BGP on Juniper for beginners

BGP on Juniper for beginners!
Here in this lab I’m going to do enjoy with configuring BGP on Juniper. You should have at least following knowledge before trying to configure BGP.
1
Sound knowledge about Routing Policy on Juniper
Sound knowledge about IGP (OSPF, ISIS)
What is BGP?
Basic terminology of BGP (AS Number, IBGP, EBGP)
When / when not need BGP?
How BGP Works?


Network Scenario
Here in this Lab we have three different AS numbered AS10 which is configured on R1, AS20 which is configured on R2 & R3 and Finally AS30 which is configured on R4. We have a network 172.16.0.0/22 which belongs to AS10 configured on the Loopback interface of R1 and network 172.16.4.0/22 which belongs to AS30 configured on the loopback interface of R4.

Now let’s move to the topology information
SN
Router
AS
Interface IP
1
R1
10
lo0.1 : 172.16.0.1/24
lo0.1 : 172.16.1.1/24
lo0.1 : 172.16.2.1/24
lo0.1 : 172.16.3.1/24
em0.0 : 192.168.12.1/24
2
R2
20
lo0.1 : 2.2.2.2/32
em1.0 : 192.168.12.2/24
em0.0 : 192.168.23.2/24
3
R3
20
lo0.1 : 3.3.3.3/32
em1.0 : 192.168.23.3/24
em0.0 : 192.168.34.3/24
4
R4
30
lo0.1 : 172.16.4.1/24
lo0.1 : 172.16.5.1/24
lo0.1 : 172.16.6.1/24
lo0.1 : 172.16.7.1/24
em1.0 : 192.168.34.4/24

First of all we are going to configure Host Name, Authentication Password, and Interface IP. Let’s begin with R1. 

Step-1. Configuring Hostname, Authentication Password and IP address on the interface.

login: root

root@% cli

root> configure

root# set system host-name R1

root# set system root-authentication plain-text-password

root# set interface em0.0 family inet address 192.168.12.1/24

root# set interface lo0.1 family inet address 172.16.0.1/24

root# set interface lo0.1 family inet address 172.16.1.1/24

root# set interface lo0.1 family inet address 172.16.2.1/24

root# set interface lo0.1 family inet address 172.16.3.1/24


I’m not going to configure R2, R3 and R4 here because the task is identical to configure Host Name, Authentication Password and IP address on the interface. 

Step-2. Configure Autonomous System Number, BGP (EBGP/IBGP) Protocol, Policy as per needs.

Here I’m going to Configure R2 for Step-2 task

Configuring AS Number
root@R2#set routing-options autonomous-system 20

Configuring External BGP (EBGP with AS10)
root@R2#set protocol bgp group Ext-AS10 neighbor 192.168.12.1 peer-as 10

root@R2#set protocol bgp group Ext-AS10 type   external

Configuring Internal BGP (IBGP with AS20)
root@R2#set protocol bgp group Int-AS20 neighbor 3.3.3.3

root@R2#set protocol bgp group Int-AS20 type internal

root@R2#set protocol bgp group Int-AS20 local-address 2.2.2.2

Explanation: In this particular scenario if I configured IBGP with 192.168.23.3 instead of 3.3.3.3 it will be working fine. Because it is directly connected to R3. But in general IBGP is configured in the loopback interface because multiple links can be exists in the production network. So to do the best practice I’m configuring here with loopback interface of R3. Don’t forget to define local-address otherwise IBGP will not establish because R3 will be peered with R2 loopback interface. If you forget do define local-address, source of the bgp packet will be 192.168.23.2 and it will not matched with the address defined by R3 i.e. neighbor 2.2.2.2, to avoid such issue don’t forget to define local address. 

Here I’m not going to configure R1, R3 and R4 because task is identical as shown in the above.
After configuring R1, R3 and R4 you will notice EBGP between R1 & R2 and R3 & R4 will be established. But IBGP between R2 & R3 will not be established.

Why?

We have configured IBGP with the loopback interface of R2 and R3. Loopback interface is not reachable from each other. Here I’m going to configure OSPF between R2 and R3 to solve the reachability issue. Multiple methods are available to accomplish the task. 

I’m configuring OSPF on R2 for sample
root@R2# set protocol ospf area 0 interface lo0.1

root@R2# set protocol ospf area 0 interface em0.0

Step-3. Advertise Network
Now it’s time to advertise 172.16.0.0/24 network to the EBGP AS20 from AS10 and 172.16.4.0/24 network from AS30 to AS 20. To accomplish the task I’m going to configure Policy on R1
root@R1# set policy-options policy-statement Ext-Local term To-AS20 from interface lo0.1

root@R1# set policy-options policy-statement Ext-Local term To-AS20 then accept

roo@R1# set protocol bgp group Ext export Ext-Local

Here I’m not going to configure policy on R4 because task is identical to each other.

Now you will encounter another problem. The Route Advertised from R1 will be displayed on R2 but not on R3 and same thing happen to Route Advertised from R4. Route Advertised from R4 will be displayed on R3 but not on R2.

Router 2 is advertising route receive from R1 which shown from the following output

root@R2> show route advertising-protocol bgp 3.3.3.3



inet.0: 11 destinations, 11 routes (11 active, 0 holddown, 0 hidden)

  Prefix                  Nexthop              MED     Lclpref    AS path

* 172.16.0.0/24           192.168.12.1                 100        10 I

* 172.16.1.0/24           192.168.12.1                 100        10 I

* 172.16.2.0/24           192.168.12.1                 100        10 I

* 172.16.3.0/24           192.168.12.1                 100        10 I

But R3 is not receiving route advertising from R2 which shown from the following output

root@R3> show route receive-protocol bgp 2.2.2.2



inet.0: 11 destinations, 11 routes (7 active, 0 holddown, 4 hidden)


From the above output we see 4 routes are hidden. Let’s find what are them? Hidden routes are shown as bellow
root@R3> show route hidden



inet.0: 11 destinations, 11 routes (7 active, 0 holddown, 4 hidden)

+ = Active Route, - = Last Active, * = Both



172.16.0.0/24       [BGP/170] 00:11:14, localpref 100, from 2.2.2.2

                      AS path: 10 I

                      Unusable

172.16.1.0/24       [BGP/170] 00:11:14, localpref 100, from 2.2.2.2

                      AS path: 10 I

                      Unusable

172.16.2.0/24       [BGP/170] 00:11:14, localpref 100, from 2.2.2.2

                      AS path: 10 I

                      Unusable

172.16.3.0/24       [BGP/170] 00:11:14, localpref 100, from 2.2.2.2

                      AS path: 10 I

                      Unusable


From the above output we can see these routes are unusable. But why ? Let’s find out the root cause.
Router 2 is advertising route receive from R1 which shown from the following output

root@R2> show route advertising-protocol bgp 3.3.3.3



inet.0: 11 destinations, 11 routes (11 active, 0 holddown, 0 hidden)

  Prefix                  Nexthop              MED     Lclpref    AS path

* 172.16.0.0/24           192.168.12.1                 100        10 I

* 172.16.1.0/24           192.168.12.1                 100        10 I

* 172.16.2.0/24           192.168.12.1                 100        10 I

* 172.16.3.0/24           192.168.12.1                 100        10 I

When BGP router receives routes from the Peer it check different attribute before moving routes in the Local-RIB. BGP Next-hop attribute states that if next hop value is not reachable from the local router that route will be discarded.  As we see from the above output Nexthop address is 192.168.12.1 is not reachable from R3 so the router discarded route.  
To fix the issue we have lots of way but I’m going to change the next-hop value when the router advertises routes which were received from BGP with the help of Policy.  

I’m going to configure On R2.

root@R2 # set policy-options policy-statement TO-IBGP term advt from protocol bgp

root@R2 # set policy-options policy-statement TO-IBGP term advt then next-hop self

root@R2 # set protocol bgp group Int-AS20 export TO-IBGP

Here I’m not going to configure R3 because configuration is identical to R2.

Enjoy !

Comments

Post a Comment

Popular Posts Last 30 days

Site-to-Site IPSec VPN Cisco-Juniper

Image
Site-to-Site IPSec VPN Cisco-Juniper :   Scenario! Here in this LAB we have seven routers. R1, R2 and R3 routers represents Branch Router. R1 is working here as the HQ router and R2 and R3 as the Branch Router. R1 and R2 routers are from Juniper Networks and R3 router is from Cisco Inc. R4 router is working as an internet router. Other routers (R5 to R7) are working here as an end device. Task 1.       Configure Policy-based site-to-site VPN. 2.       Consider R4’s loopback address as internet route. 3.       R5 and R6 are configured as server so these servers should be reached from Branch Office too. 4.       Both Branch i.e. R2 and R3 should get internet from HQ i.e. R1 5.       In HQ router we have three zones named SERVER, INTERNET and INTRANET. SERVER Zones belongs to R5 and R6. INTERNET Zone belongs to R4 and INTRANET Zone belongs to the i...
Read more

के हो साइबर सेक्युरिटि ? हाम्रा बैंक कति सुरक्षित ?

बिद्युतिय अथवा प्रविधिको माध्यमबाट प्रविधिमै निर्भर रहने सिस्टम्स, नेटर्वकस, प्रोग्राम्समा मानबिय त्रुटी/अज्ञानता/अचेतना अथवा प्रविधि भित्रको छिद्रको सहयाताले अनधिकृत रुपमा गरिने आक्रमणलाई साइबर अट्याक भन्न सकिन्छ । यसरी सिस्टम्स, नेटवर्कस र प्रोग्राममा हुन सक्ने आक्रमणबाट जोगाउन अपनाईने प्रविधि तथा मानविय चेतनालाई साईबर सेक्युरिटि भनिन्छ । प्रविधिको प्रयोगबाट हुन सक्ने आक्रमणलाई प्रविधिकै प्रयोग गरेर रोक्नु मात्र साईबर सेक्युरिटि होइन दोहो¥याएर पढ्नुहोस् प्रविधिको प्रयोगबाट हुन सक्ने आक्रमणलाई प्रविधिकै प्रयोग गरेर रोक्नु मात्र साईबर सेक्युरिटि होइन । यसले बिभिन्न उपकरण तथा पक्षबाट संकलन गरिएको लग तथा अलर्टको विश्लेषण गरी आवश्यक कदम चाल्न सक्ने क्षमतालाई समेत जनाउदछ र साईबर सेक्युरिटि शब्दले प्रविधिको प्रयोग गर्ने व्यक्तिको सूचना प्रविधि प्रयोग सम्बन्धि चेतना, ज्ञान, बोध आदी समेतलाई समेटदछ । साईबर अट्याक मूलत अनधिकृत रुपमा कुनै सिस्टम्स, नेटर्वकस र प्रोग्राम भित्र छिर्न, त्यहाँ रहेको डाटा परिवर्तन गर्न तथा भएको डाटालाई हटाउन बिगार्न तथा कुनै संस्थाले प्रदान गर्ने सेवा, सुविधा, सुचना...
Read more

Lets Play with BGP

Image
1. Configure IP Address as shown in the diagram 2. Configure Loopback Address as shown in the diagram 3. Configure AS number as shown in the diagram 4. Configure eBGP between AS 5. Configure OSPF in AS 1 6. Configure AS 1 in such a way so R1, R10 and R11 should be in the AS 64512 and R9, R12 and R13 should be in the AS 64534 Other AS should see only AS1 not Private AS Number when they receives routes Inside Sub-AS i.e. 64512 and 64534 full-mesh iBGP should be configured with the most scalable manner Hint (R1 and R9 should be Route-Reflector for the AS 64512 and 64534) Configure eBGP between R11 and R12 7. AS 2 have 192.168.120.0/24 network on his AS and Currently this network is propagating in BGP from AS 2. For some reason a part of that network (192.168.120.248/29) belongs to AS1 configure the needed router to achieve the goal with keeping this informaiton on mind. 8. By default AS1 is the shortest path to go to AS3 from AS2. Because of Bandwidth L...
Read more