© 2009 Cisco Systems, Inc. All rights reserved.ROUTE v1.0—6-1 Connecting an Enterprise Network to an ISP Network Configuring and Verifying Basic BGP Operations

© 2009 Cisco Systems, Inc. All rights reserved. ROUTE v1.0—6-1

Connecting an Enterprise Network to an ISP Network

Configuring and Verifying Basic BGP Operations


Planning for BGP

Define network requirements

Define internal connectivity

Define external connectivity to ISP

Gather required parameters


Requirements for Basic BGP Configuration

AS numbers

Neighbors (IP addresses)

Networks to be advertised


Steps to Configure Basic EBGP

Define the BGP process

Establish a EBGP neighbor relationship

Advertise the networks


Define BGP Process and Activate EBGP Session

Activate EBGP session to the neighbor Remote router IP Address and AS number

neighbor 10.1.1.2 remote-as 65020

R2(config-router)#

Define the BGP process locally with a local AS number.

router bgp 65010

R2(config)#


Advertise Networks

Configure the local networks to be advertised and include them in BGP

Option 2: Redistribution from IGP to BGP

network 10.2.2.0 mask 255.255.255.0network 10.4.4.0 mask 255.255.255.0

R2(config-router)#

Option 1:


BGP network Command Details

The router looks for 192.168.1.1/24 in the routing table, but cannot find it, so it will not announce anything.

The router looks for 192.168.0.0/16 in the routing table. If the exact route is not in the table, you can add a static route to

null0 so that the route can be announced.

The router looks for a C class 192.168.1.0 network in the routing table.

network 192.168.1.1 mask 255.255.255.0

R2(config-router)#

network 192.168.0.0 mask 255.255.0.0

R2(config-router)#

network 192.168.1.0

R2(config-router)#


Basic EBGP Configuration

R2#!<output omitted>!router bgp 65010 neighbor 10.1.1.2 remote-as 65020 network 10.2.2.0 mask 255.255.255.0 network 10.4.4.0 mask 255.255.255.0!

R2#!<output omitted>router ospf 10 network 10.2.2.0 mask 255.255.255.0 network 10.4.4.0 mask 255.255.255.0!router bgp 65010 neighbor 10.1.1.2 remote-as 65020 redistribute ospf!

Option 1 Option 2


Basic IBGP and EBGP Configuration in the Customer A Network


Shutting Down a BGP Neighbor

Administratively brings down a BGP neighbor

Used for maintenance/policy changes to prevent route flapping

Reenables a BGP neighbor that has been administratively shut down

neighbor 10.1.1.2 shutdown

R2(config-router)#

no neighbor 10.1.1.2 shutdown

R2(config-router)#


IBGP Peering Issue

An IBGP neighbor relationship is established.

What happens if the link between R3 and R4 goes down?

Which IP address should be used to establish an IBGP session?


BGP Issues with Source IP Address

Create a BGP packet: The destination IP address defined by the neighbor statement

The source IP address defined by the outbound interface

The source address of the received BGP packet is compared to list of neighbor statements: If a match is found in the list of neighbors, a relationship is

established.

If no match is found in the list of neighbors, the packet is ignored.


IBGP Using Loopback Addresses

A loopback interface can be used as the source and destination IP address of all BGP updates between neighbors.

The neighbor update-source command is normally used only with IBGP neighbors.


IBGP does not modify next hop.

IBGP Next-Hop Behavior


BGP neighbor next-hop-self Command

Forces all updates for neighbor R4 to be advertised with this router as the next hop—the same IP address as for the source of the BGP packet.


BGP States

When establishing a BGP session, BGP goes throughthe following states:1. Idle: Router is searching the routing table to see whether a route

exists to reach the neighbor.

2. Connect: Router found a route to the neighbor and has completed the three-way TCP handshake.

3. Open sent: Open message sent, with the parameters for the BGP session.

4. Open confirm: Router received an agreement on the parameters for establishing a session.

– Alternatively, the router goes into active state if no response to open message

5. Established: Peering is established; routing begins.


BGP Established and Idle States

Idle: The router cannot find the address of the neighbor in the routing table.

– Solution: Check for an IGP problem. Is the neighbor announcing the route?

Established: Proper state for BGP operations.

– Output of the show ip bgp summary command has a number in the state column indicating the number of routes learned from this neighbor.


Example: show ip bgp neighbors Command


BGP Active State Verification

Active: The router has sent an open packet and is waiting for a response. The state may cycle between active and idle.

The neighbor may not know how to get back to this router because of the following reasons:

– No route to the source IP address of the BGP open packet

– The neighbor is peering with the wrong address

– No neighbor statement for this router

– The AS number is misconfigured


Example: BGP Active State Verification

AS number misconfiguration: At the router with the wrong remote AS number:

– %BGP-3-NOTIFICATION: sent to neighbor 172.31.1.3 2/2 (peer in wrong AS) 2 bytes FDFC

– FFFF FFFF FFFF FFFF FFFF FFFF FFFF FFFF 002D 0104 FDFC 00B4 AC1F 0203 1002 0601 0400 0100 0102 0280 0002 0202 00

At the remote router:– %BGP-3-NOTIFICATION: received from neighbor 172.31.1.1 2/2 (peer in wrong AS) 2 bytes FDFC


Example: BGP Peering


BGP Neighbor Authentication

BGP authentication uses MD5

Configure a key—password; router generates a message digest (is sent), or hash, of the key (is not sent) and the message

Router generates and checks the MD5 digest of every segment sent on the TCP connection

Router authenticates the source of each routing update packet that it receives


Example: BGP Neighbor Authentication


Example: BGP Configuration


Example: show ip bgp Command


Example: show ip bgp rib-failure Command

Displays networks that are not installed in the RIB and the reason that they were not installed.


Clearing the BGP Session

When policies change, the change takes effect immediately.

The next time that a prefix or path is advertised or received, the new policy is used. This can take a long time for all networks.

You must trigger an update for immediate action.

Ways to trigger an update:

– Hard reset

– Soft reset

– Route refresh


Hard Reset of BGP Sessions

A BGP session makes the transition from established to idle; everything must be relearned.

clear ip bgp *

R2#

clear ip bgp 10.1.1.2

R2#

Resets all BGP connections with this router.

The entire BGP forwarding table is discarded.

Resets only a single neighbor.

Less severe than a clear ip bgp * command.


Soft Reset Outbound

Routes learned from this neighbor are not lost.

This router resends all BGP information to the neighbor without resetting the connection.

This option is highly recommended when you are changing the outbound policy.

The soft out option does not help if you are changing an inbound policy.

clear ip bgp 10.1.1.2 soft out

R2#


Inbound Soft Reset

This router stores all updates from this neighbor in case the inbound policy is changed.

The command is memory intensive.

Uses the stored information to generate new inbound updates.

neighbor 10.1.1.2 soft-reconfiguration inbound

R2(config-router)#

clear ip bgp 10.1.1.2 soft in

R2#


Route Refresh: Dynamic Inbound Soft Reset

Routes advertised to this neighbor are not withdrawn

Does not store update information locally

The connection remains established

Introduced in Cisco IOS Software Release 12.0(2)S and 12.0(6)T

clear ip bgp {*|10.1.1.2} [soft in | in]

R2#


Monitoring Soft Reconfiguration


debug ip bgp updates Command


Summary

For a BGP configuration, the following must be defined: BGP requirements, BGP parameters, and connectivity.

BGP is configured with the following basic BGP commands: router bgp autonomous-system, neighbor ip-address remote-as autonomous-system, network network-number [mask network-mask]

The neighbor shutdown command administratively shuts down a BGP neighbor.

When creating a BGP packet, the neighbor statement defines the destination IP address and the outbound interface defines the source IP address.


Summary (cont.)

When establishing a BGP session, the BGP goes through the following states: idle, connect, open sent, open confirm, and established.

You can configure MD5 authentication between two BGP peers, which means that each segment sent on the TCP connection between the peers is verified.

One EBGP neighbor exists in a single-homed environment.

The show and debug commands are used to troubleshoot the BGP session.


Documents

© 2009 Cisco Systems, Inc. All rights reserved.ROUTE v1.0—6-1 Connecting an Enterprise Network to an ISP Network Configuring and Verifying Basic BGP Operations