Step 1

Choose Devices > Device Management, and edit the Firepower Threat Defense device.

Step 2

Select Routing.

Step 3

(For a non-virtual-router-aware device) Select BGP.

Step 4

Select the Enable BGP check box to enable the BGP routing process.

Step 5

In the AS Number field, enter the autonomous system (AS) number for the BGP process. The AS number internally includes multiple autonomous numbers. The AS number can be from 1 to 4294967295 or from 1.0 to 65535.65535. The AS number is a uniquely assigned value, that identifies each network on the Internet.

Step 6

(Optional) Edit the various BGP settings, starting with General. The defaults for these settings are appropriate in most cases, but you can adjust them to fit the needs of your network. Click Edit (pencil) to edit the settings in the group:

1. In the Router ID drop-down list, select Automatic or Manual from the drop-down list. If you choose Automatic, the highest-level IP address on the Firepower Threat Defense device is used as the router ID. To use a fixed router ID, choose Manual and enter an IPv4 address in theIP Address field. The default value is Automatic.

2. Enter the Number of AS numbers in AS_PATH attribute. An AS _PATH attribute is a sequence of intermediate AS numbers between source and destination routers that form a directed route for packets to travel. Valid values are between 1 and 254. The default value is None.

3. Check the Log Neighbor Changes check box to enable logging of BGP neighbor changes (up or down) and resets. This helps in troubleshooting network connectivity problems and measuring network stability. This is enabled by default.

4. Check the Use TCP Path MTU Discovery check box to use the Path MTU determining technique to determine the maximum transmission unit (MTU) size on the network path between two IP hosts. This avoids IP fragmentation. This is enabled by default.

5. Check the Reset session upon Failover check box to reset the external BGP session immediately upon link failure. This is enabled by default.

6. Check the Enforce that the first AS is peer’s AS for EBGP routes check box to discard incoming updates received from external BGP peers that do not list their AS number as the first segment in the AS_PATH attribute. This prevents a mis-configured or unauthorized peer from misdirecting traffic by advertising a route as if it was sourced from another autonomous system. This is enabled by default.

7. Check the Use dot notation for AS number check box to split the full binary 4-byte AS number into two words of 16 bits each, separated by a dot. AS numbers from 0-65553 are represented as decimal numbers and AS numbers larger than 65535 are represented using the dot notation. This is disabled by default.

8. Click OK.

Step 7

(Optional) Edit the Best Path Selection section:

1. Enter a value for Default Local Preference between 0 and 4294967295. The default value is 100. Higher values indicate higher preference. This preference is sent to all routers and access servers in the local autonomous system.

2. Check the Allow comparing MED from different neighbors check box to allow the comparison of Multi Exit Discriminator (MED) for paths from neighbors in different autonomous systems. This is disabled by default.

3. Check the Compare Router ID for identical EBGP paths check box to compare similar paths received from external BGP peers during the best path selection process and switch the best path to the route with the lowest router ID. This is disabled by default.

4. Check the Pick the best MED path among paths advertised from the neighboring AS check box to enable MED comparison among paths learned from confederation peers. The comparison between MEDs is made only if no external autonomous systems are there in the path. This is disabled by default.

5. Check the Treat missing MED as the least preferred one check box to consider the missing MED attribute as having a value of infinity, making the path the least desirable; therefore, a path with a missing MED is least preferred. This is disabled by default.

6. Click OK.

Step 8

(Optional) Edit the Neighbor Timers section:

1. Enter the time interval for which the BGP neighbor remains active after not sending a keepalive message in the Keepalive interval field. At the end of this keepalive interval, the BGP peer is declared dead, if no messages are sent. The default value is 60 seconds.

2. Enter the time interval for which the BGP neighbor remains active while a BGP connection is being initiated and configured in the Hold time field. The default value is 180 seconds.

3. (Optional) Enter the minimum time interval for which the BGP neighbor remains active while a BGP connection is being initiated and configured in the Min Hold time field. Specify a value from 0 to 65535.

   Note	A hold time of less than 20 seconds increases the possibility of peer flapping.

4. Click OK.

Step 9

(Optional) Edit the Graceful Restart section:

1. Check the Enable Graceful Restart checkbox to enable Firepower Threat Defense peers to avoid a routing flap following a switchover.

2. Specify the time duration that Firepower Threat Defense peers will wait to delete stale routes before a BGP open message is received in the Restart Time field. The default value is 120 seconds. Valid values are between 1 and 3600 seconds.

3. Enter the time duration that the Firepower Threat Defense will wait before deleting stale routes after an end of record (EOR) message is received from the restarting Firepower Threat Defense in the Stalepath Time field. The default value is 360 seconds. Valid values are between 1 and 3600 seconds.

4. Click OK.

Step 10

Click Save.

Step 1

On the Device Management page, click Routing.

Step 2

Choose BGP > IPv4 or IPv6.

Step 3

Click General.

Step 4

In General, update the following sections:

1. In the Settings section, enter or select a Route Map object and enter a Scanning Interval for BGP routers for next-hop validation. Valid values are from 5 to 60 seconds. The default value is 60. Click OK.

   Note	The Route Map field is applicable only to IPv4 settings

2. In the Routes and Synchronization section, update the following as required, and click OK:

   • (Optional) Generate Default Routes — Select this option to configure default-information originate.

   • (Optional) Summarize subnet routes into network-level routes— Select this to configure automatic summarization of subnet routes into network-level routes. This check box is applicable only to IPv4 settings.

   • (Optional) Advertise inactive routes— Select this to advertise routes that are not installed in the routing information base (RIB).

   • (Optional) Synchronise between BGP and IGP system— Select this to enable synchronization between BGP and your Interior Gateway Protocol (IGP) system. Usually, a BGP speaker does not advertise a route to an external neighbor unless that route is local or exists in the IGP. This feature allows routers and access servers within an autonomous system to have the route before BGP makes it available to other autonomous systems.

   • (Optional) Redistribute IBGP into IGP— Select this to configure iBGP redistribution into an interior gateway protocol (IGP), such as OSPF.

3. In the Administrative Route Distances section, update the following as required, and click OK:

   • External — Enter the administrative distance for external BGP routes. Routes are external when learned from an external autonomous system. The range of values for this argument are from 1 to 255. The default value is 20.

   • Internal — Enter administrative distance for internal BGP routes. Routes are internal when learned from peer in the local autonomous system. The range of values for this argument are from 1 to 255. The default value is 200.

   • Local — Enter administrative distance for local BGP routes. Local routes are those networks listed with a network router show command, often as back doors, for the router or for the networks that is being redistributed from another process. The range of values for this argument are from 1 to 255. The default value is 200.

4. In the Next Hop section, optionally select the Enable address tracking check box to enable BGP next hop address tracking and enter the Delay Interval between checks on updated next-hop routes installed in the routing table. Click OK.

   Note	The Next Hop section is applicable only to IPv4 settings.

5. In the Forward Packets over Multiple Paths section, update the following as required and click OK:

   • (Optional) Number of Paths — Specify the maximum number of Border Gateway Protocol routes that can be installed in a routing table. The range of values are from 1 to 8. The default value is 1.

   • (Optional) IBGP Number of Paths — Specify the maximum number of parallel internal Border Gateway Protocol (iBGP) routes that can be installed in a routing table. The range of values are from 1 to 8. The default value is 1.

Step 5

Click Save.

Step 1

On the Device Management page, click Routing.

Step 2

Choose BGP > IPv4 or IPv6.

Step 3

Click Neighbor.

Step 4

Click Add to define BGP neighbors and neighbor settings.

Step 5

Enter the BGP neighbor IP address. This IP address is added to the BGP neighbor table.

Step 6

Choose the BGP neighbor Interface.

Step 7

Enter the autonomous system to which the BGP neighbor belongs, in the Remote AS field.

Step 8

Select the Enabled address check box to enable communication with this BGP neighbor. Further neighbor settings will be configured only if the Enabled address check box is selected.

Step 9

(Optional) Select the Shutdown administratively check box to disable a neighbor or peer group.

Step 10

(Optional) Select the Configure graceful restart check box to enable configuration of the BGP graceful restart capability for this neighbor. After selecting this option, you must use the Graceful Restart (failover / spanned mode) option to specify whether graceful restart should be enabled or disabled for this neighbor.

Step 11

(Optional) Enter a Description for the BGP neighbor.

Step 12

(Optional) In Filtering Routes, use access lists, route maps, prefix lists and AS path filters as required, to distribute BGP Neighbor information. Update the following sections:

1. Enter or Select the appropriate incoming or outgoing Access List to distribute BGP neighbor information.

   Note	Access Lists are only applicable to IPv4 settings.

2. Enter or Select the appropriate incoming or outgoing Route Maps to apply a route map to incoming or outgoing routes.

3. Enter or Select the appropriate incoming or outgoing Prefix List to distribute BGP neighbor information.

4. Enter or Select the appropriate incoming or outgoing AS path filter to distribute BGP neighbor information.

5. Select the Limit the number of prefixes allowed from the neighbor to control the number of prefixes that can be received from a neighbor.

   • Enter the maximum number of prefixes allowed from a specific neighbor in the Maximum Prefixes field.

   • Enter the percentage (of maximum) at which the router starts to generate a warning message in the Threshold Level field. Valid values are integers between 1 and 100. The default value is 75.

6. Select the Control prefixes received from the peer check box to specify additional controls for the prefixes received from a peer. Do one of the following

   • Select Terminate peering when prefix limit is exceeded to stop the BGP neighbor when the prefix limit is reached. Specify the interval after which the BGP neighbor will restart in the Restart interval field.

   • Select Give only warning message when prefix limit is exceeded to generate a log message when the maximum prefix limit is exceeded. Here, the BGP neighbor will not be terminated.

7. Click OK.

Step 13

(Optional) In Routes, specify miscellaneous Neighbor route parameter. Proceed to update the following:

1. Enter the minimum interval (in seconds) between the sending of BGP routing updates in the Advertisment Interval field. Valid values are between 1 and 600.

2. Select the Remove private AS numbers from outbound routing updates to exclude the private AS numbers from being advertised on outbound routes.

3. Select the Generate default routes checkbox to allow the local router to send the default route 0.0.0.0 to a neighbor to use as a default route. Enter or Select the route map that allows the route 0.0.0.0 to be injected conditionally in the Route map field.

4. To add conditionally advertised routes, click Add Row +. In the Add Advertised Route dialog box, do the following:

   1. Add or select a route map in the Advertise Map field, that will be advertised if the conditions of the exist map or the non-exist map are met.

   2. Select Exist Map and choose a route map from the Route Map Object Selector. This route map is compared with the routes in the BGP table, to determine whether the advertise map route is advertised.

   3. Select Non-Exist Map and choose a route map from the Route Map Object Selector. This route map is compared with the routes in the BGP table, to determine whether the advertise map route is advertised.

   4. Click OK.

Step 14

In Timers, select the Set Timers for the BGP Peer check box to set the keepalive frequency, hold time and minimum hold time

Step 15

In Advanced, update the following:

1. (Optional) Select Enable Authentication to enable MD5 authentication on a TCP connection between two BGP peers.

   1. Choose an encryption type from the Enable Encryption drop-down list.

   2. Enter a password in the Password field. Reenter the password in the Confirm field. The password is case-sensitive and can be up to 25 characters long when the service password-encryption command is enabled and up to 81 characters long when the service password-encryption command is not enabled. The string can contain any alphanumeric characters, including spaces.

      Note	You cannot specify a password in the format number-space-anything. The space after the number can cause authentication to fail.

2. (Optional) Select the Send Communty attribute to this neighbor check box to specify that communities attributes should be sent to the BGP neighbor

3. (Optional) Select the Use FTD as next hop for this neighbor check box to configure the router as the next-hop for a BGP speaking neighbor or peer group.

4. Select the Disable Connection Verification checkbox to disable the connection verification process for eBGP peering sessions that are reachable by a single hop but are configured on a loopback interface or otherwise configured with a non-directly connected IP address. When deselected (default), a BGP routing process will verify the connection of single-hop eBGP peering session (TTL=254) to determine if the eBGP peer is directly connected to the same network segment by default. If the peer is not directly connected to same network segment, connection verification will prevent the peering session from being established.

5. Select Allow connections with neighbor that is not directly connected to accept and attempt BGP connections to external peers residing on networks that are not directly connected. (Optional) Enter the time-to-live in the TTL hops field. Valid values are between 1 and 255. Alternately, select Limited number of TTL hops to neighbor, to secure a BGP peering session. Enter the maximum number of hops that separate eBGP peers in the TTL hops field. Valid values are between 1 and 254.

6. (Optional) Select the Use TCP MTU path discovery check box to enable a TCP transport session for a BGP session.

7. Choose the TCP connection mode from the TCP Transport Mode drop-down list. Options are Default, Active, or Passive.

8. (Optional) Enter a Weight for the BGP neighbor connection.

9. Select the BGP Version that the Firepower Threat Defense device will accept from the drop-down list. The version can be set to 4-Only to force the software to use only Version 4 with the specified neighbor. The default is to use Version 4 and dynamically negotiate down to Version 2 if requested.

Step 16

Update Migration, only if AS migration is considered.

1. (Optional) Select the Customize the AS number for routes received from the neighbor check box to customize the AS_PATH attribute for routes received from an eBGP neighbor.

2. Enter the local autonomous system number in the Local AS number field. Valid values are any valid autonomous system number from 1 to 4294967295 or 1.0 to65535.65535.

3. (Optional) Select the Do not prepend local AS number to routes received from neighbor check box to prevent the local AS number from being prepended to any routes received from eBGP peer.

4. (Optional) Select the Replace real AS number with local AS number in routes received from neighbor check box to replace the real autonomous system number with the local autonomous system number in the eBGP updates. The autonomous system number from the local BGP routing process is not prepended.

5. (Optional) Select the Accept either real AS number or local AS number in routesreceived from neighbor check box to configure the eBGP neighbor to establish a peering session using the real autonomous system number (from the local BGP routing process) or by using the local autonomous system number.

Step 17

Click OK.

Step 18

Click Save.

Step 1

When editing a Firepower Threat Defense device, click Routing.

Step 2

Choose BGP > IPv4 or IPv6.

Step 3

Click Add Aggregate Address.

Step 4

Enter a value for the aggregate timer (in seconds) in the Aggregate Timer field. Valid values are 0 or any value between 6 and 60. The default value is 30.

Step 5

Click Add and update the Add Aggregate Address dialog:

1. Network — Enter an IPv4 address or select the desired network/hosts objects.

2. Attribute Map — (Optional) Enter or select the route map used to set the attribute of the aggregate route.

3. Advertise Map — (Optional) Enter or select the route map used to select the routes to create AS_SET origin communities.

4. Suppress Map — (Optional) Enter or select the route map used to select the routes to be suppressed.

5. Generate AS set path Information — (Optional) Select the check box to enable generation of autonomous system set path information.

6. Filter all routes from updates — (Optional) Select the check box to filter all more-specific routes from updates.

7. Click OK.

Step 1

On the Device Management page, click Routing.

Step 2

Choose BGP > IPv4.

Step 3

Click Filtering.

Step 4

Click Add and update the Add Filter dialog:

1. Access List— Select an access control list that defines which networks are to be received and which are to be suppressed in routing updates.

2. Direction— (Optional) Select a direction that specifies if the filter should be applied to inbound updates or outbound updates.

3. Protocol— (Optional) Select the routing process for which you want to filter: None, BGP, Connected, OSPF, RIP, or Static.

4. Process ID— (Optional) Enter the process ID for the OSPF routing protocol.

5. Click OK.

Step 5

Click Save.

Step 1

On the Device Management page, click Routing.

Step 2

Choose BGP > IPv4 or IPv6.

Step 3

Click Networks.

Step 4

Click Add and update the Add Networks dialog:

1. Network— Enter the network to be advertised by the BGP routing processes.

2. (Optional) Route Map— Enter or select a route map that should be examined to filter the networks to be advertised. If not specified, all networks are redistributed.

3. Click OK.

Step 5

Click Save.

Step 1

On the Device Management page, click Routing.

Step 2

Choose BGP > IPv4 or IPv6.

Step 3

Click Redistribution.

Step 4

Click Add and update the Add Redistribution dialog:

1. Source Protocol— Select the protocol from which you want to redistribute routes into the BGP domain from the Source Protocol drop-down list.

2. Process ID— Enter the identifier for the selected source protocol. Applies to the OSPF protocol.

3. Metric— (Optional) Enter a metric for the redistributed route.

4. Route Map— Enter or select a route map that should be examined to filter the networks to be redistributed. If not specified, all networks are redistributed.

5. Match— The conditions used for redistributing routes from one routing protocol to another. The routes must match the selected condition to be redistributed. You can choose one or more of the following match conditions. These options are enabled only when OSPF is chosen as the Source Protocol.

   • Internal

   • External 1

   • External 2

   • NSSA External 1

   • NSSA External 2

6. Click OK.

Step 1

On the Device Management page, click Routing.

Step 2

Choose BGP > IPv4 or IPv6.

Step 3

Click Route Injection.

Step 4

Click Add and update the Add Route Injection dialog:

1. Inject Map— Enter or select the route map that specifies the prefixes to inject into the local BGP routing table.

2. Exist Map— Enter or select the route map containing the prefixes that the BGP speaker will track.

3. Injected routes will inherit the attributes of the aggregate route— Select this to configure the injected route to inherit attributes of the aggregate route.

4. Click OK.

Step 5

Click Save.