Juniper SRX Firewall – Advertising All Static Routes Except Default Gateway

bgpjuniperjuniper-junosjuniper-srxrouting

With the following policy, all static routes are advertised via BGP to my neighbor:

root@Nitrogen# show policy-options 
policy-statement bgp-export-policy {
    term export-statics {
        from protocol static;
        then accept;
    }
}
root@Nitrogen# show routing-instances myinstance
instance-type virtual-router;
interface ...
routing-options {
    static {
        route 0.0.0.0/0 next-hop ...;                   # I don't want to send this route
        route x.x.x.x next-hop st0.1;
        route x.x.x.x next-hop st0.1;
        route x.x.x.x next-hop st0.1;
        ...
    }
    autonomous-system XXX;
}
protocols {
    bgp {
        group mygroup {
            type external;
            export bgp-export-policy;
            neighbor XXX {
                peer-as XXX;
            }
        }
    }
}

How could I advertise all static routes except the default 0.0.0.0/0 one? Or, if this is easier, how could I advertise all routes that use st0.1 as the next hop?

Thank you in advance for your help.

Best Answer

You need to add a term to your policy statement which explicitly rejects the default route then, and add that before the export-statics term:

policy-statement bgp-export-policy {
    term reject-default {
        from {
            route-filter 0.0.0.0/0 through 0.0.0.0/32;
        then reject;
    }
    term export-statics {
        from protocol static;
        then accept;
    }
}

Another, slightly more complex, but also more versatile way is to tag the routes you want to export with a chosen community, and then write an export policy which accepts only routes with that specific community and rejects all others:

routing-options {
    static {
        route 0.0.0.0/0 next-hop 192.0.2.1;
        route x.x.x.x {
            next-hop st0.1;
            community 64496:1000;
        }
        route x.x.x.x {
            next-hop st0.1;
            community 64496:1000;
        }
        route x.x.x.x {
            next-hop st0.1;
            community 64496:1000;
        }
    }
}

policy-statement bgp-export-policy {
    term export-routes {
        from {
            protocol static;
            community 64496:1000;
        }
        then accept;
    }
    term reject {
        then reject;
    }
}

Having an explicit reject policy at the end of your policy chain is always a good idea, regardless of how you would implement this.

Related Topic