# Multihomed Enterprise Challenge

**Topology**: bgp-mh-iol

<figure><img src="https://3072390383-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FkUz2C3GqnZcWhoVL6jfk%2Fuploads%2FmSF9xfDMs9djHM3EtxcD%2Fimage.png?alt=media&#x26;token=d44f3a3e-f506-4864-82ab-6b06c17fdc96" alt=""><figcaption></figcaption></figure>

```
configure replace unix:init.cfg
```



* All links are in the format 100.X.Y.X/24.
  * For example, the link between R4 and R7 is 100.4.7.0/24.
* Lo0 is X.X.X.X/32 and is used for iBGP
* Lo1 is \<AS>.0.0.X/32 and is used as a public IP address that is pingable. The public Lo1 addresses are aggregated into a /8 at each edge router.
* eBGP and iBGP is fully preconfigured, but no policies are configured.



Goals:

* Configure AS50 as a stub AS - it should not provide transit
* Configure AS20 and AS30 to only advertise a default plus partial routes to AS50
  * AS20 must advertise prefixes of directly connected customers, which is AS40
* AS50 has two uplinks to AS20, and the R7-R4 link is better. Configure outbound traffic flow so that traffic always prefers this link as opposed to the R8-R5 link. But additionally, traffic destined for AS30 should prefer the R9-R6 link.
* Influence inbound traffic flow into AS50 so that it arrives via the R7-R4 link for all traffic except for traffic originated in AS30. This traffic should arrive over the direct link. AS30 provides the following communities that AS50 can use to influence LP, in route-map **CUSTOMER\_IN**.
  * 30:80 (set LP=80)
  * 30:120 (set LP=120)



This is a complicated lab which may take a while to solve. I’d encourage you to take your time with this one, as there is a lot of policy going on here.















































## Answer <a href="#e6e159e2-0a0b-4fb1-beeb-067b5f103ff7" id="e6e159e2-0a0b-4fb1-beeb-067b5f103ff7"></a>

```
#R2
route-map CUSTOMER_IN
 set community 20:1000
!
router bgp 20
 template peer-policy IBGP
  send-community
 exit-peer-policy
 neighbor 100.2.10.10 route-map CUSTOMER_IN in

#R4
ip community-list 1 permit 20:1000
ip as-path access-list 1 permit ^$
!
route-map CUSTOMER_OUT
 match as-path 1
route-map CUSTOMER_OUT permit 20
 match community 1
!
router bgp 20
 neighbor 100.4.7.7 route-map CUSTOMER_OUT out
 neighbor 100.4.7.7 default-originate

#R5
ip community-list 1 permit 20:1000
ip as-path access-list 1 permit ^$
!
route-map CUSTOMER_OUT
 match as-path 1
route-map CUSTOMER_OUT permit 20
 match community 1
!
router bgp 20
 neighbor 100.5.8.8 route-map CUSTOMER_OUT out
 neighbor 100.5.8.8 default-originate

#R6
ip as-path access-list 1 permit ^$
!
route-map CUSTOMER_OUT
 match as-path 1
!
router bgp 30
 neighbor 100.6.9.9 route-map CUSTOMER_OUT out
 neighbor 100.6.9.9 route-map CUSTOMER_IN in
 neighbor 100.6.9.9 default-originate

#R7
ip as-path access-list 1 permit ^$
!
route-map R4_OUT
 match as-path 1
!
route-map R4_IN
 set local-pref 120
!
router bgp 50
 add ipv4
  neighbor 100.4.7.4 route-map R4_IN in
  neighbor 100.4.7.4 route-map R4_OUT out

#R8
ip as-path access-list 1 permit ^$
!
route-map R5_OUT
 match as-path 1
 set as-path prepend 50 50
!
router bgp 50
 add ipv4
  neighbor 100.5.8.5 route-map R5_OUT out

#R9
ip as-path access-list 1 permit ^$
!
route-map R6_OUT
 match as-path 1
 set community 30:120
 set as-path prepend 50 50
!
router bgp 50
 add ipv4
  neighbor 100.6.9.6 route-map R6_OUT out
  neighbor 100.6.9.6 send-community
```



## Explanation <a href="#ab0edaf8-ecb7-4650-b769-4a58ca3518bc" id="ab0edaf8-ecb7-4650-b769-4a58ca3518bc"></a>

This challenge requires quite a bit of configuration. Here is how the general requirements are solved:

* Configure AS50 as a stub AS - it should not provide transit
  * AS50 only advertises AS paths that match ^$
* Configure AS20 and AS30 to only advertise a default plus partial routes to AS50
  * R2 sets inbound routes from AS40 with a community. R4 and R5 match this community, plus advertise locally-generated routes (AS path ^$).
* AS50 has two uplinks to AS20, and the R7-R4 link is better. Configure outbound traffic flow so that traffic always prefers this link as opposed to the R8-R5 link. But additionally, traffic destined for AS30 should prefer the R9-R6 link.
  * Naturally, because AS30 is advertising only its local prefixes, AS50 will prefer these routes due to longest-match routing. To configure other outbound traffic to always prefer the R7-R4 link, we set LP higher on routes received from R4.
* Influence inbound traffic flow into AS50 so that it arrives via the R7-R4 link for all traffic except for traffic originated in AS30. This traffic should arrive over the direct link.
  * Advertisements from R8 are AS path prepended. This is necessary so that R20 always prefers the R4-R7 link.
    * An alternative could be to set MED higher on routes advertised from R8
  * Advertisements from R9 are also AS path prepended. But we want AS30 to locally use R9 instead of taking a long path through AS20. To do this, we set the community 30:120 so that AS30 will set the prefixes to have a higher LP. But when AS30 advertises this to AS10, the path is prepended so that AS10 will still prefer the path via AS20.
    * A common mistake is to make the LP=80 in AS30. However, if you do this, AS30 will always prefer to route via AS10 instead of via the local eBGP peering. So instead we use AS path prepending to influence inbound routing and let LP just influence AS30’s local decision.



## Verification <a href="#id-4efcada7-1c23-4273-ae6a-d5fc2bdea505" id="id-4efcada7-1c23-4273-ae6a-d5fc2bdea505"></a>

First we’ll verify that AS50 is not a transit AS. On routers R7, R8 and R9, they should only advertise the local 50/8 prefix to their eBGP peers.

<div align="left"><figure><img src="https://3072390383-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FkUz2C3GqnZcWhoVL6jfk%2Fuploads%2FVa4sSHORRxlrx0UFcbDi%2Fimage.png?alt=media&#x26;token=3205ea65-4158-4462-b560-200b6b2d9e23" alt=""><figcaption></figcaption></figure></div>

<div align="left"><figure><img src="https://3072390383-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FkUz2C3GqnZcWhoVL6jfk%2Fuploads%2FsvqYnq3v5RUot7709Dnj%2Fimage.png?alt=media&#x26;token=2facca89-2353-4878-9b57-c05408a40332" alt=""><figcaption></figcaption></figure></div>

<div align="left"><figure><img src="https://3072390383-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FkUz2C3GqnZcWhoVL6jfk%2Fuploads%2FJtZng1rPPG80U6AxBkzo%2Fimage.png?alt=media&#x26;token=2c4efc35-a1bc-49f2-9b36-4fc786369521" alt=""><figcaption></figcaption></figure></div>



\
Next we’ll verify that AS20 and AS30 only advertise their directly connected prefixes, customer prefixes, and a default towards AS50. We can verify this on the AS50 routers. Notice that 10/8 is not learned, because this is not a customer or local prefix for AS20 and AS30. AS50 will follow the default to reach 10/8.

<div align="left"><figure><img src="https://3072390383-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FkUz2C3GqnZcWhoVL6jfk%2Fuploads%2FKr0IwfaK91cVj7oQTV0b%2Fimage.png?alt=media&#x26;token=058d0be2-50fa-4cf8-a429-ece74b03c4bb" alt=""><figcaption></figcaption></figure></div>

<div align="left"><figure><img src="https://3072390383-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FkUz2C3GqnZcWhoVL6jfk%2Fuploads%2F0gumyV41NeHIroNakmyM%2Fimage.png?alt=media&#x26;token=7c86b741-b381-4c44-81c5-3f9a4b1cf7ea" alt=""><figcaption></figcaption></figure></div>

<div align="left"><figure><img src="https://3072390383-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FkUz2C3GqnZcWhoVL6jfk%2Fuploads%2FcHLQBmDML7jMGRAWiq8d%2Fimage.png?alt=media&#x26;token=5bd21f4d-797c-4108-95c5-36fded96aa98" alt=""><figcaption></figcaption></figure></div>



The above output also helps us verify that outbound traffic in AS50 is configured correctly. Notice that the bestpaths are all paths on R7, and only 30/8 on R9. 30/8 is the local prefix for AS30, and we want only traffic destined for AS30 or AS30’s customers to be reached through R9. All other outbound traffic should egress R7. Verify on R8 and R9 that all best paths point towards R9 except for 30/8.

<div align="left"><figure><img src="https://3072390383-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FkUz2C3GqnZcWhoVL6jfk%2Fuploads%2FnKE6ZtPVmv2gT22mgVFE%2Fimage.png?alt=media&#x26;token=15d7f8ed-fe2c-409f-90c9-05710d70ee0f" alt=""><figcaption></figcaption></figure></div>

<div align="left"><figure><img src="https://3072390383-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FkUz2C3GqnZcWhoVL6jfk%2Fuploads%2FLZz4U6MdDNWemqfPb0vm%2Fimage.png?alt=media&#x26;token=72a7baa1-be16-4373-9262-c22a27f39a29" alt=""><figcaption></figcaption></figure></div>



Finally we examine inbound traffic to AS50. This should all ingress R7, except for any locally originated traffic in AS30. From each AS, we can source a traceroute to test this out.

<div align="left"><figure><img src="https://3072390383-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FkUz2C3GqnZcWhoVL6jfk%2Fuploads%2FrF6dOnaPjmFXApzd3fSB%2Fimage.png?alt=media&#x26;token=8d17265b-fbc4-417b-ad82-29935cd86cf8" alt=""><figcaption></figcaption></figure></div>

<div align="left"><figure><img src="https://3072390383-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FkUz2C3GqnZcWhoVL6jfk%2Fuploads%2F9FxDGkIF22JXcVhd9kg8%2Fimage.png?alt=media&#x26;token=1c46a8ab-c42e-4475-a42a-3462eaf140d0" alt=""><figcaption></figcaption></figure></div>

<div align="left"><figure><img src="https://3072390383-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FkUz2C3GqnZcWhoVL6jfk%2Fuploads%2F9AB5a0sU8sQ522mVv6ie%2Fimage.png?alt=media&#x26;token=b6b19b65-1911-4e5d-880d-ca91acdc0c5a" alt=""><figcaption></figcaption></figure></div>

<div align="left"><figure><img src="https://3072390383-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FkUz2C3GqnZcWhoVL6jfk%2Fuploads%2FJEzzfjUiImvhScoO2kt9%2Fimage.png?alt=media&#x26;token=b8646a8f-e746-41e1-9115-0340cd294778" alt=""><figcaption></figcaption></figure></div>



Our tests pass. All traffic arrives via the R4-R7 link, except for the traceroute generated in AS30 at R3. We can see at R6 that LP is set to 120 for the 50/8 prefix.

<div align="left"><figure><img src="https://3072390383-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FkUz2C3GqnZcWhoVL6jfk%2Fuploads%2FWnWh0yTbFNrrM19pcYwu%2Fimage.png?alt=media&#x26;token=f5b5bcc5-404c-4568-bd72-21d192e6c37e" alt=""><figcaption></figcaption></figure></div>



However, it is also prepended. So when this is advertised upstream to R1, R1 will choose the path with the shorter AS\_PATH length via R2. Note that R1 is however free to choose whatever path it wants based on its own local policies. In the real world, there is not much you can do to prevent this. You could attach a no-export community to R6, but that would defeat the purpose of having redundancy.

<div align="left"><figure><img src="https://3072390383-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FkUz2C3GqnZcWhoVL6jfk%2Fuploads%2FGJH2zTei2XOriUmp1c1P%2Fimage.png?alt=media&#x26;token=32bd6fbc-f5f0-4f16-8c76-a316b2174822" alt=""><figcaption></figcaption></figure></div>
