Networking-Blog

My WordPress Blog

BGP AS-Path Filter Lists

A filter list is a form of route policy that restricts the routes that will be advertised 
or accepted based on the AS-Path of the route. To configure a filter list, you must 
first create an AS-path access list based on the known paths you wish to permit.

as-path access-list xx permit 701
as-path access-list xx permit 701 6461
as-path access-list xx permit 701 6461 3

!
The list above will permit the following AS-paths:

701
701 6461
701 6461 3

To appy this list to a BGP session, use the following command:

neighbor <IP address> filter-list xx in|out

The list can be applied either to the route received (inbound) or the routes advertised
(outbound). Now let us suppose that to adjust the routing, an administrator at MIT
used AS-path-prepending to make routes to one provider more preferred over another.

This new prepended AS-path would look like this:

701 6461 3 3

This path would never be permitted through the AS-path filter because AS 3 appears
twice. Worse, suppose that after the filter was changed to match this, the administrator
at MIT decided to go back to a standard announcement, or decided to prepend twice.
This would mean a headache for the person maintaining the filter and delay needed
changes.

To make the list more flexible, Cisco has enabled the use of regular expressions in an
as-path filter list. The same list above could be rewritten to permit prepends from all
of the providers in the AS path, and even shorten the list:

as-path access-list xx permit ^(_701)+(_6461)*(_3)$

The filter list above would permit the following AS-paths:

701
701 701
701 6461
701 3
701 6461 3
701 6461 6461 3 3 3

Clearly this second list is shorter, and much more flexible.

The characters that are used above are as follows:

Char. Meaning
^ Beginning of character string
_ Any whitespace
( ) Brackets are used to group items together
NNN The numbers represent the number patterns of the AS numbers.
* Zero or more of the previous object
+ One or more of the previous object

 

The list above will permit the following AS-paths:

701
701 6461
701 6461 3

To appy this list to a BGP session, use the following command:

neighbor <IP address> filter-list xx in|out

The list can be applied either to the route received (inbound) or the routes advertised
(outbound). Now let us suppose that to adjust the routing, an administrator at MIT
used as-path-prepending to make routes to one provider more preferred over another.

This new prepended AS path would look like this:

701 6461 3 3

This path would never be permitted throught the AS-path filter because AS 3 appears
twice. Worse, suppose that after the filter was changed to match this, the administrator
at MIT decided to go back to a standard announcement, or decided to prepend twice.
This would mean a headache for the person maintaining the filter and delay needed
changes.

To make the list more flexible, Cisco has enabled the use of regular expressions in an
as-path filter list. The same list above could be rewritten to permit prepends from all
of the providers in the AS path, and even shorten the list:

as-path access-list xx permit ^(_701)+(_6461)*(_3)$

The filter list above would permit the following AS-paths:

701
701 701
701 6461
701 3
701 6461 3
701 6461 6461 3 3 3

Clearly this second list is shorter, and much more flexible.

The characters that are used above are as follows:

Char. Meaning
^ Beginning of character string
_ Any whitespace
( ) Brackets are used to group items together
NNN The numbers represent the number patterns of the AS numbers.
* Zero or more of the previous object
+ One or more of the previous object

The Basics of BGP Route Reflection

A BGP speaker will not advertise a route learned via another IBGP speaker to a third
IBGP speaker. By relaxing this restriction a bit and by providing additional control,
we can allow a router to advertise (reflect) IBGP learned routes to other IBGP
speakers. This will reduce the number of IBGP peers within an AS.

The rule states: that any route received from an iBGP neighbor must not be advertised
to any other iBGP neighbor.

Configuring Border Gateway Protocol (BGP) can be quite onerous, particularly with
large numbers of peering sessions that must be configured manually. In fact, in a
large network, the full-mesh requirement for IBGP can be a provisioning nightmare.
 

BGP’s answer to the IBGP pairing configuration nightmare that is the full mesh is
called route reflection. Route reflection allows sharing of routing information among
a group of routers without having to send the exact same information to each of them
individually. It’s sort of like giving information to one person and having them
distribute it to all their peers.

IBGP comes with a significant restriction: IBGP peers should not re-advertise IBGP–
learned routes to other IBGP speakers, which is why they all need to be fully meshed.
If you can’t re-advertise IBGP routes, you must be directly connected to the originator
of the route, hence the full mesh requirement. Remember, IBGP has no dedicated loop
prevention mechanism, and this is why you need route reflectors for large networks. 

The concept of route reflection allows you to designate one or more of your routers as
route reflectors. BGP relaxes the re-advertising restriction on these route reflectors,
allowing them to accept and propagate IBGP routes to their clients.

 

As the IBGP learned routes are reflected, it is possible to have the routing information
loop. The Route Reflector scheme has a few methods to avoid this:

Originator−id: this is an optional, non transitive BGP attribute that is four bytes long
and is created by a RR. This attribute will carry the router−id (RID) of the originator of
the route in the local AS. Thus, due to poor configuration, if the routing information
comes back to the originator, it will be ignored.

neighbor 6.6.6.6 route−reflector−client

 

A route reflector is BGP router that is allowed to break the iBGP loop avoidance rule.
Route reflectors can advertise updates received from an iBGP peer to another iBGP
peer under specific conditions.

By breaking the rules, route reflectors are used to eliminate the full mesh requirement
and allow for building iBGP networks that scale easily and cleanly.

How is this accomplished?

BGP Route Reflector follows the below listed rules to achieve this goal:

iBGP routers are divided into Route Reflectors, Route Reflector clients and non-client
Peers. Routes received from a Route-Reflector-client is reflected to other clients and
non-client neighbors. Routes received from non-client neighbors are reflected to
Route-Reflector-client neighbors only.

Setting the Originator-ID attribute in the reflected update if it is not already set.
Adding the Cluster-ID to the Cluster-list attribute in the reflected update.

A Route Reflector reflects routes considered as best routes only. If more than one
update is received for the same destination, only the BGP best route is reflected.

A Route Reflector is not allowed to change any attributes of the reflected routes
including the next-hop attribute.

 

Route Reflectors and Loop Prevention :

The following rules are used to detect and avoid routing loops caused by route
reflection:

If a router received an iBGP route with the Originator-ID attribute set to its own
router-id, the route is discarded. If a route reflector receives a route with a cluster-list
attribute containing its cluster-id, the route is discarded.

 

What is BGP, where/when are we gonna use it ?

Overview:

A) BGP is the successor of EGP [Exterior Gateway Protocol], and currently its the only
EGP deployed.
BGP is an Enhanced Distance Vector Protocol used in routing between
Autonomous Systems [AS]
“aka Interdomain Routing”, where an AS is a collection of
networks under single administration.

We use BGP in several occasions as Service Providers networks, Multihomed
customers and large
enterprise networks, etc…

 

BGP Basics:

  • Only one BGP process per router.
  • There is two types of BGP, IBGP & EBGP, if the as-numbers of the peering routers
    are the same then its IBGP, if they are different then its EBGP.
  • BGP uses AS numbers [1-64511] as public and [64512-65535] as private.
  • BGP uses TCP as its reliable transport protocol and it runs over TCP port 179.
  • The router with the higher router-id establishes the BGP peering session.
  • BGP uses Keepalive messages to detect the presence of its neighbor, Keepalive
    interval value is 60 sec, and Holdtime is 180 sec by default [1:3 ratio],
    Holdtime value is exchanged in the Open Message, and you can only modify
    the Holdtime value, BGP peers use the lower Holdtime value configured on
    either of them.
  • BGPuses triggered updates, 5 sec interval for IBGP and 30 sec interval for
    EBGP.
  • Mandatory well known attributes must exist in each routing update.
  • If multiple paths exist for the same network, only one is selected as the best
    route and the remaining routes are stored in the memory, Router propagates
    best routes only to its neighbors.
  • If multi path load sharing is enabled, router can select multiple paths to a
    single destination and installs them in the routing table, multiple path load
    sharing in BGP supports up to 16 paths.
  • Before a route is installed in the routing table, the router checks if its learned
    from another routing protocol rather than BGP, if it was learned from another
    routing protocol the router compares the Administrative Distance [AD] and
    prefers the lower.
  • BGP Split Horizon Rule: When a router receives an update it never sends it
    back to the source which it received from.
  • IBGP Split Horizon Rule: Routes learned from an IBGP neighbor is never sent
    to other IBGP neighbors, thus all IBGP routers inside an AS needs full mesh for
    consistent routing decisions.
  • AS-Path loop prevention mechanism: When a router receives an update
    containing its own AS number; it silently ignores the update.
  • EBGP peers should be reachable for all BGP speaking routers inside an AS,
    this is achieved by either redistributing connected interfaces of the EBGP peers
    into IGP, or run IGP over the EBGP peers interface and make them passive so
    that they don’t exchange IGP information, or finally use the “neighbor ip-
    address next-hop-self
    ” command so that the edge router announces it self as
    the next hop for the IBGP peers.
  • BGP sessions can be initiated using loopback interfaces, IGP or Static Routes
    are used for providing reachability between loopbacks, also the update source
    for the BGP session should be modified in order to successfully establish the
    session using the “neighbor ip-address update-source loopback number”
    command. For EBGP sessions to be established successfully using the
    loopback interfaces you will need to use the “neighbor ip-address ebgp-
    multihop value
    “ command.
  • IGP is used inside an AS to provide full reachability required for establishing
    IBGP sessions, fast convergence in case of physical failure in one of the
    multiple paths between IBGP routers, and next hop resolving “aka recursive
    look up” for appropriate packet forwarding.

BGP Path Attributes :

  • Mandatory Well Known Attributes:
    • Next-hop:ip address of the router sending the updates, by default it
      changes
      when a route is advertised to EBGP neighbor but not when its
      advertised to
      IBGP neighbor.
    • AS-Path:Sequence of ASs path a route has traveled through.
    • Origin: Indicates how BGP learned the route [IGP – EBGP – ?].
  • Discretionary Well Known Attributes:
    • Local Preference:used for consistent routing policy inside an AS.
    • Atomic Aggregate: informs a neighbor router that the originating router
      aggregated the routes.
  • Transitive Optional Attributes:
    • Aggregator:Specify the ip address and the AS number of the router that
      performed
      the aggregation.
    • Community: Route tagging mechanism used in filtering or route
      selection process.
  • Non-Transitive Optional Attributes:
    • Multi-Exit Discriminator [MED]: Discriminate between multiple exit points within an AS.
    • Cost Community: Used to influence best-path selection for IBGP and
      confederations only.
    • Originator-id: Used as a loop prevention mechanism in case of multiple
      Route Reflectors.

BGP Session Establishment Process :

  • Single BGP process is started on the router using “router bgp as-number”
    command.
  • Neighbors must be configured manually on both sides using “neighbor ip-
    address
    remote-as as-number“ command.
  • It uses TCP port 179 and the session of the router with the higher Router-id is
    retained.
  • The first state of the BGP session is IDLE which indicates that the router is
    currently not attempting any session establishment, for a router to change its
    IDLE state; the configured neighbor ip address should be reachable.
  • When peers are correctly configured the state is changes to ACTIVE which
    indicates that the router is actively sending connections attempts to its
    neighbor.
  • When the TCP connection attempt succeed, the router sends an Open Message
    containing BGP session information and changes the state to be OpenSent.
    The Open Message contains [BGP version number – AS of local router –
    Holdtime
     – Router-ID – Optional parameters].
  • If the neighbor router accepts the parameters in the Open Message; it replies
    with its own Open Message, the local router receives the Open Message and
    changes the state to OpenConfirm, and it verifies the parameters of the
    neighbor router, if accepted a keepalive message is sent as signal of acceptance
    and then the state is changed to Established.


Route Selection Criteria :

  1. Next-hop: If not reachable the route is not installed in the routing table.
  2. Weight: Local to the router.
  3. Local Preference: Local within an AS.
  4. Originated Routes: Routes originated using the network or summary
    commands.
  5. AS-Path: Prefers the shortest path.
  6. Origin Code: IGP < EGP < ?
  7. MED: Prefers the lowest value.
  8. EBGP routes over IBGP routes.
  9. For IBGP: Prefers path via closest IGP neighbor [Next-Hop with lowest IGP
    metric].
  10. For EBGP: Oldest path.
  11. Lowest BGP Router-id.

 

Advertising Networks :

There are three ways to announce networks into BGP :

  • Network command, Redistribution and Aggregation.
  • when either of the three ways is used the AS-Path will appear empty indicating
    that the route is locally originated, when the route traverses through other
    ASes, the forwarding router prepends its own AS number to the AS-Path.
  • Network command operates differently in BGP; indicates which routes will be
    injected in the BGP table not which interface will BGP run over.
  • Using a Route-Map with the Network command allows you to alter Weight,
    Local Preference, MED and tagging the route.
  • When redistributing routes into BGP, they carry an origin of incomplete “?“. –
    Conditional Route Injection: is injecting a route into BGP with no matching
    route in the routing table, this is achieved by using the “bgp inject-map map-
    name exist-map map-name” command.

Summarization & Aggregation :

  • Automatic summarization is enabled by default.
  • For a router to install a classful network in the BGP table when Automatic
    summarization is enabled; A classful network statement with a classful mask
    and at least one subnet of this classful network should exist in the routing
    table.
  • When Automatic summarization is enabled; all redistributed subnets will be
    summarized to their classful network.
  • When summarization is disabled, an exact match must be found in the routing
    table.
  • Aggregation is summarization of routes when it is advertised to other
    neighbors, and its configured using “aggregate-address ip-address
    mask”command.
  • For an aggregate route to be advertised to other neighbors; a route within the
    range of the aggregate must exist in the BGP table in order to install the
    aggregate in the BGP table.
  • By default both the aggregate and the specific routes are advertised to the
    neighbors, to advertise the aggregate only you will have to use the “summary-
    only” keyword with the aggregate command.

Securing BGP Peers :

  • MD5 authentication between BGP peers by using the “neighbor ip-address
    password password
    ” command.
  • TTL-Security: The router compares the TTL value received with the locally
    configured hop count value, this option is supported for both directly connected
    and multihop EBGP peers. the command for this option is “neighbor ip-
    address ebgp-multihop ttl
    “; where TTL is a numeric value.

Multihoming :

  • Multihoming is a customer being connected to a single ISP with multiple links
    or connected to multiple ISP’s.
  • Multihomed customers should run BGP with their ISPs using public AS and
    provider independent address space.
  • Multihomed customers should advertise their own address space only to their
    ISPs and do not advertise routes learned from their ISPs do avoid acting as a
    Transit-AS between their ISPs.
  • For influencing Upstream ISP selection, Weight and Local Preference can be
    used inside a Multihomed Customer AS.
  • For influencing Downstream ISP selection, MED can be used if the customer is
    multihomed to a single ISP as MED doesn’t traverse through ASes, and AS-
    path Prepending
    can be used if the customer is multihomed to multiple ISPs
    because AS-path attribute traverses through ASes.


AS-Path Filtering :

  • Used to announce or accept prefixes based on AS-Path Attribute.
  • It uses Regular Expressions.
  • Its implemented on per neighbor basis.
  • Use “ip as-path access-list number [permit/deny] as-regular-expression” &
    “neighbor ip-address filter-list access-list-number [in/out]” commands.

Prefix-List filtering :

  • Used to filter announce and accept specific prefixes.
  • It has some advantages over IP Access Lists as: Provide flexibility in editing,
    inserting and deleting individual lines, Matches based on subnetmask, etc…
  • Its implemented on per neighbor basis.
  • An with no Le/Ge matches exactly the specified prefix.
  • An entry with Le/Ge matches any route within the range specified.
  • Configuration example :
    • “ip prefix-list name seq number [permit/deny] prefix/length ge value le value” “neighbor ip-address prefix-list name [in/out]” “redistribute-list prefix-list name out routing-process“.


Out Bound Route Filtering [ORF] :

  • Its implemented on per neighbor basis.
  • Its a BGP feature that allows a router to accept a prefix-list from a neighbor and
    apply it to locally configured ORF neighbor.
  • A router can install an inbound prefix-list to a peer as an outbound prefix-list.
  • Its used to minimize the number of updates sent between neighbors and reduce
    system resources.
  • Configuration example :
    • “neighbor prefix-list name [in/out]” “neighbor capability orf prefix-list
      [send/receive/both]
      ”

ORF message contains :

  • Address Family Information [AFI]/ Subsequent AFI
  • ORF types
  • When to refresh
  • List of ORF entries

ORF Types :

  • type 1 –> Network Layer Reachability Information [NLRI]
  • type 2 –> Communities
  • type 3 –> Extended Communities
  • type 128 –> Prefix-List

Route-Map Filtering :

  • Route-Map matches: prefix-list/access-list/route originator/next-
    hop/origin/AS-path/community/IGP tag/IGP type[internal/external].
  • Route-Map can set: origin/next-hop/weight/local preference/MED/community.
  • IP Policy List: is grouping of route-map match clauses then attaching to route-
    map.
  • Its implemented on per neighbor basis.
  • Route Map Continue Cause: its like the match and the set causes of the route-
    map, when a match in the route-map is successful continue clause -if
    configured- jumps to a pre-specified route-map entry, the continue clause takes
    place if a match is successful, if not then it is ignored.
  • If the route-map has no match clause, the continue clause takes place
    automatically, if a match is successful the continue clause takes place, if not
    then it is ignored.
  • Configuration example:
    • “ip policy-list name [permit/deny]match [as-path/metric/community]
      route-map name permit seq-number match policy-map namematch ip address prefix-list namematch ip next-hop prefix-list namematch ip route-source prefix-list name continue seq-number
      neighbor ip-address route-map name[in/out]”

AS-Path Prepending :

  • Used to influence other ASes to select a specific return path towards an AS.
  • Used to distribute the load of returning traffic for multihomed customers,
    however in this case you will have to monitor the traffic and prepend AS to path
    as needed to accomplish the traffic load.
  • To avoid BGP AS-Path loop prevention mechanism, use only the AS number of
    the sending AS.
  • Service Providers use AS-Path filter to allow routes that are originated from
    Customers AS only, if the Customer is going to use AS-Path prepending the
    Service Provider will have to change their filter to allow AS-Path containing
    more than one copy of Customer’s AS number.
  • AS-Path prepending is applied using Route-Maps on per neighbor basis.
    ”route-map route-map-name permit 10 set as-path prepend as-no as-no as-no
    neighbor ip-address route-map route-map-name out”.


BGP hide local AS :

  • The “neighbor ip-address local-as as-number [no-prepend [replace-as [dual-
    as
    ]]]”

    • no-prepend: does not prepend local AS number to any learned EBGP
      routes.
    • replace-as: replaces the local AS number with the one set int the
      command to the AS-path attribute.
    • dual-as: allows the establishment of EBGP sessions using either the
      real AS number or using the AS number set in the command.
  • This usually happens while connecting two different BGP networks with
    different AS numbers to not disturb the established peerings [i.e. when an ISP
    buys another ISP and merging both networks into only one network].
  • Its drawback : if you configured the above command with an AS number that
    already exists for one of the IBGP peers, when this IBGP receives the route it
    will detect its own AS number in the AS path and it will ignore this route
    considering it as a routing loop.

Multi-Exit Discriminator [MED] :

  • MED is used to discriminate between multiple exit points within an AS.
  • MED is used to influence path selection in neighbor AS.
  • MED doesn’t traverse outside the receiving AS.
  • Default value is Zero and in comparison the lower value the better, to change
    the default value use “default-metric number” command.
  • MED can be set in ways:
    • Using a Route-Map
    • Inherited from an IGP by either using the BGP Network command or
      redistributing into BGP.
  • MED is compared when different values are received from same AS, if “bgp
    always-compare-med
    ” is used MED from different ASes will be also compared.
  • In intra-confederations MED is not compared and to compare it “bgp bestpath
    med confed
    ” should be used.
  • BGP sets a missing MED value to infinite value, however Cisco IOS does set it
    to Zero, to change this behavior of Cisco IOS the “bgp bestpath med missing-
    med-worst
    ” command should be used.
  • “bgp deterministic-med” allows BGP to compare the MED values after the AS-
    Path attribute directly.


  • Its a mean of tagging routes and used in filtering or route selection.
  • By default its stripped in outgoing BGP updates, to enable sending
    communities the “neighbor ip-address send-community” should be used in
    per-neighbor basis.
  • There is no limitation on the number of communities specified for a route.
  • Route-Map is used for setting the community value, it can be applied with
    redistribution, network command, neighbor command and aggregate
    command
    .
  • In Route-Map configuration, the “additive” keyword prepends new Community
    value to the existing Community values, if not used it will override the existing
    Community values. “set community value [value …][additive]”
  • The “ip bgp-community new-format” command is recommended when the
    Community value contains AS numbers.
  • Community list “ip community-list 1-99 permit|deny value [value …]”:
  • Values in one line must match to be accepted, if no matches the list acts as an
    Access-List and denies the route.
  • Keyword “internet” acts as permit any.
  • Extended Community list “ip community-list 100-199 permit|deny regexp”
  • Matches are based on regular expressions.
  • To match any use “.*” value.
  • Named Community list “ip community-list standard|expanded name permit|deny value|regexp”.
  • Sequenced Extended Community List “ip extcommunity-list 100-199|standard list-name permit|deny regexp” or “ip extcommunity-list 0-99|expanded list-name permit|deny [rt extcom-value][soo extcom-value]”
  • Allow automatic sequencing or re-sequencing for BGP Extended Community
    List
  • Allow insertion and deletion of lines in the BGP Extended Community List.
  • Rt: Specifies the Route Target of Extended Community attribute.
  • Soo: Specifies the Site Of Origin Extended Community attribute.
  • BGP Cost community “set extcommunity cost [igp] community-id cost-value”

    • Its a non-transitive attribute.
    • Its used to influence best-path selection for IBGP and confederations
      only.
    • Default value is 2147483647 and in comparison the lower value the
      better.
    • The keyword “IGP”influences the best-path selection at the POI [point of
      insertion] which follows the IGP metric comparison in BGP route
      selection criteria. In case if the POI step is not valid the cost community
      is silently ignored.

BGP Link Bandwidth :

  • Used for load balancing over unequal bandwidth links.
  • Enabled by using “bgp dmzlink-bw”.
  • Routes learned from a directly connected external neighbor propagates through
    the IBGP network with the bandwidth of the external link.
  • The “neighbor ip-address dmzlink-bw” command is used to advertise the
    bandwidth of links used to exit an AS, its configured on the DMZ interface that
    connect single hop EBGP neighbor.

Route Reflectors :

  • Route Reflectors are router running BGP that are allowed to break the IBGP
    loop prevention rules and advertise routes that are received from IBGP pears.
  • Route Reflectors eliminates the need of full mesh IBGP.
  • Route Reflector advertises the best routes only.
  • When Route Reflector receives a route update from a Route Reflector Client; it
    sends the route to all other peers.
  • When Route Reflector receives a route update from a Non Route Reflector
    Client
    ; it sends the route to all of its Clients and EBGP peers only.
  • When a Route Reflector Client receives an IBGP route update; it sends it to
    EBGP neighbors only.
  • When a Route Reflector Client receives an EBGP route update; it sends it to all
    of its neighbors.
  • In case of redundant Route Reflectors; Route Reflector Clusters is used to
    prevent routing loops, the Route Reflector adds Cluster-id and Originator-id to
    the advertised route updates.
  • Originator-id is a non-transitive optional attribute.
  • When a Route Reflector receives a route update with its own Cluster-id; it
    silently ignores the route update.
  • When a Route Reflector Client receives a route update with Originator-id same
    as its Router-id; it silently ignores the route update.
  • When a Route Reflector receives two IBGP route updates; the non reflected
    route update [the one with no Originator-id] is preferred.
  • When a Route Reflector receives two IBGP route updates ; the one with the
    shortest Cluster-list is preferred.
  • Route Reflector configuration:
    • “neighbor ip-address route-reflector-client”
    • “bgp cluster-id cluster-id”
  • Confederations splits the AS into smaller ASes to reduce the number of BGP
    sessions needed for full mesh IBGP.
  • Confederations eliminates the need of full mesh IBGP, however its needed
    inside each Confederation which can be achieved by setting a Route Reflector
    inside the Confederation.
  • When communicating to real EBGP neighbors, internal ASes are hidden and
    only one external AS is announced to all real EBGP neighbors.
  • Intra-Confederation EBGP sessions are used between Member-ASes, however
    it is slightly different from the Real EBGP sessions as is behaves like IBGP in
    passing BGP attributes as Local-Preference, MED, Next-Hop.
  • Entire Confederation should use same IGP as they all use same Next-Hop ip-
    addresses
    .
  • Intra-Confederation AS-Path appears between parentheses ( ).
  • To configure Confederations:
    • Start the BGP process with the Member-AS number.
    • Set the external “Real” AS number.
    • List all Member-ASes of the Confederation on each router with EBGP
      Session.
    • “router bgp member-as” “bgp confederation identifier external-as” “bgp
      confederation peers list-of-member-as
      ”

Peer Groups :

  • Used to configure multiple neighbors with similar requirements, also used as a
    BGP performance enhancement tool since the router builds a single update for
    all Peer Group members which reduces the CPU load.
  • IBGP & EBGP neighbors cannot be mixed in one Peer Group.
  • Peer Group parameters can be overridden by per-neighbor configurations on
    incoming updates only.
  • Peer Group configuration: “neighbor group-name peer-group” “neighbor
    group-name bgp-parameters
    ” “neighbor ip-address peer-group group-name”

Route Dampening :

  • Used to reduce processing load caused by flapping routes.
  • IBGP routes are not dampened.
  • When an EBGP route flaps it gets 1000 Penalty Points, when the Penalty
    Points exceeds the Suppress Limit the route is dampened. The Penalty Points
    decay through the use of a decay algorithm, when it drops below the reuse limit
    the route is re-advertised.
  • Flapping history of a route forgotten after the Penalty drops below than half of
    the Reuse Limit.
  • After enabling Route Dampening; routes in the BGP Table are never removed,
    the route is kept in the BGP Table and marked as history “h”.
  • To enable Route Dampening, the “bgp dampening [half-life reuse suppress
    max-suppress-time
    ] [route-map route-map-name] command is used.

    • half-time → time for penalty to decrease to half [default value is 15
      minutes].
    • suppress → limit in which penalty of a route exceeds the route is
      suppressed [default value is 2000].
    • reuse → limit in which penalty of route drops below, the route is
      unsuppressed [default value is 750].
    • max-suppress-time → no route is suppressed longer than this duration
      [default value is 60 minutes & maximum us 255 minutes].
  • Useful commands :
    • To clear the statistics of routes flaps “clear ip bgp flap-statistics”.
    • To release Dampened Routes “clear ip bgp dampening”.
    • “show ip bgp dampened-paths”.

“show ip bgp flap-statistics [ regexp regexp | filter-list access-list | ip-address mask [longer-prefix] ]”.

What is the BGP Best Path Selection Algorithm?

With the full Internet BGP routing table being upward of 200K routes and with a BGP
router having the potential to be receiving multiple copies of that routing table from
multiple providers, it has to have some way to compare those multiple BGP routing tables
and select only the best route to go into the IP routing table on the router. It uses the
BGP Best Path Selection Algorithm to do this.

You should note that Cisco BGP routers have weight as the first criteria in the table
where other brands of routers do not.

Unless there are no options in place to influence the result, the BGP Best Path selects
the best path b are put in place by network administrators.

Let’s look at the selection criteria, in order, that BGP uses to select the best routes to
install into the IP Routing table:

1 Weight — This is a Cisco-defined attribute that is assigned locally to your router
and does not get carried through to the router updates. If there are multiple paths to a
particular IP address (which is very common), then BGP looks for the path with the
highest weight. There are several ways to set the weight parameter, such as the neighbor
command, the as-path access list, or route maps.

2 Local Preference — This is an indicator to the AS as to which path has local
preference, with the highest preference being preferred. The default is 100. For example:

bgp default local-preference 150

3 Network or Aggregate — This criterion prefers the path that was locally
originated via a network or aggregate. The aggregation of specific routes into one
route is very efficient and saves space on your network. 

4 Shortest AS_PATH — BGP uses this one only when there is a “tie” comparing
weight, local preference, and locally originated vs. aggregate addresses.

5 Lowest origin type — This deals with protocols such as Interior Gateway 
Protocol (IGP) being a lower preference than Exterior Gateway Protocol (EGP).

6 Lowest multi-exit discriminator (MED) — This is also known as the external
metric of a route. A lower MED value is preferred over a higher value.

7 eBGP over iBGP — Similar to #5, BGP AS Path prefers eBGP over iBGP.

8 Lowest IGP metric — This criterion prefers the path with the lowest IGP metric
to the BGP next hop.

9 Multiple paths — This determines if multiple paths require installation in the routing
table. 

10 External paths — When both paths are external, it prefers the path that was
received first (the oldest one).

11 Lowest router ID — This prefers the route that comes from the BGP router with
the lowest router ID.

12 Minimum cluster list — If the originator or router ID is the same for multiple
paths, it prefers the path with the minimum cluster list length.

13 Lowest neighbor address — This prefers the path that comes from the lowest
neighbor address.

Influencing BGP path selection with the extcommunity cost attribute

Many of you out there should be familiarized with the BGP path selection process,
but I bet some of you (as me, until I recently found out) didn’t knew that by using the
extcommunity cost attribute, we might be able to somehow modify the BGP path
selection algorithm.

So what is the extended community cost attribute?.

The BGP Cost Community feature introduces the cost extended community
attribute. The cost community is a non-transitive extended community
attribute that is passed to internal BGP (iBGP) and confederation peers but
not to external BGP (eBGP) peers. The cost community feature allows you to
customize the local route preference and influence the best path selection
process by assigning cost values to specific routes.

This next diagram will be the topology I’ll be working on to demonstrate how this
could be done:

Network Topology BGP

 

First, we build a basic BGP configuration on every router according to the diagram
above. After that is done, if we take a look on R1 BGP table it should look like this:

R1#sh ip bgp
BGP table version is 2, local router ID is 192.168.123.1
Status codes: s suppressed, d damped, h history, * valid, > best, 
i - internal,
              r RIB-failure, S Stale
Origin codes: i - IGP, e - EGP, ? - incomplete

   Network          Next Hop            Metric LocPrf Weight Path
* i10.10.10.0/24    192.168.123.3            0    100      0 400 i
*>i                 192.168.123.2            0    100      0 400 i

R1#sh ip bgp 10.10.10.0
BGP routing table entry for 10.10.10.0/24, version 4
Paths: (2 available, best #2, table Default-IP-Routing-Table)
Flag: 0xA60
  Not advertised to any peer
  400
    192.168.123.3 from 192.168.123.3 (192.168.123.3)
      Origin IGP, metric 0, localpref 100, valid, internal
  400
    192.168.123.2 from 192.168.123.2 (192.168.123.2)
      Origin IGP, metric 0, localpref 100, valid, internal, best

 

We can see that both paths for prefix 10.10.10.0/24 (a loopback  interface on R4)
have the same attributes. If we follow the steps in the BGP path selection algorithm,
we can deduce that the next hop 192.168.123.2 is being chosen as the best path
because it’s the path announced by the router with the lowest router-id, in this
case R2.

Imagine you are in the lab, and they give you a task stating something like

“Make R1 to prefer the route to 10.10.10.0/24 through R3 but, without modifying
local preference, weight, as-path, bgp router-id or IGP metric to next-hop
”
(evil I know  ).
This is one case when the extcommunity cost could result useful.

Let’s do the configuration, we need to make R1 and R3 send community values:

R1(config)#router bgp 123 
R1(config-router)#neighbor 192.168.123.3 send-community both
!
R3(config)#router bgp 123 
R3(config-router)#neighbor 192.168.123.1 send-community both

 

Then on R3, we build a route-map, where the extcommunity cost setting will take place:

R3(config)#ip prefix-list TRICKY-TASK permit 10.10.10.0/24 
R3(config)#route-map TASK permit 10 
R3(config-route-map)#match ip add prefix-list TRICKY-TASK 
R3(config-route-map)#set extcommunity cost 1 100 
R3(config-route-map)#exit 
!
R3(config)#route-map TASK permit 20 
R3(config-route-map)#exit

 

And then we apply the route-map in R3 for the R1 neighbor relationship,
and clear the BGP process for that neighbor:

R3(config)#router bgp 123 
R3(config-router)#neighbor 192.168.123.1 route-map TASK out 
R3(config-router)#do clear ip bgp * soft out

 

That’s it, now we need to verify. To do that, we take a look at R1’s BGP table so we
can see the effect of the route-map in the route:

R1#sh ip bgp 10.10.10.0

BGP routing table entry for 10.10.10.0/24, version 5 
Paths: (2 available, best #1, table Default-IP-Routing-Table) 
Flag: 0xA60 Not advertised to any peer 400
    192.168.123.3 from 192.168.123.3 (192.168.123.3) 
Origin IGP, metric 0, localpref 100, valid, internal, 
best Extended Community: Cost:igp:1:100
  400 192.168.123.2 from 192.168.123.2 (192.168.123.2) 
Origin IGP, metric 0, localpref 100, valid, internal

 

BGP Communities

The only mechanism to set BGP community in Cisco IOS is the set community command
in a route-map.

BGP has default 4 well known communities that can be used to mark prefixes; listed as follows :

  • Internet: advertise these routes to all neighbors.
  • Local-as: prevent sending routes outside the local As within the confederation.
  • No-Advertise: do not advertise this route to any peer, internal or external.
  • No-Export: do not advertise this route to external BGP peers.

To implement communities we have to follow this process :
!
  • First need to identify traffic and policies for traffic.
  • Then we have to define a community and apply to particular prefixes by using route-maps.
  • Then configure neighbor ip address send community for particular neighbors.
  • As the routing update will received by other neighbors, that time router will look the associated
    community and on the basis of that policy will be applied.
Processing of Communities :
!
  • Prefixes are tagged with route-map with defined community values.
  • Prefixes are advertised with communities to neighbors.
  • As neighboring router will see the route associated with community, it will apply policies as
    per configurations. Ex: Community 100:10 will say that the local preference of route should be
    lowered to 50 as per configured policy.
Configuration Steps of BGP communities :
!
  • Configure communities and tag the prefixes using route-map.
  • Configure BGP community advertisement to particular neighbors. Since communities will be not
    advertised to all neighbors with updates
  • Configure BGP community access-lists to match BGP communities on receiving routers.
  • Configure route-maps and define policies for particular receiving communities as per requirement.
  • Apply the route-map to incoming or outgoing updates.

The BGP communities are transitive BGP attribute, meaning that they should be propagated to
all BGP neighbors.

Why using BGP communities?

Communities can be used to mark a set of prefixes that share a common property.
Upstream providers can use these marks to apply a common routing policy such as filtering or assigning
a specific local preference.

As a service provider you can make an agreement with your customers on a specific policy to be
applied to their prefixes using communities; this gives your customers the freedom to change the policy
of a prefix just by changing the community attribute value with no support from your side.

Using BGP communities to influence routing :

Our service provider, AS 65001, allows us to use the communities attribute of BGP to influence
how they route our traffic. In this (simplified) example, there are three different communities
we can use:

  • 200: set local preference to 200
  • 500: set local preference to 500


!
We are the customer (AS 65065) and R1 is our router. We are multi-homed to our service provider
(AS 65001) with a 100 Mbit/s connection to R2 and a T-1 connection to R3.
R2 and R3 are connected over a 100 Mbit/s connection as well.

If we send routes to AS 65001 with a community of 65001:200, the SP’s routers will set the
local preference on those routes to 200.

If we send routes to AS 65001 with a community of 65001:500, the SP’s routers will set the
local preference on those routes to 500. How handy is that?

Because of how the BGP best path selection algorithm works, we want our SP’s routers to assign a higher
local preference to the routes it receives from us over that 100 Mbit/s connection, so we’ll send
those routes with a community of 65001:500.

Just for good measure, we’ll attach community 65001:200 to the routers
we send to 172.16.13.3 over the T-1 connection as well.

Let’s go ahead and set up BGP, but don’t start advertising any routes just yet :

R1(config)# ip bgp-community new-format
R1(config)# router bgp 65065
R1(config-router)# neighbor 172.16.12.2 remote-as 65001
R1(config-router)# neighbor 172.16.12.2 next-hop-self
R1(config-router)# neighbor 172.16.12.2 send-community
R1(config-router)# neighbor 172.16.13.3 remote-as 65001
R1(config-router)# neighbor 172.16.13.3 next-hop-self
R1(config-router)# neighbor 172.16.13.3 send-community

We are all set to begin advertising our routes, with the appropriate communities attached.

The next thing we need to do is create a pair of route maps. We’ll apply these route maps outbound to the
BGP peers and these are what we will use to attach our communities to the routes:

R1(config)# route-map LOCAL_PREF_200 permit 10
R1(config-route-map)# set community 65001:200
R1(config-route-map)# route-map LOCAL_PREF_500 permit 10
R1(config-route-map)# set community 65001:500

Lookin’ good so far, right? Let’s apply those route map to our BGP peers :

R1(config)# router bgp 65065
R1(config-router)# neighbor 172.16.12.2 route-map LOCAL_PREF_500 out
R1(config-router)# neighbor 172.16.13.3 route-map LOCAL_PREF_200 out

That was easy enough. Now, let’s advertise those loopbacks :

R1(config-router)# network 172.31.0.0 mask 255.255.255.0
R1(config-router)# network 172.31.1.0 mask 255.255.255.0
R1(config-router)# network 172.31.2.0 mask 255.255.255.0
R1(config-router)# network 172.31.3.0 mask 255.255.255.0

Let’s take a look at how the SP sees our routes :

R2# sh ip bgp | in 65065
*> 172.31.0.0/24    172.16.12.1              0    500      0 65065 i
*> 172.31.1.0/24    172.16.12.1              0    500      0 65065 i
*> 172.31.2.0/24    172.16.12.1              0    500      0 65065 i
*> 172.31.3.0/24    172.16.12.1              0    500      0 65065 i
R3# sh ip bgp | in 65065
*>i172.31.0.0/24    172.16.23.2              0    500      0 65065 i
*                   172.16.13.1              0    200      0 65065 i
*>i172.31.1.0/24    172.16.23.2              0    500      0 65065 i
*                   172.16.13.1              0    200      0 65065 i
*>i172.31.2.0/24    172.16.23.2              0    500      0 65065 i
*                   172.16.13.1              0    200      0 65065 i
*>i172.31.3.0/24    172.16.23.2              0    500      0 65065 i
*                   172.16.13.1              0    200      0 65065 i

If we ping/traceroute from R3 to one of R1′s loopbacks, we should see that traffic first passes to
R2 before being sent to R1 (which is our goal):

R3# ping 172.31.0.1

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 172.31.0.1, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 4/17/36 ms
R3# traceroute 172.31.0.1

Type escape sequence to abort.
Tracing the route to 172.31.0.1

  1 172.16.23.2 4 msec 12 msec 16 msec
  2 172.16.12.1 16 msec *  32 msec

Success !

Suppose you want router Albany to set metrics for routes that it forwards to router Boston based
on the communities to which the routes belong
. You can create community lists and filter the routes
with a route map that matches on the community list.

To configure router Albany :

host1(config)#router bgp 293
host1(config-router)#neighbor 10.5.5.2 remote-as 32
host1(config-router)#neighbor 10.2.2.1 remote-as 451
host1(config-router)#neighbor 10.2.2.4 remote-as 17
host1(config-router)#neighbor 10.2.2.4 route-map commtrc out
!
host1(config)#route-map commtrc permit 1
host1(config-route-map)#match community 1
host1(config-route-map)#set metric 20
!
host1(config)#route-map commtrc permit 2
host1(config-route-map)#match community 2
host1(config-route-map)#set metric 75
!
host1(config)#route-map commtrc permit 3
host1(config-route-map)#match community 3
host1(config-route-map)#set metric 85
!
host1(config)#ip community-list 1 permit 25
host1(config)#ip community-list 2 permit 62
host1(config)#ip community-list 3 permit internet

Show commands for monitoring  Communities :
!
Show ip bgp prefix
Show ip bgp community – display all community associated routes
Show ip bgp community as:nn – display the particular prefixes with that community.
Show ip bgp community-list – display community list.

GRE Tunnel with VRF Configuration

R3-PE Configuration :

ip vrf blue
 rd 1:1
 route-target export 301:301
 route-target import 401:401
!
ip vrf green
 rd 2:2
 route-target export 302:302
 route-target import 402:402
!
!- If the import and export lists are identical, use the both keyword to define both lists simultaneously.
!- You can add only one route target to a list at a time.

!
ip cef
!
interfave tunnel 0
 ip vrf forwarding green
 ip address 1.1.1.1 255.255.255.0
 tunnel source Ethernet0/0
 tunnel destination 10.10.10.1
 tunnel vrf blue

!-Tunnel 0 is part of VRF GREEN; but it uses the tunnel destination and source addresses from the routing
   table of VRF BLUE, because of this tunnel vrf blue command.

!
interface Ethernet0/0
 ip vrf forwarding blue
 address 20.20.20.3 255.255.255.0

!— Connection to the VRF BLUE network and the VRF GREEN network using the GRE tunnel.
!
interface Ethernet0/1
 ip address 30.30.30.3 255.255.255.0
 tag-switching ip (replaces IP MPLS command)
 !
router bgp 1
 no bgp default ipv4-unicast
 bgp log-neighbor-changes  (allow those routers to log their BGP neighbors resets).
 neighbor 30.30.30.4 remote-as 1
!
 address-family vpnv4 (This command replaces the match nlri and set nlri commands).
                                         (Use to configure the router to exchange IPv4 addresses in VPN mode).
 neighbor 30.30.30.4 activate (Specify peer or peer group with routes of current address family exchanged).
 neighbor 30.30.30.4 send-community extend (Enables BGP speaker to send community attribute to peer).
 exit-address-family (Exit Address Family Configuration mode and access Router Configuration mode).
!
address-family ipv4 vrf green
 redistribute connected
 no auto-summary
 no synchronization ( Tells routers shouldn’t wait for synchronization,  just go ahead use the iBGP routes).
 exit-address-family
!
address-family ipv4 vrf blue 
 redistribute connected
 no auto-summary
 no synchronization
 exit-address-family
!
ip classless
ip route vrf blue 10.10.10.1 255.255.255.255 20.20.20.2
!
end

R4-PE Configuration :

ip vrf blue
 rd 1:1
 route-target export 401:401
 route-target import 301:301
!
ip vrf green
 rd 2:2
 route-target export 402:402
 route-target import 302:302
!
ip cef
!
interface Ethernet0/0
 ip address 30.30.30.4 255.255.255.0
 tag-switching ip (replaces IP MPLS command)
!
interface Ethernet 0/1
 ip vrf forwarding green
 ip address 100.100.100.4 255.255.255.0
!
interface Ethernet0/2
 ip vrf forwarding blue
 ip address 40.40.40.4 255.255.255.0
!
router bgp 1
 no bgp default ipv4-unicast
 bgp log-neighbor-changes
 neighbor 30.30.30.3 remote-as 1
!
address-family vpnv4
 neighbor 30.30.30.3 activate
 neighbor 30.30.30.3 send-community extend
 exit-address-family
!
address-family ipv4 vrf green 
 redistribute connected
 no auto-summary
 no synchronization
 exit-address-family
!
address-family ipv4 vrf blue
 redistribute connected
 no auto-summary
 no synchronization
 exit-address-family
!
ip classless
!
end

R1-PE Configuration :ip cef
!
interface Tunnel 0
 ip address 200.200.200.1 255.255.255.0
 tunnel source Ethernet0/0
 tunnel destination 20.20.20.3

!- Both the tunnel source and destination address are in the VRF BLUE,
    to provide transport for the VRF GREEN network.

!
interface Ethernet0/0
description Connection to R2-CE router
ip address 10.10.10.1 255.255.255.0
ip access-group 100 in
ip access-group 100 out

!- Access-group to allow only GRE packets through theR2-CE network. 
   However, R1-CE networks data is in the GRE packet.

!
ip route 0.0.0.0 0.0.0.0 Tunnel0
ip route 20.20.20.3 255.255.255.255 10.10.10.2
!
access-list 100 permit gre host 10.10.10.1 host 20.20.20.3
access-list 100 permit gre host 20.20.20.3 host 10.10.10.1

!- Permits only GRE packets between the endpoints.
!
end

R2-CE#ip cef
!
interface Ethernet0/0
description Connection to R1-CE router
ip address 10.10.10.2 255.255.255.0
ip access-group 100 in
ip access-group 100 out
!
interface Ethernet1/0
ip address 20.20.20.2 255.255.255.0
!
ip route 0.0.0.0 0.0.0.0 20.20.20.3
!
access-list 100 permit gre host 10.10.10.1 host 20.20.20.3
access-list 100 permit gre host 20.20.20.3 host 10.10.10.1

!- Permits only GRE packets between the endpoints.
!
end

R5-CE#

interface Ethernet0/0
 ip address 100.100.100.5 255.255.255.0
!
ip route 0.0.0.0 0.0.0.0 100.100.100.4
!
end

R6-CE

!
interface Ethernet0/0
 ip address 40.40.40.6 255.255.255.0
!
ip route 0.0.0.0 0.0.0.0 40.40.40.4
!
end