Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. If you'd prefer to explore, try our test area to get started. And see here for current known issues.

New Member

BGP config restrictive

Hello

Recenty I aquired another company with (5) L2 only sites. I am phasing them into my L3 AVPN network.

The first phase is to get them onto the AVPN netowrk. Routers and circuits have been ordered

For now, I want to make sure sure the L3 network works amongst their own (5) sites but I do not want to merge them into my

network just yet. See Diagram for how the network will look once ALL aspects of merge are complete.

My question is, what specific WAN config statements will I want to add to their routers so that they only communicate amongst themselves.

WAN routing protocol is BGP, I believe the config should look something like:

router bgp (AS#)

no bgp log-neighbor-changes

network 0.0.0.0

network (Local LAN subnet)192.168.1.x

network (Local LAN subnet)192.168.10.x

network (Local LAN subnet)192.168.20.x

neighbor x.x.40-44.2 remote-as (AS#)

no auto-summary

The .40-43.2 are the AVPN PER WAN ip addresses for the new sites.

sMc
1 ACCEPTED SOLUTION

Accepted Solutions
New Member

BGP config restrictive

So if I'm understanding this correctly:

  • You have X existing routers in you AVPN
  • You have N=5 additional new routers in your AVPN
  • Each of the X+N routers have a single eBGP connection with an AT&T PE router
  • You want X routers to ignore prefixes announced by N routers

If this is the case, you can achieve the same by creating the prefix-list as outlined previosly and adding it to your "PrependNetgate" route-map

config t

!!! Assuming sequence 20 is actually empty per your posted configs

route-map PrependNetgate deny 20

match ip address prefix-list DENY-NEW-NETWORKS

end

You would need to implement that config on your existing routers. Assuming every X and N router on the AVPN gets the same set of updates, this would allow the X routers to filter routes from the N routers. In other words, the two sets of X and N routers would be disjoint.

I'm assuming you manage those AVPN routers using the WAN interface only?

11 REPLIES
New Member

BGP config restrictive

Can anyone provide any technical guidance pertaining to this specific objective? 

sMc
New Member

BGP config restrictive

Hi Coady,

Is the *current* routing protocol BGP amongst those acquired routers? Also, can you post the diagram of the final state?

Have you thought about using Private ASNs during the merge process?

New Member

BGP config restrictive

The acquired are routers are new. Currently the (5) sites do no5t have any layer 3 routing. The diagram does show the final state where all site connect to our AVPN cloud.

sMc
New Member

BGP config restrictive

Please provide more information on using Private AS's during the merge process.

sMc
New Member

BGP config restrictive

Hello

I checked with my WAN provider. Using Private ASN would require cancelling current order and re-ordering new WAN. Not an option. )

With that, ALL of my sites are going to be on same AVPN. What I need to do now is to restrict routing advertisements.

The goal, for now is to only allow these (5) new sites to route amongst eachother until we can merge them into our network.

If we are all on the same AVPN network and using BGP, hpw can I keep those site routing amongst eachother only.

It seems the approach would be to not allow all the other sites to know what ip subnets are being used for the (5) new sites.

sMc
New Member

Re: BGP config restrictive

You could implement a route-map for your existing routers that filter annoucements from the 5 new routers. This route map would be applied to the neighbors with at "neighbor x.x.40-44.2 remote-as route-map ":

!!! Create a prefix list for matching local routes

ip prefix-list DENY-NEW-NETWORKS seq 10 permit 198.168.x.y/z

!!! Create route map for filtering

route-map DENY-NEW-ROUTERS deny 10

match ip address prefix-list DENY-NEW-NETWORKS

end

!!! On existing routers, apply to neighbor statements for new sites:

router bgp ASN

neighbor x.x.40.2 route-map DENY-NEW-ROUTERS

end

If this config were placed on your existing routers, they would ignore all annoucements from the 5 new routers. If you have a lot of existing routers, this could be cumbersome.

HTH

New Member

BGP config restrictive

Joseph

Thankyou for the response. I appreciate the command syntax.

Just so I understand, the first statement "ip prefix-list DENY-NEW-NETWORKS seq 10 permit 198.168.x.y/z"

The 192.168.x.x/z are the internal ip addresses of each subnet that would be advertised?

Let's say that 1 of these sites has (10) contiguous subnets to advertise, could the statement looks as follows?

     "ip prefix-list Deny-new-networks seq 10 permit 192.168.10.0/255.255.240.0"

Would there be any potential issues caused by this type of summarized statement?

Once agin, thankyou for the great info!

sMc
New Member

BGP config restrictive

To cover multiple networks under a prefix list, you specify the mask length:

ip prefix-list DENY-NEW-NETWORKS seq 10 permit 192.168.10.0/20

This would work if you *actually* summarize the route in BGP (i.e. network 192.168.10.0 255.255.240.0 _and_ you have a static route for that network in your RIB).

If, however, if you don't summarize in BGP, your prefix list changes slightly:

ip prefix-list DENY-NEW-NETWORKS seq 10 permit 192.168.10.0/16 le 20

In this case, you are covering all the networks from 192.168.0.0 - 192.168.15.0.

I'm assuming you have AT&T's MPLS VPN product? For your existing routers, you have iBGP full mesh plus an eBGP connection to an AT&T PE router?

I don't see an attachment with your diagram, that would really help me understand things better.

New Member

BGP config restrictive

We do have the AT&T AVPN. We are using eBGP. Internal routing is handled by EIGRP.

Each site is setup the same

AVPN router>Cisco 3750 switch stack (MDF)>Cisco 375 switch stack(s) (IDF)

BGP on AVPN routers:

router eigrp #

distribute-list route-map Block_EIGRP_Routes_From_BGP_Redistribution in

default-metric 1000000 10 255 1 1500

network 192.168.x.x 0.0.0.0

redistribute connected

redistribute bgp ASNXYz

distance eigrp 10 10

!

router bgp ASNXYz

no bgp log-neighbor-changes

network 0.0.0.0

network 10.1.x.0 mask 255.255.240.0

network 10.1.x+.0 mask 255.255.240.0

network 192.168.1.0

network 192.168.10.0

network 192.168.100.0

etc...

neighbor x.x.7.2 remote-as !#!#!

neighbor x.x.7.2 soft-reconfiguration inbound

neighbor x.x.7.2 route-map PrependNetgate in

no auto-summary

!

route-map PrependNetgate permit 10

match as-path 1

set local-preference 90

!

route-map PrependNetgate permit 20

!

route-map Block_EIGRP_Routes_From_BGP_Redistribution deny 10

description Block all BGP to EIGRP Redistributed Routes Tagged !#!#!

match tag !#!#!

!

route-map Block_EIGRP_Routes_From_BGP_Redistribution permit 20

description Permit All Untagged Routes Into the Routing Table

EIGRP on MDF siwtch stack

router eigrp #

network 10.0.0.0

network 192.168.1.0

network 192.168.10.0

network 192.168.100.0

eigrp stub connected

sMc
New Member

BGP config restrictive

So if I'm understanding this correctly:

  • You have X existing routers in you AVPN
  • You have N=5 additional new routers in your AVPN
  • Each of the X+N routers have a single eBGP connection with an AT&T PE router
  • You want X routers to ignore prefixes announced by N routers

If this is the case, you can achieve the same by creating the prefix-list as outlined previosly and adding it to your "PrependNetgate" route-map

config t

!!! Assuming sequence 20 is actually empty per your posted configs

route-map PrependNetgate deny 20

match ip address prefix-list DENY-NEW-NETWORKS

end

You would need to implement that config on your existing routers. Assuming every X and N router on the AVPN gets the same set of updates, this would allow the X routers to filter routes from the N routers. In other words, the two sets of X and N routers would be disjoint.

I'm assuming you manage those AVPN routers using the WAN interface only?

New Member

BGP config restrictive

Joseph

Excellent!!. Thank you

sMc
627
Views
0
Helpful
11
Replies