Image of Cortney & Jeremy

BGP Conditional Advertisements

by Jeremy L. Gaddis on March 5, 2010 · 4 comments

in Networking

When dealing with BGP, routes are normally advertised “unconditionally”. In other words, if a peering session with a neighbor is up, we’ll send them our routes. There may be times, however, when we want to refrain from advertising a prefix (or prefixes) to a neighbor. The conditional advertisement feature, says cisco.com, “is useful for multihomed networks, in which some prefixes are advertised to one of the providers only if information from the other provider is not present (this indicates a failure in the peering session or partial reachability)”.

To explain this a little better, take a look at the following topology and let’s go through a hypothetical scenario:

In this scenario, R4 (in AS 65100) represent us. We are multi-homed to R2 (AS 65002) and R5 (AS 65005), our service providers. Our connection to R5 is at 1544 Kbps (“T-1″), our connection to R2 is 128 Kbps over a frame-relay circuit, and both SPs will be sending us a default route via BGP. Normally, we would simply advertise all of our prefixes (we’ll have two) to both providers. With a little bit of AS prepending, it may even be possible to get most of our inbound traffic to flow over the R4-R5 link.

For our hypothetical situation, we’ll advertise 203.0.113.0/24, which represents the subnet our client PCs are on, to both providers and not attempt to do any manipulation of inbound traffic. Inbound traffic may come over either link. We want to ensure that traffic inbound to our server subnet (198.51.100.0/24), however, always take the faster (R4-R5) link. Even with a bit of manipulation (e.g. AS prepending), it may not be possible to ensure that 100% of inbound traffic comes over the faster link. Enter conditional advertisements.

How we’re going to handle this is to only advertise 198.51.100.0/24 to R5. R2 won’t be receiving an advertisement for that network directly from us, so it will send inbound traffic through its other connections, eventually transiting R5 and entering our network there. But, you might ask, what happens if our R4-R5 link goes down for whatever reason? At that point, there will be no routes for 198.51.100.0/24 advertised and inbound traffic won’t have any way to reach us. Within about 60 seconds, however, the BGP process on our router will notice that we have no longer have reachability to R5 and will begin advertising the 198.51.100.0/24 network to R2. At that point, inbound traffic will begin flowing again.

As mentioned, we’ll advertise 203.0.113.0/24 (our “clients” network) to both providers, all the time. We’ll advertise 198.51.100.0/24 to R5 (and only R5), as long as that link is up. If, for some reason, it goes down, then we’ll begin advertising 198.51.100.0/24 to R2, providing inbound traffic with an alternate, albeit slower, way of reaching us.

Let’s go ahead and get basic connectivity established:

R2# configure terminal
R2(config)# interface serial 0/0
R2(config-if)# encapsulation frame-relay
R2(config-if)# no shutdown
R2(config-if)# interface serial 0/0.24 point-to-point
R2(config-subif)# frame-relay interface-dlci 204
R2(config-fr-dlci)# ip address 172.16.24.1 255.255.255.252
R4# configure terminal
R4(config)# interface serial 0/0
R4(config-if)# encapsulation frame-relay
R4(config-if)# no shutdown
R4(config-if)# interface serial 0/0.24 point-to-point
R4(config-subif)# frame-relay interface-dlci 402
R4(config-fr-dlci)# ip address 172.16.24.2 255.255.255.252
R4(config-subif)# interface serial 0/1
R4(config-if)# no shutdown
R4(config-if)# ip address 172.16.14.2 255.255.255.252
R5# configure terminal
R5(config)# interface serial 0/1
R5(config-if)# clock rate 2000000
R5(config-if)# no shutdown
R5(config-if)# ip address 172.16.14.1 255.255.255.252

Make sure you can ping both R2 and R5 from R4. Now, let’s configure two loopback interfaces on R4 to represent our “servers” and “clients” subnets:

R4(config-if)# interface loopback 198
R4(config-if)# ip address 198.51.100.1 255.255.255.0
R4(config-if)# interface loopback 203
R4(config-if)# ip address 203.0.113.1 255.255.255.0

Configure the basic BGP session on our peers, R2 and R5. On both of these peers, we’ll send R4 a default route over BGP:

R2(config-subif)# router bgp 65002
R2(config-router)# neighbor 172.16.24.2 remote-as 65100
R2(config-router)# neighbor 172.16.24.2 default-originate
R5(config-if)# router bgp 65005
R5(config-router)# neighbor 172.16.14.2 remote-as 65100
R5(config-router)# neighbor 172.16.14.2 default-originate

On R4, we’ll do the same, with some other stuff added in. First, we need to ensure that we don’t act as a transit AS between our two providers. We’ll prevent this by creating an access list restricting what prefixes we advertise to our neighbors, and apply an outbound distribute-list to those peers. Let’s go ahead and begin advertising our two networks (to both peers, for now) as well:

R4(config-if)# access-list 25 permit 198.51.100.0
R4(config)# access-list 25 permit 203.0.113.0
R4(config)# router bgp 65100
R4(config-router)# neighbor 172.16.24.1 remote-as 65002
R4(config-router)# neighbor 172.16.24.1 distribute-list 25 out
R4(config-router)# neighbor 172.16.14.1 remote-as 65005
R4(config-router)# neighbor 172.16.14.1 distribute-list 25 out
R4(config-router)# network 198.51.100.0 mask 255.255.255.0
R4(config-router)# network 203.0.113.0 mask 255.255.255.0

On R4, we should now see routes for 172.16.24.1/30 and 172.16.14.1/30 (as well as our locally originated routes) in our BGP table:

R4(config-router)# do show ip bgp | begin Network
   Network          Next Hop            Metric LocPrf Weight Path
   Network          Next Hop            Metric LocPrf Weight Path
*  0.0.0.0          172.16.14.1              0             0 65005 i
*>                  172.16.24.1              0             0 65002 i
*> 198.51.100.0     0.0.0.0                  0         32768 i
*> 203.0.113.0      0.0.0.0                  0         32768 i

So far, so good.

Let’s make an AS path access list that defines an AS path that came directly from AS 65005

R4(config-router)# ip as-path access-list 1 permit ^65005$

Now, we need to create two more access lists. One will match the default route we receive from R5, the other will match the route we want to conditionally advertise to R2 (198.51.100.0/24).

R4(config)# access-list 5 permit 0.0.0.0 255.255.255.255
R4(config)# access-list 2 permit 198.51.100.0 0.0.0.255

Next up, we need to create two route maps (an “advertise-map” and a “non-exist-map”) and apply that config to our neighbor R2.

R4(config)# route-map ADVERTISE permit 10
R4(config-route-map)# match ip address 2
R4(config-route-map)# route-map NON-EXIST permit 10
R4(config-route-map)# match ip address 5
R4(config-route-map)# match as-path 1

Let’s go ahead and apply this to our neighbor R2 and clear the BGP process, then I’ll explain how it works.

R4(config-route-map)# router bgp 65100
R4(config-router)# neighbor 172.16.24.1 advertise-map ADVERTISE non-exist-map NON-EXIST
R4(config-router)# do clear ip bgp *

What we’ve done is told our BGP process that for our neighbor 172.16.24.1 (R2), advertise the routes described by the ADVERTISE route-map (thus, routes matching ACL 2) when the routes described by the NON-EXIST route-map (thus, routes matching ACL 5 with an AS Path as described by ACL 1). It seems like a lot to digest all at once, but if you break it down into its various parts, it becomes quite clear.

Let’s take a look at our BGP tables. On R4, we should see exactly what we saw earlier: the default routes from R2 and R5 and our two locally originated routes:

R4(config-router)# do show ip bgp | begin Network
   Network          Next Hop            Metric LocPrf Weight Path
*  0.0.0.0          172.16.14.1              0             0 65005 i
*>                  172.16.24.1              0             0 65002 i
*> 198.51.100.0     0.0.0.0                  0         32768 i
*> 203.0.113.0      0.0.0.0                  0         32768 i

On R5, we should see routes to both of our networks 198.51.100.0/24 and 203.0.113.0/24:

R5(config-router)# do show ip bgp | begin Network
   Network          Next Hop            Metric LocPrf Weight Path
*> 198.51.100.0     172.16.14.2              0             0 65100 i
*> 203.0.113.0      172.16.14.2              0             0 65100 i

Last, on R2, we should only see a route to 203.0.113.0/24, since the R4-R5 link is up:

R2(config-router)# do show ip bgp | begin Network
   Network          Next Hop            Metric LocPrf Weight Path
*> 203.0.113.0      172.16.24.2              0             0 65100 i

Still, so far so good. Now, we test!

Let’s go to R5 and shut down the serial 0/1 interface that’s connected to R4. This will cause the BGP session to drop, which R4 will notice and, after a moment, begin advertising the 198.51.100.0/24 network to R2.

R5(config-router)# interface serial 0/1
R5(config-if)# shutdown

Wait a moment, then look at R2’s BGP table again:

R2(config-router)# do show ip bgp | begin Network
   Network          Next Hop            Metric LocPrf Weight Path
   Network          Next Hop            Metric LocPrf Weight Path
*> 198.51.100.0     172.16.24.2              0             0 65100 i
*> 203.0.113.0      172.16.24.2              0             0 65100 i

There’s the route to 198.51.100.0/24 from AS 65100, exactly what we wanted! Now, what happens when the connection between R4 and R5 comes back up?

R5(config-if)# no shutdown

The BGP session between R4 and R5 will come back up, R4 will receive the default route from R5, the BGP process will notice, and the route for 198.51.100.0/24 that is being advertised to R2 will be withdrawn:

R2(config-router)# do show ip bgp | begin Network
   Network          Next Hop            Metric LocPrf Weight Path
*> 203.0.113.0      172.16.24.2              0             0 65100 i

Success!

{ 4 comments… read them below or add one }

Leave a Comment

Previous post:

Next post: