pfSense » pfSense Packages

This is actually an issue with how FRR is presenting the announcements of routes.
It is showing that i am sending 19 routes which is.....true...BUT...its routes that are advertised from the neighbor to the firewall and the firewall advertises it back out. Because AS-Path is the native loop prevention of BGP this doesn't cause any issues albiet i can see it causing quite a problem if as-override is implemented and not tightly controlled.
In my opinion, FRR is not doing any sanity checking when advertising routes back out to a peer that it received the route from - SplitHorizon....

IPv4 Unicast Summary (VRF default):
BGP router identifier 192.168.50.254, local AS number 65001 vrf-id 0
BGP table version 366
RIB entries 37, using 3552 bytes of memory
Peers 2, using 26 KiB of memory

Neighbor        V         AS   MsgRcvd   MsgSent   TblVer  InQ OutQ  Up/Down State/PfxRcd   PfxSnt Desc
10.6.106.2      4      65520      1057      1116      366    0    0 08:43:21            2       19 790CCV
172.28.0.5      4      65002      1136      1094      366    0    0 08:43:20           13       19 k85enterprise

There is an option no bgp network import-check. When you do not add this option parameter, it will check the local network and the IP prefixes transmitted downstream
you should use Prefix Lists and rouemap Control and filter

only listed networks (in Network Distribution) were advertised in my lab.

Please provide more details about your network/configurations.

Here is a set up that i have.
Device: SG-1100
Software: 24.03-RELEASE
Networks local to SG-1100: 192.168.70.0/24, 172.26.1.0/24

show ip bgp summary

IPv4 Unicast Summary (VRF default):
BGP router identifier 192.168.70.254, local AS number 65520 vrf-id 0
BGP table version 11
RIB entries 17, using 1632 bytes of memory
Peers 1, using 13 KiB of memory

Neighbor        V         AS   MsgRcvd   MsgSent   TblVer  InQ OutQ  Up/Down State/PfxRcd   PfxSnt Desc
10.6.106.1      4      65001      1231      1234       11    0    0 20:12:29            7        9 N/A

As you can see the output shows that PfxSent are 9. 9 routes is being sent.

nyc-fw1-inet.moore.lan# show ip bgp neighbors 10.6.106.1 advertised-routes
BGP table version is 11, local router ID is 192.168.70.254, vrf id 0
Default local pref 100, local AS 65520
Status codes:  s suppressed, d damped, h history, * valid, > best, = multipath,
               i internal, r RIB-failure, S Stale, R Removed
Nexthop codes: @NNN nexthop's vrf id, < announce-nh-self
Origin codes:  i - IGP, e - EGP, ? - incomplete
RPKI validation codes: V valid, I invalid, N Not found

    Network          Next Hop            Metric LocPrf Weight Path
 *> 172.26.0.0/24    0.0.0.0                                0 65001 i
 *> 172.26.1.0/24    0.0.0.0                  0         32768 i
 *> 172.27.0.0/24    0.0.0.0                                0 65001 i
 *> 192.168.2.0/30   0.0.0.0                                0 65001 i
 *> 192.168.3.0/24   0.0.0.0                                0 65001 i
 *> 192.168.6.0/24   0.0.0.0                                0 65001 i
 *> 192.168.17.0/30  0.0.0.0                                0 65001 i
 *> 192.168.50.0/24  0.0.0.0                                0 65001 i
 *> 192.168.70.0/24  0.0.0.0                  0         32768 i

nyc-fw1-inet.moore.lan# show ip bgp neighbors 10.6.106.1 advertised-routes
BGP table version is 11, local router ID is 192.168.70.254, vrf id 0
Default local pref 100, local AS 65520
Status codes:  s suppressed, d damped, h history, * valid, > best, = multipath,
               i internal, r RIB-failure, S Stale, R Removed
Nexthop codes: @NNN nexthop's vrf id, < announce-nh-self
Origin codes:  i - IGP, e - EGP, ? - incomplete
RPKI validation codes: V valid, I invalid, N Not found

    Network          Next Hop            Metric LocPrf Weight Path
 *> 172.26.0.0/24    0.0.0.0                                0 65001 i
 *> 172.26.1.0/24    0.0.0.0                  0         32768 i
 *> 172.27.0.0/24    0.0.0.0                                0 65001 i
 *> 192.168.2.0/30   0.0.0.0                                0 65001 i
 *> 192.168.3.0/24   0.0.0.0                                0 65001 i
 *> 192.168.6.0/24   0.0.0.0                                0 65001 i
 *> 192.168.17.0/30  0.0.0.0                                0 65001 i
 *> 192.168.50.0/24  0.0.0.0                                0 65001 i
 *> 192.168.70.0/24  0.0.0.0                  0         32768 i

PROBLEM: As part of the advertisement, the SG1100 is re-advertsing routes that it learned from its peer. The way BGP works is that the receiving peer will reject the routes seeing its own AS-PATH in the advertisements.

TO REPRODUCE.
1. Two pfsense firewalls connected to each other. Each in their own ASN. Each with local networks being advertised to each peer.
2. On the remote peer observe what routes are being advertised. It will be routes received from neighbor which is the problem.

are the following enabled on 65520 peer?
redistribute connected
redistribute static
redistribute kernel

what is the routing table showing up if BGP was disabled?

I am not redistrbuting connected/local/kernel.

I would assume the route table would only contain directly connected routes only if BGP was disabled. Im not clear what the question has to do with how the BGP advertisements are being advertised. Can you explain what you are looking for?

BGP is advertising ALL routes and does not respect the 'network x.x.x.x' statement within the configuration.
How this should work is that only networks outlined in the network statement(s) is what will be announced to peers. Attaching a route-map which is mandatory, to the neighbors is required to advertise routes. All though the route-map is set to advertise everything, in reality the network statement should control whats sent.

This is incorrect. The network statement has nothing to do with what eBGP routes are sent to other eBGP peers.

This site is not for support or diagnostic discussion.

For assistance in solving problems, please post on the Netgate Forum .

Jesus Christ…you didn’t read the redmine…
Ehhh…alright man.
I’ll follow up Glen Shok.
Incredible….