1
00:00:00,000 --> 00:00:01,449

2
00:00:01,449 --> 00:00:02,898
[AUDIO LOGO]

3
00:00:02,898 --> 00:00:07,740

4
00:00:07,740 --> 00:00:09,930
So in this video,
we're going to be

5
00:00:09,930 --> 00:00:14,080
verifying and troubleshooting
our confederation environment.

6
00:00:14,080 --> 00:00:18,720
Now, we already got a little
bit of a hint in our last video

7
00:00:18,720 --> 00:00:23,460
that something's not quite
right as it is at the moment.

8
00:00:23,460 --> 00:00:26,310
We saw on Router 7,
just as an example,

9
00:00:26,310 --> 00:00:29,190
that some of the
prefixes were missing.

10
00:00:29,190 --> 00:00:31,320
I think one of the
prefixes didn't

11
00:00:31,320 --> 00:00:33,250
have a best path selected.

12
00:00:33,250 --> 00:00:36,370
So there's definitely
some issues going on.

13
00:00:36,370 --> 00:00:38,430
Now, to approach
this we're going

14
00:00:38,430 --> 00:00:41,220
to use a slightly different
method here that we're

15
00:00:41,220 --> 00:00:42,750
going to jump to
the command line

16
00:00:42,750 --> 00:00:47,640
first, take a look at what's
going on, and then come back

17
00:00:47,640 --> 00:00:50,430
and look at our
topology diagram and see

18
00:00:50,430 --> 00:00:54,600
if we can figure out why and
what we need to do to fix it.

19
00:00:54,600 --> 00:00:57,690
Then, of course, we'll
implement any necessary fixes

20
00:00:57,690 --> 00:01:00,480
and finally verify
it to make sure

21
00:01:00,480 --> 00:01:02,170
that it's working after that.

22
00:01:02,170 --> 00:01:04,989
So let's go ahead and jump
into the command line.

23
00:01:04,989 --> 00:01:07,350
We'll start by
looking at Router 1

24
00:01:07,350 --> 00:01:12,900
and see what prefixes
it's currently aware of.

25
00:01:12,900 --> 00:01:16,490
So let's just start
with a show IP BGP.

26
00:01:16,490 --> 00:01:18,110
The first thing we
want to see here

27
00:01:18,110 --> 00:01:23,300
is Router 1 does in fact
have all four prefixes.

28
00:01:23,300 --> 00:01:26,330
But even though it
has all four, notice

29
00:01:26,330 --> 00:01:33,650
that it's only selected a
best path for the 100.4.4.0

30
00:01:33,650 --> 00:01:37,700
and the 100.9.9.0.

31
00:01:37,700 --> 00:01:43,010
The other two prefixes,
coming from AS 65002

32
00:01:43,010 --> 00:01:46,820
and then from the external
AS is beyond that,

33
00:01:46,820 --> 00:01:49,470
they have no best path selected.

34
00:01:49,470 --> 00:01:51,560
So let's look at one of
those in more detail.

35
00:01:51,560 --> 00:01:55,880
Let's do a show BGP
for the 100.8.8.0,

36
00:01:55,880 --> 00:01:59,630
and we can almost
immediately see the problem.

37
00:01:59,630 --> 00:02:06,870
The next hop of 192.168.78.8
is inaccessible.

38
00:02:06,870 --> 00:02:10,919
If we do a show IP
route, we have no route

39
00:02:10,919 --> 00:02:13,930
to the 192.168 networks.

40
00:02:13,930 --> 00:02:17,380
So of course Router 1 doesn't
know how to get there.

41
00:02:17,380 --> 00:02:19,980
It's an inaccessible next hop.

42
00:02:19,980 --> 00:02:21,630
Let's hop over and
look at Router 7,

43
00:02:21,630 --> 00:02:24,510
since we already know
it was having a problem.

44
00:02:24,510 --> 00:02:28,140
Again, if we do our
show IP BGP, it actually

45
00:02:28,140 --> 00:02:30,460
only has two of the prefixes.

46
00:02:30,460 --> 00:02:33,420
So let's look at the one
that it has but again

47
00:02:33,420 --> 00:02:35,610
hasn't selected as best.

48
00:02:35,610 --> 00:02:38,880
And if we look at
the 100.10.10.0,

49
00:02:38,880 --> 00:02:43,050
we can see that this is also
inaccessible because the next

50
00:02:43,050 --> 00:02:44,340
hop is 10.

51
00:02:44,340 --> 00:02:48,420
So hopefully we're beginning
to see a trend here.

52
00:02:48,420 --> 00:02:51,120
Let's hop over to the
diagram and take a look

53
00:02:51,120 --> 00:02:53,240
at what's going on.

54
00:02:53,240 --> 00:02:56,420
Thinking about this from
Router 1's perspective

55
00:02:56,420 --> 00:03:00,000
and talking about that prefix
that we looked at earlier,

56
00:03:00,000 --> 00:03:02,930
which is Router 8's loopback.

57
00:03:02,930 --> 00:03:08,630
When Router 8 advertises
that prefix to Router 7,

58
00:03:08,630 --> 00:03:11,990
the next hop on
that prefix is going

59
00:03:11,990 --> 00:03:17,870
to be Router 8's address
on this 192.168.78 network,

60
00:03:17,870 --> 00:03:19,475
and that happens to be 8.

61
00:03:19,475 --> 00:03:20,360
8.

62
00:03:20,360 --> 00:03:22,850
That's Router 8's host address.

63
00:03:22,850 --> 00:03:30,530
When Router 7 advertises this
through iBGP up to Router 6,

64
00:03:30,530 --> 00:03:33,320
it leaves that
next hop the same.

65
00:03:33,320 --> 00:03:37,640
Then Router 6 advertises
it over to Router 1

66
00:03:37,640 --> 00:03:41,030
and it also leaves
the next hop the same.

67
00:03:41,030 --> 00:03:43,580
This is why Router
1 is receiving it

68
00:03:43,580 --> 00:03:48,650
with the next hop of
Router 8's interface way

69
00:03:48,650 --> 00:03:51,740
down here on this network.

70
00:03:51,740 --> 00:03:55,670
That's just an example of
why these next hops are

71
00:03:55,670 --> 00:03:57,850
inaccessible.

72
00:03:57,850 --> 00:04:00,070
In an environment
like this, we're

73
00:04:00,070 --> 00:04:04,420
going to have these next hop
issues all over the place

74
00:04:04,420 --> 00:04:06,610
because almost all
of these prefixes

75
00:04:06,610 --> 00:04:10,810
are being sent between devices
that are in confederation

76
00:04:10,810 --> 00:04:13,630
peers, and with
confederation peers,

77
00:04:13,630 --> 00:04:20,470
we treat those updates from a
next hop perspective like iBGP.

78
00:04:20,470 --> 00:04:25,270
The thought process there
is, well, the underlying IGP

79
00:04:25,270 --> 00:04:28,420
should be handling how to
get to all the next hops.

80
00:04:28,420 --> 00:04:33,370
But in this case, remember that
we're running OSPF and ISIS

81
00:04:33,370 --> 00:04:39,670
in AS 65002 and AS
65001, running nothing

82
00:04:39,670 --> 00:04:45,430
at all in AS 65003, so
none of these devices

83
00:04:45,430 --> 00:04:48,560
know how to get to
any of the next hops.

84
00:04:48,560 --> 00:04:51,820
So there's really two
choices on how to fix this.

85
00:04:51,820 --> 00:04:56,260
Choice number one would
be switch out the IGP

86
00:04:56,260 --> 00:04:59,740
or redistribute
or add a new IGP.

87
00:04:59,740 --> 00:05:02,710
Do something so
all of the routers

88
00:05:02,710 --> 00:05:05,440
know how to get to
all of the next hops.

89
00:05:05,440 --> 00:05:07,970
That could definitely be done.

90
00:05:07,970 --> 00:05:10,420
The other choice is
we're pretty much

91
00:05:10,420 --> 00:05:14,110
going to have to do
next hop self everywhere

92
00:05:14,110 --> 00:05:18,730
that there's a connection
between the confederations.

93
00:05:18,730 --> 00:05:21,520
So that's the approach
we're going to take.

94
00:05:21,520 --> 00:05:23,950
I'm going to show you on
the first couple of routers,

95
00:05:23,950 --> 00:05:26,890
and then we're just going to
go ahead and copy and paste

96
00:05:26,890 --> 00:05:28,780
it and all the other
ones because there

97
00:05:28,780 --> 00:05:31,330
is a lot of next hop selves
that we're going to have

98
00:05:31,330 --> 00:05:33,440
to do here to get this to work.

99
00:05:33,440 --> 00:05:36,780
So let's jump in and do that.

100
00:05:36,780 --> 00:05:39,650
So here on Router 1,
we're going to have

101
00:05:39,650 --> 00:05:45,110
to do next hop self to
all of our iBGP peers

102
00:05:45,110 --> 00:05:50,000
as well as to Router
9 and to Router 6,

103
00:05:50,000 --> 00:05:52,640
which is pretty much
all of its neighbors.

104
00:05:52,640 --> 00:05:55,850
So we'll just go ahead and
paste the configuration in here

105
00:05:55,850 --> 00:05:57,390
to do this.

106
00:05:57,390 --> 00:05:59,990
As you can see here if you
look over this quickly,

107
00:05:59,990 --> 00:06:01,910
all we're doing is
going into the neighbor

108
00:06:01,910 --> 00:06:06,740
group, iBGP peers for
the address family IPv4,

109
00:06:06,740 --> 00:06:08,840
turning on Next Hop Self.

110
00:06:08,840 --> 00:06:10,910
Then we're doing
the exact same thing

111
00:06:10,910 --> 00:06:14,590
for our neighbor, which is
Router 9 ending in the .9,

112
00:06:14,590 --> 00:06:18,590
and our neighbor, which
is .6 ending in the .6.

113
00:06:18,590 --> 00:06:22,700
So that's all we have to
do to configure Router 1.

114
00:06:22,700 --> 00:06:24,560
Let's go to Router 2.

115
00:06:24,560 --> 00:06:27,080
And again, we're trying to make
this not just about typing,

116
00:06:27,080 --> 00:06:29,150
so we're just going to
copy and paste this.

117
00:06:29,150 --> 00:06:31,610
Once again, this is going
to be very repetitive,

118
00:06:31,610 --> 00:06:34,520
but on Router 2 it
only has to worry

119
00:06:34,520 --> 00:06:37,880
about Router 1 and Router 9.

120
00:06:37,880 --> 00:06:41,330
So that's a fairly
straightforward configuration.

121
00:06:41,330 --> 00:06:47,150
On router 3, it only has to
deal with Router 1 and Router 7.

122
00:06:47,150 --> 00:06:50,030
So that takes care of
that configuration.

123
00:06:50,030 --> 00:06:54,130
Router 4 only has to
do it towards Router 1.

124
00:06:54,130 --> 00:06:56,200
Router 5 doesn't really
need it because it's not

125
00:06:56,200 --> 00:06:58,330
injecting any routes,
but let's put it

126
00:06:58,330 --> 00:07:02,020
in there just in case Router
5 needs to inject some routes.

127
00:07:02,020 --> 00:07:06,580
Router 6 needs to do
router 7 and Router 1,

128
00:07:06,580 --> 00:07:10,450
Router 7 needs to do
Router 6 and Router 3,

129
00:07:10,450 --> 00:07:15,200
and Router 9 needs to do
Router 1 and Router 2.

130
00:07:15,200 --> 00:07:17,460
So that was a lot
of configuration.

131
00:07:17,460 --> 00:07:19,800
I know we went through
it very quickly,

132
00:07:19,800 --> 00:07:21,740
but if you need
time to catch up,

133
00:07:21,740 --> 00:07:24,080
just go back and review
the video a little bit.

134
00:07:24,080 --> 00:07:26,810
Pause on each screen
if you need to to see

135
00:07:26,810 --> 00:07:30,090
the actual configuration
that we put into each device.

136
00:07:30,090 --> 00:07:32,490
So now let's do our
verification again.

137
00:07:32,490 --> 00:07:35,690
So now let's go back
over to Router 1.

138
00:07:35,690 --> 00:07:39,380
Let's do our show
IP BGP, and notice

139
00:07:39,380 --> 00:07:43,200
that now we have
all of the prefixes

140
00:07:43,200 --> 00:07:46,830
and they all have
a chosen best path.

141
00:07:46,830 --> 00:07:50,370
So this is looking a
heck of a lot better.

142
00:07:50,370 --> 00:07:54,630
Let's check that
108.8.8.0 prefix again.

143
00:07:54,630 --> 00:07:57,080
So notice that we're
now receiving it.

144
00:07:57,080 --> 00:08:01,220
It has a valid next hop,
in this case Router 6,

145
00:08:01,220 --> 00:08:07,370
and also notice that it's marked
as confed-external, indicating

146
00:08:07,370 --> 00:08:13,900
it's not from this AS but
from a confederation peer.

147
00:08:13,900 --> 00:08:17,160
We could also look at Router 9.

148
00:08:17,160 --> 00:08:21,120
We see that we're getting
two paths, one from Router 2,

149
00:08:21,120 --> 00:08:23,370
which is confed-internal.

150
00:08:23,370 --> 00:08:27,570
It's coming from our same
confederation, 65001,

151
00:08:27,570 --> 00:08:32,100
and the one directly from Router
9, coming from, of course,

152
00:08:32,100 --> 00:08:39,990
65003, which is confed-external
because it's outside of 65001.

153
00:08:39,990 --> 00:08:43,830
So let's go do a show iBGP
on each of our devices

154
00:08:43,830 --> 00:08:46,620
just to make sure they
have all the prefixes.

155
00:08:46,620 --> 00:08:49,330
We'll go through
this fairly quickly.

156
00:08:49,330 --> 00:08:53,670
We see here on Router 2 that
it has three of the prefixes,

157
00:08:53,670 --> 00:08:56,340
but it's missing the
one from Router 4.

158
00:08:56,340 --> 00:08:57,990
That's a different
problem that we'll

159
00:08:57,990 --> 00:09:02,130
be addressing in the next video,
where we have to configure

160
00:09:02,130 --> 00:09:03,480
our route reflector.

161
00:09:03,480 --> 00:09:06,390
But for the three paths
that it is learning,

162
00:09:06,390 --> 00:09:09,250
it has a best path
for all of them.

163
00:09:09,250 --> 00:09:11,562
Let's look at Router 3.

164
00:09:11,562 --> 00:09:15,000
3 pretty much the same
situation as Router 2.

165
00:09:15,000 --> 00:09:16,950
Let's look at Router 4.

166
00:09:16,950 --> 00:09:19,570
Router 4 we can see
has all four prefixes.

167
00:09:19,570 --> 00:09:22,860
Now, that's, of course, because
Router 4 is in fact injecting

168
00:09:22,860 --> 00:09:25,500
one of them, but it
also has the three

169
00:09:25,500 --> 00:09:27,240
that it needs to be
learning, and it's

170
00:09:27,240 --> 00:09:30,150
learning them from Router 1.

171
00:09:30,150 --> 00:09:34,544
Router 5, same situation
pretty much as routers 2 and 3,

172
00:09:34,544 --> 00:09:36,420
except it's a
little bit different

173
00:09:36,420 --> 00:09:39,690
because it only has that one
next hop going to Router 1,

174
00:09:39,690 --> 00:09:42,450
but it's learning the
three prefixes it needs to.

175
00:09:42,450 --> 00:09:45,660
Still not getting that
one from Router 4.

176
00:09:45,660 --> 00:09:49,620
If we look at Router 6, it's
learning all four prefixes

177
00:09:49,620 --> 00:09:53,490
and each of them has
a best path selected.

178
00:09:53,490 --> 00:09:57,660
Router 7, same thing,
learning all four and all four

179
00:09:57,660 --> 00:09:59,700
have a best path.

180
00:09:59,700 --> 00:10:04,480
Also note as we're going
through here, the AS path.

181
00:10:04,480 --> 00:10:07,740
Notice that these are carrying
the internal confederation

182
00:10:07,740 --> 00:10:12,600
AS numbers in parentheses
in the AS path.

183
00:10:12,600 --> 00:10:14,700
This, of course, is
how the confederations

184
00:10:14,700 --> 00:10:18,990
do loop prevention within
the overall confederation

185
00:10:18,990 --> 00:10:21,630
between the sub ASes.

186
00:10:21,630 --> 00:10:25,560
We're going to jump here
out to routers 8 and 10

187
00:10:25,560 --> 00:10:29,230
and look at how they see
these prefixes as well,

188
00:10:29,230 --> 00:10:32,070
and what we want to notice
as we're looking at those

189
00:10:32,070 --> 00:10:35,070
is that these
internal confederation

190
00:10:35,070 --> 00:10:40,390
ASes are going to disappear out
of the AS path, and, of course,

191
00:10:40,390 --> 00:10:42,510
they should.

192
00:10:42,510 --> 00:10:45,900
So here on Router 8 when
we do our show IP BPG,

193
00:10:45,900 --> 00:10:48,330
we have all four prefixes.

194
00:10:48,330 --> 00:10:53,550
Everything looks good and
there's no confederation ASes

195
00:10:53,550 --> 00:10:56,300
in the AS path.

196
00:10:56,300 --> 00:11:00,170
Router 9, once
again looking good.

197
00:11:00,170 --> 00:11:05,300
All four paths and a best
path selected for each one.

198
00:11:05,300 --> 00:11:09,940
And finally, of course, Router
10, and it has all of the paths

199
00:11:09,940 --> 00:11:13,730
appropriately as well.

200
00:11:13,730 --> 00:11:18,040
So in this video, we had
to troubleshoot and verify

201
00:11:18,040 --> 00:11:20,270
our confederation environment.

202
00:11:20,270 --> 00:11:22,930
And as we saw,
our main issue was

203
00:11:22,930 --> 00:11:25,840
we had a lot of next
hop self issues,

204
00:11:25,840 --> 00:11:29,080
or really, next hop
reachability issues.

205
00:11:29,080 --> 00:11:30,830
We could have fixed
that, of course,

206
00:11:30,830 --> 00:11:32,360
in a few different ways.

207
00:11:32,360 --> 00:11:34,300
We did next hop self.

208
00:11:34,300 --> 00:11:39,070
Again, we could have changed it
by doing the IGP or, honestly,

209
00:11:39,070 --> 00:11:41,050
we could have changed
it with a route map

210
00:11:41,050 --> 00:11:43,990
or routing policy
language, and actually

211
00:11:43,990 --> 00:11:46,870
just changed the next hop on
updates as we were sending them

212
00:11:46,870 --> 00:11:48,070
to our neighbors.

213
00:11:48,070 --> 00:11:51,700
That's usually not necessary,
because that's more

214
00:11:51,700 --> 00:11:55,180
if we need to set a next
hop on specific prefixes,

215
00:11:55,180 --> 00:11:58,690
and in this case, we just
had to set the next hop

216
00:11:58,690 --> 00:12:01,870
on all the prefixes we
were sending to a neighbor.

217
00:12:01,870 --> 00:12:05,230
But keep in mind, we can
do it on specific prefixes

218
00:12:05,230 --> 00:12:06,770
if we need to.

219
00:12:06,770 --> 00:12:10,120
So where we are right now
is everything's working

220
00:12:10,120 --> 00:12:19,240
perfectly except Router 4's
loopback inside of AS 65001,

221
00:12:19,240 --> 00:12:21,550
and the solution
to that is going

222
00:12:21,550 --> 00:12:24,460
to be a route reflector,
which we're going to set up

223
00:12:24,460 --> 00:12:26,810
in the very next video.

224
00:12:26,810 --> 00:12:28,900
I hope this has been
informative for you

225
00:12:28,900 --> 00:12:31,950
and I'd like to thank
you for viewing.

226
00:12:31,950 --> 00:12:35,234