# eBGP for IPv4 (with AS 1000) ## Basic Configuration (direct) ``` router bgp 1000 bgp router-id 1.1.1.1 neighbor remote-as network 192.168.1.0 mask 255.255.255.0 ``` ## Basic Configuration (Address-Family) ``` router bgp 1000 bgp router-id 1.1.1.1 no bgp default ipv4-unicast neighbor remote-as address-family ipv4 neighbor activate network 10.10.0.0 mask 255.255.255.0 ``` ## Additional Configuration ### Summarization and Aggregation Advertise the only the summary address of aggregated routes. ``` router bgp 1000 aggregate-address 10.10.10.0 255.255.255.0 summary-only ``` ``` router bgp 1000 address-family ipv4 aggregate-address 10.10.10.0 255.255.255.0 summary-only ``` Or add as-set to include the full path: ``` router bgp 1000 aggregate-address 10.10.0.0 255.255.254.0 as-set summary-only ``` ### Advertising Default Route Advertise this router as default-gateway for the neighbor 10.0.0.2. This router does not need to have a default route (in internet there is a default-free zone). ``` router bgp 1000 neighbor 10.0.0.2 default-originate ``` # iBGP iBGP: process between routers using same ASN eBGP: process between routers using different ASNs TCP connection between routers with same ASNs is required A learned route through iBGP will by default not send to another iBGP peer to prevent routing loops. ``` router bgp 1234 neighbor remote-as 1234 network mask ``` Often used with loopbacks, make sure they can reach each others loopbacks ``` ip route 255.255.255.255 router bgp 1234 neighbor remote-as 1234 neighbor update-source loo0 network mask ``` Inserting routes from eBGP has a next hop route problem since next hops are typically not changed so internal devices do not know the route to the net hop. Either solve that problem using OSPF and having that external interface as passive interface or use next-hop altering: ``` router bgp 1234 address-family ipv4 unicast neighbor next-hop-self ``` Do this for all neighbors in iBGP # MP-BGP (BGP for IPv4 and IPv6) - Multi-Protocol ## Basic Configuration ``` router bgp 1000 bgp router-id 1.1.1.1 no bgp default ipv4-unicast neighbor 10.1.2.3 remote-as 500 neighbor 2001:db8:acad:12::3 remote-as 500 address-family ipv4 unicast neighbor 10.1.2.3 activate network 10.0.0.0 mask 255.255.255.0 exit address-family ipv6 unicast neighbor 2001:db8:acad:12::3 activate network 2001:db8:acad:1000::/64 exit ``` ## Additional Configuration ### Route Summarization ``` router bgp 1000 address-family ipv6 unicast aggregate-address 2001:db8:1000::/52 summary-only ``` Aggregated routes are advertised as long as one subnet is still available. ### Path Manipulation ``` router bgp 1000 bgp router-id 1.1.1.1 no bgp default ipv4-unicast neighbor 10.1.2.3 remote-as 500 neighbor 2001:db8:acad:12::3 remote-as 500 address-family ipv4 unicast network 10.0.0.0 mask 255.255.255.0 neighbor 10.1.2.3 activate no neighbor 2001:db8:acad:12::3 activate exit address-family ipv6 unicast network 2001:db8:acad::/64 neighbor 2001:db8:acad:12::3 activate exit ``` ### ACL based Allow to neighbor 10.1.2.3 the local nets - 192.168.3.0 255.255.255.224 - 192.168.3.64 255.255.255.192 They need to be added to BGP beforehand with network mask command ``` ip access-list extended ALLOWED_TO_500 permit ip 192.168.3.0 0.0.0.0 255.255.255.224 0.0.0.0 permit ip 192.168.3.64 0.0.0.0 255.255.255.192 0.0.0.0 exit router bgp 1000 address-family ipv4 unicast neighbor 10.1.2.3 distribute-list ALLOWED_TO_500 out exit ``` Apply with "clear bgp ipv4 unicast 500 out" ### Route Filtering with Prefix-List Accept only certain networks from neighbor 500 (10.1.2.3) ``` ip prefix-list ALLOWED_FROM_500 seq 5 permit 192.168.2.0/24 le 27 ipv6 prefix-list IPV6_ALLOWED_FROM_500 seq 5 permit 2001:db8:acad:2::/64 router bgp 1000 address-family ipv4 unicast neighbor 10.1.2.3 prefix-list ALLOWED_FROM_500 in exit address-family ipv6 unicast neighbor 2001:db8:acad:12::3 prefix-list IPV6_ALLOWED_FROM_500 in ``` Apply with "clear bgp ipv4 unicast 500 in" and "clear bgp ipv6 unicast 500 in" ### Filter routes being advertised (AS-PATH ACL) Sending only "local" networks into BGP to not become a transit AS ``` ip as-path access-list 1 permit ^$ router bgp 1000 address-family ipv4 unicast neighbor 10.1.2.3 filter-list 1 out exit ``` ### Path Attribute Manipulation Prefer for the differently subnetted network 192.168.10.0/24 the BGP peer 10.3.2.1 over the best (10.1.2.3) ``` ip prefix-list PREFFERED_IPV4_PATH seq 5 permit 192.168.10.0/24 le 27 route-map USE_THIS_PATH permit 10 match ip address prefix-list PREFERED_IPV4_PATH set local-preference 250 exit router bgp 1000 address-family ipv4 unicast neighbor 10.3.2.1 route-map USE_THIS_PATH in exit ``` Apply with clear bgp ipv4 unicast in ## BGP Communities Have MP-BGP set up Activate the AA:NN format for communities: ``` ip bgp-community new-format router bgp 1000 address-family ipv4 unicast neighbor send-community address-family ipv6 unicast neighbor send-community ``` Repeat on all community-involved neighbors accordingly. ### No-Export Community Configure this router so that the local networks will not be passed along by the peer (10.1.2.3). ``` ip prefix-list LOCAL_NETWORK_COMMSET seq 5 permit 192.168.11.0/24 le 27 ipv6 prefix-list LOCAL_6_NETWORK_COMMSET seq 5 permit 2001:db8:acad:11::/64 route-map COMMSET permit 10 match ip address prefix-list LOCAL_NETWORK_COMMSET set community no-export additive exit route-map COMMSET permit 20 set community internet additive exit route-map COMMSET_6 permit 10 match ipv6 address prefix-list LOCAL_6_NETWORK_COMMSET set communiry no-export additive exit route-map COMMSET_6 permit 20 set community internet additive exit router bgp 1000 address-family ipv4 unicast neighbor 10.1.2.3 route-map COMMSET out exit address-family ipv6 unicast neighbor 2001:db8:acad:12::3 route-map COMMSET_6 out ``` ### Community Strings Add community strings to v4 and v6 routes to 10.3.2.1 (ASN 750) 650:400 for IPv4 routes, 650:600 for IPv6 routes ``` route-map ADDCOMM permit 10 set community 650:400 additive exit route-map ADDCOMM_6 permit 10 set community 650:600 additive exit router bgp 1000 address-family ipv4 unicast neighbor 10.3.2.1 route-map ADDCOMM out exit address-family ipv6 unicast neighbor 2001:db8:acad:32::1 route-map ADDCOMM_6 out exit ! refresh clear bgp ipv4 unicast 750 out clear bgp ipv6 unicast 750 out ``` ### Community-based route filtering and manipulation Drop all routes from ASN 750 (10.3.2.1) with the 650:400 community-attribute Set a higher local preference for all routes from ASN 750 with the 650:600 ``` ip community-list 100 permit 650:400 ip community-list 101 permit 650:600 route-map COMMCHECK_4 deny 10 match community 100 exit route-map COMMCHECK_4 permit 20 exit route-map COMMCHECK_6 permit 10 match community 101 set local-preference 250 exit route-map COMMCHECK_6 permit 20 exit router bgp 1000 address-family ipv4 unicast neighbor 10.3.2.1 route_map COMMCHECK_4 in exit address-family ipv6 unicast neighbor 2001:db8:acad:32::1 route-map COMMCHECK_6 in exit ! Apply clear bgp ipv4 unicast 750 in clear bgp ipv6 unicast 750 in ``` # Redistribution Redistribute OSPF into (i)BGP ``` router bgp 1000 address-family ipv4 redistribute ospf 100 exit ``` This will only redistribute intra- and inter-area routes, to add internal and external type 1, add: ``` router bgp 1000 address-family ipv4 redistribute ospf 100 match internal external 1 exit ``` ## Filter using prefix-list Let only the Loopbacks have a route towards each other on different routing protocols. ``` ip prefix-list LOOPBACK seq 5 permit 192.168.111.2/32 ip prefix-list LOOPBACK seq 10 permit 192.168.111.3/32 ip prefix-list LOOPBACK seq 15 deny 0.0.0.0/0 le 32 route-map OSPF-into-BGP permit 10 match ip address prefix-list LOOPBACK exit router bgp 1000 address-family ipv4 redistribute ospf 100 match internal external 1 route-map OSPF-into-BGP exit ```