We will be undergoing scheduled maintenance on May 20th, 2013 at 02:00 GMT.
Implementing Cisco IP Routing (642-902 ROUTE) Tutorials
BGP / Lab - BGP Transit Area Prevention
Visitors to VTC.com will be able to view all introductory videos for each training course.
Free Trial Members will gain access to first three chapters for each training course.
Full Access Members have full access to VTC.com�s entire library of video tutorials.
Learn More
Subtitles of the Movie (Implementing Cisco IP Routing (642-902 ROUTE) / BGP / Lab - BGP Transit Area Prevention)
In this video, we're going to discuss BGP Transit Areas and how to prevent your network from becoming one. As I put this section of the lab together, I've affectionately referred to it as the Get Off my Lawn section of the lab. So let's look at our network layout here. Obviously we're emulating the Internet here with seven Routers and if you'll notice all of the routes that start with 150 and 151 are over here under Access 2 and ISP 2. And all the routes that start with 50 or 10 are over here under Access 1 and ISP 1. So let's go over to ISP 1 and let's check his Route Table and see how he would get to these 150 networks. So we go over to ISP 1, run Show IP Route and if we look at 150.10. 11 and 12 we see that his next hop is 50.1.1.2 which if we look back at our Network Diagram, 50.1.1.2 is the Access 1 Router. So it shows that the quickest way for ISP 1 to get to these routes over here in AS 50 is to go through AS 12, our Autonomous System in one of our Internet connections, across our Core Router, out the other Internet connection and over here to this other ISP. Therefore using our bandwidth, our routing processes, basically we want them to get off our lawn. And the reason for this is, is that we haven't tuned BGP to prevent this. If we go over to ISP 1 and we do Show IP BGP and we look at the routes for these 150 networks, we'll see the reason why it's picked these routes through 50.1.1.2, is that the AS Path is shorter. It goes 12, 50 versus 42, 55 and then 50. However, we don't want them to come through AS 12. So the easiest way to do this, is to go into both our Access 1 and Access 2 Routers and set up what's called an AS Path Access List. And this AS Path Access List will say, I only want you to allow routes that originated in my Autonomous System. If you learn a route that originates in Autonomous System 50 and you learn it through Access 2, don't advertise that same route out ISP 1 because then ISP 1 will say, oh well I can just go this way and get to that network a lot quicker. And trust me I can see why that works, because again you're kind of short circuiting the Internet by sending it through your Internet connections. So this introduces two new concepts, again it's the AS Path Access List and a Filter List. So lets go here onto Access 1 and let's set both of these up. So Access 1 we'll go into Config T and the first thing we're going to do is set up our AS Path Access List. So we'll do IP, if we hit Question Mark we'll see that we have lots of options in here. We're going to set up an AS Path which is an Autonomous System Path Filter. So IP AS Path, the only thing we can do is set up an Access List, so Access List and we're going to give it an Access List of 1. We're going to Permit and then we can do a Regular Expression to match BGP Paths. Now I'll admit I'm not an expert with Regular Expressions, there's whole tutorials on using Regular Expressions and in my opinion people that use Regular Expressions are nigh on wizards in technology almost. I do know however, that this Regular Expression here in Cisco Routers in the AS Path Access List says only Permit routes that originated in my Autonomous System. Basically AS 12 is first or AS 47 or 228 or whatever your Local AS is, only permit paths that are in this Autonomous System or that originated in this Autonomous System and that's the only thing we're going to put in this Access List, because we want to deny everything else. Now we go into BGP and we say for our neighbor, in this case neighbor 50.1.1.1, we're going to Filter our Updates through this Access List. So basically, we're telling BGP unless you learned about the route from your own internal Autonomous System, don't even send it to the neighbor. This way you advertise just your networks, just your Internet presence to your ISP, you don't advertise your other Internet presence or if you have three or four, you don't advertise all of your Internet presences out to your ISP. So we'll do Router BGP 12, we will then go into Neighbor 50.1.1.1 and give it a Filter List argument and again it's another Neighbor Statement but you should be used to that by now. And there's the command we're going to put in, Neighbor 50.1.1.1 Filter List. We're going to use Filter List 1 which only permits our local AS and we're filtering it outbound. We obviously don't want to filter it inbound because it wouldn't do any good, because basically, all of the routes we're going to learn won't originate from AS 12, it'll originate somewhere else on the Internet. So we're filtering it outbound to this neighbor using that List 1. So now we go in here and do Clear IP BGP star and I'm going to go over to the Access 2 Router and do the exact same thing only with it's neighbor and I'm going to come back once BGP has reconverged on that Router as well and we'll examine the Route Tables to make sure that it worked as we expected. Alright, so now I've modified the Access 2 Router, let's go look at the ISP 1 Route Table now, Show IP Route. We should not see any routes going to 50.1.1.1 except for the 192.168 and the 10.20 networks. So there's 192.168 via 50.1.1.2. There's all the 10.5s going out the other network. There's all the 151 and 150, they're all going out 50.10.10.2 which is it's link to what I've got labeled as Customer 1, but let's for the time being assume that it's just another Router out on the Internet. And none of our routes are going through our AS. If I do Show IP BGP, we notice that the only networks we show that start with 12 are the actual networks that are in Autonomous System 12. Everything else goes out through AS 42 which is as it's supposed to be. So that is how you prevent your Internet connection in your local network from becoming a BGP Transit AS.
Tutorial Information
| Course: | Implementing Cisco IP Routing (642-902 ROUTE) |
| Author: | Greg Dickinson |
| SKU: | 34291 |
| ISBN: | 978-1-61866-028-2 |
| Release Date: | 2011-12-28 |
| Duration: | 10 hrs / 105 lessons |
| Work Files: |
Yes |
| Captions: | No |
| Compatibility: |
Vista/XP/2000, OS X, Linux QuickTime 7, Flash 8 |
VTC Sign up & Benefits
- Unlimited Access
- 81,350 Video Tutorials (14,200 free)
- Video Available as Flash or QuickTime
- Over 715 Courses
- $30 for One Month Access
- Multi-User Discounts Available
