BGP Exercises

 

Anatomy of a BGP Configuration

 

ip bgp-community new-format

!

router bgp 3582                                                           - Initial BGP config statement with ASN

 no synchronization                                                       - Do not synchronize with the IGP

 no auto-summary                                                         - no classfull boundaries

 bgp dampening                                                            - dampen route flaps

 network 128.223.0.0                                                   - network to announce into BGP

 neighbor 207.98.66.11 send-community                      - Send communities to peers

 neighbor 207.98.66.11 version 4                                             - BGP version 4 negotiation

 neighbor 207.98.66.11 soft-reconfiguration inbound                 - Store updates & allow reads. Without   reset

 neighbor 207.98.66.11 prefix-list sanity-filter in            - filter all incoming prefixes against this prefix-list

 neighbor 207.98.66.11 prefix-list my-routes out                          neighbor 207.98.66.11 prefix-list my-routes out         - filter all outgoing prefixes against this prefix-list

 neighbor 207.98.66.11 remote-as 3701                       - neighbor peering session

 neighbor 207.98.66.11 description NERO Transit (noc@nero.net)         - neighbor description

 neighbor 207.98.66.11 update-source POS 6/0/0        - peering session connection source

 neighbor 198.108.0.1 remote-as 3582             - set up an ibgp peering session

 neighbor 198.108.0.1 version 4                                   - BGP version 4

 neighbor 198.108.0.1 description IBGP-peer   - neighbor description

 neighbor 198.108.0.1 update-source loopback          - peering session connection source

!

ip prefix-list my-routes seq 5 permit 128.223.0.0/16                 - prefix-list filtering all outgoing advertised

ip prefix-list my-routes seq 50 deny 0.0.0.0/0 le 32                               prefixes.

!

ip prefix-list pond seq 5 permit 205.240.25.0/24                       - prefix-list filtering all incoming advertised

ip prefix-list pond seq 10 permit 199.217.92.0/22                     prefixes from peer.

ip prefix-list pond seq 15 permit 206.40.128.0/22

ip prefix-list pond seq 50 deny 0.0.0.0/0 le 32

!

ip prefix-list sanity-filter description "Deny default, RFC1918, net 10"    - no bogons

ip prefix-list sanity-filter seq 10 deny 127.0.0.0/8 le 32

ip prefix-list sanity-filter seq 15 deny 10.0.0.0/8 le 32

ip prefix-list sanity-filter seq 20 deny 172.16.0.0/12 le 32

ip prefix-list sanity-filter seq 25 deny 192.168.0.0/16 le 32

ip prefix-list sanity-filter seq 30 deny 192.0.2.0/24 le 32

ip prefix-list sanity-filter seq 50 permit 0.0.0.0/0 le 32

!

 

 

BGP Lab Exercise 1 - eBGP link to upstream provider.

 

 


 

1.      Remove OSPF from your router and do shutdown on your serial links.  We will only be using the Ethernet links for this exercise.

 

 

2.      Confirm that you are not longer receiving OSPF routes by doing a show ip route

 

We will now set up eBGP between all of the routers in the classroom.   Each table will be its own AS.  For example, Table A is AS 100.  Table E is AS 200, etc.   Instructors operate AS 1 and AS 2.

 

 

3.      Figure out your AS number.

 

AS:

 

 

4.      Verify the IP address block used for your PC link.  This is the network that we will announce to our BGP peers. Recall from the OSPF exercise that you received a /28 for the network connection to your PC – this is the address block you want to announce by BGP in this exercise.

 

 

Local address block:                             Mask:

 

 

 

5.      We will set up peering sessions according the map.     Decide which IP addresses you are going to use for your Point-to-Point links with your neighboring peer. 

 

 

6.      Configure BGP on your router to announce your network.

 

RouterA#config term

Enter configuration commands, one per line.  End with CNTL/Z.

RouterA(config)#ip bgp-community new-format

RouterA(config)#router bgp 100                  // use your AS number

RouterA(config-router)#network 81.199.108.80 mask 255.255.255.240

                                                                                                // use your network and mask

 

RouterA(config-router)#no synchronization    // you should have these commands as part // of your default BGP configuration

RouterA(config-router)#no auto-summary

RouterA(config-router)#bgp dampening

 

BGP is now configured on your router

 

 

7.      Set up a peering session with your neighbor:

 

RouterA(config)#router bgp 100                                         //use your AS number

RouterA(config-router)#neighbor 81.199.108.65 remote-as 1

                                                // use the IP address and AS number of your neighbor

 

RouterA(config-router)#neighbor 81.199.108.65 description My-Peer-with-AS1

RouterA(config-router)#neighbor 81.199.108.65 prefix-list my-routes out

RouterA(config-router)#neighbor 81.199.108.65 prefix-list sanity-filter in

 

 

8.      Define the prefix-lists that you will need.  This specifies which routes you will send out and which routes you will accept.

 

RouterA(config)#ip prefix-list my-routes description My routes outbound

RouterA(config)#ip prefix-list my-routes permit 81.199.108.80/28

RouterA(config)#ip prefix-list my-routes deny 0.0.0.0/0 le 32

RouterA(config)#

RouterA(config)#ip prefix-list sanity-filter description Sanity Inbound

RouterA(config)#ip prefix-list sanity-filter deny 127.0.0.0/8 le 32

RouterA(config)#ip prefix-list sanity-filter deny 10.0.0.0/8 le 32

RouterA(config)#ip prefix-list sanity-filter deny 172.16.0.0/12 le 32

RouterA(config)#ip prefix-list sanity-filter deny 192.168.0.0/16 le 32

RouterA(config)#ip prefix-list sanity-filter deny 192.0.2.0/24 le 32

RouterA(config)#ip prefix-list sanity-filter permit 0.0.0.0/0 le 32

 

Double check that you set your “my-routes” outbound filter to contain the network you wish to announce.

 

In this exercise, you trust your provider enough that you can use a simple sanity filter that denies a few things and then permits everything else.

 

 

 

 

 

9.      Check to see if the peering session is up:

 

RouterA#show ip bgp sum

BGP router identifier 81.199.108.66, local AS number 100

BGP table version is 3, main routing table version 3

 

Neighbor      V  AS MsgRcvd MsgSent   TblVer  InQ OutQ Up/Down State/PfxRcd

 

81.199.108.65 4   1       0       0        0    0    0 never   Idle 

 

 

10.   Check to see if you are sending routes to your neighbor?  Why or why not?

 

   RouterA#sh ip bgp neighbor x.x.x.x advertised-routes

 

 

11.  Check to see if you are receiving routes from your neighbor. 

 

   RouterA#show ip bgp

 

What routes are you receiving?

 

Other commands to monitor BGP:

 

RouterA#sh ip route

RouterA#sh ip bgp

RouterA#sh ip bgp neighbor

RouterA#sh ip bgp neighbor x.x.x.x received-routes     [*]

 

[*] Only works if “soft-reconfiguration inbound” has been configured for this peer

 

 

 

BGP Exercise 2 – Add links to a local BGP peer

 


 

1.                  AS 100 and AS 1100 represent two ISPs in the same country.  They are both connected to different upstream providers.  Before we add a local connection, traffic between AS 100 and AS 1100 goes over expensive international links to AS1 and AS 2.

 

2.                  We will add a local link between AS 100 and AS 1100.  Similarly, between AS 200 and AS 1200, etc.

 

3.                  Connect cables and configure IP addresses as necessary for the new links.

 

4.                  You should be able to ping across the new point-to-point links.

 

5.                  Add BGP configuration for the new links.

 

6.                  A simple “sanity filter” was good enough for the link to your upstream provider, but it’s not good enough for a link to a peer that you do not trust so much.  Use a strict filter that permits the routes that you want to receive from your peer and then denies everything else.  For example,

 

RouterC(config)#ip prefix-list as100-routes permit 81.199.109.80/28

RouterC(config)#ip prefix-list as100-routes deny 0.0.0.0/0 le 32

 

Remember that you only want to send your routes to your peer, and you only want to receive peer’s routes. If you send your peer all the routes you know, he will be able to send traffic to all the networks you know about – so use your network for his traffic. Unless he pays you money for this, this is not a desirable feature.

 

 

 

BGP Exercise 3 - Dual-homed/OSPF IGP/iBGP/Local eBGP peering

 


 

1.      We will now combine adjacent classroom tables into the same AS.

 

2.      There are two or three tables in each student AS, and each student AS is multi-homed to two upstream providers.

 

3.      Remove all old BGP configurations.

 

4.       Change the physical cables and the IP addresses as necessary to conform to the above diagram.

 

5.      Run OSPF between the routers within your AS.  You should verify:

-         Your addressing scheme. 

-         Agree with your peers what IP addresses you will be using for your peering links

-         Double check the ip addresses and masks of your Ethernet interfaces

-         Verify the ip addresses of your serial links

-         Verify the ip address and mask of your loopback interface

-         That you can reach all the PC and routers within your AS.

 

6.       Now you should configure your iBGP peering sessions.

-         Every router in your AS needs to have an iBGP session with every other router in your AS.

-         IBGP should be configured using the loopback interfaces.

 

RouterA(config)#router bgp 100                                           //use your AS number

RouterA(config-router)#neighbor 81.199.109.127 remote-as 100

                                                // The IP address is from your neighbour’s loopback interface

//  The neighbour’s  AS number is the same as your AS number

RouterA(config-router)#neighbor 81.199.109.127 update-source Loopback0

 

7.      Configure eBGP with your upstream providers.

 

8.      Add a network statement for all of the routes that your AS will originate.   Make sure that you aggregate your announcement!

 

9.      For IBGP, make sure you do Update Source Loopback 0.  And make sure that you have a route for your Loopbacks in your OSPF!

 

            RouterA(config-router)#neighbor 81.199.109.127 update-source loopback0        

 

10.  Determine what routes your neighbors will be sending you.

 

 

11.  Add route maps to filter your peers.  Inbound and Outbound.  Only accept the routes that your neighbor is supposed to originate.  Only send the routes that your AS is supposed to originate.

 

12.  Can you reach everything in your neighboring AS?

 

BGP Testing

 

1.                    Make sure that you have connectivity within your AS.  You should set-up OSPF so that you have connectivity between the routers and PCs in your AS.

 

2.                    Verify that you can see routes for all networks in your AS by using show IP route.  Test connectivity using ping and traceroute, as well as “show ip bgp” and “show ip route”.

 

3.                    Add some additional routes to simulate connections to customers.  Obtain IP address allocations from the registry (instructors), add routes to “null 0”, and use bgp “network” statements to bring the routes into BGP.  Adjust your filters as appropriate.  Get your peers to adjust their filters too.

 

4.                    Review your filters.  Make sure that you are seeing the right information from everyone.

 

5.                    What routes do you see in your routing table?     What do the ASpaths look like?  Which routes are preferred?

 

6.                    Look at the routing table of other ASes to understand how traffic flows in the network.

 

7.                    Verify that you can get to all the PCs in the entire classroom (not just in your own AS).

 

8.                    Experiment with breaking connections.  See how the routing changes.