The Border Gateway Protocol (BGP) is used as an Internet routing protocol for studying, announcing and best route selecting. EcoRouterOS uses an extended BGP - Multiprotocol BGP (MP-BGP), which allows to combine different types of addressing (unicast, multicast) within a single configuration and, in the future, IPv6. MP-BGP is compatible with a traditional BGP ver.4. As a result BGP-4 router can communicate as a neighbor to MP-BGP router and just ignore any BGP messages with unknown extension.

In the table below one can see comparision of a BGP main concept with an Internal Gateway Protocol (IGP). OSPF is taken for example.

Basic BGP configuring

The previously registered autonomous system ID (ASN) is required to exchange and recieve route information. The IANA regulates a number allocation process both for ASN and for open routing IP addresses. In certain connections to the Internet a provider allocates IDs from a private range autonomous system (AS). The EcoRouterOS supports IDs for AS in range <1-4294967295>.

Depending on the appertation to a local AS or to a nighboring AS BGP defines two neighborhood classes for routers: internal BGP (iBGP) and external BGP (eBGP) respectively. The EcoRouterOS supports flexible configuration for both of them. Proceed the following steps for basic configuring:

For iBGP:

Step 1. Specify a loopback interface IP address for each router, using the commands:

interface loopback.<number> 

ip address <address/mask>

Step 2. Enable BGP specifying the AS by command:

router bgp <number>

Step 3. Specify BGP to use a loopback interface as a source by command:

neighbor <neighbor-ip> update-source <interface-id>

Step 4. Configure bgp neghibors for each router specifying neighbor's loopback address and local AS's ID by command:

neighbor <neighbor-ip> remote-as <number>

Step 5. Check if each router has a route to the neighbor's loopback address.

show ip route bgp

For eBGP:

Step 1. Specify a loopback interface IP address for each router, using the commands:

interface loopback.<number> 

ip address <address/mask>

Step 2. Enable BGP specifying the AS by command:

router bgp <number> 

Step 3. Specify BGP to use a loopback interface as a source by command:

neighbor <neighbor-ip> update-source <interface-id>

Step 4. Configure bgp neghibors for each router specifying neighbor's loopback address and local AS's ID by command:

neighbor <neighbor-ip> remote-as <number>

Step 5. Check if each router has a route to the neighbor's loopback address.

show ip route bgp

Step 6. To increase TTL value configure eBGP multihop by command:

neighbor <neighbor-ip> ebgp-multihop <hops>

The above examples shows one of the ways to configure the device (in terms of fault-tolerance) on a simple topology.

BGP attributes

For route information and traffic flow route control and BGP net administration problem resolving EcoRouterOS supports the attributes shown in the table below.

Weight

Local Preference

AS-path (length)

Origin

Multi-Exit Discriminator (MED)

Some of BGP attributes are intended for a best route selection, some serve for another purposes. For example the Next Hop parameter displays an information about the neighbor. The routing to this address must be present in a routing table for protocol functionality, but this attribute doesn't affect on the best path selecting algorithm itself. The best path selecting is described in the table below. Parameters are arranged in descending order of priority, starting with the most preferred.

See the configuring commands' examples for changing a default values of attributes / parameters.

The neighbor <address> next-hop-self command saves Next Hop address when iBGP neighborhood (by default iBGP address is not transmitted).

The neighbor <address> weight <value> command sets the Weight value for a neighbor (default value is 0 for routes got from a neighbors and 32768 for routes locally injected). The value can be set up by route-map and implemented by the neighbor <address> route-map <name> in command.

The bgp default local-preference <0-4294967295> command sets the Local Preference value (default value is 100). The value can be set up by route-map and implemented by the neighbor <address> route-map <name> in command.

Attribute configuration commands via route-map

To use such command the neighbor <address> soft-reconfiguration inbound command must be included into protocol configuration.

To display all attributes available on a BGP configuration sublevel use the set <attribute> command.

ecorouter(config-route-map)#set ?

?corouter(config-route-map)#set

  aggregator        BGP aggregator attribute
  as-path           Prepend string for a BGP AS-path attribute
  atomic-aggregate  BGP atomic aggregate attribute
  comm-list         set BGP community list (for deletion)
  community         BGP community attribute
  dampening         Enable route-flap dampening
  extcommunity      BGP extended community attribute
  interface         Configure interface
  ip                Internet Protocol (IP)
  level             IS-IS level to export route
  local-preference  BGP local preference path attribute
  metric            Metric value for destination routing protocol
  metric-type       Type of metric for destination routing protocol
  origin            BGP origin code
  originator-id     BGP originator ID attribute
  tag               Tag value for destination routing protocol
  vpnv4             VPNv4 information
  weight            BGP weight for routing table

Attributes wich can be configuered are shown in the table below.

ecorouter(config-route-map)#set community ?

<1-65535> community number

AA:NN community number in aa:nn format

additive Add to the existing community

internet Internet (well-known community)

local-AS Do not send outside local AS (well-known community)

no-advertise Do not advertise to any peer (well-known community)

no-export Do not export to next AS (well-known community)

none No community attribute

route-map community permit 100

match community 1

set metric 777

BGP configuring example

See the topology configuration example:

Objective: configure neighborhood between R1-ECO1 and ECO1-R2, change the MED attribute value for routes announced by R1 in order to set 33.0.0.0/29 metrica equal to 1000 and 33.0.0.8/29 metrica equal to 500.

ECO1 configuration:

Step 1. Entering configuration mode

ECO1>enable

ECO1#configure terminal

Step 2. Configuring at interfaces, service instances and ports

ECO1(config)#interface e1

ECO1(config-if)#interface e1

ECO1(config-if)#ip address 77.0.0.200/8

ECO1(config-if)#interface e2

ECO1(config-if)#ip address 200.0.0.200/24

ECO1(config-if)#port ge1

ECO1(config-port)#service-instance ge1/e1

ECO1(config-service-instance)#encapsulation untagged

ECO1(config-service-instance)#connect ip interface e1

ECO1(config-service-instance)#exit

ECO1(config-port)#port ge2

ECO1(config-port)#service-instance ge2/e2

ECO1(config-service-instance)#encapsulation untagged

ECO1(config-service-instance)#connect ip interface e2

ECO1(config-service-instance)#exit

ECO1(config-port)#exit

Step 3. Configuring filter lists

ECO1(config)#policy-filter-list 1 permit 33.0.0.0 0.0.0.7

ECO1(config)#policy-filter-list 2 permit 33.0.0.8 0.0.0.7

Step 4. Matching filter lists and specifying metrica for networks

ECO1(config)#route-map bgp permit 1

ECO1(config-route-map)#match ip address 1

ECO1(config-route-map)#set metric 1000

ECO1(config-route-map)#route-map bgp permit 2

ECO1(config-route-map)#match ip address 2

ECO1(config-route-map)#set metric 500

Step 5. Creating an empty filter list for all other routes with a default metric

ECO1(config-route-map)#route-map bgp permit 3

ECO1(config-route-map)#exit

Step 6. Creating and configuring neighbor groups

ECO1(config)#router bgp 200

ECO1(config-router)#neighbor eBGP peer-group

ECO1(config-router)#neighbor eBGP remote-as 100

ECO1(config-router)#neighbor eBGP ebgp-multihop 2

ECO1(config-router)#neighbor eBGP update-source loopback.0

ECO1(config-router)#neighbor eBGP route-map bgp in

ECO1(config-router)#neighbor iBGP peer-group

ECO1(config-router)#neighbor iBGP remote-as 200

ECO1(config-router)#neighbor iBGP update-source loopback.0

ECO1(config-router)#neighbor iBGP next-hop-self

ECO1(config-router)#neighbor 1.1.1.1 peer-group eBGP

ECO1(config-router)# neighbor 2.2.2.2 peer-group iBGP

ECO1(config-router)#exit

Step 7. Creating static routes

ECO1(config)#ip route 1.1.1.1/32 77.0.0.100

ECO1(config)#ip route 2.2.2.2/32 200.0.0.202

See the example of BGP table information output on the picture below:

Use the network command to place routes into BGP and furter announcing or use the redistribute command for redistribution from Interior Gateway Protocols (further IGP).

Use the network command to announce the loopbac-interface of the R2 router

ECO1(config-router)#network 2.2.2.2 mask 255.255.255.255

In the EcoRouterOS the synchronization is disabled by default. In the protocol configuration mode use the synchronization command to enable it.

Filtering and neighbor relations in BGP

A route filtering in BGP is similar to IGP but politics are indicated for each neighbor separately with a direction mark in or out.

The commands for route filtering in BGP are shown in the table below.

The description for different list types can be found in the relevant sections. Here only AS-path lists are described. The AS-path lists allow to filter routes depending on autonomous systems mentioned in AS-path attribute. Use the regular expressions to specify AS-path attribute value (read mere in section Service Instances). Use the  ip as-path access-list <номер> permit/deny <regular expression> command to configure route politics.

BGP partnership relations updating

The commands for BGP partnership relations updating are shown in the table below.

Hard type means that BGP partnership relations updating will be done with TCP session reset.

Soft type means that BGP partnership relations updating will be done without TCP session reset.

For the clear ip bgp neighbor-id in functionality the neighbor <address> soft-reconfiguration inbound command must be in configuration of protocol.

Users often have to change BGP route filter policies. Major changes in the routing tables and the reset of TCP sessions with BGP neighbors cause a surge in the load on the central processor of the router. To reduce this effect and make working with BGP neighbors and route information announcements more convenient and flexible, EcoRouterOS provides functionality to disable of routing information auto-update when changing filter policies. In BGP, route policies can be configured in the following ways:

• by prefix lists;
• by route-maps;
• by policy-filter-lists;
• by distribute-lists;
• by filter-lists along with ip as-path access-lists.

By default, when creating or changing a filter policy towards a neighbor, the router will send a BGP Update message 30 seconds later (in the case of an EBGP neighborhood) or instantly (in the case of an iBGP neighborhood).

Example:

ip prefix-list 1 deny 1.1.1.1/32

neighbor 10.0.0.2 prefix-list 1 out   

Use the neighbor 1.1.1.1 advertisement-interval <VALUE> command to change the time interval where <VALUE> specified in seconds. Use the neighbor 10.0.0.2 disable-auto-refresh command to disable this behavior. Then, to send the routing information, the neighbor will need to reset the neighbor relationship. To do this, without resetting the TCP sessions reset the neighbor relations (soft reset), add the soft keyword to the clear ip bgp ... reset command call.

By default, when creating or changing the filtering policy in the direction from the neighbor, the router instantly (in both cases - EBGP and iBGP Neighborhood) will send a message requesting BGP Route-Refresh updates, but only if the neighbor supports this option.

Example:

  ip prefix-list 1 deny 1.1.1.1/32  

  neighbor 10.0.0.2 prefix-list 1 in 

This behavior is caused by the BGP Auto-Refresh option, which is enabled by default in EcoRouterOS. Use the neighbor 10.0.0.2 disable-auto-refresh command to disable this behavior. Then, to send the routing information, the neighbor will need to reset the neighbor relationship. To do this, without resetting the TCP sessions reset the neighbor relations (soft reset), add the soft keyword to the clear ip bgp ... reset command call. It also requires that the neighbor supports BGP Route-Refresh.

Use the no neighbor 10.0.0.2 capability route-refresh command to disable the BGP Route-Refresh option and exclude the ability to send BGP Route-Refresh messages to a neighbor.

Attention! It is strongly recommended to disable the auto-refresh functionality for neighbors if they promote too many BGP announces.

To test if the neigbor supports this option, use the command:

ecorouter # show ip bgp neighbors

BGP neighbor is 10.0.0.2, remote AS 2, local AS 1, external link

  BGP version 4, remote router ID 100.100.100.100

  BGP state = Established, up for 02:07:11

  Last read 02:07:11, hold time is 90, keepalive interval is 30 seconds

  Neighbor capabilities:

    Route refresh: advertised and received (old and new)

    Address family IPv4 Unicast: advertised and received

  Received 315 messages, 0 notifications, 0 in queue

         …………..The output is shortened…………….

The "advertised and received" phrase in the output indicates the BGP Route-Refresh option enabled on both the local router and the neighbor.

The result of disabling this option on the local device is shown below:

ecorouter#show ip bgp neighbors

BGP neighbor is 10.0.0.2, remote AS 2, local AS 1, external link

  BGP version 4, remote router ID 100.100.100.100

  BGP state = Established, up for 02:07:11

  Last read 02:07:11, hold time is 90, keepalive interval is 30 seconds

  Neighbor capabilities:

    Route refresh: received (old and new)

    Address family IPv4 Unicast: advertised and received

  Received 315 messages, 0 notifications, 0 in queue

         …………..The output is shortened…………….

Regular expressions

In the EcoRouterOS realization the following regular expressions are supported (see the table below):

See some examples of frequently used regular expressions:

• .* - any expression matches to this rule,
• ^$ - the route from local AS,
• ^100_ - the route information recieved from AS 100,
• _100$ - the subnet located in AS 100,
• _100_ - the route passes through AS 100,
• ^[0-9]+$ - the route from the directly connected (neighboring) AS.

Route reflectors and confederations

Route reflector is a router which performs the function of route reflecting. A route reflector recieves a route from one neighbor and advertizes it to all others. It allows to reduce the number of connections needed to create at full-mesh topology when teaching neighbors to all AS's routes and avoid routing loops.

When administrating a big BGP domain the route reflectors must be configured. Use the neighbor <address> route-reflector-client command.

The route reflectors do not affect on the pathes of IP packets but define the order of propagating the route information along the network.

Confederation is a group of several AS which are anounced to the external BGP nodes by common AS identifier. The route reflector's function normally is viewed from the standpoint of iBGP. The confederation operates at the level of AS. Using confederation allows to divide an autonomous system onto several subsystems which exchange by route information via eBGP. When creating a confederation the bgp confederation identifier <1-65535> command for all the routers must be used. Use the bgp confederation peers <numberAS1 numberAS2 ...> command to specify the neighboring AS which must be included into the confederation. The neighboring AS identifiers in the command must be separated by spaces.

BGP configuration commands

The BGP configuring commands are shown in the table below. These commands are available in the router's configuration mode and context configuration mode (config-router)#.

BGP show commands

Viewing BGP settings and statistic information commands are shown in the table below.

BGP Route Dampening

The BGP route dampening is an instrument to reduce the instability caused by route flapping. In computer networking and telecommunications, route flapping occurs when the routes are added to and then excluded from routing table in quick sequence. This can be caused by broken link, device operation errors, inproper equipment configuration, etc. Flapping routes in the routing table increase the load of network equipment processors leading more serious network problems. Implemeintation of route dampening is a good practice used in many providers' networks.

A penalty is added for every flap in a flapping route. As soon as the total penalty reaches the suppress limit the  advertisement of the route is suppressed. This penalty is decayed according to the configured half time value. Once the penalty is lower than the reuse limit, the route advertisement is unsuppressed.

The dampening information is purged from the router once the penalty becomes less than half of the reuse limit.

In the context router configuration mode use the bgp dampening {route-map <ROUTE-MAP-NAME> | <REACHIBILITY-HALF-LIFE-TIME> <REUSE-VALUE> <SUPPRESS-VALUE> <MAX-SUPPRESS-VALUE> <UN-REACHIBILITY-HALF-LIFE-TIME>} command to configure dampening. This command alsow allows to specify a certain route to be supressed.

<ROUTE-MAP-NAME>

<REACHIBILITY-HALF-LIFE-TIME>

<REUSE-VALUE>

<SUPPRESS-VALUE>

<MAX-SUPPRESS-VALUE>

<UN-REACHIBILITY-HALF-LIFE-TIME>

Example:

#configure terminal
(config)#router bgp 11
(config-router)#bgp dampening 20 800 2500 80 25

Background BGP scanners

These parameters are responsible both for scanning the BGP RIP and IP RIB tables of the router, and sorting, sending and deleting of entries in it. The BGP uses only routes with available next-hop, in case of the next-hop is unavailable the subnets will be deleted from the routing tables. These actions are defined by the background bgp next-hops timer value, by default all the routes are checked once per 60 seconds.

Use the bgp scan-time next-hops <0-60> command in context BGP configuration mode to change the value of this timer. If the value is set to 0 the scanning will be disabled.

In addition to the availability of next-hop, BGP scans the router's tables for new static entries and the route 0.0.0.0. These actions are determined by the value of the background bgp networks timer, by default all the routes are checked once every per 15 seconds.

Use the bgp scan-time networks <15-60> command in context BGP configuration mode to change the value of this timer.

To reduce the load on the CPU of the device, the network engineer can set the maximum values of the scanning timers, but the network convergence time will be increased.

Clear commands

In the administration mode use the clear ip bgp dampening command to reset BGP route flap dampening information for specified subnet or VRF instance. The command syntax is following: clear ip bgp dampening [<ADDRESS>[/<MASK>] | ] [ vrf {<VRF-NAME> | default | all} ].

<ADDRESS>/<MASK>

vrf {<VRF-NAME> | default | all}

Example:

#clear ip bgp dampening 35.0.0.0/8

In the administration mode use the clear bgp group of command to reset BGP statistics and IPv4 information.

To reset BGP statistics use the following command syntax: clear bgp statistics.

To reset BGP IPv4 information use the following command syntax: clear bgp ipv4 {multicast | unicast} { * | <AS-number> | <ADDRESS>[/<MASK>] | flap-statistics { <ADDRESS>[/<MASK>] | vrf {<VRF-NAME> | all | default} } }.

<ADDRESS>/<MASK>

multicast | unicast

<AS-number>

flap-statistics

Example:

#clear bgp statistics

#clear bgp ipv4 unicast flap-statistics all

BGP Blackhole

The traffic discarding functionality via Null interface by substituting it as the next hop address for BGP routes in EcoRouterOS as one of the methods against DDoS attack is implemented. Such scenarios are an effective means against large-scale attacks, the purpose of which is to bring the attacked network to "denial of service" status. More information about all the advantages and disadvantages of this functionality can be found on the Internet.

The example of scenario and EcoRouter configuration is shown below.

Consider an attacker from the 192.168.0.0/24 network sends a huge amount of traffic to BGP AS to the Server 10.10.10.10/32, trying to cause the server down. As a result the task is to send advertising about the address 10.10.10.10/32 from the device R1 to a certain number of the community attribute. After the ECO-2 router accepted advertising with this route, it must update the data in the RIB and start discarding all packets arriving from the PC towards the address 10.10.10.10/32. The ECO-2 router configuration might look like this:

ecorouter#sh running-config

!

no service password-encryption

!

hw mgmt ip 192.168.255.1/24

!

ip vrf management

!

mpls propagate-ttl

!

security default

security none vrf management

!

ip pim register-rp-reachability

!

router bgp 1

 redistribute connected

 neighbor 1.1.1.1 remote-as 1

 neighbor 1.1.1.1 soft-reconfiguration inbound

 neighbor 1.1.1.1 route-map BLACKHOLE in

!

ip route 9.9.9.9/32 Null

!

ip community-list 66 permit 1:777

!

route-map BLACKHOLE permit 10

 match community 66

 set ip next-hop 9.9.9.9

!

route-map BLACKHOLE permit 20

!

line con 0

line vty 0 39

!

traffic-class default

!

port te0

 lacp-priority 32767

 mtu 9728

 service-instance 1

  encapsulation untagged

!

port te1

 lacp-priority 32767

 mtu 9728

 service-instance 1

  encapsulation untagged

!

interface 1

 ip mtu 1500

 connect port te1 service-instance 1

 ip address 1.1.1.2/24

!

interface 2

 ip mtu 1500

 connect port te0 service-instance 1

 ip address 192.168.0.1/24

 vrf management

Note the static route in the Null interface and the set ip next-hop 9.9.9.9 instruction in the route map. These are the main conditions for setting a recursive route to the RIB via the Null interface. Example of output of the routing table is shown below:

ecorouter#sh ip ro

Codes: K - kernel, C - connected, S - static, R - RIP, B - BGP

       O - OSPF, IA - OSPF inter area

       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2

       E1 - OSPF external type 1, E2 - OSPF external type 2

       i - IS-IS, L1 - IS-IS level-1, L2 - IS-IS level-2, ia - IS-IS inter area

       * - candidate default

IP Route Table for VRF "default"

C       1.1.1.0/24 is directly connected, 1

S       9.9.9.9/32 [1/0] is a summary, Null

B       10.10.10.0/24 [200/0] via 1.1.1.1, 1, 00:08:45

B       10.10.10.10/32 [200/0] via 9.9.9.9 (recursive blackhole), 00:08:45

C       192.168.0.0/24 is directly connected, 2

Gateway of last resort is not set

In the example the iBGP protocol is used, if necessary this functionality can be used in the eBGP topology. However, to create a recursive route via Null, the neighbor <address> ebgp-multihop <value> command for the neighbor must be specified. This command makes the neighbor to send information about the route with the community attribute (in the example the neighbor's address is 1.1.1.1) or create a loopback interface on the EcoRouter with the address from the subnet of the BGP next-hop used in the route map.