BGP multihoming AS PAth Flitering and return traffic

[hmc2500]

Hi we have a multihome BGP scenario with the following config:

Local router:
interface to Primary ISP A 1.1.1.2 mask 255.255.255.248
interface to Backup ISP B 2.2.2.2 mask 255.255.255.252

ISP A 1.1.1.1 mask 255.255.255.248
ISP B 2.2.2.1 mask 255.255.255.252

BGP Config local router:
router bgp 2222
network 1.1.1.0 mask 255.255.255.248
network 3.3.3.0 mask 255.255.255.0
network 2.2.2.0 mask 255.255.255.252
neighbor 1.1.1.1 remote-as 1111
neighbor 1.1.1.1 ebgp-multihop 2
neighbor 1.1.1.1 weight 100
neighbor 2.2.2.1 remote-as 4444
neighbor 2.2.2.1 route-map prepend out

ip prefix-list MATCHALL seq 10 permit 0.0.0.0/0 le 32
!
route-map prepend permit 10
match ip address prefix-list MATCHALL
set as-path prepend 2222 2222
!
route-map prepend permit 20

My questions:

- Do ISP's filter advertised networks that are smaller then /24? Is there a risk becoming a transit AS?

- Should the above config  be enough to allow outgoing (Weight 100) and returning traffic (AS prepend) to come in through ISP A? If not what can be done to have all traffic pass through ISP A only (ISP B should be backup)? 

[Francesco Molino]

Hi

You don't want isp using your router to reach some subnets.
ISPs won't advertise subnets smaller than/24.

Using weight as attribute to make link path selection is one of them and it'll work.
If you prepend advertisement from isp 2, all traffic will always go out and in the same isp.

[Georg Pauwen]

Hello,

if you don't want your AS to become a transit AS, ypu can use an as-path filter or the no-export community:

ip as-path access-list 1 permit ^$

!

neighbor 1.1.1.1 filter-list 1 out
neighbor 2.2.2.1 filter-list 1 out

route-map NO-EXPORT
set community no-export

!

neighbor 1.1.1.1 route-map NO-EXPORT in
neighbor 2.2.2.1 route-map NO-EXPORT in

Also, you don't need the as-path prepending to make the link to neighbor 1.1.1.1 the preferred one. The weight attribute is sufficient...

[a.alekseev · Accepted solution]

>The weight attribute is sufficient...

is't not correct

weight or local reference we use for outgoing traffic

as-prepend for incoming

But you cannot grantie what all incoming traffic will only go through R1 or R2.

You can only increase probability of that.

[Georg Pauwen]

You are very right...I missed the inbound part...:(

Thinking about it again, since you are paying for your second ISP link, why leave it idle and for backup only ? Unless that is a hard requirement, why not implement load balancing ?

[hmc2500]

Thanks all. Is there a way to verify if your AS has become a transit AS? 

[Francesco Molino]

You can run the command show ip bgp neighbo x.x.x.x advertised-routes for a particular neighbor.
If you have already done a filter, you can run a debug bgp to see what’s going on also with routes advertised.
If you have done a filter and you do sh ip bgp neig x.x.x.x adverti you won’t see the prefixes denied by your route-map out.

[hmc2500]

Thanks but i meant how can you verify live traffic that's transiting through your AS. I've been told in some cases the ISP does block AS advertisements that are not coming locally from the customers router. I think the command you recommend only tells you what is advertised out but I doubt if it will tell you if your ISP blocks it or not. 

[Francesco Molino]

Yes the command tell you what you're advertising. If you don't advertise learned prefixes then you're not a transit as. If you advertise then you need to ask your isp or rely on him. You can go on route views and connect to a router to make a traceroute and see if traffic is coming through your router or check with sh ip bgp x.x.x.x
http://www.routeviews.org/routeviews/index.php/collectors/

[hmc2500]

THank you. Not sure how to give you credit for this since this is not directly related to my original questions but your responses are very helpful. 

Does it matter how many times you prepand in as path prepending? If you prepend your AS more times (let's say 5x times) would that inrease the probability of returing through the primary ISP more? And is there a limit as to how many times you could prepend? 

Thanks again.

[Francesco Molino]

More you prepend your AS, worst the path will be.

To answer again your question, you have to use out preference to choose which link the traffic should take and you can use for this weight, local-pref... And you need to ensure that remote peers take the right path and for this you can play with as-prepend.

If you manage both ends (or if it's mpls, your isp has some community to be used for path preference), you advertise some subnets on link1 with a community (let's called out priority community), and some on link 2 with same priority community. Here you'll advertise link 1 subnets on link 2 with secondary community (a new community) and link 2 subnets on link 1 with same secondary community. On the other end, you'll play with local-pref and route-map checking communities to stevy the right path. But this is possible if you can manage yourself all peers or with your isp help. For internet it'll not work.
For internet, when you advertise your public subnet and make sure the traffic will come from the same link, you need to play with as-prepend.

If this is for internet, the other question will be why you want to get the return traffic from the same path? Is it because of a firewall?? Or share your design please to take a closer look.