Cisco BGP

Border Gateway Protocol (RFC 4271) är ett path vector routing protokoll. Det kommunicerar på TCP port 179 så routing måste vara på plats, man kan nästan se det som ett L4-protokoll. TCP står för acknowledgement, retransmission, sequencing och update fragmentation. BGP kan få många vägar till samma destination. Bästa vägen väljs utifrån en algoritm. http://www.cisco.com/c/en/us/support/docs/ip/border-gateway-protocol-bgp/13753-25.html

States

TCP Idle State: ConnectRetry timer 120 sekunder
Active State: BGP speaker försöker nå peer med TCP
Connect State: TCP session established

BGP OpenSent State: BGP version, AS number, hold time, BGP ID. Börja skicka keepalives
OpenConfirm State: Response recieved
Established State: Skicka uppdateringar. Neighbor up

Pakettyper

OPEN: Första paketet som skickas av varje sida
UPDATE: En update skickas endast en gång
NOTIFICATION: Errormeddelanden
KEEPALIVE: Skickas regelbundet

Konfiguration

För att byta från NLRI-format till AFI-format i konfigurationen

bgp upgrade-cli 

router bgp [ASN]
no auto-summary
router-id [loopback-adress]
(bgp router-id vrf auto-assign)

Neighbors

iBGP eller eBGP (ttl 1)

neighbor 1.1.1.1 remote-as 65001
neighbor 1.1.1.1 description Other side

Addess family

address-family ipv4
 network 10.0.0.0
 redistribute isis level-2
 neighbor 1.1.1.1 activate
 neighbor 1.1.1.1 send-community both
exit-address-family

Verify

show ip bgp neighbor

Loopback. When configuring iBGP always use loopbacks (advertised by your IGP) for peering.

neighbor [ip-address] update-source [interface]

eBGP om det ej är directly connected, t.ex. loopback

neighbor [ip-address] ebgp-multihop 2

Nätverk som ska annonseras

network [ip-address] mask [subnet-mask]
show ip bgp 10.10.10.0/24

Maximum Prefix

neighbor 10.0.0.10 maximum-prefix 30 100

Soft

neighbor 1.1.1.1 soft-reconfiguration inbound

Send default route

default-information originate

Synchronization is enabled by default in Cisco IOS Software Release prior to 12.2(8)T.

no synchronization

AS

bgp asnotation dot

Timers

tim bg 10 30 20

Peer Group

För att förenkla konfen kan man gruppera flera grannar i så kallade peer groups.

neighbor GROUP01 peer-group
neighbor 1.1.1.1 peer-group GROUP01

Passive Peer

bgp neighbor transport connection-mode active/passive

Dynamic Peering

router bgp 100
 bgp listen limit
 bgp listen range 10.0.0.0/24 peer-group GROUP
 neighbor GROUP ebgp-multihop TTL
 neighbor GROUP remote-as 102 alternative-as 105
show ip bgp peer-group GROUP
debug ip bgp range

Next Hop

Ändra så att annonserade uppdateringar har den egna IP-adressen istället för det som står i uppdateringen från den granne man har lärt sig nätverket av.

neighbor 10.0.0.10 set-next-hop-self

Alternativt

neighbor 10.0.0.10 route-map OUT
route-map OUT permit 10 
set ip next-hop-self

Alternativt

route-map 10.0.0.10 permit 10
set ip next-hop peer-address

Summarization

aggregate-address, null route automatically installed

aggregate-address 10.0.0.0 255.0.0.0 [summary-only]

summary-only, suppress detailed routes

Alternativt

ip route 10.0.0.0 255.0.0.0 null 0
router bgp 100
 network 10.0.0.0 255.0.0.0

Route Reflector

Routes lärda av iBGP skickas ej vidare till iBGP-grannar per default. En route reflector bryter denna regel.
Route Reflector:

address-family ipv4
neighbor [ip-address] route-reflector-client

Communities

Några kända

• Internet
• no-export
• no-advertise
• local-as

Best practice

ip bgp community new-format

Skicka standard och extended

neighbor [ip-address] send-community both

Show

show ip bgp community

Filtering

AS

Regular Expressions

• .* = Any
• ^$ = Local AS

ACL

ip as-path access-list 100 permit .*
neighbor 1.1.1.1 filter-list 100 in

Network
Distribute-list, standard ACL

access-list 1 permit 10.10.10.0 0.0.0.255 
neighbor 1.1.1.1 distribute-list 1 in

Prefix-list, det rekommenderade sättet.

ip prefix-list ACCEPT seq 10 permit 10.10.10.0/24 le 24
neighbor 1.1.1.1 prefix-list ACCEPT in

Verify

show ip bgp prefix-list ACCEPT
show ip bgp neighbors 1.1.1.1 received prefix-filter

eBGP multipath

router bgp 100
 bgp bestpath as-path multipath-relax
 maximum-paths 2

Best path

bgp always-compare-med
bgp bestpath as-path ignore
bgp bestpath med missing-worst
bgp bestpath med confed

Convergence

Don't wait for the hold-down timer (180 sec) to expire (this is default).

bgp fast-external-fallover  #Global
ip bgp fast-external-fallover  #Per interface

Dampening

route-map selective_dampening permit 10
set dampening 5 1900 2000 10

5=half-life, 1900=reuse-limit, 2000=suppress-limit, 10 max-suppress-limit

router bgp [ASN]
bgp dampening route-map selective_dampening

Route flap

show ip bgp flap-statistics

Show

show ip bgp summary
show bgp ipv4 unicast 
show ip bgp paths
show ip bgp rib-failure

Routes som skickas

sh ip bgp vrf Name neighbors 10.10.10.10 advertised-routes 

Reset

clear ip bgp *
clear ip bgp <address> soft

Debug

debug ip bgp events

MED

multi-exit discriminator

ip access-list standard MED
 permit 1.1.1.0 0.0.0.255
route-map MED_50 permit 10
 match ip address MED
 set metric 50

Local Preference

Preference

bgp default local-preference 100

Högst preference vinner

route-map LOCALPREF permit 10
 set local-preference 500
neighbor 1.1.1.1 route-map LOCALPREF in

BMP

The BGP Monitoring Protocol (BMP) feature supports the following functionality to monitor Border Gateway Protocol (BGP) neighbors

router bgp 65000
neighbor 30.1.1.1 bmp-activate server 1
bmp server 1
 activate

Show

show ip bgp bmp server 1
show ip bgp bmp server summary

Resource Public Key Infrastructure

RPKI is used to secure the Border Gateway Protocol (BGP)

router bgp 100
 bgp rpki server tcp 10.0.10.10 port 1333 refresh 600
show ip bgp rpki servers
show ip bgp rpki table
clear ip bgp rpki server