---
# System prepended metadata

title: NRP - TP 3 & 4 - BGP
tags: [NRP, S2]

---

# NRP - TP 3 & 4 - BGP

###### tags: `NRP` `S2`

### basic config

![](https://i.imgur.com/F1Xt2D7.png)

Pour configurer un router : 
 - clic-droit sur le router
 - start
 - console
 - configuration comme un routeur cisco

Pour mettre en configuration ipv6 
> conf t
> ipv6 unicast-routing

pour chaque interface faire 

>Router(config)# interface name number
>Router(config-if)# ipv6 enable
>Router(config-if)# ipv6 address ipv6-address/prefix-length
>Router(config-if)# no shutdown

Lors de la configuration de BGP on utilise les commandes 
>neighbor _ipv6-address_ remote-as _as-number_

et

>neighbor _ipv6-address_ activate

__NB__ : Les ip utilisée (Global-unicast) et as-number sont toujours ceux du routeur sur lequel on veut se connecter


**Can a router establish a BGP session that has not been manually configured on the router? Why?**

No ? On ne veut pas que les routeurs se connectent tous car ils n'appartiennent pas forcément aux mêmes entreprises

## Part 5: BGP Peering

### 5.1 What packets related to BGP do you see on Wireshark?

When activating the connection between R2 and R3 we can see some BGP messages :
 - OPEN
 - KEEPALIVE
 - UPDATE

What packets related to BGP do you see on Wireshark?

![](https://i.imgur.com/AIMwKD6.png)

BGP établie sa connection en TCP
Quand on ne configure qu'un routeur le paquet reçu est supprimé ([RST, ACK])
Dès qu'on configure le deuxième routeur le paquet TCP contenant BGP ouvre une connection (Classique SYN, SYN-ACK, ACK)
### 5.2 What information is exchanged between the two BGP routers?

__Open message :__
On y trouve des infos comme le `as-number` ou le `hold-time` (= le temps sans recevoir de message update ou keepalive avant de tuer la connection)

__Update message:__
On ne trouve aucune information tant qu'aucun autre chemin n'a été configuré.
Avec wireshark le champ `Withdraw Routes Length` est égal à 0 car le `Network statement` (= statement qui indique le network possédé) n'est pas encore configuré.

### 5.3 Which packets are sent regularly and why? How often? Where can you find this information?

We can see on wireshark KEEPALIVE packets are send oftenly.

__wikipedia__ : KEEPALIVE maintient la session ouverte. Par défaut le message KEEPALIVE est envoyé toutes les 30 secondes, et un délai de 90 secondes sans message UPDATE ni KEEPALIVE reçu entraîne la fermeture de la session


### 5.5  What are the states that a BGP session can have?  Explain what each of them means.

Idle
Connect
Active
OpenSent
OpenConfirm
Established

![](https://i.imgur.com/C59vH2F.png)

Plus de doc: `https://fr.wikipedia.org/wiki/Border_Gateway_Protocol#Machine_d'%C3%A9tats_finis_de_BGP`

### 5.6  What is the state of the BGP session on R2 / R3?

Established

### 5.7 Can you ping R3 from R1?  Why?

```cisco
R1#ping 2001:100:4:3::2
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 2001:100:4:3::2, timeout is 2 seconds:

% No valid route for destination
Success rate is 0 percent (0/1)
R1#
```
Ils sont dans deux réseaux differents et pour l'instant aucun des routeurs n'a publié  des adresses reseaux ( cf questions suivantes )
No routes are set up to allow R2 to transit traffic.
Hence the need for BGP

__Ping R2 from LAN1__

Nothing changed, no route to destination.


#### 5.7.2 Look at the BGP table on the router R2 (`show bgp ipv6 unicast`) .  What does it show?

We can see the prefixes that have been propagated by BGP, with the AS path
```cisco
R2#show bgp ipv6 unicast
BGP table version is 5, local router ID is 2.2.2.2
Status codes: s suppressed, d damped, h history, * valid, > best, i - internal, 
              r RIB-failure, S Stale, m multipath, b backup-path, f RT-Filter, 
              x best-external, a additional-path, c RIB-compressed, 
Origin codes: i - IGP, e - EGP, ? - incomplete
RPKI validation codes: V valid, I invalid, N Not found

     Network          Next Hop            Metric LocPrf Weight Path
 *>  2001:100:1:1::/64
                       2001:100:4:1::2          0             0 101 i
 *>  2001:100:1:2::/64
                       2001:100:4:3::2                        0 103 104 i
 *>  2001:100:4:1::/64
                       ::                       0         32768 i
 *>  2001:100:4:2::/64
                       2001:100:4:3::2          0             0 103 i
R2#
```

```
  Network          Next Hop            Metric LocPrf Weight Path
 *>  2001:100:1:1::/64
                       2001:100:4:1::2          0             0 111 i
 *>  2001:100:1:2::/64
                       2001:100:4:3::2                        0 113 114 i
 *>  2001:100:4:1::/64
                       ::                       0         32768 i
 *                    2001:100:4:1::2          0             0 111 i
 *>  2001:100:4:2::/64
                       2001:100:4:3::2          0             0 113 i
 *   2001:100:4:3::/64
                       2001:100:4:3::2          0             0 113 i
 *>                   ::                       0         32768 i
```

This time, nexthops are specified with their link-local IPv6 addresses.

```cisco
R2#show ipv6 route bgp
IPv6 Routing Table - default - 8 entries
Codes: C - Connected, L - Local, S - Static, U - Per-user Static route
       B - BGP, R - RIP, H - NHRP, I1 - ISIS L1
       I2 - ISIS L2, IA - ISIS interarea, IS - ISIS summary, D - EIGRP
       EX - EIGRP external, ND - ND Default, NDp - ND Prefix, DCE - Destination
       NDr - Redirect, O - OSPF Intra, OI - OSPF Inter, OE1 - OSPF ext 1
       OE2 - OSPF ext 2, ON1 - OSPF NSSA ext 1, ON2 - OSPF NSSA ext 2, l - LISP
B   2001:100:1:1::/64 [20/0] -> distance=20
     via FE80::C801:35FF:FE1E:38, GigabitEthernet2/0
B   2001:100:1:2::/64 [20/0]
     via FE80::C803:35FF:FE1E:1C, GigabitEthernet1/0
B   2001:100:4:2::/64 [20/0]
     via FE80::C803:35FF:FE1E:1C, GigabitEthernet1/0
R2#
```

#### 5.7.3 Look  at  the  BGP  routing  table  on  the  router  R2.   Are  there  any  BGP  routes?   What  is  the administrative distance of BGP? What does it mean?

The administrative distance of BGP is 20 as shown in the [20/0] after the ip in the routes.

https://www.cisco.com/c/fr_ca/support/docs/ip/border-gateway-protocol-bgp/15986-admin-distance.pdf

#### 5.7.4  Physically unplug the link between R2 and R3.  How long does it take for destinations within AS1Z1 to disappear from the routing table of R1?  Plug the link back in, how long does it take for R1to recover its forwarding state for destinations within AS 1Z1?

It takes approximately 180s to disappear, and about 10-20s to come back.

## Part 6: BGP Filtering

**Partie cours**
https://networklessons.com/cisco/ccnp-route/introduction-to-route-maps les infos sont ici
Si qq peut résumer 

### 6.1

Yes, all of them. 
```
R2#show ipv6 route
IPv6 Routing Table - default - 16 entries
Codes: C - Connected, L - Local, S - Static, U - Per-user Static route
       B - BGP, R - RIP, H - NHRP, I1 - ISIS L1
       I2 - ISIS L2, IA - ISIS interarea, IS - ISIS summary, D - EIGRP
       EX - EIGRP external, ND - ND Default, NDp - ND Prefix, DCE - Destination
       NDr - Redirect, O - OSPF Intra, OI - OSPF Inter, OE1 - OSPF ext 1
       OE2 - OSPF ext 2, ON1 - OSPF NSSA ext 1, ON2 - OSPF NSSA ext 2, l - LISP
B   2001:100:1:1::/64 [20/0]
     via FE80::C803:1FFF:FED7:1C, GigabitEthernet1/0
B   2001:100:1:2::/64 [20/0]
     via FE80::C802:20FF:FE4D:0, FastEthernet0/0
B   2001:100:1:11::/64 [20/0]
     via FE80::C803:1FFF:FED7:1C, GigabitEthernet1/0
B   2001:100:1:12::/64 [20/0]
     via FE80::C803:1FFF:FED7:1C, GigabitEthernet1/0
B   2001:100:1:13::/64 [20/0]
     via FE80::C803:1FFF:FED7:1C, GigabitEthernet1/0
B   2001:100:1:41::/64 [20/0]
     via FE80::C802:20FF:FE4D:0, FastEthernet0/0
B   2001:100:1:42::/64 [20/0]
     via FE80::C802:20FF:FE4D:0, FastEthernet0/0
B   2001:100:1:43::/64 [20/0]
     via FE80::C802:20FF:FE4D:0, FastEthernet0/0
C   2001:100:4:1::/64 [0/0]
     via GigabitEthernet1/0, directly connected
L   2001:100:4:1::1/128 [0/0]
     via GigabitEthernet1/0, receive
B   2001:100:4:2::/64 [20/0]
     via FE80::C802:20FF:FE4D:0, FastEthernet0/0
C   2001:100:4:3::/64 [0/0]
     via FastEthernet0/0, directly connected
L   2001:100:4:3::1/128 [0/0]
     via FastEthernet0/0, receive
B   2001:200:200:201::/64 [20/0]
     via FE80::C803:1FFF:FED7:1C, GigabitEthernet1/0
B   2001:200:200:204::/64 [20/0]
     via FE80::C802:20FF:FE4D:0, FastEthernet0/0
L   FF00::/8 [0/0]
     via Null0, receive
```

### 6.2

pour créer une access-list
`conf t`
`ipv6 access-list *name-acl*`
`Router(config-ipv6-acl)#{permit ou deny}<ipv6-source-prefix> <ipv6-dest-prefix>`

Dans cet exemple on prend la source 2001:200:200:201::/64 et la destination any


config sur le router R1

```
interface FastEthernet0/0
 no ip address
 duplex full
 ipv6 address 2001:100:1::1/64
 ipv6 address 2001:100:1:1::1/64
 ipv6 address 2001:100:1:11::1/64
 ipv6 address 2001:100:1:12::1/64
 ipv6 address 2001:100:1:13::1/64
 ipv6 address 2001:200:200:201::1/64
 ipv6 enable
!         
interface GigabitEthernet1/0
 no ip address
 negotiation auto
 ipv6 address 2001:100:4:1::2/64
!         
interface GigabitEthernet2/0
 no ip address
 shutdown 
 negotiation auto
!         
router bgp 11
 bgp router-id 1.1.1.1
 bgp log-neighbor-changes
 no bgp default ipv4-unicast
 neighbor 2001:100:4:1::1 remote-as 12
 !        
 address-family ipv4
 exit-address-family
 !        
 address-family ipv6
  network 2001:100:1:1::/64
  network 2001:100:1:11::/64
  network 2001:100:1:12::/64
  network 2001:100:1:13::/64
  network 2001:100:4:1::/64
  network 2001:200:200:201::/64
  neighbor 2001:100:4:1::1 activate
  neighbor 2001:100:4:1::1 route-map mapdeny201 out
 exit-address-family
!         
ip forward-protocol nd
!         
!         
no ip http server
no ip http secure-server
!         
!         
route-map mapdeny201 deny 10
 match ipv6 address deny201
!         
!         
!         
ipv6 access-list deny201
 permit ipv6 2001:200:200:201::/64 any
!         
```


### 6.3

`R2#clear bgp ipv6 unicast *`

```
router bgp 12
 bgp router-id 2.2.2.2
 bgp log-neighbor-changes
 no bgp default ipv4-unicast
 neighbor 2001:100:4:1::2 remote-as 11
 neighbor 2001:100:4:3::2 remote-as 13
 !        
 address-family ipv4
 exit-address-family
 !        
 address-family ipv6
  network 2001:100:4:1::/64
  network 2001:100:4:3::/64
  neighbor 2001:100:4:1::2 activate
  neighbor 2001:100:4:1::2 route-map mapdeny201 in
  neighbor 2001:100:4:3::2 activate
 exit-address-family
!         
ip forward-protocol nd
!         
!         
no ip http server
no ip http secure-server
!         
!         
route-map mapdeny201 deny 10
 match ipv6 address deny201
!         
route-map mapdeny201 permit 20
 match ipv6 address base
!         
!         
!         
ipv6 access-list base
 permit ipv6 any any
!         
ipv6 access-list deny201
 permit ipv6 2001:200:200:201::/64 any
!   
```


## Part 7: Filtering in function of the AS_PATH

### 7.1

sans bgp R1-R4
```
R1#show ipv6 route 2001:200:200:204::
Routing entry for 2001:200:200:204::/64
  Known via "bgp 11", distance 20, metric 0, type external
  Route count is 1/1, share count 0
  Routing paths:
    FE80::C801:1FFF:FEB6:1C, GigabitEthernet1/0
      MPLS label: nolabel
      Last updated 00:01:02 ago
```
avec bgp R1-R4
```
R1#show ipv6 route 2001:200:200:204::/64    
Routing entry for 2001:200:200:204::/64
  Known via "bgp 11", distance 20, metric 0, type external
  Route count is 1/1, share count 0
  Routing paths:
    FE80::C804:1FFF:FEE7:38, GigabitEthernet2/0
      MPLS label: nolabel
      Last updated 00:01:44 ago

```

### 7.3

sans bgp
```
R3#show ipv6 route 2001:100:1:1::/64
Routing entry for 2001:100:1:1::/64
  Known via "bgp 13", distance 20, metric 0, type external
  Route count is 1/1, share count 0
  Routing paths:
    FE80::C801:1FFF:FEB6:0, FastEthernet0/0
      MPLS label: nolabel
      Last updated 00:23:19 ago

```
pas de changement avec bgp