bgp filter irr

Pre-Alpha. This page describes behavior that may change.

The bgp-filter-irr plugin filters incoming BGP routes against prefix lists derived from Internet Routing Registry (IRR) data. For each eBGP peer, it resolves the peer's AS-SET (via RADB whois by default) into a set of allowed prefixes, and rejects routes whose prefix is not in that set.

How it works

1. On startup and at each refresh interval, the plugin queries the configured IRR server for each peer's AS-SET.
2. The AS-SET is expanded to member ASNs, then each ASN's announced prefixes are resolved.
3. The resulting prefix list becomes the import filter for that peer.
4. Routes not matching any prefix in the list are rejected on the import path.

When a peer's ASN has no registered AS-SET, the plugin falls back to looking up prefixes directly under the peer's ASN. PeeringDB is queried to discover the AS-SET name when it is not configured explicitly.

Which peers are resolved

A peer is enrolled for IRR resolution only when it has asked for it, in one of two ways:

• a bgp-filter-irr:<asn> reference in a filter chain that applies to it, at the global, group, or peer level, or
• an explicit session { irr { as-set ...; } }.

Having a remote ASN is not enough. The plugin's config root is bgp, so it auto-loads for any config with a bgp {} block, and it used to enroll every peer carrying a remote ASN and resolve it at once. That meant a PeeringDB request over HTTPS plus a whois to whois.radb.net for every peer in any BGP config, whether or not the operator had asked for IRR filtering at all.

Configuration

Global IRR settings go under bgp { policy { irr { ... } } }. Per-peer settings go under bgp { peer <name> { session { irr { ... } } } }. The chain reference below is what enrolls upstream; the explicit as-set would do so on its own.

bgp {
    policy {
        irr {
            server whois.radb.net;
            peeringdb-url "https://www.peeringdb.com";
            refresh-interval 3600;
        }
    }

    peer upstream {
        connection { remote { ip 10.0.0.1; } }
        session {
            asn { local 65000; remote 65001; }
            irr {
                as-set AS-EXAMPLE;
            }
            family {
                ipv4/unicast { prefix { maximum 1000000; } }
            }
        }
    }
}

Setting	Default	Description
server	whois.radb.net	IRR whois server for AS-SET and prefix queries
peeringdb-url	https://www.peeringdb.com	PeeringDB API URL for AS-SET discovery
refresh-interval	3600	Seconds between prefix list refreshes (range: 60 to 86400)
as-set (per-peer)	(auto-discovered)	Explicit AS-SET name for this peer
enable (per-peer)	enable	Set to disable to skip IRR filtering for this peer

CLI commands

Command	Mode	Description
show bgp irr	read-only	Per-ASN IRR filter status: AS-SET, prefix count, server, last and next refresh
show bgp irr prefix <peer>	read-only	List all IRR-resolved prefixes for a peer
show bgp irr check <peer> <prefix>	read-only	Test whether a prefix would be accepted by the IRR filter
update bgp irr all	write	Refresh all IRR prefix-lists immediately
update bgp irr asn <asn>	write	Refresh IRR prefix-list for a specific ASN
update bgp irr as-set <as-set>	write	Refresh IRR prefix-list for a specific AS-SET

Filter behaviour

The plugin operates as an import filter. It runs in the per-prefix modify path, which means it evaluates each prefix in a multi-prefix UPDATE independently. A single UPDATE with ten prefixes might accept seven and reject three.

When the IRR data changes on refresh, sessions are not reset. The new prefix list takes effect on the next incoming UPDATE. To force re-evaluation, use update bgp irr all followed by a route refresh for the affected families.

Metrics

The plugin registers Prometheus metrics for prefix list sizes and refresh timing under the ze_bgp_filter_irr_* namespace.

Shared prefix store

IRR expansion and the on-disk prefix cache live in a shared store (the resolve IRR client plus its cache file). The firewall's firewall-irr plugin reuses the same store, so a prefix list fetched for BGP import filtering is also available to firewall rules and vice versa. See Firewall for the firewall side.

See also

• Firewall for IRR-based packet filtering and per-interface source validation using the same prefix store.
• Route Filters for the filter chain overview.
• bgp-filter-prefix for static prefix filters.
• bgp-filter-aspath for AS-path regex filters.
• Plugins for the plugin catalogue.
• Command Reference for the full CLI reference.

Adapted from the bgp-filter-irr plugin source code and YANG schema.