher preference. This preference is sent to all routers and access servers in the local autonomous system.

2. Check the Allow comparing MED from different neighbors check box to allow the comparison of Multi Exit Discriminator (MED) for paths from neighbors in different autonomous systems. This is disabled by default.

3. Check the Compare Router ID for identical EBGP paths check box to compare similar paths received from external BGP peers during the best path selection process and switch the best path to the route with the lowest router ID. This is disabled by default.

4. Check the Pick the best MED path among paths advertised from the neighboring AS check box to enable MED comparison among paths learned from confederation peers. The comparison between MEDs is made only if no external autonomous systems are there in the path. This is disabled by default.

5. Check the Treat missing MED as the least preferred one check box to consider the missing MED attribute as having a value of infinity, making the path the least desirable; therefore, a path with a missing MED is least preferred. This is disabled by default.

6. Click OK.

Step 10

(Optional) Edit the Neighbor Timers section:

1. Enter the time interval for which the BGP neighbor remains active after not sending a keepalive message in the Keep alive interval field. At the end of this keepalive interval, the BGP peer is declared dead, if no messages are sent. The default value is 60 seconds.

2. Enter the time interval for which the BGP neighbor remains active while a BGP connection is being initiated and configured in the Hold time field. The default value is 180 seconds. Specify a value from 0 to 65535.

3. (Optional) Enter the minimum time interval for which the BGP neighbor remains active while a BGP connection is being initiated and configured in the Min Hold time field. Specify a value from 3 to 65535.

   Note	A hold time of less than 20 seconds increases the possibility of peer flapping.

4. Click OK.

Step 11

In the Next Hop section, optionally select the Enable address tracking check box to enable BGP next hop address tracking and enter the Delay Interval between checks on updated next-hop routes installed in the routing table. Click OK.

Step 12

(Optional) Edit the Graceful Restart section:

1. Check the Enable Graceful Restart checkbox to enable threat defense peers to avoid a routing flap following a switchover.

2. Specify the time duration that threat defense peers will wait to delete stale routes before a BGP open message is received in the Restart Time field. The default value is 120 seconds. Valid values are between 1 and 3600 seconds.

3. Enter the time duration that the threat defense will wait before deleting stale routes after an end of record (EOR) message is received from the restarting threat defense in the Stalepath Time field. The default value is 360 seconds. Valid values are between 1 and 3600 seconds.

4. Click OK.

Step 13

Click Save.

Step 14

To view the BGP basic settings, from the virtual routers drop-down, select the desired router, and then click BGP.

Step 15

To edit the router ID settings, modify the IP address in the IP Address fields. The modified value overrides the router ID settings that were configured in the BGP page under General Settings.

Step 1

On the Device Management page, click Routing.

Step 2

(For a virtual-router-aware device) From the virtual routers drop-down, select the virtual router for which you are configuring BGP.

Step 3

Choose BGP > IPv4 or IPv6.

Step 4

Click General.

Step 5

In General, update the following sections:

1. In the Settings section, enter or select a Route Map object and click OK.

   Note	The Route Map field is applicable only to IPv4 settings.

2. In the Administrative Route Distances section, update the following as required, and click OK:

   • External — Enter the administrative distance for external BGP routes. Routes are external when learned from an external autonomous system. The range of values for this argument are from 1 to 255. The default value is 20.

   • Internal — Enter administrative distance for internal BGP routes. Routes are internal when learned from peer in the local autonomous system. The range of values for this argument are from 1 to 255. The default value is 200.

   • Local — Enter administrative distance for local BGP routes. Local routes are those networks listed with a network router show command, often as back doors, for the router or for the networks that is being redistributed from another process. The range of values for this argument are from 1 to 255. The default value is 200.

3. In the Routes and Synchronization section, update the following as required, and click OK:

   • (Optional) Generate default routes — Check the check box of this option to configure default-information originate.

   • (Optional) Summarize subnet routes into network-level routes — Check the check box of this to configure automatic summarization of subnet routes into network-level routes. This check box is applicable only to IPv4 settings.

   • (Optional) Advertise inactive routes — Check the check box of this to advertise routes that are not installed in the routing information base (RIB).

   • (Optional) Synchronize between BGP and IGP system — Check the check box of this to enable synchronization between BGP and your Interior Gateway Protocol (IGP) system. Usually, a BGP speaker does not advertise a route to an external neighbor unless that route is local or exists in the IGP. This feature allows routers and access servers within an autonomous system to have the route before BGP makes it available to other autonomous systems.

   • (Optional) Redistribute IBGP into IGP — Check the check box of this to configure iBGP redistribution into an interior gateway protocol (IGP), such as OSPF.

4. In the Forward Packets over Multiple Paths section, update the following as required and click OK:

   • (Optional) Number of Paths — Enter the maximum number of Border Gateway Protocol routes that can be installed in a routing table. The range of values are from 1 to 8. The default value is 1.

   • (Optional) IBGP Number of Paths — Enter the maximum number of parallel internal Border Gateway Protocol (iBGP) routes that can be installed in a routing table. The range of values are from 1 to 8. The default value is 1.

Step 6

Click Save.

Step 1

On the Device Management page, click Routing.

Step 2

(For a virtual-router-aware device) From the virtual routers drop-down, choose the virtual router for which you are configuring BGP.

Step 3

Choose BGP > IPv4 or IPv6.

Step 4

Click Neighbor.

Step 5

Click Add to define BGP neighbors and neighbor settings.

Step 6

Enter the BGP neighbor IP address. This IP address is added to the BGP neighbor table. When you are configuring BGP IPv6 on static VTI, enter the virtual tunnel IP address of the neighbor.

Step 7

Choose the BGP neighbor Interface.

Step 8

Enter the autonomous system to which the BGP neighbor belongs, in the Remote AS field.

Step 9

Check the Enabled address check box to enable communication with this BGP neighbor. Further neighbor settings will be configured only if the Enabled address check box is selected.

Step 10

(Optional) Check the Shutdown administratively check box to disable a neighbor or peer group.

Step 11

(Optional) Check the Configure graceful restart (failover / spanned mode) check box to enable configuration of the BGP graceful restart capability for this neighbor. After selecting this option, you must check the Enable graceful restart check box to specify whether graceful restart should be enabled or disabled for this neighbor.

Step 12

(Optional) To enable configuration of the BFD support for BGP, from the BFD Fallover drop-down list, choose the BFD type—single-hop, multi-hop, or auto-detect-hop. This selection registers the BGP neighbor to receive forwarding path detection failure messages from BFD. Choose None if you do not want to have BFD support.

Step 13

(Optional) Enter a Description for the BGP neighbor.

Step 14

(Optional) From the Update Sourcedrop-down list, choose an interface to source the BGP packets.

Step 15

(Optional) In Filtering Routes, use access lists, route maps, prefix lists and AS path filters as required, to distribute BGP Neighbor information. Update the following sections:

1. Choose or select the appropriate incoming or outgoing Access List to distribute BGP neighbor information.

   Note	Access lists are only applicable to IPv4 settings.

2. Choose or select the appropriate incoming or outgoing Route Maps to apply a route map to incoming or outgoing routes.

3. Choose or select the appropriate incoming or outgoing Prefix List to distribute BGP neighbor information.

4. Choose or select the appropriate incoming or outgoing AS path filter to distribute BGP neighbor information.

5. Check the check box of Limit the number of prefixes allowed from the neighbor to control the number of prefixes that can be received from a neighbor.

   • Enter the maximum number of prefixes allowed from a specific neighbor in the Maximum Prefixes field.

   • Enter the percentage (of maximum) at which the router starts to generate a warning message in the Threshold Level field. Valid values are integers between 1 and 100. The default value is 75.

6. Check the Control prefixes received from the peer check box to specify additional controls for the prefixes received from a peer. Do one of the following

   • Check the Terminate peering when prefix limit is exceeded check box to stop the BGP neighbor when the prefix limit is reached. Specify the interval after which the BGP neighbor will restart in the Restart interval field.

   • Check the Give only warning message when prefix limit is exceeded check box to generate a log message when the maximum prefix limit is exceeded. Here, the BGP neighbor will not be terminated.

7. Click OK.

Step 16

(Optional) In Routes, specify miscellaneous Neighbor route parameter. Proceed to update the following:

1. Enter the minimum interval (in seconds) between the sending of BGP routing updates in the Advertisement Interval field. Valid values are between 1 and 600.

2. Check the Remove private AS numbers from outbound routing updates check box to exclude the private AS numbers from being advertised on outbound routes.

3. Check the Generate default routes check box to allow the local router to send the default route 0.0.0.0 to a neighbor to use as a default route. Enter or Select the route map that allows the route 0.0.0.0 to be injected conditionally in the Route map field.

4. To add conditionally advertised routes, click Add Row +. In the Add Advertised Route dialog box, do the following:

   1. Add or choose a route map in the Advertise Map field, that will be advertised if the conditions of the exist map or the non-exist map are met.

   2. Click Exist Map and choose a route map from the Route Map Object Selector. This route map is compared with the routes in the BGP table, to determine whether the advertise map route is advertised.

   3. Click Non-Exist Map and choose a route map from the Route Map Object Selector. This route map is compared with the routes in the BGP table, to determine whether the advertise map route is advertised.

   4. Click OK.

Step 17

In Timers, check the Set timers for the BGP peer check box to set the keepalive frequency, hold time and minimum hold time

Step 18

In Advanced, update the following:

1. (Optional) Check the Enable Authentication check box to enable MD5 authentication on a TCP connection between two BGP peers.

   1. Choose an encryption type from the Enable Encryption drop-down list.

   2. Enter a password in the Password field. Reenter the password in the Confirm Password field. The password is case-sensitive and can be up to 25 characters long when the service password-encryption command is enabled and up to 81 characters long when the service password-encryption command is not enabled. The string can contain any alphanumeric characters, including spaces.

      Note	You cannot specify a password in the format number-space-anything. The space after the number can cause authentication to fail.

2. (Optional) Select the Send Community attribute to this neighbor check box to specify that communities attributes should be sent to the BGP neighbor

3. (Optional) Select the Use FTD as next hop for this neighbor check box to configure the router as the next-hop for a BGP speaking neighbor or peer group.

4. Select the Disable Connection Verification check box to disable the connection verification process for eBGP peering sessions that are reachable by a single hop but are configured on a loopback interface or otherwise configured with a non-directly connected IP address. When deselected (default), a BGP routing process will verify the connection of single-hop eBGP peering session (TTL=254) to determine if the eBGP peer is directly connected to the same network segment by default. If the peer is not directly connected to same network segment, connection verification will prevent the peering session from being established.

5. Select Allow connections with neighbor that is not directly connected to accept and attempt BGP connections to external peers residing on networks that are not directly connected. (Optional) Enter the time-to-live in the TTL hopsfield. Valid values are between 1 and 255. Alternately, select Limited number of TTL hops to neighbor, to secure a BGP peering session. Enter the maximum number of hops that separate eBGP peers in the TTL hops field. Valid values are between 1 and 254.

6. (Optional) Select the Use TCP MTU path discovery check box to enable a TCP transport session for a BGP session.

7. Choose the TCP connection mode from the TCP Transport Mode drop-down list. Options are Default, Active, or Passive.

8. (Optional) Enter a Weight for the BGP neighbor connection.

9. Select the BGP Version that threat defense will accept from the drop-down list. The version can be set to 4-Only to force the software to use only Version 4 with the specified neighbor. The default is to use Version 4 and dynamically negotiate down to Version 2 if requested.

Step 19

Update Migration, only if AS migration is considered.

1. (Optional) Check the Customize the AS number for routes received from the neighbor check box to customize the AS_PATH attribute for routes received from an eBGP neighbor.

2. Enter the local autonomous system number in the Local AS number field. Valid values are any valid autonomous system number from 1 to 4294967295 or 1.0 to 65535.65535.

3. (Optional) Check the Do not prepend local AS number to routes received from neighbor check box to prevent the local AS number from being prepended to any routes received from eBGP peer.

4. (Optional) Check the Replace real AS number with local AS number in routes received from neighbor check box to replace the real autonomous system number with the local autonomous system number in the eBGP updates. The autonomous system number from the local BGP routing process is not prepended.

5. (Optional) Check the Accept either real AS number or local AS number in routesreceived from neighbor check box to configure the eBGP neighbor to establish a peering session using the real autonomous system number (from the local BGP routing process) or by using the local autonomous system number.

Step 20

Click OK.

Step 21

Click Save.

Step 1

When editing the threat defense device, click Routing.

Step 2

(For a virtual-router-aware device) From the virtual routers drop-down, choose the virtual router for which you are configuring BGP.

Step 3

Choose BGP > IPv4 or IPv6.

Step 4

Click Add Aggregate Address.

Step 5

Enter a value for the aggregate timer (in seconds) in the Aggregate Timer field. Valid values are 0 or any value between 6 and 60. The default value is 30.

Step 6

Click ()Add and update the Add Aggregate Address dialog box:

1. Network — Enter an IPv4 address or select the desired network/hosts objects.

2. Attribute Map — (Optional) Enter or select the route map used to set the attribute of the aggregate route.

3. Advertise Map — (Optional) Enter or select the route map used to select the routes to create AS_SET origin communities.

4. Suppress Map — (Optional) Enter or select the route map used to select the routes to be suppressed.

5. Generate AS set path Information — (Optional) Check the check box to enable generation of autonomous system set path information.

6. Filter all routes from updates — (Optional) Check the check box to filter all more-specific routes from updates.

7. Click OK.

Step 1

On the Device Management page, click Routing.

Step 2

(For a virtual-router-aware device) From the virtual routers drop-down, choose the virtual router for which you are configuring BGP.

Step 3

Choose BGP > IPv4.

Step 4

Click Filtering.

Step 5

Click ()Add and update the Add Filter dialog box:

1. Access List— Choose an access control list that defines which networks are to be received and which are to be suppressed in routing updates.

2. Direction— (Optional) Choose a direction that specifies if the filter should be applied to inbound updates or outbound updates.

3. Protocol— (Optional) Choose the routing process for which you want to filter: None, BGP, Connected, OSPF, RIP, or Static.

4. Process ID— (Optional) Enter the process ID for the OSPF routing protocol.

5. Click OK.

Step 6

Click Save.

Step 1

On the Device Management page, click Routing.

Step 2

(For a virtual-router-aware device) From the virtual routers drop-down, choose the virtual router for which you are configuring BGP.

Step 3

Choose BGP > IPv4 or IPv6.

Step 4

Click Networks.

Step 5

Click Add and update the Add Networks dialog box:

1. Network— Choose the network to be advertised by the BGP routing processes.

   Note	For a network prefix to be advertised, a route to the device must exist on the routing table.

   To add a new network object, see Creating Network Objects.

2. (Optional) Route Map— Enter or choose a route map that should be examined to filter the networks to be advertised. If not specified, all networks are redistributed. To add a new route map object, see Route Map.

3. Click OK.

Step 6

Click Save.

Step 1

On the Device Management page, click Routing.

Step 2

(For a virtual-router-aware device) From the virtual routers drop-down, choose the virtual router for which you are configuring BGP.

Step 3

Choose BGP > IPv4 or IPv6.

Step 4

Click Redistribution.

Step 5

Click Add and update the Add Redistribution dialog:

1. Source Protocol— Select the protocol from which you want to redistribute routes into the BGP domain from the Source Protocol drop-down list.

   Note	User-defined virtual routers does not support redistributing traffic from RIP.

2. Process ID— Enter the identifier for the selected source protocol. Applies to the OSPF protocol. For devices using virtual routing, this drop-down lists the process ID assigned for the virtual router for which you are configuring the BGP settings.

3. Metric— (Optional) Enter a metric for the redistributed route.

4. Route Map— Enter or select a route map that should be examined to filter the networks to be redistributed. If not specified, all networks are redistributed. To create a new route map object, click Add (). See Configure Route Map Entry for the procedure to add a new route map.

5. Match— The conditions used for redistributing routes from one routing protocol to another. The routes must match the selected condition to be redistributed. You can choose one or more of the following match conditions. These options are enabled only when OSPF is chosen as the Source Protocol.

   • Internal

   • External 1

   • External 2

   • NSSA External 1

   • NSSA External 2

6. Click OK.

Step 1

On the Device Management page, click Routing.

Step 2

(For a virtual-router-aware device) From the virtual routers drop-down, choose the virtual router for which you are configuring BGP.

Step 3

Choose BGP > IPv4 or IPv6.

Step 4

Click Route Injection.

Step 5

Click Add and update the Add Route Injection dialog box:

1. Inject Map— Enter or select the route map that specifies the prefixes to inject into the local BGP routing table. To create a new route map object, click Add (). For the procedure to add a new route map, see Configure Route Map Entry.

2. Exist Map— Enter or select the route map containing the prefixes that the BGP speaker will track.

3. Injected routes will inherit the attributes of the aggregate route— Check this box to configure the injected route to inherit attributes of the aggregate route.

4. Click OK.

Step 6

Click Save.

Step 1

On the Device Management page, click Routing.

Step 2

(For a virtual-router-aware device) From the virtual routers drop-down, choose the virtual router for which you are configuring BGP.

Step 3

Choose BGP > IPv4 or IPv6.

Step 4

(Supported only for only virtual routers) Click Route Import/Export.

Step 5

In the Route Targets Import field, enter the route target extended community that you want to match for the routes to be imported. On deployment, the routes of the destination virtual router that matches this value is imported to the source virtual router's BGP table.

Step 6

In the Route Targets Export field, enter the route target extended community to tag the source virtual router's routes with the route target value. On deployment, the routes of the source virtual router are tagged with this value.

Step 7

Route maps help you to narrow down the routes to be shared instead of leaking the entire routing table. Route map filtering is applied on the list of routes that are obtained with the specified route target values:

1. (Optional) Under User Virtual Router, choose the route map from the Import Route Map drop-down list to filter the routes at the destination virtual router.

   Note	The user virtual router import route map is effective only when the route targets import is configured.

2. (Optional) Under User Virtual Router, choose the route map from the Export Route Map drop-down list to filter the routes at the source virtual router before the routes are exported to other virtual routers.

   Note	You can use the match and set clauses in the route map with the route target extended community lists for filtering based on other criteria or tagging the routes with the route target community values. For more information, see Route Map.

Step 8

To share the routes between a user-defined virtual router and global virtual router, specify the route map under the Global Virtual Router:

1. To leak the global virtual router routes to the user-defined virtual router, select the route map from the Import Route Map drop-down list. The IPv4 or IPv6 route map is imported to the user-defined virtual router.

2. To leak the user-defined virtual router routes to the global virtual router, select the route map from the Export Route Map drop-down list. The IPv4 or IPv6 route map is exported to the global virtual router.

   Note	You must specify the route targets for export apart from specifying the route map.

Step 9

Follow the procedure ( Step 3 to Step 8) to configure relevant BGP route import and export settings for other virtual routers as well.

Step 10

Click Save and Deploy.