Configuring BGP over MPLS and Private Connections

UniFi Gateways can exchange routes over BGP with a private connection such as a carrier MPLS or L3VPN circuit, an AWS Direct Connect or Azure ExpressRoute link, or a cross-connect delivered through an exchange such as Equinix Fabric or Megaport. This lets you connect branch offices to a data center or cloud environment over a dedicated Layer 3 path, learn the remote networks dynamically, and either keep internet traffic local or send it through the data center. This article explains how to connect the private circuit to your gateway, how to choose between a LAN and a WAN interface for it, and which architectures UniFi supports.

For the BGP configuration file format and the ISP and AWS VPN examples, see UniFi - Border Gateway Protocol (BGP). This article builds on that one.

Choosing the Interface Type

Connect the private circuit as a LAN interface unless you need the private connection to carry your default route. A UniFi Gateway does not install a default route (0.0.0.0/0) learned from a BGP neighbor. If all traffic, including internet-bound traffic, must leave over the private connection, then connect it as a WAN interface instead so that UniFi’s SLA-based WAN failover will manage the default route.

Connecting as a LAN Interface

This is the recommended method of configuring an interface. It should be used anytime standard Internet traffic exists locally (i.e., it is not used as the default route in UniFi).

1. Navigate to Settings > Networks and create a new network for the private connection (for example, MPLS Transit).
2. Set the gateway address and subnet to the IP address your provider assigned to you (for example, 172.31.10.2/30).
3. Disable the DHCP server on this network. Nothing on the transit subnet should receive an address from UniFi.
4. Navigate to Ports, select the gateway, select the port connected to the provider’s handoff, and set the new network as its native VLAN. If the handoff carries more than one connection on the same port (for example, the two sessions of an Azure ExpressRoute circuit), create one transit network per connection and add the additional networks to the port as tagged VLANs, matching the VLAN IDs your provider assigned.
5. Create your BGP configuration file. Use the provider’s router address as the neighbor and advertise only the networks you want the remote side to reach. 
6. Navigate to Settings > Routing > BGP, create a new BGP entry, and upload the file.
7. Verify that the remote networks appear in Settings > Policy Engine > Routing Table with the provider’s router as the next hop.

Once configured, the transit network will be placed in the Internal firewall zone. The default behavior is to allow traffic between it and your other networks in that zone. If the provider’s side should only reach specific networks or services, create a firewall policy for the transit network that allows the required traffic and blocks the rest. See Zone-Based Firewalls in UniFi.

Connecting as a WAN Interface

Use this option when the private connection must carry your default route.

1. Navigate to Settings > Internet, select an available WAN port for the private connection, and set the connection type to Static IP using the address your provider assigned, with the provider’s router address as the gateway.
2. Set the WAN priority so this WAN is primary and your internet WAN, if you have one, is the failover. This is what ensures that this interface will be used as the default route.
3. Create a custom SLA for this WAN with verification servers that are reachable through the private connection, such as a server in your data center, and assign it to the WAN. The default Auto SLA uses public internet targets, which may not be reachable over a private circuit.
4. Create a firewall policy that allows the BGP neighbor to reach the gateway: 
   1. Source Zone
      1. External
      2. Optionally select IP, to limit this to the BGP neighbor's IP address
   2. Action
      1. Allow
      2. Auto Allow Return Traffic
   3. Destination Zone
      1. Gateway
      2. Any
      3. Optionally select a Specific Port, and configure the Service to BGP.
5. Create additional firewall rules to allow relevant traffic from the private WAN interface (External Zone) to other local networks (Internal Zone). If you do not do this, all unestablished incoming traffic will be blocked by default.
6. Exclude relevant networks from NAT. Traffic to your data center and other sites must keep its original source addresses, or connections initiated from the data center toward your devices will fail. 
   1. Go to UniFi Devices, select your gateway, open Settings > Global NAT Settings, uncheck Auto, select Custom, then select Excluded Networks. 
   2. If you keep an internet WAN as a failover, then create a Masquerade NAT rule for those networks on the internet WAN interface so that internet traffic is still translated during a failover. See DNAT, SNAT, and Masquerading in UniFi.
7. Create the BGP configuration file as in Option A, with the provider’s router address as the neighbor, and upload it under Settings > Routing > select your BGP configuration > Enable .
8. Optionally configure WAN Failover and WAN SLAs, which will determine the default route for traffic.

BGP and UniFi SD-WAN

There are two common architectures using BGP with UniFi's native SD-WAN:

• The UniFi Hub(s) use BGP to peer with a dedicated datacenter network, and/or cloud network to advertise those routes to SD-WAN spokes that do not have a direct connection of their own. This can be configured in Settings > Routing Table > select Redistribute to SD-WAN.
  Note: You must also modify your BGP FRR file to include the 'redistribute ospf' keyword.

• Each UniFi spoke uses BGP to peer with a private circuit which it uses as the preferred path, and SD-WAN is used only as a backup. Routes learned over BGP take precedence over the same routes learned over SD-WAN, so traffic moves to SD-WAN only when the BGP neighbor is down and returns to the private circuit when the neighbor recovers.

For hub and spoke setup, see UniFi Gateway - Setting Up SD-WAN with UniFi Site Manager and Fabrics.

Common Architectures

Private Connection With Local Internet Breakout

The branch gateway peers with the carrier over a LAN interface, learns the data center and other branch networks, and sends internet traffic out its own WAN. Deny the default route in your inbound route map so the branch keeps using its internet WAN.

Private Connection Carrying the Default Route

All branch traffic, including internet traffic, leaves over the private connection and exits through the data center. The private connection must be configured as a WAN interface with NAT disabled. If the branch also has an internet circuit, configure it as the failover WAN with SLAs, and add a NAT Masquerade to ensure traffic is translated appropriately.

Two Data Centers

Both data centers connect to the same carrier network and advertise their networks. The carrier delivers the best route for each network to the branch, so the branch configuration is the same as for a single data center, depending if a local Internet breakout exists, or whether the default route must use the private connection. When the two data centers advertise the same networks, which one the branch uses is decided by the route preferences set at the data centers (for example, AS path prepending on the secondary data center) and by the carrier; the branch needs no preference configuration of its own. When each data center advertises its own networks, traffic to each network goes to the data center that owns it. If the branch receives the same network from two neighbors with equal attributes, maximum-paths enables ECMP across them.

Private Cloud Connections (AWS Direct Connect, Azure ExpressRoute)

A gateway in your data center or colocation facility peers with the cloud provider over a dedicated circuit, either directly or through an exchange such as Equinix Fabric or Megaport. The exchange delivers a Layer 3 handoff; the BGP configuration is the same as for a carrier circuit, using a LAN interface on the UniFi gateway.

• AWS Direct Connect: use a private virtual interface. AWS accepts up to 100 prefixes per BGP session, so advertise summary networks. For redundancy, AWS recommends two connections, each with its own virtual interface and BGP session.
• Azure ExpressRoute: use private peering. Azure provides two BGP sessions on two /30 subnets, and both must be configured for the connection to be covered by Azure’s availability SLA. Azure’s AS number is 12076.

Neither cloud provider advertises a default route to you. Your gateway advertises your on-premises networks and receives the VPC or VNet address ranges.

Additional Considerations

• Default routes from BGP neighbors: A UniFi Gateway does not install a default route received from a BGP neighbor. A third-party router peering with a UniFi Gateway can still receive a default route from it if you configure default-originate for that neighbor.
• ECMP: Equal Cost Multipath (ECMP) is supported with maximum-paths.
• Restricting neighbors: BGP cannot be bound to a single interface. To control which routers may connect, use bgp listen range <network> peer-group <group> in your configuration file.
• Shadow Mode Failover: A Shadow Mode gateway inherits the BGP configuration from the primary unit. The private circuit must be physically connected to both gateways, for example through a WAN switch between the provider handoff and the two gateways.
• MTU and MSS Clamping: A private connection delivered on a physical port normally carries the standard 1500-byte MTU, and no MSS adjustment is needed. The gateway’s MSS Clamping setting (UniFi Devices > select your gateway > Settings) applies only to PPPoE WAN connections. If your private connection runs inside a tunnel, configure MSS where the tunnel is defined: in Site Manager for UniFi SD-WAN, or in the tunnel’s settings for an IPsec VPN.
• Re-advertising routes: Networks received from one eBGP neighbor are advertised to your other eBGP neighbors without additional configuration. Use outbound route maps to limit what each neighbor receives.

FAQs

Can my UniFi Gateway accept a default route from my MPLS provider?

No. To send all traffic over the private connection, connect it as a WAN interface (Option B) so that the default route is managed by UniFi’s WAN failover.

Should I use a /30 or a /31 for the transit subnet?

Either works. Use whichever your provider assigns.

Does the private connection need to be on a dedicated port?

A dedicated port is recommended. If the provider’s handoff carries several connections as tagged VLANs, one port can carry all of them, with one transit network per VLAN.

Is there anything different about Equinix Fabric or Megaport?

No. The exchange delivers a Layer 3 connection, and your gateway forms a BGP session over it exactly as it would over a carrier circuit.

Will networks learned over BGP be reachable from my SD-WAN spokes?

Yes. All networks learned over BGP on a hub are shared with the SD-WAN group.