Jump to content

BGP настройка

proftp666
 Share

Recommended Posts

proftp666

proftp666

Posted
Posted

Здравствуйте.

Подскажите пожалуйста. Я поднял BGP с клиентом, он анонсировал мне сеть. Теперь мне ему надо свой дефолт отдать. Как это делается?

Спасибо.

VolanD666

VolanD666

Posted
Posted
В 18.02.2022 в 12:47, proftp666 сказал:

Здравствуйте.

Подскажите пожалуйста. Я поднял BGP с клиентом, он анонсировал мне сеть. Теперь мне ему надо свой дефолт отдать. Как это делается?

Спасибо.

redistribute-static ?

proftp666

proftp666

Posted
  • Author
Posted

# jan/03/1970 21:29:57 by RouterOS 7.1.2
# software id = ZSVN-68Q7
#
# model = RB2011UiAS
# serial number = E1480D2D02D5
/interface bridge
add admin-mac=08:55:31:7D:18:00 auto-mac=no comment=defconf name=bridge
add name=bridge114
/interface vlan
add interface=ether1 name=vlan114 vlan-id=114
/interface list
add comment=defconf name=WAN
add comment=defconf name=LAN
/interface lte apn
set [ find default=yes ] ip-type=ipv4
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
/ip pool
add name=default-dhcp ranges=192.168.88.10-192.168.88.254
/ip dhcp-server
add address-pool=default-dhcp interface=bridge name=defconf
/port
set 0 name=serial0
/routing bgp template
add as=203481 disabled=no name=temp1 router-id=46.255.239.250
/routing ospf instance
add name=default-v2 redistribute=connected,static,vpn,dhcp,modem router-id=\
    46.255.239.250
/routing ospf area
add instance=default-v2 name=backbone-v2
/routing rip instance
add name=rip-instance-4 route-gc-timeout=120 route-timeout=180 routing-table=\
    main update-interval=30
/interface bridge port
add comment=defconf ingress-filtering=no interface=ether2
add bridge=bridge comment=defconf ingress-filtering=no interface=ether3
add bridge=bridge comment=defconf ingress-filtering=no interface=ether4
add bridge=bridge114 comment=defconf ingress-filtering=no interface=ether5 \
    pvid=114
add bridge=bridge114 comment=defconf ingress-filtering=no interface=ether6
add bridge=bridge comment=defconf ingress-filtering=no interface=ether7
add bridge=bridge comment=defconf ingress-filtering=no interface=ether8
add bridge=bridge114 comment=defconf ingress-filtering=no interface=ether9
add bridge=bridge comment=defconf ingress-filtering=no interface=ether10
add bridge=bridge comment=defconf ingress-filtering=no interface=sfp1
add bridge=bridge114 ingress-filtering=no interface=ether1
add bridge=bridge114 ingress-filtering=no interface=vlan114
add ingress-filtering=no interface=*12
/ip neighbor discovery-settings
set discover-interface-list=LAN
/ip settings
set max-neighbor-entries=8192
/ipv6 settings
set disable-ipv6=yes max-neighbor-entries=8192
/interface detect-internet
set detect-interface-list=all
/interface list member
add comment=defconf interface=bridge list=LAN
add comment=defconf interface=ether1 list=WAN
/ip address
add address=192.168.88.1/24 comment=defconf interface=bridge network=\
    192.168.88.0
add address=92.47.161.2/30 interface=bridge114 network=92.47.161.0
add address=46.8.108.1/24 interface=bridge114 network=46.8.108.0
add address=46.255.239.250/30 interface=bridge114 network=46.255.239.248
/ip dhcp-client
# DHCP client can not run on slave interface!
add comment=defconf interface=ether1
/ip dhcp-server network
add address=192.168.88.0/24 comment=defconf gateway=192.168.88.1
/ip dns
set allow-remote-requests=yes
/ip dns static
add address=192.168.88.1 comment=defconf name=router.lan
/ip firewall address-list
add address=46.255.239.248/30 list=bgp-networks
/ip firewall filter
add action=accept chain=input comment=\
    "defconf: accept established,related,untracked" connection-state=\
    established,related,untracked disabled=yes
add action=drop chain=input comment="defconf: drop invalid" connection-state=\
    invalid disabled=yes
add action=accept chain=input comment="defconf: accept ICMP" disabled=yes \
    protocol=icmp
add action=accept chain=input comment=\
    "defconf: accept to local loopback (for CAPsMAN)" disabled=yes \
    dst-address=127.0.0.1
add action=drop chain=input comment="defconf: drop all not coming from LAN" \
    disabled=yes in-interface-list=!LAN
add action=accept chain=forward comment="defconf: accept in ipsec policy" \
    disabled=yes ipsec-policy=in,ipsec
add action=accept chain=forward comment="defconf: accept out ipsec policy" \
    disabled=yes ipsec-policy=out,ipsec
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" \
    connection-state=established,related disabled=yes hw-offload=yes
add action=accept chain=forward comment=\
    "defconf: accept established,related, untracked" connection-state=\
    established,related,untracked disabled=yes
add action=drop chain=forward comment="defconf: drop invalid" \
    connection-state=invalid disabled=yes
add action=drop chain=forward comment=\
    "defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat \
    connection-state=new disabled=yes in-interface-list=WAN
/ip firewall nat
add action=masquerade chain=srcnat comment="defconf: masquerade" \
    ipsec-policy=out,none out-interface-list=WAN
/ip route
add disabled=no dst-address=0.0.0.0/0 gateway=92.47.161.1
/ip service
set telnet disabled=yes
set ftp disabled=yes
set www disabled=yes
set ssh disabled=yes
set api disabled=yes
set winbox address=46.8.252.0/23,192.168.93.0/24,10.60.0.0/22,192.168.88.0/24
set api-ssl disabled=yes
/routing bgp connection
add as=203481 cisco-vpls-nlri-len-fmt=auto-bits connect=yes disabled=no \
    listen=yes local.address=46.255.239.250 .role=ebgp-rs multihop=yes name=\
    peer1 output.network=bgp-networks .redistribute=\
    connected,static,ospf,vpn,dhcp remote.address=46.255.239.249/32 .as=43873 \
    .port=179 router-id=46.255.239.250 routing-table=main templates=temp1
/routing filter rule
add chain=AS4383-bgp-in disabled=yes rule=\
    "if (dst == 10.0.0.0/8) { reject; }"
add chain=AS4383-bgp-in disabled=yes rule=\
    "if (dst == 192.168.0.0/16) { reject; }"
add chain=AS4383-bgp-in disabled=yes rule=\
    "if (dst == 172.16.0.0/12) { reject; }"
add chain=AS4383-bgp-in disabled=yes rule=\
    "if (dst == 169.254.0.0/16) { reject; }"
add chain=AS4383-bgp-in disabled=yes rule=\
    "if (dst == 224.0.0.0/4) { reject; }"
add chain=AS4383-bgp-in disabled=yes rule=\
    "if (dst == 127.0.0.0/8) { reject; }"
add chain=AS4383-bgp-in disabled=yes rule=\
    "if (dst == 46.255.239.248/30) { reject; }"
add chain=AS4383-bgp-out disabled=yes rule=\
    "if (dst == 46.255.239.248/30) { accept; }"
add chain=AS4383-bgp-in disabled=yes rule="reject;"
add chain=AS4383-bgp-out disabled=yes rule="reject;"
/routing ospf interface-template
add area=backbone-v2 interfaces=bridge networks=192.168.88.0/24 priority=1
add area=backbone-v2 interfaces=bridge114 networks=92.47.161.0/30 priority=1
add area=backbone-v2 interfaces=bridge114 networks=46.8.108.0/24 priority=1
add area=backbone-v2 interfaces=bridge114 networks=46.255.239.248/30 \
    priority=1
/system clock
set time-zone-name=Asia/Almaty
/system identity
set name=ESHDI
/tool mac-server
set allowed-interface-list=LAN
/tool mac-server mac-winbox
set allowed-interface-list=LAN

 

 

вот весь конфиг, все вроде по инструкции прописанно

proftp666

proftp666

Posted
  • Author
Posted
В 20.02.2022 в 15:38, VolanD666 сказал:

Эта команда что говорит?

[admin@ESHDI] > /routing bgp connection print
Flags: D - dynamic, X - disabled, I - inactive
 0   name="peer1"
     remote.address=46.255.239.249/32 .port=179 .as=43873
     local.address=46.255.239.250 .role=ebgp-rs
     connect=yes listen=yes routing-table=main router-id=46.255.239.250 templates=temp1 as=203481 multihop=yes cisco-vpls-nlri-len-fmt=auto-bits
     output.redistribute=connected,static,ospf,vpn,dhcp .network=bgp-networks

 

микротик 7 версии

proftp666

proftp666

Posted
  • Author
Posted

откатил на старую версию микротик.

[admin@ESHDI] > routing bgp advertisements print
PEER     PREFIX               NEXTHOP          AS-PATH                                              ORIGIN     LOCAL-PREF
peer1    92.47.161.0/30       46.255.239.250                                                        incomplete
peer1    46.8.108.0/24        46.255.239.250                                                        incomplete
peer1    192.168.88.0/24      46.255.239.250                                                        incomplete
peer1    46.255.239.248/30    46.255.239.250                                                        igp       

 

VolanD666

VolanD666

Posted
Posted
В 20.02.2022 в 14:27, proftp666 сказал:

откатил на старую версию микротик.

конфигурация не изменилась?

 

Вот этот маршрут:

 

Цитата

/ip route
add disabled=no dst-address=0.0.0.0/0 gateway=92.47.161.1

У вас в таблице маршрутизации точно есть?

proftp666

proftp666

Posted
  • Author
Posted

вроде нет

 

config.rsc

 

есть

 #      DST-ADDRESS        PREF-SRC        GATEWAY            DISTANCE
 0 A S  0.0.0.0/0                          92.47.161.1               1
 1 ADC  46.8.108.0/24      46.8.108.1      bridge114                 0
 2 ADb  46.255.239.0/24                    46.255.239.249           20
 3 ADb  46.255.239.12/30                   46.255.239.249           20
 4 ADC  46.255.239.248/30  46.255.239.250  bridge114                 0
 5 ADC  92.47.161.0/30     92.47.161.2     bridge114                 0
 6 ADC  192.168.88.0/24    192.168.88.1    bridge                    0

 

 

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Guest
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.

×
 Share
Go to topic listing
×
×
  • Create New...
На сайте используются файлы cookie и сервисы аналитики для корректной работы форума и улучшения качества обслуживания. Продолжая использовать сайт, вы соглашаетесь с использованием файлов cookie и с Политикой конфиденциальности.