1

Networking Community,

Problem: I am struggling with applying the correct BGP “next-hop self” policies in JunOS.

Background: I have been brushing up setting BGP policies, e.g. ‘direct’, ‘next-hop self’, etc in JunOS. I am currently using the Juniper vLab “BGP - Multi-AS” as my sandbox (The labs/sandboxes come preconfigured and are free). -Ref. BGP-Multi-AS topology shown below:

BGP Topology

My goal is fairly simple, to configure the policies on the routers so I can ping from vMX1 to vMX6.

The first policy I tried was “direct.” Using the following configuration applied to the “to-AS645XX” groups, I was able to successfully ping from vMX1 to vMX6 using the policy: policy-option policy-statement po-test-export-out-1 term 1 [____]

  • from protocol direct
  • then accept
  • from protocol static
  • then accept

“Next-hop self”

I again tried to do the same thing, (ping from vMX1 to vMX6) except this time using “next-hop self” as my policy and I must admit I am a bit flummoxed.

Someone please correct me here, but the way I am understanding “next-hop self” is that by default, routes learned from eBGP peers are advertised to iBGP with the next hop (of eBGP) unchanged, and if iBGP neighbors do not have routes to the next hop, the routes learned are unusable and are therefore hidden. If I am reading it correctly, “Next-hop self” is used to replace the next-hop of the prefixes learned via eBGP with that of the eBGP router IP itself so internal iBGP peers will then send packets destined for those prefixes to the eBGP routers at the border of the AS.

I have set up an initial configuration on vMX4, vMX2, and vMX1. But am unable to ping from vMX1 to vMX4. Hopefully I am close, but any advice would be appreciated. I have provided my configurations below.

vMX4

jcluser@vMX4# show protocols 
bgp {
    group to-AS64544 {
        type external;
        peer-as 64544;
        neighbor 10.100.46.2;
        neighbor 10.100.45.2;
    }
    group to-AS64522 {
        type external;
        export ebgp-adv;
        peer-as 64522;
        neighbor 10.100.34.1;
        neighbor 10.100.24.1;
    }
}
ospf {
    area 0.0.0.0 {
        interface lo0.0;
    }
}


jcluser@vMX4# show policy-options                    
policy-statement ebgp-adv {
    term 1 {
        from {
            route-filter 10.100.100.4/32 exact;
        }
        then accept;
    }
    term 2 {
        then reject;
    }
}

vMX2

bgp {
    group IBGP {
        type internal;
        local-address 10.100.100.2;
        export ebgp-to-ibgp;
        neighbor 10.100.100.1;
        neighbor 10.100.100.3;
    }
    group to-AS64533 {
        type external;
        peer-as 64533;
        neighbor 10.100.24.2;
    }
    group to-AS64544 {
        type external;
        peer-as 64544;
        neighbor 10.100.25.2;
    }
}
ospf {
    area 0.0.0.0 {
        interface ge-0/0/3.0;
        interface ge-0/0/2.0;
        interface lo0.0;
    }
}

jcluser@vMX2# show policy-options 
term 1 {
    from protocol bgp;
    then {
        next-hop self;
        accept;
    }
}
term 2 {
    then reject;
}

vMX1

jcluser@vMX1# show protocols 
bgp {
    group IBGP {
        type internal;
        local-address 10.100.100.1;
        neighbor 10.100.100.2;
        neighbor 10.100.100.3;
    }
}
ospf {
    area 0.0.0.0 {
        interface ge-0/0/3.0;
        interface ge-0/0/4.0;
        interface lo0.0;
    }
}

[edit]
jcluser@vMX1# 

jcluser@vMX1> show route receive-protocol bgp 10.100.100.2 

inet.0: 13 destinations, 14 routes (13 active, 0 holddown, 0 hidden)
  Prefix  Nexthop       MED     Lclpref    AS path
  10.100.100.4/32         10.100.100.2                 100        64533 I

inet6.0: 1 destinations, 1 routes (1 active, 0 holddown, 0 hidden)

jcluser@vMX1> show route 10.100.100.4 

inet.0: 13 destinations, 14 routes (13 active, 0 holddown, 0 hidden)
+ = Active Route, - = Last Active, * = Both

10.100.100.4/32    *[BGP/170] 04:19:30, localpref 100, from 10.100.100.3
                      AS path: 64533 I, validation-state: unverified
                    >  to 100.123.0.1 via fxp0.0
                    [BGP/170] 01:44:21, localpref 100, from 10.100.100.2
                      AS path: 64533 I, validation-state: unverified
                    >  to 10.100.12.2 via ge-0/0/3.0

jcluser@vMX1> ping 10.100.100.4 
PING 10.100.100.4 (10.100.100.4): 56 data bytes
^C
--- 10.100.100.4 ping statistics ---
2 packets transmitted, 0 packets received, 100% packet loss

Thank you!

The primary Juniper references I have been using are: https://supportportal.juniper.net/s/article/SRX-BGP-NEXT-HOP-self-configuration?language=en_US https://www.juniper.net/documentation/us/en/software/junos/bgp/bgp.pdf

1
  • Your question is quite unclear and you seem to have cut a lot of relevant parts of configuration (policy names for example), and IP addresses in the output don't seem to match the diagram. This makes it really hard to read. Nexthop self is typically set on an import policy for eBGP sessions. It seems you're trying to apply it on iBGP sessions.
    – Teun Vink
    Mar 10 at 10:34

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.