JN0-649 BGP

BGP Detailed Explanation

1. BGP Overview

1.1 Protocol Type

BGP is a path vector protocol that is primarily used for inter-domain routing. Unlike OSPF or IS-IS, which are used within a single autonomous system (AS), BGP is designed to exchange routing information between multiple ASes.

1. Key Characteristics:

   • Operates over TCP (port 179).
   • Provides scalability for the internet, handling hundreds of thousands of routes.

2. Purpose:

   • BGP connects different networks and enables efficient routing across the internet.
   • Used to advertise prefixes (IP address ranges) and enforce routing policies.

1.2 Key Concepts

1.2.1 eBGP vs. iBGP

BGP operates in two modes depending on whether it is used between or within ASes:

1. eBGP (External BGP):

   • Connects routers in different ASes.
   • Commonly used between organizations or ISPs.
   • Default TTL (Time-to-Live) for eBGP is 1 hop.

2. iBGP (Internal BGP):

   • Connects routers within the same AS.
   • Used to share routes internally.
   • Requires full-mesh connectivity unless route reflectors or confederations are implemented.

1.2.2 BGP Attributes

BGP uses attributes to determine the best path. These attributes are divided into categories:

1. Well-Known Mandatory:

   • AS_PATH: Records the ASes that a route has traversed.
   • NEXT_HOP: Indicates the next-hop IP address for the route.
   • ORIGIN: Specifies the source of the route (IGP, EGP, or incomplete).

2. Optional Transitive:

   • Community: Tags for route grouping and policy application.
   • Aggregator: Indicates the AS that combined multiple routes.

1.2.3 Routing Policies

BGP is highly policy-driven, meaning you can control which routes are advertised or accepted. Policies can:

• Modify attributes like AS_PATH or Local Preference.
• Filter prefixes based on criteria (e.g., IP ranges, AS numbers).

2. Scaling with BGP

As BGP networks grow, managing iBGP peering can become complex. Two mechanisms help address this:

2.1 Route Reflectors

• Problem: iBGP requires a full-mesh topology, which is difficult to scale.
• Solution: Route reflectors reduce the need for full-mesh peering by acting as a hub for routes.
• Operation:
  • Route reflectors have clients and non-clients.
  • Routes learned from clients are reflected to other clients and non-clients.

2.2 Confederations

• Problem: Scaling iBGP in very large ASes.
• Solution: Divide the AS into smaller sub-ASes, called confederations.
• Operation:
  • Sub-ASes use iBGP internally and appear as a single AS to the outside world.
  • Simplifies configuration and reduces the size of the iBGP mesh.

3. BGP Path Selection

When a router receives multiple routes to the same destination, BGP uses a decision-making process to choose the best path. The steps are evaluated in this order:

3.1 Decision Process

1. Local Preference:

   • Highest value is preferred.
   • Local Preference is shared within the AS.

2. AS_PATH:

   • Shorter AS_PATH is preferred (fewer ASes).

3. Multi-Exit Discriminator (MED):

   • Lowest MED is preferred.
   • Used to influence routing between ASes.

4. eBGP vs. iBGP:

   • Routes learned via eBGP are preferred over iBGP.

5. Router ID:

   • Lowest router ID is preferred if all other factors are equal.

3.2 BGP Communities

Communities allow tagging and grouping of routes. They are used in routing policies to apply consistent actions.

1. Predefined Communities:

   • NO_EXPORT: Prevents routes from being advertised outside the local AS.
   • NO_ADVERTISE: Prevents routes from being advertised entirely.

2. Custom Communities:

   • Administrators can define custom tags to manage traffic or policies.

4. Configurations

4.1 Basic eBGP Configuration

eBGP peering is configured to establish a connection between routers in different ASes. Example:

set protocols bgp group ebgp-peer type external
set protocols bgp group ebgp-peer peer-as 65002
set protocols bgp group ebgp-peer neighbor 192.0.2.1

4.2 Route Reflector Setup

To configure a router as a route reflector:

set protocols bgp group internal type internal
set protocols bgp group internal cluster 192.0.2.100
set protocols bgp group internal neighbor 192.0.2.2

5. Advanced BGP Configurations

5.1 Advanced Policies

Policies play a significant role in controlling BGP behavior. Below are some common advanced configurations:

5.1.1 Filtering Prefixes

Control which prefixes are advertised or accepted using filters.

• Example: Filter incoming prefixes from a specific AS:

  set policy-options policy-statement block-as term 1 from as-path AS-65002
  set policy-options policy-statement block-as term 1 then reject
  set protocols bgp group ebgp-peer import block-as
  

5.1.2 AS-Path Prepending

Add your own AS multiple times to make a route less preferred.

• Example: Prepend AS path for outbound routes:

  set policy-options policy-statement prepend-as term 1 then as-path-prepend "65001 65001"
  set protocols bgp group ebgp-peer export prepend-as
  

5.1.3 Adjusting Local Preference

Set a higher Local Preference to make a route preferred within the AS.

• Example: Assign Local Preference of 200 to certain routes:

  set policy-options policy-statement set-local-pref term 1 from route-filter 192.0.2.0/24 exact
  set policy-options policy-statement set-local-pref term 1 then local-preference 200
  set protocols bgp group internal import set-local-pref
  

5.2 Route Aggregation

Combine multiple prefixes into a single route to reduce the size of routing tables.

• Example: Aggregate multiple prefixes:

  set routing-options aggregate route 203.0.113.0/24
  set routing-options aggregate route 203.0.113.0/24 policy aggregate-policy
  set policy-options policy-statement aggregate-policy term 1 then accept
  

6. Troubleshooting BGP Connections

When issues arise with BGP, the following steps and commands can help identify and resolve problems.

6.1 Common Issues

6.1.1 BGP Session Not Established

1. TCP Port 179 Blocked:

   • Ensure that port 179 is open between peers.

2. Neighbor Configuration Mismatch:

   • AS number, IP address, or authentication key mismatch can prevent peering.

   Command to check:

   show bgp neighbor
   

6.1.2 Routes Not Received

1. Filters in Place:

   • Check for import/export policies rejecting the route.

2. Prefix Not Advertised:

   • Ensure the route is in the BGP table and matches the export policy.

   Commands to verify:

   show route advertising-protocol bgp <neighbor-ip>
   show route receive-protocol bgp <neighbor-ip>
   

6.1.3 AS-Path Loops

• Occurs when a route loops back into its originating AS.
• Use as-path filters to reject such routes.

6.2 Debugging Tools

1. BGP Summary:

   • Displays the status of all BGP sessions.

   show bgp summary
   

2. BGP Table:

   • Verify routes in the BGP routing table.

   show route protocol bgp
   

3. BGP Logs:

   • Check for errors in the logs.

   show log messages
   

7. Real-World BGP Use Cases

7.1 Multi-Homed Connections

Organizations often connect to multiple ISPs for redundancy and load balancing.

• Example: Configure BGP for two ISPs:

  set protocols bgp group isp1 type external
  set protocols bgp group isp1 peer-as 65002
  set protocols bgp group isp1 neighbor 192.0.2.1
  
  set protocols bgp group isp2 type external
  set protocols bgp group isp2 peer-as 65003
  set protocols bgp group isp2 neighbor 198.51.100.1
  

7.2 Traffic Engineering

Control how traffic enters or leaves your network by manipulating attributes like Local Preference, AS_PATH, and MED.

• Example: Prefer one ISP for inbound traffic:

  set policy-options policy-statement prefer-inbound term 1 from route-filter 192.0.2.0/24 exact
  set policy-options policy-statement prefer-inbound term 1 then med 50
  set protocols bgp group isp1 export prefer-inbound
  

7.3 BGP as a DDoS Mitigation Tool

Advertise null routes or blackhole routes to block malicious traffic.

• Example: Configure blackhole routing:

  set routing-options static route 203.0.113.0/24 discard
  set policy-options policy-statement blackhole term 1 from route-filter 203.0.113.0/24 exact
  set policy-options policy-statement blackhole term 1 then community add blackhole
  set policy-options policy-statement blackhole term 1 then accept
  

BGP (Additional Content)

1. BGP Administrative Distance

Administrative Distance (AD) is a critical concept when a router receives multiple routes to the same destination from different routing protocols. It helps determine which route to install in the routing table based on trustworthiness.

Default Administrative Distance Values

• eBGP (External BGP):

  • Cisco default: 20

  • Juniper default: 170 for eBGP-learned routes

• iBGP (Internal BGP): 200

• OSPF: 110

• Connected interface: 0

• Static route: 5

Why It Matters

• A route learned via OSPF will override an iBGP route to the same prefix unless preference is explicitly changed.

• In Junos, routing protocols have preference values, not AD. However, the concept is similar:

  • BGP (eBGP) preference: 170

  • BGP (iBGP) preference: 170

  • OSPF preference: 10 (internal), 150 (external)

Key Exam Insight

You might be asked to choose which route is preferred between BGP and OSPF. Remember that in Juniper devices, the lower preference wins.

2. BGP Loop Prevention Mechanism

Loop prevention is fundamental in BGP's design and differs between eBGP and iBGP.

eBGP Loop Prevention

• eBGP uses the AS_PATH attribute to detect routing loops.

• If a BGP speaker sees its own AS number in the AS_PATH of a received update, it rejects the route.

iBGP Loop Prevention

• iBGP does not modify the AS_PATH, so AS loop detection doesn’t apply.

• To prevent loops, iBGP does not advertise routes learned from one iBGP peer to another iBGP peer.

• This rule creates a challenge in large networks, which is resolved using either:

  • Full-mesh iBGP: All routers peer with each other

  • Route Reflectors (RRs): Allow hierarchical distribution of iBGP routes

Key Exam Question Pattern

• “Why is full-mesh iBGP required?”

  • Answer: Because iBGP does not forward iBGP-learned routes to other iBGP peers, unless using a route reflector.

3. BGP Multipath (Add-Path) Capability

Purpose

Normally, BGP installs only one best path per prefix into the routing table. However, in real-world scenarios (e.g., for load balancing), multiple paths might be desirable.

Multipath Support in Junos

• Junos allows multiple equal-cost BGP paths to be installed and used for ECMP (Equal-Cost Multi-Path) routing.

• This is enabled with the multipath configuration under the BGP group:

set protocols bgp group ebgp-peer multipath

• Junos also supports BGP Add-Path, which allows advertising multiple paths for the same prefix to peers. This is not enabled by default and is considered an advanced feature.

Use Case

• Multipath improves traffic distribution and resilience.

• Add-Path solves BGP route oscillation and blackholing issues in multi-homed environments.

4. BGP for IPv6 Routing

As networks increasingly support IPv6, BGP must be configured to carry IPv6 routes using the appropriate address family.

Junos Configuration for IPv6

To enable BGP IPv6 unicast routing:

set protocols bgp group ebgp-v6 family inet6 unicast

• inet6 denotes IPv6

• unicast specifies the routing context (vs. multicast, for example)

Notes

• Ensure that BGP peering is established over IPv6 addresses.

• iBGP and eBGP over IPv6 are configured similarly to IPv4, but require address family declarations.

Summary of Key Points

• BGP Administrative Preference:

  • In Junos, BGP (both iBGP and eBGP) has default preference of 170; OSPF internal is 10.

• Loop Prevention:

  • eBGP uses AS_PATH; iBGP uses the “no iBGP-to-iBGP advertisement” rule.

• Multipath Support:

  • Junos allows installing and forwarding over multiple BGP paths using multipath.

• IPv6 Support:

  • Must explicitly define IPv6 family with family inet6 unicast.