Preventing an Accidental Transit AS

As we discussed earlier, an AS peer can either be a transit peer (allowing traffic from an outside AS to another outside AS) or a non-transit peer (requiring all traffic to either originate or terminate on its AS). Transit peers will have dramatically larger routing tables. Typically, you will not want to configure a SonicWALL security appliance as a transit peer.

Transit Peers vs. Non-Transit Peers

To prevent your appliance from inadvertently becoming a transit peer, you will want to configure inbound and outbound filters, such as the following:

•
Outbound Filters
•
Inbound Filters
Outbound Filters
Permit only routes originated from the local AS out:
ip as-path access-list 1 permit ^$
router bgp 12345
: bgp router-id 10.50.165.233
: network 12.34.5.0/24
: neighbor 10.50.165.228 remote-as 7675
: neighbor 10.50.165.228 filter-list 1 out
: neighbor 172.1.1.2 remote-as 9999
: neighbor 10.50.165.228 filter list 1 out
Permit only owned prefixes out:
ip prefix-list myPrefixes seq 5 permit 12.34.5.0/24
ip prefix-list myPrefixes seq 10 permit 23.45.6.0/24
router bgp 12345
: bgp router-id 10.50.165.233
: network 12.34.5.0/24
: network 23.45.6.0/24
: neighbor 10.50.165.228 remote-as 7675
: neighbor 172.1.1.2 remote-as 9999
: neighbor 10.50.165.228 prefix-list myPrefixes out
: neighbor 172.1.1.2 prefix-list myPrefixes out
Inbound Filters
Drop all owned and private inbound prefixes
ip prefix-list unwantedPrefixes seq 5 deny 12.34.5.0/24 le 32
ip prefix-list unwantedPrefixes seq 10 deny 23.45.6.0/24 le 32
ip prefix-list unwantedPrefixes seq 20 deny 10.0.0.0/8 le 32
ip prefix-list unwantedPrefixes seq 21 deny 172.16.0.0/12 le 32
ip prefix-list unwantedPrefixes seq 22 deny 192.168.0.0/16 le 32
ip prefix-list unwantedPrefixes seq 30 permit 0.0.0.0/0 le 32
router bgp 12345
: bgp router-id 10.50.165.233
: network 12.34.5.0/24
: network 23.45.6.0/24
: neighbor 10.50.165.228 remote-as 7675
: neighbor 172.1.1.2 remote-as 9999
: neighbor 10.50.165.228 prefix-list unwantedPrefixes in
: neighbor 172.1.1.2 prefix-list unwantedPrefixes in