| BGPD.CONF(5) | File Formats Manual | BGPD.CONF(5) |
bgpd.conf — BGP
routing daemon configuration file
The bgpd(8) daemon implements the Border Gateway Protocol version 4 as described in RFC 4271.
The bgpd.conf config file is divided into
the following main sections:
With the exception of macros, the sections should be grouped and
appear in bgpd.conf in the order shown above.
The current line can be extended over multiple lines using a backslash (‘\’). Comments can be put anywhere in the file using a hash mark (‘#’), and extend to the end of the current line. Care should be taken when commenting out multi-line text: the comment is effective until the end of the entire block.
Argument names not beginning with a letter, digit, or underscore must be quoted.
Additional configuration files can be included with the
include keyword, for example:
include "/etc/bgpd/bgpd-10.0.0.1.filter"
Macros can be defined that will later be expanded in context.
Macro names must start with a letter, digit, or underscore, and may contain
any of those characters. Macro names may not be reserved words (for example,
AS, neighbor, or
group). Macros are not expanded inside quotes.
For example:
peer1="1.2.3.4"
neighbor $peer1 {
remote-as 65001
}
These settings affect the operation of the bgpd(8) daemon as a whole.
AS
as-number [as-number]The AS numbers are assigned by local RIRs, such as:
The AS numbers 64512 – 65534 are designated for private use. The AS number 23456 is reserved and should not be used. 4-byte AS numbers may be specified in either the ASPLAIN format:
AS 196618
or in the older ASDOT format:
AS 3.10
connect-retry
secondsdump
[rib name]
(table-v2|table-mp|table)
file [interval]dump
(all|updates)
(in|out)
file [interval]The table-v2 and
table-mp RIB formats store multi-protocol RIBs
correctly, but the table format does not. The
latter two are provided only to support third-party tools lacking
support for the recommended table-v2 format.
Dump an alternative RIB by specifying name.
Specify an interval in seconds for periodic RIB
dumps.
The following will dump the entire RIB table, at startup and every 5 minutes thereafter, to a new file:
dump table-v2 "/tmp/rib-dump-%H%M" 300
Dumps of ongoing BGP activity include all BGP state
transitions, and all BGP messages in the specified direction. Use
updates to dump only BGP
UPDATE messages, without state transitions. Specify an
interval in seconds to restart periodically with a
new file:
dump all in "/tmp/all-in-%H%M" 300
fib-priority
priofib-update
(yes|no)no, do not update the Forwarding
Information Base, a.k.a. the kernel routing table. The default is
yes.
holdtime
secondsThe neighbor session is dropped if the session holdtime passes without receipt of a KEEPALIVE or an UPDATE message from the neighbor. The default is 90 seconds.
holdtime min secondslisten
on address [port
port]log
updatesnexthop
qualify via
(bgp|default)bgp, bgpd(8) may
verify nexthops using BGP routes. If set to
default, bgpd(8) may verify
nexthops using the default route. By default bgpd(8)
uses only static routes or routes added by other routing daemons, such as
ospfd(8).
rde
evaluate
(default|all)rde
med compare
(always|strict)always, the
MULTI_EXIT_DISC attributes will always be compared. The
default is strict, where the metric is only
compared between peers belonging to the same AS.
rde
rib name [no
evaluate]rde
rib name
[rtable number]no evaluate flag, and this precludes their export
to any kernel routing table. By default its routes will be evaluated, but
not exported to the kernel. They may be both evaluated and exported if
associated with a given rtable
number, which must belong to the routing domain that
bgpd(8) was started in. This table will not be consulted
during nexthop verification unless it is the one that
bgpd(8) was started in. It is unnecessary to create
Adj-RIB-In and Loc-RIB,
which are created automatically and used by default.
rde
route-age
(ignore|evaluate)evaluate, the route decision process
will also consider the age of the route in addition to its path
attributes, giving preference to the older, typically more stable, route.
This renders the decision process nondeterministic. The default is
ignore.
reject
as-set
(yes|no)yes, AS paths
attributes containing AS_SET path segments will be
rejected and all prefixes will be treated as withdraws. The default is
no.
router-id
dotted-quadrouter-id 10.0.0.1
rtable
numberrde rib Loc-RIB rtable number
socket
"path"
[restricted]restricted is specified, a restricted control
socket will be created. By default
/run/openbgpd/bgpd.sock.<rdomain> is used
where <rdomain> is the routing domain in which
bgpd(8) has been started. By default, no restricted
socket is created.
transparent-as
(yes|no)yes, AS paths to EBGP
neighbors are not prepended with the local AS. The default is
no.bgpd(8) supports the efficient lookup of data
within named
sets. An
as-set, a prefix-set, and an
origin-set store AS numbers, prefixes, and
prefixes/source-as pairs, respectively. Such sets may be referenced by
filter rules; see the FILTER section for
details. It is more efficient to evaluate a set than a long series of rules
for filtering each of its members.
One single roa-set may be defined, against
which bgpd(8) will validate the origin of each prefix. The
roa-set and the aspa-set are
merged with the corresponding tables received via
rtr sessions.
A set definition can span multiple lines, and an optional comma is allowed between elements. The same set can be defined more than once, in this case the definitions are merged into one common set.
as-set
name {
as-number ... }as-set stores AS numbers, and can be used with
the AS specific parameter in FILTER
rules.
aspa-set
{ customer-as
as-number [expires
seconds] provider-as
{ as-number
... } ...
}aspa-set holds a collection of
Validated ASPA Payloads (VAPs). Each as AS_PATH received
from an eBGP peer is checked against the aspa-set,
and the ASPA Validation State (AVS) is set.
expires can be set to the seconds since Epoch
until when this VAP is valid.
aspa-set {
customer-as 64511 provider-as { 64496 65496 }
customer-as 64496 provider-as { 65496 64544 }
}
origin-set
name {
address/len
maxlen mlen
source-as asn ...
}origin-set stores prefix/source-as pairs, and
can be used to filter on the combination by using the
origin-set parameter in
FILTER rules.
origin-set private { 10.0.0.0/8 maxlen 24 source-as 64511
203.0.113.0/24 source-as 64496 }
prefix-set
name {
address/len
... }prefix-set stores network prefixes and can be
used in place of the prefix parameter in
FILTER rules, and in
network statements. A prefix can be followed by
the prefixlen operators listed for the prefix
parameter in the PARAMETERS section.
The first example below creates a set of prefixes called “private”, to hold a number of RFC 1918 private network blocks. The second example shows the use of prefixlen operators.
prefix-set private { 10.0.0.0/8, 172.16.0.0/12,
192.168.0.0/16, fc00::/7 }
prefix-set as64496set { 192.0.2.0/24 prefixlen >= 26,
2001:db8::/32 or-longer }
roa-set
{
address/len
[maxlen mlen]
source-as asn
[expires seconds] ...
}roa-set holds a collection of
Validated ROA Payloads (VRPs). Each received prefix is
checked against the roa-set, and the Origin
Validation State (OVS) is set. expires can be set
to the seconds since Epoch until when this VRP is valid.
roa-set { 192.0.2.0/23 maxlen 24 source-as 64511
203.0.113.0/24 source-as 64496 }
rtr
address {
... }rtr block specifies a
RPKI to
Router (RTR) session.
RTR
sessions provide another means to load VRP sets into
bgpd(8). Changes propagated via the RTR protocol do not
need a config reload and are immediately applied. The union of all
VRP sets received via rtr
sessions and the entries in the roa-set is used to
validate the origin of routes. The rtr session properties are as follows:
descr
descriptionlocal-address
addressport
numberport is
323.network statements specify the networks
that bgpd(8) will announce as its own. An announcement
must also be permitted by the FILTER rules.
By default bgpd(8) announces no networks.
network
address/prefix
[set ...]network
(inet|inet6)
connected [set ...]network prefix-set name
[set ...]network
(inet|inet6)
priority number
[set ...]network
(inet|inet6)
rtlabel label
[set ...]network
(inet|inet6)
static [set ...]Each network statement may set default
AS path attributes:
network 192.168.7.0/24 set localpref 220
See also the ATTRIBUTE SET section.
flowspec statements specify the flowspec
rules that bgpd(8) will announce as its own. By default
bgpd(8) announces no flowspec rules.
flowspec
(inet|inet6)
rule [set ...]The following rule parameters can be set. Most number arguments in the below rules can be specified as a list of ranges enclosed in curly brackets using these operators:
= (equal, default) != (unequal) < (less than) <= (less than or equal) > (greater than) >= (greater than or equal) - (range including boundaries) >< (except range)
‘><’, and ‘-’ are binary operators (they take two arguments).
from
source [port
list]to
dest [port
list]any to match any address. In
most cases a to address must be specified and be
part of the announced networks.
Ports can be specified either by number or by name. For
example, port 80 can be specified as www. For a
list of all port name to number mappings see the file
/etc/services.
flags
a/bfragment
a/bicmp-type
type [code
code]icmp6-type
type [code
code]length
pktlenproto
protocoltos
string|numbercritical, inetcontrol,
lowdelay, netcontrol,
throughput, reliability,
or one of the DiffServ Code Points: ef,
af11 ...
af43, cs0
... cs7;
number may be either a hex or decimal number.The action taken when a flowspec rules matches depends on extended
communities. For example to block all traffic either
ext-community flow-rate
as-number:0 or ext-community
flow-pps as-number:0 need to
be set.
A vpn section configures a router to
participate in an MPLS Virtual Private Network. It specifies an
mpe(4) interface to use, a description, and various
properties of the VPN:
vpn "description" on mpe1 {
rd 65002:1
import-target rt 65002:42
export-target rt 65002:42
network 192.168.1/24
}
bgpd(8) will not exchange VPN routes with a neighbor by default, see the NEIGHBORS AND GROUPS section. The description is used when logging but has no further meaning to bgpd(8).
The mpe(4) interface will be used as the outgoing interface for routes to the VPN, and local networks will be announced with the MPLS label specified on the interface. The interface can provide VPN connectivity for another rdomain by being configured in that rdomain. The required rdomain must be configured on the interface before bgpd(8) uses it. Multiple VPNs may be connected to a single rdomain, including the rdomain that bgpd(8) is running in.
An example hostname.if(5) configuration for an mpe(4) interface providing connectivity to rdomain 1:
rdomain 1 mplslabel 2000 inet 192.198.0.1 255.255.255.255 up
The VPN properties are as follows:
export-target
subtype as-number:localexport-target
subtype IP:localrt, to ensure interoperability. The arguments are
further detailed in the ATTRIBUTE
SET section. More than one export-target can
be specified.
fib-update
(yes|no)no, do not update the Forwarding
Information Base, a.k.a. the kernel routing table. The default is
yes.
import-target
subtype as-number:localimport-target
subtype IP:localimport-target. The community
subtype should be a route target,
rt, to ensure interoperability. The arguments are
further detailed in the ATTRIBUTE
SET section. More than one import-target can
be specified.
network
argument ...rd
as-number:localrd
IP:localrd supplies BGP with
namespaces to disambiguate VPN prefixes, as these needn't be globally
unique. Unlike route targets, the rd neither
identifies the origin of the prefix nor controls into which VPNs the
prefix is distributed. The as-number or
IP of a rd should be set to
a number or IP that was assigned by an appropriate authority, whereas
local can be chosen by the local operator.bgpd(8) establishes TCP connections to other BGP
speakers called neighbors. A neighbor and its properties
are specified by a
neighbor
section:
neighbor 10.0.0.2 {
remote-as 65002
descr "a neighbor"
}
Neighbors placed within a
group section
inherit the properties common to that group:
group "peering AS65002" {
remote-as 65002
neighbor 10.0.0.2 {
descr "AS65002-p1"
}
neighbor 10.0.0.3 {
descr "AS65002-p2"
}
}
An entire network of neighbors may be accommodated by specifying an address/netmask pair:
neighbor 10.0.0.0/8
This is a
template that
recognises as a neighbor any connection from within the given network. Such
neighbors inherit their template's properties, except for their IP address.
A template may omit remote-as;
bgpd(8) then accepts any AS presented by the neighbor in
the OPEN message.
The neighbor properties are as follows:
announce
(IPv4|IPv6)
(none|unicast|vpn
|flowspec)At the moment, only none, which
disables the announcement of that address family,
unicast, vpn, which
allows the distribution of BGP MPLS VPNs, and
flowspec, which allows the distribution of Flow
Specification Rules, are supported.
The default is unicast for the same
address family of the session.
announce add-path recv
(yes|no)yes, the receive add-path capability is
announced, which allows reception of multiple paths per prefix. The
default is no.
announce add-path send
(no|all)announce add-path send
(best|ecmp
|as-wide-best) [plus
num] [max
num]all, best,
ecmp, or as-wide-best, the
send add-path capability is announced, which allows sending multiple paths
per prefix. The paths sent depend on which mode is selected:
noallbestecmpas-wide-bestplus allows the inclusion of
additional backup paths and works for best,
ecmp, and as-wide-best.
max can be used to limit the total amount of
paths sent for ecmp and
as-wide-best. Right now
ecmp and as-wide-best
are equivalent. The default is no. If
add-path send is active
then the setting of rde
evaluate is ignored.
announce as-4byte
(yes|no)no, the 4-byte AS capability is not
announced and so native 4-byte AS support is disabled. The default is
yes.
announce capabilities
(yes|no)no, capability negotiation is disabled
during the establishment of the session. This can be helpful to connect to
old or broken BGP implementations. The default is
yes.
announce enhanced refresh
(yes|no)yes, the enhanced route refresh
capability is announced. The default is no.
announce policy
(yes|no|enforce)yes, add the open policy role
capability. If the role of the neighbor does not correspond to the
expected role then the session will be closed. If
enforce is set the session will only establish if
the neighbor also announces the open policy capability. The default is
no.
announce refresh
(yes|no)no, the route refresh capability is not
announced. The default is yes.
announce restart
(yes|no)no, the graceful restart capability is
not announced. Currently only the End-of-RIB marker is supported and
announced by the restart capability. The default
is yes.
as-override
(yes|no)yes, all occurrences of the neighbor AS
in the AS path will be replaced with the local AS before
running the filters. The Adj-RIB-In still holds the unmodified AS path.
The default value is no.
demote
groupFor more information on interface groups, see the
group keyword in
ifconfig(8).
depend
on interfaceThe state of the network interfaces on the system can be
viewed using the show interfaces command to
bgpctl(8).
descr
descriptiondown
[reason]down reason was configured
at runtime, the reason is sent as Administrative
Shutdown Communication. The reason cannot exceed 255
octets.
dump
(all|updates)
(in|out)
file [interval]dump setting in
GLOBAL CONFIGURATION.
enforce
local-as
(yes|no)no, AS paths will not
be checked for AS loop detection. This feature is similar to allowas-in in
some other BGP implementations. Since there is no AS path loop check, this
feature is dangerous, and requires you to add filters to prevent receiving
your own prefixes. The default value is yes.
enforce
neighbor-as
(yes|no)yes, AS paths whose
leftmost
AS is not equal to the
remote
AS of the neighbor are rejected and a
NOTIFICATION
is sent back. The default value for IBGP peers is
no otherwise the default is
yes.
export
(none|default-route)none, no UPDATE
messages will be sent to the neighbor. If set to
default-route, only the default route will be
announced to the neighbor.
holdtime
secondsholdtime min secondsipsec
(ah|esp)
(in|out)
spi spi-number authspec
[encspec]ipsec statements per peer with manual keying, one
per direction. authspec specifies the authentication
algorithm and key. It can be
sha1 <key> md5 <key>
encspec specifies the encryption
algorithm and key. ah does not support
encryption. With esp, encryption is optional.
encspec can be
3des <key> 3des-cbc <key> aes <key> aes-128-cbc <key>
Keys must be given in hexadecimal format. After changing
settings, a session needs to be reset to use the new keys. The
ipsec flows only work with session using the
default port 179.
ipsec
(ah|esp)
ike-Ka. This can be done in
rc.conf.local(8). After starting the
isakmpd(8) and bgpd(8) daemons on both
sides, the session should be established. After changing settings, a
session needs to be reset to use the new keys. The
ipsec flows only work with session using the
default port 179.
local-address
addressno local-addresslocal-address is given, bgpd(8)
binds to this address first. no local-address
reverts back to the default.
local-as
as-number [as-number]AS.
Since there is no AS path loop check, this option is dangerous, and requires you to add filters to prevent receiving your ASNs. Intended to be used temporarily, for migrations to another AS.
log
nolog
updatesmax-prefix
number [restart
number]restart is specified, the session will be
restarted after number minutes.
max-prefix
number out
[restart number]restart is specified, the session will be
restarted after number minutes.
multihop
hopsmultihop statement defines the
maximum hops the neighbor may be away.
passiveport
portreject
as-set
(yes|no)yes, AS paths
attributes containing AS_SET path segments will be
rejected and all prefixes will be treated as withdraws. The default is
inherited from the global reject
as-set setting.
remote-as
as-numberrde
evaluate
(default|all)rde
evaluate setting.
rib
namerole
roleannounce policy will also
be disabled. On iBGP session the role setting is ignored and forced to
none.
route-reflector
[address]set
attribute ...neighbor or group block:
set localpref 300
See also the ATTRIBUTE
SET section. Set parameters are applied to the received prefixes;
the only exceptions are prepend-self,
nexthop no-modify and nexthop
self. These sets are rewritten into filter rules and can be
viewed with “bgpd -nv”.
tcp md5sig
password secrettcp md5sig
key secrettcp md5sig password mekmitasdigoat tcp md5sig key deadbeef
transparent-as
(yes|no)yes, AS paths to EBGP
neighbors are not prepended with the local AS. The default is inherited
from the global transparent-as setting.
ttl-security
(yes|no)no.bgpd(8) filters all BGP UPDATE messages, including its own announcements, and blocks them by default. Filter rules may match on neighbor, direction, prefix or AS path attributes. Filter rules may also modify AS path attributes.
For each UPDATE processed by the filter, the
filter rules are evaluated in sequential order, from first to last. The last
matching allow or deny rule
decides what action is taken. The default action is to deny.
The following actions can be used in the filter:
The rule parameters specify the UPDATES to which a rule applies. An UPDATE always comes from, or goes to, one neighbor. Most parameters are optional, but each can appear at most once per rule. If a parameter is specified, the rule only applies to packets with matching attributes.
as-set
nameas-set
name:
ASpeer-assource-astransit-asas-number is an AS number as explained
above under GLOBAL
CONFIGURATION. It may be set to neighbor-as,
which is expanded to the current neighbor remote AS number, or
local-as, which is expanded to the locally
assigned AS number.
When specifying an as-set
name, the AS path will instead be matched against
all the AS numbers in the set.
The operator can be unspecified (this case is identical to the equality operator), or one of the numerical operators
= (equal) != (unequal) - (range including boundaries) >< (except range)
>< and - are binary operators (they take two arguments);
with these, as-number cannot be set to
neighbor-as.
Multiple as-number entries for a given type or as-type as-number entries may also be specified, separated by commas or whitespace, if enclosed in curly brackets:
deny from any AS { 1, 2, 3 }
deny from any { AS 1, source-as 2, transit-as 3 }
deny from any { AS { 1, 2, 3 }, source-as 4, transit-as 5 }
avs
(valid | unknown |
invalid)community
as-number:localcommunity
namecommunity path attribute is present and matches.
Communities are specified as
as-number:local, where
as-number is an AS number and
local is a locally significant number between zero
and 65535. Both as-number
and local may be set to ‘*’ to do
wildcard matching. Alternatively, well-known communities may be given by
name instead and include BLACKHOLE,
GRACEFUL_SHUTDOWN,
NO_EXPORT, NO_ADVERTISE,
NO_EXPORT_SUBCONFED, and
NO_PEER. Both as-number and
local may be set to
neighbor-as, which is expanded to the current
neighbor remote AS number, or local-as, which is
expanded to the locally assigned AS number.
large-community
as-number:local:localLarge community path attribute is present and
matches. Communities are specified as
as-number:local:local,
where as-number is an AS number and
local is a locally significant number between zero
and 4294967295. Both
as-number and local may be set
to ‘*’ to do wildcard matching,
neighbor-as, which is expanded to the current
neighbor remote AS number, or local-as, which is
expanded to the locally assigned AS number.
ext-community
subtype as-number:localext-community
subtype IP:localext-community
subtype numvalueext-community
ovs (valid |
not-found | invalid)neighbor-as, which is expanded to the current
neighbor remote AS number, or local-as, which is
expanded to the locally assigned AS number. Wildcard matching is supported
for local, numvalue and
subtype. If wildcard matching is used on the
subtype then numvalue also
needs to be set to ‘*’. See also the
ATTRIBUTE SET section for further
information about the encoding.
from|to)
peeranyibgpebgpgroup descrAS
as-numberMultiple peer entries may also be specified, separated by commas or whitespace, if enclosed in curly brackets:
deny from { 128.251.16.1, 251.128.16.2, group hojo }
inet|inet6)inet is an alias for "prefix 0.0.0.0/0
prefixlen >= 0"; inet6 is an alias for
"prefix ::/0 prefixlen >= 0".
max-as-len
lenmax-as-seq
lenmax-communities|max-large-communities|max-ext-communities
numnexthop
addressorigin-set
nameovs
(valid | not-found |
invalid)prefix
address/lenprefix
address/len
prefixlen rangeprefix
address/len
or-longerprefix
address/len
maxlen mlenMultiple entries may be specified, separated by commas or whitespace, if enclosed in curly brackets:
deny from any prefix { 192.168.0.0/16, 10.0.0.0/8 or-longer }
Multiple lists can also be specified, which is useful for macro expansion:
good="{ 192.168.0.0/16, 172.16.0.0/12, 10.0.0.0/8 }"
bad="{ 224.0.0.0/4 prefixlen >= 4, 240.0.0.0/4 prefixlen >= 4 }"
ugly="{ 127.0.0.1/8, 169.254.0.0/16 }"
deny from any prefix { $good $bad $ugly }
Prefix length ranges are specified by using these operators:
= (equal) != (unequal) < (less than) <= (less than or equal) > (greater than) >= (greater than or equal) - (range including boundaries) >< (except range)
>< and - are binary operators (they take two arguments). For instance, to match all prefix lengths >= 8 and <= 12, and hence the CIDR netmasks 8, 9, 10, 11 and 12:
prefixlen 8-12
Or, to match all prefix lengths < 8 or > 12, and hence the CIDR netmasks 0–7 and 13–32:
prefixlen 8><12
This will match all prefixes in the 10.0.0.0/8 netblock with netmasks longer than 16:
prefix 10.0.0.0/8 prefixlen > 16
or-longer is a shorthand for:
prefixaddress/lenprefixlen >=len
maxlen mlen is a
shorthand for:
prefixaddress/lenprefixlen <=mlen
prefix-set
name [or-longer]or-longer, the UPDATES will
match any prefix in the prefix-set where
address/lenprefixlen >=len
quickquick option set, this rule is considered the last
matching rule, and evaluation of subsequent rules is skipped.
rib
nameset
attribute ...AS path attributes can be modified with
set.
set can be used on
network statements, in
neighbor or group blocks,
and on filter rules. Attribute sets can be expressed as lists.
The following attributes can be modified:
community
[delete]
as-number:localcommunity
[delete] name65535. Alternately, well-known communities may
be specified by name: GRACEFUL_SHUTDOWN,
NO_EXPORT, NO_ADVERTISE,
NO_EXPORT_SUBCONFED, or
NO_PEER. For delete, both
as-number and local may be set
to ‘*’ to do wildcard matching.
large-community
[delete]
as-number:local:locallarge-community
[delete] name4294967295. For
delete, both as-number and
local may be set to ‘*’ to do wildcard
matching.
ext-community
[delete] subtype
as-number:localext-community
[delete] subtype
IP:localext-community
[delete] subtype numvalueext-community
[delete] ovs
(valid | not-found |
invalid)bdc BGP Data Collection defgw Default Gateway esi-lab ESI Label esi-rt ES-Import Route Target l2vid L2VPN Identifier mac-mob MAC Mobility odi OSPF Domain Identifier ort OSPF Route Type ori OSPF Router ID ovs BGP Origin Validation State rt Route Target soo Route Origin / Source of Origin srcas Source AS vrfri VRF Route Import
Not all type and subtype value pairs are allowed by IANA and the parser will ensure that no invalid combination is created.
For delete,
subtype, numvalue, or
local, may be set to ‘*’ to do
wildcard matching. If wildcard matching is used on the
subtype then numvalue also
needs to be set to ‘*’.
localpref
numbermed
numbermetric
numberorigin
(igp|egp|incomplete)nexthop
(address|blackhole|reject|self|no-modify)set nexthop 192.168.0.1 set nexthop blackhole set nexthop reject set nexthop no-modify set nexthop self
pftable
tableprepend-neighbor
numberprepend-self
numberrtlabel
labelweight
numberstrftime(3), ipsec(4), pf(4), rdomain(4), tcp(4), bgpctl(8), bgpd(8), ipsecctl(8), isakmpd(8), rc.conf.local(8)
The bgpd.conf file format first appeared
in OpenBSD 3.5.
| August 16, 2023 | Debian |