BGP neighbor unsuppress-map

Using the aggregate-address command with no arguments will create an aggregate entry in the BGP routing table if there are any more-specific BGP routes available that fall in the specified range. The aggregate route will be advertised as coming from your autonomous system and has the atomic aggregate attribute set to show that information might be missing. (By default, the atomic aggregate attribute is set unless you specify the as-set keyword.)

If a subset of suppressed routes needs to be made available, you can unsuppress those routes on a per-neighbor basis using the neighbor unsuppress-map command.

Video Demonstration

from: Cisco IOS IP Routing: BGP Command Reference

neighbor unsuppress-map

To selectively advertise routes previously suppressed by the aggregate-address command, use the neighbor unsuppress-map command in address family or router configuration mode. To restore the system to the default condition, use the no form of this command.

neighbor {ip-address | peer-group-name} unsuppress-map route-map-name

no neighbor {ip-address | peer-group-name} unsuppress-map route-map-name

Syntax Description

ip-address	IP address of the BGP-speaking neighbor.
peer-group-name	Name of a BGP peer group.
route-map-name	Name of a route map.

Command Default

No routes are unsuppressed.

Command Modes

Address family configuration
Router configuration

Command History

Release	Modification
12.0(5)T	This command was introduced.
12.0(5)T	Address family configuration mode was added.
12.2(33)SRA	This command was integrated into Cisco IOS Release 12.2(33)SRA.
12.2SX	This command is supported in the Cisco IOS Release 12.2SX train. Support in a specific 12.2SX release of this train depends on your feature set, platform, and platform hardware.

Usage Guidelines

Use of the neighbor unsuppress-map command allows specified suppressed routes to be advertised.

Examples

The following BGP router configuration shows that routes specified by a route map named map1 are suppressed:

access-list 3 deny 172.16.16.6

access-list 3 permit any

route-map map1 permit 10

match ip address 3

!

router bgp 65000 

network 172.16.0.0

neighbor 192.168.1.2 remote-as 40000

aggregate-address 172.0.0.0 255.0.0.0 suppress-map map1

neighbor 192.168.1.2 unsuppress-map map1

neighbor 192.168.1.2 activate

The following example shows the routes specified by internal-map being unsuppressed for neighbor 172.16.16.6:

router bgp 100

address-family ipv4 multicast

 network 172.16.0.0

 neighbor 172.16.16.6 unsuppress-map internal-map

Related Commands

Command	Description
address-family ipv4 (BGP)	Places the router in address family configuration mode for configuring routing sessions such as BGP, RIP, or static routing sessions that use standard IPv4 address prefixes.
address-family vpnv4	Places the routing in address family configuration mode for configuring routing sessions such as BGP, RIP, or static routing sessions that use standard VPNv4 address prefixes.
aggregate-address	Creates an aggregate entry in a BGP routing table.
neighbor route-map	Applies a route map to inbound or outbound routes.

Files:
Topology
Configs
BGP Configuration

BGP aggregate-address suppress-map

Using the aggregate-address command with no arguments will create an aggregate entry in the BGP routing table if there are any more-specific BGP routes available that fall in the specified range. The aggregate route will be advertised as coming from your autonomous system and has the atomic aggregate attribute set to show that information might be missing. (By default, the atomic aggregate attribute is set unless you specify the as-set keyword.)

Using the suppress-map keyword creates the aggregate route but suppresses advertisement of specified routes. You can use the match clauses of route maps to selectively suppress some more-specific routes of the aggregate and leave others unsuppressed. IP access lists and autonomous system path access lists match clauses are supported.

Video Demonstration

from: Cisco IOS IP Routing: BGP Command Reference

aggregate-address

To create an aggregate entry in a Border Gateway Protocol (BGP) database, use the aggregate-address command in address family or router configuration mode. To disable this function, use the no form of this command.

aggregate-address address mask [as-set] [as-confed-set] [summary-only] [ suppress-map map-name ] [ advertise-map map-name ] [ attribute-map map-name ]

no aggregate-address address mask [as-set] [as-confed-set] [summary-only] [ suppress-map map-name ] [ advertise-map map-name ] [ attribute-map map-name ]

Syntax Description

address	Aggregate address.
mask	Aggregate mask.
as-set	(Optional) Generates autonomous system set path information.
as-confed-set	(Optional) Generates autonomous confederation set path information.
summary-only	(Optional) Filters all more-specific routes from updates.
suppress-map map-name	(Optional) Specifies the name of the route map used to select the routes to be suppressed.
advertise-map map-name	(Optional) Specifies the name of the route map used to select the routes to create AS_SET origin communities.
attribute-map map-name	(Optional) Specifies the name of the route map used to set the attribute of the aggregate route.

Command Default

The atomic aggregate attribute is set automatically when an aggregate route is created with this command unless the as-set keyword is specified.

Command Modes

Address family configuration (config-router-af)

Router configuration (config-router)

Command History

Release	Modification
10.0	This command was introduced.
11.1(20)CC	The nlri unicast, nlri multicast, and nlri unicast multicast keywords were added.
12.0(2)S	The nlri unicast, nlri multicast, and nlri unicast multicast keywords were added.
12.0(7)T	The nlri unicast, nlri multicast, and nlri unicast multicast keywords were removed. Address family configuration mode support was added.
12.2(33)SRA	This command was integrated into Cisco IOS Release 12.2(33)SRA.
12.2(33)SRB	Support for IPv6 was added.
12.2(33)SB	This command was integrated into Cisco IOS Release 12.2(33)SB.
12.2(33)SXI	This command was integrated into Cisco IOS Release 12.2(33)SXI.
12.2(33)SRE	The as-confed-set keyword was added.
Cisco IOS XE Release 3.1S	This command was introduced on Cisco ASR 1000 series routers.

Usage Guidelines

You can implement aggregate routing in BGP and Multiprotocol BGP (mBGP) either by redistributing an aggregate route into BGP or mBGP, or by using the conditional aggregate routing feature.

Using the aggregate-addresscommand with no keywords will create an aggregate entry in the BGP or mBGP routing table if any more-specific BGP or mBGP routes are available that fall within the specified range. (A longer prefix that matches the aggregate must exist in the Routing Information Base (RIB).) The aggregate route will be advertised as coming from your autonomous system and will have the atomic aggregate attribute set to show that information might be missing. (By default, the atomic aggregate attribute is set unless you specify the as-set keyword.)

Using the as-setkeyword creates an aggregate entry using the same rules that the command follows without this keyword, but the path advertised for this route will be an AS_SET consisting of all elements contained in all paths that are being summarized. Do not use this form of the aggregate-addresscommandwhen aggregating many paths, because this route must be continually withdrawn and updated as autonomous system path reachability information for the summarized routes changes.

Using the as-confed-set keyword creates an aggregate entry using the same rules that the command follows without this keyword. This keyword performs the same function as theas-set keyword, except that it generates autonomous confed set path information.

Using the summary-onlykeyword not only creates the aggregate route (for example, 192.*.*.*) but also suppresses advertisements of more-specific routes to all neighbors. If you want to suppress only advertisements to certain neighbors, you may use the neighbor distribute-list command, with caution. If a more-specific route leaks out, all BGP or mBGP routers will prefer that route over the less-specific aggregate you are generating (using longest-match routing).

Using the suppress-mapkeyword creates the aggregate route but suppresses advertisement of specified routes. You can use the match clauses of route maps to selectively suppress some more-specific routes of the aggregate and leave others unsuppressed. IP access lists and autonomous system path access lists match clauses are supported.

Using the advertise-mapkeyword selects specific routes that will be used to build different components of the aggregate route, such as AS_SET or community. This form of theaggregate-addresscommand is useful when the components of an aggregate are in separate autonomous systems and you want to create an aggregate with AS_SET, and advertise it back to some of the same autonomous systems. You must remember to omit the specific autonomous system numbers from the AS_SET to prevent the aggregate from being dropped by the BGP loop detection mechanism at the receiving router. IP access lists and autonomous system path access lists match clauses are supported.

Using the attribute-mapkeyword allows attributes of the aggregate route to be changed. This form of the aggregate-addresscommand is useful when one of the routes forming the AS_SET is configured with an attribute such as the community no-export attribute, which would prevent the aggregate route from being exported. An attribute map route map can be created to change the aggregate attributes.

Files:
Topology
Configs
BGP Configuration

BGP aggregate-address as-set

Using the aggregate-address command with no arguments will create an aggregate entry in the BGP routing table if there are any more-specific BGP routes available that fall in the specified range. The aggregate route will be advertised as coming from your autonomous system and has the atomic aggregate attribute set to show that information might be missing. (By default, the atomic aggregate attribute is set unless you specify the as-set keyword.)

Using the as-set keyword creates an aggregate entry using the same rules that the command follows without this keyword, but the path advertised for this route will be an AS_SET consisting of all elements contained in all paths that are being summarized. Do not use this form of aggregate-address when aggregating many paths, because this route must be continually withdrawn and re-updated as autonomous system path reachability information for the summarized routes changes.

Video Demonstration

from: Cisco IOS IP Routing: BGP Command Reference

aggregate-address

To create an aggregate entry in a Border Gateway Protocol (BGP) database, use the aggregate-address command in address family or router configuration mode. To disable this function, use the no form of this command.

aggregate-address address mask [as-set] [as-confed-set] [summary-only] [ suppress-map map-name ] [ advertise-map map-name ] [ attribute-map map-name ]

no aggregate-address address mask [as-set] [as-confed-set] [summary-only] [ suppress-map map-name ] [ advertise-map map-name ] [ attribute-map map-name ]

Syntax Description

address	Aggregate address.
mask	Aggregate mask.
as-set	(Optional) Generates autonomous system set path information.
as-confed-set	(Optional) Generates autonomous confederation set path information.
summary-only	(Optional) Filters all more-specific routes from updates.
suppress-map map-name	(Optional) Specifies the name of the route map used to select the routes to be suppressed.
advertise-map map-name	(Optional) Specifies the name of the route map used to select the routes to create AS_SET origin communities.
attribute-map map-name	(Optional) Specifies the name of the route map used to set the attribute of the aggregate route.

Command Default

The atomic aggregate attribute is set automatically when an aggregate route is created with this command unless the as-set keyword is specified.

Command Modes

Address family configuration (config-router-af)

Router configuration (config-router)

Command History

Release	Modification
10.0	This command was introduced.
11.1(20)CC	The nlri unicast, nlri multicast, and nlri unicast multicast keywords were added.
12.0(2)S	The nlri unicast, nlri multicast, and nlri unicast multicast keywords were added.
12.0(7)T	The nlri unicast, nlri multicast, and nlri unicast multicast keywords were removed. Address family configuration mode support was added.
12.2(33)SRA	This command was integrated into Cisco IOS Release 12.2(33)SRA.
12.2(33)SRB	Support for IPv6 was added.
12.2(33)SB	This command was integrated into Cisco IOS Release 12.2(33)SB.
12.2(33)SXI	This command was integrated into Cisco IOS Release 12.2(33)SXI.
12.2(33)SRE	The as-confed-set keyword was added.
Cisco IOS XE Release 3.1S	This command was introduced on Cisco ASR 1000 series routers.

Usage Guidelines

You can implement aggregate routing in BGP and Multiprotocol BGP (mBGP) either by redistributing an aggregate route into BGP or mBGP, or by using the conditional aggregate routing feature.

Using the aggregate-addresscommand with no keywords will create an aggregate entry in the BGP or mBGP routing table if any more-specific BGP or mBGP routes are available that fall within the specified range. (A longer prefix that matches the aggregate must exist in the Routing Information Base (RIB).) The aggregate route will be advertised as coming from your autonomous system and will have the atomic aggregate attribute set to show that information might be missing. (By default, the atomic aggregate attribute is set unless you specify the as-set keyword.)

Using the as-setkeyword creates an aggregate entry using the same rules that the command follows without this keyword, but the path advertised for this route will be an AS_SET consisting of all elements contained in all paths that are being summarized. Do not use this form of the aggregate-addresscommandwhen aggregating many paths, because this route must be continually withdrawn and updated as autonomous system path reachability information for the summarized routes changes.

Using the as-confed-set keyword creates an aggregate entry using the same rules that the command follows without this keyword. This keyword performs the same function as theas-set keyword, except that it generates autonomous confed set path information.

Using the summary-onlykeyword not only creates the aggregate route (for example, 192.*.*.*) but also suppresses advertisements of more-specific routes to all neighbors. If you want to suppress only advertisements to certain neighbors, you may use the neighbor distribute-list command, with caution. If a more-specific route leaks out, all BGP or mBGP routers will prefer that route over the less-specific aggregate you are generating (using longest-match routing).

Using the suppress-mapkeyword creates the aggregate route but suppresses advertisement of specified routes. You can use the match clauses of route maps to selectively suppress some more-specific routes of the aggregate and leave others unsuppressed. IP access lists and autonomous system path access lists match clauses are supported.

Using the advertise-mapkeyword selects specific routes that will be used to build different components of the aggregate route, such as AS_SET or community. This form of theaggregate-addresscommand is useful when the components of an aggregate are in separate autonomous systems and you want to create an aggregate with AS_SET, and advertise it back to some of the same autonomous systems. You must remember to omit the specific autonomous system numbers from the AS_SET to prevent the aggregate from being dropped by the BGP loop detection mechanism at the receiving router. IP access lists and autonomous system path access lists match clauses are supported.

Using the attribute-mapkeyword allows attributes of the aggregate route to be changed. This form of the aggregate-addresscommand is useful when one of the routes forming the AS_SET is configured with an attribute such as the community no-export attribute, which would prevent the aggregate route from being exported. An attribute map route map can be created to change the aggregate attributes.

Files:
Topology
Configs
BGP Configuration

Cisco IOS Group Encrypted Transport VPN (GETVPN)

Cisco’s Group Encrypted Transport VPN (GET VPN) introduces the concept of a trusted group to eliminate point-to-point tunnels and their associated overlay routing. All group members (GMs) share a common security association (SA), also known as a group SA. This enables GMs to decrypt traffic that was encrypted by any other GM. (Note that IPsec CE acts as a GM.) In GET VPN networks, there is no need to negotiate point-to- point IPsec tunnels between the members of a group, because GET VPN is “tunnel-less.”

The IETF standard RFC-6407 Group Domain of Interpretation (GDOI) is an integral part of GET VPN. The GDOI protocol was introduced in 12.4(2)T but the GET VPN solution with several enhancements was released in 12.4(11)T.

1.1 Key GET VPN Benefits

• Instantaneous large-scale any-to-any IP connectivity using a group IPsec security paradigm
• Takes advantage of underlying IP VPN routing infrastructure and does not require an overlay routing control plane
• Seamlessly integrates with multicast infrastructures without the multicast replication issues typically seen in traditional tunnel-based IPsec solutions.
• Preserves the IP source and destination addresses during the IPsec encryption and encapsulation process. Therefore GET VPN integrates very well with features such as QoS and traffic engineering.

1.2 Technology Overview

• GDOI (RFC 6407)
• Key servers (KSs)
• Cooperative (COOP) KSs
• GMs.
• IP tunnel header preservation
• Group security association
• Rekey mechanism
• Time-based anti-replay (TBAR)

Configuration Guide

Key Server (KS) Configuration

Configuring IKE Policy on KS

crypto isakmp policy 1

 encr aes

 authentication pre-share

! Pre-shared key autentication

 group 2

crypto isakmp key “password” address 0.0.0.0 0.0.0.0

! you can customize passwords for each router

crypto isakmp keepalive 15 periodic

Configuring GDOI Group

crypto key generate rsa general-keys label GDOI_KEY modulus 1024 exportable

! If a redundant KS is present, these keys (Public and Private Keys) must also be exported to this redundant KS manually.

access-list 169 permit ip 192.168.150.40 0.0.0.7 192.168.150.72 0.0.0.7

access-list 169 permit ip 192.168.150.72 0.0.0.7 192.168.150.40 0.0.0.7

!Symmetric ACL Policy – Example used in current scenario

! KS GDOI Configuration follows:

crypto ipsec transform-set GET esp-aes esp-sha-hmac

crypto ipsec profile GET

 set security-association lifetime seconds 7200

! Indicates how long IPSec SAs remain valid before they are renegotiated (can be set to default)

 set transform-set GET

crypto gdoi group GET

 identity number 1

! Group SA identifier

 server local

 ! Indicates this is a Key Server

  rekey algorithm aes 128

  rekey retransmit 10 number 2

 ! Indicates if a change is made on KS, rekey messages will be sent in 10 seconds, twice

  rekey authentication mypubkey rsa GDOI_KEY

! Specifies the keys to be used for a rekey to GDOI GMs

  rekey transport unicast

  sa ipsec 1

! Configuring Security Policies

   !

  profile GET

! Use IPSec Profile configured above

   match address ipv4 169

! Indicates interesting traffic to be encrypted

   replay time window-size 5

! Anti-replay window-size is set to 5

  address ipv4 “IP OF KEYSERVER”

! Use this address to source rekey packets

Group Member  (GM) Configuration

Configuring IKE Policies on GM-1 & GM-2

!All GM’s authenticate with the KS, using pre-shared keys

crypto isakmp policy 1

 encr aes

 authentication pre-share

 group 2

 lifetime 300

crypto isakmp key “password” address 0.0.0.0 0.0.0.0

!

GDOI Group Configuration on GM-1 & GM-2

crypto gdoi group GET

 identity number 1

 server address ipv4 “IP OF KEYSERVER”

! KS Router

 client registration interface “LOCAL INTERFACE”

! LAN Interface – EX: client registration interface Vlan1/ GigabitEthernet0/1

Configuring and Applying Crypto MAP on GMs

crypto map GET 10 gdoi

 set group GET

!

interface “WAN”

 crypto map GET

Note:
No video demonstration in this post. Scenario tested in production network.

Files:
Cisco PDF GETVPN
Cisco VPNs Comparison