![\"\"](\"https:\/\/geekmungus.co.uk\/wp-content\/uploads\/2026\/02\/image-29.png\")
<\/figure>\n\n\n\nThe configuration steps will also be much more brief from now on, with less explaination of what is being added, and focussing on the actual key parts of the article’s partifulcar topic.<\/p>\n\n\n\n
Step 1 – Configure New Routers and Links<\/h1>\n\n\n\n
We’re going to configure the new routers, their links and their BGP configuration. We are also going to be setting up AS Green (65002) to use an IGP (OSPF) as well, a completely separate Area which will help distribute routes around the AS needed to support the BGP configuration. And as before the BGP configuration will make use of the loopback IP addresses for BGP Neighbours (peers) within the AS and the interface IPs for the BGP Neighbours (peers) between the AS.<\/p>\n\n\n\n
Router B<\/h2>\n\n\n\ncreate vlan \"RB-RD\"\nconfigure vlan \"RB-RD\" ipaddress 192.168.100.13\/30\nenable ipforwarding vlan \"RB-RD\"\nconfigure vlan \"RB-RD\" add port 3 untagged\n\ncreate bgp neighbor 192.168.100.14 remote-AS-number 65002\nconfigure bgp neighbor 192.168.100.14 source-interface ipaddress 192.168.100.13\nenable bgp neighbor 192.168.100.14\n\nconfigure ospf add vlan RB-RD area 0.0.0.0 passive<\/code><\/pre>\n\n\n\nRouter C<\/h2>\n\n\n\ncreate vlan \"RC-RD\"\nconfigure vlan \"RC-RD\" ipaddress 192.168.100.29\/30\nenable ipforwarding vlan \"RC-RD\"\nconfigure vlan \"RC-RD\" add port 2 untagged\n\ncreate vlan \"RC-RH\"\nconfigure vlan \"RC-RH\" ipaddress 192.168.100.17\/30\nenable ipforwarding vlan \"RC-RH\"\nconfigure vlan \"RC-RH\" add port 4 untagged\n\ncreate bgp neighbor 1.1.1.4 remote-AS-number 65002\nconfigure bgp neighbor 1.1.1.4 source-interface ipaddress 1.1.1.3\nenable bgp neighbor 1.1.1.4\n\ncreate bgp neighbor 1.1.1.9 remote-AS-number 65002\nconfigure bgp neighbor 1.1.1.9 source-interface ipaddress 1.1.1.3\nenable bgp neighbor 1.1.1.9\n\nconfigure ospf routerid 1.1.1.3\nenable ospf\nconfigure ospf add vlan RC-RA area 0.0.0.0 passive\nconfigure ospf add vlan RC-RD area 0.0.0.0 link-type point-to-point\nconfigure ospf add vlan RC-RH area 0.0.0.0 link-type point-to-point \nconfigure ospf add vlan RouterC-LP area 0.0.0.0 passive\n<\/code><\/pre>\n\n\n\nNote: that although OSPF is being enabled on the interface going to Router A (in the other AS), we are not using OSPF for the exchange of any routes between the two AS, we don’t need to and if we did this would defeat the point of using BGP in the first place! OSPF is only there to move the routes needed as the underlay network around within the AS to support the use of BGP (specifically iBGP).<\/p>\n\n\n\n
Router D<\/h2>\n\n\n\ncreate vlan \"RD-RB\"\nconfigure vlan \"RD-RB\" ipaddress 192.168.100.14\/30\nenable ipforwarding vlan \"RD-RB\"\nconfigure vlan \"RD-RB\" add port 3 untagged\n\ncreate vlan \"RD-RC\"\nconfigure vlan \"RD-RC\" ipaddress 192.168.100.30\/30\nenable ipforwarding vlan \"RD-RC\"\nconfigure vlan \"RD-RC\" add port 2 untagged\n\ncreate vlan \"RD-RH\"\nconfigure vlan \"RD-RH\" ipaddress 192.168.100.21\/30\nenable ipforwarding vlan \"RD-RH\"\nconfigure vlan \"RD-RH\" add port 4 untagged\n\ncreate vlan \"RouterD-LP\"\nconfigure vlan RouterD-LP tag 1114\nenable loopback-mode vlan RouterD-LP\nconfigure vlan RouterD-LP ipaddress 1.1.1.4 255.255.255.255\nenable ipforwarding vlan RouterD-LP\n\ncreate vlan \"RouterD-LAN1\" tag 1005\nconfigure vlan \"RouterD-LAN1\" ipaddress 10.2.1.1\/24\nenable ipforwarding \"RouterD-LAN1\"\nenable loopback-mode vlan \"RouterD-LAN1\"\n\nconfigure bgp AS-number 65002\nconfigure bgp routerid 1.1.1.4\nenable bgp\n\ncreate bgp neighbor 192.168.100.13 remote-AS-number 65001\nconfigure bgp neighbor 192.168.100.13 source-interface ipaddress 192.168.100.14\nenable bgp neighbor 192.168.100.13\n\ncreate bgp neighbor 1.1.1.3 remote-AS-number 65002\nconfigure bgp neighbor 1.1.1.3 source-interface ipaddress 1.1.1.4\nenable bgp neighbor 1.1.1.3\n\ncreate bgp neighbor 1.1.1.9 remote-AS-number 65002\nconfigure bgp neighbor 1.1.1.9 source-interface ipaddress 1.1.1.4\nenable bgp neighbor 1.1.1.9\n\nconfigure bgp add network 10.2.1.0\/24\n\nconfigure ospf routerid 1.1.1.4\nenable ospf\nconfigure ospf add vlan RD-RB area 0.0.0.0 passive\nconfigure ospf add vlan RD-RC area 0.0.0.0 link-type point-to-point\nconfigure ospf add vlan RD-RH area 0.0.0.0 link-type point-to-point \nconfigure ospf add vlan RouterD-LP area 0.0.0.0 passive<\/code><\/pre>\n\n\n\nNote: that although OSPF is being enabled on the interface going to Router A (in the other AS), we are not using OSPF for the exchange of any routes between the two AS, we don’t need to and if we did this would defeat the point of using BGP in the first place! OSPF is only there to move the routes needed as the underlay network around within the AS to support the use of BGP (specifically iBGP).<\/p>\n\n\n\n
Router H<\/h2>\n\n\n\ncreate vlan \"RH-RC\"\nconfigure vlan \"RH-RC\" ipaddress 192.168.100.18\/30\nenable ipforwarding vlan \"RH-RC\"\nconfigure vlan \"RH-RC\" add port 2 untagged\n\ncreate vlan \"RH-RD\"\nconfigure vlan \"RH-RD\" ipaddress 192.168.100.22\/30\nenable ipforwarding vlan \"RH-RD\"\nconfigure vlan \"RH-RD\" add port 1 untagged\n\ncreate vlan \"RouterH-LP\"\nconfigure vlan RouterH-LP tag 1119\nenable loopback-mode vlan RouterH-LP\nconfigure vlan RouterH-LP ipaddress 1.1.1.9 255.255.255.255\nenable ipforwarding vlan RouterH-LP\n\ncreate vlan \"RouterH-LAN1\" tag 1006\nconfigure vlan \"RouterH-LAN1\" ipaddress 10.2.2.1\/24\nenable ipforwarding \"RouterH-LAN1\"\nenable loopback-mode vlan \"RouterH-LAN1\"\n\nconfigure bgp AS-number 65002\nconfigure bgp routerid 1.1.1.9\nenable bgp\n\ncreate bgp neighbor 1.1.1.3 remote-AS-number 65002\nconfigure bgp neighbor 1.1.1.3 source-interface ipaddress 1.1.1.9\nenable bgp neighbor 1.1.1.3\n\ncreate bgp neighbor 1.1.1.4 remote-AS-number 65002\nconfigure bgp neighbor 1.1.1.4 source-interface ipaddress 1.1.1.9\nenable bgp neighbor 1.1.1.4\n\nconfigure bgp add network 10.2.2.0\/24\n\nconfigure ospf routerid 1.1.1.9\nenable ospf\nconfigure ospf add vlan RH-RC area 0.0.0.0 link-type point-to-point\nconfigure ospf add vlan RH-RD area 0.0.0.0 link-type point-to-point\nconfigure ospf add vlan RouterH-LP area 0.0.0.0 passive\n<\/code><\/pre>\n\n\n\nWith the environment ready, we can now work through some tests and further configuration.<\/p>\n\n\n\n
Step 2 – Verify<\/h1>\n\n\n\n
We need to verify that OSPF is working on the AS Green (65002) Autonomous System, we’re using OSPF to carry around the routes for the underlying network, that needed by iBGP. We then need to verify BGP neighbour (peers) are all working as expected. Then finally we can do some connection tests.<\/p>\n\n\n\n
OSPF<\/h2>\n\n\n\n
Run the following on each of the Routers in AS Green, so Router C, Router D and Router H, and ensure each has a FULL session with the other two routers.<\/p>\n\n\n\n
* tris-routerH.77 # show ospf neighbor\nNeighbor ID Pri State Up\/Dead Time Address Interface\n BFD Session State\n==========================================================================================\n1.1.1.3 1 FULL \/DROTHER 00:00:18:28\/00:00:00:04 192.168.100.17 RH-RC\n None\n\n1.1.1.4 1 FULL \/DROTHER 00:00:18:28\/00:00:00:05 192.168.100.21 RH-RD\n None\n\nTotal number of neighbors: 2 (All neighbors in Full state)<\/code><\/pre>\n\n\n\nRemember both ends will show as DROTHER because we’ve configured point-to-point links, which means there are no DR or BDR.<\/p>\n\n\n\n
BGP<\/h2>\n\n\n\n
Run the following on each of the Routers in AS Green, so Router C, Router D and Router H, and ensure each has an ESTABLISHED session with the other two routers. And on Router C and Router D, it should also have an eBGP session to Router A and Router B (respectively) in the other AS (AS Blue).<\/p>\n\n\n\n
* tris-routerH.79 # show bgp neighbor\n\n Peer AS Weight State InMsgs OutMsgs(InQ) Up\/Down\n-----------------------------------------------------------------------------------\nIe-- 1.1.1.3 65002 1 ESTABLISHED 31 27 (0 ) 0:0:22:14\nIe-- 1.1.1.4 65002 1 ESTABLISHED 29 28 (0 ) 0:0:22:43\n\nFlags: (d) disabled, (e) enabled, (E) external peer, (I) internal peer\n (m) EBGP multihop, (r) route reflector client\n\nBGP Peer Statistics\n Total Peers : 2\n EBGP Peers : 0 IBGP Peers : 2\n RR Client : 0 EBGP Multihop : 0\n Enabled : 2 Disabled : 0<\/code><\/pre>\n\n\n\nConnectivity Test<\/h2>\n\n\n\n
Now let’s perform a test. We’ll ping from RouterG-LAN1 VLAN interface (10.1.2.1) to the RouterH-LAN1 VLAN interface (10.2.2.1), we should find this works fine, because Router G will have learnt the route to RouterH-LAN1 (10.2.2.0\/24) from either Router A or Router B (infact both), and these will have learnt the routes from either Router C or Router D (infact both), which in turn would have learnt this route from Router H itself; all via BGP.<\/p>\n\n\n\n
* tris-routerG.1 # ping 10.2.2.1 from 10.1.2.1\nPing(ICMP) 10.2.2.1: 4 packets, 8 data bytes, interval 1 second(s).\n16 bytes from 10.2.2.1: icmp_seq=0 ttl=62 time=1.297 ms\n16 bytes from 10.2.2.1: icmp_seq=1 ttl=62 time=1.062 ms\n16 bytes from 10.2.2.1: icmp_seq=2 ttl=62 time=1.014 ms\n16 bytes from 10.2.2.1: icmp_seq=3 ttl=62 time=1.043 ms\n\n--- 10.2.2.1 ping statistics ---\n4 packets transmitted, 4 packets received, 0% loss\nround-trip min\/avg\/max = 1\/1\/1 ms<\/code><\/pre>\n\n\n\nThen let’s run a traceroute to see which way the traffic is going across the network.<\/p>\n\n\n\n
* tris-routerG.2 # traceroute 10.2.2.1 from 10.1.2.1\ntraceroute to 10.2.2.1, 30 hops max\n 1 192.168.100.1 5 ms 4 ms 3 ms\n 2 192.168.100.10 0 ms 0 ms 0 ms\n 3 10.2.2.1 1 ms 4 ms 0 ms\n\n--- Packet Response\/Error Flags ---\n (*) No response, (!N) ICMP network unreachable, (!H) ICMP host unreachable,\n (!P) ICMP protocol unreachable, (!F) ICMP fragmentation needed,\n (!S) ICMP source route failed, (!u) Transmit error, network unreachable,\n (!f) Transmit error, fragmentation needed, (!t) General transmit error<\/code><\/pre>\n\n\n\nExamining the network diagram, we can see that the traffic is going from: Router G \u2192 Router A (192.168.100.1) \u2192 Router C (192.168.100.10) \u2192 Router H (10.2.2.1)<\/strong>.<\/p>\n\n\n\nExamine Route Tables<\/h2>\n\n\n\n
If we now check the route tables on the AS Green, we should see lots of routes showing, notice we should not be seeing any OSPF routes for the point to point links between routers in AS Blue when viewed from AS Green (and vice versa); these OSPF routes are only for within the AS and are only there to facilitate the underlying infrastructure that BGP depends on, namely the Loopback addresses.<\/p>\n\n\n\n
Checking on Router H, we can see the routes labeled with “bi” are the ones learnt via iBGP, from the local AS (Green), but also from the remote AS (Blue).<\/p>\n\n\n\n
* tris-routerH.80 # show iproute\nOri Destination Gateway Mtr Flags VLAN Duration\n#oa 1.1.1.3\/32 192.168.100.17 12 UG-D---um--f- RH-RC 0d:0h:31m:33s\n#oa 1.1.1.4\/32 192.168.100.21 12 UG-D---um--f- RH-RD 0d:0h:31m:28s\n#d 1.1.1.9\/32 1.1.1.9 1 U------um--f- RouterH-LP 0d:0h:36m:45s\n#bi 10.1.0.0\/24 192.168.100.17 1 UG-D---um--f- RH-RC 0d:0h:11m:1s\n#bi 10.1.1.0\/24 192.168.100.17 1 UG-D---um--f- RH-RC 0d:0h:11m:1s\n#bi 10.1.2.0\/24 192.168.100.17 1 UG-D---um--f- RH-RC 0d:0h:11m:1s\n#bi 10.2.0.0\/24 192.168.100.17 0 UG-D---um--f- RH-RC 0d:0h:30m:14s\n#bi 10.2.1.0\/24 192.168.100.21 0 UG-D---um--f- RH-RD 0d:0h:19m:28s\n#d 10.2.2.0\/24 10.2.2.1 1 U------um--f- RouterH-LAN1 0d:0h:36m:39s\n#oa 192.168.100.8\/30 192.168.100.17 4 UG-D---um--f- RH-RC 0d:0h:11m:33s\n#oa 192.168.100.12\/30 192.168.100.21 4 UG-D---um--f- RH-RD 0d:0h:31m:28s\n#d 192.168.100.16\/30 192.168.100.18 1 U------um--f- RH-RC 0d:0h:33m:18s\n#d 192.168.100.20\/30 192.168.100.22 1 U------um--f- RH-RD 0d:0h:33m:13s\n#oa 192.168.100.28\/30 192.168.100.17 4 UG-D---um--f- RH-RC 0d:0h:31m:33s\n#oa 192.168.100.28\/30 192.168.100.21 4 UG-D---um---- RH-RD 0d:0h:31m:28s\n\n (mo) MOSPF (o) OSPF, (o1) OSPFExt1, (o2) OSPFExt2,\n (oa) OSPFIntra, (oe) OSPFAsExt, (or) OSPFInter, (pd) PIM-DM, (ps) PIM-SM,\n (r) RIP, (ra) RtAdvrt, (s) Static, (sv) SLB_VIP, (hm) Host-mobility, (un) UnKnown,\n (*) Preferred unicast route (@) Preferred multicast route,\n (#) Preferred unicast and multicast route.\n\nFlags: (b) BFD protection requested, (B) BlackHole, (c) Compressed, (D) Dynamic,\n (f) Provided to FIB, (G) Gateway, (H) Host Route,\n (I) ICMP ping protection requested, (l) Calculated LDP LSP,\n (L) Matching LDP LSP, (m) Multicast, (p) BFD protection active,\n (P) LPM-routing, (R) Modified, (s) Static LSP, (S) Static,\n (t) Calculated RSVP-TE LSP, (T) Matching RSVP-TE LSP, (u) Unicast,\n (U) Up, (3) L3VPN Route.\n\nMPLS Label: (S) Bottom of Label Stack\nMask distribution:\n 6 routes at length 24 6 routes at length 30\n 3 routes at length 32\n\nRoute Origin distribution:\n 4 routes from Direct 6 routes from OSPFIntra\n 5 routes from IBGP\n\nTotal number of routes = 15\nTotal number of compressed routes = 0<\/code><\/pre>\n\n\n\nIf we then check the BGP routes, we see something interesting and expected. Looking at Router H, we can see that the networks in AS Blue, i.e. 10.1.0.0\/16<\/strong>, so within that 10.1.0.0\/24<\/strong>, 10.1.1.0\/24<\/strong> and 10.1.2.0\/24<\/strong> are all showing up with two routes, which makes sense. Router H has two routes to these networks via Router C and Router D.<\/p>\n\n\n\nWe’ll explore this in more detail in the next step.<\/p>\n\n\n\n
Step 3 – Link Failure Router C to Router A<\/h1>\n\n\n\n
Previous to this most recent configuration, if the link between Router C and Router A were to fail, the connectivity between the two AS would have been disrupted, now however, with the newly added Router D and its additional links, there exists the posibility for multiple routes through the network, so let’s try this. <\/p>\n\n\n\n
We’re going to down the link between Router A and Router C. So previously if RouterG-LAN1 (10.1.2.0\/24)<\/strong> wanted to talk to RouterH-LAN1 (10.2.2.0\/24)<\/strong> the path would have been: Router G \u2192 Router A (192.168.100.1) \u2192 Router C (192.168.100.10) \u2192 Router H (10.2.2.1). <\/strong>Output is shown below, some content omitted for brevity.<\/p>\n\n\n\nBefore Link Failure<\/h2>\n\n\n\n* tris-routerG.1 # traceroute 10.2.2.1 from 10.1.2.1\ntraceroute to 10.2.2.1, 30 hops max\n 1 192.168.100.1 1 ms 1 ms 1 ms\n 2 192.168.100.10 1 ms 5 ms 0 ms\n 3 10.2.2.1 1 ms 1 ms 1 ms\n\n...<\/code><\/pre>\n\n\n\n* tris-routerG.2 # show bgp routes all\n\nRoutes:\n Destination Peer Next-Hop LPref Weight MED AS-Path\n----------------------------------------------------------------------------------------\n*>i 10.1.0.0\/24 1.1.1.1 1.1.1.1 100 1 0\n*>i 10.1.1.0\/24 1.1.1.2 1.1.1.2 100 1 0\n*>i 10.2.0.0\/24 1.1.1.1 192.168.100.10 100 1 0 65002\n i 10.2.0.0\/24 1.1.1.2 192.168.100.14 100 1 0 65002\n*>i 10.2.1.0\/24 1.1.1.1 192.168.100.10 100 1 0 65002\n i 10.2.1.0\/24 1.1.1.2 192.168.100.14 100 1 0 65002\n*>i 10.2.2.0\/24 1.1.1.1 192.168.100.10 100 1 0 65002\n i 10.2.2.0\/24 1.1.1.2 192.168.100.14 100 1 0 65002\n\nFlags: (*) Preferred BGP route, (>) Active, (d) Suppressed, (h) History\n (s) Stale, (m) Multipath, (u) Unfeasible\n\nOrigin: (?) Incomplete, (e) EGP, (i) IGP\n\n...<\/code><\/pre>\n\n\n\nAfter Link Failure<\/p>\n\n\n\n
* tris-routerG.3 # traceroute 10.2.2.1 from 10.1.2.1\ntraceroute to 10.2.2.1, 30 hops max\n 1 192.168.100.5 4 ms 5 ms 6 ms\n 2 192.168.100.14 6 ms 0 ms 0 ms\n 3 10.2.2.1 5 ms 5 ms 0 ms<\/code><\/pre>\n\n\n\n* tris-routerG.4 # show bgp routes all\n\nRoutes:\n Destination Peer Next-Hop LPref Weight MED AS-Path\n----------------------------------------------------------------------------------------\n*>i 10.1.0.0\/24 1.1.1.1 1.1.1.1 100 1 0\n*>i 10.1.1.0\/24 1.1.1.2 1.1.1.2 100 1 0\n*>i 10.2.0.0\/24 1.1.1.2 192.168.100.14 100 1 0 65002\n*>i 10.2.1.0\/24 1.1.1.2 192.168.100.14 100 1 0 65002\n*>i 10.2.2.0\/24 1.1.1.2 192.168.100.14 100 1 0 65002\n\nFlags: (*) Preferred BGP route, (>) Active, (d) Suppressed, (h) History\n (s) Stale, (m) Multipath, (u) Unfeasible\n\nOrigin: (?) Incomplete, (e) EGP, (i) IGP<\/code><\/pre>\n\n\n\nWe can see now that a different path\/route through the network is being taken; and the previously secondary routes in the BGP route table are now the primaries!<\/p>\n\n\n\n
Re-enable the link ready for the next article and further testing.<\/p>\n\n\n\n
Conclusion<\/h1>\n\n\n\n
Now we have built some additional configuration into the network, we have what we need to explore how we can manipulate the routing between AS Blue and AS Green.<\/p>\n\n\n\n
\n- Why does the traffic sent from Router G flow via Router A and Router C on its way to Router H?<\/li>\n\n\n\n
- Why does it not use Router B and Router D instead, those are both the same number of hops, same Routers, same speed links?<\/li>\n\n\n\n
- Why is it when the link between Router A and Router C is unavailable that there are not still two routes, i.e. Router G \u2192 Router A \u2192 Router B \u2192 Router D \u2192 Router H, sure its not very direct, but its still another option!<\/li>\n\n\n\n
- How can we maniupulate this to what we want it to be?<\/li>\n<\/ul>\n","protected":false},"excerpt":{"rendered":"
In the previous article we got our AS Blue 65001 operating as we want it, now we crank up the complexity with a more complex example which is more like you’d find or want to architect in real world scenario. Previously our AS Blue 65001 only had a single exit point to AS Green 65002, … Read more<\/a><\/p>\n","protected":false},"author":4,"featured_media":4783,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[62,41,17],"tags":[],"class_list":["post-4896","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-bgp","category-extreme-networks","category-networking"],"_links":{"self":[{"href":"https:\/\/geekmungus.co.uk\/index.php?rest_route=\/wp\/v2\/posts\/4896","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/geekmungus.co.uk\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/geekmungus.co.uk\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/geekmungus.co.uk\/index.php?rest_route=\/wp\/v2\/users\/4"}],"replies":[{"embeddable":true,"href":"https:\/\/geekmungus.co.uk\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=4896"}],"version-history":[{"count":2,"href":"https:\/\/geekmungus.co.uk\/index.php?rest_route=\/wp\/v2\/posts\/4896\/revisions"}],"predecessor-version":[{"id":4899,"href":"https:\/\/geekmungus.co.uk\/index.php?rest_route=\/wp\/v2\/posts\/4896\/revisions\/4899"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/geekmungus.co.uk\/index.php?rest_route=\/wp\/v2\/media\/4783"}],"wp:attachment":[{"href":"https:\/\/geekmungus.co.uk\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=4896"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/geekmungus.co.uk\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=4896"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/geekmungus.co.uk\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=4896"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
create vlan \"RB-RD\"\nconfigure vlan \"RB-RD\" ipaddress 192.168.100.13\/30\nenable ipforwarding vlan \"RB-RD\"\nconfigure vlan \"RB-RD\" add port 3 untagged\n\ncreate bgp neighbor 192.168.100.14 remote-AS-number 65002\nconfigure bgp neighbor 192.168.100.14 source-interface ipaddress 192.168.100.13\nenable bgp neighbor 192.168.100.14\n\nconfigure ospf add vlan RB-RD area 0.0.0.0 passive<\/code><\/pre>\n\n\n\nRouter C<\/h2>\n\n\n\ncreate vlan \"RC-RD\"\nconfigure vlan \"RC-RD\" ipaddress 192.168.100.29\/30\nenable ipforwarding vlan \"RC-RD\"\nconfigure vlan \"RC-RD\" add port 2 untagged\n\ncreate vlan \"RC-RH\"\nconfigure vlan \"RC-RH\" ipaddress 192.168.100.17\/30\nenable ipforwarding vlan \"RC-RH\"\nconfigure vlan \"RC-RH\" add port 4 untagged\n\ncreate bgp neighbor 1.1.1.4 remote-AS-number 65002\nconfigure bgp neighbor 1.1.1.4 source-interface ipaddress 1.1.1.3\nenable bgp neighbor 1.1.1.4\n\ncreate bgp neighbor 1.1.1.9 remote-AS-number 65002\nconfigure bgp neighbor 1.1.1.9 source-interface ipaddress 1.1.1.3\nenable bgp neighbor 1.1.1.9\n\nconfigure ospf routerid 1.1.1.3\nenable ospf\nconfigure ospf add vlan RC-RA area 0.0.0.0 passive\nconfigure ospf add vlan RC-RD area 0.0.0.0 link-type point-to-point\nconfigure ospf add vlan RC-RH area 0.0.0.0 link-type point-to-point \nconfigure ospf add vlan RouterC-LP area 0.0.0.0 passive\n<\/code><\/pre>\n\n\n\nNote: that although OSPF is being enabled on the interface going to Router A (in the other AS), we are not using OSPF for the exchange of any routes between the two AS, we don’t need to and if we did this would defeat the point of using BGP in the first place! OSPF is only there to move the routes needed as the underlay network around within the AS to support the use of BGP (specifically iBGP).<\/p>\n\n\n\n
Router D<\/h2>\n\n\n\ncreate vlan \"RD-RB\"\nconfigure vlan \"RD-RB\" ipaddress 192.168.100.14\/30\nenable ipforwarding vlan \"RD-RB\"\nconfigure vlan \"RD-RB\" add port 3 untagged\n\ncreate vlan \"RD-RC\"\nconfigure vlan \"RD-RC\" ipaddress 192.168.100.30\/30\nenable ipforwarding vlan \"RD-RC\"\nconfigure vlan \"RD-RC\" add port 2 untagged\n\ncreate vlan \"RD-RH\"\nconfigure vlan \"RD-RH\" ipaddress 192.168.100.21\/30\nenable ipforwarding vlan \"RD-RH\"\nconfigure vlan \"RD-RH\" add port 4 untagged\n\ncreate vlan \"RouterD-LP\"\nconfigure vlan RouterD-LP tag 1114\nenable loopback-mode vlan RouterD-LP\nconfigure vlan RouterD-LP ipaddress 1.1.1.4 255.255.255.255\nenable ipforwarding vlan RouterD-LP\n\ncreate vlan \"RouterD-LAN1\" tag 1005\nconfigure vlan \"RouterD-LAN1\" ipaddress 10.2.1.1\/24\nenable ipforwarding \"RouterD-LAN1\"\nenable loopback-mode vlan \"RouterD-LAN1\"\n\nconfigure bgp AS-number 65002\nconfigure bgp routerid 1.1.1.4\nenable bgp\n\ncreate bgp neighbor 192.168.100.13 remote-AS-number 65001\nconfigure bgp neighbor 192.168.100.13 source-interface ipaddress 192.168.100.14\nenable bgp neighbor 192.168.100.13\n\ncreate bgp neighbor 1.1.1.3 remote-AS-number 65002\nconfigure bgp neighbor 1.1.1.3 source-interface ipaddress 1.1.1.4\nenable bgp neighbor 1.1.1.3\n\ncreate bgp neighbor 1.1.1.9 remote-AS-number 65002\nconfigure bgp neighbor 1.1.1.9 source-interface ipaddress 1.1.1.4\nenable bgp neighbor 1.1.1.9\n\nconfigure bgp add network 10.2.1.0\/24\n\nconfigure ospf routerid 1.1.1.4\nenable ospf\nconfigure ospf add vlan RD-RB area 0.0.0.0 passive\nconfigure ospf add vlan RD-RC area 0.0.0.0 link-type point-to-point\nconfigure ospf add vlan RD-RH area 0.0.0.0 link-type point-to-point \nconfigure ospf add vlan RouterD-LP area 0.0.0.0 passive<\/code><\/pre>\n\n\n\nNote: that although OSPF is being enabled on the interface going to Router A (in the other AS), we are not using OSPF for the exchange of any routes between the two AS, we don’t need to and if we did this would defeat the point of using BGP in the first place! OSPF is only there to move the routes needed as the underlay network around within the AS to support the use of BGP (specifically iBGP).<\/p>\n\n\n\n
Router H<\/h2>\n\n\n\ncreate vlan \"RH-RC\"\nconfigure vlan \"RH-RC\" ipaddress 192.168.100.18\/30\nenable ipforwarding vlan \"RH-RC\"\nconfigure vlan \"RH-RC\" add port 2 untagged\n\ncreate vlan \"RH-RD\"\nconfigure vlan \"RH-RD\" ipaddress 192.168.100.22\/30\nenable ipforwarding vlan \"RH-RD\"\nconfigure vlan \"RH-RD\" add port 1 untagged\n\ncreate vlan \"RouterH-LP\"\nconfigure vlan RouterH-LP tag 1119\nenable loopback-mode vlan RouterH-LP\nconfigure vlan RouterH-LP ipaddress 1.1.1.9 255.255.255.255\nenable ipforwarding vlan RouterH-LP\n\ncreate vlan \"RouterH-LAN1\" tag 1006\nconfigure vlan \"RouterH-LAN1\" ipaddress 10.2.2.1\/24\nenable ipforwarding \"RouterH-LAN1\"\nenable loopback-mode vlan \"RouterH-LAN1\"\n\nconfigure bgp AS-number 65002\nconfigure bgp routerid 1.1.1.9\nenable bgp\n\ncreate bgp neighbor 1.1.1.3 remote-AS-number 65002\nconfigure bgp neighbor 1.1.1.3 source-interface ipaddress 1.1.1.9\nenable bgp neighbor 1.1.1.3\n\ncreate bgp neighbor 1.1.1.4 remote-AS-number 65002\nconfigure bgp neighbor 1.1.1.4 source-interface ipaddress 1.1.1.9\nenable bgp neighbor 1.1.1.4\n\nconfigure bgp add network 10.2.2.0\/24\n\nconfigure ospf routerid 1.1.1.9\nenable ospf\nconfigure ospf add vlan RH-RC area 0.0.0.0 link-type point-to-point\nconfigure ospf add vlan RH-RD area 0.0.0.0 link-type point-to-point\nconfigure ospf add vlan RouterH-LP area 0.0.0.0 passive\n<\/code><\/pre>\n\n\n\nWith the environment ready, we can now work through some tests and further configuration.<\/p>\n\n\n\n
Step 2 – Verify<\/h1>\n\n\n\n
We need to verify that OSPF is working on the AS Green (65002) Autonomous System, we’re using OSPF to carry around the routes for the underlying network, that needed by iBGP. We then need to verify BGP neighbour (peers) are all working as expected. Then finally we can do some connection tests.<\/p>\n\n\n\n
OSPF<\/h2>\n\n\n\n
Run the following on each of the Routers in AS Green, so Router C, Router D and Router H, and ensure each has a FULL session with the other two routers.<\/p>\n\n\n\n
* tris-routerH.77 # show ospf neighbor\nNeighbor ID Pri State Up\/Dead Time Address Interface\n BFD Session State\n==========================================================================================\n1.1.1.3 1 FULL \/DROTHER 00:00:18:28\/00:00:00:04 192.168.100.17 RH-RC\n None\n\n1.1.1.4 1 FULL \/DROTHER 00:00:18:28\/00:00:00:05 192.168.100.21 RH-RD\n None\n\nTotal number of neighbors: 2 (All neighbors in Full state)<\/code><\/pre>\n\n\n\nRemember both ends will show as DROTHER because we’ve configured point-to-point links, which means there are no DR or BDR.<\/p>\n\n\n\n
BGP<\/h2>\n\n\n\n
Run the following on each of the Routers in AS Green, so Router C, Router D and Router H, and ensure each has an ESTABLISHED session with the other two routers. And on Router C and Router D, it should also have an eBGP session to Router A and Router B (respectively) in the other AS (AS Blue).<\/p>\n\n\n\n
* tris-routerH.79 # show bgp neighbor\n\n Peer AS Weight State InMsgs OutMsgs(InQ) Up\/Down\n-----------------------------------------------------------------------------------\nIe-- 1.1.1.3 65002 1 ESTABLISHED 31 27 (0 ) 0:0:22:14\nIe-- 1.1.1.4 65002 1 ESTABLISHED 29 28 (0 ) 0:0:22:43\n\nFlags: (d) disabled, (e) enabled, (E) external peer, (I) internal peer\n (m) EBGP multihop, (r) route reflector client\n\nBGP Peer Statistics\n Total Peers : 2\n EBGP Peers : 0 IBGP Peers : 2\n RR Client : 0 EBGP Multihop : 0\n Enabled : 2 Disabled : 0<\/code><\/pre>\n\n\n\nConnectivity Test<\/h2>\n\n\n\n
Now let’s perform a test. We’ll ping from RouterG-LAN1 VLAN interface (10.1.2.1) to the RouterH-LAN1 VLAN interface (10.2.2.1), we should find this works fine, because Router G will have learnt the route to RouterH-LAN1 (10.2.2.0\/24) from either Router A or Router B (infact both), and these will have learnt the routes from either Router C or Router D (infact both), which in turn would have learnt this route from Router H itself; all via BGP.<\/p>\n\n\n\n
* tris-routerG.1 # ping 10.2.2.1 from 10.1.2.1\nPing(ICMP) 10.2.2.1: 4 packets, 8 data bytes, interval 1 second(s).\n16 bytes from 10.2.2.1: icmp_seq=0 ttl=62 time=1.297 ms\n16 bytes from 10.2.2.1: icmp_seq=1 ttl=62 time=1.062 ms\n16 bytes from 10.2.2.1: icmp_seq=2 ttl=62 time=1.014 ms\n16 bytes from 10.2.2.1: icmp_seq=3 ttl=62 time=1.043 ms\n\n--- 10.2.2.1 ping statistics ---\n4 packets transmitted, 4 packets received, 0% loss\nround-trip min\/avg\/max = 1\/1\/1 ms<\/code><\/pre>\n\n\n\nThen let’s run a traceroute to see which way the traffic is going across the network.<\/p>\n\n\n\n
* tris-routerG.2 # traceroute 10.2.2.1 from 10.1.2.1\ntraceroute to 10.2.2.1, 30 hops max\n 1 192.168.100.1 5 ms 4 ms 3 ms\n 2 192.168.100.10 0 ms 0 ms 0 ms\n 3 10.2.2.1 1 ms 4 ms 0 ms\n\n--- Packet Response\/Error Flags ---\n (*) No response, (!N) ICMP network unreachable, (!H) ICMP host unreachable,\n (!P) ICMP protocol unreachable, (!F) ICMP fragmentation needed,\n (!S) ICMP source route failed, (!u) Transmit error, network unreachable,\n (!f) Transmit error, fragmentation needed, (!t) General transmit error<\/code><\/pre>\n\n\n\nExamining the network diagram, we can see that the traffic is going from: Router G \u2192 Router A (192.168.100.1) \u2192 Router C (192.168.100.10) \u2192 Router H (10.2.2.1)<\/strong>.<\/p>\n\n\n\nExamine Route Tables<\/h2>\n\n\n\n
If we now check the route tables on the AS Green, we should see lots of routes showing, notice we should not be seeing any OSPF routes for the point to point links between routers in AS Blue when viewed from AS Green (and vice versa); these OSPF routes are only for within the AS and are only there to facilitate the underlying infrastructure that BGP depends on, namely the Loopback addresses.<\/p>\n\n\n\n
Checking on Router H, we can see the routes labeled with “bi” are the ones learnt via iBGP, from the local AS (Green), but also from the remote AS (Blue).<\/p>\n\n\n\n
* tris-routerH.80 # show iproute\nOri Destination Gateway Mtr Flags VLAN Duration\n#oa 1.1.1.3\/32 192.168.100.17 12 UG-D---um--f- RH-RC 0d:0h:31m:33s\n#oa 1.1.1.4\/32 192.168.100.21 12 UG-D---um--f- RH-RD 0d:0h:31m:28s\n#d 1.1.1.9\/32 1.1.1.9 1 U------um--f- RouterH-LP 0d:0h:36m:45s\n#bi 10.1.0.0\/24 192.168.100.17 1 UG-D---um--f- RH-RC 0d:0h:11m:1s\n#bi 10.1.1.0\/24 192.168.100.17 1 UG-D---um--f- RH-RC 0d:0h:11m:1s\n#bi 10.1.2.0\/24 192.168.100.17 1 UG-D---um--f- RH-RC 0d:0h:11m:1s\n#bi 10.2.0.0\/24 192.168.100.17 0 UG-D---um--f- RH-RC 0d:0h:30m:14s\n#bi 10.2.1.0\/24 192.168.100.21 0 UG-D---um--f- RH-RD 0d:0h:19m:28s\n#d 10.2.2.0\/24 10.2.2.1 1 U------um--f- RouterH-LAN1 0d:0h:36m:39s\n#oa 192.168.100.8\/30 192.168.100.17 4 UG-D---um--f- RH-RC 0d:0h:11m:33s\n#oa 192.168.100.12\/30 192.168.100.21 4 UG-D---um--f- RH-RD 0d:0h:31m:28s\n#d 192.168.100.16\/30 192.168.100.18 1 U------um--f- RH-RC 0d:0h:33m:18s\n#d 192.168.100.20\/30 192.168.100.22 1 U------um--f- RH-RD 0d:0h:33m:13s\n#oa 192.168.100.28\/30 192.168.100.17 4 UG-D---um--f- RH-RC 0d:0h:31m:33s\n#oa 192.168.100.28\/30 192.168.100.21 4 UG-D---um---- RH-RD 0d:0h:31m:28s\n\n (mo) MOSPF (o) OSPF, (o1) OSPFExt1, (o2) OSPFExt2,\n (oa) OSPFIntra, (oe) OSPFAsExt, (or) OSPFInter, (pd) PIM-DM, (ps) PIM-SM,\n (r) RIP, (ra) RtAdvrt, (s) Static, (sv) SLB_VIP, (hm) Host-mobility, (un) UnKnown,\n (*) Preferred unicast route (@) Preferred multicast route,\n (#) Preferred unicast and multicast route.\n\nFlags: (b) BFD protection requested, (B) BlackHole, (c) Compressed, (D) Dynamic,\n (f) Provided to FIB, (G) Gateway, (H) Host Route,\n (I) ICMP ping protection requested, (l) Calculated LDP LSP,\n (L) Matching LDP LSP, (m) Multicast, (p) BFD protection active,\n (P) LPM-routing, (R) Modified, (s) Static LSP, (S) Static,\n (t) Calculated RSVP-TE LSP, (T) Matching RSVP-TE LSP, (u) Unicast,\n (U) Up, (3) L3VPN Route.\n\nMPLS Label: (S) Bottom of Label Stack\nMask distribution:\n 6 routes at length 24 6 routes at length 30\n 3 routes at length 32\n\nRoute Origin distribution:\n 4 routes from Direct 6 routes from OSPFIntra\n 5 routes from IBGP\n\nTotal number of routes = 15\nTotal number of compressed routes = 0<\/code><\/pre>\n\n\n\nIf we then check the BGP routes, we see something interesting and expected. Looking at Router H, we can see that the networks in AS Blue, i.e. 10.1.0.0\/16<\/strong>, so within that 10.1.0.0\/24<\/strong>, 10.1.1.0\/24<\/strong> and 10.1.2.0\/24<\/strong> are all showing up with two routes, which makes sense. Router H has two routes to these networks via Router C and Router D.<\/p>\n\n\n\nWe’ll explore this in more detail in the next step.<\/p>\n\n\n\n
Step 3 – Link Failure Router C to Router A<\/h1>\n\n\n\n
Previous to this most recent configuration, if the link between Router C and Router A were to fail, the connectivity between the two AS would have been disrupted, now however, with the newly added Router D and its additional links, there exists the posibility for multiple routes through the network, so let’s try this. <\/p>\n\n\n\n
We’re going to down the link between Router A and Router C. So previously if RouterG-LAN1 (10.1.2.0\/24)<\/strong> wanted to talk to RouterH-LAN1 (10.2.2.0\/24)<\/strong> the path would have been: Router G \u2192 Router A (192.168.100.1) \u2192 Router C (192.168.100.10) \u2192 Router H (10.2.2.1). <\/strong>Output is shown below, some content omitted for brevity.<\/p>\n\n\n\nBefore Link Failure<\/h2>\n\n\n\n* tris-routerG.1 # traceroute 10.2.2.1 from 10.1.2.1\ntraceroute to 10.2.2.1, 30 hops max\n 1 192.168.100.1 1 ms 1 ms 1 ms\n 2 192.168.100.10 1 ms 5 ms 0 ms\n 3 10.2.2.1 1 ms 1 ms 1 ms\n\n...<\/code><\/pre>\n\n\n\n* tris-routerG.2 # show bgp routes all\n\nRoutes:\n Destination Peer Next-Hop LPref Weight MED AS-Path\n----------------------------------------------------------------------------------------\n*>i 10.1.0.0\/24 1.1.1.1 1.1.1.1 100 1 0\n*>i 10.1.1.0\/24 1.1.1.2 1.1.1.2 100 1 0\n*>i 10.2.0.0\/24 1.1.1.1 192.168.100.10 100 1 0 65002\n i 10.2.0.0\/24 1.1.1.2 192.168.100.14 100 1 0 65002\n*>i 10.2.1.0\/24 1.1.1.1 192.168.100.10 100 1 0 65002\n i 10.2.1.0\/24 1.1.1.2 192.168.100.14 100 1 0 65002\n*>i 10.2.2.0\/24 1.1.1.1 192.168.100.10 100 1 0 65002\n i 10.2.2.0\/24 1.1.1.2 192.168.100.14 100 1 0 65002\n\nFlags: (*) Preferred BGP route, (>) Active, (d) Suppressed, (h) History\n (s) Stale, (m) Multipath, (u) Unfeasible\n\nOrigin: (?) Incomplete, (e) EGP, (i) IGP\n\n...<\/code><\/pre>\n\n\n\nAfter Link Failure<\/p>\n\n\n\n
* tris-routerG.3 # traceroute 10.2.2.1 from 10.1.2.1\ntraceroute to 10.2.2.1, 30 hops max\n 1 192.168.100.5 4 ms 5 ms 6 ms\n 2 192.168.100.14 6 ms 0 ms 0 ms\n 3 10.2.2.1 5 ms 5 ms 0 ms<\/code><\/pre>\n\n\n\n* tris-routerG.4 # show bgp routes all\n\nRoutes:\n Destination Peer Next-Hop LPref Weight MED AS-Path\n----------------------------------------------------------------------------------------\n*>i 10.1.0.0\/24 1.1.1.1 1.1.1.1 100 1 0\n*>i 10.1.1.0\/24 1.1.1.2 1.1.1.2 100 1 0\n*>i 10.2.0.0\/24 1.1.1.2 192.168.100.14 100 1 0 65002\n*>i 10.2.1.0\/24 1.1.1.2 192.168.100.14 100 1 0 65002\n*>i 10.2.2.0\/24 1.1.1.2 192.168.100.14 100 1 0 65002\n\nFlags: (*) Preferred BGP route, (>) Active, (d) Suppressed, (h) History\n (s) Stale, (m) Multipath, (u) Unfeasible\n\nOrigin: (?) Incomplete, (e) EGP, (i) IGP<\/code><\/pre>\n\n\n\nWe can see now that a different path\/route through the network is being taken; and the previously secondary routes in the BGP route table are now the primaries!<\/p>\n\n\n\n
Re-enable the link ready for the next article and further testing.<\/p>\n\n\n\n
Conclusion<\/h1>\n\n\n\n
Now we have built some additional configuration into the network, we have what we need to explore how we can manipulate the routing between AS Blue and AS Green.<\/p>\n\n\n\n
\n- Why does the traffic sent from Router G flow via Router A and Router C on its way to Router H?<\/li>\n\n\n\n
- Why does it not use Router B and Router D instead, those are both the same number of hops, same Routers, same speed links?<\/li>\n\n\n\n
- Why is it when the link between Router A and Router C is unavailable that there are not still two routes, i.e. Router G \u2192 Router A \u2192 Router B \u2192 Router D \u2192 Router H, sure its not very direct, but its still another option!<\/li>\n\n\n\n
- How can we maniupulate this to what we want it to be?<\/li>\n<\/ul>\n","protected":false},"excerpt":{"rendered":"
In the previous article we got our AS Blue 65001 operating as we want it, now we crank up the complexity with a more complex example which is more like you’d find or want to architect in real world scenario. Previously our AS Blue 65001 only had a single exit point to AS Green 65002, … Read more<\/a><\/p>\n","protected":false},"author":4,"featured_media":4783,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[62,41,17],"tags":[],"class_list":["post-4896","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-bgp","category-extreme-networks","category-networking"],"_links":{"self":[{"href":"https:\/\/geekmungus.co.uk\/index.php?rest_route=\/wp\/v2\/posts\/4896","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/geekmungus.co.uk\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/geekmungus.co.uk\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/geekmungus.co.uk\/index.php?rest_route=\/wp\/v2\/users\/4"}],"replies":[{"embeddable":true,"href":"https:\/\/geekmungus.co.uk\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=4896"}],"version-history":[{"count":2,"href":"https:\/\/geekmungus.co.uk\/index.php?rest_route=\/wp\/v2\/posts\/4896\/revisions"}],"predecessor-version":[{"id":4899,"href":"https:\/\/geekmungus.co.uk\/index.php?rest_route=\/wp\/v2\/posts\/4896\/revisions\/4899"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/geekmungus.co.uk\/index.php?rest_route=\/wp\/v2\/media\/4783"}],"wp:attachment":[{"href":"https:\/\/geekmungus.co.uk\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=4896"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/geekmungus.co.uk\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=4896"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/geekmungus.co.uk\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=4896"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}