Skip to content

Cloud Platforms

Jump to bottom
Thomas Mangin edited this page Nov 13, 2025 · 4 revisions

Cloud Platform Integration

Table of Contents

Overview

ExaBGP integrates with major cloud platforms to provide BGP-based networking, hybrid cloud connectivity, and service advertisement across cloud and on-premises infrastructure.

Common Cloud Use Cases:

  • Hybrid Cloud Connectivity: BGP peering between cloud VPCs and on-premises networks
  • Multi-Cloud Networking: BGP routing between AWS, Azure, GCP
  • Service Advertisement: Announce cloud services via BGP to external networks
  • Load Balancing: BGP-based traffic distribution across cloud regions
  • DDoS Mitigation: FlowSpec for cloud edge protection
  • Anycast Services: Global anycast deployment across cloud regions

Important: ExaBGP does NOT manipulate routing tables. It announces routes via BGP. Cloud platforms handle actual packet forwarding based on their routing policies.

AWS Integration

Architecture Overview

┌─────────────────────────────────────────┐
│              AWS VPC                     │
│                                          │
│  ┌──────────────────────────────────┐   │
│  │  EC2 Instance (ExaBGP)           │   │
│  │  - Announces service IPs         │   │
│  │  - BGP peer: Virtual Private     │   │
│  │    Gateway or Transit Gateway    │   │
│  └──────────────┬───────────────────┘   │
│                 │ BGP                    │
│  ┌──────────────▼───────────────────┐   │
│  │  Virtual Private Gateway (VGW)   │   │
│  │  or Transit Gateway (TGW)        │   │
│  └──────────────┬───────────────────┘   │
└─────────────────┼────────────────────────┘
                  │
          ┌───────▼────────┐
          │  Direct Connect │
          │  or VPN         │
          └─────────────────┘

AWS VPC with ExaBGP

EC2 Instance Setup

1. Launch EC2 Instance:

# Launch Ubuntu instance in your VPC
aws ec2 run-instances \
    --image-id ami-0c55b159cbfafe1f0 \
    --instance-type t3.small \
    --key-name your-key \
    --subnet-id subnet-xxxxxx \
    --security-group-ids sg-xxxxxx \
    --associate-public-ip-address \
    --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=exabgp-node}]'

2. Configure Security Group:

# Allow BGP (TCP 179)
aws ec2 authorize-security-group-ingress \
    --group-id sg-xxxxxx \
    --protocol tcp \
    --port 179 \
    --cidr 10.0.0.0/8

# Allow ICMP for troubleshooting
aws ec2 authorize-security-group-ingress \
    --group-id sg-xxxxxx \
    --protocol icmp \
    --port -1 \
    --cidr 10.0.0.0/8

3. Disable Source/Destination Checks:

# Required for IP forwarding/routing
aws ec2 modify-instance-attribute \
    --instance-id i-xxxxxx \
    --no-source-dest-check

4. Install ExaBGP:

# SSH into instance
ssh -i your-key.pem ubuntu@<instance-ip>

# Install via pip
sudo apt update
sudo apt install -y python3-pip
sudo pip3 install exabgp

AWS Direct Connect BGP

# exabgp.conf for Direct Connect

neighbor 169.254.255.1 {
    router-id 10.0.1.10;
    local-address 10.0.1.10;
    local-as 65000;
    peer-as 65001;  # AWS ASN

    family {
        ipv4 unicast;
    }

    # Announce service VIP
    static {
        route 203.0.113.10/32 next-hop self community [65000:100];
    }
}

AWS Transit Gateway

# exabgp.conf for Transit Gateway

neighbor 10.0.0.1 {
    router-id 10.0.1.10;
    local-address 10.0.1.10;
    local-as 65000;
    peer-as 64512;  # TGW ASN

    family {
        ipv4 unicast;
    }

    process health-check {
        run /opt/scripts/aws_health_check.py;
        encoder json;
    }

    api {
        processes [ health-check ];
    }
}

AWS Route 53 Health Checks

Integrate with Route 53 for DNS failover:

#!/usr/bin/env python3
# aws_health_check.py

import sys
import time
import boto3

# Initialize Route 53 client
route53 = boto3.client('route53')

def check_route53_health():
    """Check Route 53 health check status"""
    try:
        response = route53.get_health_check_status(
            HealthCheckId='xxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx'
        )

        for checker in response['HealthCheckObservations']:
            if checker['StatusReport']['Status'] == 'Success':
                return True

        return False
    except Exception as e:
        print(f"Error checking Route 53: {e}", file=sys.stderr)
        return False

# Main loop
while True:
    if check_route53_health():
        sys.stdout.write('announce route 203.0.113.10/32 next-hop self\n')
    else:
        sys.stdout.write('withdraw route 203.0.113.10/32 next-hop self\n')

    sys.stdout.flush()
    time.sleep(30)

AWS ECS/Fargate

Deploy ExaBGP in ECS:

{
  "family": "exabgp-task",
  "networkMode": "host",
  "containerDefinitions": [
    {
      "name": "exabgp",
      "image": "exabgp/exabgp:5.0.0",
      "essential": true,
      "command": ["/etc/exabgp/exabgp.conf"],
      "mountPoints": [
        {
          "sourceVolume": "exabgp-config",
          "containerPath": "/etc/exabgp",
          "readOnly": true
        }
      ],
      "environment": [
        {
          "name": "AWS_REGION",
          "value": "us-east-1"
        }
      ],
      "logConfiguration": {
        "logDriver": "awslogs",
        "options": {
          "awslogs-group": "/ecs/exabgp",
          "awslogs-region": "us-east-1",
          "awslogs-stream-prefix": "exabgp"
        }
      }
    }
  ],
  "volumes": [
    {
      "name": "exabgp-config",
      "host": {
        "sourcePath": "/etc/exabgp"
      }
    }
  ],
  "requiresCompatibilities": ["EC2"],
  "cpu": "256",
  "memory": "512"
}

AWS CloudFormation Template

AWSTemplateFormatVersion: '2010-09-09'
Description: ExaBGP BGP Server

Parameters:
  KeyName:
    Type: AWS::EC2::KeyPair::KeyName
    Description: EC2 Key Pair for SSH access

  VPCID:
    Type: AWS::EC2::VPC::Id
    Description: VPC for ExaBGP deployment

  SubnetID:
    Type: AWS::EC2::Subnet::Id
    Description: Subnet for ExaBGP instance

Resources:
  ExaBGPSecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: Security group for ExaBGP
      VpcId: !Ref VPCID
      SecurityGroupIngress:
        - IpProtocol: tcp
          FromPort: 179
          ToPort: 179
          CidrIp: 10.0.0.0/8
        - IpProtocol: tcp
          FromPort: 22
          ToPort: 22
          CidrIp: 0.0.0.0/0

  ExaBGPInstance:
    Type: AWS::EC2::Instance
    Properties:
      ImageId: ami-0c55b159cbfafe1f0  # Ubuntu 20.04 LTS
      InstanceType: t3.small
      KeyName: !Ref KeyName
      SubnetId: !Ref SubnetID
      SecurityGroupIds:
        - !Ref ExaBGPSecurityGroup
      SourceDestCheck: false
      Tags:
        - Key: Name
          Value: exabgp-server
      UserData:
        Fn::Base64: !Sub |
          #!/bin/bash
          apt-get update
          apt-get install -y python3-pip
          pip3 install exabgp

          # Configure ExaBGP
          mkdir -p /etc/exabgp
          cat > /etc/exabgp/exabgp.conf <<EOF
          neighbor 169.254.255.1 {
              router-id 10.0.1.10;
              local-address 10.0.1.10;
              local-as 65000;
              peer-as 64512;

              static {
                  route 203.0.113.10/32 next-hop self;
              }
          }
          EOF

          # Start ExaBGP
          exabgp /etc/exabgp/exabgp.conf

Outputs:
  InstanceId:
    Description: ExaBGP Instance ID
    Value: !Ref ExaBGPInstance

  PrivateIP:
    Description: Private IP of ExaBGP instance
    Value: !GetAtt ExaBGPInstance.PrivateIp

Azure Integration

Architecture Overview

┌─────────────────────────────────────────┐
│              Azure VNet                  │
│                                          │
│  ┌──────────────────────────────────┐   │
│  │  VM (ExaBGP)                     │   │
│  │  - Announces routes              │   │
│  │  - BGP peer: Azure Route Server  │   │
│  └──────────────┬───────────────────┘   │
│                 │ BGP                    │
│  ┌──────────────▼───────────────────┐   │
│  │  Azure Route Server              │   │
│  └──────────────┬───────────────────┘   │
└─────────────────┼────────────────────────┘
                  │
          ┌───────▼────────┐
          │  ExpressRoute   │
          │  or VPN Gateway │
          └─────────────────┘

Azure Route Server Integration

1. Create Azure Route Server:

# Create Route Server subnet
az network vnet subnet create \
    --name RouteServerSubnet \
    --resource-group myResourceGroup \
    --vnet-name myVNet \
    --address-prefix 10.0.1.0/25

# Create Route Server
az network routeserver create \
    --name myRouteServer \
    --resource-group myResourceGroup \
    --hosted-subnet /subscriptions/{subscription-id}/resourceGroups/myResourceGroup/providers/Microsoft.Network/virtualNetworks/myVNet/subnets/RouteServerSubnet

2. Deploy ExaBGP VM:

# Create Ubuntu VM
az vm create \
    --resource-group myResourceGroup \
    --name exabgp-vm \
    --image UbuntuLTS \
    --admin-username azureuser \
    --generate-ssh-keys \
    --vnet-name myVNet \
    --subnet mySubnet \
    --nsg exabgp-nsg \
    --size Standard_B2s

# Disable IP forwarding check
az vm update \
    --resource-group myResourceGroup \
    --name exabgp-vm \
    --set networkProfile.networkInterfaces[0].enableIPForwarding=true

3. Configure BGP Peering:

# Get Route Server IPs
az network routeserver show \
    --name myRouteServer \
    --resource-group myResourceGroup

# Create BGP connection
az network routeserver peering create \
    --name exabgp-peering \
    --routeserver myRouteServer \
    --resource-group myResourceGroup \
    --peer-asn 65000 \
    --peer-ip 10.0.2.10

4. ExaBGP Configuration:

# exabgp.conf for Azure Route Server

# Peer with both Route Server instances for HA
neighbor 10.0.1.4 {
    router-id 10.0.2.10;
    local-address 10.0.2.10;
    local-as 65000;
    peer-as 65515;  # Azure Route Server ASN

    family {
        ipv4 unicast;
    }

    static {
        route 203.0.113.10/32 next-hop self;
    }
}

neighbor 10.0.1.5 {
    router-id 10.0.2.10;
    local-address 10.0.2.10;
    local-as 65000;
    peer-as 65515;

    family {
        ipv4 unicast;
    }

    static {
        route 203.0.113.10/32 next-hop self;
    }
}

Azure Load Balancer Integration

#!/usr/bin/env python3
# azure_health_check.py

import sys
import time
import requests
from azure.identity import DefaultAzureCredential
from azure.mgmt.network import NetworkManagementClient

def check_load_balancer_health():
    """Check Azure Load Balancer backend health"""
    credential = DefaultAzureCredential()
    subscription_id = "your-subscription-id"

    network_client = NetworkManagementClient(credential, subscription_id)

    lb = network_client.load_balancers.get(
        resource_group_name='myResourceGroup',
        load_balancer_name='myLoadBalancer'
    )

    # Check backend pool health
    backend_pool = lb.backend_address_pools[0]

    # If backends are healthy, announce route
    if len(backend_pool.backend_ip_configurations) > 0:
        return True

    return False

while True:
    if check_load_balancer_health():
        sys.stdout.write('announce route 203.0.113.10/32 next-hop self\n')
    else:
        sys.stdout.write('withdraw route 203.0.113.10/32 next-hop self\n')

    sys.stdout.flush()
    time.sleep(30)

Azure ExpressRoute

# exabgp.conf for ExpressRoute

neighbor 192.168.0.1 {
    router-id 10.0.0.10;
    local-address 10.0.0.10;
    local-as 65000;
    peer-as 12076;  # Microsoft ASN

    family {
        ipv4 unicast;
    }

    # Announce private prefixes
    static {
        route 10.100.0.0/16 next-hop self;
    }
}

Google Cloud Platform

Architecture Overview

┌─────────────────────────────────────────┐
│              GCP VPC                     │
│                                          │
│  ┌──────────────────────────────────┐   │
│  │  Compute Engine (ExaBGP)         │   │
│  │  - Announces routes              │   │
│  │  - BGP peer: Cloud Router        │   │
│  └──────────────┬───────────────────┘   │
│                 │ BGP                    │
│  ┌──────────────▼───────────────────┐   │
│  │  Cloud Router                    │   │
│  └──────────────┬───────────────────┘   │
└─────────────────┼────────────────────────┘
                  │
          ┌───────▼────────┐
          │  Cloud VPN or   │
          │  Interconnect   │
          └─────────────────┘

GCP Cloud Router Integration

1. Create Cloud Router:

# Create Cloud Router
gcloud compute routers create my-router \
    --network=my-vpc \
    --region=us-central1 \
    --asn=65000

# Create router interface
gcloud compute routers add-interface my-router \
    --interface-name=bgp-interface \
    --ip-address=169.254.1.1 \
    --mask-length=30 \
    --vpn-tunnel=my-vpn-tunnel \
    --region=us-central1

2. Configure BGP Peer:

# Add BGP peer
gcloud compute routers add-bgp-peer my-router \
    --peer-name=exabgp-peer \
    --interface=bgp-interface \
    --peer-ip-address=169.254.1.2 \
    --peer-asn=65001 \
    --region=us-central1

3. Deploy ExaBGP on Compute Engine:

# Create instance
gcloud compute instances create exabgp-instance \
    --zone=us-central1-a \
    --machine-type=e2-small \
    --subnet=my-subnet \
    --image-family=ubuntu-2004-lts \
    --image-project=ubuntu-os-cloud \
    --tags=exabgp \
    --metadata=startup-script='#!/bin/bash
apt-get update
apt-get install -y python3-pip
pip3 install exabgp
'

# Allow BGP traffic
gcloud compute firewall-rules create allow-bgp \
    --network=my-vpc \
    --allow=tcp:179 \
    --source-ranges=169.254.0.0/16 \
    --target-tags=exabgp

4. ExaBGP Configuration:

# exabgp.conf for GCP Cloud Router

neighbor 169.254.1.1 {
    router-id 10.0.1.10;
    local-address 169.254.1.2;
    local-as 65001;
    peer-as 65000;  # Cloud Router ASN

    family {
        ipv4 unicast;
    }

    process gcp-health {
        run /opt/scripts/gcp_health_check.py;
        encoder json;
    }

    api {
        processes [ gcp-health ];
    }
}

GCP Load Balancer Health Checks

#!/usr/bin/env python3
# gcp_health_check.py

import sys
import time
from google.cloud import compute_v1

def check_backend_health():
    """Check GCP Load Balancer backend health"""
    client = compute_v1.BackendServicesClient()

    project = "your-project-id"
    backend_service = "your-backend-service"

    request = compute_v1.GetHealthBackendServiceRequest(
        project=project,
        backend_service=backend_service,
        resource_group_reference=compute_v1.ResourceGroupReference()
    )

    response = client.get_health(request=request)

    # Check if any backends are healthy
    for health_status in response.health_status:
        if health_status.health_state == "HEALTHY":
            return True

    return False

while True:
    if check_backend_health():
        sys.stdout.write('announce route 203.0.113.10/32 next-hop self\n')
    else:
        sys.stdout.write('withdraw route 203.0.113.10/32 next-hop self\n')

    sys.stdout.flush()
    time.sleep(30)

GCP Kubernetes Engine (GKE)

Deploy ExaBGP in GKE:

apiVersion: apps/v1
kind: DaemonSet
metadata:
  name: exabgp
  namespace: kube-system
spec:
  selector:
    matchLabels:
      app: exabgp
  template:
    metadata:
      labels:
        app: exabgp
    spec:
      hostNetwork: true
      containers:
      - name: exabgp
        image: exabgp/exabgp:5.0.0
        args: ["/etc/exabgp/exabgp.conf"]
        volumeMounts:
        - name: config
          mountPath: /etc/exabgp
      volumes:
      - name: config
        configMap:
          name: exabgp-config

Multi-Cloud BGP

Architecture Pattern

┌──────────┐      BGP      ┌──────────┐      BGP      ┌──────────┐
│   AWS    │◄─────────────►│ Transit  │◄─────────────►│   GCP    │
│  ExaBGP  │               │  Router  │               │  ExaBGP  │
└──────────┘               └────┬─────┘               └──────────┘
                                │
                            BGP │
                                │
                          ┌─────▼────┐
                          │  Azure   │
                          │  ExaBGP  │
                          └──────────┘

Multi-Cloud Configuration

AWS ExaBGP Configuration:

# aws-exabgp.conf

# Peer with transit router
neighbor 203.0.113.1 {
    router-id 10.0.1.10;
    local-address 10.0.1.10;
    local-as 65100;  # AWS AS
    peer-as 65000;   # Transit AS

    family {
        ipv4 unicast;
    }

    # Announce AWS VPC routes
    static {
        route 10.0.0.0/16 next-hop self community [65100:1];
    }
}

GCP ExaBGP Configuration:

# gcp-exabgp.conf

neighbor 203.0.113.1 {
    router-id 10.1.1.10;
    local-address 10.1.1.10;
    local-as 65200;  # GCP AS
    peer-as 65000;   # Transit AS

    family {
        ipv4 unicast;
    }

    # Announce GCP VPC routes
    static {
        route 10.1.0.0/16 next-hop self community [65200:1];
    }
}

Azure ExaBGP Configuration:

# azure-exabgp.conf

neighbor 203.0.113.1 {
    router-id 10.2.1.10;
    local-address 10.2.1.10;
    local-as 65300;  # Azure AS
    peer-as 65000;   # Transit AS

    family {
        ipv4 unicast;
    }

    # Announce Azure VNet routes
    static {
        route 10.2.0.0/16 next-hop self community [65300:1];
    }
}

Multi-Cloud Service Advertisement

Announce same service IP from multiple clouds:

#!/usr/bin/env python3
# multi_cloud_anycast.py

import sys
import time
import os

CLOUD_PROVIDER = os.getenv('CLOUD_PROVIDER', 'aws')
SERVICE_IP = os.getenv('SERVICE_IP', '203.0.113.100')
REGION = os.getenv('REGION', 'us-east-1')

def check_local_health():
    """Check if local service is healthy"""
    # Cloud-specific health check logic
    if CLOUD_PROVIDER == 'aws':
        return check_aws_health()
    elif CLOUD_PROVIDER == 'gcp':
        return check_gcp_health()
    elif CLOUD_PROVIDER == 'azure':
        return check_azure_health()

def get_metric():
    """Calculate BGP MED based on region preference"""
    region_preference = {
        'us-east-1': 100,
        'us-west-2': 110,
        'eu-west-1': 120,
        'ap-southeast-1': 130
    }
    return region_preference.get(REGION, 200)

while True:
    if check_local_health():
        metric = get_metric()
        sys.stdout.write(
            f'announce route {SERVICE_IP}/32 next-hop self med {metric}\n'
        )
    else:
        sys.stdout.write(
            f'withdraw route {SERVICE_IP}/32 next-hop self\n'
        )

    sys.stdout.flush()
    time.sleep(10)

Hybrid Cloud Scenarios

Pattern 1: Cloud Bursting

On-premises announces routes, cloud takes overflow:

# on-premises-exabgp.conf

neighbor 192.168.1.1 {
    router-id 10.0.0.1;
    local-address 10.0.0.2;
    local-as 65000;
    peer-as 65001;

    process load-based {
        run /opt/scripts/load_based_announcement.py;
        encoder json;
    }

    api {
        processes [ load-based ];
    }
}
# load_based_announcement.py

import sys
import psutil

CPU_THRESHOLD = 80.0
SERVICE_IP = "203.0.113.10"

while True:
    cpu_usage = psutil.cpu_percent(interval=5)

    if cpu_usage < CPU_THRESHOLD:
        # Low load - announce with low metric
        sys.stdout.write(
            f'announce route {SERVICE_IP}/32 next-hop self med 100\n'
        )
    else:
        # High load - announce with high metric (cloud takes traffic)
        sys.stdout.write(
            f'announce route {SERVICE_IP}/32 next-hop self med 200\n'
        )

    sys.stdout.flush()

Pattern 2: Active-Passive Failover

On-premises primary, cloud backup:

# active_passive_failover.py

import sys
import time
import requests

PRIMARY_ENDPOINT = "http://on-premises-service:80/health"
SERVICE_IP = "203.0.113.10"
IS_PRIMARY = True  # Set based on deployment

while True:
    if IS_PRIMARY:
        # Primary site - always announce with low metric
        sys.stdout.write(
            f'announce route {SERVICE_IP}/32 next-hop self med 50\n'
        )
    else:
        # Backup site - check if primary is down
        try:
            response = requests.get(PRIMARY_ENDPOINT, timeout=3)
            if response.status_code == 200:
                # Primary is up - don't announce (or use high metric)
                sys.stdout.write(
                    f'announce route {SERVICE_IP}/32 next-hop self med 200\n'
                )
            else:
                # Primary is down - take over with low metric
                sys.stdout.write(
                    f'announce route {SERVICE_IP}/32 next-hop self med 50\n'
                )
        except:
            # Primary is unreachable - take over
            sys.stdout.write(
                f'announce route {SERVICE_IP}/32 next-hop self med 50\n'
            )

    sys.stdout.flush()
    time.sleep(10)

Pattern 3: Geographic Load Distribution

Route users to nearest cloud region:

# geographic_routing.py

import sys
import time

REGIONS = {
    'us-east-1': {'ip': '203.0.113.10', 'metric': 100},
    'eu-west-1': {'ip': '203.0.113.20', 'metric': 100},
    'ap-southeast-1': {'ip': '203.0.113.30', 'metric': 100}
}

CURRENT_REGION = 'us-east-1'

while True:
    for region, config in REGIONS.items():
        if region == CURRENT_REGION:
            # Local region - low metric
            metric = config['metric']
        else:
            # Remote region - high metric
            metric = config['metric'] + 50

        sys.stdout.write(
            f'announce route {config["ip"]}/32 next-hop self med {metric}\n'
        )

    sys.stdout.flush()
    time.sleep(30)

Best Practices

1. Use Private ASNs

Use private AS numbers (64512-65534) for internal BGP:

local-as 65000;  # Private ASN

2. BGP Authentication

Enable MD5 authentication:

neighbor 192.168.1.1 {
    router-id 10.0.0.1;
    local-address 10.0.0.2;
    local-as 65000;
    peer-as 65001;
    md5-password "your-secure-password";
}

3. Route Filtering

Filter announced routes:

# Only announce specific prefixes
ALLOWED_PREFIXES = ['203.0.113.0/24', '198.51.100.0/24']

def is_prefix_allowed(prefix):
    return prefix in ALLOWED_PREFIXES

4. Metric Strategy

Use consistent metric strategy:

Primary site: MED 100
Secondary site: MED 200
Tertiary site: MED 300
Failed: MED 1000 or withdraw

5. Monitoring

Monitor BGP sessions across all clouds:

# Export metrics for Prometheus
from prometheus_client import Gauge

bgp_session_state = Gauge(
    'cloud_bgp_session_state',
    'BGP session state',
    ['cloud', 'region']
)

6. Redundancy

Deploy multiple ExaBGP instances per cloud:

# Multi-AZ deployment in AWS
regions:
  - us-east-1a
  - us-east-1b
  - us-east-1c

7. Automation

Use Infrastructure as Code (Terraform):

# terraform/exabgp.tf

resource "aws_instance" "exabgp" {
  count         = 3
  ami           = data.aws_ami.ubuntu.id
  instance_type = "t3.small"

  user_data = file("${path.module}/scripts/install-exabgp.sh")

  tags = {
    Name = "exabgp-${count.index + 1}"
  }
}

8. Documentation

Document BGP topology:

AS 65000 - Transit/Core
AS 65100 - AWS (us-east-1)
AS 65200 - GCP (us-central1)
AS 65300 - Azure (eastus)

Security Considerations

1. Restrict BGP Access

Use security groups/firewall rules:

# AWS Security Group
aws ec2 authorize-security-group-ingress \
    --group-id sg-xxxxxx \
    --protocol tcp \
    --port 179 \
    --source-group sg-yyyyyy  # Only from trusted sources

2. VPN Tunnels

Run BGP over encrypted tunnels:

ExaBGP ←→ IPsec VPN ←→ Cloud Gateway ←→ Cloud BGP

3. Route Validation

Implement prefix filters:

# Validate announced routes
import ipaddress

def validate_route(prefix):
    net = ipaddress.ip_network(prefix)

    # Reject default route
    if net == ipaddress.ip_network('0.0.0.0/0'):
        return False

    # Reject too-specific routes
    if net.prefixlen > 24:
        return False

    return True

4. BGP TTL Security

Configure TTL security:

neighbor 192.168.1.1 {
    ttl-security 255;  # Enforce single-hop BGP
}

5. Logging and Auditing

Enable comprehensive logging:

[exabgp.log]
all = true
destination = /var/log/exabgp/exabgp.log

Troubleshooting

BGP Session Not Establishing

# Check network connectivity
ping <peer-ip>

# Check BGP port
telnet <peer-ip> 179

# Verify routing
traceroute <peer-ip>

# Check ExaBGP logs
tail -f /var/log/exabgp/exabgp.log

Routes Not Propagating

# AWS: Check VPC route tables
aws ec2 describe-route-tables --filters "Name=vpc-id,Values=vpc-xxxxxx"

# GCP: Check Cloud Router routes
gcloud compute routers get-status my-router --region=us-central1

# Azure: Check Route Server learned routes
az network routeserver peering list-learned-routes \
    --name exabgp-peering \
    --routeserver myRouteServer \
    --resource-group myResourceGroup

Cloud-Specific Issues

AWS:

# Check Direct Connect status
aws directconnect describe-connections

# Verify VGW/TGW BGP peers
aws ec2 describe-vpn-connections

GCP:

# Check Cloud Router status
gcloud compute routers get-status my-router --region=us-central1

# View BGP session details
gcloud compute routers describe my-router --region=us-central1

Azure:

# Check ExpressRoute status
az network express-route list

# View Route Server BGP peers
az network routeserver peering list \
    --routeserver myRouteServer \
    --resource-group myResourceGroup

See Also

References

👻 Ghost written by Claude (Anthropic AI)

🏠 Home

🚀 Getting Started

🔧 API

🛡️ Use Cases

🌐 Address Families

⚙️ Configuration

🔍 Operations

📚 Reference

🔄 Migration

🌍 Community

🔗 External

👻 Ghost written by Claude (Anthropic AI)

Clone this wiki locally