bgp role

Pre-Alpha. This page describes behavior that may change.

RFC 9234 BGP Role enforcement. Stamps the OTC attribute on eligible egress updates and rejects routes that arrive carrying OTC from a non-customer direction.

Configuration

The plugin activates per peer when a role { import <role> } declaration is present.

bgp {
    peer upstream {
        role {
            import customer;
            strict true;
        }
    }
}

Full configuration reference on the BGP Role configuration page.

Behaviour

The plugin is registered as a mandatory filter that runs on both ingress and egress for peers with a declared role. On ingress, it checks the OTC attribute against the local and remote roles and marks the route as a leak if OTC is present when the peer is a customer or route-server-client. On egress, it stamps OTC with the local ASN when the destination peer is a customer, route-server-client, or peer.

With strict true, the plugin requires the remote peer to advertise the Role capability in its OPEN. A peer that does not advertise Role gets a Role Mismatch NOTIFICATION (code 2, subcode 11) and the session is rejected. With strict false (the default), the session proceeds and OTC filtering is applied based on the locally configured role.

Interactions

Runs as a filter in the redistribution chain. Mandatory: cannot be overridden.
Reads and writes the OTC attribute (type 35) through the egress ModAccumulator.