Overview: Border Gateway Protocol (BGP) Solutions in this chapter: ■ The History of BGP ■ Maximizing the Functionality of BGP ■ External BGP and the Internet ■ The BGP Path Selection Process ■ Redistributing BGP into Your IGP ■ Defining Internal BGP, Route Reflectors, and Confederations ■ Advanced BGP Network Design Chapter 10 375 110_QoS_10 2/13/01 11:51 AM Page 375 376 Chapter 10 • Overview: Border Gateway Protocol (BGP) Introduction As at press time, the Internet holds well over 90,000 routes, which is far more than Interior Gateway Protocols (IGPs) such as EIGRP or OSPF were designed to handle. Additionally, whereas private internetworks generally have only a few possible paths, with the Internet, there could literally be thousands of ways to arrive at the same destination. EIGRP or OSPF would have major problems under these circumstances. Clearly, another protocol is needed to deal with the complex routing issues on the public Internet.The answer to this problem is BGP, or, more precisely, BGP 4. Unlike OSPF or EIGRP, which were designed to be intra-AS (autonomous system), BGP was specifically designed to route traffic between autonomous systems, and is therefore called an Inter-AS routing protocol. This chapter gives some background on the development of this protocol, explains the difference between EBGP and IBGP, explores some of the most popular design concepts, and discusses more complex issues such as route reflec- tors and confederations. The History of BGP Border Gateway Protocol 4 (BGP 4) was preceded by BGP 1, BGP 2, and BGP 3 as standards for use in exchanging TCP/IP routing information between domains. Furthermore, all BGP versions were preceded by the Exterior Gateway Protocol (EGP) as both a standard and a protocol for interdomain routing.The Internet and most of the backbone providers were using EGP exclusively until the mid 1990’s.There was limited use of BGP 3 on any production network, pri- marily because of the stability of EGP and the lack of significant differences in features available in BGP 3. However, BGP 4 was developed to fix several major problems with EGP, and it led to the widespread use of BGP that exists today. Specifically, BGP 4 pro- vided for the use of classless interdomain routing (CIDR), it provided for a more open topology structure between BGP speakers, and it could coexist with EGP on a router.These features provided a means of minimizing the routing tables and easily moving to this new standard. Exterior Gateway Protocol (EGP) The Exterior Gateway Protocol dates back to the early 1980’s. Its implementation assumed an engineered tree topology throughout the Internet. Since there was no www.syngress.com 110_QoS_10 2/13/01 11:51 AM Page 376 www.syngress.com overall network architect authority for the Internet and connecting regional net- works, this limitation was the root cause of many problems associated with full mesh peering.The full mesh network configuration created backdoor routes between regional networks that resulted in “suboptimal routing,”“routing loops,” or “black holes” that prevented IP packets from traversing the Internet efficiently. Suboptimal routing can best be described as routing that does not use the best path between the source and destination systems.A “routing loop” is a situa- tion that exists when two systems both see each other as an appropriate next hop to forward packets for a given network.The forwarding decision is determined by the routing table, derived from the routing protocol. In this situation, both sys- tems will forward packets to each other until the time-to-live (TTL) for the packets is exhausted. A “black hole” occurs when a collection of routers believes that the best forwarding path to a destination network is via a router that does not have a route to the destination network. Supposing we refer to this router as Router A, when other routers send packets destined for the unknown network to Router A, and it does not know how to reach this destination, Router A simply discards the packets. Since it appears that the packets disappeared for no apparent reason, they are spoken of as having disappeared into a “black hole.”This is how the term “black hole” came to be used. EGP could not prevent the propagation of false routing information between regional networks and the backbone Internet that created these situations. RFC 1092,“EGP and Policy Based Routing in the New NSFNET Backbone,” addressed these problems in relation to the NSFNET.This RFC acknowledged that because the processes proposed were interim measures and did not scale for a global Internet, they should be used only until a better routing algorithm could be developed and put into use. The Original Implementation RFC 1267 established the standards for the original implementation of BGP.This implementation is also referred to as BGP 3. It built upon lessons learned with EGP and began the transition process. However, there is no evidence of wide- scale use of this protocol in the Internet, and it was simply relegated to labs and test networks for test purposes. Since this implementation of BGP did not solve the most pressing needs of backbone providers, namely, the classful routing dilemma, there was no incentive to go through the trouble of conversion. BGP was introduced as an inter-autonomous system (AS) routing protocol. An AS is defined as a collection of routers under a common administration. Furthermore, within the AS you can have multiple Interior Gateway Protocols Overview: Border Gateway Protocol (BGP) • Chapter 10 377 110_QoS_10 2/13/01 11:51 AM Page 377 378 Chapter 10 • Overview: Border Gateway Protocol (BGP) (IGPs) that are used to exchange network routing information. A BGP speaker’s primary function is to exchange network reachability information with other BGP systems. Since the BGP speaker sees the Internet as a collection of autonomous systems (AS), the network reachability information includes the full AS path that traffic must travel to reach these networks.This information allows the BGP system to construct a graph of AS connectivity.This graph is used to prune routing loops, and it permits policy decisions by the system.Thus, BGP is best described as a hop-by-hop protocol in which each system advertises only the network reachability information that it uses. The implementation of BGP 3 introduced the foundation elements that are still in use today. First of all, BGP systems establish a connection upon initializa- tion over TCP using port 179. Next, the systems exchange the complete routing table and send incremental updates only as necessary. Since there is no provision to periodically refresh the complete BGP database, all systems keep track of a ver- sion of one another’s table. Once the BGP speakers enter the established state, the BGP scanner process on each system ensures consistency among the BGP database, the IGP database, and the IP routing table. If you issue the exec command show process cpu, you will see this process in the list identified as BGP Scanner. It is important to note that this process is different from the BGP Router process, which is used to establish and maintain the BGP session. Finally, the session will remain up unless the connection experiences an error condition.When this situation occurs, the initialization process begins and will continue until the BGP session is reestablished.This procedure is fairly straightforward and depends on the reliability provided with a TCP connection. The fundamental elements of BGP 3 provided a stable basis on which to make the improvements that were eventually released as BGP 4. The Current RFC The current RFC standard actually consists of two documents: RFC 1771,“A Border Gateway Protocol 4 (BGP 4),” and the companion document, RFC 1772, “Application of the Border Gateway Protocol in the Internet.” Both documents define the inter-autonomoussystem routing protocol in use today. Fundamentally, BGP 4 is simply a new and improved version of its predecessor.The foundation elements of BGP 4, such as BGP connection, messages, peer establishment, and error correction mechanisms, are essentially the same as in BGP 3. www.syngress.com 110_QoS_10 2/13/01 11:51 AM Page 378 Overview: Border Gateway Protocol (BGP) • Chapter 10 379 However, BGP-4 provides a new set of mechanisms to support both Classless Interdomain Routing (CIDR) and Variable Length Subnet Mask (VLSM). BGP 4 also introduces mechanisms to aggregate routes and AS paths.These additions make supernetting possible and serve as a solution to database growth on the Internet, as well as a means to address the IP, version 4, address space depletion problem.This concept is called classless interdomain routing (CIDR) and is explained in the CIDR sidebar in this chapter. This implementation of BGP 4 also provides support for multiple network protocols, such as IPv4, IPv6, and IPX, which allows it to carry network infor- mation for these protocols. In this form, BGP is known as Multiprotocol BGP (MBGP). RFC 2283 outlines the specifications for all protocols supported, and the mechanisms to exchange reachability information between BGP speakers. In general, the individual network layer protocols are identified by an Address Family (AF), defined in RFC 1700.Through the multiprotocol extensions, BGP peers can, with a single peering session, exchange reachability information on multiple AFs, such as IPv4, IPv6, and IPX, ,as well as subAFs, for instance, unicast and multicast. Finally, BGP4 provides an easy means to work with EGP that facilitates a transition path to this new standard.This probably is what finally served to make BGP 4 the preferred interdomain routing protocol compared to EGP and all pre- vious versions of BGP. www.syngress.com The specifications of CIDR are listed in RFC 1519. These standards were adopted to curb the routing table growth on the backbone Internet routers in the early 1990’s. Between 1991 and 1995, the Internet routing tables doubled every 10 months. If CIDR had not been stan- dardized and implemented, we could have had hundreds of thousands of Internet routes in the routing tables today. CIDR, simply stated, provides a means to view a network and mask combination that will summarize a group of consecutively num- bered networks into a single advertisement. This summarized group of networks is known as a supernet. Consider the Class C network Classless Interdomain Routing (CIDR) and the Current RFC Continued 110_QoS_10 2/13/01 11:51 AM Page 379 380 Chapter 10 • Overview: Border Gateway Protocol (BGP) Maximizing the Functionality of BGP BGP works like any other routing protocol by maintaining routing tables, exchanging routing updates with peer routers, and making routing decisions based on BGP and neighbor parameters. Each BGP speaker exchanges network reachability information that includes the AS path list to permit the building of an AS graph for all network prefixes. This graph, or tree, is used to prune routing loops, and it determines the best for- warding path to place into the forwarding database or routing table. All routing information is retained by the BGP speakers until an update message withdraws the network prefix, changes the AS path, or modifies a metric. The BGP Routing Process The BGP routing process begins with the establishment of a connection. Once this connection is created and both BGP speakers agree on the parameters to use for the session, a complete BGP database is sent by each system.The systems keep the session alive with periodic KEEPALIVE messages and will send a BGP UPDATE message only if a network prefix is modified with a different AS path or metric. In this case, the network prefix entry is updated in all BGP tables, as www.syngress.com 192.168.3.0 and natural mask of 255.255.255.0. In this example, we know the network identifier is 192.168.3.0. In CIDR terminology, this network-mask pair is represented as 192.168.3.0/24. The /24 indicates the masking length in bits for the network identifier. In this case, 24 bits of network mask are used to identify the network bit boundary. If we attempt to summarize a group of Class C networks into a supernet that includes the network 192.168.3.0, we only need to reduce the number of bits that indicates the network mask. Thus, a supernet of 192.168.0.0/16 indicates a CIDR block of contiguous networks with 16 bits identifying the network boundary. In this example, the address range is 192.168.0.0 to 192.168.255.255. You can see just from this example how CIDR has helped slow down the growth of the routing table size for Internet routers. Today, the use of CIDR and supernetting has spread to the enter- prise network for the same reasons that it was used in the Internet. However, you must remember that using CIDR and supernets requires a routing protocol that can pass along network and mask combinations in the routing advertisement. For example, BGP 4, OSPF, and EIGRP are examples that can be used in this environment. 110_QoS_10 2/13/01 11:51 AM Page 380 Overview: Border Gateway Protocol (BGP) • Chapter 10 381 appropriate. If a network prefix disappears, then a BGP UPDATE message is sent out that withdraws the network prefix or prefixes from all BGP tables. In such a case, the prefixes are removed from the BGP tables until a BGP UPDATE mes- sage is received that specifically adds the networks back. The BGP system keeps track of the current database version for all BGP speakers, and it can determine the reliability of the data in updates and KEEPALIVE messages. Since all BGP speakers track one another’s database ver- sions, they can use this to detect missed updates and determine the reliability of information from their respective neighbors.This mechanism enables the various BGP neighbors to simply send out incremental updates to the BGP database as necessary, and avoids the need to periodically resend the complete BGP database. This process that BGP systems cycle through is called the BGP Finite State Machine. Figure 10.1 depicts the movement through this cycle and identifies the decision points in the cycle. BGP Finite State Machine Logic The following information summarizes the various transitional states that a BGP speaker goes through with the BGP Finite State Machine. Refer back to Figure 10.1 for clarification. ■ 1 Idle This is the first state in the BGP Finite State Machine cycle. At this stage, the BGP speaker is waiting for a Start event. A Start event can be caused by an Administrator establishing a new BGP router configura- tion peer statement or resetting an existing BGP peer session. In this state, the BGP speaker initiates the TCP session with the BGP peer. ■ 2 Connect At this stage, the BGP speaker is waiting for the TCP con- nection to establish.When this occurs, it moves to the OpenSent state. If the TCP transport fails, the state becomes Active. If the ConnectRetry timer expires, the state remains in the Connect phase.Any other events initiated by the system or operator cause the state to return to Idle. ■ 3 Active In this stage, the BGP system attempts to establish a TCP ses- sion. Once the TCP session is established, the BGP session is in the OpenSent state. If the TCP session fails to establish and the ConnectRetry timer expires, the BGP session returns to the Connect state. If the system or operator causes a Stop event, the session will revert to the Idle state. ■ 4 OpenSent In this state, BGP is waiting for a BGP OPEN message. Once the OPEN message is received, it is checked for errors. If errors www.syngress.com 110_QoS_10 2/13/01 11:51 AM Page 381 382 Chapter 10 • Overview: Border Gateway Protocol (BGP) are detected, such as a bad version number or unacceptable AS, a NOTI- FICATION message is sent out and the system returns to the Idle state. If no errors are detected, the system starts sending out BGP KEEPALIVE messages, the two systems negotiate a BGP hold time value, and the state advances to OpenConfirm. In the hold time negotia- tion, the smallest value of either system is selected.As with the other states, if a TCP disconnect or problem occurs, the system goes back to the Active state. If the hold time expires, a NOTIFICATION message is sent out and the system moves to the Idle state. ■ 5 OpenConfirm BGP waits to receive a KEEPALIVE message in this phase. Once the KEEPALIVE message is received, the system moves on to the Established state and the hold timer is initialized. If any errors occur at this point, a NOTIFICATION message is sent out and the system returns to the Idle state. ■ 6 Established This is the state that you want to see all BGP systems in. At this phase, UPDATE and KEEPALIVE messages are exchanged as necessary, and you can see the prefixes that each BGP system is sending out. If any errors occur while in this state, a NOTIFICATION message is sent out and the system returns to the Idle state. ■ Prefix Exceeded This is a “Cisco Only” state. It indicates that the BGP system is operational but is limiting the total number of prefixes in the database to a quantity less than has been received by an adjacent neighbor. Issuing the exec command clear ip bgp will reset all BGP neighbors and return the system to an Idle state. ■ Shutdown This is also a “Cisco Only” state and indicates an adminis- trative state for a given system. It is used when a BGP neighbor is con- figured in the router and is administratively shut down. Once a Start event is issued, the system will move to the Idle state. NOTE A BGP session that oscillates between the Connect and Active states indi- cates there is a problem with the TCP transport layer for the two sys- tems. Check the definition in the configuration lines carefully, and verify reachability with a ping and a traceroute. www.syngress.com 110_QoS_10 2/13/01 11:51 AM Page 382 Overview: Border Gateway Protocol (BGP) • Chapter 10 383 www.syngress.com Figure 10.1 BGP Finite State Machine Logic Cycle 1 Idle 3 Active 4 Open Sent 5 Open Confirm 6 Established TCP Connection Request? Valid Neighbor? 2 Connect TCP Connection Succeed? Yes Yes Yes Yes No Expired Connect-Retry Timer? Yes No Neighbor Configuration OK? BGP Version OK? Yes No No NOTIFICATION Message Sent Out KEEPALIVE Messages Sent Out Yes Hold-Timer Expired? Yes TCP Connection Closed? No OPEN Messages Sent Out Yes No Message Contains Errors UPDATE Messages Exchanged KEEPALIVE Messages Sent Out Yes No Maximum # of Prefixes Exceeded Cisco only State Prefix Exceeded Cisco only State Shutdown No Yes “Clear IP BGP neighbor” Command Issued No No Yes No Neighbor Administratively Shutdown Yes Neighbor removed from Shutdown State Yes 110_QoS_10 2/13/01 11:51 AM Page 383 384 Chapter 10 • Overview: Border Gateway Protocol (BGP) The Types of BGP Messages There are four BGP message types used to establish and maintain BGP connections. ■ OPEN This message establishes BGP communications between speakers and is the first message sent once a TCP session is established between the two BGP speakers. ■ UPDATE This message is used to notify BGP peers about network prefixes and their associated BGP attributes. ■ NOTIFICATION This message is used to notify a speaker that a pro- tocol error condition has occurred and the active session is being closed. ■ KEEPALIVE This message is used to prevent the TCP session from expiring by notifying the BGP peer that a device is active. Such mes- sages are exchanged if the keepalive period is exceeded and an UPDATE message has not been exchanged. The Format of BGP Packets All BGP messages start with a BGP header.The OPEN, UPDATE, and NOTIFI- CATION messages all contain additional fields that are explained in the fol- lowing sections.The BGP header is 19 bytes in length, has three fields, and is also used as a KEEPALIVE message.A complete BGP message can range in size from a minimum of 19 bytes for a KEEPALIVE message, to a maximum of 4096 bytes for a large UPDATE message containing multiple network layer reachability information (NLRI) entries. However, the BGP speaker will evaluate the Maximum Transmission Unit (MTU) value of the outgoing interface before building the packet to send out on the interface.Thus, if an interface supports only a MTU of 1500 bytes the BGP packet will also have a maximum size of 1500 bytes. Figure 10.2 illustrates the fields and layout of the BGP header. ■ Marker This 16-byte field contains a sequence that is predictable by a BGP peer. Being predictable means that the remote system can process the information based on a common algorithm used by both systems. Given this capability, the systems can utilize this field for authentication or synchronization. Furthermore, the standards specify the use of this field in the routing protocols, and, based on the values, each system should calculate the same resulting value. www.syngress.com 110_QoS_10 2/13/01 11:51 AM Page 384 [...]... 10. 5 Table 10. 5 Pseudo AS Path List for Figure 10. 10 Local AS Remote AS AS Path Stub AS 101 Stub AS 101 Stub AS 102 Multihomed AS 100 AS1 AS1 or AS1 AS1 or AS2 AS2 or AS1 Multihomed AS 100 Multihomed AS 100 www.syngress.com Stub AS 101 Stub AS 102 AS2 AS102 AS100 AS2 AS100 AS101 AS1 AS101 AS102 AS2 AS102 110 _QoS_ 10 2/13/01 11:51 AM Page 397 Overview: Border Gateway Protocol (BGP) • Chapter 10 Does that... 4096 bytes Figure 10. 3 depicts the field layout for this message www.syngress.com 385 110 _QoS_ 10 386 2/13/01 11:51 AM Page 386 Chapter 10 • Overview: Border Gateway Protocol (BGP) Figure 10. 3 BGP 4 OPEN Message Fields 7 15 23 31 Version - 1 Autonomous System 2 bytes Hold Time - 2 bytes BGP Identifier - 4 bytes Optional Length - 1 Optional Parameters - Variable Optional Parameters - Variable s Version... www.syngress.com 395 110 _QoS_ 10 396 2/13/01 11:51 AM Page 396 Chapter 10 • Overview: Border Gateway Protocol (BGP) Figure 10. 10 Simple AS Example Transit AS 1 ISP A Stub AS 101 Transit AS 2 ISP B Stub AS 102 Multihomed AS 100 regional transit AS and global transit AS classifications are given to ISPs Since this diagram depicts peer level transit AS connections, Stub AS 101 has connectivity to Stub AS 102 only through... messages, and Table 10. 3 lists the error codes with possible subcodes www.syngress.com 391 110 _QoS_ 10 392 2/13/01 11:51 AM Page 392 Chapter 10 • Overview: Border Gateway Protocol (BGP) Figure 10. 7 BGP 4 Notification Message Fields 0 7 Error - 1 15 Error Subcode - 1 23 31 Data - Variable s Error This single-byte field is used to indicate the type of notification s Error Subcode This single-byte field provides... command neighbor {ip- address \peer-group-name} weight weight We can verify the use of this parameter by issuing the show ip protocol exec command on the local router In Figure 10. 11, we see that no Weight is configured for any of the BGP neighbors of this particular router www.syngress.com 397 110 _QoS_ 10 398 2/13/01 11:51 AM Page 398 Chapter 10 • Overview: Border Gateway Protocol (BGP) Figure 10. 11 BGP Neighbor... default behavior can be modified through the next-hop-self router configuration command or the set-next-hop route-map command In this example, if Router 2 applies the next-hop-self command to the IBGP session with Router 3, the packets destined for Network A will be routed through Router 2 www.syngress.com 399 110 _QoS_ 10 400 2/13/01 11:51 AM Page 400 Chapter 10 • Overview: Border Gateway Protocol (BGP)... Comparison Best Path Source 134.24.88.55 2/13/01 Path Selection Step Table 10. 7 Continued 110 _QoS_ 10 Page 405 110 _QoS_ 10 406 2/13/01 11:51 AM Page 406 Chapter 10 • Overview: Border Gateway Protocol (BGP) Figure 10. 15 BGP Route Information for 208.188.42.0 Figure 10. 16 Routing Table Entry for NEXT_HOP Sources for 208.188.42.0 Figure 10. 16 depicts the routing information used to reach the NEXT_HOP sources... IGP 100 N/A Continued All equal (Fig 10. 15) None (Fig 10. 15) All have 3 AS hops (Fig 10. 15) All equal (Fig 10. 15) All equal (Fig 10. 15) All equal (Fig 10. 15) None (Fig 10. 11) All reachable via static routes (Fig 10. 16) N/A with EBGP Evaluation Result 11:51 AM N/A Reachable Source 192.157.69.5 2/13/01 1 Next_Hop Reachable Comparison 2 Synchro- N/A nization Comparison 3 Weight N/A Comparison 4 Local 100 ... accommodate www.syngress.com 110 _QoS_ 10 2/13/01 11:51 AM Page 409 Overview: Border Gateway Protocol (BGP) • Chapter 10 this policy It is always best to try to make all IP routing work using the simplest method possible One method is to use only a default route to attract traffic out of an AS.To make this work effectively, you must have a well-thought-out IP network plan that summarizes IP address space from... Path Selection Step Table 10. 7 BGP Path Selection Process for 208.188.0.0 110 _QoS_ 10 Page 404 N/A 192.41.177.69 N/A 198.32.176.25 * 0 Source 192.41.177.69 0 Source 198.32.176.25 192.157.69.5 N/A 0 Source 192.157.69.5 Largest ID 198.32.176.25 (Fig 10. 15) None (Fig 10. 11) All equal (Fig 10. 16) Evaluation Result 11:51 AM 10 IGP 0 Metric to Next_Hop Comparison 11 BGP N/A Multipath Support 12 ROUTER_ 134.24.88.55 . Error 10 - Invalid Network Field 11 – Malformed AS_PATH www.syngress.com Figure 10. 7 BGP 4 Notification Message Fields 01531 Data - Variable 237 Error - 1 Error Subcode - 1 Continued 110 _QoS_ 10 2/13/01. Message Fields 01531 Marker - 16 Bytes 237 Length - 2 Bytes Type - 1 110 _QoS_ 10 2/13/01 11:51 AM Page 393 394 Chapter 10 • Overview: Border Gateway Protocol (BGP) in Table 10. 4.Analyzing the memory. bytes. Figure 10. 3 depicts the field layout for this message. www.syngress.com Figure 10. 2 BGP 4 Packet Header Fields 01531 Marker - 16 Bytes 237 Length - 2 Bytes Type - 1 110 _QoS_ 10 2/13/01 11:51