Bgp Confusion

[Huntingbugs]

Hello all,

I will start this off by saying I am a bit confused about a certain aspect of the whole bgp thing

say I am wanting to advertise a network into bgp  and I have all the pertinent data set up

like IP address is in the routing table and say I even had a static route to the prefix up

as I have learned bgp can only advertise a network that is in the RIB Table?

if these conditions are met for the selected prefix

say 1.1.1.0/24 as this belongs to cloudflare I think but just for instance you see this in a lot of examples

assuming all routing tables reflect a valid route to the said prefix

can You go into the bgp router like this

router bgp ASNnumber

 than issue a network command using the prefix and a subnet mask from the console or from say a script

or would one need to set a full ebgp multi hop relationship with another router

my biggest confusion is whether the actual router can be used to advertise a network into bgp without an ebgp peer if you are able to issue commands to said router just a odd question that I've been wondering about.

[Peter Paluch]

Hello,

as I have learned bgp can only advertise a network that is in the RIB Table?

That is correct. More precisely: BGP can only advertise a route that your router already knows about. That route needs to be in the router's routing table (RIB), and from there, BGP can pick it up and advertise it further.

or would one need to set a full ebgp multi hop relationship with another router

I am not certain what you mean here. You see - you can start a BGP process on your router and enter network or redistribute commands to have the BGP process populate its local database with networks that are present in your own routing table. However, as oppposed to RIP, EIGRP, OSPF, or IS-IS, BGP does not establish adjacencies between routers until and unless you configure BGP to do so using the neighbor command. Without neighbors, BGP will run locally, and read in the specified networks from the routing table, but it will have nobody to advertise these networks to, nor will it have anyone to learn more networks from. So, a BGP configuration without neighbor commands is mostly useless (the only use case I can think of right now is a controlled route leaking between different VRFs but this is beyond our discussion here).

my biggest confusion is whether the actual router can be used to advertise a network into bgp without an ebgp peer

It can - but without any neighbors, iBGP or eBGP, the BGP running on your router will not be able to do anything useful with that network.

I am not sure if this answers your questions - please feel welcome to ask further!

Best regards,
Peter

[Huntingbugs]

"I am not certain what you mean here. You see - you can start a BGP process on your router and enter network or redistribute commands to have the BGP process populate its local database with networks that are present in your own routing table. However, as oppposed to RIP, EIGRP, OSPF, or IS-IS, BGP does not establish adjacencies between routers until and unless you configure BGP to do so using the neighbor command. Without neighbors, BGP will run locally, and read in the specified networks from the routing table, but it will have nobody to advertise these networks to, nor will it have anyone to learn more networks from. So, a BGP configuration without neighbor commands is mostly useless (the only use case I can think of right now is a controlled route leaking between different VRFs but this is beyond our discussion here)."

Ok thay makes a ton of sense but I left out the part about the router would already have an established multihop relationship with the neighbors that it sends and receives from on a certain port etc there may even be route maps and filters in place to stop malicious advertisements or ones that are accepted from the upstream provider etc aka bogon filtering possibly

what I really meant is I guess say the main router already has a bgp table and neighbors that are established what I was trying to ask I guess is if I am the admin of the said router can I add a network into the bgp table like we discussed to get it out to the connected peers etc just using the network command and than issuing a soft reset outbound? as also from what i read you do not need to configure a soft reset on incoming messages so it should work in theory?

what I meant about the ebgp multihop is I don't want to have to bring exabgp up and do all that I know how nto really well but I can for sure advertise a prefix via exabgp and set up peering but it would be allot easier if from my admin script I wrote if I  can just  send this data out to the existing ASN's that we advertise to without like i said involving a whole new neighbor just to advertise a simple prefix from the RIB table is what I'm trying to get at

does this make sense if not i'll try to figure out how to word it better

[Peter Paluch]

Hello,

Thank you for the clarification!

if I am the admin of the said router can I add a network into the bgp table like we discussed to get it out to the connected peers etc just using the network command and than issuing a soft reset outbound?

Exactly correct. In fact, you do not need to do anything regarding any soft reset whatsoever. If you simply add an existing network to BGP using the network or redistribute command, it will be advertised to all existing (and new) BGP peers within 1 minute automatically (this is the timing of the internal IOS process that identifies new updates to be sent out). In other words, adding a new network to BGP has nothing to do with adding a new BGP peering, internal or external. Having peers is one thing, adding a network to be advertised in BGP is another thing. Once you have your peerings established and are fine with who they are, then you just add networks to BGP as you see fit, and they will get advertised to those peers spontaneously.

from what i read you do not need to configure a soft reset on incoming messages so it should work in theory?

The soft reset, or better said, soft reconfiguration, is an outdated concept in BGP that has been obsoleted more than a decade ago. Initially, BGP did not have any message that would allow one router to ask its peer to send all routes again. The soft reconfiguration was a hack around this limitation by simply having a router keep all unfiltered and unchanged routes received from its peer in a standalone database, and later filter them through any inbound route policies that were in place. Obviously, this feature worked, but needed to be configured on a per-neighbor basis, and consumed lots of memory. Since RFC 2918 (September 2000), there is an official support for a Route Refresh message in BGP that adds exactly what was missing - the capability of one router asking the other one to resend the routes. All major BGP implementations support this out of the box, without any configuration whatsoever. Therefore, there is no need to even bother with any kind of soft reconfiguration; the only reasonable use case that remains is diagnostics: With soft reconfiguration, we can always see the unfiltered set of all routes that the peer sent us. This can prove useful in some troubleshooting scenarios.

As always, please feel welcome to ask further!

Best regards,
Peter

[Huntingbugs]

Thanks,

That made a whole bunch of sense I was always wondering why I needed an EBGP peer just to advertise a route when I am already connected.  the whole point of this is to learn to advertise and to use route maps to selectively advertise networks and filter what is being accepted etc.  BGP is a monster in itself and is very confusing but over the past couple of months I am starting to understand it more.

so onto the next part of what is also confusing me now that we know I have a valid prefix up say I have router A and router B   router A connects to our ISP but router 2 is somewhere else say I want to route traffic to that specified router

I am reading I will need to use as-path prepend as med,local_pref are only accepted locally and aren't passed over EBGP

since we discussed I am trying to add routes to an existing peering relationship.  What is confusing me here is say we prepend our own ASN multiple times that would work because if we prepend our own as 5 times it will effect best path because the normal hops for a desired connection max out around 4 for the rest of the net when it comes to AS-Path?

so say we advertise the prefix out and we don't want to follow the router A address upon return we want to influence the traffic or engineer it inbound to the ASN B or router B

by messing with the long AS-Path it will not be a desired route so we can do that I think

but what is really bothering me is how in the world does the internet know from pulling the ASN out as it travels over BGP it is passed around backwards in relativity to the origin as and will traverse the routers that are in the AS-Path?

2 questions

1.) how does a ASN in the path know how to forward to the next ASN or know which ip it needs to go to

2.)each BGP router that touches it in transit adds its own ASN number to the advertisement to avoid routing loops thus when the AS-path is prepended to most times the bgp daemons would assume naturally that a router in its path was actually traversed to send the traffic?

what I am trying to get at is when we append an AS-Path how  do we engineer the actual destination AS-Path?

and when this bgp router handles this data for said prefix I will just need to handle the connection as a standard routing setup in the ASN we have?

I will stuff one of our offsite routers into the AS-Path even if it doesn't participate in routing will it receive these packets for the selected prefix after  I advertise this?

than I can just do this

ip route 1.1.1.0 255.255.255.0 Null0 -> would send to a blackhole?

ip route 0.0.0.0 0.0.0.0 originating AS

those 2 statements should effectively null route the prefix that would be handled by that  and the second one would route all traffic back to the other router A

but what My real theory behind this is I don't want to effect the best path selection I just want to fudge the AS-Path is this possible to pull off just by doing an AS-Path prepend? there's really no point in messing with the selection algo for the path unless you want to shut router A out if we prepend router A's as to our path even though it didn't touch it that will naturally allow us to keep the original route intact to the rest of the net?

as well allowing us such fine grained control over the advertisement we should have our next router being able to handle this

the reason I am trying to figure this out is I would like to send the traffic to a device we have to filter out malicious traffic at some point and create fail over connections

so I am trying to learn the steps 1 by 1 if I am misunderstanding this stuff feel free to point it out

as of yet I seem to be getting check marks across the board from you which is nice I have researched allot and the boss appreciates the speed I have learned at costing the company nothing

sorry for all the questions it is just very interesting to have someones ear to chew off on these odd questions I come up with in my head as I am always trying to simplify my tasks and reduce the cost of things or just think outside the box.

[Peter Paluch]

Hello,

My apologies for getting back to you with a huge delay... I hope these answers will still be helpful.

I am reading I will need to use as-path prepend as med,local_pref are only accepted locally and aren't passed over EBGP

It is true that local preference is not passed from one AS to another. However, the MED is - however, it is only passed when explicitly set in an outbound route-map applied to an eBGP peer. If you have a route that already has a MED attribute, and you advertise it to another eBGP peer but without a route-map that would again specify an explicit MED value, the MED attribute will be removed and not advertised further. Also, the usability of MED is limited: If you have two or more routes to choose from, their MED values will only be compared if both routes came from the same neighboring AS (in other words, when the first ASN in the AS_PATH is the same). Therefore, the AS_PATH prepending remains one of the most popular approaches to steering the traffic, since AS_PATH is always evaluated, and is globally valid (unless very specific scenarios, we do not strip off the AS_PATH).

What is confusing me here is say we prepend our own ASN multiple times that would work because if we prepend our own as 5 times it will effect best path because the normal hops for a desired connection max out around 4 for the rest of the net when it comes to AS-Path?

The decision to prepend your own ASN 5 times when advertising your routes to the backup eBGP peer is only an arbitrary estimate. Whatever routes you advertise to your eBGP neighbors, they will be advertised further throughout the world, through different autonomous systems and their peerings, and the AS_PATH on these routes will grow as they are advertised to progressively farther and farther autonomous systems. The number of times you prepend your own ASN toward the backup eBGP peer is only a guess - a mere hope that it will be enough for the whole world to still treat the other path as the better one (having fewer elements in the AS_PATH). If prepending your ASN 5 times turns out to be not enough, you can always increase it.

how in the world does the internet know from pulling the ASN out as it travels over BGP it is passed around backwards in relativity to the origin as and will traverse the routers that are in the AS-Path?

Think of it this way:

1. BGP will, in general, look for paths with the shortest AS_PATH attribute
2. Every BGP router knowing the path will also know the NEXT_HOP attribute which points either to the IP address of the eBGP router in the nearest next AS (the first AS in the AS_PATH) down the route to the destination, or to the iBGP router that interfaces directly with that eBGP router (if using next-hop-self).
3. Knowing this IP address of the next hop, the router will route the packets down the path toward that next hop, ultimately putting them on the shortest path down to the destination.

1.) how does a ASN in the path know how to forward to the next ASN or know which ip it needs to go to

The AS_PATH attribute does not truly enforce the path for the packets down the route. The AS_PATH attribute has two uses: Prevent routing loops, and allow BGP to pick the shortest path in terms of ASNs we need to traverse. However, the traffic-steering attribute is the NEXT_HOP. This one is by default set to the IP address of the eBGP peer in the neighboring AS from which we learned about this route. If we know the route to that IP address, we follow the AS_PATH too. If you recursively apply this rule for every AS on the path, you will truly create a path that aligns with the AS_PATH.

2.)each BGP router that touches it in transit adds its own ASN number to the advertisement to avoid routing loops thus when the AS-path is prepended to most times the bgp daemons would assume naturally that a router in its path was actually traversed to send the traffic?

No, not really. The AS_PATH is modified only when a route is advertised over an eBGP peering, from one AS to another. Inside an AS, the AS_PATH is not touched. Also, in BGP, we have special router roles such as route reflectors and route servers that collect routes and distribute them to BGP routers, but which do not really sit in the path of the packet flows. Just because a router advertises a route does not mean that the packets need to flow through it. This typically happens when a router learns a route via BGP and advertises it to its peers, but its peers do not consider it a next hop down the path to the address in the BGP NEXT_HOP attribute.

when we append an AS-Path how  do we engineer the actual destination AS-Path?

Could you try rephrasing this question? I am sorry but I do not understand it.

Perhaps what would help is a sketch of your intended topology, plus point-by-point description of what you are trying to achieve.

Thanks!

Best regards,
Peter

[Huntingbugs]

I get it now thank you for explaining now is there any way to find out right away if the advertisement went out? any online tool for checking our ebgp ASN for the prefix being advertised?

[Peter Paluch]

Hello,

is there any way to find out right away if the advertisement went out?

If you can access the router that advertises a route to its neighbor, you can ask about the advertised routes to that particular neighbor using the show ip bgp neighbor X.X.X.X advertised-routes command.

To check how the public internet sees a route, there are many tools for that - they are called Looking Glass, and if you google for "looking glass bgp", you will get a lot of results since many ISPs out there provide an access to this tool to see the routes from their perspective. Typically, the ISPs provide a web form where you can choose what test you want to execute (a BGP table dump for a network vs. ping vs. traceroute) and where you can enter the address of your interest.

Also, you can telnet into route-views.routeviews.org - use the "rviews" as the username; you will not be prompted for any password. There, you are on a router that has the full internet BGP table, and you can use the show ip bgp network netmask command to check what the BGP on this router knows about the particular network.

Please feel welcome to ask further!

Best regards,
Peter