This LAB demonstrates the use of BGP attributes such as Local Preference and Prepending AS-Path to influence inbound and outbound traffic within an Autonomous System.
- Local Preference
- As you all know that this attribute is only applicable within an Autonomous System and the routes with higher Local Preference value are more preferred than the lower. Therefore, this attribute is applicable to all the outbound traffic exiting your AS if you have multiple exit points. The default value is 100.
- Prepend AS-Path
- In this attribute, we add ASN numbers of the local AS to the routes advertised outbound to another AS. Let's say our Local AS is 1234 and the other AS is 2000. Then the other AS will not choose its original path through AS 2000 to reach the destination networks but instead it will choose another path through AS 3000 to reach the destination networks. This is because BGP always chooses the route with the shortest AS-Path value in its routing table.
ISP01, ISP02, and ISP03 are service provider networks where each router is in different Autonomous systems as shown below.
- ISP01 is in ASN 2000
- ISP02 is in ASN 3000
- ISP03 is in ASN 4000
The primary task in this LAB is to influence the traffic flow from
Host01 and Host02 to reach the webserver and vice versa.
We will follow two main conditions for the traffic flow between Host01,
Host02 to reach the Webserver.
Condition-1: BGP configurations with default
attributes
The “next-hop-self” feature on BGP will give us proper gateway IP for an alternate
route to reach destination networks
Configuration for R1
configure
terminal
interface
GigabitEthernet0/0
ip address
192.168.30.0 255.255.255.254
no shut
exit
!
interface
serial2/0
ip address
45.45.45.1 255.255.255.254
no shut
exit
!
interface
ethernet3/0
ip address
192.168.10.1 255.255.255.0
no shut
exit
!
ip dhcp pool
HOST-A
network
192.168.10.0 255.255.255.0
default-router
192.168.10.1
dns-server
192.168.10.1
exit
!
router bgp
1234
neighbor
192.168.30.1 remote-as 1234
neighbor
45.45.45.0 remote-as 2000
address-family ipv4
redistribute connected
neighbor 192.168.30.1 activate
neighbor 192.168.30.1 next-hop-self
neighbor 45.45.45.0 activate
neighbor 45.45.45.0 next-hop-self
exit
!
end
wr
Configuration for R2
configure
terminal
interface
GigabitEthernet0/0
ip address
192.168.30.1 255.255.255.254
no shut
exit
!
interface
serial2/0
ip address
54.54.54.0 255.255.255.254
no shut
exit
!
interface
ethernet3/0
ip address
192.168.20.1 255.255.255.0
no shut
exit
!
ip dhcp pool
HOST-A
network
192.168.20.0 255.255.255.0
default-router
192.168.20.1
dns-server
192.168.20.1
exit
!
router bgp
1234
neighbor
192.168.30.0 remote-as 1234
neighbor
54.54.54.1 remote-as 3000
address-family ipv4
redistribute connected
neighbor 192.168.30.0 activate
neighbor 192.168.30.0 next-hop-self
neighbor 54.54.54.1 activate
neighbor 54.54.54.1 next-hop-self
exit
!
end
wr
R1#
*Mar 5 17:39:18.071: %BGP-5-ADJCHANGE: neighbor
192.168.30.1 Up
R1#
Configuration for ISP1
configure
terminal
interface
GigabitEthernet0/0
ip address
192.168.40.1 255.255.255.254
no shut
exit
!
interface
serial2/0
ip address
45.45.45.0 255.255.255.254
no shut
exit
!
router bgp 2000
neighbor
192.168.40.0 remote-as 4000
neighbor
45.45.45.1 remote-as 1234
address-family ipv4
redistribute connected
neighbor 192.168.40.0 activate
neighbor 192.168.40.0 next-hop-self
neighbor 45.45.45.1 activate
neighbor 45.45.45.1 next-hop-self
exit
!
end
wr
ISP1#
*Mar 5 17:07:53.479: %BGP-5-ADJCHANGE: neighbor
45.45.45.1 Up
ISP1#
Configuration for ISP2
configure
terminal
interface
GigabitEthernet0/0
ip address
192.168.50.0 255.255.255.254
no shut
exit
!
interface
serial2/0
ip address
54.54.54.1 255.255.255.254
no shut
exit
!
router bgp 3000
neighbor
192.168.50.1 remote-as 4000
neighbor
54.54.54.0 remote-as 1234
address-family ipv4
redistribute connected
neighbor 192.168.50.1 activate
neighbor 192.168.50.1 next-hop-self
neighbor 54.54.54.0 activate
neighbor 54.54.54.0 next-hop-self
exit
!
end
wr
ISP2#
*Mar 5 17:07:41.835: %BGP-5-ADJCHANGE: neighbor
54.54.54.0 Up
ISP2#
Configuration for ISP3
configure
terminal
interface
GigabitEthernet0/0
ip address
192.168.40.0 255.255.255.254
no shut
exit
!
interface
GigabitEthernet1/0
ip address
192.168.50.1 255.255.255.254
no shut
exit
!
interface
ethernet3/0
ip address
192.168.60.1 255.255.255.0
no shut
exit
!
ip dhcp pool
Web-Server
network
192.168.60.0 255.255.255.0
default-router
192.168.60.1
dns-server
192.168.60.1
exit
!
router bgp
4000
neighbor
192.168.40.1 remote-as 2000
neighbor
192.168.50.0 remote-as 3000
address-family ipv4
redistribute connected
neighbor 192.168.40.1 activate
neighbor 192.168.40.1 next-hop-self
neighbor 192.168.50.0 activate
neighbor 192.168.50.0 next-hop-self
exit
!
end
wr
ISP3#
*Mar 5 17:09:08.387: %BGP-5-ADJCHANGE: neighbor
192.168.50.0 Up
*Mar 5 17:09:09.011: %BGP-5-ADJCHANGE: neighbor
192.168.40.1 Up
ISP3#
Run “ip dhcp” on Host-A, Host-B and Web-Server, so that they get IP assigned.
Host-A> ip
dhcp
DDORA IP
192.168.10.2/24 GW 192.168.10.1
Host-B> ip
dhcp
DDORA IP
192.168.20.2/24 GW 192.168.20.1
Web-Server>
ip dhcp
DORA IP
192.168.60.2/24 GW 192.168.60.1
Let us do some verifications on the routes taken when we have not modified any attributes. BGP will go through all attributes one by one in selecting the best route to reach the destination.
Host-A>
ping 192.168.60.2
84 bytes from
192.168.60.2 icmp_seq=1 ttl=61 time=91.788 ms
84 bytes from
192.168.60.2 icmp_seq=2 ttl=61 time=92.158 ms
84 bytes from
192.168.60.2 icmp_seq=3 ttl=61 time=91.214 ms
84 bytes from
192.168.60.2 icmp_seq=4 ttl=61 time=91.939 ms
84 bytes from
192.168.60.2 icmp_seq=5 ttl=61 time=92.687 ms
Host-A>
The PING results show that the connectivity is established between Host-A and the Web-Server. Now we will check the BGP routing table on R1 to see what path it takes to reach the webserver.
R1#show ip bgp
BGP table
version is 9, local router ID is 192.168.30.0
Status codes:
s suppressed, d damped, h history, * valid, > best, i - internal,
r RIB-failure, S Stale, m
multipath, b backup-path, f RT-Filter,
x best-external, a
additional-path, c RIB-compressed,
Origin codes:
i - IGP, e - EGP, ? - incomplete
RPKI
validation codes: V valid, I invalid, N Not found
Network Next Hop Metric LocPrf Weight Path
*
45.45.45.0/31 45.45.45.0 0 0 2000 ?
*> 0.0.0.0 0 32768 ?
*>i 54.54.54.0/31 192.168.30.1 0 100
0 ?
*>
192.168.10.0 0.0.0.0 0 32768 ?
*>i 192.168.20.0 192.168.30.1 0 100
0 ?
* i 192.168.30.0/31 192.168.30.1 0 100
0 ?
*> 0.0.0.0 0 32768 ?
*>
192.168.40.0/31 45.45.45.0 0 0 2000 ?
*
192.168.50.0/31 45.45.45.0 0 2000 4000 ?
*>i 192.168.30.1 0 100
0 3000 ?
* i
192.168.60.0 192.168.30.1 0 100
0 3000 4000 ?
*> 45.45.45.0 0 2000 4000 ?
R1#
R1#show ip bgp
192.168.60.2
BGP routing
table entry for 192.168.60.0/24, version 9
Paths: (2
available, best #2, table default)
Advertised to update-groups:
3
Refresh Epoch 1
3000 4000
192.168.30.1 from 192.168.30.1
(192.168.30.1)
Origin incomplete, metric 0, localpref
100, valid, internal
rx pathid: 0, tx pathid: 0
Refresh Epoch 1
2000 4000
45.45.45.0 from 45.45.45.0 (192.168.40.1)
Origin incomplete, localpref 100, valid,
external, best
rx pathid: 0, tx pathid: 0x0
R1#
The BGP routing table on R1 tells us that to reach 192.168.60.0/24 network it is going through ISP1 route. This is because according to the BGP attribute it has selected the best path external over the internal path as shown above.
Condition-2: BGP configurations with modified
attributes
Let’s assume that our network is not stable through ISP01 because we are
experiencing a packet loss beyond ISP01.
Now let focus on outbound traffic flow. So, if we want Host-A to take the ISP02 path instead of ISP01, we can manipulate it using Local Preference for the inbound traffic on R2 for ISP02 neighbor.
Configuration for R2
configure
terminal
router bgp
1234
address-family
ipv4
neighbor
54.54.54.1 route-map INBOUND in
exit
exit
route-map
INBOUND permit 10
set
local-preference 200
!
end
wr
Now if we see the path from Host-A to Webserver, it will take the path from ISP02 instead ISP01, as the local preference value is higher for ISP02 path.
Host-A>
trace 192.168.60.2
trace to
192.168.60.2, 8 hops max, press Ctrl+C to stop
1
192.168.10.1 15.462 ms 15.850 ms
16.167 ms
2
192.168.30.1 47.279 ms 47.549 ms
46.231 ms
3
54.54.54.1 61.104 ms 76.163 ms
77.495 ms
4
192.168.50.1 91.609 ms 92.555 ms
92.682 ms
5
*192.168.60.2 106.949 ms (ICMP
type:3, code:3, Destination port unreachable)
Host-A>
R1#show ip bgp
192.168.60.2
BGP routing
table entry for 192.168.60.0/24, version 29
Paths: (2
available, best #1, table default)
Advertised to update-groups:
5
Refresh Epoch 1
3000 4000
192.168.30.1 from 192.168.30.1
(192.168.30.1)
Origin incomplete, metric 0, localpref
200, valid, internal, best
rx pathid: 0, tx pathid: 0x0
Refresh Epoch 2
2000 4000
45.45.45.0 from 45.45.45.0 (192.168.40.1)
Origin incomplete, localpref 100, valid,
external
rx pathid: 0, tx pathid: 0
R1#
But now the issue is the inbound traffic from Webserver to Host-A is still coming from ISP01 circuit as from below trace:
Web-Server>
trace 192.168.10.2
trace to
192.168.10.2, 8 hops max, press Ctrl+C to stop
1
192.168.60.1 15.396 ms 15.341 ms
15.842 ms
2
192.168.40.1 46.686 ms 45.724 ms
45.938 ms
3
45.45.45.1 91.782 ms 90.778 ms
90.307 ms
4
*192.168.10.2 105.879 ms (ICMP
type:3, code:3, Destination port unreachable)
Web-Server>
So, to manipulate the inbound traffic flow, we can use AS Prepend so that the traffic will get diverted through ISP02, as ISP02 will have shortest AS path.
Configuration for R1
configure
terminal
router bgp
1234
address-family
ipv4
neighbor
45.45.45.0 route-map OUTBOUND out
exit
exit
route-map
OUTBOUND permit 10
set as-path
prepend 1234 1234 1234
!
end
wr
So, now if we check on ISP01 for route towards Host-A, it will show the other path as best paths instead of ISP01 circuit
ISP1#show ip
bgp 192.168.10.2
BGP routing
table entry for 192.168.10.0/24, version 33
Paths: (2
available, best #1, table default)
Advertised to update-groups:
2
Refresh Epoch 1
4000 3000 1234
192.168.40.0 from 192.168.40.0
(192.168.60.1)
Origin incomplete, localpref 100, valid,
external, best
rx pathid: 0, tx pathid: 0x0
Refresh Epoch 1
1234 1234 1234 1234
45.45.45.1 from 45.45.45.1 (192.168.30.0)
Origin incomplete, metric 0, localpref
100, valid, external
rx pathid: 0, tx pathid: 0
ISP1#
We can also
verify through traceroute on Webserver to reach the Host-A.
Web-Server>
trace 192.168.10.2
trace to
192.168.10.2, 8 hops max, press Ctrl+C to stop
1
192.168.60.1 15.593 ms 15.446 ms
15.611 ms
2
192.168.50.0 47.276 ms 48.049 ms
46.417 ms
3
54.54.54.0 76.942 ms 77.174 ms
77.605 ms
4
192.168.30.0 107.766 ms 108.474 ms
106.352 ms
5
*192.168.10.2 122.066 ms (ICMP
type:3, code:3, Destination port unreachable)
Web-Server>
In my scenario, I have selected Local Preference and Prepend AS-PATH metric to influence the inbound and outbound routes for the hosts in ASN1234 to reach the Webserver because these metrics can be configured on the edge routers within the ASN-1234 and we don’t have to tell our ISP to influence the BGP routes for us because mostly the ISPs are not responsible to route the traffic within our ASN-1234.
Thank you for following my Blog and let me know if you have any questions?
No comments:
Post a Comment