neighbor ebgp-btsh

Enables BGP time to live (TTL) security hack protection (BTSH) for eBGP.
Syntax
neighbor { ip-address | ipv6-address | peer-group-name } ebgp-btsh
no neighbor { ip-address | ipv6-address | peer-group-name } ebgp-btsh
Command Default

Disabled.

Parameters
ip-address
Specifies the IPv4 address of the neighbor.
ipv6-address
Specifies the IPv6 address of the neighbor.
peer-group-name
Specifies a peer group.
Modes

BGP configuration mode

BGP address-family IPv6 unicast configuration mode

BGP address-family IPv4 unicast VRF configuration mode

BGP address-family IPv6 unicast VRF configuration mode

Usage Guidelines

When this command is entered in BGP global configuration mode, it applies only to the IPv4 address family. Use this command in BGP address-family IPv6 unicast configuration mode for BGP4+ configurations. To maximize the effectiveness of this feature, the neighbor ebgp-btsh command should be executed on each participating device.

The neighbor ebgp-btsh command is supported for both directly connected peering sessions and multihop eBGP peering sessions. When the neighbor ebgp-btsh command is used, BGP control packets sent by the device to a neighbor have a TTL value of 255. In addition, the device expects the BGP control packets received from the neighbor to have a TTL value of either 254 or 255. For multihop peers, the device expects the TTL for BGP control packets received from the neighbor to be greater than or equal to 255, minus the configured number of hops to the neighbor. If the BGP control packets received from the neighbor do not have the anticipated value, the device drops them.

The no form of the command disables BTSH for eBGP.

Examples

The following example enables GTSM between a device and a neighbor with the IP address 10.10.10.1.

device# configure terminal
device(config)# router bgp
device(config-bgp-router)# neighbor 10.1.1.1 ebgp-btsh

The following example enables GTSM between a device and a neighbor with the IPv6 address 2001:2018:8192::125.

device# configure terminal
device(config)# router bgp
device(config-bgp-router)# address-family ipv6 unicast
device(config-bgp-ipv6u)# neighbor 2001:2018:8192::125 ebgp-btsh
History
Release version Command history
08.0.30 Support was added for the BGP address-family IPv6 unicast VRF configuration mode.