b1-1up
b1-1up
Control
ISP/IXP Workshops
Cisco ISP
Workshops © `2005, Cisco Systems, Inc. All rights reserved. 1
Agenda
• BGP Attributes
• BGP Path Selection
• Applying Policy
Cisco ISP
Workshops © 2005, Cisco Systems, Inc. All rights reserved. 2
BGP Attributes
The “tools” available for the job
Cisco ISP
Workshops © `2005, Cisco Systems, Inc. All rights reserved. 3
What Is an Attribute?
Next
... Hop AS Path MED ... ...
Cisco ISP
Workshops © 2005, Cisco Systems, Inc. All rights reserved. 4
AS-Path
Cisco ISP
Workshops © 2005, Cisco Systems, Inc. All rights reserved. 5
AS-Path loop detection
AS 200 AS 100
170.10.0.0/16 180.10.0.0/16
Cisco ISP
Workshops © 2005, Cisco Systems, Inc. All rights reserved. 6
Next Hop
150.10.1.1 150.10.1.2
iBGP C
AS 200
A B
150.10.0.0/16 eBGP AS 300
150.10.0.0/16 150.10.1.1
160.10.0.0/16 150.10.1.1
Cisco ISP
Workshops © 2005, Cisco Systems, Inc. All rights reserved. 7
iBGP Next Hop
120.1.2.0/23
120.1.1.0/24
iBGP C
Loopback
120.1.254.3/32
Loopback B
120.1.254.2/32
AS 300
D
120.1.1.0/24 120.1.254.2
120.1.2.0/23 120.1.254.3
Next hop is ibgp router loopback address
Recursive
Cisco ISP route look-up
Workshops © 2005, Cisco Systems, Inc. All rights reserved. 8
Third Party Next Hop
AS 200
120.68.1.0/24 150.1.1.3
Cisco ISP
Workshops © 2005, Cisco Systems, Inc. All rights reserved. 10
Origin
Cisco ISP
Workshops © 2005, Cisco Systems, Inc. All rights reserved. 12
Local Preference
AS 100
160.10.0.0/16
AS 200 AS 300
D 500 800 E
A B
160.10.0.0/16 500
AS 400
> 160.10.0.0/16 800
C
Cisco ISP
Workshops © 2005, Cisco Systems, Inc. All rights reserved. 13
Local Preference
• Local to an AS – non-transitive
local preference set to 100 when heard from
neighbouring AS
• Used to influence BGP path selection
determines best path for outbound traffic
• Path with highest local preference wins
Cisco ISP
Workshops © 2005, Cisco Systems, Inc. All rights reserved. 14
Local Preference
• Configuration of Router B:
router bgp 400
neighbor 120.5.1.1 remote-as 300
neighbor 120.5.1.1 route-map local-pref in
!
route-map local-pref permit 10
match ip address prefix-list MATCH
set local-preference 800
!
ip prefix-list MATCH permit 160.10.0.0/16
Cisco ISP
Workshops © 2005, Cisco Systems, Inc. All rights reserved. 15
Multi-Exit Discriminator (MED)
AS 200
AS 201
Cisco ISP
Workshops © 2005, Cisco Systems, Inc. All rights reserved. 16
Multi-Exit Discriminator
Cisco ISP
Workshops © 2005, Cisco Systems, Inc. All rights reserved. 18
Multi-Exit Discriminator
• Configuration of Router B:
router bgp 400
neighbor 120.5.1.1 remote-as 200
neighbor 120.5.1.1 route-map set-med out
!
route-map set-med permit 10
match ip address prefix-list MATCH
set metric 1000
!
ip prefix-list MATCH permit 120.68.1.0/24
Cisco ISP
Workshops © 2005, Cisco Systems, Inc. All rights reserved. 19
Weight
Cisco ISP
Workshops © 2005, Cisco Systems, Inc. All rights reserved. 20
Weight – Used to help Deploy RPF
AS4 Link to use for most traffic from AS1
B
AS4, LOCAL_PREF
Backup link, but RPF 100, weight 100
still needs to work A AS1
Cisco ISP
Workshops © 2005, Cisco Systems, Inc. All rights reserved. 22
Community
ISP 2
160.10.0.0/16 300:1
X 170.10.0.0/16 300:1
100.10.0.0/16 AS 400
F
E
100.10.0.0/16 300:9
D ISP 1
AS 300
160.10.0.0/16 300:1 C 170.10.0.0/16 300:1
A B
AS 100 AS 200
160.10.0.0/16 170.10.0.0/16
Cisco ISP
Workshops © 2005, Cisco Systems, Inc. All rights reserved. 23
Well-Known Communities
105.7.0.0/16
105.7.X.X No-Export
105.7.X.X D
A
105.7.0.0/16
AS 100 AS 200 G
B E
C F
• AS100 announces aggregate and subprefixes
aim is to improve loadsharing by leaking subprefixes
• Subprefixes marked with no-export community
• Router G in AS200 does not announce prefixes with no-export
community set
Cisco ISP
Workshops © 2005, Cisco Systems, Inc. All rights reserved. 25
No-Peer Community
105.7.0.0/16 upstream
105.7.X.X No-Peer D C&D&E
are peers
e.g. Tier-1s
105.7.0.0/16
upstream
E
A
upstream
B
Router1>sh ip bgp
BGP table version is 28, local router ID is 100.1.15.224
Status codes: s suppressed, d damped, h history,
* valid, > best,i - internal, r RIB-failure, S Stale
Origin codes: i - IGP, e - EGP, ? – incomplete
Cisco ISP
Workshops © 2005, Cisco Systems, Inc. All rights reserved. 27
BGP Path Selection Algorithm
Why is this the best path?
Cisco ISP
Workshops © `2005, Cisco Systems, Inc. All rights reserved. 28
BGP Path Selection Algorithm
Cisco ISP
Workshops © 2005, Cisco Systems, Inc. All rights reserved. 31
BGP Path Selection Algorithm
(continued)
Cisco ISP
Workshops © 2005, Cisco Systems, Inc. All rights reserved. 32
Applying Policy with BGP
How to use the “tools”
Cisco ISP
Workshops © `2005, Cisco Systems, Inc. All rights reserved. 33
Applying Policy with BGP
Cisco ISP
Workshops © 2005, Cisco Systems, Inc. All rights reserved. 34
Policy Control – Prefix List
Cisco ISP
Workshops © 2005, Cisco Systems, Inc. All rights reserved. 35
Prefix-list Command
• Syntax:
[no] ip prefix-list <list-name> [seq <seq-value>] permit|deny
<network>/<len> [ge <ge-value>] [le <le-value>]
<network>/<len>: The prefix and its length
ge <ge-value>: "greater than or equal to”
le <le-value>: "less than or equal to”
Both "ge" and "le" are optional. Used to specify the range of
the prefix length to be matched for prefixes that are more
specific than <network>/<len>
Cisco ISP
Workshops © 2005, Cisco Systems, Inc. All rights reserved. 36
Prefix Lists – Examples
• Example Configuration
router bgp 100
network 105.7.0.0 mask 255.255.0.0
neighbor 102.10.1.1 remote-as 110
neighbor 102.10.1.1 prefix-list PEER-IN in
neighbor 102.10.1.1 prefix-list PEER-OUT out
!
ip prefix-list PEER-IN deny 218.10.0.0/16
ip prefix-list PEER-IN permit 0.0.0.0/0 le 32
ip prefix-list PEER-OUT permit 105.7.0.0/16
ip prefix-list PEER-OUT deny 0.0.0.0/0 le 32
Cisco ISP
Workshops © 2005, Cisco Systems, Inc. All rights reserved. 39
Policy Control – Filter List
Cisco ISP
Workshops © 2005, Cisco Systems, Inc. All rights reserved. 41
Policy Control – Regular Expressions
• Simple Examples
.* match anything
.+ match at least one character
^$ match routes local to this AS
_1800$ originated by AS1800
^1800_ received from AS1800
_1800_ via AS1800
_790_1800_ via AS1800 and AS790
_(1800_)+ multiple AS1800 in sequence
(used to match AS-PATH prepends)
_\(65530\)_ via AS65530 (confederations)
Cisco ISP
Workshops © 2005, Cisco Systems, Inc. All rights reserved. 42
Policy Control – Regular Expressions
Cisco ISP
Workshops © 2005, Cisco Systems, Inc. All rights reserved. 44
Route Maps – Caveats
Cisco ISP
Workshops © 2005, Cisco Systems, Inc. All rights reserved. 45
Route Maps – Caveats
• Example
omitting the third line below means that
prefixes not matching list-one or list-two are
dropped
route-map sample permit 10
match ip address prefix-list list-one
set local-preference 120
!
route-map sample permit 20
match ip address prefix-list list-two
set local-preference 80
!
route-map sample permit 30 ! Don’t forget this
Cisco ISP
Workshops © 2005, Cisco Systems, Inc. All rights reserved. 46
Policy Control – Route Maps
Cisco ISP
Workshops © 2005, Cisco Systems, Inc. All rights reserved. 47
Policy Control – Route Maps
Cisco ISP
Workshops © 2005, Cisco Systems, Inc. All rights reserved. 49
Policy Control – Route Maps
Cisco ISP
Workshops © 2005, Cisco Systems, Inc. All rights reserved. 50
Policy Control – Route Maps
Cisco ISP
Workshops © 2005, Cisco Systems, Inc. All rights reserved. 51
Policy Control – Route Maps
Cisco ISP
Workshops © 2005, Cisco Systems, Inc. All rights reserved. 52
Policy Control –
Matching Communities
• Example Configuration
router bgp 100
neighbor 102.10.1.2 remote-as 200
neighbor 102.10.1.2 route-map filter-on-community in
!
route-map filter-on-community permit 10
match community 1
set local-preference 50
!
route-map filter-on-community permit 20
match community 2 exact-match
set local-preference 200
!
ip community-list 1 permit 150:3 200:5
ip community-list 2 permit 88:6
Cisco ISP
Workshops © 2005, Cisco Systems, Inc. All rights reserved. 53
Policy Control –
Setting Communities
• Example Configuration
router bgp 100
network 105.7.0.0 mask 255.255.0.0
neighbor 102.10.1.1 remote-as 200
neighbor 102.10.1.1 send-community
neighbor 102.10.1.1 route-map set-community out
!
route-map set-community permit 10
match ip address prefix-list NO-ANNOUNCE
set community no-export
!
route-map set-community permit 20
match ip address prefix-list AGGREGATE
!
ip prefix-list NO-ANNOUNCE permit 105.7.0.0/16 ge 17
ip prefix-list AGGREGATE permit 105.7.0.0/16
Cisco ISP
Workshops © 2005, Cisco Systems, Inc. All rights reserved. 54
Aggregation Policies
• Suppress Map
Used to suppress selected more-specific
prefixes (e.g. defined through a route-
map) in the absence of the summary-only
keyword.
• Unsuppress Map
Used to unsuppress selected more-
specific prefixes per BGP peering when
the summary-only keyword is in use.
Cisco ISP
Workshops © 2005, Cisco Systems, Inc. All rights reserved. 55
Aggregation Policies –
Suppress Map
• Example
router bgp 100
network 102.10.10.0
network 102.10.11.0
network 102.10.12.0
network 102.10.33.0
network 102.10.34.0
aggregate-address 102.10.0.0 255.255.0.0 suppress-map block-net
neighbor 102.5.7.2 remote-as 200
!
route-map block-net permit 10
match ip address prefix-list SUPPRESS
!
ip prefix-list SUPPRESS permit 102.10.8.0/21 le 32
ip prefix-list SUPPRESS deny 0.0.0.0/0 le 32
!
Cisco ISP
Workshops © 2005, Cisco Systems, Inc. All rights reserved. 56
Aggregation Policies –
Suppress Map
router1#sh ip bgp
BGP table version is 11, local router ID is 102.5.7.1
Status codes: s suppressed, d damped, h history, * valid, > best, i - internal
Origin codes: i - IGP, e - EGP, ? - incomplete
Network Next Hop Metric LocPrf Weight Path
*> 102.10.0.0/16 0.0.0.0 32768 i
s> 102.10.10.0 0.0.0.0 0 32768 i
s> 102.10.11.0 0.0.0.0 0 32768 i
s> 102.10.12.0 0.0.0.0 0 32768 i
*> 102.10.33.0 0.0.0.0 0 32768 i
*> 102.10.34.0 0.0.0.0 0 32768 i
Cisco ISP
Workshops © 2005, Cisco Systems, Inc. All rights reserved. 57
Aggregation Policies –
Suppress Map
Cisco ISP
Workshops © 2005, Cisco Systems, Inc. All rights reserved. 58
Aggregation Policies –
Unsuppress Map
• Example
router bgp 100
network 102.10.10.0
network 102.10.11.0
network 102.10.12.0
network 102.10.33.0
network 102.10.34.0
aggregate-address 102.10.0.0 255.255.0.0 summary-only
neighbor 102.5.7.2 remote-as 200
neighbor 102.5.7.2 unsuppress-map leak-net
!
route-map leak-net permit 10
match ip address prefix-list LEAK
!
ip prefix-list LEAK permit 102.10.8.0/21 le 32
ip prefix-list LEAK deny 0.0.0.0/0 le 32
!
Cisco ISP
Workshops © 2005, Cisco Systems, Inc. All rights reserved. 59
Aggregation Policies –
Unsuppress Map
Cisco ISP
Workshops © 2005, Cisco Systems, Inc. All rights reserved. 60
Aggregation Policies –
Unsuppress Map
Cisco ISP
Workshops © 2005, Cisco Systems, Inc. All rights reserved. 61
Aggregation Policies –
Aggregate Address
Cisco ISP
Workshops © 2005, Cisco Systems, Inc. All rights reserved. 62
BGP Attributes and Policy
Control
ISP/IXP Workshops
Cisco ISP
Workshops © `2005, Cisco Systems, Inc. All rights reserved. 63