BGP预防中转AS出现

默认情况下，BGP会将所有的前缀都发布给EBGP邻居。这就意味着，如果一个AS多宿主到多个ISP中，那么该AS就有可能成为传输AS。如下图所示：

image-20200119174513297

如上图所示：AS65001多宿主到ISP 65002和65003

要避免AS65001成为传输AS，需要确保RTA只发布来自于本AS的路由信息，常见的方法有如下四种：

  1. Filter-list使用AS-PATH 访问列表
  2. No-ExportCommunity
  3. Prefix-list Filtering
  4. Distribute-list Filtering

Prefix-lists和distribute-lists可以解决该问题，但是在大规模路由情况下不能很好工作。ilter-list和no-export community能够非常优雅的解决该问题，只需要配置一次即可。

配置

RTA

RTA# show running-config 
Building configuration...

Current configuration:
!
frr version 7.1
frr defaults traditional
hostname 61c4b3ba0cdb
log syslog informational
no ipv6 forwarding
hostname RTA
service integrated-vtysh-config
!
interface lo
 ip address 2.2.2.2/24
!
router bgp 65001
 neighbor 10.1.1.2 remote-as external
 neighbor 10.1.1.3 remote-as external
 !
 address-family ipv4 unicast
  network 2.2.2.0/24
 exit-address-family
!
line vty
!
end
RTA#

RTB

RTB# show running-config 
Building configuration...

Current configuration:
!
frr version 7.1
frr defaults traditional
hostname 68c431a0c532
log syslog informational
no ipv6 forwarding
hostname RTB
service integrated-vtysh-config
!
router bgp 65002
 neighbor 10.1.1.1 remote-as external
!
line vty
!
end
RTB#

RTC

RTC# show running-config 
Building configuration...

Current configuration:
!
frr version 7.1
frr defaults traditional
hostname dc5f5d6c9fc8
log syslog informational
no ipv6 forwarding
hostname RTC
service integrated-vtysh-config
!
interface lo
 ip address 3.3.3.3/24
!
router bgp 65003
 neighbor 10.1.1.1 remote-as external
 !
 address-family ipv4 unicast
  network 3.3.3.0/24
 exit-address-family
!
line vty
!
end
RTC#

查看RTB的路由表

RTB# show ip bgp 
BGP table version is 2, local router ID is 172.17.0.3, vrf id 0
Default local pref 100, local AS 65002
Status codes:  s suppressed, d damped, h history, * valid, > best, = multipath,
               i internal, r RIB-failure, S Stale, R Removed
Nexthop codes: @NNN nexthop's vrf id, < announce-nh-self
Origin codes:  i - IGP, e - EGP, ? - incomplete

   Network          Next Hop            Metric LocPrf Weight Path
*> 2.2.2.0/24       10.1.1.1                 0             0 65001 i
*> 3.3.3.0/24       10.1.1.3                               0 65001 65003 i

Displayed  2 routes and 2 total paths
RTB# show ip route  bgp 
Codes: K - kernel route, C - connected, S - static, R - RIP,
       O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP,
       T - Table, v - VNC, V - VNC-Direct, A - Babel, D - SHARP,
       F - PBR, f - OpenFabric,
       > - selected route, * - FIB route, q - queued route, r - rejected route

B>* 2.2.2.0/24 [20/0] via 10.1.1.1, eth1, 00:02:58
B>* 3.3.3.0/24 [20/0] via 10.1.1.3, eth1, 00:03:57
RTB#

从上面可以看出，对于路由3.3.3.0/24的as path为65001 65003。说明AS65001被当做了中转AS，这种情况不是我们需要的。

使用Filter-list with AS PATH access-list解决该问题

在RTA上添加如下配置：

RTA(config)# bgp as-path access-list test permit ^$  
RTA(config)# router bgp  65001
RTA(config-router-af)# neighbor 10.1.1.2 filter-list test out
RTA(config-router-af)# neighbor 10.1.1.3 filter-list test out

在RTB上查看路由信息：

RTB# show ip bgp        
BGP table version is 3, local router ID is 172.17.0.3, vrf id 0
Default local pref 100, local AS 65002
Status codes:  s suppressed, d damped, h history, * valid, > best, = multipath,
               i internal, r RIB-failure, S Stale, R Removed
Nexthop codes: @NNN nexthop's vrf id, < announce-nh-self
Origin codes:  i - IGP, e - EGP, ? - incomplete

   Network          Next Hop            Metric LocPrf Weight Path
*> 2.2.2.0/24       10.1.1.1                 0             0 65001 i

Displayed  1 routes and 1 total paths
RTB# show ip route  bgp        
Codes: K - kernel route, C - connected, S - static, R - RIP,
       O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP,
       T - Table, v - VNC, V - VNC-Direct, A - Babel, D - SHARP,
       F - PBR, f - OpenFabric,
       > - selected route, * - FIB route, q - queued route, r - rejected route

B>* 2.2.2.0/24 [20/0] via 10.1.1.1, eth1, 00:10:19
RTB#

从上面可以看出，RTA不再向邻居10.1.1.2发布从RTC接收到的路由信息。

使用No-Export Community解决该问题

在RTA上添加如下配置：

RTA(config-router-af)# no neighbor 10.1.1.3 filter-list test out
RTA(config-router-af)# no neighbor 10.1.1.2 filter-list test out 
RTA(config)# no bgp as-path access-list test
RTA(config)# 
RTA(config)# route-map test permit 1
RTA(config-route-map)# set community no-export
RTA(config-route-map)# exit
RTA(config)# router bgp  65001                     
RTA(config-router)# address-family ipv4 unicast 
RTA(config-router-af)# neighbor 10.1.1.2 route-map test in 
RTA(config-router-af)# neighbor 10.1.1.3 route-map test in  
RTA(config-router-af)#

查看RTB上的路由信息：

RTB# show ip bgp        
BGP table version is 5, local router ID is 172.17.0.3, vrf id 0
Default local pref 100, local AS 65002
Status codes:  s suppressed, d damped, h history, * valid, > best, = multipath,
               i internal, r RIB-failure, S Stale, R Removed
Nexthop codes: @NNN nexthop's vrf id, < announce-nh-self
Origin codes:  i - IGP, e - EGP, ? - incomplete

   Network          Next Hop            Metric LocPrf Weight Path
*> 2.2.2.0/24       10.1.1.1                 0             0 65001 i

Displayed  1 routes and 1 total paths
RTB# show ip route  bgp 
Codes: K - kernel route, C - connected, S - static, R - RIP,
       O - OSPF, I - IS-IS, B - BGP, E - EIGRP, N - NHRP,
       T - Table, v - VNC, V - VNC-Direct, A - Babel, D - SHARP,
       F - PBR, f - OpenFabric,
       > - selected route, * - FIB route, q - queued route, r - rejected route

B>* 2.2.2.0/24 [20/0] via 10.1.1.1, eth1, 00:15:56
RTB#

使用No-Export Community也可以达到同样的效果。

posted @ 2020-01-19 18:02  ouyangxibao  阅读(490)  评论(0)    收藏  举报