Difference between revisions of "IPv6: Mikrotik: BGP Example"
Jump to navigation
Jump to search
Onnowpurbo (talk | contribs) |
Onnowpurbo (talk | contribs) |
||
| Line 124: | Line 124: | ||
routing filter add chain=IN-RFC-6890-IPv6 prefix=fe80::/10 action=discard | routing filter add chain=IN-RFC-6890-IPv6 prefix=fe80::/10 action=discard | ||
| − | ==Buat BGP egress | + | ==Buat BGP egress Filter== |
| − | Egress | + | Egress filter digunakan untuk mem-filter advertisement dari jaringan kita, membatasi agar hanya meng-advertise jaringan lokal yang spesifik. Parameter invert-match=yes , ini menginstruksikan filter agar membuang semua kecuali prefix yang kita inginkan. |
| − | + | routing filter add chain=OUT-IPv4 prefix=199.2.2.0/24 invert-match=yes action=discard | |
| − | + | routing filter add chain=OUT-IPv6 prefix=2a99:2:2::/48 invert-match=yes action=discard | |
| − | |||
==Tambahkan BGP Peer== | ==Tambahkan BGP Peer== | ||
Revision as of 09:18, 5 April 2019
Sumber: http://www.obriain.com/mikrotik/mikrotik-ISP2-configuration.html
Enable IPv6
Default IPv6 di disable. Cek melalui,
/system package print
Flags: X - disabled # NAME VERSION SCHEDULED 0 routeros-x86 6.45beta27 1 system 6.45beta27 2 X ipv6 6.45beta27 3 ups 6.45beta27 4 wireless 6.45beta27 5 hotspot 6.45beta27 6 mpls 6.45beta27 7 routing 6.45beta27 8 ppp 6.45beta27 9 dhcp 6.45beta27 10 security 6.45beta27 11 advanced-tools 6.45beta27 12 dude 6.45beta27
Enable
/system package enable 2 /system reset-configuration no-defaults=yes
Set system identity
/system identity set name=ISP2
IP addressing
Menambahkan IP address ke interface.
/interface bridge add name=loopback0 /ip address add address=200.2.2.2/32 interface=loopback0 /ip address add address=199.9.9.22/24 interface=ether1 /ipv6 address add address=2a99:9:9::22/48 interface=ether1 /ip address add address=199.2.2.1/24 interface=ether2 /ipv6 address add address=2a99:2:2::1/48 interface=ether2
/ip address print
Flags: X - disabled, I - invalid, D - dynamic # ADDRESS NETWORK INTERFACE 0 200.2.2.2/32 200.2.2.2 loopback0 1 199.9.9.22/24 199.9.9.0 ether1 2 199.2.2.1/24 199.2.2.0 ether2
/ipv6 address print
Flags: X - disabled, I - invalid, D - dynamic, G - global, L - link-local # ADDRESS FROM-... INTERFACE ADV 0 IG 2a99:9:9::22/48 ether1 no 1 IG 2a99:2:2::1/48 ether2 no 2 DL fe80::c18:64ff:fe7e:e1f1/64 loopback0 no
BGP Configuration
/routing bgp instance add name=ASN5222 as=5222 router-id=200.2.2.2 /routing bgp network add network=199.2.2.0/24 /routing bgp network add network=2a99:2:2::/48 /routing bgp peer add name=toISP1 remote-address=192.168.3.1 remote-as=10 address-families=ip,ipv6 add name=toISP3 remote-address=192.168.2.2 remote-as=30 address-families=ip,ipv6 add name=toISP1 remote-address=2001:192:168:3::1 remote-as=10 address-families=ip,ipv6 add name=toISP3 remote-address=2001:192:168:2::2 remote-as=30 address-families=ip,ipv6
Buat BGP ingress Filter
Ingress Filter digunakan untuk memfilter advertisement ke dalam jaringan. Best practice untuk ingress filter untuk semua peer adalah:
- Buang jika prefix yang di terima adalah milik sendiri.
- Buang rute default yang kita terima, jika kita melakukan full routing.
- Buang entri address tujuan khusus yang dinyatakan di RFC 6890.
Chain IN-IXP-IPv4 adalah sebuah input filter dan dia akan membuang prefix diri sendiri atau route default jika menerima-nya karena kita melakukan full routing. Filter ini akan jump ke chain selanjutnya, yaitu, chain IN-RFC-6890-IPv4 yang akan membuang IPv4 Special-Purpose Address Registry Entries yang di jelaskan di RFC 6890.
routing filter add chain=IN-IXP-IPv4 prefix=199.2.2.0/24 action=discard routing filter add chain=IN-IXP-IPv4 prefix=0.0.0.0/0 action=discard routing filter add chain=IN-IXP-IPv4 action=jump jump-target=IN-RFC-6890-IPv4 routing filter add chain=IN-RFC-6890-IPv4 prefix=0.0.0.0/8 action=discard routing filter add chain=IN-RFC-6890-IPv4 prefix=10.0.0.0/8 action=discard routing filter add chain=IN-RFC-6890-IPv4 prefix=100.64.0.0/10 action=discard routing filter add chain=IN-RFC-6890-IPv4 prefix=127.0.0.0/8 action=discard routing filter add chain=IN-RFC-6890-IPv4 prefix=169.254.0.0/16 action=discard routing filter add chain=IN-RFC-6890-IPv4 prefix=172.16.0.0/12 action=discard routing filter add chain=IN-RFC-6890-IPv4 prefix=192.0.2.0/24 action=discard routing filter add chain=IN-RFC-6890-IPv4 prefix=192.88.99.0/24 action=discard routing filter add chain=IN-RFC-6890-IPv4 prefix=192.168.0.0/16 action=discard routing filter add chain=IN-RFC-6890-IPv4 prefix=198.18.0.0/15 action=discard routing filter add chain=IN-RFC-6890-IPv4 prefix=198.51.100.0/24 action=discard routing filter add chain=IN-RFC-6890-IPv4 prefix=203.0.113.0/24 action=discard routing filter add chain=IN-RFC-6890-IPv4 prefix=240.0.0.0/4 action=discard routing filter add chain=IN-RFC-6890-IPv4 prefix=255.255.255.255/32 action=discard
Chain IN-IXP-IPv6 adalah input filter dan dia akan membuang prefix diri sendiri atau route default jika menerima-nya karena kita melakukan full routing. Filter ini akan jump ke chain selanjutnya, yaitu, chain IN-RFC-6890-IPv6 yang akan membuang IPv6 Special-Purpose Address Registry Entries yang di jelaskan di RFC 6890.
routing filter add chain=IN-IXP-IPv6 prefix=2a99:2:2::/48 action=discard routing filter add chain=IN-IXP-IPv6 prefix=::/0 action=discard routing filter add chain=IN-IXP-IPv6 action=jump jump-target=IN-RFC-6890-IPv6 routing filter add chain=IN-RFC-6890-IPv6 prefix=::1/128 action=discard routing filter add chain=IN-RFC-6890-IPv6 prefix=::/128 action=discard routing filter add chain=IN-RFC-6890-IPv6 prefix=64:ff9b::/96 action=discard routing filter add chain=IN-RFC-6890-IPv6 prefix=::ffff:0:0/96 action=discard routing filter add chain=IN-RFC-6890-IPv6 prefix=100::/64 action=discard routing filter add chain=IN-RFC-6890-IPv6 prefix=2001::/23 action=discard routing filter add chain=IN-RFC-6890-IPv6 prefix=2001::/32 action=discard routing filter add chain=IN-RFC-6890-IPv6 prefix=2001:2::/48 action=discard routing filter add chain=IN-RFC-6890-IPv6 prefix=2001:db8::/32 action=discard routing filter add chain=IN-RFC-6890-IPv6 prefix=2001:10::/28 action=discard routing filter add chain=IN-RFC-6890-IPv6 prefix=2002::/16 action=discard routing filter add chain=IN-RFC-6890-IPv6 prefix=fc00::/7 action=discard routing filter add chain=IN-RFC-6890-IPv6 prefix=fe80::/10 action=discard
Buat BGP egress Filter
Egress filter digunakan untuk mem-filter advertisement dari jaringan kita, membatasi agar hanya meng-advertise jaringan lokal yang spesifik. Parameter invert-match=yes , ini menginstruksikan filter agar membuang semua kecuali prefix yang kita inginkan.
routing filter add chain=OUT-IPv4 prefix=199.2.2.0/24 invert-match=yes action=discard routing filter add chain=OUT-IPv6 prefix=2a99:2:2::/48 invert-match=yes action=discard
Tambahkan BGP Peer
Create the peer links to the other BGP peers for IPv4 and IPv6. Note that IPv4 family is the default and for IPv6 the family must be specified.
routing bgp peer add name=ixp instance=ASN5222 remote-as=5999 remote-address=199.9.9.1 in-filter=IN-IXP-IPv4 out-filter=OUT-IPv4 routing bgp peer add name=ixp instance=ASN5222 remote-as=5999 remote-address=2a99:9:9::1 address-families=ipv6 in-filter=IN-IXP-IPv6 out-filter=OUT-IPv6
Referensi
Pranala Menarik