Lab Objective:
The focus of this lab is to understand BGP implementation and configuration in Cisco IOS routers. Additional technologies tested include route reflectors, route-maps, and security.
Lab Topology:
The lab network topology is illustrated below:
|
IMPORTANT NOTE If you are using the www.howtonetwork.net racks, please bring up the LAN interfaces connected to the routers by issuing the no shutdown command on the connected switches. If you are using a home lab with no interface fastethernet 0/0 Alternately, you can simply connect the interfaces to a hub or switch if you have one available in your own lab. |
Task 1
Configure hostnames and IP addressing on all routers as illustrated in the network topology.
Task 2
Without using peer groups, configure internal BGP on R1, R2, R3, and R4 as follows:
- Statically configure a BGP router ID using the router number, e.g. 1.1.1.1 for R1, etc.
- All routers should peer using their physical interface addresses
- R1 should peer to R2 and R3
- R2 should peer to R1
- R3 should peer to R1 and R4
- R4 should peer to R3
- All routers should use the TCP MD5 authentication password ‘CCNP’
- BGP Hellos should be sent out every 5 seconds
- All of the BGP speakers should advertise a Hold Time of 15 seconds
- The COMMUNITIES attribute (standard) should be supported
Task 3
Advertise the 150.1.1.0/24, 150.2.2.0, and 150.3.3.0/24 subnets on R1, R2, and R3 via BGP. These prefixes must be advertised with the standard community values listed below. You are NOT allowed to redistribute these prefixes into BGP. Additionally, you are NOT allowed to use outbound or inbound route-maps when completing this task. Ensure that the community values are displayed in ASN:nn (RFC 1997 – BGP Communities Attribute) format. Verify your configuration using the appropriate commands.
- The 150.1.1.0/24: community value of 254:111
- The 150.2.2.0/24: community value of 254:222
- The 150.3.3.0/24: community value of 254:333
Task 4
Configure your network so that all 150.x.x.x/24 subnets can reach each other. You are NOT allowed to use any static routes in your solution. Additionally, you are NOT allowed to advertise or redistribute the 150.4.4.0/24 subnet into BGP on R4. Instead, consider other BGP features to complete this task. You are NOT allowed to configure R2 or R4. Additionally, you are NOT allowed to configure a dynamic routing protocol to complete this task.
Next, verify your configuration using the appropriate commands as well as the extended ping function. For example, on R1 use the extended ping function to send a ping to 150.2.2.2 sourced from 150.1.1.1, etc, etc. All pings should work when the task is completed correctly.
Lab Validation
Task 1
Please refer to previous tasks for basic IP addressing and hostname configuration. This will not be included in this section to avoid being redundant.
Task 2
The requirements of this task are straightforward and are completed as follows:
| R1(config)#router bgp 254 R1(config-router)#bgp router-id 1.1.1.1 R1(config-router)#neighbor 10.0.0.2 remote-as 254 R1(config-router)#neighbor 10.0.0.2 timers 5 15 % Warning: A hold time of less than 20 seconds increases the chances of peer flapping R1(config-router)#neighbor 10.0.0.2 password CCNP R1(config-router)#neighbor 10.0.0.2 send-community standard R1(config-router)#neighbor 10.0.0.6 remote-as 254 R1(config-router)#neighbor 10.0.0.6 timers 5 15 % Warning: A hold time of less than 20 seconds increases the chances of peer flapping R1(config-router)#neighbor 10.0.0.6 password CCNP R1(config-router)#neighbor 10.0.0.6 send-community standard R1(config-router)#exit |
| R2(config)#router bgp 254 R2(config-router)#bgp router-id 2.2.2.2 R2(config-router)#neighbor 10.0.0.1 remote-as 254 R2(config-router)#neighbor 10.0.0.1 timers 5 15 % Warning: A hold time of less than 20 seconds increases the chances of peer flapping R2(config-router)#neighbor 10.0.0.1 password CCNP R2(config-router)#neighbor 10.0.0.1 send-community standard R2(config-router)#exit |
| R3(config)#router bgp 254 R3(config-router)#bgp router-id 3.3.3.3 R3(config-router)#neighbor 10.0.0.5 remote-as 254 R3(config-router)#neighbor 10.0.0.5 timers 5 15 % Warning: A hold time of less than 20 seconds increases the chances of peer flapping R3(config-router)#neighbor 10.0.0.5 password CCNP R3(config-router)#neighbor 10.0.0.5 send-community standard R3(config-router)#neighbor 10.0.0.14 remote-as 254 R3(config-router)#neighbor 10.0.0.14 timers 5 15 % Warning: A hold time of less than 20 seconds increases the chances of peer flapping R3(config-router)#neighbor 10.0.0.14 password CCNP R3(config-router)#neighbor 10.0.0.14 send-community standard R3(config-router)#exit |
| R4(config)#router bgp 254 R4(config-router)#bgp router-id 4.4.4.4 R4(config-router)#neighbor 10.0.0.13 remote-as 254 R4(config-router)#neighbor 10.0.0.13 timers 5 15 % Warning: A hold time of less than 20 seconds increases the chances of peer flapping R4(config-router)#neighbor 10.0.0.13 password CCNP R4(config-router)#neighbor 10.0.0.13 send-community standard R4(config-router)#exit |
Verify your configuration using the show ip bgp summary command:
| R1#show ip bgp summary BGP router identifier 1.1.1.1, local AS number 254 BGP table version is 1, main routing table version 1 Neighbor V AS MsgRcvd MsgSent TblVer InQ OutQ Up/Down State/PfxRcd |
| R2#show ip bgp summary BGP router identifier 2.2.2.2, local AS number 254 BGP table version is 1, main routing table version 1 Neighbor V AS MsgRcvd MsgSent TblVer InQ OutQ Up/Down State/PfxRcd |
| R3#show ip bgp summary BGP router identifier 3.3.3.3, local AS number 254 BGP table version is 1, main routing table version 1 Neighbor V AS MsgRcvd MsgSent TblVer InQ OutQ Up/Down State/PfxRcd |
| R4#show ip bgp summary BGP router identifier 4.4.4.4, local AS number 254 BGP table version is 1, main routing table version 1 Neighbor V AS MsgRcvd MsgSent TblVer InQ OutQ Up/Down State/PfxRcd |
Task 3
BGP allows you to set attributes for prefixes advertised via the network <network> mask <mask> command by appending a route map to this command. The route map can be used to set or modify different BGP attributes for the network. This is completed as follows:
| R1(config)#route-map COMMUNITY permit 10 R1(config-route-map)#set community 254:111 R1(config-route-map)#exit R1(config)#router bgp 254 R1(config-router)#network 150.1.1.0 mask 255.255.255.0 route-map COMMUNITY R1(config-router)#exit |
| R2(config)#route-map COMMUNITY permit 10 R2(config-route-map)#set community 254:222 R2(config-route-map)#exit R2(config)#router bgp 254 R2(config-router)#network 150.2.2.0 mask 255.255.255.0 route-map COMMUNITY R2(config-router)#exit |
| R3(config)#route-map COMMUNITY permit 10 R3(config-route-map)#set community 254:333 R3(config-route-map)#exit R3(config)#router bgp 254 R3(config-router)#network 150.3.3.0 mask 255.255.255.0 route-map COMMUNITY R3(config-router)#exit |
Verify your configuration using the show ip bgp command on all routers:
| R1#show ip bgp 150.1.1.0 255.255.255.0 BGP routing table entry for 150.1.1.0/24, version 2 Paths: (1 available, best #1, table Default-IP-Routing-Table) Flag: 0x820 Advertised to update-groups: 1 Local 0.0.0.0 from 0.0.0.0 (1.1.1.1) Origin IGP, metric 0, localpref 100, weight 32768, valid, sourced, local, best Community: 16646255 |
By default, the Cisco default community format is one 32-bit number (as seen above). To ensure that the community conforms to RFC 1997 (BGP Communities Attribute), you need to issue the ip bgp-community new-format command on all routers. This task is completed as follows:
| R1(config)#ip bgp-community new-format |
| R2(config)#ip bgp-community new-format |
| R3(config)#ip bgp-community new-format |
| R4(config)#ip bgp-community new-format |
Verify these changes using the show ip bgp command on all routers:
| R1#show ip bgp 150.1.1.0 255.255.255.0 BGP routing table entry for 150.1.1.0/24, version 2 Paths: (1 available, best #1, table Default-IP-Routing-Table) Flag: 0x820 Advertised to update-groups: 1 Local 0.0.0.0 from 0.0.0.0 (1.1.1.1) Origin IGP, metric 0, localpref 100, weight 32768, valid, sourced, local, best Community: 254:111 |
| R2#show ip bgp 150.2.2.0 255.255.255.0 BGP routing table entry for 150.2.2.0/24, version 3 Paths: (1 available, best #1, table Default-IP-Routing-Table) Flag: 0x820 Advertised to update-groups: 1 Local 0.0.0.0 from 0.0.0.0 (2.2.2.2) Origin IGP, metric 0, localpref 100, weight 32768, valid, sourced, local, best Community: 254:222 |
| R3#show ip bgp 150.3.3.0 255.255.255.0 BGP routing table entry for 150.3.3.0/24, version 3 Paths: (1 available, best #1, table Default-IP-Routing-Table) Flag: 0x820 Advertised to update-groups: 1 Local 0.0.0.0 from 0.0.0.0 (3.3.3.3) Origin IGP, metric 0, localpref 100, weight 32768, valid, sourced, local, best Community: 254:333 |
You can verify that the COMMUNITY attribute is being sent to peers using the show ip bgp neighbors <address> command:
| R1#show ip bgp neighbors 10.0.0.2 BGP neighbor is 10.0.0.2, remote AS 254, internal link BGP version 4, remote router ID 10.0.0.2 BGP state = Established, up for 00:34:11 Last read 00:00:00, last write 00:00:00, hold time is 15, keepalive interval is 5 seconds Configured hold time is 15,keepalive interval is 5 seconds Minimum holdtime from neighbor is 0 seconds Neighbor capabilities: Route refresh: advertised and received(old & new) Address family IPv4 Unicast: advertised and received Message statistics: InQ depth is 0 OutQ depth is 0 Sent Rcvd Opens: 1 1 Notifications: 0 0 Updates: 5 1 Keepalives: 413 413 Route Refresh: 0 0 Total: 419 415 Default minimum time between advertisement runs is 0 seconds For address family: IPv4 Unicast |
Task 4
The requirements of this final task are three-fold. Because we cannot advertise the 150.4.4.0/24 subnet connected to R4 via BGP, we need to configure this router to advertise a default route to the rest of the domain, allowing all other routers to reach this subnet.
Therefore, the first part of this task is completed by advertising a default route from R4 so that all other routers can reach the 150.4.4.0/24 subnet since this cannot be advertised or redistributed into BGP. To advertise a default route without one existing in the routing table, use the neighbor <address> default-originate command under BGP. This task is completed by executing this command on R4 as follows:
| R4(config)#router bgp 254 R4(config-router)#neighbor 10.0.0.13 default-originate R4(config-router)#exit |
Following this, verify that there is NO default route locally on R4:
| R4#show ip bgp 0.0.0.0 0.0.0.0 % Network not in table |
However, based on the configuration, a BGP-originated default route is now advertised to R3:
| R3#show ip bgp 0.0.0.0 0.0.0.0 BGP routing table entry for 0.0.0.0/0, version 4 Paths: (1 available, best #1, table Default-IP-Routing-Table) Flag: 0x820 Not advertised to any peer Local 10.0.0.14 from 10.0.0.14 (4.4.4.4) Origin IGP, metric 0, localpref 100, valid, internal, best |
The second part of this task is to ensure that routes are advertised between all routers. Since we cannot configure R2 or R4, we need to configure R1 and R3 as route reflectors. This is because, by default, internal BGP (iBGP) speakers will NOT advertise routes received from one iBGP speaker to another iBGP speaker.
Because of this default rule, the BGP tables on all routers are incomplete and do not contain all the prefixes. Verify using the show ip bgp command. For example, R1 will not have the default route advertised by R4 in its BGP Table because this default route is received by R3 from another iBGP peer:
| R1#show ip bgp BGP table version is 4, local router ID is 1.1.1.1 Status codes: s suppressed, d damped, h history, * valid, > best, i – internal, r RIB-failure, S Stale Origin codes: i – IGP, e – EGP, ? – incomplete Network Next Hop Metric LocPrf Weight Path |
Likewise, R2 will not show an entry for the 150.3.3.0/24 (R3) and 0.0.0.0/0 (R4) prefixes in its BGP Table because the 150.3.3.0/24 prefix is advertised to R1 from an iBGP peer. Likewise, because R1 never receives the default route from R3, this will never show up in R2s BGP Table.
| R2#show ip bgp BGP table version is 3, local router ID is 2.2.2.2 Status codes: s suppressed, d damped, h history, * valid, > best, i – internal, r RIB-failure, S Stale Origin codes: i – IGP, e – EGP, ? – incomplete Network Next Hop Metric LocPrf Weight Path |
The same concept is also applicable to R3 and R4. To address this issue, you need to configure R1 and R3 as route reflectors. When doing so, you do NOT need to configure R1 and R3 as clients of each other. This is because, by default, a route reflector will advertise routes received from a client to a non-client and vice versa. This task is completed as follows:
| R1(config)#router bgp 254 R1(config-router)#neighbor 10.0.0.2 route-reflector-client R1(config-router)#exit |
| R3(config)#router bgp 254 R3(config-router)#neighbor 10.0.0.14 route-reflector-client R3(config-router)#exit |
However, you will still notice that the routers still cannot ping each others’ 150.x.x.x/24 subnets. This is because the NEXT_HOP attribute is NOT changed when these prefixes are advertised between the iBGP peers. For example, on R1, the NEXT_HOP for the 0.0.0.0/0 prefix reflects the IP address of R1 (10.0.0.14). Because there is no route for this prefix, it is considered inaccessible and is not advertised to R2:
| R1#show ip bgp 0.0.0.0 0.0.0.0 BGP routing table entry for 0.0.0.0/0, version 12 Paths: (1 available, no best path) Not advertised to any peer Local 10.0.0.14 (inaccessible) from 10.0.0.6 (3.3.3.3) Origin IGP, metric 0, localpref 100, valid, internal Originator: 4.4.4.4, Cluster list: 3.3.3.3 |
To resolve this issue, you need to either run an IGP or use static routes, which is forbidden in this task, or modify the BGP NEXT_HOP. However, because these updates are from iBGP neighbors, you cannot use the the neighbor <address> next-hop-self command. The reason you need to modify the NEXT_HOP using a route-map is because the neighbor <address> next-hop-self command should not be used to modify the NEXT_HOP
attribute for a route reflector when this feature is enabled for a route reflector client.
It will not work because this command will modify next hop attributes only for routes that are learned from eBGP peers and not the intended routes that are being reflected from the route reflector clients. This means that the NEXT_HOP for all routes received from the iBGP peers will be inaccessible since we are not running an IGP or using static routes in the network. For example, on R1, the NEXT_HOP for the default advertised by R4 shows the IP address of the Serial0/0 interface on R4, which is 10.0.0.14, as illustrated or shown in the previous output.
Because the neighbor <address> next-hop-self command will not work due to the route reflector configuration, the only other way to modify the next NEXT_HOP attribute is using an outbound route map. This task is completed as follows:
| R1(config)#route-map R2-NEXT-HOP permit 10 R1(config-route-map)#set ip next-hop 10.0.0.1 % Warning: Next hop address is our address R1(config-route-map)#exit R1(config)#route-map R3-NEXT-HOP permit 10 R1(config-route-map)#set ip next-hop 10.0.0.5 % Warning: Next hop address is our address R1(config-route-map)#exit R1(config)#router bgp 254 R1(config-router)#neighbor 10.0.0.2 route-map R2-NEXT-HOP out R1(config-router)#neighbor 10.0.0.6 route-map R3-NEXT-HOP out R1(config-router)#exit |
| R3(config)#route-map R1-NEXT-HOP permit 10 R3(config-route-map)#set ip next-hop 10.0.0.6 % Warning: Next hop address is our address R3(config-route-map)#exit R3(config)#route-map R4-NEXT-HOP permit 10 R3(config-route-map)#set ip next-hop 10.0.0.13 % Warning: Next hop address is our address R3(config-route-map)#exit R3(config)#router bgp 254 R3(config-router)#neighbor 10.0.0.14 route-map R4-NEXT-HOP out R3(config-router)#neighbor 10.0.0.5 route-map R1-NEXT-HOP out R3(config-router)#exit |
Following this configuration, the BGP RIBs on all routers show the following entries:
| R1#show ip bgp BGP table version is 7, local router ID is 1.1.1.1 Status codes: s suppressed, d damped, h history, * valid, > best, i – internal, r RIB-failure, S Stale Origin codes: i – IGP, e – EGP, ? – incomplete Network Next Hop Metric LocPrf Weight Path |
| R2#show ip bgp BGP table version is 7, local router ID is 2.2.2.2 Status codes: s suppressed, d damped, h history, * valid, > best, i – internal, r RIB-failure, S Stale Origin codes: i – IGP, e – EGP, ? – incomplete Network Next Hop Metric LocPrf Weight Path |
| R3#show ip bgp BGP table version is 4, local router ID is 3.3.3.3 Status codes: s suppressed, d damped, h history, * valid, > best, i – internal, r RIB-failure, S Stale Origin codes: i – IGP, e – EGP, ? – incomplete Network Next Hop Metric LocPrf Weight Path |
| R4#show ip bgp BGP table version is 7, local router ID is 4.4.4.4 Status codes: s suppressed, d damped, h history, * valid, > best, i – internal, r RIB-failure, S Stale Origin codes: i – IGP, e – EGP, ? – incomplete Network Next Hop Metric LocPrf Weight Path |
Finally, complete this task by issuing extended pings, LAN-to-LAN, between the routers:
| R1#ping 150.2.2.2 source fastethernet 0/0 repeat 10
Type escape sequence to abort. R1#ping 150.3.3.3 source fastethernet 0/0 repeat 10 Type escape sequence to abort. R1#ping 150.4.4.4 source fastethernet 0/0 repeat 10 Type escape sequence to abort. |
| R2#ping 150.1.1.1 source fastethernet 0/0 repeat 10
Type escape sequence to abort. R2#ping 150.3.3.3 source fastethernet 0/0 repeat 10 Type escape sequence to abort. R2#ping 150.4.4.4 source fastethernet 0/0 repeat 10 Type escape sequence to abort. |
| R3#ping 150.1.1.1 source fastethernet 0/0 repeat 10
Type escape sequence to abort. R3#ping 150.2.2.2 source fastethernet 0/0 repeat 10 Type escape sequence to abort. R3#ping 150.4.4.4 source fastethernet 0/0 repeat 10 Type escape sequence to abort. |
| R4#ping 150.1.1.1 source fastethernet 0/0 repeat 10
Type escape sequence to abort. R4#ping 150.2.2.2 source fastethernet 0/0 repeat 10 Type escape sequence to abort. R4#ping 150.3.3.3 source fastethernet 0/0 repeat 10 Type escape sequence to abort. |
Final Router Configurations
R1
|
R1#term len 0 Current configuration : 1582 bytes R1# |
R2
|
R2#term len 0 Current configuration : 1167 bytes R2# |
R3
|
R3#term len 0 Current configuration : 1909 bytes R3# |
R4
|
R4#term len 0 Current configuration : 1097 bytes R4# |