BGP – Border Gateway Protocol Breve introducción RETINA – 2003

Clase 2 Atributos. Redistribución del default. Filtros: Localpref, med, weight, otros. Redistribución del default. Filtros: Access-lists. As-paths. Aggregate-address. Más comandos show y repaso. Comandos clear.

Antes de empezar Hicieron los ejercicios??????? Cada uno explicar qué hizo Mariela: Hay rutas de RIU que se ven sólo por SECYT Ale: AS inconsistentes en ruta 194.138.184.0/24 Daniel: sumarizar bloque 170.210.244-247 200.10.202.0 la originan 3 routers 192.168.1.0/30 se aprende del 6140 (red privada)

Atributos Local Preference MED Weight Otros

Local Preference Indica un grado de preferencia respecto a otras rutas al mismo destino. Es un atributo local al sistema autonomo (se propaga por iBGP pero no por eBGP). Mayor local preference indica preferencia (ej: local pref 600 es mejor que 100). Da una visión uniforme a todo el AS. Se setea mediante route-maps

Local Preference AS 45 AS X AS 1 AS 2 Ping 10.0.0.1 Set local-pref 200 Network 10.0.0.0/24

Weight (Cisco propietario) Es similar a local pref, sólo que tiene efecto local en el router que se define. No se pasa esta info a otros routers. Tiene precedencia más alta que cualquier otro atributo (ver selección de camino). Sirve para discriminar rutas entre proveedores conectados al mismo router. Se setea mediante route-maps.

Weight (Cisco) AS 45 AS X AS 1 AS 2 Ping 10.0.0.1 weight 400 Network 10.0.0.0/24

MED Multi Exit Discriminator Se utiliza en conexiones multihomed. Es una métrica para indicarle a otro AS cuál debería ser la puerta de entrada a nuestro AS. Baja precedencia en el algoritmo de selección de camino. Preferible: usar communities.

MED *>172.16.20.0/24 NH=A MED=50 172.16.20.0/24 NH=B MED=80 MED=80

Local-pref, Weight y MED route-map: set local-pref 200 10.0.0.0/24 iBGP Local Preference Aprende: 10.0.0.0/24 con local-pref 200

Local-pref, Weight y MED route-map: set weight 50 10.0.0.0/24 iBGP Weight Aprende: 10.0.0.0/24 con weight 0

Local-pref, Weight y MED route-map: set med 50 Aprende: 10.0.0.0/24 con med 50 10.0.0.0/24 iBGP MED Aprende: 10.0.0.0/24 con med 50

Otros atributos AS-PATH Next Hop Origin: igp, egp o incomplete Los route-maps permiten “prepend” Next Hop Origin: igp, egp o incomplete igp: originada en un igp, anunciada con “network” egp: originada en un EGP (BGP a BGP) incomplete: origen desconocido, normalmente producto de un redistribute Communities Próxima clase

Redistribución del default network 0.0.0.0 Debe existir la ruta en la tabla de ruteo Se enseña a todos los neighbors Importante: poner filtros neighbor default-originate Aplicado a un neighbor No importa si el router tiene una ruta por default

Filtros Basados en direcciones IP Basados en el path distribute-list (access-lists) Basados en el path filter-list (as-path)

Filtros por IP Se define una lista de acceso con las IPs que se permiten y deniegan. Se aplica esa lista de acceso a la información que recibimos (in) o enviamos (out) a un neighbor. Sintaxis: neighbor xxx distribute-list nnn (in | out)

Filtros por IP Ejemplo: neighbor 199.248.144.22 distribute-list 10 in neighbor 199.248.144.22 distribute-list 11 out ... access-list 10 permit ip 200.10.202.0 access-list 11 deny ip 10.0.0.0 access-list 11 deny ip 172.16.0.0 access-list 11 permit ip any

ACLs: standard vs extendidas Listas de acceso standard: solo miran la porción de red de una ruta access-list 1 permit 168.96.0.0 access-list 2 permit 168.96.0.0 0.0.255.0 Listas de acceso extendidas: permiten tener en cuentas las máscaras: access-list 101 permit ip 168.96.0.0 0.0.255.0 255.255.255.0 0.0.0.0 access-list 102 deny ip 200.10.202.0 0.0.0.0 255.255.255.128 0.0.0.127 Sintaxis (extendidas): access-list ... <src> <src-wild> <mask> <mask-wild>

Filtros por AS-PATH Se define una expresión regular que denota un as-path: ip as-path access-list <n> (permit|deny) <regexp> Se aplica esa expresión regular a la información que recibimos (in) o enviamos (out) a un neighbor. Sintaxis: neighbor xxx filter-list nnn (in | out)

Filtros por AS-PATH Ejemplo: neighbor 199.248.144.22 filter-list 10 in neighbor 199.248.144.22 filter-list 11 out ... ip as-path access-list 10 permit ^$ ip as-path access-list 11 deny 4740$ ip as-path access-list 11 deny ^2703 ip as-path access-list 11 permit _200_300_

Agregación de direcciones Comando aggregate-address Basta que exista una ruta para una porción específica para que incorpore el aggregate Permite crear “supernets” y minimizar el tamaño de las tablas de ruteo Con “summary-only” anuncia sólo la ruta agregada y no las porciones mas específicas

Agregación de direcciones Aggregate: 168.96.0.0/16 B C Router B: aggregate address 168.96.0.0 255.255.0.0 summary-only 168.96.1.0/24 A 168.96.2.0/24

Agregación de direcciones Supernets: 200.0.198.0/24 200.0.199.0/24 Se pueden sumarizar en 200.0.198.0/23 Diferencia (aparte de sintaxis)?: Network 168.96.0.0 mask 255.255.0.0 Aggregate-address 168.96.0.0 255.255.0.0

Repaso Sh ip bgp summary Sh ip bgp Sh ip bgp <prefix> Sh ip bgp neighbors [ <ip> ] Sh ip bgp neighbors <ip> advertised-routes Sh ip bgp neighbors <ip> routes Sh ip bgp regexp <regexp>

show ip bgp summary Que router es este? BGP router identifier 200.10.202.22, local AS number 3597 BGP table version is 48347, main routing table version 48347 2558 network entries and 3869 paths using 389968 bytes of memory 527 BGP path attribute entries using 28600 bytes of memory 250 BGP AS-PATH entries using 6304 bytes of memory 1 BGP community entries using 24 bytes of memory 191 BGP route-map cache entries using 3056 bytes of memory 1028 BGP filter-list cache entries using 12336 bytes of memory BGP activity 14929/71963 prefixes, 42175/38306 paths Neighbor V AS MsgRcvd MsgSent TblVer InQ OutQ Up/Down State/PfxRcd 199.248.144.114 4 6140 38357 31873 48347 0 0 6d08h 1342 199.248.144.122 4 7908 31728 34362 48347 0 0 6d09h 97 199.248.144.182 4 4387 32203 34388 48347 0 0 2w1d 70 199.248.144.190 4 3597 31146 62851 48347 0 0 2w1d 4 199.248.144.238 4 3597 0 0 0 0 0 never Active 200.10.202.1 4 3597 38217 52708 48347 0 0 6d08h 2329 200.10.202.11 4 3597 31057 57875 48347 0 0 6d08h 3 200.10.202.23 4 3597 31066 57722 48347 0 0 2w1d 1 200.10.202.114 4 3597 244830 57881 48347 0 0 6d07h 0 200.32.127.2 4 3597 33504 31208 48347 0 0 6d07h 18 200.69.141.117 4 3597 31048 31242 48347 0 0 2d14h 2

show ip bgp BGP table version is 48394, local router ID is 200.10.202.22 Status codes: s suppressed, d damped, h history, * valid, > best, i - internal Origin codes: i - IGP, e - EGP, ? - incomplete Network Next Hop Metric LocPrf Weight Path *> 170.210.244.0/24 199.248.144.182 95 0 4387 4270 i *> 170.210.245.0/24 199.248.144.182 95 0 4387 4270 i *> 170.210.246.0/24 199.248.144.182 95 0 4387 4270 i *> 170.210.247.0/24 199.248.144.182 95 0 4387 4270 i *>i170.210.248.0/21 199.248.144.126 0 600 0 4270 i * 199.248.144.182 95 0 4387 4270 i *>i192.168.1.0/30 199.248.144.9 100 0 6140 ? * i194.138.184.0 172.16.20.143 100 0 11058 7908 i * 199.248.144.114 90 100 0 6140 7908 i *> 199.248.144.122 100 0 7908 65012 I *>i200.10.186.0 172.16.20.121 100 0 11058 10481 i * 199.248.144.114 90 100 0 6140 11058 10481 i *> 200.10.202.0 0.0.0.0 50 32768 i * i 200.10.202.1 28160 100 0 i * i 200.10.202.11 1 100 0 i *>i200.10.202.32/27 200.32.127.2 0 100 0 i *>i200.10.202.232/29 200.10.202.23 0 100 0 i Preguntar que partes de esta tabla tienen problemas Identificar c/u un problema y verlo Vemos

show ip bgp <prefix> BGP routing table entry for 194.138.184.0/24, version 26804 Paths: (3 available, best #3) Advertised to non peer-group peers: 199.248.144.190 200.10.202.1 200.10.202.11 200.10.202.23 200.10.202.114 11058 7908, (Received from a RR-client) 172.16.20.143 (metric 30720) from 200.10.202.1 (200.69.129.106) Origin IGP, localpref 100, valid, internal, ref 2 6140 7908 199.248.144.114 from 199.248.144.114 (200.31.1.218) Origin IGP, metric 90, localpref 100, valid, external, ref 2 7908 65012 199.248.144.122 from 199.248.144.122 (200.47.200.104) Origin IGP, metric 100, localpref 100, valid, external, best, ref 2

show ip bgp neighbors [ <ip> ] BGP neighbor is 199.248.144.238, remote AS 3597, internal link BGP version 4, remote router ID 0.0.0.0 BGP state = Active Last read 2w1d, hold time is 180, keepalive interval is 60 seconds Received 0 messages, 0 notifications, 0 in queue Sent 0 messages, 0 notifications, 0 in queue Route refresh request: received 0, sent 0 Minimum time between advertisement runs is 5 seconds For address family: IPv4 Unicast BGP table version 48398, neighbor version 0 Index 5, Offset 0, Mask 0x20 Route-Reflector Client 0 accepted prefixes consume 0 bytes Prefix advertised 0, suppressed 0, withdrawn 0 Connections established 0; dropped 0 Last reset 2w1d, due to User reset No active TCP connection

show ip bgp neighbors <ip> advertised-routes show ip bgp neighbors 199.248.144.114 advertised-routes BGP table version is 48402, local router ID is 200.10.202.22 Status codes: s suppressed, d damped, h history, * valid, > best, i - internal Origin codes: i - IGP, e - EGP, ? - incomplete Network Next Hop Metric LocPrf Weight Path *> 168.83.0.0 199.248.144.182 95 0 4387 i *>i168.96.192.0/29 200.10.202.1 0 100 0 i *>i199.248.144.0 200.10.202.11 1 100 0 i *>i199.248.144.188/30 199.248.144.190 0 100 0 i *> 200.0.198.0/23 0.0.0.0 32768 i *> 200.1.224.0/19 199.248.144.182 95 0 4387 i *> 200.9.242.0/23 199.248.144.182 95 0 4387 i *> 200.9.244.0/23 199.248.144.182 95 0 4387 i *>i200.10.202.232/29 200.10.202.23 0 100 0 i *>i200.12.154.0 172.16.20.118 100 0 11058 26608 5745 i *>i200.16.96.0 200.16.99.100 0 100 0 676 i *>i200.16.96.0/20 200.16.99.100 100 0 676 i *>i200.16.97.0 200.16.99.100 0 100 0 676 i *>i200.16.98.0 172.16.20.127 100 0 11058 11664 676 i *>i200.16.99.0 172.16.20.127 100 0 11058 11664 676 i *>i200.26.125.0 172.16.20.104 100 0 11058 10834 676 i

show ip bgp neighbors <ip> routes show ip bgp neighbors 200.10.202.1 routes BGP table version is 48402, local router ID is 200.10.202.22 Status codes: s suppressed, d damped, h history, * valid, > best, i - internal Origin codes: i - IGP, e - EGP, ? - incomplete Network Next Hop Metric LocPrf Weight Path *>i170.210.168.0/21 199.248.144.126 0 600 0 4270 i *>i170.210.184.0/21 199.248.144.126 0 600 0 4270 i *>i170.210.192.0/21 199.248.144.126 0 600 0 4270 i *>i170.210.200.0/21 199.248.144.126 0 600 0 4270 i *>i170.210.208.0/21 199.248.144.126 0 600 0 4270 i *>i170.210.216.0/22 199.248.144.126 0 600 0 4270 i *>i170.210.224.0/21 199.248.144.126 0 600 0 4270 i *>i170.210.232.0/22 199.248.144.126 0 600 0 4270 i *>i170.210.239.0/24 199.248.144.126 0 600 0 4270 i *>i170.210.240.0/22 199.248.144.126 0 600 0 4270 i *>i170.210.248.0/21 199.248.144.126 0 600 0 4270 i *>i192.168.1.0/30 199.248.144.9 100 0 6140 ? *>i192.193.42.0 172.16.20.132 100 0 11058 7303 i

show ip bgp regexp <regexp> BGP table version is 48402, local router ID is 200.10.202.22 Status codes: s suppressed, d damped, h history, * valid, > best, i - internal Origin codes: i - IGP, e - EGP, ? - incomplete Network Next Hop Metric LocPrf Weight Path *> 168.83.0.0 199.248.144.182 95 0 4387 i *> 200.1.224.0/19 199.248.144.182 95 0 4387 i *> 200.9.242.0/23 199.248.144.182 95 0 4387 i *> 200.9.244.0/23 199.248.144.182 95 0 4387 i

Más comandos “show” Show ip bgp paths Show ip bgp cidr-only Show ip bgp filter-list <access-list-number> Show ip bgp inconsistent-as

Show ip bgp paths Address Hash Refcount Metric Path 0x822F2DF4 0 1 0 i 0x82081A30 0 17 0 i 0x8218F8AC 0 4 0 i 0x822F7794 7 1 0 6140 17401 i 0x8208F250 9 1 0 20080 10764 17579 1237 7623 17866 i 0x8218C680 10 3 1079 11537 1103 1888 i 0x8218E0EC 10 1 1079 11537 1103 1888 i 0x822F8244 12 1 0 7908 10986 i 0x82188070 12 2 847 11537 5568 3058 2148 i 0x8218C894 12 1 847 11537 5568 3058 2148 i 0x8208DD88 14 0 1079 11537 20965 1853 2036 i 0x820820B8 18 1 847 11537 22335 6325 22978 i 0x822F2000 21 2 0 20080 10764 17579 1237 7623 9686 i 0x8218F9DC 27 36 846 11537 20965 5538 i 0x8218F944 28 1 846 11537 10466 7328 ? 0x8208A2C0 30 1 846 11537 10466 11424 i 0x8208C2D0 32 21 1 11537 10546 i 0x82084DD8 37 1 847 11537 17579 1237 1781 1781 i 0x82182ECC 37 4 847 11537 17579 1237 23552 23552 i

Show ip bgp cidr-only BGP table version is 15041, local router ID is 168.96.6.22 *>i168.96.1.0/24 200.10.202.114 0 900 0 i *>i168.96.7.0/24 200.10.202.114 0 900 0 i *>i168.96.62.0/25 200.10.202.18 0 100 0 i *>i168.96.64.0/21 200.32.127.2 0 100 0 i *>i168.96.72.0/21 200.32.127.2 0 100 0 i *>i168.96.132.0/23 200.32.127.1 0 100 0 i *>i168.96.135.0/24 200.32.127.1 0 100 0 i *>i168.96.144.0/22 200.32.127.2 0 100 0 i *>i168.96.148.0/24 199.248.144.9 100 0 6140 65050 i *>i168.96.149.0/24 199.248.144.9 100 0 6140 65050 i *>i168.96.192.0/29 200.10.202.1 0 100 0 i *>i168.96.200.0/24 200.10.202.114 0 900 0 i *>i168.96.204.0/23 200.69.141.117 0 100 0 I *>i168.96.204.124/32 *>i168.96.212.0/24 200.32.127.2 0 100 0 i *>i168.96.252.0/24 200.10.202.18 0 100 0 i *>i168.96.254.0/24 200.10.202.114 0 900 0 i *>i168.96.255.0/24 200.32.127.2 0 100 0 i

Sh ip bgp filter-list sh ip bgp filter-list 6 BGP table version is 15631, local router ID is 168.96.6.22 Status codes: s suppressed, d damped, h history, * valid, > best, i - internal Origin codes: i - IGP, e - EGP, ? - incomplete Network Next Hop Metric LocPrf Weight Path *>i128.255.0.0 200.10.202.114 847 900 0 11537 22335 3676 i *> 168.83.0.0 199.248.144.182 95 0 4387 i * i168.96.0.0 200.10.202.11 1 100 0 i *>i 200.10.202.1 0 100 0 i *>i168.96.72.0/21 200.32.127.2 0 100 0 i *>i168.96.132.0/23 200.32.127.1 0 100 0 i *>i200.12.154.0 172.16.20.118 100 0 11058 26608 5745 i *>i200.16.96.0 200.16.99.100 0 100 0 676 i *>i200.16.96.0/20 200.16.99.100 100 0 676 i *>i200.16.97.0 172.16.20.127 100 0 11058 11664 676 i *>i200.16.98.0 200.16.99.100 0 100 0 676 i *>i200.16.99.0 172.16.20.127 100 0 11058 11664 676 i sh ip as-path-access-list 6 AS path access list 6 permit 3597$ permit 676$ permit 5745$ permit 4387$ permit ^$

Show ip bgp inconsistent-as BGP table version is 15751, local router ID is 168.96.6.22 Status codes: s suppressed, d damped, h history, * valid, > best, i - internal Origin codes: i - IGP, e - EGP, ? - incomplete Network Next Hop Metric LocPrf Weight Path * 194.138.184.0 199.248.144.114 90 100 0 6140 11058 7908 i *> 199.248.144.122 100 0 7908 65012 i * i 172.16.20.142 100 0 11058 7908 i *> 200.16.83.0 199.248.144.114 90 100 0 6140 7908 i * 199.248.144.122 100 0 7908 65003 i *> 200.47.1.0 199.248.144.114 90 100 0 6140 7908 i * 199.248.144.122 100 0 7908 65001 i *> 200.47.5.0 199.248.144.114 90 100 0 6140 7908 ? * 199.248.144.122 100 0 7908 65001 ? * i 172.16.20.142 100 0 11058 7908 ? * 200.47.12.0 199.248.144.114 90 100 0 6140 7908 ? *> 199.248.144.122 100 0 7908 65026 ?

Comandos “clear” Clear ip bgp <neighbor-address> Clear ip bgp peer-group <tag> Las nuevas versiones soportan “soft in” y “soft out” Implica menos carga para el router Los clear indiscriminados pueden colgar un router (CPU, inestabilidades)