2

In the following topology I have a multi-point redistribution from BGP <-> OSPF and I have recently encountered a routing loop. After further reading I have understood the problematic routers were ISP-2 and ISP-3 and that I need to tag the routes and deny as needed so the loop won't occur, however, after trying it out I understood BGP does not support tags (% "OSPF_TO_BGP" used as redistribute ospf into bgp route-map, set tag not supported). Looking into the topic I was told I could achieve the same thing with BGP communities but I have no clue as to how I should implement this. I'll appreciate any help.

NOTE: Images, traces and configurations added below trace of trying to ping RE-2 from RB-5

RB-5#trace 10.1.22.2  
Type escape sequence to abort.
Tracing the route to 10.1.22.2
VRF info: (vrf in name/id, vrf out name/id)
  1 172.16.52.2 11 msec 9 msec 6 msec
  2 172.16.65.1 [AS 65200] 9 msec 13 msec 7 msec
  3 10.1.11.2 [AS 65200] 9 msec 21 msec 20 msec
  4 10.1.31.1 [AS 65200] 29 msec 18 msec 15 msec
  5 10.0.32.2 [AS 65200] 17 msec 20 msec 10 msec
  6 10.0.42.1 [AS 65200] 18 msec 25 msec 13 msec
  7 172.16.34.2 [AS 65100] 21 msec 32 msec 18 msec
  8 172.16.32.2 [AS 65100] 13 msec 12 msec 14 msec
  9 172.16.65.1 [AS 65200] 15 msec 31 msec 16 msec
 10 10.1.11.2 [AS 65200] 15 msec 18 msec 16 msec
 11 10.1.31.1 [AS 65200] 18 msec 28 msec 24 msec
 12 10.0.32.2 [AS 65200] 22 msec 24 msec 13 msec
 13 10.0.42.1 [AS 65200] 22 msec 24 msec 22 msec
 14 172.16.34.2 [AS 65100] 34 msec 22 msec 16 msec
 15 172.16.32.2 [AS 65100] 20 msec 18 msec 17 msec
 16 172.16.65.1 [AS 65200] 41 msec 33 msec 26 msec
 17 10.1.11.2 [AS 65200] 20 msec 25 msec 28 msec
 18 10.1.31.1 [AS 65200] 31 msec 34 msec 28 msec
 19 10.0.32.2 [AS 65200] 21 msec 32 msec 24 msec
 20 10.0.42.1 [AS 65200] 26 msec 30 msec 31 msec
 21 172.16.34.2 [AS 65100] 37 msec 45 msec 44 msec
 22 172.16.32.2 [AS 65100] 12 msec 29 msec 36 msec
 23 172.16.65.1 [AS 65200] 24 msec 38 msec 33 msec
 24 10.1.11.2 [AS 65200] 31 msec 34 msec 32 msec
 25 10.1.31.1 [AS 65200] 68 msec 59 msec 63 msec
 26 10.0.32.2 [AS 65200] 42 msec 45 msec 35 msec
 27 10.0.42.1 [AS 65200] 28 msec 51 msec 30 msec
 28 172.16.34.2 [AS 65100] 45 msec 32 msec 48 msec
 29 172.16.32.2 [AS 65100] 41 msec 37 msec 41 msec
 30 172.16.65.1 [AS 65200] 39 msec 47 msec 39 msec

ISP-2 Config:

ISP-2(config)#do show run
Building configuration...

Current configuration : 2854 bytes
!
! Last configuration change at 08:07:38 UTC Thu Jul 29 2021
!
version 15.2
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
service compress-config
!
hostname ISP-2
!
boot-start-marker
boot-end-marker
!
!
logging discriminator EXCESS severity drops 6 msg-body drops EXCESSCOLL 
logging buffered 50000
logging console discriminator EXCESS
!
no aaa new-model
!
!         
!         
!         
!         
no ip icmp rate-limit unreachable
!         
!         
!         
no ip domain-lookup
ip cef    
no ipv6 cef
!         
!         
!         
spanning-tree mode rapid-pvst
spanning-tree extend system-id
!         
vlan internal allocation policy ascending
!         
ip tcp synwait-time 5
!         
!         
!         
!         
!         
!         
!         
!         
!         
!         
!         
!         
!         
interface Ethernet0/0
 no switchport
 ip address 172.16.12.2 255.255.255.252
 duplex auto
!         
interface Ethernet0/1
 no switchport
 ip address 172.16.52.2 255.255.255.252
 duplex auto
!         
interface Ethernet0/2
 no switchport
 ip address 172.16.32.2 255.255.255.252
 duplex auto
!         
interface Ethernet0/3
 no switchport
 ip address 172.16.210.1 255.255.255.252
 duplex auto
!         
interface Ethernet1/0
 shutdown 
!         
interface Ethernet1/1
 shutdown 
!         
interface Ethernet1/2
 shutdown 
!         
interface Ethernet1/3
 shutdown 
!         
interface Ethernet2/0
 shutdown 
!         
interface Ethernet2/1
 shutdown 
!         
interface Ethernet2/2
 shutdown 
!         
interface Ethernet2/3
 shutdown 
!         
interface Ethernet3/0
 shutdown 
!         
interface Ethernet3/1
 shutdown 
!         
interface Ethernet3/2
 shutdown 
!         
interface Ethernet3/3
 no switchport
 ip address 172.16.65.2 255.255.255.252
 duplex auto
!         
interface Vlan1
 no ip address
 shutdown 
!         
router ospf 101
 redistribute bgp 65200 metric 1 metric-type 1 subnets route-map BGP_TO_OSPF
 network 172.16.65.0 0.0.0.3 area 1
!         
router bgp 65200
 bgp router-id 2.0.0.2
 bgp log-neighbor-changes
 neighbor 172.16.12.1 remote-as 15000
 neighbor 172.16.32.1 remote-as 65100
 neighbor 172.16.52.1 remote-as 25000
 neighbor 172.16.210.2 remote-as 65300
 !        
 address-family ipv4
  network 172.16.12.0 mask 255.255.255.252
  network 172.16.32.0 mask 255.255.255.252
  network 172.16.52.0 mask 255.255.255.252
  network 172.16.65.0 mask 255.255.255.252
  network 172.16.210.0 mask 255.255.255.252
  redistribute ospf 101 match internal external 1 external 2 route-map OSPF_TO_BGP
  neighbor 172.16.12.1 activate
  neighbor 172.16.32.1 activate
  neighbor 172.16.52.1 activate
  neighbor 172.16.210.2 activate
 exit-address-family
!         
ip forward-protocol nd
!         
ip bgp-community new-format
!         
no ip http server
no ip http secure-server
!         
!         
!         
route-map BGP_TO_OSPF deny 10
 match tag 111
!         
route-map BGP_TO_OSPF permit 20
 set tag 222
!         
route-map OSPF_TO_BGP deny 10
 match tag 222
!         
route-map OSPF_TO_BGP permit 20
 set tag 111
!         
!         
!         
control-plane
!         
!         
line con 0
 exec-timeout 0 0
 privilege level 15
 logging synchronous
line aux 0
 exec-timeout 0 0
 privilege level 15
 logging synchronous
line vty 0 4
 login    
!         
!         
end
Improve this question
1
  • Did any answer help you? if so, you should accept the answer so that the question does not keep popping up forever, looking for an answer. Alternatively, you could post and accept your own answer.
    – Ron Maupin ♦
    Dec 23, 2021 at 21:03

5 Answers 5

Reset to default
3

I do the same in my network, but it does work. I think the difference here is the tagging that you use to redistribute, and is not supported as you mentioned. You can do the filtering on the route map via ip prefix instead of tag. Please, check the example in my router and let me know if it helps.

router ospf 1
 router-id 10.254.61.254
 redistribute bgp 65111 metric 10 route-map BGP-to-OSPF
 passive-interface default
 no passive-interface Loopback1
 no passive-interface Vlan4003
 network 10.211.61.72 0.0.0.3 area 11
 network 10.254.61.254 0.0.0.0 area 11
!
router bgp 65111
 bgp router-id 10.255.61.5
 bgp log-neighbor-changes
 neighbor 10.255.61.1 remote-as 65444
 neighbor 10.255.61.1 update-source GigabitEthernet0/0/0
 !
 address-family ipv4
  network 10.254.61.254 mask 255.255.255.255
  network 10.255.61.0 mask 255.255.255.248
  network 172.17.111.0 mask 255.255.255.0
  network 172.17.121.0 mask 255.255.255.0
  redistribute ospf 1 metric 10 route-map OSPF-to-BGP
  neighbor 10.255.61.1 activate
  neighbor 10.255.61.1 send-community
  neighbor 10.255.61.1 allowas-in 1
  neighbor 10.255.61.1 soft-reconfiguration inbound
 exit-address-family
!
ip prefix-list IPVPN seq 10 permit 10.30.0.0/16
ip prefix-list IPVPN seq 15 permit 172.19.221.0/24
ip prefix-list IPVPN seq 20 permit 172.19.21.0/24
ip prefix-list IPVPN seq 25 permit 10.7.0.0/16
!
ip prefix-list PF-LOCAL seq 10 permit 10.211.1.0/24
ip prefix-list PF-LOCAL seq 15 permit 172.17.101.0/24
ip prefix-list PF-LOCAL seq 20 permit 172.17.102.0/24
ip prefix-list PF-LOCAL seq 25 permit 172.17.103.0/24
ip prefix-list PF-LOCAL seq 30 permit 172.17.104.0/24
ip prefix-list PF-LOCAL seq 35 permit 172.17.105.0/24
ip prefix-list PF-LOCAL seq 40 permit 172.17.111.0/24
ip prefix-list PF-LOCAL seq 45 permit 172.17.121.0/24
!
ip prefix-list PL-DEFAULT-ROUTE seq 5 permit 0.0.0.0/0
!
!
route-map BGP-to-OSPF permit 10 
 match ip address prefix-list IPVPN
!
route-map OSPF-to-BGP permit 10 
 match ip address prefix-list PF-LOCAL
!
route-map RM-DENY-DEFAULT-IN deny 5 
 match ip address prefix-list PL-DEFAULT-ROUTE
!
route-map RM-DENY-DEFAULT-IN permit 10 
!
Improve this answer
1
  • You deny for the default route should be have le 32 at the end otherwise it’ll match ALL routes and deny all inbound routes rather than just the default route, if that was your goal (based on the name you used, I’m guessing it was).
    – Jesse P.
    Jul 29, 2021 at 11:16
3

Without configurations for some of the other routers (RO-4/RO-1) we're basically guessing. However, this sounds like a classic issue of your own routes being announced back to you. If "ISP-2" is supposed to be an ISP's router, it wouldn't be running OSPF with you.

In this messy example, you've created a loop between OSPF area 0 and 1 outside of OSPF (via BGP.) OSPF obviously can't see that. In the common real world case, you'd never dump OSPF into BGP. You would tightly configure BGP to only announce the prefixes you own -- the prefixes known/expected to be within the AS -- and filter those prefixes out of what others announce to you:

! (null routes covering owned prefixes, so they're always in the FIB)
ip route 246.152.0.0  255.255.224.0 Null0 200
ip route 246.152.32.0 255.255.240.0 Null0 200
ip route 246.152.48.0 255.255.240.0 Null0 200

router bgp ...
! (announce the networks I own)
network 246.152.0.0  mask 255.255.224.0
network 246.152.32.0 mask 255.255.240.0
network 246.152.48.0 mask 255.255.240.0

neighbor XXX distribute-list 111 in

! (for any global internet peer)
access-list 111 deny   ip 127.0.0.0 0.255.255.255 any log
access-list 111 deny   ip 10.0.0.0 0.255.255.255 any log
access-list 111 deny   ip 172.16.0.0 0.15.255.255 any log
access-list 111 deny   ip 192.168.0.0 0.0.255.255 any log
! ...
! (allow multi-homed customer's prefix)
access-list 111 permit ip 246.152.26.0 0.0.0.255 any
! ...
! (owned prefix)
access-list 111 deny   ip 246.152.0.0 0.0.63.255 any log
! ...
access-list 111 permit ip any any

If you have multiple, independent borders (announced with different ASNs), you'd have to filter those route announcements ingress at the other borders.

neighbor XXX filter-list 99 in

ip as-path access-list 99 deny (^|_)65100(_|$)
ip as-path access-list 99 deny (^|_)65200(_|$)
ip as-path access-list 99 deny (^|_)65300(_|$)

(Similar filtering is possible with route-maps, including using tags and communities.)

Improve this answer
1

Had this conversation yesterday. Communities sound complex but are really just tags for BGP. There are a few different ways that you could potentially resolve this. Looking at the topology I am assuming that RO-1 and RO-4 are your redistribution sets. With this in mind you could set a BGP community for 65100:10 and 65200:10 (the number is arbitrary. Standard practice is to use your ASN). At the redistribution points you would add a route map to set the community for redistributed routes to either community 65100:10 or 65200:10 and then on your eBGP peers you would want to set an inbound policy from your ebgp neighbors to match on 65100:10 or 65200:10 and deny those routes. I am on a phone so typing an example config is a bit difficult but hopefully this is helpful

Key things to remember: You need to accept and send communities

Recommend turning on soft reset inbound (helps to verify that you see the NLRI and can set up rules accordingly

Inbound policies: you can match on your known prefixes or match on communities. There are conditionals you can setup but those are a bit more complex

Improve this answer
1

You have a couple of route-maps that are almost correct. Like you surmised, you need to use communities within BGP routing-policy.

ip community-list standard permit from-ospf <asn>:1

route-map BGP_TO_OSPF deny 10
 match community from-ospf
route-map BGP_TO_OSPF permit 20
 set tag 222

route-map OSPF_TO_BGP deny 10
 match tag 222
route-map OSPF_TO_BGP permit 20
 set community <asn>:1
Improve this answer
0

So after further examination I had came to conclusion that one of the main reasons trace didn't work for a few devices was because a wrong route was selected. The issue was directly with OSPF route selection preferring the ASBRs that were redistributing the redistributed route (EIGRP->OSPF) as opposed to the redistributed route from the ASBR that was already bordering EIGRP.

Now the only part remaining is the route tagging using route tags and BGP communities.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.