Difference between revisions of "Cisco BGP"
Helikopter (talk | contribs) |
Helikopter (talk | contribs) |
||
| Line 1: | Line 1: | ||
| − | Border Gateway Protocol (RFC 4271) är ett path vector routing protokoll. Det kommunicerar på TCP port 179 så routing måste vara på plats, man kan nästan se det som ett L4-protokoll. TCP står för acknowledgement, retransmission, sequencing och update fragmentation. BGP kan få många vägar till samma destination. Bästa vägen väljs utifrån en | + | Border Gateway Protocol (RFC 4271) är ett path vector routing protokoll. Det kommunicerar på TCP port 179 så routing måste vara på plats, man kan nästan se det som ett L4-protokoll. TCP står för acknowledgement, retransmission, sequencing och update fragmentation. BGP kan få många vägar till samma destination. Bästa vägen väljs utifrån en [http://www.cisco.com/c/en/us/support/docs/ip/border-gateway-protocol-bgp/13753-25.html algoritm]. Den bästa pathen markeras valid/best och blir en kandidat till routingtabellen. Om next hop inte är reachable så blir aldrig en route valid. |
| − | http://www.cisco.com/c/en/us/support/docs/ip/border-gateway-protocol-bgp/13753-25.html | + | |
===States=== | ===States=== | ||
| − | '''TCP''' | + | '''TCP''' <br/> |
Idle State: ConnectRetry timer 120 sekunder <br/> | Idle State: ConnectRetry timer 120 sekunder <br/> | ||
Active State: BGP speaker försöker nå peer med TCP <br/> | Active State: BGP speaker försöker nå peer med TCP <br/> | ||
Connect State: TCP session established <br/> | Connect State: TCP session established <br/> | ||
| − | '''BGP''' | + | '''BGP''' <br/> |
OpenSent State: BGP version, AS number, hold time, BGP ID. Börja skicka keepalives <br/> | OpenSent State: BGP version, AS number, hold time, BGP ID. Börja skicka keepalives <br/> | ||
OpenConfirm State: Response recieved <br/> | OpenConfirm State: Response recieved <br/> | ||
| Line 18: | Line 18: | ||
NOTIFICATION: Errormeddelanden <br/> | NOTIFICATION: Errormeddelanden <br/> | ||
KEEPALIVE: Skickas regelbundet <br/> | KEEPALIVE: Skickas regelbundet <br/> | ||
| + | |||
| + | ===BGP table=== | ||
| + | Källor till BGP table: | ||
| + | * Network command: lägger prefix i bgp table men kan inte annonseras ut om det inte finns i routingtabellen | ||
| + | * BGP updates: | ||
| + | * Redistribution: | ||
| + | |||
| + | ===Path attribute=== | ||
| + | '''Well Known''' <br/> | ||
| + | Mandatory attributes | ||
| + | * AS Path | ||
| + | * Next Hop | ||
| + | * Origin | ||
| + | |||
| + | Descretionary attributes | ||
| + | * Local Preference | ||
| + | * Atomic Aggregate | ||
| + | |||
| + | '''Optional''' <br/> | ||
| + | Transitive attributes | ||
| + | * Aggregator | ||
| + | * Community | ||
| + | |||
| + | Non transitive attributes | ||
| + | * MED (Multi Exit Discriminator) | ||
| + | * Originator | ||
| + | * Cluster ID | ||
=Konfiguration= | =Konfiguration= | ||
| Line 49: | Line 76: | ||
eBGP om det ej är directly connected, t.ex. loopback | eBGP om det ej är directly connected, t.ex. loopback | ||
neighbor [ip-address] ebgp-multihop 2 | neighbor [ip-address] ebgp-multihop 2 | ||
| + | |||
| + | md5 authentication görs med tcp option 19 | ||
| + | neighbor 1.1.1.1 password cisco | ||
Nätverk som ska annonseras | Nätverk som ska annonseras | ||
| Line 61: | Line 91: | ||
Send default route | Send default route | ||
| + | network 0.0.0.0 | ||
| + | Måste finnas i routingtabellen | ||
default-information originate | default-information originate | ||
| + | Requires redistribution och måste finnas i routingtabellen | ||
| + | neighbor default-originate | ||
| + | Skickar default route villkorslöst | ||
Synchronization is enabled by default in Cisco IOS Software Release prior to 12.2(8)T. | Synchronization is enabled by default in Cisco IOS Software Release prior to 12.2(8)T. | ||
| Line 99: | Line 134: | ||
route-map 10.0.0.10 permit 10 | route-map 10.0.0.10 permit 10 | ||
set ip next-hop peer-address | set ip next-hop peer-address | ||
| + | |||
| + | Om något händer med en befintlig nexthop, meddela BGP-processen. | ||
| + | bgp nexthop trigger enable | ||
| + | När ska nästa scan köras | ||
| + | bgp nexthop trigger delay 10 | ||
===NLRI=== | ===NLRI=== | ||
| Line 159: | Line 199: | ||
===eBGP multipath=== | ===eBGP multipath=== | ||
| + | Flera paths kan hamna i routingtabelllen men endast best path kan annonseras vidare. | ||
router bgp 100 | router bgp 100 | ||
bgp bestpath as-path multipath-relax | bgp bestpath as-path multipath-relax | ||
| Line 181: | Line 222: | ||
Route flap | Route flap | ||
show ip bgp flap-statistics | show ip bgp flap-statistics | ||
| + | show ip bgp dampening parameters | ||
| + | |||
| + | '''Backdoor''' | ||
| + | Sätter AD till 200 på routen så IGPs används i första hand. | ||
==Show== | ==Show== | ||
Revision as of 11:55, 12 March 2016
Border Gateway Protocol (RFC 4271) är ett path vector routing protokoll. Det kommunicerar på TCP port 179 så routing måste vara på plats, man kan nästan se det som ett L4-protokoll. TCP står för acknowledgement, retransmission, sequencing och update fragmentation. BGP kan få många vägar till samma destination. Bästa vägen väljs utifrån en algoritm. Den bästa pathen markeras valid/best och blir en kandidat till routingtabellen. Om next hop inte är reachable så blir aldrig en route valid.
Contents
- 1 States
- 2 Pakettyper
- 3 BGP table
- 4 Path attribute
- 5 Konfiguration
- 6 BMP
- 7 Resource Public Key Infrastructure
States
TCP
Idle State: ConnectRetry timer 120 sekunder
Active State: BGP speaker försöker nå peer med TCP
Connect State: TCP session established
BGP
OpenSent State: BGP version, AS number, hold time, BGP ID. Börja skicka keepalives
OpenConfirm State: Response recieved
Established State: Skicka uppdateringar. Neighbor up
Pakettyper
OPEN: Första paketet som skickas av varje sida
UPDATE: En update skickas endast en gång
NOTIFICATION: Errormeddelanden
KEEPALIVE: Skickas regelbundet
BGP table
Källor till BGP table:
- Network command: lägger prefix i bgp table men kan inte annonseras ut om det inte finns i routingtabellen
- BGP updates:
- Redistribution:
Path attribute
Well Known
Mandatory attributes
- AS Path
- Next Hop
- Origin
Descretionary attributes
- Local Preference
- Atomic Aggregate
Optional
Transitive attributes
- Aggregator
- Community
Non transitive attributes
- MED (Multi Exit Discriminator)
- Originator
- Cluster ID
Konfiguration
För att byta från NLRI-format till AFI-format i konfigurationen
bgp upgrade-cli
router bgp [ASN] no auto-summary router-id [loopback-adress] (bgp router-id vrf auto-assign)
Neighbors
iBGP eller eBGP (ttl 1)
neighbor 1.1.1.1 remote-as 65001 neighbor 1.1.1.1 description Other side
Addess family
address-family ipv4 network 10.0.0.0 redistribute isis level-2 neighbor 1.1.1.1 activate neighbor 1.1.1.1 send-community both exit-address-family
Verify
show ip bgp neighbor
Loopback. When configuring iBGP always use loopbacks (advertised by your IGP) for peering.
neighbor [ip-address] update-source [interface]
eBGP om det ej är directly connected, t.ex. loopback
neighbor [ip-address] ebgp-multihop 2
md5 authentication görs med tcp option 19
neighbor 1.1.1.1 password cisco
Nätverk som ska annonseras
network [ip-address] mask [subnet-mask] show ip bgp 10.10.10.0/24
Maximum Prefix
neighbor 10.0.0.10 maximum-prefix 30 100
Soft
neighbor 1.1.1.1 soft-reconfiguration inbound
Send default route
network 0.0.0.0
Måste finnas i routingtabellen
default-information originate
Requires redistribution och måste finnas i routingtabellen
neighbor default-originate
Skickar default route villkorslöst
Synchronization is enabled by default in Cisco IOS Software Release prior to 12.2(8)T.
no synchronization
AS
bgp asnotation dot
Timers
tim bg 10 30 20
Peer Group
För att förenkla konfen kan man gruppera flera grannar i så kallade peer groups.
neighbor GROUP01 peer-group neighbor 1.1.1.1 peer-group GROUP01
Passive Peer
bgp neighbor transport connection-mode active/passive
Dynamic Peering
router bgp 100 bgp listen limit bgp listen range 10.0.0.0/24 peer-group GROUP neighbor GROUP ebgp-multihop TTL neighbor GROUP remote-as 102 alternative-as 105 show ip bgp peer-group GROUP debug ip bgp range
Next Hop
Ändra så att annonserade uppdateringar har den egna IP-adressen istället för det som står i uppdateringen från den granne man har lärt sig nätverket av.
neighbor 10.0.0.10 set-next-hop-self
Alternativt
neighbor 10.0.0.10 route-map OUT route-map OUT permit 10 set ip next-hop-self
Alternativt
route-map 10.0.0.10 permit 10 set ip next-hop peer-address
Om något händer med en befintlig nexthop, meddela BGP-processen.
bgp nexthop trigger enable
När ska nästa scan köras
bgp nexthop trigger delay 10
NLRI
Summarization
aggregate-address, null route automatically installed
aggregate-address 10.0.0.0 255.0.0.0 [summary-only]
summary-only, suppress detailed routes
Alternativt
ip route 10.0.0.0 255.0.0.0 null 0 router bgp 100 network 10.0.0.0 255.0.0.0
Route Reflector
Routes lärda av iBGP skickas ej vidare till iBGP-grannar per default. En route reflector bryter denna regel.
Route Reflector:
address-family ipv4 neighbor [ip-address] route-reflector-client
Communities
Några kända
- Internet
- no-export
- no-advertise
- local-as
Best practice
ip bgp community new-format
Skicka standard och extended
neighbor [ip-address] send-community both
Show
show ip bgp community
Filtering
AS
Regular Expressions
- .* = Any
- ^$ = Local AS
ACL
ip as-path access-list 100 permit .* neighbor 1.1.1.1 filter-list 100 in
Network
Distribute-list, standard ACL
access-list 1 permit 10.10.10.0 0.0.0.255 neighbor 1.1.1.1 distribute-list 1 in
Prefix-list, det rekommenderade sättet.
ip prefix-list ACCEPT seq 10 permit 10.10.10.0/24 le 24 neighbor 1.1.1.1 prefix-list ACCEPT in
Verify
show ip bgp prefix-list ACCEPT show ip bgp neighbors 1.1.1.1 received prefix-filter
Conditional Route Injection
AS-path manipulation
eBGP multipath
Flera paths kan hamna i routingtabelllen men endast best path kan annonseras vidare.
router bgp 100 bgp bestpath as-path multipath-relax maximum-paths 2
Best path
bgp always-compare-med bgp bestpath as-path ignore bgp bestpath med missing-worst bgp bestpath med confed
Convergence
Don't wait for the hold-down timer (180 sec) to expire (this is default).
bgp fast-external-fallover #Global ip bgp fast-external-fallover #Per interface
Dampening
route-map selective_dampening permit 10 set dampening 5 1900 2000 10
5=half-life, 1900=reuse-limit, 2000=suppress-limit, 10 max-suppress-limit
router bgp [ASN] bgp dampening route-map selective_dampening
Route flap
show ip bgp flap-statistics show ip bgp dampening parameters
Backdoor Sätter AD till 200 på routen så IGPs används i första hand.
Show
show ip bgp summary show bgp ipv4 unicast show ip bgp paths show ip bgp rib-failure
Routes som skickas
sh ip bgp vrf Name neighbors 10.10.10.10 advertised-routes
Reset
clear ip bgp * clear ip bgp <address> soft
Debug
debug ip bgp events
MED
multi-exit discriminator
ip access-list standard MED permit 1.1.1.0 0.0.0.255 route-map MED_50 permit 10 match ip address MED set metric 50
Local Preference
Preference
bgp default local-preference 100
Högst preference vinner
route-map LOCALPREF permit 10 set local-preference 500 neighbor 1.1.1.1 route-map LOCALPREF in
BMP
The BGP Monitoring Protocol (BMP) feature supports the following functionality to monitor Border Gateway Protocol (BGP) neighbors
router bgp 65000 neighbor 30.1.1.1 bmp-activate server 1 bmp server 1 activate
Show
show ip bgp bmp server 1 show ip bgp bmp server summary
Resource Public Key Infrastructure
RPKI is used to secure the Border Gateway Protocol (BGP)
router bgp 100 bgp rpki server tcp 10.0.10.10 port 1333 refresh 600 show ip bgp rpki servers show ip bgp rpki table clear ip bgp rpki server
