BGP multipath on nx-os

[artem-sidorenko]

Hi there,

I've following BGP setup:

AS A        PE1  - - - - - - PE2

                 |                        |

                 |                        |

AS B       CE1 ---------- CE2

I run bgp, eBGP between CE1/CE2 and PE1/PE2 and iBGP between CE1/CE2.

sh bgp vrf internet all
BGP routing table information for VRF internet, address family IPv4 Unicast
BGP table version is 10, Local Router ID is CE1
Status: s-suppressed, x-deleted, S-stale, d-dampened, h-history, *-valid, >-best
Path type: i-internal, e-external, c-confed, l-local, a-aggregate, r-redist, I-injected
Origin codes: i - IGP, e - EGP, ? - incomplete, | - multipath, & - backup, 2 - best2

Network      Next Hop Metric LocPrf Weight Path
* i0.0.0.0/0 CE2 100 0 AS A i
*>e          PE1 0 AS A i

I would like to enable multipath, so I can distribute the load to the both lines (PE1/PE2). My BGP configuration looks like this:

router bgp AS B
    vrf internet
        address-family ipv4 unicast
    neighbor PE1
        remote-as AS A
        password 3
        address-family ipv4 unicast
          send-community
    neighbor CE2
        remote-as internal
        password 3
        address-family ipv4 unicast
        next-hop-self

When I try to enable EIBGP multipath like stated here, I get the following error message:

router bgp AS B
    vrf internet
        address-family ipv4 unicast
            maximum-paths eibgp 2

Cannot configure EIBGP multipath along with per-vrf label mode

From my understanding the maximum-paths eibgp is what I'm looking for, as I want to utilize the multiple external paths using the internal paths. Do I miss something?

I run two Nexus 9000 with nx-os 10.4(2)

[Joseph W. Doherty]

Are your PEs same AS?

Internal egress traffic will be sent to CE1 or CE2, or internal egress traffic will be sent to both CEs, concurrently?

[artem-sidorenko]

PEs are the same AS.

on the CE1/CE2 I'm doing VRRP for L3 HA and vPC for L2 HA (simple setup to avoid complexity)

I guess I figured out the reason: from PEs I'm getting the default route only (not the full table): in case of EIBGP multipath I would get at least partially a routing loop: CE1/CE2 might forward the packets for the default route to each other, without to pass them to the eBGP peer. So it makes totally sense what I need some further factor (e.g. MPLS) or get the full table and split it

[MHM Cisco World]

From error message I think you need to change mode from per-vrf to per-prefix 

MHM

[artem-sidorenko]

If I enable mpls and l3vpn, the only option I can use in the CLI is `per-vrf`

[MHM Cisco World]

label-allocation-mode ? <- can I see option you have 

MHM

[artem-sidorenko]

only 'per-vrf' (with configuration above and installed/enabled mpls and l3vpn)

[MHM Cisco World]

No label-allocation-mode per-vrf 

This will return nsk use per-prefix (defualt).

MHM

[Joseph W. Doherty]

". . . in case of EIBGP multipath I would get at least partially a routing loop: CE1/CE2 might forward the packets for the default route to each other, without to pass them to the eBGP peer."

Exactly one of my concerns, if egress traffic from internal network hits both CEs.

I'm unsure what all your options might be with a NX-OS platform.

Any chance to make changes from internal network to CEs and/or add additional hardware between internal network and CEs or between CEs and PEs?

[Harold Ritter · Accepted solution]

Hi @artem-sidorenko ,

eibgp multi path is only supported for l3vpn, as it could cause traffic loops otherwise.

Regards,