Connecting an Enterprise Network to an ISP Network Configuring and Verifying Basic BGP Operations Connecting an Enterprise Network to an ISP Network

Planning for BGP Define network requirements Define internal connectivity Define external connectivity to ISP Gather required parameters

Requirements for Basic BGP Configuration AS numbers Neighbors (IP addresses) Networks to be advertised

Steps to Configure Basic EBGP Define the BGP process Establish a EBGP neighbor relationship Advertise the networks

Define BGP Process and Activate EBGP Session R2(config)# router bgp 65010 Define the BGP process locally with a local AS number. R2(config-router)# neighbor 10.1.1.2 remote-as 65020 Activate EBGP session to the neighbor Remote router IP Address and AS number

Advertise Networks Option 1: Option 2: R2(config-router)# network 10.2.2.0 mask 255.255.255.0 network 10.4.4.0 mask 255.255.255.0 Configure the local networks to be advertised and include them in BGP Option 2: Redistribution from IGP to BGP

BGP network Command Details The router looks for 192.168.1.1/24 in the routing table, but cannot find it, so it will not announce anything. The router looks for 192.168.0.0/16 in the routing table. If the exact route is not in the table, you can add a static route to null0 so that the route can be announced. The router looks for a C class 192.168.1.0 network in the routing table. R2(config-router)# network 192.168.1.1 mask 255.255.255.0 R2(config-router)# network 192.168.0.0 mask 255.255.0.0 R2(config-router)# network 192.168.1.0

Basic EBGP Configuration Option 1 Option 2 R2# ! <output omitted> router bgp 65010 neighbor 10.1.1.2 remote-as 65020 network 10.2.2.0 mask 255.255.255.0 network 10.4.4.0 mask 255.255.255.0 R2# ! <output omitted> router ospf 10 network 10.2.2.0 mask 255.255.255.0 network 10.4.4.0 mask 255.255.255.0 router bgp 65010 neighbor 10.1.1.2 remote-as 65020 redistribute ospf

Basic IBGP and EBGP Configuration in the Customer A Network

Shutting Down a BGP Neighbor R2(config-router)# neighbor 10.1.1.2 shutdown Administratively brings down a BGP neighbor Used for maintenance/policy changes to prevent route flapping Reenables a BGP neighbor that has been administratively shut down R2(config-router)# no neighbor 10.1.1.2 shutdown

IBGP Peering Issue An IBGP neighbor relationship is established. What happens if the link between R3 and R4 goes down? Which IP address should be used to establish an IBGP session?

BGP Issues with Source IP Address Create a BGP packet: The destination IP address defined by the neighbor statement The source IP address defined by the outbound interface The source address of the received BGP packet is compared to list of neighbor statements: If a match is found in the list of neighbors, a relationship is established. If no match is found in the list of neighbors, the packet is ignored.

IBGP Using Loopback Addresses A loopback interface can be used as the source and destination IP address of all BGP updates between neighbors. The neighbor update-source command is normally used only with IBGP neighbors.

IBGP Next-Hop Behavior IBGP does not modify next hop.

BGP neighbor next-hop-self Command Forces all updates for neighbor R4 to be advertised with this router as the next hop—the same IP address as for the source of the BGP packet.

BGP States When establishing a BGP session, BGP goes through the following states: Idle: Router is searching the routing table to see whether a route exists to reach the neighbor. Connect: Router found a route to the neighbor and has completed the three-way TCP handshake. Open sent: Open message sent, with the parameters for the BGP session. Open confirm: Router received an agreement on the parameters for establishing a session. Alternatively, the router goes into active state if no response to open message Established: Peering is established; routing begins.

BGP Established and Idle States Idle: The router cannot find the address of the neighbor in the routing table. Solution: Check for an IGP problem. Is the neighbor announcing the route? Established: Proper state for BGP operations. Output of the show ip bgp summary command has a number in the state column indicating the number of routes learned from this neighbor.

Example: show ip bgp neighbors Command

BGP Active State Verification Active: The router has sent an open packet and is waiting for a response. The state may cycle between active and idle. The neighbor may not know how to get back to this router because of the following reasons: No route to the source IP address of the BGP open packet The neighbor is peering with the wrong address No neighbor statement for this router The AS number is misconfigured

Example: BGP Active State Verification AS number misconfiguration: At the router with the wrong remote AS number: %BGP-3-NOTIFICATION: sent to neighbor 172.31.1.3 2/2 (peer in wrong AS) 2 bytes FDFC FFFF FFFF FFFF FFFF FFFF FFFF FFFF FFFF 002D 0104 FDFC 00B4 AC1F 0203 1002 0601 0400 0100 0102 0280 0002 0202 00 At the remote router: %BGP-3-NOTIFICATION: received from neighbor 172.31.1.1 2/2 (peer in wrong AS) 2 bytes FDFC

Example: BGP Peering

BGP Neighbor Authentication BGP authentication uses MD5 Configure a key—password; router generates a message digest (is sent), or hash, of the key (is not sent) and the message Router generates and checks the MD5 digest of every segment sent on the TCP connection Router authenticates the source of each routing update packet that it receives

Example: BGP Neighbor Authentication

Example: BGP Configuration

Example: show ip bgp Command

Example: show ip bgp rib-failure Command Displays networks that are not installed in the RIB and the reason that they were not installed.

Clearing the BGP Session When policies change, the change takes effect immediately. The next time that a prefix or path is advertised or received, the new policy is used. This can take a long time for all networks. You must trigger an update for immediate action. Ways to trigger an update: Hard reset Soft reset Route refresh

Hard Reset of BGP Sessions A BGP session makes the transition from established to idle; everything must be relearned. R2# clear ip bgp * Resets all BGP connections with this router. The entire BGP forwarding table is discarded. R2# clear ip bgp 10.1.1.2 Resets only a single neighbor. Less severe than a clear ip bgp * command.

Soft Reset Outbound Routes learned from this neighbor are not lost. This router resends all BGP information to the neighbor without resetting the connection. This option is highly recommended when you are changing the outbound policy. The soft out option does not help if you are changing an inbound policy. R2# clear ip bgp 10.1.1.2 soft out

Inbound Soft Reset This router stores all updates from this neighbor in case the inbound policy is changed. The command is memory intensive. Uses the stored information to generate new inbound updates. R2(config-router)# neighbor 10.1.1.2 soft-reconfiguration inbound R2# clear ip bgp 10.1.1.2 soft in

Route Refresh: Dynamic Inbound Soft Reset Routes advertised to this neighbor are not withdrawn Does not store update information locally The connection remains established Introduced in Cisco IOS Software Release 12.0(2)S and 12.0(6)T R2# clear ip bgp {*|10.1.1.2} [soft in | in]

Monitoring Soft Reconfiguration

debug ip bgp updates Command

Summary For a BGP configuration, the following must be defined: BGP requirements, BGP parameters, and connectivity. BGP is configured with the following basic BGP commands: router bgp autonomous-system, neighbor ip-address remote-as autonomous-system, network network-number [mask network-mask] The neighbor shutdown command administratively shuts down a BGP neighbor. When creating a BGP packet, the neighbor statement defines the destination IP address and the outbound interface defines the source IP address.

Summary (cont.) When establishing a BGP session, the BGP goes through the following states: idle, connect, open sent, open confirm, and established. You can configure MD5 authentication between two BGP peers, which means that each segment sent on the TCP connection between the peers is verified. One EBGP neighbor exists in a single-homed environment. The show and debug commands are used to troubleshoot the BGP session.