BGP配置与排错

©2003,CiscoSystems,Inc.Allrightsreserved.BSCI2.0—7-1BGP配置及其排错©2003,CiscoSystems,Inc.Allrightsreserved.1©2003,CiscoSystems,Inc.Allrightsreserved.BSCI2.0—7-2•BGP掌控着Internet上十多万条路由，之所以这么强悍是因为其深谙无为而治的道理，IGP的协议都有着非常复杂的路由算法（SPF/DUAL）,看上去很美的算法反而束缚了这些协议的施展空间，BGP没有算法，有的是可以随心所欲控制的规则（属性）•可怜的IGP不仅要被人鄙视，还要被霸道的BGP利用，它们一方面要为BGP牵线搭桥建立邻居关系，另一方面他们辛苦学习来的路由还要遭受BGP随心所欲的玩弄（控制）。•相对于IGP而言，BGP协议的精髓在于对路由的控制，而不是学习路由。©2003,CiscoSystems,Inc.Allrightsreserved.2BGP何以如此强大？©2003,CiscoSystems,Inc.Allrightsreserved.BSCI2.0—7-3©2003,CiscoSystems,Inc.Allrightsreserved.3BGP高度总结•邻居：用loopback接口创建(update-sourceloopback)，保证邻居的可靠冗余IBGP:两个地址之间有路由即可。有两大问题一同步问题（只要规划合理，nosynchronization）二水平分割问题解决方案有三个FULL-MESHIBGP（开销太高）RouteReflector（路由反射器）RouteConfederence（路由联盟）EBGP:如果不直连，用静态路由提供IP连接并且修改TTL值（ebgp-multihop255）•下一跳：不需要直连，但必须通过IGP可达默认情况，是指的到达下一个AS的最佳入口地址，当不可达时(Next-HoP-Self)©2003,CiscoSystems,Inc.Allrightsreserved.BSCI2.0—7-4控制数据包的出口路径（在inbound方向的路由上设置）•Weight•Local-Preference控制数据包的入口路经（在outbound方向的路由上设置）•As-Pathprepend•Med•Community策略控制©2003,CiscoSystems,Inc.Allrightsreserved.BSCI2.0—7-5Access-Listfilter(最传统的控制方法，不灵活)Prefix-Listfilter（可以直接引用在Neighbor上，也可以被distribute-list以及route-map调用）AS-pathfilter（可以被filter-list或者route-map调用）Community-listfilter（可以被route-map调用）Distribute-List(只过滤不做属性控制)Route-Map（过滤，属性控制）强烈推荐：对于IGP协议,用prefix-list定义路由，通过Distribute-List掉用进行路由过滤。对于BGP协议，用Prefix-List,As-PathListCommunity-list定义路由，再通过route-map进行调用©2003,CiscoSystems,Inc.Allrightsreserved.5©2003,CiscoSystems,Inc.Allrightsreserved.BSCI2.0—7-6汇总•Networkx.x.x.xx.x.x.x（对IGP路由进行汇总宣告此路由必须在路由表中有一个精确匹配的路由）属于虚假汇总，需要创建指向null0的静态路由•Aggregatex.x.x.xx.x.x.x(summary-only)(as-set)真正的汇总，汇总BGP表中的路由，具体路由可以通过summary-only抑制as-set可以设置被汇总具体路由的AS编号©2003,CiscoSystems,Inc.Allrightsreserved.BSCI2.0—7-7常见故障汇总•邻居不能建立（AS号码错误，地址不匹配，路由不可达，TTL问）Bgplog-neighbor-changeShowipbgpneighborx.x.x.xShowipbgpsummary•路由丢失(next-hop无效，路由未同步，宣告的网络没有与之匹配的IGP路由，汇总时被抑制，做了错误的过滤)Showipbgp(x.x.x.x)(longer)Showiproute(x.x.x.x)(longer)SHOWIPBGPNEIGHBORX.X.X.XADVERTISED-ROUTESSHOWIPBGPNEIGHBOTX.X.X.XRECEIVED-ROUTESSHOWIPBGPNEIGHBORX.X.X.XROUTES（需要命令neighborsoftreconfiguration）DEBUGIPBGPDEBUGIPBGPX.X.X.XUPDATEDEBUGIPBGPEVENTSClearipbgp（softin）Clearipbgp(softout)©2003,CiscoSystems,Inc.Allrightsreserved.8BGP基本概念/基本配置回顾BGP路由属性及其策略选路BGP汇总配置BGP过滤配置BGP故障排除©2003,CiscoSystems,Inc.Allrightsreserved.BSCI2.0—7-9BGPCharacteristicsBGPisadistance-vectorprotocolwiththefollowingenhancements:•Reliableupdates:BGPrunsontopofTCP(port179)•Incremental,triggeredupdatesonly•PeriodickeepalivemessagestoverifyTCPconnectivity•Richmetrics(calledpathvectorsorattributes)•Designedtoscaletohugeinternetworks(e.g.,theInternet)©2003,CiscoSystems,Inc.Allrightsreserved.BSCI2.0—7-10BGPCharacteristics(Cont.)ReliableUpdates•UseTCPastransportprotocol•Noperiodicupdates•PeriodickeepalivestoverifyTCPconnectivity•Triggeredupdatesarebatchedandrate-limited–every5secondsforinternalpeer–every30secondsforexternalpeer量太大，批量更新©2003,CiscoSystems,Inc.Allrightsreserved.BSCI2.0—7-11BGPDatabases•Neighbortable（必须双向手工创建）–ListofBGPneighborsShowipbgpneighbor（summary）•BGPforwardingtable/database（不是包含所有路径）–Listofallnetworkslearnedfromeachneighbor–Cancontainmultiple（不是所有）pathwaystodestinationnetworks–DatabasecontainsBGPattributesforeachpathwayShowipbgp•IProutingtable–ListofbestpathstodestinationnetworksShowiproute©2003,CiscoSystems,Inc.Allrightsreserved.BSCI2.0—7-12BGPCommandsrouterbgpautonomous-systemRouter(config)#•Thiscommand,withnosubcommands,doesnotactivateBGP.（对BGP而言Network命令不是必须的）•OnlyoneinstanceofBGPcanbeconfiguredontherouteratasingletime.•Theautonomoussystemnumberidentifiestheautonomoussystemtowhichtherouterbelongs.•Theautonomoussystemnumberinthiscommandiscomparedtotheautonomoussystemnumberslistedinneighborstatementstodetermineiftheneighborisaninternalorexternalneighbor.©2003,CiscoSystems,Inc.Allrightsreserved.BSCI2.0—7-13BGPneighborCommandneighbor{ip-address|peer-group-name}remote-asautonomous-systemRouter(config-router)#•TheneighborcommandactivatesaBGPsessionwiththisneighbor.•Thetermremote-asshowswhatASthisneighborisin.ThisASnumberisusedtodetermineiftheneighborisinternalorexternal.•Thiscommandisusedforbothexternalandinternalneighbors.•TheIPaddressspecifiedisthedestinationaddressofBGPpacketsgoingtothisneighbor.•ThisroutermusthaveanIPpathwaytoreachthisneighborbeforeitcansetupaBGPrelationship.（IGP对BGP的贡献之一提供TCP连接的路经）©2003,CiscoSystems,Inc.Allrightsreserved.BSCI2.0—7-14Example:BGPneighborCommand©2003,CiscoSystems,Inc.Allrightsreserved.BSCI2.0—7-15BGPIssueswithSourceIPAddress•WhencreatingaBGPpacket,theneighborstatementwillbethedestinationIPaddressandtheoutboundinterfacewillbethesourceIPaddress.（有需要时可以通过Update-source修改）•WhenaBGPpacketisreceivedforanewBGPsession,thesourceaddressofthepacketiscomparedtothelistofneighborstatements.–Ifamatchisfound,arelationshipisestablished.–Ifnomatchisfound,thepacketisignored.•MakesurethesourceIPaddressmatchestheaddressthattheotherrouterhasinitsneighborstatement.©2003,CiscoSystems,Inc.Allrightsreserved.BSCI2.0—7-16BGPNeighborUpdateSourceAddressneighbor{ip-addres