BGP Exist Map multiple different BGP routes

[mile.ljepojevic]

Hi, I need little help:

Maybe it is easy, but in LAB I could not get what I wanted. Let say I have this network layout:

ISP 1 connected to R1

ISP 2 connected to R1

ISP 3 connected to R2

R1 is connected to R2

The story is simple, I have two different ISPs coming to R1 and I am announcing my network to both ISPs. From ISP1 I get default-gateway, from IPS2 I get couple of client networks. I iBGP between R1 and R2 where R2 learns all eBGP routes (including default gateway).

Link on R2 is payed per usage, so I do not want to use it if all R1 links are up (so I am not announcing network).

So, once R1 loose either default route from ISP1 or client's route form ISP2, I want to start announcing my network on R2 to compensate.

So, here is config:

router bgp 65001
no synchronization
bgp log-neighbor-changes
network 192.168.0.0
neighbor 10.200.200.1 remote-as 65101
neighbor 10.200.200.1 description ISP3
neighbor 10.200.200.1 soft-reconfiguration inbound
neighbor 10.200.200.1 route-map ISP3 out
neighbor 10.200.200.1 advertise-map ISP2 non-exist-map COND
neighbor 192.168.0.253 remote-as 65001
neighbor 192.168.0.253 description R1
neighbor 192.168.0.253 next-hop-self
neighbor 192.168.0.253 soft-reconfiguration inbound
!
ip as-path access-list 100permit ^65011
!
ip access-list standard MyNet
permit 192.168.0.0 0.0.0.255
ip access-list standard DEFAULT
permit 0.0.0.0
ip access-list standard Client
permit 172.16.20.0 0.0.0.255

route-map ISP2 permit 10
match ip address MyNet
!
route-map COND permit 10
match ip address DEFAULT
match as-path 100
!
route-map COND permit 15
match ip address Client

So, it should be, if R2 ever loose either default gateway originating from AS 65011 or Client network, he should start announcing MyNet to ISP3.

With this setup, as long as one route existed, R2 didn't announce my network to ISP3.

[Mahesh Gohil]

Hi,

Please look at below config.

----------------------------------

ip as-path access-list 100permit ^65011

route-map COND permit 10
match ip address DEFAULT
match as-path 100
!
route-map COND permit 15
match ip address Client

ip access-list standard Client
permit 172.16.20.0 0.0.0.255

------------------------------------

what is ^65011 I do not see this AS number 65011 matching in bgp configuration. If you are getting default route from R1 only why can't you match

just a default route and see the result..i mean config something like below

route-map COND permit 10
match ip address DEFAULT

Hope this is helpful

Regards

Mahesh

[mile.ljepojevic]

Hi Mahesh,

first of all I would like to thank you for your reply.

The problem is that R2 receive default-gateway from R1 and from ISP3, so I cannot just match existence of default route in BGP table. R1 learns default gateway from ISP that has 65011, so through iBGP R2 learn that route.

My goal is to make R2 announcing MyNet if lose default-gateway or client's network and both of them are learned through iBGP from R1. Also, on R2 I have default gateway announced by ISP3.

[Mahesh Gohil]

Hi,

Yes i agree with that...but when you see sh ip bgp for default route does it contain AS :65011 in the as-path list.

In addition to that as a work-around can you try matching next-hop in that route-map and also remove permit 15 statement to know

what exactly happening inside router.

Also you can enable debug ip bgp packets to know whether non-exist route-map trigers or not if your business allows.

Regards

Mahesh

[mile.ljepojevic]

Sorry for misunderstanding, I didn't provide some important info.

BGP is OK, I have both routes and that is OK.

When I use route map that is matching only default gateway originating in 65011, and when I turn the link towards ISP1, after a while R2 will start announcing MyNet to ISP3.

Also, I tried matching only Client's network, when I turn of link towards ISP2, R2 will start announcing MyNet to ISP3.

So, disregard routing issues. BGP table is good. Problem is that with my configuration, I got basically AND function, R2 starts announcing routes only after BOTH of routes are missing.

When I loose only one (either one) R2 do not  announce MyNet.

I will probably play with it more on Monday, I can collect some amount of debug...

I was just wondering if there was someone already configured something like this.

[milan.kulik · Accepted solution]

Hi,

I'm afraid the logic of the non-exist map is different.

Here is what my favourite book  BGP Design and Implementation (Randy Zhang, Micah Bartell, CiscoPress 2004)

says on page 124:

"The route map associated with the non-exist-map specifies the prefix (or prefixes) that the
BGP speaker tracks. Only permit is accepted; any deny is ignored. When a match is made,
the status of the advertise-map is Withdraw; when no match is made, the status becomes
Advertise.
Within the non-exist-map, a match statement for the prefix is required. You can configure it
with a prefix list or a standard access list. Only an exact match is supported. Additionally,
AS_PATH and community can be matched.
The route map associated with the advertise-map defines the prefix (or prefixes) that are
advertised to the specific neighbor when the prefixes in the non-exist-map no longer exist—
that is, when the status is Advertise. When the status is Withdraw, the prefix or prefixes
defined in the advertise-map are not advertised or withdrawn."

IMHO, as long as either default gateway originating from AS 65011 or Client network is received by your router, the status of your non-exist-map COND is Withdraw and your router is not advertising the prefixes specified by the advertise-map ISP2.

I've got no idea how to build a non-exist-map to work the way you are requesting.

What about using two non-exist-maps?

neighbor 10.200.200.1 advertise-map ISP2 non-exist-map COND1

neighbor 10.200.200.1 advertise-map ISP2 non-exist-map COND2

where

route-map COND1 permit 10
match ip address DEFAULT
match as-path 100
!
route-map COND2 permit 10
match ip address Client

I know all examples are always using just one non-exist-map, but IMHO this might work.

And you mentioned you were planning some lab anyway...

HTH,

Milan

[mile.ljepojevic]

Hvala Milane

Thanks Milan,

this worked... That is exactly what I needed, I was unaware that you can use multiple non-exist advertise-maps for the same peer...

Thank you all.

Best regards,

Mile

[mile.ljepojevic]

Actually, I spoke to soon...

It is not working, the first defined route-map is only one that was looked...

I get advertise on Cond2 but always get withdrawn ISP2 route-map...

So bottom line, in following configuration:

neighbor 10.200.200.1 advertise-map ISP2 non-exist-map COND1

neighbor 10.200.200.1 advertise-map ISP2 non-exist-map COND2

If COND1 exists, he will suppress updates from if COND2 do not exist.

If COND1 do not exist, router will announce network to peer.

The same goes other way around. So I found a workaround.

On Client-network I used local-AS feature to "persuade" R1 that peer belongs to the same AS as ISP1, so my client's network and ISP1 0.0.0.0 network has the same AS_PATH

After that I just used:

route-map COND permit 10
match ip address DEFAULT Client
match as-path 100

And that worked... I tested both scenarios, it's working perfectly.

Thank you all, once again.

[milan.kulik]

Hi Mile,

regarding the multiple advertise-map commands applied on one neighbor:

I also was not sure, that's why I asked you to test in your lab.

What's even more surprising for me is your final non-exist map:

route-map COND permit 10
match ip address DEFAULT Client
match as-path 100

AFAIK, the

match ip address DEFAULT Client
is matched by a prefix matching one of that two access-list (i.e., OR should be applied in that line, see http://www.cisco.com/en/US/tech/tk365/technologies_tech_note09186a008047915d.shtml for details).

Which means: in a case either the default route is coming matching the as-path 100 OR the Client prefix is coming matching the as-path 100, the COND route-map should get the Withdraw status and nothing should be advertised by your advertise-map.

Are you 100% sure that non-exist map works? I.e., you subnet is advertised in a case ONE of the tracked routes (default, Client) is missing?

And R2 is not advertising anything in a case both the default route and Client subnets are present in his BGP table?

If you realise the current solution is not working, I've got another idea:

It should be possible to configure an exist-map on R1 tracking the default route coming from ISP1.

And an advertise-map to advertise the Client prefix coming from ISP2 to the router R2 only in a case the exist-map is matched.

Which means, R2 would receive the Client prefix from R1 only in a case both the default and Client prefixes were received correctly by R1.

Then you would configure on R2: a non-exist map tracking the Client prefix received from R1 and an advertise-map to advertise your prefix to ISP3 in a case the Client prefix was not received (as you intended originally).

The only drawback of this solution is R2 would not receive the Client prefix (even when that subnet is alive) from R1 in a case the default route is not received from ISP1. Would that be OK for you?

BR,

Milan

[mile.ljepojevic]

Hi Milan,

Of course it didn't work, and about bunch of other stuff I tried too, until I did exist-map on R1. That is the only solution I can think of and to work.

Multiple conditional advertisement is going to work as long as they are not for the same network. Since I am trying to announce same network through both conditional statements, one that still do not exist will always put route-map in withdraw, which will basically remove that prefix from updates to that peer. I spoke too soon about working or not, since I always had one  route-map in advertise state, but on Looking Glass there was not route visible.

I did conditional advertisement, that as long client's network exist on R1, to announce default-gateway to R2. R2 uses that as condition not to advertise MyNet. I will test it today.

Thanks.

Mile

[milan.kulik]

Hi Mile,

yes, that's pretty similar to what I suggested, I just had thought as long as the default exist on R1 to announce the client to R2 might be more comfortable - you are losing the default route on R2 in a case the Client is not received on R1.

I really wonder if that works :-)

BR,

Milan

[pvzcisco07]

Hi Guys,

I am having a similar issue but in my case, I am using an exist-map instead of non-exist-map.

My scenario is as below

R1 connected to ISP1

R2 connected to ISP2

I have split my /24 prefix into two /25 prefixes for inbound load sharing of the links.

When using an advertise map, all routes seem to get advertised (including the ones that I dont want to announce). Its almost like the map is not taking effect at all. It works fine when I use the route-map option instead of advertise map.

I have lab'd this on Version 12.4(25c) on GNS3.

Please find the relevant config as attached (I have attached only the config for R1 & ISP1). Would be great if you could provide some suggestions to resolve this issue

[Cristian Matei]

Hi,

  @pvzcisco07 You got answers on your other opened thread.

Regards,

Cristian Matei.