Tài liệu BGP III Lab Scenario pdf

CertificationZone Page 1 of 9 http://www.certificationzone.com/studyguides /?Issue=20&IssueDate=09-01-2000&CP= 11/06/01 Date of Issue: 09-01-2000 BGP III Lab Scenario by Chuck Larrieu Setup Working Configurations Router 1 Configuration Router 2 Configuration Router 3 Configuration Router 4 Configuration A Look at the Routing Tables Reality Check A Look at the Regular Expressions Path Manipulation on Router 4 How Could You See the Regexp? Changing Policy Add the Access List to Router 4 Configuration. Huh? It Didn't Work Something Is Missing Setup Build a configuration that consists of four routers: R1 R2 R3 R4 | | | | Working Configurations Router 1 Configuration service timestamps debug uptime service timestamps log uptime no service password-encryption service udp-small-servers service tcp-small-servers ! hostname Router_1 ! Router_1 Router_2 Router_3 Router_4 AS 1 2 3 4 Router ID 1.1.1.1 2.2.2.2 3.3.3.3 4.4.4.4 Ethernet 0 n/a n/a n/a n/a Loopback 0 192.168.64.1/24 192.168.32.1/24 192.168.8.1/24 192.168.0.1/24 Loopback 1 192.168.65.1/24 192.168.33.1/24 192.168.9.1/24 192.168.1.1/24 Loopback 2 192.168.66.1/24 192.168.34.1/24 192.168.10.1/24 192.168.2.1/24 Loopback 3 192.168.67.1/24 192.168.35.1/24 192.168.11.1/24 192.168.3.1/24 Serial 0 10.0.0.14/30 10.0.0.9/30 10.0.0.5/30 10.0.0.1/30 Serial 1 10.0.0.10/30 10.0.0.6/30 10.0.0.2/30 10.0.0.13/30 CertificationZone Page 2 of 9 http://www.certificationzone.com/studyguides /?Issue=20&IssueDate=09-01-2000&CP= 11/06/01 ip subnet-zero ! cns event-service server ! interface Loopback0 ip address 192.168.64.1 255.255.255.0 ! interface Loopback1 ip address 192.168.65.1 255.255.255.0 ! interface Loopback2 ip address 192.168.66.1 255.255.255.0 ! interface Loopback3 ip address 192.168.67.1 255.255.255.0 ! interface Ethernet0 no ip address shutdown no cdp enable ! interface Serial0 ip address 10.0.0.14 255.255.255.252 ! interface Serial1 ip address 10.0.0.10 255.255.255.252 ! router ospf 1000 network 192.168.64.1 0.0.0.0 area 0 network 192.168.65.1 0.0.0.0 area 0 network 192.168.66.1 0.0.0.0 area 0 network 192.168.67.1 0.0.0.0 area 0 ! router bgp 1 bgp router-id 1.1.1.1 bgp cluster-id 3232187137 redistribute ospf 1000 neighbor 10.0.0.9 remote-as 2 neighbor 10.0.0.13 remote-as 4 ! ip classless no ip http server ! ! line con 0 exec-timeout 0 0 privilege level 15 transport input none line aux 0 line vty 0 4 privilege level 0 password yahoudi login ! end Router 2 Configuration service timestamps debug uptime service timestamps log uptime no service password-encryption ! hostname router_2 ! ip subnet-zero ! cns event-service server ! interface Loopback0 ip address 192.168.32.1 255.255.255.0 ! interface Loopback1 ip address 192.168.33.1 255.255.255.0 ! CertificationZone Page 3 of 9 http://www.certificationzone.com/studyguides /?Issue=20&IssueDate=09-01-2000&CP= 11/06/01 interface Loopback2 ip address 192.168.34.1 255.255.255.0 ! interface Loopback3 ip address 192.168.35.1 255.255.255.0 ! interface Ethernet0 no ip address shutdown ! interface Serial0 ip address 10.0.0.9 255.255.255.252 no fair-queue ! interface Serial1 ip address 10.0.0.6 255.255.255.252 ! router bgp 2 bgp router-id 2.2.2.2 bgp cluster-id 3232178945 network 10.0.0.4 mask 255.255.255.252 network 192.168.32.0 network 192.168.33.0 network 192.168.34.0 network 192.168.35.0 aggregate-address 192.168.32.0 255.255.252.0 summary-only neighbor 10.0.0.5 remote-as 3 neighbor 10.0.0.10 remote-as 1 ! ip classless no ip http server ! line con 0 privilege level 15 transport input none line aux 0 line vty 0 4 privilege level 0 no login ! end Router 3 Configuration no service password-encryption no service udp-small-servers no service tcp-small-servers ! hostname Router_3 ! ip subnet-zero ! interface Loopback0 ip address 192.168.8.1 255.255.255.0 ! interface Loopback1 ip address 192.168.9.1 255.255.255.0 ! interface Loopback2 ip address 192.168.10.1 255.255.255.0 ! interface Loopback3 ip address 192.168.11.1 255.255.255.0 ! interface Ethernet0 no ip address no keepalive shutdown ! interface Serial0 ip address 10.0.0.5 255.255.255.252 ! interface Serial1 ip address 10.0.0.2 255.255.255.252 CertificationZone Page 4 of 9 http://www.certificationzone.com/studyguides /?Issue=20&IssueDate=09-01-2000&CP= 11/06/01 ! router ospf 1000 network 192.168.8.1 0.0.0.0 area 0 network 192.168.9.1 0.0.0.0 area 0 network 192.168.10.1 0.0.0.0 area 0 network 192.168.11.1 0.0.0.0 area 0 ! router bgp 3 bgp router-id 3.3.3.3 network 10.0.0.0 redistribute ospf 1000 neighbor 10.0.0.1 remote-as 4 neighbor 10.0.0.6 remote-as 2 ! ip classless ! line con 0 line aux 0 line vty 0 4 login ! end Router 4 Configuration service timestamps debug uptime service timestamps log uptime service password-encryption ! hostname router_4 ! no logging console ! ip subnet-zero cns event-service server ! interface Loopback0 ip address 192.168.0.1 255.255.255.0 ! interface Loopback1 ip address 192.168.1.1 255.255.255.0 ! interface Loopback2 ip address 192.168.2.1 255.255.255.0 ! interface Loopback3 ip address 192.168.3.1 255.255.255.0 ! interface Ethernet0 no ip address shutdown ! interface Serial0 ip address 10.0.0.1 255.255.255.252 ! interface Serial1 ip address 10.0.0.13 255.255.255.252 ! router bgp 4 bgp router-id 4.4.4.4 bgp cluster-id 3232286465 network 10.0.0.0 mask 255.255.255.252 network 192.168.0.0 network 192.168.1.0 network 192.168.2.0 network 192.168.3.0 neighbor 10.0.0.2 remote-as 3 neighbor 10.0.0.14 remote-as 1 ! no ip http server ip as-path access-list 1 permit _3_ ! line con 0 exec-timeout 0 0 CertificationZone Page 5 of 9 http://www.certificationzone.com/studyguides /?Issue=20&IssueDate=09-01-2000&CP= 11/06/01 privilege level 15 transport preferred none transport input none line aux 0 transport preferred none transport input all line vty 0 4 privilege level 0 transport preferred none ! end A Look at the Routing Tables Router_1#sh ip route Codes: C - connected, S - static, I - IGRP, R - RIP, M - mobile, B - BGP D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2 E1 - OSPF external type 1, E2 - OSPF external type 2, E - EGP i - IS-IS, L1 - IS-IS level-1, L2 - IS-IS level-2, ia - IS-IS inter area * - candidate default, U - per-user static route, o - ODR P - periodic downloaded static route Gateway of last resort is not set B 192.168.8.0/24 [20/0] via 10.0.0.13, 00:05:56 B 192.168.9.0/24 [20/0] via 10.0.0.13, 00:05:56 B 192.168.10.0/24 [20/0] via 10.0.0.13, 00:05:56 B 192.168.11.0/24 [20/0] via 10.0.0.13, 00:05:56 B 10.0.0.0/8 [20/0] via 10.0.0.13, 00:05:57 B 10.0.0.0/30 [20/0] via 10.0.0.13, 00:05:57 B 10.0.0.4/30 [20/0] via 10.0.0.9, 00:05:57 B 192.168.0.0/24 [20/0] via 10.0.0.13, 00:05:58 B 192.168.1.0/24 [20/0] via 10.0.0.13, 00:05:58 B 192.168.2.0/24 [20/0] via 10.0.0.13, 00:05:58 B 192.168.3.0/24 [20/0] via 10.0.0.13, 00:05:58 B 192.168.32.0/22 [20/0] via 10.0.0.9, 00:05:58 Router_1# Observe that on router_1, networks advertised by router_4 appear via the interface connected to router_4 There are no secondary paths. Reality Check Routes advertised by router 3, which is two hops away (both through router 2 and router 4), appear as originating through router 4. Why? BGP is designed to ensure loop free routing. The BGP decision process is run on the Adj-RIB-in table upon the receipt of route notifications from neighbors. Router 1 would have received notification of routes originating from router 3 from two different sources (router 2 and router 4) One of those notifications would have arrived prior to the other. Upon receipt of the duplicate route, BGP would discard that update. One thing to try might be to shut down one of the serial interfaces, clear the BGP process (clear ip bgp *) and observe the installation of the route via the other interface. Router_1#sh ip bgp summary BGP router identifier 1.1.1.1, local AS number 1 BGP table version is 146, main routing table version 146 16 network entries and 23 paths using 2380 bytes of memory 10 BGP path attribute entries using 520 bytes of memory 5 BGP AS-PATH entries using 120 bytes of memory CertificationZone Page 6 of 9 http://www.certificationzone.com/studyguides /?Issue=20&IssueDate=09-01-2000&CP= 11/06/01 0 BGP route-map cache entries using 0 bytes of memory 0 BGP filter-list cache entries using 0 bytes of memory BGP activity 59/116 prefixes, 156/129 paths, scan interval 15 secs Neighbor V AS MsgRcvd MsgSent TblVer InQ OutQ Up/Down State/PfxRcd 10.0.0.9 4 2 1639 1650 146 0 0 1d00h 7 10.0.0.13 4 4 1674 1659 146 0 0 1d01h 12 Shows the BGP neighbors, current BGP table version, networks and paths, and memory usage. A Look at the Regular Expressions Information obtained through the use of show commands in conjunction with regular expressions can be useful in determining how BGP paths are installed into the BGP tables. The following is the result of the show ip bgp regexp .* command, which reveals all paths known to BGP on this router. Router_1#sh ip bgp regexp.* BGP table version is 146, local router ID is 1.1.1.1 Status codes: s suppressed, d damped, h history, * valid, > best, i - internal Origin codes: i - IGP, e - EGP, ? - incomplete Network Next Hop Metric LocPrf Weight Path *>10.0.0.0/30 10.0.0.13 0 0 4 i * 10.0.0.0 10.0.0.9 0 2 3 i *> 10.0.0.13 0 4 3 i * 10.0.0.4/30 10.0.0.13 0 4 3 2 i *> 10.0.0.9 0 0 2 i *>192.168.0.0 10.0.0.13 0 0 4 i *>192.168.1.0 10.0.0.13 0 0 4 i *>192.168.2.0 10.0.0.13 0 0 4 i *>192.168.3.0 10.0.0.13 0 0 4 i * 192.168.8.0 10.0.0.9 0 2 3 ? *> 10.0.0.13 0 4 3 ? * 192.168.9.0 10.0.0.9 0 2 3 ? *> 10.0.0.13 0 4 3 ? * 192.168.10.0 10.0.0.9 0 2 3 ? *> 10.0.0.13 0 4 3 ? * 192.168.11.0 10.0.0.9 0 2 3 ? *> 10.0.0.13 0 4 3 ? * 192.168.32.0/22 10.0.0.13 0 4 3 2 i *> 10.0.0.9 0 2 i *>192.168.64.0 0.0.0.0 0 32768 ? *>192.168.65.0 0.0.0.0 0 32768 ? *>192.168.66.0 0.0.0.0 0 32768 ? *>192.168.67.0 0.0.0.0 0 32768 ? Observe this on all routers. In the case of router_1, the output of the show ip bgp .* shows, for example, that directly connected networks have a weight of 32768, and a path of "?" indicating that these networks are local to the router. If router_1 were to receive notification from another source of a path to one of these routes, it would know by comparison that there is a loop, and that these route notifications are unreliable, and should be dropped. Note the summary route 192.168.32.0/22, denoted by the * as reliable, and advertised by AS4 (router 4) but that the best path, indicated by > comes from AS2 (router 2). Again, router 1 has received notification of two paths to a particular network, but installs only one of them into its routing table. (Refer to the router_1 routing table, above.) Path Manipulation on Router 4 Observe the router_4 routing table ROUTER_4#sh ip route bgp B 192.168.8.0/24 [20/0] via 10.0.0.2, 00:01:14 B 192.168.9.0/24 [20/0] via 10.0.0.2, 00:01:14 B 192.168.10.0/24 [20/0] via 10.0.0.2, 00:01:14 CertificationZone Page 7 of 9 http://www.certificationzone.com/studyguides /?Issue=20&IssueDate=09-01-2000&CP= 11/06/01 B 192.168.11.0/24 [20/0] via 10.0.0.2, 00:01:14 B 192.168.64.0/24 [20/0] via 10.0.0.14, 00:01:18 B 192.168.65.0/24 [20/0] via 10.0.0.14, 00:01:18 B 192.168.66.0/24 [20/0] via 10.0.0.14, 00:01:18 10.0.0.0/8 is variably subnetted, 4 subnets, 2 masks B 10.0.0.0/8 [20/0] via 10.0.0.2, 00:01:14 B 10.0.0.4/30 [20/0] via 10.0.0.14, 00:01:18 B 192.168.67.0/24 [20/0] via 10.0.0.14, 00:01:18 B 192.168.32.0/22 [20/0] via 10.0.0.14, 00:01:18 ROUTER_4# Router 4 is receiving information that certain networks are best reached from AS1 (router_1). How Could You See the Regexp? A look at the regular expression confirms this: Network Next Hop Metric LocPrf Weight Path *>198.92.0.0 198.92.72.30 8896 32768 ? * 198.92.72.30 0 109 108 ? *>198.92.1.0 198.92.72.30 8796 32768 ? * 198.92.72.30 0 109 108 ? ROUTER_4#sh ip bgp regexp .* BGP table version is 22, local router ID is 4.4.4.4 Status codes: s suppressed, d damped, h history, * valid, > best, i - internal Origin codes: i - IGP, e - EGP, ? - incomplete Network Next Hop Metric LocPrf Weight Path *>10.0.0.0/30 0.0.0.0 32768 i *>10.0.0.0 10.0.0.2 0 3 i * 10.0.0.14 0 1 2 3 i * 10.0.0.4/30 10.0.0.2 0 3 2 i *> 10.0.0.14 0 1 2 i *>192.168.0.0 0.0.0.0 32768 i *>192.168.1.0 0.0.0.0 32768 i *>192.168.2.0 0.0.0.0 32768 i *>192.168.3.0 0.0.0.0 32768 i *>192.168.8.0 10.0.0.2 0 3 ? * 10.0.0.14 0 1 2 3 ? *>192.168.9.0 10.0.0.2 0 3 ? * 10.0.0.14 0 1 2 3 ? *>192.168.10.0 10.0.0.2 0 3 ? * 10.0.0.14 0 1 2 3 ? *>192.168.11.0 10.0.0.2 0 3 ? * 10.0.0.14 0 1 2 3 ? * 192.168.32.0/22 10.0.0.2 0 3 2 i *> 10.0.0.14 0 1 2 i * 192.168.64.0 10.0.0.2 0 3 2 1 ? *> 10.0.0.14 0 1 ? * 192.168.65.0 10.0.0.2 0 3 2 1 ? *> 10.0.0.14 0 1 ? * 192.168.66.0 10.0.0.2 0 3 2 1 ? *> 10.0.0.14 0 1 ? * 192.168.67.0 10.0.0.2 0 3 2 1 ? *> 10.0.0.14 0 1 ? ROUTER_4# Observe that while a number of routes are advertised as originating through both AS1 (router_1) and AS3 (router_3) all routes are assigned a best path status based upon the decision process. Changing Policy Suppose, though, that router_4 did not want to accept traffic from router_1 unless that traffic had passed through AS3. Suppose, for example, that the managers of AS4 determined that AS1 was abusing its peering privilege, and dumping far more traffic into AS4 than was permitted by agreement. Through the use of regular expressions in conjunction with an access-list, the management of AS4 can set a policy restricting traffic from AS1 entering AS4 directly. CertificationZone Page 8 of 9 http://www.certificationzone.com/studyguides /?Issue=20&IssueDate=09-01-2000&CP= 11/06/01 Note that in the configuration for AS4, there is an access list ip as-path access-list 1 permit _3_ Note the "_3_ " portion. The regular expression _3_ denotes an exact match of AS3, preceded and followed by any other AS. Add the Access List to Router 4 Configuration. One more step is required. As with all Cisco access-lists, it is one thing to create them. They must still be applied. This is done with a filter list, applied under the routing process. So, in this case, on router_4, enter the following command: router bgp 4 neighbor 10.0.0.14 filter-list 1 in Huh? It Didn't Work Now observe the change in the routing table, or in the regexp output. There is no change! Why? Something Is Missing because the paths are already installed into the BGP tables. The BGP processes must be cleared so that, as updates are received, the new policy can be applied. This is done with the clear ip bgp * command. Now observe the routing table and the regexp output for router 4: ROUTER_4#sh ip route bgp B 192.168.8.0/24 [20/0] via 10.0.0.2, 00:00:15 B 192.168.9.0/24 [20/0] via 10.0.0.2, 00:00:15 B 192.168.10.0/24 [20/0] via 10.0.0.2, 00:00:15 B 192.168.11.0/24 [20/0] via 10.0.0.2, 00:00:15 B 192.168.64.0/24 [20/0] via 10.0.0.2, 00:00:15 B 192.168.65.0/24 [20/0] via 10.0.0.2, 00:00:15 B 192.168.66.0/24 [20/0] via 10.0.0.2, 00:00:15 10.0.0.0/8 is variably subnetted, 4 subnets, 2 masks B 10.0.0.0/8 [20/0] via 10.0.0.2, 00:00:15 B 10.0.0.4/30 [20/0] via 10.0.0.2, 00:00:15 B 192.168.67.0/24 [20/0] via 10.0.0.2, 00:00:15 B 192.168.32.0/22 [20/0] via 10.0.0.2, 00:00:15 ROUTER_4# All routes are originating through the connection to router 3 (AS3). ROUTER_4#sh ip bgp regexp .* BGP table version is 17, local router ID is 4.4.4.4 Status codes: s suppressed, d damped, h history * valid, > best, i - internal Origin codes: i - IGP, e - EGP, ? - incomplete Network Next Hop Metric LocPrf Weight Path *> 10.0.0.0/30 0.0.0.0 32768 i *> 10.0.0.0 10.0.0.2 0 3 i *> 10.0.0.4/30 10.0.0.2 0 3 2 i *> 192.168.0.0 0.0.0.0 32768 i *> 192.168.1.0 0.0.0.0 32768 i *> 192.168.2.0 0.0.0.0 32768 i *> 192.168.3.0 0.0.0.0 32768 i *> 192.168.8.0 10.0.0.2 0 3 ? Do not reset interfaces in production networks unless you know what the consequences will be. Wherever possible, use the newer soft refresh mechanisms. See the BGP3 Tutorial for a discussion of soft refresh. CertificationZone Page 9 of 9 http://www.certificationzone.com/studyguides /?Issue=20&IssueDate=09-01-2000&CP= 11/06/01 *> 192.168.9.0 10.0.0.2 0 3 ? *> 192.168.10.0 10.0.0.2 0 3 ? *> 192.168.11.0 10.0.0.2 0 3 ? *> 192.168.32.0/22 10.0.0.2 0 3 2 i *> 192.168.64.0 10.0.0.2 0 3 2 1 ? *> 192.168.65.0 10.0.0.2 0 3 2 1 ? *> 192.168.66.0 10.0.0.2 0 3 2 1 ? *> 192.168.67.0 10.0.0.2 0 3 2 1 ? [IE-BGP3-LS1-F03] [2000-08-30-01] Copyright © 2000 Genium Publishing Corporation . /?Issue=20&IssueDate=09-01-2000&CP= 11/06/01 Date of Issue: 09-01-2000 BGP III Lab Scenario by Chuck Larrieu Setup Working Configurations Router 1 Configuration . how BGP paths are installed into the BGP tables. The following is the result of the show ip bgp regexp .* command, which reveals all paths known to BGP