1
00:00:00,000 --> 00:00:03,430
[AUDIO LOGO]

2
00:00:03,430 --> 00:00:07,350

3
00:00:07,350 --> 00:00:11,010
In this video, we're going to
be taking a look at AS path

4
00:00:11,010 --> 00:00:12,400
prepending.

5
00:00:12,400 --> 00:00:15,060
The idea behind
AS path pretending

6
00:00:15,060 --> 00:00:19,260
is to influence BGP
path selection based

7
00:00:19,260 --> 00:00:22,200
on the shortest AS path rule.

8
00:00:22,200 --> 00:00:27,660
The way we do that is by
adding AS numbers to the path

9
00:00:27,660 --> 00:00:31,050
that we do not want
our neighbors to use.

10
00:00:31,050 --> 00:00:34,620
And since we're doing this
to influence our neighbors,

11
00:00:34,620 --> 00:00:37,020
that essentially
means that we're doing

12
00:00:37,020 --> 00:00:39,970
this to affect inbound traffic.

13
00:00:39,970 --> 00:00:43,470
Now, like other things we've
discussed in this course,

14
00:00:43,470 --> 00:00:47,710
of course, using things like
BGP communities and such,

15
00:00:47,710 --> 00:00:49,870
we could use them
for other things.

16
00:00:49,870 --> 00:00:53,010
And technically,
we could use this

17
00:00:53,010 --> 00:00:55,540
for outbound path selection.

18
00:00:55,540 --> 00:00:58,600
But again, this would not
be done very commonly.

19
00:00:58,600 --> 00:01:01,800
So let's jump in and take a
look at some of the details

20
00:01:01,800 --> 00:01:05,890
of our AS path prepending.

21
00:01:05,890 --> 00:01:09,250
So AS path prepending
is following

22
00:01:09,250 --> 00:01:13,400
BGP rule number 4
where we're, of course,

23
00:01:13,400 --> 00:01:19,190
going to prefer the path
with the shortest AS path.

24
00:01:19,190 --> 00:01:22,420
So again, this is about
the number of AS's.

25
00:01:22,420 --> 00:01:27,340
It's not about the actual length
as far as number of digits.

26
00:01:27,340 --> 00:01:28,810
Now, one quick note.

27
00:01:28,810 --> 00:01:31,540
This can actually be disabled.

28
00:01:31,540 --> 00:01:34,240
I would generally not
recommend doing it.

29
00:01:34,240 --> 00:01:40,240
But this step can be skipped
if you configure this command--

30
00:01:40,240 --> 00:01:44,290
"bgp bestpath as-path ignore."

31
00:01:44,290 --> 00:01:47,440
Again, this is not something
we generally want to do.

32
00:01:47,440 --> 00:01:53,140
In fact, a lot, I would say, the
majority of BGP path selections

33
00:01:53,140 --> 00:01:55,750
happen based on this rule.

34
00:01:55,750 --> 00:01:59,630
However, there could be reasons
you want to change that.

35
00:01:59,630 --> 00:02:03,560
So it's good that we can turn
it off in certain circumstances,

36
00:02:03,560 --> 00:02:07,580
but it's not, again, a
very common thing to do.

37
00:02:07,580 --> 00:02:11,890
And since we are concerned
about the number of AS's, it's

38
00:02:11,890 --> 00:02:15,940
also important to note
that if we have an AS_SET,

39
00:02:15,940 --> 00:02:18,850
that always counts as one.

40
00:02:18,850 --> 00:02:22,570
It doesn't matter how
many AS's are in that set.

41
00:02:22,570 --> 00:02:29,770
The set itself counts as one
AS for AS path prepending.

42
00:02:29,770 --> 00:02:34,510
Another caveat here is
that the CONFED_SEQUENCE

43
00:02:34,510 --> 00:02:41,400
and the CONFED_SET are also not
included in the actual length.

44
00:02:41,400 --> 00:02:44,360
This is because it's, of
course, trying to only count

45
00:02:44,360 --> 00:02:47,000
external AS numbers.

46
00:02:47,000 --> 00:02:52,550
Of course, the AS path itself
is a well-known and mandatory

47
00:02:52,550 --> 00:02:53,970
attribute.

48
00:02:53,970 --> 00:02:57,650
So well-known, of course,
meaning that all BGP speakers

49
00:02:57,650 --> 00:03:00,260
will understand the AS path.

50
00:03:00,260 --> 00:03:04,310
Mandatory, meaning that it
must be in every update.

51
00:03:04,310 --> 00:03:07,220
Now, that, of course,
doesn't mean that we

52
00:03:07,220 --> 00:03:09,560
have to actually do prepending.

53
00:03:09,560 --> 00:03:14,180
It just means that the AS
path has to be present.

54
00:03:14,180 --> 00:03:19,850
Now, this is relatively high
on the BGP path selection list.

55
00:03:19,850 --> 00:03:24,540
It's rule number 4, which puts
it pretty high to the top.

56
00:03:24,540 --> 00:03:27,560
The reason that it's important
to understand that this

57
00:03:27,560 --> 00:03:30,500
is high on the
BGP path selection

58
00:03:30,500 --> 00:03:36,020
is when we send an AS path
prepend to a neighboring AS,

59
00:03:36,020 --> 00:03:39,650
we need to be fairly confident
that they will, in fact, be

60
00:03:39,650 --> 00:03:42,510
influenced by that AS path.

61
00:03:42,510 --> 00:03:46,640
Now, of course, if the
policy in that neighboring AS

62
00:03:46,640 --> 00:03:49,700
is implementing something
like local preference,

63
00:03:49,700 --> 00:03:54,140
or wait, to override what
we're trying to do with AS path

64
00:03:54,140 --> 00:03:57,650
prepending, well, those
attributes would, of course,

65
00:03:57,650 --> 00:04:01,020
still win because they
are higher on the list.

66
00:04:01,020 --> 00:04:03,950
But generally speaking,
neighboring AS's would not

67
00:04:03,950 --> 00:04:07,460
be purposefully trying
to override what we're

68
00:04:07,460 --> 00:04:09,470
doing with AS path prepending.

69
00:04:09,470 --> 00:04:12,290
Just be aware, of
course, that they can,

70
00:04:12,290 --> 00:04:14,660
just because wait
and local preference

71
00:04:14,660 --> 00:04:18,570
are higher on the list.

72
00:04:18,570 --> 00:04:22,680
Again, the rule here is to
prefer the shorter AS path.

73
00:04:22,680 --> 00:04:27,390
And again, it's the length,
meaning how many AS's not

74
00:04:27,390 --> 00:04:31,110
based on the actual AS
numbers, which would more

75
00:04:31,110 --> 00:04:33,300
be about the number of digits.

76
00:04:33,300 --> 00:04:36,250
And as we mentioned
during the introduction,

77
00:04:36,250 --> 00:04:41,850
this is normally used to
influence the inbound traffic

78
00:04:41,850 --> 00:04:45,270
in a multihomed AS environment.

79
00:04:45,270 --> 00:04:49,110
Technically, we could use AS
path prepending to control

80
00:04:49,110 --> 00:04:50,730
our outbound traffic.

81
00:04:50,730 --> 00:04:55,050
But again, given that we already
have wait and local preference,

82
00:04:55,050 --> 00:04:57,850
there's not really
any reason to do that.

83
00:04:57,850 --> 00:05:01,860
So again, it's
not commonly done.

84
00:05:01,860 --> 00:05:04,400
So again, the reason
this is so important

85
00:05:04,400 --> 00:05:08,240
is because just
generally trying to get

86
00:05:08,240 --> 00:05:12,590
another AS to return your
traffic on a certain path

87
00:05:12,590 --> 00:05:13,820
directly.

88
00:05:13,820 --> 00:05:15,950
Basically, what
we mean by that is

89
00:05:15,950 --> 00:05:18,860
like calling up another
service provider,

90
00:05:18,860 --> 00:05:21,450
or calling a
customer, and saying,

91
00:05:21,450 --> 00:05:23,990
"Listen, could you
modify your policy

92
00:05:23,990 --> 00:05:27,140
to send traffic a certain way?"

93
00:05:27,140 --> 00:05:29,150
That's what we mean by directly.

94
00:05:29,150 --> 00:05:31,010
They're not going
to generally change

95
00:05:31,010 --> 00:05:35,030
their policy based on what
you would like to happen.

96
00:05:35,030 --> 00:05:36,740
And particularly,
if you're looking

97
00:05:36,740 --> 00:05:40,280
at this from the customer
side, the service provider

98
00:05:40,280 --> 00:05:44,318
is certainly not going to change
their policy for a customer.

99
00:05:44,318 --> 00:05:46,610
Now notice we put here-- and
we've mentioned this a few

100
00:05:46,610 --> 00:05:48,080
times now--

101
00:05:48,080 --> 00:05:51,650
communities, of course,
can be an exception.

102
00:05:51,650 --> 00:05:54,090
As a service provider,
we can, of course,

103
00:05:54,090 --> 00:05:59,030
write policies, route maps,
to accept certain communities,

104
00:05:59,030 --> 00:06:03,360
and then select certain
paths for the customer.

105
00:06:03,360 --> 00:06:05,960
So the overall idea,
again, is we're

106
00:06:05,960 --> 00:06:09,380
going to be manually
manipulating the AS path

107
00:06:09,380 --> 00:06:10,640
length.

108
00:06:10,640 --> 00:06:14,420
We're going to take the
originating AS's number.

109
00:06:14,420 --> 00:06:17,480
And we're going to add
it a number of times

110
00:06:17,480 --> 00:06:21,590
to the end of our
normal AS path.

111
00:06:21,590 --> 00:06:26,270
The reason we usually use the
originating AS's number is,

112
00:06:26,270 --> 00:06:30,090
that way, we don't interfere
with BGP loop prevention.

113
00:06:30,090 --> 00:06:32,210
We don't want this
traffic to arrive

114
00:06:32,210 --> 00:06:36,680
at an AS that actually is the
AS number that we prepended.

115
00:06:36,680 --> 00:06:40,400
So since our own routes
should never come back to us,

116
00:06:40,400 --> 00:06:44,570
it wouldn't be a problem to use
our own AS number to prepend.

117
00:06:44,570 --> 00:06:47,030
That's why it's
normally done that way.

118
00:06:47,030 --> 00:06:48,050
Understand, though.

119
00:06:48,050 --> 00:06:51,710
There's nothing technical
to stop you from prepending,

120
00:06:51,710 --> 00:06:56,600
honestly, any numbers you
want to for whatever reason.

121
00:06:56,600 --> 00:07:00,050
But normally, again, it's going
to be the originating AS's

122
00:07:00,050 --> 00:07:00,720
number.

123
00:07:00,720 --> 00:07:03,020
That's how this
is commonly used.

124
00:07:03,020 --> 00:07:07,310
This is, of course, in
addition to the normal AS

125
00:07:07,310 --> 00:07:13,040
path prepending that we
normally do in eBGP updates.

126
00:07:13,040 --> 00:07:16,100
That means that if we
prepend three times,

127
00:07:16,100 --> 00:07:18,740
like I indicated up here,
that we would actually

128
00:07:18,740 --> 00:07:22,910
be adding our AS number
four times to this update,

129
00:07:22,910 --> 00:07:25,580
the three that we
prepended, as well

130
00:07:25,580 --> 00:07:27,320
as the one that
would, of course,

131
00:07:27,320 --> 00:07:30,210
normally be put on that update.

132
00:07:30,210 --> 00:07:33,050
Now, there is one thing we
need to be concerned with when

133
00:07:33,050 --> 00:07:35,180
it comes to AS path prepending.

134
00:07:35,180 --> 00:07:40,160
And that is, it may not
pass the neighboring AS's

135
00:07:40,160 --> 00:07:42,380
inbound filters.

136
00:07:42,380 --> 00:07:47,150
It's actually quite common, for
example, for a service provider

137
00:07:47,150 --> 00:07:50,360
to filter the updates
coming from a neighbor

138
00:07:50,360 --> 00:07:54,860
to only allow updates with
that neighbor's AS on it

139
00:07:54,860 --> 00:07:56,990
as the only AS.

140
00:07:56,990 --> 00:08:02,690
So, for example, if one of
my customers was AS 65,001,

141
00:08:02,690 --> 00:08:07,490
I would not accept any updates
from that customer that

142
00:08:07,490 --> 00:08:11,150
weren't originated from 65001.

143
00:08:11,150 --> 00:08:13,760
Now, what I can do
is write my filter

144
00:08:13,760 --> 00:08:18,750
to allow multiple instances
of that same number.

145
00:08:18,750 --> 00:08:21,600
And that's quite
commonly done as well.

146
00:08:21,600 --> 00:08:24,050
But if it's not
written that way,

147
00:08:24,050 --> 00:08:26,600
then prepending
would be a problem.

148
00:08:26,600 --> 00:08:30,170
If the person that I'm trying
to send these updates to

149
00:08:30,170 --> 00:08:34,880
does not accept multiple
instances of the AS number,

150
00:08:34,880 --> 00:08:38,880
then prepending is not
going to be our option.

151
00:08:38,880 --> 00:08:41,360
So this means we
probably want to verify

152
00:08:41,360 --> 00:08:44,059
with neighboring
AS's how they're

153
00:08:44,059 --> 00:08:46,100
configuring their filters.

154
00:08:46,100 --> 00:08:49,010
So just to summarize
the whole idea here

155
00:08:49,010 --> 00:08:53,270
of AS path prepending,
the basic idea

156
00:08:53,270 --> 00:08:59,370
is we're going to taint the path
that we want to be the backup.

157
00:08:59,370 --> 00:09:02,130
So if we don't want
a path to be used,

158
00:09:02,130 --> 00:09:07,690
that's the one that we would
do our AS path prepending on.

159
00:09:07,690 --> 00:09:10,620
In this video, we
talked about using

160
00:09:10,620 --> 00:09:17,170
AS path pretending to affect
the return path into our AS.

161
00:09:17,170 --> 00:09:20,110
So the basic idea
being we're going

162
00:09:20,110 --> 00:09:24,460
to add multiple copies of
the originating AS number

163
00:09:24,460 --> 00:09:29,290
to the path that we don't
want to use, therefore

164
00:09:29,290 --> 00:09:32,500
causing our neighboring
AS's to return

165
00:09:32,500 --> 00:09:37,030
traffic to us across the
alternate path, rather

166
00:09:37,030 --> 00:09:40,840
than the one that we added
all of the AS numbers to.

167
00:09:40,840 --> 00:09:44,710
In the next video, we're going
to take a look at an example

168
00:09:44,710 --> 00:09:49,160
of how this would work
with multiple AS's.

169
00:09:49,160 --> 00:09:51,380
I hope this has been
informative for you.

170
00:09:51,380 --> 00:09:54,550
And I'd like to thank
you for viewing.

171
00:09:54,550 --> 00:09:58,000