BGP · Topic 5 of 7
BGP Route Distribution and Routing Filters
Learn how routes enter BGP through network statements and redistribution, and how in and out routing filters accept, discard or change routes.
- 5 min
- BGP originates only what you configure or redistribute.
- A network statement needs a matching route in the routing table.
- A blackhole route is a common way to create that match.
What it is
Route distribution decides which prefixes enter BGP, and routing filters decide which ones are accepted or sent.
BGP never advertises anything on its own. You choose what the router originates, and you choose what it will accept from and send to each peer.
Both steps are central to policy, because BGP is built to apply policy rather than to find the shortest path.
How it works
Originate prefixes, then shape what comes in and goes out with filter chains on each peer.
Getting routes into BGP
There are two main ways. The first is a network statement. It names a prefix to advertise.
/routing bgp network add network=198.51.100.0/24
/ip route add dst-address=198.51.100.0/24 type=blackholeA network statement advertises a prefix only if a matching route exists in the routing table. A blackhole route is the usual way to create that match for a block that is split into many smaller networks.
The second way is redistribution. On RouterOS v6 the BGP instance has switches that pull routes from other sources.
/routing bgp instance set default redistribute-connected=yes redistribute-static=no- Other sources, such as OSPF or RIP, have their own redistribute settings on the instance.
- Redistribution moves everything of that type, so a filter is often added to limit it.
RouterOS v7 changes these settings, with output options on the BGP connection. The idea is the same.
Routing filters
A routing filter is a list of rules grouped in a named chain. The chain is attached to a peer as an in filter for routes received, or an out filter for routes sent.
Rules are read from the top. The first rule that matches decides the result.
/routing filter add chain=from-isp prefix=0.0.0.0/0 prefix-length=0 action=accept
/routing filter add chain=from-isp action=discard
/routing bgp peer set upstream in-filter=from-isp| Part | Meaning |
|---|---|
chain | The name of the rule list |
prefix and prefix-length | Match on the prefix and its mask length |
action | What to do with a matching route, such as accept or discard |
set options | Change attributes of an accepted route |
The set options include local preference, prepend, MED and communities. They let a filter change how a route is chosen, which the next page explains.
Matching on attributes
Rules can match more than the prefix. They can also look at the AS path and at communities. This makes it possible to accept only routes that originated in a given AS, or to tag routes with a community when they enter.
/routing filter add chain=from-cust bgp-communities=65000:100 action=acceptA community is a label, written as two numbers, that travels with the route.
Using the default behaviour safely
Do not rely on what happens when no rule matches. End every chain with an explicit final rule, for example a discard, so that the outcome is clear.
Put the more specific rules first. A broad accept placed on top will hide every rule below it.
Checking the result
/routing bgp advertisements print
/ip route print where bgprouting bgp advertisements printshows what the router is sending to its peers.ip route print where bgpshows the routes BGP installed in the table.
After editing a filter, remember that routes already received are not always re-evaluated at once. Check the advertisements and the received routes, and reset the session if needed.
What to remember for the exam
Seven facts cover most questions here.
- BGP originates only what you configure or redistribute.
- A network statement needs a matching route in the routing table.
- A blackhole route is a common way to create that match.
- Redistribution on the instance moves whole route types into BGP.
- Filters are named chains attached to a peer as an in filter or out filter.
- Rules are read top down, and the first match wins.
- Filters can match prefix, AS path and communities, and can change attributes.
An in filter protects your router, and an out filter protects the world. Use both on a multihomed edge.
Common mistakes
These four errors are common.
No matching route for the network statement. The prefix is configured but never advertised, because the table has no exact match.
Redistributing too much. Connected and static routes can include private networks that must stay inside.
Wrong rule order. A general accept above a specific discard makes the discard useless.
Forgetting the direction. An in filter does not change what is sent, and an out filter does not change what is received.
Check yourself
Work through these three questions.
Why is a prefix in a
routing bgp networkentry sometimes not advertised?A network statement is advertised only if a matching route exists in the routing table. A blackhole route can provide that match.
How are routing filters applied to a BGP peer?
A named chain is attached to the peer as an in filter for received routes or an out filter for sent routes. Rules are read from the top, and the first match decides.
Which commands show what BGP sends and what it installed?
/routing bgp advertisements printshows what is sent to peers./ip route print where bgpshows routes installed by BGP.
Topic 5 of 7 in BGP
Test yourself on BGP
The full MikroTik MTCINE question bank has 475 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by MikroTik. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.