BGP Notes

In this doc, we do a deep dive into BGP; we go over neighborship workflow, troubleshooting peering down, troubleshooting flapping peer, best path selection, troubleshooting missing routes, multipath, confederation, route-reflector, securing the connection and a more 

• Establish TCP transport
• Uses TCP port 179
• BGP peers must agree
  • AS number
  • Source Address
  • Address Family: IPv4 unicast, L2VPN, EVPN ...
  • Sec: authentication, TTL security ...
• Negotiate address family
• Advertise NLRI
• Apply BGP policy

BGP peering down

• Configuration
  • check AS Number, Network, Neighbor IP, Multi-Hope, TTL-Security
  • BGP authentication, ACLs
• Reachability
  • Check the ICMP ping source
  • verify port 179 is open: Telnet /source-interface

Flapping BGP peer

• Stuck in IDLE
  • no connected route to the peer ( interface down ... )
• Stuck in Active
  • network is not in the routing table
  • connection error
  • update source
• Flapping Active/IDLE
  • TCP established, but BGP negotiation fails (missing configured AS ...)
• Flapping IDLE/Established
  • Bad update, TCP problem (MSS size in multi-hope) (MTU) you can Verify MTU by ping with DFbit

Missing routes Troubleshooting

• Check Well-known communities (No-Export, No-advertise, Local-AS)
• Check Privet communities
• Check the routing table
  • Verify next hop is in the routing table
  • Check BGP table
• Verify that routes are being advertised
• Verify soft-reconfiguration if possible

Best path selection

1. Weight
   • local significant
   • highest wins
2. Local Preference
   • within the same AS
   • highest wins
3. locally originated
   • Network or Redistribute command preferred over local aggregates (aggregate-address command)
4. AS_PATH
   • Shortest path win
5. ORIGIN
   • IGP < EGP < Incomplete (lowest wins)
   • IGP: network layer reachability information (NLRI) is interior to the AS of origination This normally happens when you issue the bop network command or set it in a route-map
   • EGP: NLRI is learned via exterior gateway protocol (EGP)
   • INCOMPLETE: NLRI is unknot or learned via some other means Usually occurs when you redistribute routes from other routing protocols to BGP
6. MED
   • Metric is a hint to external neighbours about the path preference into an AS
   • A lower metric is preferred
   • Metrics are one-hop only
   • SP and enterprises can agree on a uniform policy on how to set the MED
   • Smallest wins

• Community
  • it is like a tag, but we have some well-known community
  • your community can be additive like an as-path; you can also remove all others and replace
  • well-known community
    • NO-EXPORT: do not advertise to EBGP peers (keep within AS )
    • NO-ADVERTISE: do not advertise to any peer, internal or external
    • INTERNET: advertise this route to the internet community any route belonging to this community
    • local-as: use in confederation scenarios to prevent the transmission of packets outside the local-as

BGP multipath

• IBGP multipath: route reflector reflects only a single best path even with multiple IBGP best paths installed in the routing table, route reflector reflects only a single best path.
• EBGP multipath: multipath feature works only when you have multiple homed connections to a single AS - if a prefix is learnt via a different provider AS's, then the multipath functionality doesn't work, but we can use it in such scenarios using the command
• EIbgp multipath
  • The existing BGP path selection algorithm prefers eBGP paths over iBGP paths; this prevents having both the iBGP and the ebgp multipath prefixes from getting installed in the routing table at the same time
  • configuration to modify the algorithm to allow load-sharing among both iBGP and EBGP paths - Usually configured for MPLS VPN deployments, this is configured on a per-VRF instance and not for VPNV4 address-family
  • PS: verify the routing. You can easily cause a ROUTING LOOP

Preventing BGP DDOS attacks