BGP: Difference between revisions

From Network Security Wiki
 
m (1 revision imported)
(No difference)

Revision as of 17:42, 14 August 2016


Introduction

BGP is needed for redundancy of servers. BGP is not used for providing redundancy to users for internet access.

  • Session establishment facts
BGP neighbors are not discovered.
They must be configured manually on both sides of the connection.
TCP port 179 is used. 
Only one session remains if both connection attempts succeed.


  • BGP is an advanced path vector protocol and has following advantages:
Reliable updates
Triggered updates only
Rich metric (Path attributes)
Scalable to massive networks


BGP States

Idle           Neighbor is not responding
Active         Attempting to connect
Connect        TCP session established
OpenSent       Open message sent
OpenConfirm    Response received
Established    Adjacency established


BGP Messages

Open
Update 
Keepalive       Sent every 60 seconds
Notification    Always indicate something is wrong


Protocol Specifications

Protocol Type Path vector
Peering mechanism Manual peering between neighbors
eBGP AD 20
iBGP AD 200
Rights Open standard
Supported protocols IPv4, IPv6
Transport TCP/179
Update mode Only triggered
Timers Hello (60 sec)
Authentication None, MD5
Specifications RFC 4271


  • Usage applications
Customer connected to multiple Internet service providers (ISPs).
Service provider networks (Transit autonomous system).
Network cores of very large enterprise networks (distribution or core layer)as a backup or redundant routing protocol due to its stability.


BGP Route selection criteria[1]

Mnemonics: N-WLLA-OMNI

Full Internet BGP routing table is more than 300K routes and a BGP router can receive multiple copies of that routing table from multiple providers, router has to compare those multiple entries and select only the best route for the routing table. It uses the BGP Best Path Selection Algorithm to do this. Routes installed by different BGP instances are compared by the general algorithm, i.e. route distances are compared and the route with lower distance is preferred.

Attribute Which is better
Next Hop reachable Route cannot be used if next hop is unreachable
Weight Bigger
Local Preference Bigger
Locally Injected Locally injected is better than iBGP/eBGP learned
AS Path Length Smaller
Origin Prefer I over E & E over Unknown
MED Smaller
Neighbor Type Prefer eBGP over iBGP
IGP Metric to Next Hop Smaller

Filter with Route Maps

Route maps are very powerful filtering tools, they can be used to accomplish the following tasks:

Filter on IP prefixes coming from a specific autonomous system
Filter on other BGP attributes
Modify BGP attributes

Match clauses in the BGP route map can be based on the following:

IP network numbers and subnet masks (prefix list or access list)
Route originator
Next hop
Origin code
Tag value attached to an Interior Gateway Protocol (IGP) route
Autonomous system path
Community
IGP route type

With a route map, the following can be set:

Origin
Next hop
Weight
Community
Local preference
MED

You can apply a route map on incoming or outgoing routing information for a neighbor. The routing information must be permitted by the route map to be accepted. If the route map has no statement explicitly permitting a route, the route is implicitly denied and dropped.

The syntax required is as follows:

Router(config-router)# neighbor ip-address route-map name in|out
  • What is a Route Reflector?[2]
        This section is under construction.


Troubleshooting and Monitoring

Command Description
show ip bgp neighbor ip-address Displays detailed neighbor information
show ip bgp Displays all the routes in the BGP table
show ip bgp ip-prefix [mask subnet-mask] Displays detailed information about all paths for a single prefix
debug ip tcp transactions Displays all TCP transactions
debug ip bgp events Displays significant BGP events
debug ip bgp keepalives Debugs BGP keepalive packets
debug ip bgp updates Displays all incoming or outgoing BGP updates
debug ip bgp updates acl Displays all incoming and sent updates matching an ACL
debug up bgp ip-address update [acl] Displays all BGP updates received from or sent to a specific neighbor


  • BGP route not installing, route reasons:
        This section needs verification or testing!
Synchronization is enabled & route knowing by IGP
Not Sync
Next Hop inaccessible
AS path includes the local AS
Rejection by inbound policy


LAB

  • Complete BGP Lab:
        This section is under construction.



References

  1. www.accenture.com
  2. www.accenture.com



{{#widget:DISQUS |id=networkm |uniqid=BGP |url=https://aman.awiki.org/wiki/BGP }}