BGP

#########BGP ########
###############Transiting Non-BGP Speaking Devices ###########
Method 1: Redistribute BGP into IGP at the EBGP boundaries
Method 2: Create a GRE tunnel encompassing the NON BGP speaker. ibGP between the TUnnel end points to peer using the GRE Tunnel ip addresses

Method 1: NOTE: All IGP peers (EIGRP/OSPF) will see the redistributed BGP routes, ==> over 2,00,000 Internet routes
Method 2: NOTE: All IGP peers will not see the BGP routes

weight: can be applied on the neighbor stmt or via route-map inbound, affects only local router
local-prefrence: can be applied via route-map inbound, affects all neighbors in the AS
med: can be applied by EBGP neighbor via route-map outbound, affects only directly connected AS. Default metric is 0, so we need to apply metric higher than 1 on other branch to influence selection.
Lower the MED the better.

##########need to clarify: if I would have modified MED within my OWN AS via route-map inbound, would it make sense ??????
##########need to clarify: next-hop-self modification via route-map outbound or directly applying on the neighbor stmt, wht is the diff (if any) ?

no-export : Cannot Advertise to EBGP neighbor
no-advertise : Cannot Advertise to any neighbor


##########need to clarify: IN which scenarios will you use local-as ?
"The local-AS feature allows a router to appear to be a member of a second autonomous system (AS), in addition to its real AS. This feature can only be used for true eBGP peers. You cannot use this feature for two peers that are members of different confederation sub-ASs"

##########ORF################
Why do it ?
Outbound Route Filtering: Under Normal BGP Process, Upstream routers dump all their BGP updates/routes to their downstream peers.
This has two disadv:
1) BW wasted in sending updates on the link
2) Resources on the downstream router, to filter out unwanted routes.

So to avoid this, we can use ORF , where the downstream peer themselves ask for what prefixes they want.

########On upstream Router ( The guy dumping the prefixes) ########
router bgp 2
!
address-family ipv4
neighbor 155.1.146.4 activate
neighbor 155.1.146.4 capability orf prefix-list receive
exit-address-family


########On downstream Router ( The guy wanting partial prefixes) ########
!
router bgp 3
neighbor 155.1.146.1 remote-as 2
!
address-family ipv4
neighbor 155.1.146.1 activate
neighbor 155.1.146.1 capability orf prefix-list send
neighbor 155.1.146.1 prefix-list DENY_VLAN5 in
exit-address-family


################## aggregate-address x.x.x.x y.y.y.y summary-only ##############
without keyword summary-only : supernet and individual subnets sent
with keyword summary-only: only supernet sent

##########need to clarify: IN real lab, I will not have access to BB Routers.
In that case how do I verify , tht BB routers are indeed recieving the summary route only !

I mean in the scenario present in pg104 of Adv Technologies Lab:
I applied summary-only to R1's BGP, but didnt on R3.
So the R3's 10.2.0.0/16 and 10.3.0.0/16 were making it to AS1.
This I Realised only after seeing R4's sh ip bgp. But how do i know this in real lab ?

Ans: be deligent and ensure tht all routers neigboring with BB rtrs AS , i.e all entry points into BB's AS are secured
by issuing sh ip bgp neigh X.X.X.X advertised-routes cmd

they dont care abt sub optimal routing tht summary-only will create unless explicitly specified
################suppress-map ######################
suppress-map filters Out the specific networks that the aggregate advertises.
this has an indirect effect in the sense that remaining specific subnets are NOW advertised along with the summary.

==> when there is no suppress-map, and summary-only keyword is used, only summary is sent
now with suppress-map, the specific prefixes not mentioned in suppress-map are adv along with summary

==> suppress-map is at BGP process level, applies to all neighbors

################unsuppress-map ######################
Even though you have aggregate-add with summary-only option, if you have per neighbor (peer level) a unsuppress-map stmt, it will allow sending more specific prefixes which were normally suppressed by aggregate address

e.g: neighbor 155.1.0.5 unsuppress-map UNSUPPRESS
WHere UNSUPPRESS is the route-map permitting the prefix-list which has more specific subnest suppressed by aggregate-address .. summary-nly option


#################(resolved) need to clarify: aggregate-address as-set summary-only############
R1 & R2 dont get summary of 155.1.0.0/21 why ?
Despite R5 sending the summary route , R1 and R2 are reluctant to add them ..why ?

Rack1R1#sh ip bgp
Network Next Hop Metric LocPrf Weight Path
*> 155.1.1.0/24 0.0.0.0 0 32768 i
Rack1R1#


Rack1R2#sh ip bgp
Network Next Hop Metric LocPrf Weight Path
*> 155.1.2.0/24 0.0.0.0 0 32768 i

Rack1R3#sh ip bgp
Network Next Hop Metric LocPrf Weight Path
*> 155.1.0.0/21 155.1.0.5 0 0 5 {1,2} i
Rack1R3#

Rack1R5#sh ip bgp
Network Next Hop Metric LocPrf Weight Path
*> 155.1.0.0/21 0.0.0.0 100 32768 {1,2} i
s> 155.1.1.0/24 155.1.0.1 0 0 1 i
s> 155.1.2.0/24 155.1.0.2 0 0 2 i
s> 155.1.5.0/24 0.0.0.0 0 32768 i
Rack1R5#

Rack1R5#sh ip bgp neighbors 155.1.0.1 advertised-routes
Network Next Hop Metric LocPrf Weight Path
*> 155.1.0.0/21 0.0.0.0 100 32768 {1,2} i

Rack1R5#sh ip bgp neighbors 155.1.0.2 advertised-routes
Network Next Hop Metric LocPrf Weight Path
*> 155.1.0.0/21 0.0.0.0 100 32768 {1,2} i

Rack1R5#sh ip bgp neighbors 155.1.0.3 advertised-routes
Network Next Hop Metric LocPrf Weight Path
*> 155.1.0.0/21 0.0.0.0 100 32768 {1,2} i

ANS: http://www.cisco.com/warp/public/459/aggregation.html#aggregatingwiththeassetargument

-->(Avoid Loops) With the as-set argument, the path information in the BGP table for the aggregate route changes to include a set from 300 {200,100}. This set indicates that the aggregate actually summarizes routes that have passed through AS-200 and AS-100. The as-set information becomes important in the avoidance of routing loops because the information records where the route has been.
Note: Because the aggregate as-set has AS-1 & AS-2 only, R3 in AS-3 accepts the aggregate route and installs the route in the routing table. The BGP loop detection mechanism causes this route acceptance. The BGP loop detection mechanism does not detect its own AS in as-set.

-->Note: The as-set argument contains information about each individual route that the aggregate summarizes. Changes in the individual route cause an update of the aggregate.

Impact of the Use of suppress-map with Other Configuration Commands

The aggregate-address command includes other configuration commands, such as suppress-map. In order to understand the impact of the use of all the configuration commands in combination, note that aggregate-address only inherits the attributes from the more-specific routes when you use the as-set configuration command. Examples of the attributes that aggregate-address can inherit include no-export and no-advertise.

*

----- When you use the suppress-map configuration command along with the summary-only configuration command, the summary-only configuration command does not have any effect. With use of the suppress-map configuration command, the more-specific routes that the suppress-map suppresses are not advertised. However, the routes that the suppress-map does not cover are advertised in addition to the aggregated route. Therefore, the notes in this section apply to the use of suppress-map either with or without the summary-only configuration command.
*

-----When you use as-set with suppress-map, although the suppressed routes are not advertised, the aggregated route inherits the attributes of all the suppressed routes. But you can override the inherited attributes with the use of other configuration commands, such as attribute-map. The Change the Attributes of the Aggregate Route section describes the use of attribute-map.
*

-----When you use the as-set and suppress-map configuration commands with advertise-map, the aggregate forms. The aggregate inherits the attributes only out of the routes that are selected in the advertise-map, irrespective of whether suppress-map suppresses the route. See the Use advertise-map to Aggregate a Subset of Specific Routes section.
*

-----When you use advertise-map and attribute-map along with as-set and other configuration commands, the attribute-map overrides the attributes that are chosen in the advertise-map.

<<<----->>>In general, when you use advertise-map, only the advertise-map influences the aggregate. In the absence of advertise-map, the aggregate inherits the attributes of the more-specific routes, both suppressed and unsuppressed. In both the cases, you can use the attribute-map configuration command to override the chosen attributes.


######################the Aggregate inherits the community from the specific prefixes ==> use attribute-map ##################
So if there is an specific prefix being received from some ebgp peer, and lets say its community is no-export
then the aggregate will also carry the community no-export, thus having the effect tht no (ebgp/ibgp) peers will get it

thus to alliviate this, we have to use attribute-map and attach a route-map which sets the community to none.

#####################advertise-map, excludes the prefixes from being counted in the aggregate ##################
This means when we use as-set, the prefixes EXCLUDED by the advertise-map, thier parent AS# are not mentioned in the { }
Hence the remote AS which dont have their AS# in {} now accept the summary, even though they now MAY have a specific prefix covered by the aggregate

Read this on CCO http://www.cisco.com/warp/public/459/aggregation.html#aggregatingwiththeassetargument


########## allow-as in #######################
basically disables BGP loop prevention mechanisim
when ebgp peer receives an prefix update with its own AS# in the AS_PATH and if allow-as in is configured for that ebgp peer.
then the prefix is accepted.

This has to be configured on the peer where we want the prefix to be accepted in.

Adv Technologies: EIGRP

#########EIGRP Authentication########
Takes some time, so will need to be patient. Need to chage system clock (clock set 00:22:00 1 Feb 2007) for Auth to kick in
OR
clear ip eigrp neigh will do


Also there is a typo, can u spot the mistake ?




key chain EIGRP
key 1
key-string CISCO123
accept-lifetime 00:00:00 Mar 1 2002 00:15:00 Jan 1 2007
send-lifetime 00:00:00 Mar 1 2002 00:00:00 Jan 1 2007
key 2
key-string CISCO456
accept-lifetime 23:45:00 Dec 31 2006 infinite
send-lifetime 00:00:00 Jan 1 2007 infinite



Rack1R4#sh key chain
Key-chain EIGRP:
key 1 -- text "CISCO123 "
accept lifetime (00:00:00 UTC Mar 1 2002) - (00:15:00 UTC Jan 1 2007) [valid now]
send lifetime (00:00:00 UTC Mar 1 2002) - (00:00:00 UTC Jan 1 2007) [valid now]
key 2 -- text "CISCO456"
accept lifetime (23:45:00 UTC Dec 31 2006) - (infinite)
send lifetime (00:00:00 UTC Jan 1 2007) - (infinite)
Rack1R4#


Rack1R5#sh key cha
Key-chain EIGRP:
key 1 -- text "CISCO123"
accept lifetime (00:00:00 UTC Jan 1 2002) - (00:15:00 UTC Jan 1 2007) [valid now]
send lifetime (00:00:00 UTC Jan 1 2002) - (00:00:00 UTC Jan 1 2007) [valid now]
key 2 -- text "CISCO456"
accept lifetime (23:45:00 UTC Dec 31 2006) - (infinite) [valid now]
send lifetime (00:00:00 UTC Jan 1 2007) - (infinite)
Rack1R5#


Ans: in R4 router, there is an additional space in the Key 1 "CISCO123 "



#########EIGRP Stub########

From Non Stub router only UPDATES are sent out to stub neighbor, no QUERIES sent to stub
But a Non Stub router will receive QUERIES from stub neighbor and will reply to the same.


########### Leak-map ########################
ip summary-address eigrp 100 0.0.0.0 0.0.0.0 leak-map LEAK

The benefit of route leaking (advertising a route) is that the leaked route is more specific than a summarized route and is therefore the preferred route.

#######How To ############
Configuring an EIGRP Summary Address to Leak a Component Route


There might be times when you have summarized routes, but you want a particular route to be advertised. The benefit of route leaking (advertising a route) is that the leaked route is more specific than a summarized route and is therefore the preferred route. Perform this task to leak an EIGRP route that would otherwise be suppressed by a summary route.

In general, leaking an EIGRP route is achieved by defining a standard IP access list (or IP prefix list) to identify the component route as a source address. Then the access list is referenced in a route map (in a match ip address command), and the route map is referenced by the leak-map keyword in the ip summary-address eigrp command.

You can use a single access list to permit all the routes that you want to leak through a single summary.



##Behavior if EIGRP Route Leaking Is Configured Incompletely##

The following default behavior occurs if the ip summary-address eigrp command is configured using the leak-map keyword and either the route map or access list is not configured:

--If the leak-map keyword is configured to reference a nonexistent route map, the configuration of this keyword has no effect. The summary address is advertised, but all component routes are suppressed.

--If the leak-map keyword is configured, but the access list does not exist or the route map does not reference the access list, the summary address and all component routes are sent.


###############ip default-network ############################
When deciding whether to use a default static route or a default network, keep in mind that if you want the routing protocol to propagate the default route, the ip default-network command will do that for you. But if you want only the local router to have the default route, a static IP route is the way to go.

http://blog.internetworkexpert.com/2008/01/15/issues-with-the-ip-default-network-command/


##############Changing Internal and External AD of EIGRP Routes ############
NOTE: We can not change distance for individual external EIGRP prefixes
distance eigrp 99 200
e.g all internal routes set to AD99 and external routes set to AD200
However we can still change {selectively} AD of internal routes from 99 to something else as shwon below, but cannot {selectively} change AD of external routes

NOTE: that you specify neighbor’s IP address (like with RIP and unlike OSPF)
when you fine-tune AD based on access-list
"distance 199 155.1.45.5 0.0.0.0 10"

e.g: This will set the routes recd from source-ip 155.1.45.5 to AD 199 if the routes match that in ACL 10

#################Filtering with Distribute Lists ############
router eigrp 100
distribute-list 99 in Serial 0/0
distribute-list 99 in Serial 0/1


A bit advanced distribute-list with route-map
router eigrp 100
distribute-list route-map FILTER_EIGRP in serial 0/1
distribute-list route-map FILTER_EIGRP in serial 0/0

Where all the magic happens in FILTER_EIGRP route-map to match against tag 100 and then selectively permit only those routes in, rest are filtered#########EIGRP AUthentication########
Takes some time, so will need to be patient. Need to chage system clock (clock set 00:22:00 1 Feb 2007) for Auth to kick in
OR
clear ip eigrp neigh will do


Also there is a typo, can u spot the mistake ?




key chain EIGRP
key 1
key-string CISCO123
accept-lifetime 00:00:00 Mar 1 2002 00:15:00 Jan 1 2007
send-lifetime 00:00:00 Mar 1 2002 00:00:00 Jan 1 2007
key 2
key-string CISCO456
accept-lifetime 23:45:00 Dec 31 2006 infinite
send-lifetime 00:00:00 Jan 1 2007 infinite



Rack1R4#sh key chain
Key-chain EIGRP:
key 1 -- text "CISCO123 "
accept lifetime (00:00:00 UTC Mar 1 2002) - (00:15:00 UTC Jan 1 2007) [valid now]
send lifetime (00:00:00 UTC Mar 1 2002) - (00:00:00 UTC Jan 1 2007) [valid now]
key 2 -- text "CISCO456"
accept lifetime (23:45:00 UTC Dec 31 2006) - (infinite)
send lifetime (00:00:00 UTC Jan 1 2007) - (infinite)
Rack1R4#


Rack1R5#sh key cha
Key-chain EIGRP:
key 1 -- text "CISCO123"
accept lifetime (00:00:00 UTC Jan 1 2002) - (00:15:00 UTC Jan 1 2007) [valid now]
send lifetime (00:00:00 UTC Jan 1 2002) - (00:00:00 UTC Jan 1 2007) [valid now]
key 2 -- text "CISCO456"
accept lifetime (23:45:00 UTC Dec 31 2006) - (infinite) [valid now]
send lifetime (00:00:00 UTC Jan 1 2007) - (infinite)
Rack1R5#


Ans: in R4 router, there is an additional space in the Key 1 "CISCO123 "



#########EIGRP Stub########

From Non Stub router only UPDATES are sent out to stub neighbor, no QUERIES sent to stub
But a Non Stub router will receive QUERIES from stub neighbor and will reply to the same.


########### Leak-map ########################
ip summary-address eigrp 100 0.0.0.0 0.0.0.0 leak-map LEAK

The benefit of route leaking (advertising a route) is that the leaked route is more specific than a summarized route and is therefore the preferred route.

#######How To ############
Configuring an EIGRP Summary Address to Leak a Component Route


There might be times when you have summarized routes, but you want a particular route to be advertised. The benefit of route leaking (advertising a route) is that the leaked route is more specific than a summarized route and is therefore the preferred route. Perform this task to leak an EIGRP route that would otherwise be suppressed by a summary route.

In general, leaking an EIGRP route is achieved by defining a standard IP access list (or IP prefix list) to identify the component route as a source address. Then the access list is referenced in a route map (in a match ip address command), and the route map is referenced by the leak-map keyword in the ip summary-address eigrp command.

You can use a single access list to permit all the routes that you want to leak through a single summary.



##Behavior if EIGRP Route Leaking Is Configured Incompletely##

The following default behavior occurs if the ip summary-address eigrp command is configured using the leak-map keyword and either the route map or access list is not configured:

--If the leak-map keyword is configured to reference a nonexistent route map, the configuration of this keyword has no effect. The summary address is advertised, but all component routes are suppressed.

--If the leak-map keyword is configured, but the access list does not exist or the route map does not reference the access list, the summary address and all component routes are sent.


###############ip default-network ############################
When deciding whether to use a default static route or a default network, keep in mind that if you want the routing protocol to propagate the default route, the ip default-network command will do that for you. But if you want only the local router to have the default route, a static IP route is the way to go.

http://blog.internetworkexpert.com/2008/01/15/issues-with-the-ip-default-network-command/


##############Changing Internal and External AD of EIGRP Routes ############
NOTE: We can not change distance for individual external EIGRP prefixes
distance eigrp 99 200
e.g all internal routes set to AD99 and external routes set to AD200
However we can still change {selectively} AD of internal routes from 99 to something else as shwon below, but cannot {selectively} change AD of external routes

NOTE: that you specify neighbor’s IP address (like with RIP and unlike OSPF)
when you fine-tune AD based on access-list
"distance 199 155.1.45.5 0.0.0.0 10"

e.g: This will set the routes recd from source-ip 155.1.45.5 to AD 199 if the routes match that in ACL 10

#################Filtering with Distribute Lists ############
router eigrp 100
distribute-list 99 in Serial 0/0
distribute-list 99 in Serial 0/1


A bit advanced distribute-list with route-map
router eigrp 100
distribute-list route-map FILTER_EIGRP in serial 0/1
distribute-list route-map FILTER_EIGRP in serial 0/0

Where all the magic happens in FILTER_EIGRP route-map to match against tag 100 and then selectively permit only those routes in, rest are filetered (denied)
(denied)

CoD: Frame Relay

1) Multipoint Interfaces
Assign MAP statements automatically assigns Circuit (DLCI) to the interface.
So frame-relay map ... config applied ==> No need to do frame-relay interface-dlci .....

2) Layer 3 to Layer 2 Resoultion is only Locally Significatnt.
==> You can use IARP at one end and frame-relay map at other and viceversa

3) sh frame-relay map cmd o/p on Point-to-point interface
When the configuration is verified with the show frame-relay map command, a unicast
layer 3 address is not associated with the DLCI. Instead, the output point-to-point dlci
indicates that any traffic transiting the subinterface will use the DLCI specified on the
interface. In addition to this, broadcast support is automatically enabled on point-to-point
NBMA circuits. This can be seen by the output of the show frame-relay map command,
as the broadcast keyword is associated with the mapping.

4) Not only is layer 3 to layer 2 resolution only locally significant, the type of interface,
whether a main interface, multipoint subinterface, or point-to-point subinterface, is also
only locally significant.

5) no frame-relay inverse-arp ip 405 ==> to remove Mappings for Unused DLCI

6) V V IMP: Minimise Redundant Broadcast Between Hub-Spoke

--Note that on R4 and R5, multiple mapping statements resolve to the same layer 2
address. This is due to the fact that in order for traffic to pass between R4 and R5, it
must first transit R1. Also, note that the broadcast keyword on the end of their frame relay map statements is only used on one mapping. This prevents the spokes from
duplicating the same broadcast or multicast packet that is sent to the interface out the
same circuit.

--Note that the mapping that the broadcast keyword is associated with is
arbitrary, and could be moved to the mapping for R4 and R5's addresses respectively.
This is due to the fact that the broadcast resolution does not relate to the unicast
address, but instead only relates to the layer 2 circuit address.