Jump to content
Калькуляторы

BGP настройка

Reply to this topic

proftp666   

proftp666
Posted

Здравствуйте.

Подскажите пожалуйста. Я поднял BGP с клиентом, он анонсировал мне сеть. Теперь мне ему надо свой дефолт отдать. Как это делается?

Спасибо.

Share this post

Link to post
Share on other sites

VolanD666   

VolanD666
Posted
В 18.02.2022 в 12:47, proftp666 сказал:

Здравствуйте.

Подскажите пожалуйста. Я поднял BGP с клиентом, он анонсировал мне сеть. Теперь мне ему надо свой дефолт отдать. Как это делается?

Спасибо.

redistribute-static ?

Share this post

Link to post
Share on other sites

proftp666   

proftp666
Posted

# jan/03/1970 21:29:57 by RouterOS 7.1.2
# software id = ZSVN-68Q7
#
# model = RB2011UiAS
# serial number = E1480D2D02D5
/interface bridge
add admin-mac=08:55:31:7D:18:00 auto-mac=no comment=defconf name=bridge
add name=bridge114
/interface vlan
add interface=ether1 name=vlan114 vlan-id=114
/interface list
add comment=defconf name=WAN
add comment=defconf name=LAN
/interface lte apn
set [ find default=yes ] ip-type=ipv4
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
/ip pool
add name=default-dhcp ranges=192.168.88.10-192.168.88.254
/ip dhcp-server
add address-pool=default-dhcp interface=bridge name=defconf
/port
set 0 name=serial0
/routing bgp template
add as=203481 disabled=no name=temp1 router-id=46.255.239.250
/routing ospf instance
add name=default-v2 redistribute=connected,static,vpn,dhcp,modem router-id=\
    46.255.239.250
/routing ospf area
add instance=default-v2 name=backbone-v2
/routing rip instance
add name=rip-instance-4 route-gc-timeout=120 route-timeout=180 routing-table=\
    main update-interval=30
/interface bridge port
add comment=defconf ingress-filtering=no interface=ether2
add bridge=bridge comment=defconf ingress-filtering=no interface=ether3
add bridge=bridge comment=defconf ingress-filtering=no interface=ether4
add bridge=bridge114 comment=defconf ingress-filtering=no interface=ether5 \
    pvid=114
add bridge=bridge114 comment=defconf ingress-filtering=no interface=ether6
add bridge=bridge comment=defconf ingress-filtering=no interface=ether7
add bridge=bridge comment=defconf ingress-filtering=no interface=ether8
add bridge=bridge114 comment=defconf ingress-filtering=no interface=ether9
add bridge=bridge comment=defconf ingress-filtering=no interface=ether10
add bridge=bridge comment=defconf ingress-filtering=no interface=sfp1
add bridge=bridge114 ingress-filtering=no interface=ether1
add bridge=bridge114 ingress-filtering=no interface=vlan114
add ingress-filtering=no interface=*12
/ip neighbor discovery-settings
set discover-interface-list=LAN
/ip settings
set max-neighbor-entries=8192
/ipv6 settings
set disable-ipv6=yes max-neighbor-entries=8192
/interface detect-internet
set detect-interface-list=all
/interface list member
add comment=defconf interface=bridge list=LAN
add comment=defconf interface=ether1 list=WAN
/ip address
add address=192.168.88.1/24 comment=defconf interface=bridge network=\
    192.168.88.0
add address=92.47.161.2/30 interface=bridge114 network=92.47.161.0
add address=46.8.108.1/24 interface=bridge114 network=46.8.108.0
add address=46.255.239.250/30 interface=bridge114 network=46.255.239.248
/ip dhcp-client
# DHCP client can not run on slave interface!
add comment=defconf interface=ether1
/ip dhcp-server network
add address=192.168.88.0/24 comment=defconf gateway=192.168.88.1
/ip dns
set allow-remote-requests=yes
/ip dns static
add address=192.168.88.1 comment=defconf name=router.lan
/ip firewall address-list
add address=46.255.239.248/30 list=bgp-networks
/ip firewall filter
add action=accept chain=input comment=\
    "defconf: accept established,related,untracked" connection-state=\
    established,related,untracked disabled=yes
add action=drop chain=input comment="defconf: drop invalid" connection-state=\
    invalid disabled=yes
add action=accept chain=input comment="defconf: accept ICMP" disabled=yes \
    protocol=icmp
add action=accept chain=input comment=\
    "defconf: accept to local loopback (for CAPsMAN)" disabled=yes \
    dst-address=127.0.0.1
add action=drop chain=input comment="defconf: drop all not coming from LAN" \
    disabled=yes in-interface-list=!LAN
add action=accept chain=forward comment="defconf: accept in ipsec policy" \
    disabled=yes ipsec-policy=in,ipsec
add action=accept chain=forward comment="defconf: accept out ipsec policy" \
    disabled=yes ipsec-policy=out,ipsec
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" \
    connection-state=established,related disabled=yes hw-offload=yes
add action=accept chain=forward comment=\
    "defconf: accept established,related, untracked" connection-state=\
    established,related,untracked disabled=yes
add action=drop chain=forward comment="defconf: drop invalid" \
    connection-state=invalid disabled=yes
add action=drop chain=forward comment=\
    "defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat \
    connection-state=new disabled=yes in-interface-list=WAN
/ip firewall nat
add action=masquerade chain=srcnat comment="defconf: masquerade" \
    ipsec-policy=out,none out-interface-list=WAN
/ip route
add disabled=no dst-address=0.0.0.0/0 gateway=92.47.161.1
/ip service
set telnet disabled=yes
set ftp disabled=yes
set www disabled=yes
set ssh disabled=yes
set api disabled=yes
set winbox address=46.8.252.0/23,192.168.93.0/24,10.60.0.0/22,192.168.88.0/24
set api-ssl disabled=yes
/routing bgp connection
add as=203481 cisco-vpls-nlri-len-fmt=auto-bits connect=yes disabled=no \
    listen=yes local.address=46.255.239.250 .role=ebgp-rs multihop=yes name=\
    peer1 output.network=bgp-networks .redistribute=\
    connected,static,ospf,vpn,dhcp remote.address=46.255.239.249/32 .as=43873 \
    .port=179 router-id=46.255.239.250 routing-table=main templates=temp1
/routing filter rule
add chain=AS4383-bgp-in disabled=yes rule=\
    "if (dst == 10.0.0.0/8) { reject; }"
add chain=AS4383-bgp-in disabled=yes rule=\
    "if (dst == 192.168.0.0/16) { reject; }"
add chain=AS4383-bgp-in disabled=yes rule=\
    "if (dst == 172.16.0.0/12) { reject; }"
add chain=AS4383-bgp-in disabled=yes rule=\
    "if (dst == 169.254.0.0/16) { reject; }"
add chain=AS4383-bgp-in disabled=yes rule=\
    "if (dst == 224.0.0.0/4) { reject; }"
add chain=AS4383-bgp-in disabled=yes rule=\
    "if (dst == 127.0.0.0/8) { reject; }"
add chain=AS4383-bgp-in disabled=yes rule=\
    "if (dst == 46.255.239.248/30) { reject; }"
add chain=AS4383-bgp-out disabled=yes rule=\
    "if (dst == 46.255.239.248/30) { accept; }"
add chain=AS4383-bgp-in disabled=yes rule="reject;"
add chain=AS4383-bgp-out disabled=yes rule="reject;"
/routing ospf interface-template
add area=backbone-v2 interfaces=bridge networks=192.168.88.0/24 priority=1
add area=backbone-v2 interfaces=bridge114 networks=92.47.161.0/30 priority=1
add area=backbone-v2 interfaces=bridge114 networks=46.8.108.0/24 priority=1
add area=backbone-v2 interfaces=bridge114 networks=46.255.239.248/30 \
    priority=1
/system clock
set time-zone-name=Asia/Almaty
/system identity
set name=ESHDI
/tool mac-server
set allowed-interface-list=LAN
/tool mac-server mac-winbox
set allowed-interface-list=LAN

 

 

вот весь конфиг, все вроде по инструкции прописанно

Share this post

Link to post
Share on other sites

proftp666   

proftp666
Posted
В 20.02.2022 в 15:38, VolanD666 сказал:

Эта команда что говорит?

[admin@ESHDI] > /routing bgp connection print
Flags: D - dynamic, X - disabled, I - inactive
 0   name="peer1"
     remote.address=46.255.239.249/32 .port=179 .as=43873
     local.address=46.255.239.250 .role=ebgp-rs
     connect=yes listen=yes routing-table=main router-id=46.255.239.250 templates=temp1 as=203481 multihop=yes cisco-vpls-nlri-len-fmt=auto-bits
     output.redistribute=connected,static,ospf,vpn,dhcp .network=bgp-networks

 

микротик 7 версии

Share this post

Link to post
Share on other sites

proftp666   

proftp666
Posted

откатил на старую версию микротик.

[admin@ESHDI] > routing bgp advertisements print
PEER     PREFIX               NEXTHOP          AS-PATH                                              ORIGIN     LOCAL-PREF
peer1    92.47.161.0/30       46.255.239.250                                                        incomplete
peer1    46.8.108.0/24        46.255.239.250                                                        incomplete
peer1    192.168.88.0/24      46.255.239.250                                                        incomplete
peer1    46.255.239.248/30    46.255.239.250                                                        igp       

 

Share this post

Link to post
Share on other sites

VolanD666   

VolanD666
Posted
В 20.02.2022 в 14:27, proftp666 сказал:

откатил на старую версию микротик.

конфигурация не изменилась?

 

Вот этот маршрут:

 

Цитата

/ip route
add disabled=no dst-address=0.0.0.0/0 gateway=92.47.161.1

У вас в таблице маршрутизации точно есть?

Share this post

Link to post
Share on other sites

proftp666   

proftp666
Posted

вроде нет

 

config.rsc

 

есть

 #      DST-ADDRESS        PREF-SRC        GATEWAY            DISTANCE
 0 A S  0.0.0.0/0                          92.47.161.1               1
 1 ADC  46.8.108.0/24      46.8.108.1      bridge114                 0
 2 ADb  46.255.239.0/24                    46.255.239.249           20
 3 ADb  46.255.239.12/30                   46.255.239.249           20
 4 ADC  46.255.239.248/30  46.255.239.250  bridge114                 0
 5 ADC  92.47.161.0/30     92.47.161.2     bridge114                 0
 6 ADC  192.168.88.0/24    192.168.88.1    bridge                    0

 

 

Share this post

Link to post
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Guest
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.

×
Go to topic listing Mikrotik коммутаторы и маршрутизаторы