how to design a global BGP network

[gbcbooksmj]

hi guys 

please check the diagram . and give out your suggestions 

here is the requirement:

1.we need to build a global backbone network , LA , FRK and HK3 are the core routers, and you can see the private BGP AS number next to all routers 

2.to simulate a real Global network , we restrict to announce lower than /24 mask routes.

3.all router connect to same ISPs in belong to their area. and use a /30 long address as the interface address

now, please look at the Asia area ,  i want to build a BGP confederation in AS 700 ,  

Router HK3 has subnet 45.128.16.0/24 and Router SG has 45.128.17.0/24 , both of the subnet were announced to BGP confederation AS 700

but others router of Asia can will not import them into their bgp route table, because of thesse routes will be received from ISP and it will bring AS 700 in its as path information 

what can i do to finish this mission . or should i give up bgp confederation ? 

[chrihussey]

It's been a while but I worked on an ISP network years ago and did confederation successfully. The other AS700 confederation members should not learn about the 45.128.16.0 /24 and 45.128.17.0 /24 from the ISPs but from the originating confederation AS instead. Are you EBGP peering between the confederation ASs?

[gbcbooksmj]

no , it wasn't peering each other . 

i was thinking use GRE to establish a logical connect with other aren't connect directly  Routers in the same Area. and there is another problem. the interface address is a /30 long address.  it is not allow to  announced into ISP's BGP network . because of the rule. 

what will a ISP do when they face this problem ?

[chrihussey]

They don't have to be directly connected. As long as the IGP inside the AS700 confederation allows for connectivity between the different ASs you should be able to EBGP peer between them using "ebgp-multihop". Suggest using loopback IPs as source.

Also suggest you try it between two AS inside the confederation to see if it solves the issue and then take it from there.

[gbcbooksmj]

yes,  they dont need to be connect directly,

for example , 

Router ID will not know the Route SG 's interface , even it is a loopback IPs , because it is from AS700.   isn't it ? 

[chrihussey]

My assumption is that you are running a common IGP (OSPF/ISIS/EIGRP) inside AS700 and that all routers inside AS 700 have IP reach-ability with each other without having to go outside the AS.

If indeed that is not the case and for example ID needs to go through an ISP to reach SG, then they cannot be in a confederation or you will have the exact problem you are having.

Hope that makes sense.

[gbcbooksmj]

thks 

i make ISP announce a aggregate-address which could include the /30 long bit address of interface , so that each router can be connect from any where .

because it is summary-only , so , routers exclude ISP will receive a /24 long bit route , it satisfied the requirement . 

one think i am still curiosity , will ISP take this measure too ? 

[gbcbooksmj]

any reply ? 

[gbcbooksmj]

chrihussey  

in this picture , i had established four bgp connections between ID and  SG 

connection with address 45.112.5.2 and 45.96.5.2 will be routed to ISP backbone

connection with address 10.16.2.1 and 10.16.1.1 will be routed to a GRE tunnel 

the prefix 45.128.16.0/24 was announced from Router HK3(AS65400)

i expect ISP backbone would be more prior than GRE

so i have "prepend last-as 2 " in all router out direction ,  but the shortest as path rule will exclude confederation as path . 

for now , i can use local-preference or MED to control routes .

but can you tell me what  the most useful measure is that ISP to do with this ? 

[chrihussey]

Do the Asia routers have connectivity / IP reach-ability to each other without having to go through an ISP? If they don't, it is obviously not an optimal design for a few reasons. Are you also using tunnels to EBGP peer in the Europe and America confederations?

To answer your question, yes, setting the local preference or MED would probably be the best way to control the routes.

[gbcbooksmj]

thks for you reply 

for you question , i just update my diagram ,  i added connection between ISPs , please check the attachment

so that , Asia Routers have the connectivity to each other , the core Router of the diagram (LA,HK3,FRK) connect each other with MPLS VPN . 

i am planing to use GRE tunnel to build EBGP peer in Europe and America ,  any suggestion ? 

[chrihussey]

Adding the connections between the ISPs probably better simulates the Internet cloud.

Regardless, not having true connectivity and relying on tunnels across the Internet between the AS 700 members is in and of itself a design flaw.

Be that as it may, there are many different ways to design this network. In the case of the Asia routers, considering the actual link between SG and HK, it may be a good idea to have ID, NIT and EQ peer with each of them as opposed to two peering sessions to the same neighbor.

The main thing to keep in mind is to make sure that loss of connectivity between any members of the confederation does not result in routers advertising routes to the Internet that they can no longer reach, thus traffic getting black holed.