BGP: routing between autonomous systems (FRRouting)
You build eBGP and iBGP sessions with FRRouting and use path attributes and route policies to control which link traffic enters and leaves by.
Level 401 · 20 lessons · 18 practice labs
Lessons
BGP basics
- How the internet is stitched together: ASes and peering
- Your first eBGP session
- BGP session states and a session that will not come up
- Announcing prefixes: network and redistribute
- Short task: exchange prefixes between two ASes
Path selection
- Path attributes: AS_PATH, NEXT_HOP, MED
- The best-path selection algorithm
- Choosing the exit link with local preference
- Steering inbound traffic with AS_PATH prepending
- Carrying policy with communities
- Short task: build a primary and backup provider policy
iBGP and scale
- iBGP and the full-mesh problem
- Route reflectors
- Running BGP together with OSPF
- Short task: simplify a four-router iBGP with a reflector
Protection and monitoring
- Filtering with prefix lists and route maps
- max-prefix, TTL security and session passwords
- Monitoring BGP: tables, logs, looking glass
- Short task: apply a strict prefix filter to a customer session
Wrap-up
- Capstone: the BGP policy of a multihomed company
Practice labs
- The session stays in Active: Find the wrong remote AS number keeping an eBGP session between two ASes from reaching Established, fix it and show the session state.
- Loopback peering will not come up: Find the missing multihop setting and update source on an eBGP session between loopbacks, fix them and show the session survives when one link drops.
- A session that drops every three minutes: Use logs and a capture to find why Copperleaf Insurance’s provider session drops at regular intervals, fix it and show it running for half an hour without a reset.
- The prefix is not being announced: Investigate a prefix that never reaches the neighbour despite its network statement, fix the missing routing-table match and show it in the neighbour’s table.
- Internal routes leaking out: Find the internal subnets sent to the provider because of redistribute connected, change it so only the company prefix is announced, and prove it with the list the neighbour receives.
- Gather scattered blocks into one prefix: Announce several subnets as one aggregate, suppress the unneeded more-specifics, and test and explain what the aggregate does when one subnet goes down.
- Why was this path chosen?: Write a short note explaining, step by step through the best-path algorithm, which of three paths for a prefix was chosen and why, backed by output.
- Keep the expensive link from being primary: Send Windy Ridge Energy’s outbound traffic to the cheap provider with local preference, leave the expensive link as backup, and test the switchover by shutting the primary.
- MED is set but has no effect: Show why MED is ignored between paths from different ASes, achieve the wanted inbound preference with the right tool, and prove it with tables on both sides.
- Keep inbound traffic off the backup link: Prepend the AS_PATH on the prefix sent to the backup provider, and show remote ASes picking the primary path.
- Instruct the provider with a community: Use the provider’s documented community value to have your prefix held at low preference in its network, and prove it with the local preference on the provider router.
- Split inbound load across two links: Announce Saltmarsh Fisheries’s prefix block so inbound traffic splits across two providers, test that all traffic moves when one fails, and document the policy.
- The iBGP route is there but unusable: Show that an external prefix visible on an inside router is unused because its next hop is unreachable, fix it and prove it by passing traffic.
- The fourth router sees no routes: Find the routes that never reach one router because the full mesh is incomplete, solve it with a route reflector and compare the tables on all routers.
- BGP falls when OSPF falls: In a network running BGP over OSPF, find why iBGP sessions drop when one inside link fails, fix the loopback and OSPF design, and show the resilience by cutting the link.
- Only the peer’s own networks: Apply a prefix list on a peering session accepting only the peer’s own and its customers’ prefixes, and show the third-party prefixes it sends being rejected.
- The neighbour suddenly sent a thousand routes: Set max-prefix and a session password against a neighbour flooding routes after a misconfiguration, then recreate the flood and show the protection kicking in.
- The route-map chain denies everything: Step through a route-map with several conditions and community matches to find why it denies every route, fix it to give the intended policy and list the accepted routes.
About this course
You build eBGP and iBGP sessions with FRRouting and use path attributes and route policies to control which link traffic enters and leaves by.
What you will learn
- BGP basics
- Path selection
- iBGP and scale
- Protection and monitoring
- Wrap-up
Prerequisites
You should have practised the topics of the same path up to level 301.
Lab environment
Lessons run in your own Kali Linux terminal in the browser, connected to a private lab network. Nothing to install.
Frequently asked questions
- Is this course right for my level?
- The course is at level 401; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.