Sample Configuration for BGP with Two Different Service Providers (ISP) - Multihoming
[LEFT][CODE]http://www.cisco.com/en/US/tech/tk365/technologies_configuration_example09186a008009456d.shtml[/CODE]
[B] Introduction [/B]
Border Gateway Protocol (BGP) is one of the key protocols to use to achieve Internet connection redundancy. When you connect your network to two different Internet service providers (ISPs), it is called [I]multihoming[/I]. Multihoming provides redundancy and network optimization. It selects the ISP which offers the best path to a resource. When you are running BGP with more than one service provider, you run the risk that your autonomous system (AS) will become a transit AS. This causes Internet traffic to pass through your AS and potentially consume all of the bandwidth and resources on the CPU of your router. This document addresses this issue, with appropriate configuration examples.
[B] Prerequisites [/B]
[B] Requirements [/B]
Ensure that you have knowledge of these topics before you attempt this configuration:
[LIST][*] [URL="http://www.cisco.com/en/US/docs/ios/12_2/ip/configuration/guide/1cfbgp.html#wp1000879"]The Cisco BGP Implementation[/URL][*] [URL="http://www.cisco.com/en/US/docs/ios/12_2/ip/configuration/guide/1cfbgp.html#wp1000934"]Basic BGP Configuration Task List[/URL][*] [URL="http://www.cisco.com/en/US/tech/tk365/technologies_tech_note09186a00800c95bb.shtml"]BGP Case Studies[/URL][/LIST]
[B] Components Used [/B]
The information in this document is based on Cisco 2500 Series Routers that run Cisco IOS® Software Release 12.2(27).
The information in this document was created from the devices in a specific lab environment. All of the devices used in this document started with a cleared (default) configuration. If your network is live, make sure that you understand the potential impact of any command.
[B] Conventions [/B]
Refer to [URL="http://www.cisco.com/en/US/tech/tk801/tk36/technologies_tech_note09186a0080121ac5.shtml"]Cisco Technical Tips Conventions[/URL] for more information on document conventions.
[B] Background Information [/B]
If you want to receive the full Internet routing table, use the [URL="http://www.cisco.com/en/US/tech/tk365/technologies_configuration_example09186a008009456d.shtml#routingtable"]Configuration to Receive Full Internet Routing Table[/URL] on your local router (Router A in the examples in this document).
If you want to receive routes that are directly connected to your service providers, but use default routes to the rest of the Internet, try the [URL="http://www.cisco.com/en/US/tech/tk365/technologies_configuration_example09186a008009456d.shtml#directlyconnected"]Configuration to Receive Directly-Connected Routes[/URL].
If you want to receive only default routes from the directly connected service providers, use the [URL="http://www.cisco.com/en/US/tech/tk365/technologies_configuration_example09186a008009456d.shtml#defaultroutes"]Configuration to Receive Default Routes Only[/URL].
For more information about the regular expressions used in the configurations in this document, refer to [URL="http://www.cisco.com/en/US/tech/tk365/technologies_tech_note09186a0080094a92.shtml"]Using Regular Expressions in BGP[/URL].
[B] Configure [/B]
In this section, you are presented with the information to configure the features described in this document.
[B]Note: [/B]Use the [URL="http://www.cisco.com/pcgi-bin/Support/Cmdlookup/home.pl"]Command Lookup Tool[/URL] ([SIZE=-1] [URL="http://tools.cisco.com/RPF/register/register.do"]registered[/URL] customers only[/SIZE]) to find more information on the commands used in this document.
[B] Network Diagram [/B]
This document uses this network setup:
[IMG]http://www.cisco.com/image/gif/paws/23675/27.gif[/IMG]
In that network diagram, 1.0.0.0/8 and 2.0.0.0/8 are advertised by AS 300 to the outside.
[B] Configuration to Receive Full Internet Routing Table [/B]
The following configuration allows Router A to peer with BGP speakers in other autonomous systems. The [B]route-map localonly[/B] allows only the locally generated routes to be advertised to both of the service providers. In other words, they filter the Internet routes from one service provider that go back to the other service provider. This prevents the risk that your autonomous system will become a transit AS for Internet traffic.
Router A
Current configuration:
[B]router bgp 300[/B]
network 1.0.0.0
network 2.0.0.0
neighbor 10.10.10.10 remote-as 100
neighbor 10.10.10.10 route-map localonly out
[I]
[COLOR=#0000ff]!--- Outgoing policy route-map that filters routes to service provider A (SP-A).[/COLOR]
[/I]
neighbor 20.20.20.20 remote-as 200
neighbor 20.20.20.20 route-map localonly out
[I]
[COLOR=#0000ff]!--- Outgoing policy route-map that filters routes to service provider B (SP-B).[/COLOR]
[/I]
end
This AS-Path access list only permits locally originated BGP routes:[INDENT] ip as-path access-list 10 permit ^$[/INDENT]This is an example of a route map that uses that AS-Path access list to filter the routes advertised to the external neighbors in the service provider networks:[INDENT] route-map localonly permit 10
match as-path 10[/INDENT][B] Configuration to Receive Directly-Connected Routes [/B]
Router A
Current configuration:
[B]router bgp 300[/B]
network 1.0.0.0
network 2.0.0.0
neighbor 10.10.10.10 remote-as 100
neighbor 10.10.10.10 route-map localonly out
[I]
[COLOR=#0000ff]!--- Outgoing policy route-map that filters routes to SP-A.[/COLOR]
[/I]
neighbor 10.10.10.10 route-map as100only in
[I]
[COLOR=#0000ff]!--- Incoming policy route-map that filters routes from SP-A.[/COLOR]
[/I]
neighbor 20.20.20.20 remote-as 200
neighbor 20.20.20.20 route-map localonly out
[I]
[COLOR=#0000ff]!--- Outgoing policy route-map that filters routes to SP-B.[/COLOR]
[/I]
neighbor 20.20.20.20 route-map as200only in
[I]
[COLOR=#0000ff]!--- Incoming policy route-map that filters routes from SP-B.[/COLOR]
[/I]
end
Because you only want to accept routes that are directly connected to the service providers, you must filter the routes that they send to you, as well as the routes that you advertise. This access list and route map permit only locally originated routes; use it to filter outbound routing updates:[INDENT] ip as-path access-list 10 permit ^$
route-map localonly permit 10
match as-path 10[/INDENT]This access list and route map filter out anything that is not sourced within the first service provider network; use it to filter the routes that are learned from service provider A (SP-A).[INDENT] ip as-path access-list 20 permit ^100$
route-map as100only permit 10
match as-path 20[/INDENT]This access list and route map filter out anything that is not sourced within the second service provider network; use it to filter the routes that are learned from service provider B (SP-B).[INDENT] ip as-path access-list 30 permit ^200$
route-map as200only permit 10
match as-path 30[/INDENT]You also need two default routes that are distributed back into the rest of your network, one pointed to each of the service provider entry points:[INDENT] ip route 0.0.0.0 0.0.0.0 10.10.10.10
ip route 0.0.0.0 0.0.0.0 20.20.20.20[/INDENT][B] Configuration to Receive Default Routes Only [/B]
Router A
Current configuration:
[B]router bgp 300[/B]
network 1.0.0.0
network 2.0.0.0
neighbor 10.10.10.10 remote-as 100
neighbor 10.10.10.10 route-map localonly out
[I]
[COLOR=#0000ff]!--- Outgoing policy route-map that filters routes to SP-A.[/COLOR]
[/I]
neighbor 10.10.10.10 prefix-list ABC in
neighbor 20.20.20.20 remote-as 200
neighbor 20.20.20.20 route-map localonly out
[I]
[COLOR=#0000ff]!--- Outgoing policy route-map that filters routes to SP-B.[/COLOR]
[/I]
neighbor 20.20.20.20 prefix-list ABC in
ip prefix-list ABC seq 5 permit 0.0.0.0/0
[I]
[COLOR=#0000ff]!--- Prefix list to allow only default route updates.[/COLOR]
[/I]
end
Because you want Router A to receive only default routes and no other networks from SP-A and SP-B, you must permit only the default route and deny all other BGP updates. Use this prefix list to allow only the default route update 0.0.0.0/0 and to deny all other BGP updates on Router A:[INDENT] ip prefix-list ABC seq 5 permit 0.0.0.0/0[/INDENT]Apply that prefix list on the inbound updates on individual BGP neighbors in this way:[INDENT] neighbor 10.10.10.10 prefix-list ABC in
neighbor 20.20.20.20 prefix-list ABC in[/INDENT]For more information on how to configure a prefix list, refer to the [URL="http://www.cisco.com/en/US/docs/ios/12_0/np1/configuration/guide/1cbgp.html#wp7487"]Configuring BGP Filtering Using Prefix Lists[/URL] section of [URL="http://www.cisco.com/en/US/docs/ios/12_0/np1/configuration/guide/1cbgp.html"]Configuring BGP[/URL]
For explanations of what each command does, refer to [URL="http://www.cisco.com/en/US/docs/ios/12_0/np1/configuration/guide/1cbgp.html"]Configuring BGP[/URL] and [URL="http://www.cisco.com/en/US/docs/ios/12_2/iproute/command/reference/1rfbgp1.html"]BGP Commands[/URL].
[B] Verify [/B]
Use this section to confirm that your configuration works properly.
The [URL="https://www.cisco.com/cgi-bin/Support/OutputInterpreter/home.pl"]Output Interpreter Tool[/URL] ([SIZE=-1] [URL="http://tools.cisco.com/RPF/register/register.do"]registered[/URL] customers only[/SIZE]) (OIT) supports certain [B]show[/B] commands. Use the OIT to view an analysis of [B]show[/B] command output.
You can use the [URL="http://www.cisco.com/en/US/docs/ios/12_3/iproute/command/reference/ip2_s3g.html#wp1039689"] [B]show ip route[/B] [/URL] and [URL="http://www.cisco.com/en/US/docs/ios/12_3/iproute/command/reference/ip2_s2g.html#wp1039007"] [B]show ip bgp[/B] [/URL] commands to check the IP routing table and BGP routing table entries.
[B][URL="http://www.cisco.com/en/US/tech/tk365/technologies_tech_note09186a008009478a.shtml"]Troubleshoot[/URL] [/B]
[/LEFT]
