Multihomed Enterprise Challenge
Last updated
Last updated
Topology: bgp-mh-iol
All links are in the format 100.X.Y.X/24.
For example, the link between R4 and R7 is 100.4.7.0/24.
Lo0 is X.X.X.X/32 and is used for iBGP
Lo1 is <AS>.0.0.X/32 and is used as a public IP address that is pingable. The public Lo1 addresses are aggregated into a /8 at each edge router.
eBGP and iBGP is fully preconfigured, but no policies are configured.
Goals:
Configure AS50 as a stub AS - it should not provide transit
Configure AS20 and AS30 to only advertise a default plus partial routes to AS50
AS20 must advertise prefixes of directly connected customers, which is AS40
AS50 has two uplinks to AS20, and the R7-R4 link is better. Configure outbound traffic flow so that traffic always prefers this link as opposed to the R8-R5 link. But additionally, traffic destined for AS30 should prefer the R9-R6 link.
Influence inbound traffic flow into AS50 so that it arrives via the R7-R4 link for all traffic except for traffic originated in AS30. This traffic should arrive over the direct link. AS30 provides the following communities that AS50 can use to influence LP, in route-map CUSTOMER_IN.
30:80 (set LP=80)
30:120 (set LP=120)
This is a complicated lab which may take a while to solve. I’d encourage you to take your time with this one, as there is a lot of policy going on here.
This challenge requires quite a bit of configuration. Here is how the general requirements are solved:
Configure AS50 as a stub AS - it should not provide transit
AS50 only advertises AS paths that match ^$
Configure AS20 and AS30 to only advertise a default plus partial routes to AS50
R2 sets inbound routes from AS40 with a community. R4 and R5 match this community, plus advertise locally-generated routes (AS path ^$).
AS50 has two uplinks to AS20, and the R7-R4 link is better. Configure outbound traffic flow so that traffic always prefers this link as opposed to the R8-R5 link. But additionally, traffic destined for AS30 should prefer the R9-R6 link.
Naturally, because AS30 is advertising only its local prefixes, AS50 will prefer these routes due to longest-match routing. To configure other outbound traffic to always prefer the R7-R4 link, we set LP higher on routes received from R4.
Influence inbound traffic flow into AS50 so that it arrives via the R7-R4 link for all traffic except for traffic originated in AS30. This traffic should arrive over the direct link.
Advertisements from R8 are AS path prepended. This is necessary so that R20 always prefers the R4-R7 link.
An alternative could be to set MED higher on routes advertised from R8
Advertisements from R9 are also AS path prepended. But we want AS30 to locally use R9 instead of taking a long path through AS20. To do this, we set the community 30:120 so that AS30 will set the prefixes to have a higher LP. But when AS30 advertises this to AS10, the path is prepended so that AS10 will still prefer the path via AS20.
A common mistake is to make the LP=80 in AS30. However, if you do this, AS30 will always prefer to route via AS10 instead of via the local eBGP peering. So instead we use AS path prepending to influence inbound routing and let LP just influence AS30’s local decision.
First we’ll verify that AS50 is not a transit AS. On routers R7, R8 and R9, they should only advertise the local 50/8 prefix to their eBGP peers.
Next we’ll verify that AS20 and AS30 only advertise their directly connected prefixes, customer prefixes, and a default towards AS50. We can verify this on the AS50 routers. Notice that 10/8 is not learned, because this is not a customer or local prefix for AS20 and AS30. AS50 will follow the default to reach 10/8.
The above output also helps us verify that outbound traffic in AS50 is configured correctly. Notice that the bestpaths are all paths on R7, and only 30/8 on R9. 30/8 is the local prefix for AS30, and we want only traffic destined for AS30 or AS30’s customers to be reached through R9. All other outbound traffic should egress R7. Verify on R8 and R9 that all best paths point towards R9 except for 30/8.
Finally we examine inbound traffic to AS50. This should all ingress R7, except for any locally originated traffic in AS30. From each AS, we can source a traceroute to test this out.
Our tests pass. All traffic arrives via the R4-R7 link, except for the traceroute generated in AS30 at R3. We can see at R6 that LP is set to 120 for the 50/8 prefix.
However, it is also prepended. So when this is advertised upstream to R1, R1 will choose the path with the shorter AS_PATH length via R2. Note that R1 is however free to choose whatever path it wants based on its own local policies. In the real world, there is not much you can do to prevent this. You could attach a no-export community to R6, but that would defeat the purpose of having redundancy.
