neighbor flowspec validation

Configures Border Gateway Protocol flow specification (BGP flowspec) route validation at neighbor or peer-group level.

Syntax

neighbor { ip-address | peer-group } flowspec validation [ redirect ]

no neighbor { ip-address | peer-group } flowspec validation [ redirect ]

Command Default

By default, flowspec validation is enabled at neighbor or peer-group level.

Parameters

ip-address: IP address in IPv4 format.
peer-group: Name of a peer group.
redirect: Specifies the validation of only the redirect IP nexthop address.

Modes

BGP address-family IPv4 flowspec configuration mode

Usage Guidelines

Flowspec validation can be configured at neighbor, peer-group or address-family level with the neighbor-level configuration prioritized over peer-group level configuration and the peer-group level configuration prioritized over the address-level configuration.

Use the neighbor flowspec validation command to configure flowspec validation at neighbor or peer-group level. To configure flowspec validation at address-family level, refer to the flowspec validation command.

By default, flowspec validation is enabled. Use the no form of the command to completely disable flowspec validation at neighbor or peer-group level. To only disable redirect IP nexthop validation at neighbor or peer-group level, use the no form of the command specifying the redirect option.

Only one flowspec validation configuration is allowed at a time. Configuration operates as follows:

When complete flowspec validation is already disabled at neighbor or peer-group level, issuing the no neighbor flowspec validation command specifying the redirect option has no impact; complete flowspec validation remains disabled.
When the redirect option is already disabled, issuing the no neighbor flowspec validation command without the redirect option changes the configuration to complete flowspec validation disabled at neighbor or peer-group level.

Examples

The following example shows how to disable IPv4 flowspec validation. In this example, only redirect IP nexthop validation is disabled for a peer group named peer-group1 in the default VRF.

device# configure terminal
device(config)# router bgp
device(config-bgp-router)# address-family ipv4 flowspec 
device(config-bgp-ipv4fs)# no neighbor peer-group1 flowspec validation redirect