Example: Configuring Walkup for Route Filters Globally to Improve Operational Efficiency
Use the walkup feature if you have concerns about policy performance because of split route filters across multiple policy terms. The walkup feature enables the consolidation of route filters under one policy term.
This example shows how to configure the route filter walkup feature globally for policy statements with route filters. When configured at the global level, the route filter walkup option applies to all policy statements. This example changes the default behavior of policy terms with multiple route filters globally, so that any reversion to the default “no walkup” behavior must be established locally.
Requirements
This example uses the following hardware and software components:
A Juniper Networks router
A Junos operating system from 13.3 or above
Before you configure route filter walkup locally, be sure you have:
A properly configured routing policy or set of routing policies
A need to consolidate multiple route filter terms into fewer routing policy terms
Overview
Routing protocols exchange information with other routers running the same routing protocols. In many cases, route filters are used in routing policy statements to filter prefixes for import or export. In some cases, when route filters are split into many separate terms, performance is impacted. The route filter walkup feature allows consolidation of policy statement terms for operational efficiency.
This example uses BGP, but the same walkup feature applies to any routing protocol that supports route filtering of input or output.
You can configure a Juniper Networks router to change the default operation of a term in a policy statement with route filters. By default, only a single longest match attempt is made for all route filters in a term. The walkup feature allows the router to “walk up” the route filters in a term from longest match to less specific in search of a true condition. This allows consolidation of multiple terms in a policy statement and corresponding operational efficiency.
This example changes the default behavior globally, for all policy statements. You can
still configure no-walkup for an individual policy.
Topology
In the sample network in Figure 1, the router CE1 is a router from another vendor. The rest are Juniper Networks routers. The walkup feature can be configured on any router in the figure, except for router CE1. The vendor of router CE1 might or not might support a similar feature.
In the example, the following addresses are used:
10.0.0.0/16
10.0.0.0/8
Although the 10.0.0.0/8 address space is not specifically reserved
for documentation, the private RFC 1918 10.0.0.0/8 address space is used in this
topic because of the flexibility and realistic scenarios that this address spaces provides.
Configuring Route Filter Walkup Globally
CLI Quick Configuration
To quickly configure this example, copy the following commands, paste
them into a text file, remove any line breaks, change any details such as addresses and interfaces
to match your network configuration, and then copy and paste the commands into the CLI at
the [edit] hierarchy level.
Device PE1
set policy-options defaults route-filter walkup set policy-options policy-statement routeset1-import term prefixes1 from route-filter 10.0.0.0/16 prefix-length-range /22-/24 set policy-options policy-statement routeset1-import term prefixes1 from route-filter 10.0.0.0/8 orlonger set policy-options policy-statement routeset1-import term prefixes1 then accept set policy-options policy-statement routeset1-import term reject-the-rest then reject set policy-options policy-statement import-route-filter-a term import-routes from protocol bgp set policy-options policy-statement import-route-filter-a term import-routes from policy routeset1-import set policy-options policy-statement import-route-filter-a term import-routes then next policy set policy-options policy-statement import-route-filter-a term all-others then reject set policy-options policy-statement route-filter-a-export term all then reject set protocols bgp group routeset1 type external set protocols bgp group routeset1 neighbor 10.0.10.13 import import-route-filter-a set protocols bgp group routeset1 neighbor 10.0.10.13 family inet unicast set protocols bgp group routeset1 neighbor 10.0.10.13 export route-filter-a-export set protocols bgp group routeset1 neighbor 10.0.10.13 peer-as 64506
Procedure
Step-by-Step Procedure
The following example requires that you navigate to various levels in the configuration hierarchy. For information about navigating the CLI, see Using the CLI Editor in Configuration Mode in the Junos OS CLI User Guide
To configure router PE1 to perform walkup globally and combine multiple route filters in one term:
Configure the walkup feature globally.
[edit policy-options defaults] user@PE1# set route-filter walkup
Configure the policy statements for an import policy named
routeset1-import.[edit policy-options] user@PE1# set policy-statement routeset1-import term prefixes1 from route-filter 10.0.0.0/16 prefix-length-range /22-/24 user@PE1# set policy-statement routeset1-import term prefixes1 from route-filter 10.0.0.0/8 orlonger user@PE1# set policy-statement routeset1-import term prefixes1 then accept user@PE1# set policy-statement routeset1-import term reject-the-rest then reject
Configure the policy options for the import and export policy statements.
[edit policy-options] user@PE1# set policy-statement import-route-filter-a term import-routes from protocol bgp user@PE1# set policy-statement import-route-filter-a term import-routes from policy routeset1-import user@PE1# set policy-statement import-route-filter-a term import-routes then next policy user@PE1# set policy-statement route-filter-a-export term all-others then reject
Apply the import and export policies to a BGP neighbor.
[edit protocols bgp] user@PE1# set group routeset1 type external user@PE1# set group routeset1 neighbor 10.0.10.13 import import-route-filter-a user@PE1# set group routeset1 neighbor 10.0.10.13 family inet unicast user@PE1# set group routeset1 neighbor 10.0.10.13 export route-filter-a-export user@PE1# set group routeset1 neighbor 10.0.10.13 peer-as 64506
Results
From configuration mode, confirm your configuration by entering the show
protocols and show policy-options commands. If the output does not display
the intended configuration, repeat the instructions in this example to correct the configuration.
user@PE1# show policy-options
defaults {
route-filter walkup;
}
policy-statement routeset1-import {
term prefixes1 {
from {
route-filter 10.0.0.0/16 prefix-length-range /22-/24;
route-filter 10.0.0.0/8 orlonger;
}
then accept;
}
term reject-the-rest {
then reject;
}
}
policy-statement import-route-filter-a {
term import-routes {
from {
protocol bgp;
policy routeset1-import;
}
then next policy;
}
term all-others {
then reject;
}
}
policy-statement route-filter-a-export {
term all {
then reject;
}
}
user@PE!# show protocols bgp
group routeset1 {
type external;
neighbor 10.0.10.13 {
import import-route-filter-a;
family inet {
unicast;
}
export router-filter-a-export;
peer-as 64506;
}
}
If you are done configuring the device, enter commit from configuration mode.
Verification
Verifying Route Filter Operation
Purpose
Display expected information about the routes to confirm the route filters are working as expected.
Notice that the 10.0.0.0/8 orlonger filter includes the 10.0.0.0/16
prefix-length-range /22-/24 filter in its scope. That is, any 10.0.0.0 route
with a prefix of 8 bits or longer could also be a route with a prefix in the range between
22 and 24 bits. Without the walkup feature enabled, a route such as 10.0.0.0/16 would be rejected and become a hidden route. If the walkup feature is working as expected,
then a route such as 10.0.0.0/16 would be accepted by the policy.
Action
From operational mode, enter the show route protocolbgp 10.0.0.0/16 command. Make sure that 10.0.0.0/16 is not a hidden
route.
user@PE1>show route protocol bgp 10.0.0.0/16
inet.0: 520762 destinations, 520764 routes (520760 active, 0 holddown, 2 hidden)
+ = Active Route, - = Last Active, * = Both
10.0.0.0/16 *[BGP/170] 01:07:37, localpref 100
AS path: 64506, I, validation-state: unverified
> to 10.0.100.13 via xe-0/2/0.0
As a further check, make sure that no routes that should be accepted are hidden routes.
From operational mode, enter the show route protocol bgp ip-address-prefix hidden command to verify this.
Meaning
The presence of routes that are not the longest match in the configured policy route filter term shows that the walkup feature is functioning globally.
Troubleshooting
To troubleshoot route filter walkup globally:
Troubleshooting BGP
Problem
BGP is not functioning as expected.
Solution
See the BGP Configuration Overview topic, examples, and troubleshooting.
Troubleshooting Policy Statements
Problem
The policy statements are not functioning as expected.
Solution
See the Verify That a Particular BGP Route Is Received on Your Router and Example: Configuring BGP Route Advertisement topics, related examples, and troubleshooting.
Troubleshooting Route Filters
Problem
The route filters are not functioning as expected.
Solution
See the Route Filter Match Conditions topic, examples, and troubleshooting.