[j-nsp] Improving EBGP defaults: sideloading RFC 8212 on Junos

Job Snijders job at instituut.net
Sun Sep 24 12:18:09 EDT 2017

Dear all,

Currently, out of the box, a device running Junos will accept any routes
and announce any routes on EBGP session when no import or export policy is
defined for that neighbor. This oftentimes is not the appropriate behavior
in context of Internet routing as it can easily result in full table route

Adam Chappell created an interesting shim to improve the default behaviour
related to EBGP Internet routing on Juniper Junos via a commit script. You
can download the SLAX script here:

The commit script ensures an implicit “deny-any” policy is provisioned on
all EBGP sessions for either the import or export direction (or both) if
the respective import/export policies are absent. In other words: if you
forget to configure an export policy statement, the commit script ensure a
deny-any export statement is put in place. This protects both yourself and
your neighbor!

Props to both Adam for creating the script and to Juniper for allowing such
permissionless patching! This is cool!

Some background info on RFC 8212 can be found here:

Kind regards,


More information about the juniper-nsp mailing list