1
1.1.1.0/24              1.1.1.0/24
[community 100:1]       [community: 200:1]
[as path 100 300 500]   [as path 200 500]       
eBGP peer (AS100)     eBGP peer (AS200)      
  \                  /
   \                /
    \              / 9.9.9.0/24 not exported to AS200
      \           /
       \        /                     
         ROUTER1 (AS 10) ---------------- ibgp --------------- ROUTER2 (AS 10)
                                                                |
                                                                |
                                                       export routes to AS999 with community 100:1 only (only routes from AS 100)
                                                                |
                                                                |
                                                                |
                                                         9.9.9.0/24
                                                         eBGP peer (AS999)

Purpose: AS999 should only be announced via AS100 and learn AS100 routes.

However I found a problematic scenario:

ROUTER1 has two paths for 1.1.1.0/24 and calculates the best route to 1.1.1.0/24 via AS 200.

Because IBGP exchanges only best routes, ROUTER1 exports only 1.1.1.0/24 via AS200 to ROUTER2.

ROUTER2 exports no routes to AS999 because of a filter in place that accepts only routes tagged 100:1 (routes from AS100).

AS999 won't have a path for 1.1.1.0/24 at all.

Does it make sense to use bgp add path option for the IBGP connection to exchange all routes (not only the best routes) in this situation between ROUTER1 and ROUTER2, which would allow ROUTER2 to learn a path to 1.1.1.0/24 via AS100 as well?

Or is there some other recommended solution?

Thanks.

3
  • Why does AS 999 want a path to AS 100 if router 1 won't forward it that way?
    – Ron Trunk
    Mar 20 at 19:53
  • Well you made a good point that I missed since router1 will hold a FIB entry for 1.1.1.0/24 via AS200 (if we stick with this single prefix as an example, it's the best calculated route) so it will never be forwarded outbound via AS100. On a broader scale I would like for AS999's traffic to only traverse my routers via AS100 and back. This would be quite simple to do on a single router with a separate routing table for AS999, but now that I have two routers in between I am not so sure now...
    – krdx
    Mar 20 at 20:40
  • You can do this several ways but all involve route-maps. You also need to think through (or at least define) more requirements. For example, do you want AS999 to receive any routes from AS200, or just not 1.1.1.0? Should AS 200 advertise prefixes from 999? If AS200 advertises 9.9.9.0, return traffic may come through it. Is that OK?
    – Ron Trunk
    Mar 21 at 12:02

1 Answer 1

1
  1. Router2 can filter out advertisements to AS999 that contain 200 in the path.
  2. Router1 can filter out advertisements to AS 200 that contain 999 in the path.

This should accomplish what you're looking to do.

7
  • That's what I at first thought that it will be this simple but it appears it isn't. Lets assume that the [1] and [2] BGP policies are active. Lets analyze 1.1.1.0/24 prefix on Router1. Router1 installs in the FIB 1.1.1.0/24 via AS200 and exports this via iBGP to Router2. Because policy [1] is active on Router2, AS999 doesn't learn the 1.1.1.0/24 prefix at all. IF I use bgp additional paths extension on Router1/Router2, then Router1 will send both paths to 1.1.1.0/24 via AS100 and AS200. This lets AS999 to learn a route to 1.1.1.0/24 via AS100. Sounds good sofar
    – krdx
    Mar 21 at 17:49
  • Because policy [1] is active on Router2, AS999 doesn't learn the 1.1.1.0/24 prefix at all. According to your description, that's what you want. If router 1's path to 1.1.1.0 is through 200, then don't tell 999 about it.
    – Ron Trunk
    Mar 21 at 17:51
  • But now lets see what happens when AS999 decides to send a packet towards 1.1.1.0/24. First it lands on Router2. It consults the FIB, sends it to Router1. Then it lands on Router1. It consults the FIB, the best path for 1.1.1.0/24 is via AS200. So router1 will egress this packet towards AS200. Since the AS200 is a private peering m for AS10 and meant to be used only for AS10 I violated the requirement. (E.g. AS200 can have an ACL to only allow packets from AS10).
    – krdx
    Mar 21 at 17:54
  • "Because policy [1] is active on Router2, AS999 doesn't learn the 1.1.1.0/24 prefix at all. According to your description, that's what you want." Ok, so that's the misunderstanding. No, I would very much want AS999 to learn a path to 1.1.1.0/24 but not via AS200. So I don't think I can easily achieve this with BGP alone, and should opt in for a separate routing table/VRF or something.
    – krdx
    Mar 21 at 17:55
  • In the shortest terms, from the perspective of AS999. Routers 1 and Routers 2 should handle AS999 traffic as if they didn't know that AS200 exists at all.
    – krdx
    Mar 21 at 17:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.