3.7g Implement and troubleshoot AS path manipulations
3.7g(i) Local AS, allow AS in, remove private AS
1. local-as
The local-AS feature allows the router to appear to be a member of a second AS, in addition to its real AS. This feature can only be used for true eBGP peers, not between two peers in different confederation sub-AS.
The local-as does not replace the normal AS number advertised to its peers. Rather, it prepends the local-as to the actual AS, resulting in the AS_PATH length of two. Routes advertised to neighbors with local-as will appear to arrive via the specified AS, but will still be known to have originated in the actual AS.
Let's look at an example. R1 and R2 are in AS 100, R3 is in AS 300. However, R2 is configured to peer with R3 using AS 200.
+--------+ +------------+ +--------+
| | | | | |
| AS 100 | --- | AS 100/200 | --- | AS 300 |
| R1 | | R2 | | R3 |
+--------+ +------------+ +--------+
Configuration.
R1#
interface FastEthernet0/0
ip address 10.1.12.1 255.255.255.0
!
router bgp 100
no synchronization
bgp log-neighbor-changes
network 192.168.10.0
neighbor 10.1.12.2 remote-as 100
no auto-summary
R2#
interface FastEthernet0/0
ip address 10.1.12.2 255.255.255.0
!
interface FastEthernet0/1
ip address 10.1.23.2 255.255.255.0
!
router bgp 100
no synchronization
bgp log-neighbor-changes
neighbor 10.1.12.1 remote-as 100
neighbor 10.1.23.3 remote-as 300
neighbor 10.1.23.3 local-as 200
no auto-summary
R3#
interface FastEthernet0/1
ip address 10.1.23.3 255.255.255.0
!
router bgp 300
no synchronization
bgp log-neighbor-changes
neighbor 10.1.23.2 remote-as 200
no auto-summary
From R3's perspective, R2 is peering from AS 200. Although, the BGP process on R2 is AS 100 (router bgp 100).
R3#show ip bgp summary
BGP router identifier 10.1.23.3, local AS number 300
BGP table version is 6, main routing table version 6
1 network entries using 120 bytes of memory
1 path entries using 52 bytes of memory
2/1 BGP path/bestpath attribute entries using 248 bytes of memory
1 BGP AS-PATH entries using 24 bytes of memory
0 BGP route-map cache entries using 0 bytes of memory
0 BGP filter-list cache entries using 0 bytes of memory
BGP using 444 total bytes of memory
BGP activity 3/2 prefixes, 3/2 paths, scan interval 60 secs
Neighbor V AS MsgRcvd MsgSent TblVer InQ OutQ Up/Down State/PfxRcd
10.1.23.2 4 200 98 95 6 0 0 00:04:47 1
Pay attention to the AS_PATH in the learned prefix.
R3#show ip bgp
BGP table version is 6, local router ID is 150.1.3.3
Status codes: s suppressed, d damped, h history, * valid, > best, i - internal,
r RIB-failure, S Stale
Origin codes: i - IGP, e - EGP, ? - incomplete
Network Next Hop Metric LocPrf Weight Path
*> 192.168.10.0 10.1.23.2 0 200 100 i
2. allowas-in
EBGP loop prevention is based on the AS_PATH attribute. If the local AS number is seen in the AS_PATH of the NLRI, that UPDATE is not accepted. What if there is a situation where the BGP AS is split in two (as demonstrated below)?
+--------+ +--------+ +--------+
| | | | | |
| AS 100 | --- | AS 200 | --- | AS 100 |
| R1 | | R2 | | R3 |
+--------+ +--------+ +--------+
Configuration.
R1#
interface FastEthernet0/0
ip address 10.1.12.1 255.255.255.0
!
router bgp 100
no synchronization
bgp log-neighbor-changes
network 172.16.16.0 mask 255.255.255.0
network 172.16.17.0 mask 255.255.255.0
network 192.168.10.0
network 192.168.11.0
neighbor 10.1.12.2 remote-as 200
no auto-summary
R2#
interface FastEthernet0/0
ip address 10.1.12.2 255.255.255.0
!
interface FastEthernet0/1
ip address 10.1.23.2 255.255.255.0
!
router bgp 200
no synchronization
bgp log-neighbor-changes
neighbor 10.1.12.1 remote-as 100
neighbor 10.1.23.3 remote-as 100
no auto-summary
R3#
interface FastEthernet0/1
ip address 10.1.23.3 255.255.255.0
!
router bgp 100
no synchronization
bgp log-neighbor-changes
neighbor 10.1.23.2 remote-as 200
no auto-summary
R1 is advertising four routes: 192.168.10.0/24, 192.168.11.0/24, 172.16.16.0/24, and 172.16.17.0/24.
R1#show ip bgp
BGP table version is 5, local router ID is 10.1.12.1
Status codes: s suppressed, d damped, h history, * valid, > best, i - internal,
r RIB-failure, S Stale
Origin codes: i - IGP, e - EGP, ? - incomplete
Network Next Hop Metric LocPrf Weight Path
*> 172.16.16.0/24 0.0.0.0 0 32768 i
*> 172.16.17.0/24 0.0.0.0 0 32768 i
*> 192.168.10.0 0.0.0.0 0 32768 i
*> 192.168.11.0 0.0.0.0 0 32768 i
Normally, the routes from R1 to R3 (via R2) would get rejected because AS 100 would be listed in the AS_PATH.
R3# debug ip bgp updates
*Mar 1 02:52:42.303: BGP(0): 10.1.23.2 rcv UPDATE about 192.168.11.0/24 -- DENIED due to: AS-PATH contains our own AS;
*Mar 1 02:52:42.307: BGP(0): 10.1.23.2 rcv UPDATE about 192.168.10.0/24 -- DENIED due to: AS-PATH contains our own AS;
*Mar 1 02:52:42.307: BGP(0): 10.1.23.2 rcv UPDATE about 172.16.17.0/24 -- DENIED due to: AS-PATH contains our own AS;
*Mar 1 02:52:42.311: BGP(0): 10.1.23.2 rcv UPDATE about 172.16.16.0/24 -- DENIED due to: AS-PATH contains our own AS;
To allow the UPDATES to be received, neighbor x.x.x.x allowas-in must be configured on R3.
R3#
router bgp 100
no synchronization
bgp log-neighbor-changes
neighbor 10.1.23.2 remote-as 200
neighbor 10.1.23.2 allowas-in
no auto-summary
The routes are now installed into R3's BGP table, regardless of the AS_PATH containing R3's AS number (100).
R3#show ip bgp
BGP table version is 5, local router ID is 10.1.23.3
Status codes: s suppressed, d damped, h history, * valid, > best, i - internal,
r RIB-failure, S Stale
Origin codes: i - IGP, e - EGP, ? - incomplete
Network Next Hop Metric LocPrf Weight Path
*> 172.16.16.0/24 10.1.23.2 0 200 100 i
*> 172.16.17.0/24 10.1.23.2 0 200 100 i
*> 192.168.10.0 10.1.23.2 0 200 100 i
*> 192.168.11.0 10.1.23.2 0 200 100 i
3. remove-private-as
IANA has reserved a private AS number space (64512 to 65535) to converse public AS numbers (1 to 64511). The private AS numbers cannot be leaked into the global BGP table because they are not unique (EBGP uses the AS_PATH for loop prevention). The remove-private-as command strips off the private AS numbers out of the AS_PATH list before the routes are propagated to a BGP peer.
A private AS is commonly allocated when a customer connects to one ISP (single-homed or dual-homed connection). A private AS number cannot be used when the customer connects to multiple ISPs. When a private AS number is allocated to the customer, the BGP updates from the customer will have the private AS number in the AS_PATH list. The ISP should not propagate the AS_PATH with the private AS number. The neighbor x.x.x.x remove-private-as command removes the private AS number from outbound updates.
The following conditions apply:
- Only used with eBGP peers.
- If the update has only private AS numbers in the AS_PATH, BGP removes these numbers.
- If the AS_PATH includes both private and public AS numbers, BGP doesn't remove the private AS numbers. This situation is considered a configuration error.
- If the AS_PATH contains the AS number of the eBGP neighbor, BGP does not remove the private AS number.
- If the AS_PATH contains confederations, BGP removes the private AS numbers only if they come after the confederation portion of the AS_PATH.
Example.
+----------+ +--------+ +--------+
| | | | | |
| AS 65001 | --- | AS 200 | --- | AS 300 |
| R1 | | R2 | | R3 |
+----------+ +--------+ +--------+
Simple scenario: R1 is advertising its Loopback0. R2 will remove the private AS number before propagating the route to R3.
R1#
interface FastEthernet0/0
ip address 155.1.12.1 255.255.255.0
!
interface Loopback0
ip address 150.1.1.1 255.255.255.255
!
router bgp 65001
no synchronization
bgp log-neighbor-changes
network 150.1.1.1 mask 255.255.255.255
neighbor 155.1.12.2 remote-as 200
no auto-summary
R2#
interface FastEthernet0/0
ip address 155.1.12.2 255.255.255.0
!
interface FastEthernet0/1
ip address 155.1.23.2 255.255.255.0
!
router bgp 200
no synchronization
bgp log-neighbor-changes
neighbor 155.1.12.1 remote-as 65001
neighbor 155.1.23.3 remote-as 300
no auto-summary
R3#
interface FastEthernet0/1
ip address 155.1.23.3 255.255.255.0
!
router bgp 300
no synchronization
bgp log-neighbor-changes
neighbor 155.1.23.2 remote-as 200
no auto-summary
Before the private AS is removed, R3 can see it in the AS_PATH of the 155.1.1.1/32 route.
R3#show ip bgp
BGP table version is 5, local router ID is 150.1.23.3
Status codes: s suppressed, d damped, h history, * valid, > best, i - internal,
r RIB-failure, S Stale
Origin codes: i - IGP, e - EGP, ? - incomplete
Network Next Hop Metric LocPrf Weight Path
*> 150.1.1.1/32 155.1.23.2 0 200 65001 i
Applying the configuration
R2#
router bgp 200
neighbor 155.1.23.3 remove-private-as
Verification. Only AS 200 is listed in the AS_PATH.
R3#show ip bgp
BGP table version is 6, local router ID is 150.1.23.3
Status codes: s suppressed, d damped, h history, * valid, > best, i - internal,
r RIB-failure, S Stale
Origin codes: i - IGP, e - EGP, ? - incomplete
Network Next Hop Metric LocPrf Weight Path
*> 150.1.1.1/32 155.1.23.2 0 200 i
No comments:
Post a Comment