1
00:00:00,000 --> 00:00:00,968

2
00:00:00,968 --> 00:00:04,356
[AUDIO LOGO]

3
00:00:04,356 --> 00:00:12,110

4
00:00:12,110 --> 00:00:14,831
Next up, we have
Trouble Ticket 3.

5
00:00:14,831 --> 00:00:20,090
And this ticket simply says that
routes being injected into BGP

6
00:00:20,090 --> 00:00:26,330
on R10, so coming down this
way, are not reaching router 7,

7
00:00:26,330 --> 00:00:28,080
and they should be.

8
00:00:28,080 --> 00:00:30,710
So we're going to have
to go look at router 7

9
00:00:30,710 --> 00:00:33,710
and find out why it's
not getting prefixes

10
00:00:33,710 --> 00:00:35,330
from router 10.

11
00:00:35,330 --> 00:00:37,470
So let's jump into
the command line.

12
00:00:37,470 --> 00:00:40,820
Of course, we might as
well start on router 7.

13
00:00:40,820 --> 00:00:43,610
Let's start with a show ip bgp.

14
00:00:43,610 --> 00:00:46,580
And as we can see,
we do have a network

15
00:00:46,580 --> 00:00:49,860
coming from router 8, which
is one of our other neighbors,

16
00:00:49,860 --> 00:00:54,260
but certainly nothing coming
from router 10 or router 6

17
00:00:54,260 --> 00:00:55,700
or router 1 or router.

18
00:00:55,700 --> 00:00:59,840
We're just getting one
update coming from router 8.

19
00:00:59,840 --> 00:01:03,180
So let's see if we
configure what's going on.

20
00:01:03,180 --> 00:01:05,780
Let's start by going
to router 6 and see

21
00:01:05,780 --> 00:01:09,740
if router 6 is even trying
to send anything to router 7.

22
00:01:09,740 --> 00:01:12,740
Keep in mind, the reason
we're looking at router 6

23
00:01:12,740 --> 00:01:16,790
is we don't know if the problem
yet is router 10 or router 6.

24
00:01:16,790 --> 00:01:20,790
So we may, as well, just go to
router 6 and see what it knows.

25
00:01:20,790 --> 00:01:24,230
So first on router 6,
let's do our show ip bgp,

26
00:01:24,230 --> 00:01:27,770
and we see that this does
in fact have prefixes

27
00:01:27,770 --> 00:01:29,930
being learned from router 10.

28
00:01:29,930 --> 00:01:33,630
So clearly, router 6
does have the prefixes.

29
00:01:33,630 --> 00:01:37,250
Now, let's see if it's
sending them to the neighbor.

30
00:01:37,250 --> 00:01:42,580
So we'll say show ip
bgp neighbor 50.0.167.7,

31
00:01:42,580 --> 00:01:45,230
and we'll say advertised-routes.

32
00:01:45,230 --> 00:01:48,590
So according to router
6, it is, in fact,

33
00:01:48,590 --> 00:01:52,540
sending all of these
prefixes to router 7.

34
00:01:52,540 --> 00:01:56,750
But for some reason, router
7 is not getting them.

35
00:01:56,750 --> 00:01:59,500
So let's actually jump on
to Wireshark real quick

36
00:01:59,500 --> 00:02:02,440
and see if router 6 is
actually sending them

37
00:02:02,440 --> 00:02:05,480
or if it just thinks
it's sending them.

38
00:02:05,480 --> 00:02:07,330
So here in Wireshark,
we're going

39
00:02:07,330 --> 00:02:11,240
to capture on router
7's gigabit 1 interface,

40
00:02:11,240 --> 00:02:16,510
and we're filtering four BGP
packets except for BGP packets

41
00:02:16,510 --> 00:02:18,710
with a length of 19.

42
00:02:18,710 --> 00:02:21,850
That's to prevent the keepalives
from showing up and making

43
00:02:21,850 --> 00:02:24,710
this more difficult to find
the packets we're looking for.

44
00:02:24,710 --> 00:02:29,980
So now, let's go to router 7 and
do a clear on our BGP neighbors

45
00:02:29,980 --> 00:02:32,450
and see what gets sent.

46
00:02:32,450 --> 00:02:35,483
We'll just do a
clear ip bgp star in.

47
00:02:35,483 --> 00:02:37,900
And then let's go back and see
if we've picked up anything

48
00:02:37,900 --> 00:02:40,070
on Wireshark.

49
00:02:40,070 --> 00:02:42,530
So here in Wireshark,
we actually

50
00:02:42,530 --> 00:02:46,250
see this packet that is an
update coming from router 6

51
00:02:46,250 --> 00:02:47,540
to router 7.

52
00:02:47,540 --> 00:02:49,790
We can see that this is
in response, actually,

53
00:02:49,790 --> 00:02:51,600
to a route refresh message.

54
00:02:51,600 --> 00:02:54,140
But let's take a look
at what's in here.

55
00:02:54,140 --> 00:02:56,850
Let's expand the update message.

56
00:02:56,850 --> 00:02:59,630
We'll start with the first
one and look at the NLRI.

57
00:02:59,630 --> 00:03:02,000
We see here where it
was trying to advertise

58
00:03:02,000 --> 00:03:05,630
all of these subnets
coming from router 10.

59
00:03:05,630 --> 00:03:09,590
These other update messages are
going to contain other NLRIs,

60
00:03:09,590 --> 00:03:12,380
but we don't really have to
look at every one of them.

61
00:03:12,380 --> 00:03:16,190
We see that router 6 is,
in fact, sending updates

62
00:03:16,190 --> 00:03:19,620
to router 7 with
this information.

63
00:03:19,620 --> 00:03:22,650
So let's go back and
look at router 7 again.

64
00:03:22,650 --> 00:03:25,640
So since we know that router
7 is, in fact, receiving

65
00:03:25,640 --> 00:03:29,010
the updates, let's
debug those updates.

66
00:03:29,010 --> 00:03:31,770
So we'll turn on
terminal monitor,

67
00:03:31,770 --> 00:03:35,130
and we'll do a
debug ip bgp update.

68
00:03:35,130 --> 00:03:38,190
Then let's do a clear ip
bgp, but this time, only the

69
00:03:38,190 --> 00:03:39,150
router 6.

70
00:03:39,150 --> 00:03:41,970
That way, we don't get other
packets from other routers

71
00:03:41,970 --> 00:03:44,260
because there is
router 1 out there.

72
00:03:44,260 --> 00:03:46,450
So let's go ahead
and clear this.

73
00:03:46,450 --> 00:03:48,930
Let's turn off the debugging
because we've already

74
00:03:48,930 --> 00:03:51,090
seen what we need to see.

75
00:03:51,090 --> 00:03:53,640
Let's scroll up
just a little bit.

76
00:03:53,640 --> 00:03:56,230
This way, we can see the
bulk of the messages.

77
00:03:56,230 --> 00:03:58,530
All of these messages
right here are

78
00:03:58,530 --> 00:04:01,140
about receiving all
of those prefixes.

79
00:04:01,140 --> 00:04:05,400
And notice, it says
denied due to the AS path

80
00:04:05,400 --> 00:04:09,100
contains our own AS.

81
00:04:09,100 --> 00:04:14,470
So as we can see, this is just
standard BGP loop prevention.

82
00:04:14,470 --> 00:04:21,380
BGP will not accept updates if
its own AS is in the AS path.

83
00:04:21,380 --> 00:04:23,810
And if we look back
at our diagram,

84
00:04:23,810 --> 00:04:28,960
we can see clearly here
that router 10 and router 7

85
00:04:28,960 --> 00:04:31,291
are in the same AS.

86
00:04:31,291 --> 00:04:34,660
And as such, router
7 is not going

87
00:04:34,660 --> 00:04:36,560
to be accepting these updates.

88
00:04:36,560 --> 00:04:40,520
So we have a couple of choices
on how we can fix this.

89
00:04:40,520 --> 00:04:46,720
The first would be, we could do
remove private AS on router 6.

90
00:04:46,720 --> 00:04:50,080
We would have to do
remove private AS all

91
00:04:50,080 --> 00:04:53,230
because otherwise, it won't
remove the private AS when

92
00:04:53,230 --> 00:04:56,740
we send back to
our own AS number,

93
00:04:56,740 --> 00:05:01,930
or we could do maybe
local AS on router 7.

94
00:05:01,930 --> 00:05:05,980
Change router 7's configuration
to actually use a different AS

95
00:05:05,980 --> 00:05:06,663
number.

96
00:05:06,663 --> 00:05:08,080
There's a lot of
things that would

97
00:05:08,080 --> 00:05:11,470
be involved in doing that, but
it could certainly be done.

98
00:05:11,470 --> 00:05:15,640
Or of course, we could always
just change the AS numbers.

99
00:05:15,640 --> 00:05:17,830
That's, of course, an option.

100
00:05:17,830 --> 00:05:21,760
Or we could use something
called allowas-in.

101
00:05:21,760 --> 00:05:24,580
Now, the problem
with using allowas-in

102
00:05:24,580 --> 00:05:30,190
is we are basically disabling or
circumventing BGP's normal loop

103
00:05:30,190 --> 00:05:31,130
prevention.

104
00:05:31,130 --> 00:05:34,570
So if we're going to do
that, that leaves it up

105
00:05:34,570 --> 00:05:39,380
to us as administrators to make
sure we're not creating a loop.

106
00:05:39,380 --> 00:05:42,520
Now, we can tell clearly by
looking here at the diagram

107
00:05:42,520 --> 00:05:47,530
that allowing these routes
from router 10 into router 7

108
00:05:47,530 --> 00:05:51,560
would not cause a loop in
this particular environment.

109
00:05:51,560 --> 00:05:54,280
So as long as we know it's
not going to create a loop,

110
00:05:54,280 --> 00:05:56,780
that would be a
fair thing to do.

111
00:05:56,780 --> 00:05:59,980
So let's go ahead and
go back over to router 7

112
00:05:59,980 --> 00:06:05,230
and figure out which solution
we want to implement.

113
00:06:05,230 --> 00:06:07,650
So given our different
choices, if we

114
00:06:07,650 --> 00:06:10,710
have to implement the
solution just on router 7,

115
00:06:10,710 --> 00:06:14,380
we're going to have to go
with that allowas-in option.

116
00:06:14,380 --> 00:06:20,220
So let's go into Configuration
mode, router bgp 65001.

117
00:06:20,220 --> 00:06:23,970
For the neighbor, 50.0.167.6.

118
00:06:23,970 --> 00:06:28,140
We're going to say allowas-in.

119
00:06:28,140 --> 00:06:30,270
I don't know about
you, but I've always

120
00:06:30,270 --> 00:06:32,980
found this command a
little bit interesting.

121
00:06:32,980 --> 00:06:37,890
Why is it allowas, like it's one
word, dash in instead of like,

122
00:06:37,890 --> 00:06:40,830
allow-as-in?

123
00:06:40,830 --> 00:06:42,490
Might make a little more sense.

124
00:06:42,490 --> 00:06:44,020
The command is what it is.

125
00:06:44,020 --> 00:06:47,130
I've just always personally
found it a little bit amusing.

126
00:06:47,130 --> 00:06:49,980
We can then specify
how many times

127
00:06:49,980 --> 00:06:52,740
we want to allow our AS in.

128
00:06:52,740 --> 00:06:55,410
I'm not going to specify this,
so we can see the default.

129
00:06:55,410 --> 00:06:57,390
The default is actually 3.

130
00:06:57,390 --> 00:07:00,030
The reason for this,
of course, is in case

131
00:07:00,030 --> 00:07:02,670
our update is going around
and around in a loop,

132
00:07:02,670 --> 00:07:04,350
it doesn't loop forever.

133
00:07:04,350 --> 00:07:09,160
So yes, we're disabling loop
prevention, but with a limit.

134
00:07:09,160 --> 00:07:13,500
So we'll just say allowas-in,
so we can see what it does.

135
00:07:13,500 --> 00:07:15,270
This is not something
we actually have

136
00:07:15,270 --> 00:07:17,380
to clear the neighborship for.

137
00:07:17,380 --> 00:07:20,160
If we do a show
ip bgp, we can see

138
00:07:20,160 --> 00:07:22,290
that they've already shown up.

139
00:07:22,290 --> 00:07:28,110
If we do a show ip bgp for
the neighbor 50.0.167.6

140
00:07:28,110 --> 00:07:30,750
under the address
family, we can actually

141
00:07:30,750 --> 00:07:34,470
see here where we're
allowing our AS number in.

142
00:07:34,470 --> 00:07:37,320
And well, it's not
exactly proper English,

143
00:07:37,320 --> 00:07:39,450
but I didn't write it.

144
00:07:39,450 --> 00:07:44,830
My AS number is allowed
for three number of times.

145
00:07:44,830 --> 00:07:47,490
So that's what it says.

146
00:07:47,490 --> 00:07:50,010
But of course,
the point is, it's

147
00:07:50,010 --> 00:07:52,710
allowing our AS in three time.

148
00:07:52,710 --> 00:07:55,110
And of course, as
we just saw, we

149
00:07:55,110 --> 00:07:57,690
are now getting the
prefixes that we're supposed

150
00:07:57,690 --> 00:07:59,880
to be getting on router 7.

151
00:07:59,880 --> 00:08:05,320
So that proves that we have,
in fact, solved this ticket.

152
00:08:05,320 --> 00:08:12,100
In this video, we saw an example
of a problem with BGP AS path,

153
00:08:12,100 --> 00:08:15,460
where we had a device
not accepting prefixes

154
00:08:15,460 --> 00:08:18,190
that we wanted it
to because they

155
00:08:18,190 --> 00:08:21,200
had our own AS in the AS path.

156
00:08:21,200 --> 00:08:24,650
Now, again, there's a couple
of different ways to fix this.

157
00:08:24,650 --> 00:08:27,490
One that I actually didn't
mention in our choices

158
00:08:27,490 --> 00:08:29,920
is something called as-override.

159
00:08:29,920 --> 00:08:32,320
We'll take a look at that
one a little bit more

160
00:08:32,320 --> 00:08:34,340
in our MPLS section.

161
00:08:34,340 --> 00:08:36,850
But there's a couple of ways
we could have fixed this,

162
00:08:36,850 --> 00:08:39,520
but one of them
is to allow AS in.

163
00:08:39,520 --> 00:08:42,520
And of course, we can
limit how many times it

164
00:08:42,520 --> 00:08:45,880
does that, the default being 3.

165
00:08:45,880 --> 00:08:48,160
I hope this has been
informative for you,

166
00:08:48,160 --> 00:08:51,240
and I'd like to thank
you for viewing.

167
00:08:51,240 --> 00:08:55,000