COMMON BGP CONFIGURATION IN ISP ENVIRONMENT

If you have studied BGP, you may be wondering which attribute to use where? which are the common attribute used the most? what is the common configuration when it comes to BGP while setting up a PE-CE link?

Let me share with you the two most common scenario in ISP environment for PE-CE configuration.

First, when the customer have only one link with ISP.

CPE Configuration looks like as follows:


interface FastEthernet0/0
description "Wan Interface toward ISP"
 ip address X.X.X.1 255.255.255.252  (Point to Point IP between ISP and Customer)
exit


interface FastEthernet0/1
description "Lan Interface"
 ip address Y.Y.Y.1 255.255.255.240
exit


router bgp UU   (Customer AS number. Could be private if the customer doesn't have its own AS No.)
 no synchronization
 bgp log-neighbor-changes
 network Y.Y.Y.0 mask 255.255.255.240  (Customer Public N/W)
neighbor X.X.X.2 remote-as ZZ  (EBGP Peering with ISP)
no auto-summary
exit

PE Configuration:-

interface FastEthernet 0/0
description "Toward Customer"
 ip address X.X.X.2 255.255.255.252  (Point to Point IP between ISP and Customer)
exit


router bgp ZZ (ISP AS number)
 no synchronization
 bgp log-neighbor-changes
neighbor X.X.X.1 remote-as UU (EBGP Peering with Customer)
neighbor X.X.X.1 prefix-list customer-routes in  (Only accepting the routes assigned to customer
neighbor X.X.X.1 prefix-list default-route out (Only sending default route to customer)
no auto-summary
exit

ip prefix-list default-route seq 5 permit 0.0.0.0/0
ip prefix-list customer-routes seq 5 permit Y.Y.Y.0/28

As you see in the configuration, most of the ISP accepts only the network assign to you just to prevent the customers from corrupting the routing table by false advertisements.
Also, ISP will send only the default route towards you just to prevent the CPE from crashing due to huge number of internet routes.

Second scenario is same as first but in this scenario customer has two links (for redundancy) towards ISP rather than one.

For this kind of setup, ISP uses one of the BGP attribute to prefer one path over another.

The ISP (PE) side configuration looks like this.


router bgp ZZ (ISP AS number)
 no synchronization
 bgp log-neighbor-changes
neighbor X.X.X.1 remote-as UU (EBGP Peering with Customer's Primary Link)
neighbor X.X.X.1  prefix-list customer-routes in  (Only accepting the routes assigned to customer
neighbor X.X.X.1 prefix-list default-route out (Only sending default route to customer)

neighbor X.X.Y.1 remote-as UU (EBGP Peering with Customer's Backup Link)
neighbor X.X.Y.1 route-map customer-routes in  (Only accepting the routes assigned to customer
neighbor X.X.Y.1 prefix-list default-route out (Only sending default route to customer)

no auto-summary
exit

route-map customer-routes permit 10
match ip address prefix-list customer-routes
set weight 0
exit

In above configuration, BGP attribute "weight" is used to influence the path. You can use any attribute to do it. If the link are terminated in different PE router, then weight can't be used. In this case, local-preference or AS- Path prepending is used.
In the next post i will explain how the configuration is done when you have two links from two different ISP (Multi-Homing).

6TH PING DROPPED BY CISCO CALL MANAGER 5.X AND ABOVE

Many of you folks may have noticed it but if you try to do a continues ping to your Cisco CUCM (5.X or above), you may notice that every 6th ping is being dropped. It only happens when you ping from Switch or Router or any device that sends ping packets at faster rate. You may not face the same issue when you ping from a normal PC.

The reason is the firewall policy on CUCM that rate-limits the ping packet just to protect CUCM from ICMP based attacked. You can view the firewall policy using this command.

admin:utils firewall ipv4 list

ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED
ACCEPT icmp -- 0.0.0.0/0 0.0.0.0/0 icmptype 8 limit: avg 10/sec burst 5 LOG icmp -- 0.0.0.0/0 0.0.0.0/0 icmp type 8 limit: avg 1/min burst 5 LOG flags 0 level 4 prefix `ping flood '
DROP icmp -- 0.0.0.0/0 0.0.0.0/0 icmp type 8 

So next time you see it, just don't be scared. There is nothing wrong with the server or the NIC!!

MONITORING BANDWIDTH UTILIZATION

Today at work i faced an issue which i think most of the networking folks have encountered regularly. Determining the ip address/addresses utilizing the most bandwidth. The issue i faced was high utilization on uplink ports that too in inbound direction and that means two things. Either the user is downloading some really heavy stuff or he is under some kind of attack.

In an ISP environment where you have thousand of users, its kind of difficult to determine who is the exact culprit causing the choking on uplinks. If you have all your backbone as Cisco, you can find it out using "IP Accounting" feature but if you multi-vendor environment, it becomes that much difficult specially when the access to you core devices becomes slow due to choking.

For me, the saviour was a product we were testing from last few days. Its called "Scrutinizer". Its a software that analyses your traffic flow and gives you a complete dashboard showing the all the top source/destination ip addresses along with the application details. The best part of Scrutinizer is that it has inbuild algorithm which determines abnormal behavior to determine if any host is under attack such as DDOS.

This feature saved us today as we were able to get the victim ip address that was under attack and were able to take necessary action.

All hail Scrutinizer!!

Introduction

After so many days/weeks/months of thinking and planning, i have finally made my own blog. The whole intention of this blog is to share my day-to-day experience while dealing with Cisco devices. 


Hope my everyday experience while dealing with networking world will help someone someday.