BGP backdoor question

[jrhofman]

I want to make sure I understand the BGP back door option.

out main site has local internet access and the static route to the internet is being redistributed via EIGRP throught the complex. We have another remote site that has this same configuration. Both sites are then connected via BGP. We are currently blocking 0.0.0.0 from coming in on our WAN routers at each site via prefix lists. If we didn't it's my understanding that each site would prefer the other locations default route because of the administrative distance of 20 that would be in the BGP advertisement (vs the 170 we see via EIGRP).

It sounds like the BGP backdoor option might allow us to use each site as a backup to the other for internet access. How would I set that up so that the EIGRP router is prefered over the BGP route (until it goes away) given the following router configs.

Site A

router EIGRP 10

network 136.237.0.0

redistribute BGP 64000

!

Router BGP 64000

network 136.237.0.0 255.255.0.0

network 0.0.0.0

neighbor 136.237.0.2 prefix-list blockSTP in

!

ip prefix-list blockSTP seq 70 deny 0.0.0.0/0

ip prefix-list blockSTP seq 105 permit 0.0.0.0/0 le 32

Site B

router EIGRP 10

network 150.100.0.0

redistribute BGP 65000

!

Router BGP 65000

network 150.100.0.0 255.255.0.0

network 0.0.0.0

neighbor 150.101.0.1 prefix-list blockSTP in

!

ip prefix-list blockSTP seq 70 deny 0.0.0.0/0

ip prefix-list blockSTP seq 105 permit 0.0.0.0/0 le 32

Note: each of these two main locations advertizes a default router to our many smaller remote sites (hence the current network 0.0.0.0 statement under BGP).

[thisisshanky]

Yeah, you can use network 0.0.0.0 backdoor, so that you dont need to use the prefix lists. When backdoor is used, admin distance of BGP route is changed to 200, and EIGRP default will be preferred.

[jrhofman]

so my network statement under bgp should be network "0.0.0.0 backdoor" at both locations and thats it?

[thisisshanky]

Yes, one minor correction, is that when you enter the command, you should enter it as,

network 0.0.0.0 mask 0.0.0.0 backdoor.

When you look at the configs it would appear only as "network 0.0.0.0 backdoor". But if you dont enter the command with the mask specified, then it wont advertise the network 0.0.0.0 to any peer.

HTH