bgp filter irr

Pre-Alpha. This page describes behavior that may change.

The bgp-filter-irr plugin filters incoming BGP routes against prefix lists derived from Internet Routing Registry (IRR) data. For each eBGP peer, it resolves the peer's AS-SET (via RADB whois by default) into a set of allowed prefixes, and rejects routes whose prefix is not in that set.

How it works

1. On startup and at each refresh interval, the plugin queries the configured IRR server for each peer's AS-SET.
2. The AS-SET is expanded to member ASNs, then each ASN's announced prefixes are resolved.
3. The resulting prefix list becomes the import filter for that peer.
4. Routes not matching any prefix in the list are rejected on the import path.

When a peer's ASN has no registered AS-SET, the plugin falls back to looking up prefixes directly under the peer's ASN. PeeringDB is queried to discover the AS-SET name when it is not configured explicitly.

Configuration

Global IRR settings go under bgp { policy { irr { ... } } }. Per-peer settings go under bgp { peer <name> { session { irr { ... } } } }.

bgp {
    policy {
        irr {
            server whois.radb.net;
            peeringdb-url "https://www.peeringdb.com";
            refresh-interval 3600;
        }
    }

    peer upstream {
        connection { remote { ip 10.0.0.1; } }
        session {
            asn { local 65000; remote 65001; }
            irr {
                as-set AS-EXAMPLE;
            }
            family {
                ipv4/unicast { prefix { maximum 1000000; } }
            }
        }
    }
}

Setting	Default	Description
server	whois.radb.net	IRR whois server for AS-SET and prefix queries
peeringdb-url	https://www.peeringdb.com	PeeringDB API URL for AS-SET discovery
refresh-interval	3600	Seconds between prefix list refreshes (range: 60 to 86400)
as-set (per-peer)	(auto-discovered)	Explicit AS-SET name for this peer
enable (per-peer)	enable	Set to disable to skip IRR filtering for this peer

CLI commands

Command	Mode	Description
show bgp irr	read-only	Per-ASN IRR filter status: AS-SET, prefix count, server, last and next refresh
show bgp irr prefix <peer>	read-only	List all IRR-resolved prefixes for a peer
show bgp irr check <peer> <prefix>	read-only	Test whether a prefix would be accepted by the IRR filter
update bgp irr all	write	Refresh all IRR prefix-lists immediately
update bgp irr asn <asn>	write	Refresh IRR prefix-list for a specific ASN
update bgp irr as-set <as-set>	write	Refresh IRR prefix-list for a specific AS-SET

Filter behaviour

The plugin operates as an import filter. It runs in the per-prefix modify path, which means it evaluates each prefix in a multi-prefix UPDATE independently. A single UPDATE with ten prefixes might accept seven and reject three.

When the IRR data changes on refresh, sessions are not reset. The new prefix list takes effect on the next incoming UPDATE. To force re-evaluation, use update bgp irr all followed by a route refresh for the affected families.

Metrics

The plugin registers Prometheus metrics for prefix list sizes and refresh timing under the ze_bgp_filter_irr_* namespace.

See also

• Route Filters for the filter chain overview.
• bgp-filter-prefix for static prefix filters.
• bgp-filter-aspath for AS-path regex filters.
• Plugins for the plugin catalogue.
• Command Reference for the full CLI reference.

Adapted from the bgp-filter-irr plugin source code and YANG schema.