NRP - TP 3 & 4 - BGP

# NRP - TP 3 & 4 - BGP ###### tags: `NRP` `S2` ### basic config ![](https://i.imgur.com/F1Xt2D7.png) Pour configurer un router : - clic-droit sur le router - start - console - configuration comme un routeur cisco Pour mettre en configuration ipv6 > conf t > ipv6 unicast-routing pour chaque interface faire >Router(config)# interface name number >Router(config-if)# ipv6 enable >Router(config-if)# ipv6 address ipv6-address/prefix-length >Router(config-if)# no shutdown Lors de la configuration de BGP on utilise les commandes >neighbor _ipv6-address_ remote-as _as-number_ et >neighbor _ipv6-address_ activate __NB__ : Les ip utilisée (Global-unicast) et as-number sont toujours ceux du routeur sur lequel on veut se connecter **Can a router establish a BGP session that has not been manually configured on the router? Why?** No ? On ne veut pas que les routeurs se connectent tous car ils n'appartiennent pas forcément aux mêmes entreprises ## Part 5: BGP Peering ### 5.1 What packets related to BGP do you see on Wireshark? When activating the connection between R2 and R3 we can see some BGP messages : - OPEN - KEEPALIVE - UPDATE What packets related to BGP do you see on Wireshark? ![](https://i.imgur.com/AIMwKD6.png) BGP établie sa connection en TCP Quand on ne configure qu'un routeur le paquet reçu est supprimé ([RST, ACK]) Dès qu'on configure le deuxième routeur le paquet TCP contenant BGP ouvre une connection (Classique SYN, SYN-ACK, ACK) ### 5.2 What information is exchanged between the two BGP routers? __Open message :__ On y trouve des infos comme le `as-number` ou le `hold-time` (= le temps sans recevoir de message update ou keepalive avant de tuer la connection) __Update message:__ On ne trouve aucune information tant qu'aucun autre chemin n'a été configuré. Avec wireshark le champ `Withdraw Routes Length` est égal à 0 car le `Network statement` (= statement qui indique le network possédé) n'est pas encore configuré. ### 5.3 Which packets are sent regularly and why? How often? Where can you find this information? We can see on wireshark KEEPALIVE packets are send oftenly. __wikipedia__ : KEEPALIVE maintient la session ouverte. Par défaut le message KEEPALIVE est envoyé toutes les 30 secondes, et un délai de 90 secondes sans message UPDATE ni KEEPALIVE reçu entraîne la fermeture de la session ### 5.5 What are the states that a BGP session can have? Explain what each of them means. Idle Connect Active OpenSent OpenConfirm Established ![](https://i.imgur.com/C59vH2F.png) Plus de doc: `https://fr.wikipedia.org/wiki/Border_Gateway_Protocol#Machine_d'%C3%A9tats_finis_de_BGP` ### 5.6 What is the state of the BGP session on R2 / R3? Established ### 5.7 Can you ping R3 from R1? Why? ```cisco R1#ping 2001:100:4:3::2 Type escape sequence to abort. Sending 5, 100-byte ICMP Echos to 2001:100:4:3::2, timeout is 2 seconds: % No valid route for destination Success rate is 0 percent (0/1) R1# ``` Ils sont dans deux réseaux differents et pour l'instant aucun des routeurs n'a publié des adresses reseaux ( cf questions suivantes ) No routes are set up to allow R2 to transit traffic. Hence the need for BGP __Ping R2 from LAN1__ Nothing changed, no route to destination. #### 5.7.2 Look at the BGP table on the router R2 (`show bgp ipv6 unicast`) . What does it show? We can see the prefixes that have been propagated by BGP, with the AS path ```cisco R2#show bgp ipv6 unicast BGP table version is 5, local router ID is 2.2.2.2 Status codes: s suppressed, d damped, h history, * valid, > best, i - internal, r RIB-failure, S Stale, m multipath, b backup-path, f RT-Filter, x best-external, a additional-path, c RIB-compressed, Origin codes: i - IGP, e - EGP, ? - incomplete RPKI validation codes: V valid, I invalid, N Not found Network Next Hop Metric LocPrf Weight Path *> 2001:100:1:1::/64 2001:100:4:1::2 0 0 101 i *> 2001:100:1:2::/64 2001:100:4:3::2 0 103 104 i *> 2001:100:4:1::/64 :: 0 32768 i *> 2001:100:4:2::/64 2001:100:4:3::2 0 0 103 i R2# ``` ``` Network Next Hop Metric LocPrf Weight Path *> 2001:100:1:1::/64 2001:100:4:1::2 0 0 111 i *> 2001:100:1:2::/64 2001:100:4:3::2 0 113 114 i *> 2001:100:4:1::/64 :: 0 32768 i * 2001:100:4:1::2 0 0 111 i *> 2001:100:4:2::/64 2001:100:4:3::2 0 0 113 i * 2001:100:4:3::/64 2001:100:4:3::2 0 0 113 i *> :: 0 32768 i ``` This time, nexthops are specified with their link-local IPv6 addresses. ```cisco R2#show ipv6 route bgp IPv6 Routing Table - default - 8 entries Codes: C - Connected, L - Local, S - Static, U - Per-user Static route B - BGP, R - RIP, H - NHRP, I1 - ISIS L1 I2 - ISIS L2, IA - ISIS interarea, IS - ISIS summary, D - EIGRP EX - EIGRP external, ND - ND Default, NDp - ND Prefix, DCE - Destination NDr - Redirect, O - OSPF Intra, OI - OSPF Inter, OE1 - OSPF ext 1 OE2 - OSPF ext 2, ON1 - OSPF NSSA ext 1, ON2 - OSPF NSSA ext 2, l - LISP B 2001:100:1:1::/64 [20/0] -> distance=20 via FE80::C801:35FF:FE1E:38, GigabitEthernet2/0 B 2001:100:1:2::/64 [20/0] via FE80::C803:35FF:FE1E:1C, GigabitEthernet1/0 B 2001:100:4:2::/64 [20/0] via FE80::C803:35FF:FE1E:1C, GigabitEthernet1/0 R2# ``` #### 5.7.3 Look at the BGP routing table on the router R2. Are there any BGP routes? What is the administrative distance of BGP? What does it mean? The administrative distance of BGP is 20 as shown in the [20/0] after the ip in the routes. https://www.cisco.com/c/fr_ca/support/docs/ip/border-gateway-protocol-bgp/15986-admin-distance.pdf #### 5.7.4 Physically unplug the link between R2 and R3. How long does it take for destinations within AS1Z1 to disappear from the routing table of R1? Plug the link back in, how long does it take for R1to recover its forwarding state for destinations within AS 1Z1? It takes approximately 180s to disappear, and about 10-20s to come back. ## Part 6: BGP Filtering **Partie cours** https://networklessons.com/cisco/ccnp-route/introduction-to-route-maps les infos sont ici Si qq peut résumer ### 6.1 Yes, all of them. ``` R2#show ipv6 route IPv6 Routing Table - default - 16 entries Codes: C - Connected, L - Local, S - Static, U - Per-user Static route B - BGP, R - RIP, H - NHRP, I1 - ISIS L1 I2 - ISIS L2, IA - ISIS interarea, IS - ISIS summary, D - EIGRP EX - EIGRP external, ND - ND Default, NDp - ND Prefix, DCE - Destination NDr - Redirect, O - OSPF Intra, OI - OSPF Inter, OE1 - OSPF ext 1 OE2 - OSPF ext 2, ON1 - OSPF NSSA ext 1, ON2 - OSPF NSSA ext 2, l - LISP B 2001:100:1:1::/64 [20/0] via FE80::C803:1FFF:FED7:1C, GigabitEthernet1/0 B 2001:100:1:2::/64 [20/0] via FE80::C802:20FF:FE4D:0, FastEthernet0/0 B 2001:100:1:11::/64 [20/0] via FE80::C803:1FFF:FED7:1C, GigabitEthernet1/0 B 2001:100:1:12::/64 [20/0] via FE80::C803:1FFF:FED7:1C, GigabitEthernet1/0 B 2001:100:1:13::/64 [20/0] via FE80::C803:1FFF:FED7:1C, GigabitEthernet1/0 B 2001:100:1:41::/64 [20/0] via FE80::C802:20FF:FE4D:0, FastEthernet0/0 B 2001:100:1:42::/64 [20/0] via FE80::C802:20FF:FE4D:0, FastEthernet0/0 B 2001:100:1:43::/64 [20/0] via FE80::C802:20FF:FE4D:0, FastEthernet0/0 C 2001:100:4:1::/64 [0/0] via GigabitEthernet1/0, directly connected L 2001:100:4:1::1/128 [0/0] via GigabitEthernet1/0, receive B 2001:100:4:2::/64 [20/0] via FE80::C802:20FF:FE4D:0, FastEthernet0/0 C 2001:100:4:3::/64 [0/0] via FastEthernet0/0, directly connected L 2001:100:4:3::1/128 [0/0] via FastEthernet0/0, receive B 2001:200:200:201::/64 [20/0] via FE80::C803:1FFF:FED7:1C, GigabitEthernet1/0 B 2001:200:200:204::/64 [20/0] via FE80::C802:20FF:FE4D:0, FastEthernet0/0 L FF00::/8 [0/0] via Null0, receive ``` ### 6.2 pour créer une access-list `conf t` `ipv6 access-list *name-acl*` `Router(config-ipv6-acl)#{permit ou deny}<ipv6-source-prefix> <ipv6-dest-prefix>` Dans cet exemple on prend la source 2001:200:200:201::/64 et la destination any config sur le router R1 ``` interface FastEthernet0/0 no ip address duplex full ipv6 address 2001:100:1::1/64 ipv6 address 2001:100:1:1::1/64 ipv6 address 2001:100:1:11::1/64 ipv6 address 2001:100:1:12::1/64 ipv6 address 2001:100:1:13::1/64 ipv6 address 2001:200:200:201::1/64 ipv6 enable ! interface GigabitEthernet1/0 no ip address negotiation auto ipv6 address 2001:100:4:1::2/64 ! interface GigabitEthernet2/0 no ip address shutdown negotiation auto ! router bgp 11 bgp router-id 1.1.1.1 bgp log-neighbor-changes no bgp default ipv4-unicast neighbor 2001:100:4:1::1 remote-as 12 ! address-family ipv4 exit-address-family ! address-family ipv6 network 2001:100:1:1::/64 network 2001:100:1:11::/64 network 2001:100:1:12::/64 network 2001:100:1:13::/64 network 2001:100:4:1::/64 network 2001:200:200:201::/64 neighbor 2001:100:4:1::1 activate neighbor 2001:100:4:1::1 route-map mapdeny201 out exit-address-family ! ip forward-protocol nd ! ! no ip http server no ip http secure-server ! ! route-map mapdeny201 deny 10 match ipv6 address deny201 ! ! ! ipv6 access-list deny201 permit ipv6 2001:200:200:201::/64 any ! ``` ### 6.3 `R2#clear bgp ipv6 unicast *` ``` router bgp 12 bgp router-id 2.2.2.2 bgp log-neighbor-changes no bgp default ipv4-unicast neighbor 2001:100:4:1::2 remote-as 11 neighbor 2001:100:4:3::2 remote-as 13 ! address-family ipv4 exit-address-family ! address-family ipv6 network 2001:100:4:1::/64 network 2001:100:4:3::/64 neighbor 2001:100:4:1::2 activate neighbor 2001:100:4:1::2 route-map mapdeny201 in neighbor 2001:100:4:3::2 activate exit-address-family ! ip forward-protocol nd ! ! no ip http server no ip http secure-server ! ! route-map mapdeny201 deny 10 match ipv6 address deny201 ! route-map mapdeny201 permit 20 match ipv6 address base ! ! ! ipv6 access-list base permit ipv6 any any ! ipv6 access-list deny201 permit ipv6 2001:200:200:201::/64 any ! ``` ## Part 7: Filtering in function of the AS_PATH ### 7.1 sans bgp R1-R4 ``` R1#show ipv6 route 2001:200:200:204:: Routing entry for 2001:200:200:204::/64 Known via "bgp 11", distance 20, metric 0, type external Route count is 1/1, share count 0 Routing paths: FE80::C801:1FFF:FEB6:1C, GigabitEthernet1/0 MPLS label: nolabel Last updated 00:01:02 ago ``` avec bgp R1-R4 ``` R1#show ipv6 route 2001:200:200:204::/64 Routing entry for 2001:200:200:204::/64 Known via "bgp 11", distance 20, metric 0, type external Route count is 1/1, share count 0 Routing paths: FE80::C804:1FFF:FEE7:38, GigabitEthernet2/0 MPLS label: nolabel Last updated 00:01:44 ago ``` ### 7.3 sans bgp ``` R3#show ipv6 route 2001:100:1:1::/64 Routing entry for 2001:100:1:1::/64 Known via "bgp 13", distance 20, metric 0, type external Route count is 1/1, share count 0 Routing paths: FE80::C801:1FFF:FEB6:0, FastEthernet0/0 MPLS label: nolabel Last updated 00:23:19 ago ``` pas de changement avec bgp

Syntax	Example	Reference
# Header	Header	基本排版
- Unordered List	Unordered List
1. Ordered List	Ordered List
- [ ] Todo List	Todo List
> Blockquote	Blockquote
Bold font	Bold font
Italics font	Italics font
~~Strikethrough~~	~~Strikethrough~~
19^th^	19^th
H~2~O	H₂O
++Inserted text++	Inserted text
==Marked text==	Marked text
[link text](https:// "title")	Link
![image alt](https:// "title")	Image
`Code`	`Code`	在筆記中貼入程式碼
```javascript var i = 0; ```	`var i = 0;`
:smile:		Emoji list
{%youtube youtube_id %}	Externals
$L^aT_eX$	L^aT_eX
:::info This is a alert area. :::	This is a alert area.