BGP Fundamentals untuk ISP

# Filter INBOUND: Terima hanya prefix yang valid dari peer
/routing filter add \
  chain=BGP-IN \
  prefix=0.0.0.0/0 \
  prefix-length=0-32 \
  rule="if (dst in 10.0.0.0/8 || dst in 172.16.0.0/12 || dst in 192.168.0.0/16) { reject }"

# Filter: Tolak prefix terlalu kecil (> /24 untuk IPv4)
/routing filter add \
  chain=BGP-IN \
  rule="if (dst-len > 24) { reject }"

# Filter: Tolak default route dari peer (jika tidak diinginkan)
/routing filter add \
  chain=BGP-IN \
  prefix=0.0.0.0/0 \
  prefix-length=0 \
  rule="reject"

# Filter OUTBOUND: Hanya announce prefix kita sendiri
/routing filter add \
  chain=BGP-OUT \
  rule="if (dst != 203.0.113.0/24) { accept } else { reject }"

# Filter: Jangan announce private ASN
/routing filter add \
  chain=BGP-OUT \
  rule="if (bgp-as-path ~ \"64[0-9]{3}\") { reject }"

# Blokir bogon prefixes dari internet
:local bogons { \
  "0.0.0.0/8"; "10.0.0.0/8"; "100.64.0.0/10"; \
  "127.0.0.0/8"; "169.254.0.0/16"; "172.16.0.0/12"; \
  "192.0.0.0/24"; "192.0.2.0/24"; "192.168.0.0/16"; \
  "198.18.0.0/15"; "198.51.100.0/24"; "203.0.113.0/24"; \
  "224.0.0.0/3" \
}

:foreach bogon in=$bogons do={
  /routing filter add \
    chain=BGP-IN \
    prefix=$bogon \
    rule="reject"
}

# Juga blokir AS_PATH yang mencurigakan
/routing filter add \
  chain=BGP-IN \
  rule="if (bgp-as-path ~ \"^0 \" || len(bgp-as-path) > 25) { reject }"

# Format: ASN:VALUE (contoh: 65000:1)
# Beberapa community standar:
# 65535:0   = NO_EXPORT (jangan di-export ke eBGP peer)
# 65535:666 = BLACKHOLE
# 65535:0   = NO_ADVERTISE (jangan di-announce ke siapapun)

# Set community pada route yang di-announce
/routing filter add \
  chain=BGP-OUT \
  set-bgp-communities=65000:100 \
  rule="if (dst in 203.0.113.0/24) { accept }"

# Match community pada filter inbound
/routing filter add \
  chain=BGP-IN \
  rule="if (bgp-communities includes 65000:100) { \
    set-bgp-local-pref 200; accept \
  }"

# Contoh penggunaan: ISP Indonesia (IIX community)
# Community untuk menandai route dari IIX
/routing filter add \
  chain=BGP-IIX-IN \
  set-bgp-communities=65000:1 \
  rule="accept"

# Community untuk menandai route dari upstream
/routing filter add \
  chain=BGP-TRANSIT-IN \
  set-bgp-communities=65000:2 \
  rule="accept"

# Set router ID
/routing router-id add \
  name=bgp-id \
  address=203.0.113.1

# Buat BGP instance
/routing bgp instance add \
  name=bgp1 \
  as=65000 \
  router-id=bgp-id \
  redistribute-static=no \
  redistribute-connected=no \
  redistribute-ospf=no

# Tambah BGP peer (upstream ISP)
/routing bgp peer add \
  name=upstream-isp1 \
  instance=bgp1 \
  remote-address=198.51.100.1 \
  remote-as=64600 \
  address-families=ip \
  multihop=no \
  in-filter=BGP-IN \
  out-filter=BGP-OUT \
  comment="Upstream ISP 1"

# Tambah BGP peer (IX peering)
/routing bgp peer add \
  name=ix-peer1 \
  instance=bgp1 \
  remote-address=103.26.156.1 \
  remote-as=7713 \
  address-families=ip \
  in-filter=BGP-IN \
  out-filter=BGP-OUT \
  comment="IIX Peering - Telkom"

# Announce prefix kita
/ip firewall address-list
/routing filter add \
  chain=BGP-OUT \
  prefix=203.0.113.0/24 \
  rule="accept"

# Lihat BGP peers
/routing bgp peer print

# Lihat status detail peer
/routing bgp peer print detail where name=upstream-isp1

# Lihat BGP routes yang diterima
/routing bgp advertisements print peer=upstream-isp1

# Lihat routes yang di-announce
/routing bgp advertisements print

# Monitor BGP state changes
/log print where topics~"bgp"

# Cek jumlah routes
/routing bgp peer print count-only

# Reset BGP session (soft reset)
/routing bgp peer refresh upstream-isp1

# Hard reset BGP session
/routing bgp peer reset upstream-isp1

# Primary ISP — set local-pref lebih tinggi
/routing filter add \
  chain=BGP-ISP1-IN \
  rule="set-bgp-local-pref 200; accept"

# Backup ISP — local-pref default (100)
/routing filter add \
  chain=BGP-ISP2-IN \
  rule="accept"

# Peer ISP 1 (primary)
/routing bgp peer add \
  name=isp1-primary \
  instance=bgp1 \
  remote-address=198.51.100.1 \
  remote-as=64600 \
  in-filter=BGP-ISP1-IN \
  out-filter=BGP-OUT \
  comment="Primary ISP"

# Peer ISP 2 (backup)
/routing bgp peer add \
  name=isp2-backup \
  instance=bgp1 \
  remote-address=198.51.101.1 \
  remote-as=64601 \
  in-filter=BGP-ISP2-IN \
  out-filter=BGP-OUT \
  comment="Backup ISP"

# Load balancing: set local-pref sama untuk traffic masuk
# dan gunakan AS-path prepend pada satu ISP untuk preferensi

# Cek status BGP peers
/routing bgp peer print detail where name=upstream-isp1

# Aktifkan BGP debug logging
/system logging add topics=bgp action=memory

# Lihat BGP log
/log print where topics~"bgp"

# Common issues:
# - State: Active → Tidak bisa TCP connect (firewall block port 179)
# - State: OpenSent → AS number salah di remote-as
# - State: Established tapi no route → Filter salah

# Pastikan port 179 tidak diblokir
/ip firewall filter print where dst-port=179

# Test TCP connectivity
/tool port-scan address=198.51.100.1 port=179

# Lihat route yang diterima dari peer
/routing bgp advertisements print peer=upstream-isp1

# Lihat jumlah route
/ip route print count-only where bgp