Course contents

Module 2: Configuring BGPLesson 2.6 (6 of 6 in this module)9 of 43 in the BGP course

Lab: eBGP to two ISPs and iBGP inside

You have built each piece on its own. Now put them together: two ISPs, two company routers and one prefix, then find out what each router chooses when nobody has told it what to prefer.

Advanced · 16 min read

You'll learn to build the complete course network with eBGP to two ISPs and iBGP between R1 and R2, verify what each router learns, and diagnose three common faults.

The network you are building

The company is AS 64500 with two border routers. R1 connects to ISP A (AS 64501) and R2 connects to ISP B (AS 64502). R1 and R2 are joined by an internal link, and both connect to the company LAN 198.51.100.0/24. All addresses and AS numbers are documentation values.

192.0.2.0/30192.0.2.4/30Gi0/1 .1.2 Gi0/110.0.12.0/30Gi0/2Gi0/2InternetISP AAS 64501ISP BAS 64502R1RID 1.1.1.1R2RID 2.2.2.2Company LAN, AS 64500Subnet 198.51.100.0/24

Device key: ISP A, ISP B, R1, R2 (router) · Company LAN, AS 64500 (network / site)

Lines show the example’s network connections. Thick links: uplinks/WAN, as labelled. Read the numbered steps for traffic direction and changes.

Reading the addresses

IP labels identify interfaces or destinations. Subnet labels identify networks; /n is the prefix length. A router ID (RID) identifies a routing process and need not be a reachable interface.

An IP address alone is not a URL. A web URL includes a scheme such as https://; an address on a router or printer does not imply a website.

  • ISP A: AS 64501
  • ISP B: AS 64502
  • R1: RID 1.1.1.1
  • R2: RID 2.2.2.2
  • Company LAN, AS 64500: Subnet 198.51.100.0/24
  1. 1. Provider sessions: Each company router peers with its own ISP.
  2. 2. Internal session: R1 and R2 exchange what each learned.
The same network is used in every lesson of this course. Interface addresses are in the table below.
The network you are building
The network you are buildingDevice; Interface; Address; Router ID. R1: Gi0/0 to ISP A · Gi0/1 to R2 · Gi0/2 LAN · Lo0 192.0.2.2/30 · 10.0.12.1/30 · 198.51.100.2/24 · 10.255.0.1/32 1.1.1.1 R2: Gi0/0 to ISP B · Gi0/1 to R1 · Gi0/2 LAN · Lo0 192.0.2.6/30 · 10.0.12.2/30 · 198.51.100.3/24 · 10.255.0.2/32 2.2.2.2 ISP A: Gi0/0 · Lo10 192.0.2.1/30 · 203.0.113.1/24 11.11.11.11 ISP B: Gi0/0 · Lo10 192.0.2.5/30 · 203.0.113.1/24 12.12.12.12DeviceInterfaceAddressRouter IDR1Gi0/0 to ISP A · Gi0/1 toR2 · Gi0/2 LAN · Lo0192.0.2.2/30 ·10.0.12.1/30 ·198.51.100.2/24 ·10.255.0.1/321.1.1.1R2Gi0/0 to ISP B · Gi0/1 toR1 · Gi0/2 LAN · Lo0192.0.2.6/30 ·10.0.12.2/30 ·198.51.100.3/24 ·10.255.0.2/322.2.2.2ISP AGi0/0 · Lo10192.0.2.1/30 ·203.0.113.1/2411.11.11.11ISP BGi0/0 · Lo10192.0.2.5/30 ·203.0.113.1/2412.12.12.12

On small screens, swipe sideways or focus the diagram and use the arrow keys.

Read each row across: the left box names the item, the others describe it.

The provider routers use their own router IDs so that no two routers in the lab share one. Both ISPs carry the same example destination, 203.0.113.0/24 on a Loopback10, because it stands for a remote network reachable through either provider. The company advertises 198.51.100.0/24 to both.

Build the course network in five stages
Build the course network in five stagesFive boxes in a row: addressing, loopbacks with OSPF, eBGP to both ISPs, iBGP between R1 and R2 with next-hop-self, then verification.1 AddressingInterface IPs,no shutdown,ping neighbours2 LoopbacksOSPF carriesR1 and R2loopbacks3 eBGPR1 to ISP A,R2 to ISP B,filters on4 iBGPR1 to R2 onloopbacks,next-hop-self5 VerifySummary, table,routes, pingfrom the LAN

On small screens, swipe sideways or focus the diagram and use the arrow keys.

Each stage has its own check. Do not start the next stage until the previous one passes, or you will not know which layer caused a fault.

Stages 1 and 2: addresses and loopbacks

Configure the interfaces from the table first and ping every directly connected neighbour. Then run OSPF between R1 and R2 so each can reach the other's loopback. BGP is not used for this reachability; the iBGP session needs it to exist.

Stages 1 and 2
Stages 1 and 2Addresses first, then the IGP and loopbacks.Addressesinterfaces upPingeach linkLoopbacksadvertised by IGP

On small screens, swipe sideways or focus the diagram and use the arrow keys.

Ping every link and every loopback before BGP.
interface Loopback0 ip address 10.255.0.1 255.255.255.255 interface GigabitEthernet0/1 ip address 10.0.12.1 255.255.255.252 no shutdown router ospf 1 router-id 1.1.1.1 network 10.0.12.0 0.0.0.3 area 0 network 10.255.0.1 0.0.0.0 area 0

R1 internal reachability. R2 is the mirror: 10.0.12.2/30, Loopback0 10.255.0.2/32 and router-id 2.2.2.2. Do not advertise the provider links or the company LAN into OSPF.

Check with show ip route ospf on each router and ping 10.255.0.2 source Loopback0 from R1. Do not move on until that loopback-to-loopback ping works.

Stage 3: the two provider sessions

Each router gets prefix lists so only the intended prefixes move in each direction, the same pattern as the first eBGP lesson.

Stage 3: provider sessions
Stage 3: provider sessionsTwo eBGP sessions, one per provider.R1 to ISP Aremote-as 64501R2 to ISP Bremote-as 64502Filters onbefore advertising

On small screens, swipe sideways or focus the diagram and use the arrow keys.

Verify both reach Established before iBGP.
ip prefix-list COMPANY-ONLY seq 10 permit 198.51.100.0/24 ip prefix-list PROVIDER-ONLY seq 10 permit 203.0.113.0/24 router bgp 64500 bgp router-id 1.1.1.1 no bgp default ipv4-unicast neighbor 192.0.2.1 remote-as 64501 address-family ipv4 unicast network 198.51.100.0 mask 255.255.255.0 neighbor 192.0.2.1 activate neighbor 192.0.2.1 prefix-list PROVIDER-ONLY in neighbor 192.0.2.1 prefix-list COMPANY-ONLY out exit-address-family

R1: eBGP to ISP A. On R2 use neighbor 192.0.2.5 remote-as 64502 and bgp router-id 2.2.2.2; both routers originate the company prefix.

ip prefix-list COMPANY-ONLY seq 10 permit 198.51.100.0/24 ip prefix-list PROVIDER-ONLY seq 10 permit 203.0.113.0/24 interface Loopback10 ip address 203.0.113.1 255.255.255.0 router bgp 64501 bgp router-id 11.11.11.11 no bgp default ipv4-unicast neighbor 192.0.2.2 remote-as 64500 address-family ipv4 unicast network 203.0.113.0 mask 255.255.255.0 neighbor 192.0.2.2 activate neighbor 192.0.2.2 prefix-list COMPANY-ONLY in neighbor 192.0.2.2 prefix-list PROVIDER-ONLY out exit-address-family

ISP A. ISP B is the same with AS 64502, router-id 12.12.12.12, interface address 192.0.2.5 and neighbor 192.0.2.6 remote-as 64500.

Stage 4: iBGP on loopbacks with next-hop-self

Stage 4: iBGP on loopbacks
Stage 4: iBGP on loopbacksiBGP between R1 and R2 with next-hop-self.update-sourceLoopback0next-hop-selfon both routersEstablishedloopback to loopback

On small screens, swipe sideways or focus the diagram and use the arrow keys.

Without next-hop-self the provider next hop is unreachable inside the AS.
router bgp 64500 neighbor 10.255.0.2 remote-as 64500 neighbor 10.255.0.2 update-source Loopback0 address-family ipv4 unicast neighbor 10.255.0.2 activate neighbor 10.255.0.2 next-hop-self exit-address-family

R1. On R2, the neighbour is 10.255.0.1. update-source makes the session use the loopback; next-hop-self makes R1 present itself as the next hop for ISP A routes.

Stage 5: verify what each router chose

Illustrative Cisco IOS XE output written for this lesson, not a router capture
R1#show ip bgp summary | begin Neighbor
Neighbor        V           AS MsgRcvd MsgSent   TblVer  InQ OutQ Up/Down  State/PfxRcd
10.255.0.2      4        64500      22      21        5    0    0 00:08:41        2
192.0.2.1       4        64501      27      25        5    0    0 00:11:03        1
Both sessions are Established, shown by the numbers in the last column. R1 accepted two prefixes from R2 (the company prefix and the ISP B copy of 203.0.113.0/24) and one from ISP A.
Illustrative Cisco IOS XE output written for this lesson, not a router capture
R1#show ip bgp
     Network          Next Hop            Metric LocPrf Weight Path
 *>  198.51.100.0     0.0.0.0                  0         32768 i
 * i                  10.255.0.2               0    100      0 i
 *>  203.0.113.0      192.0.2.1                0             0 64501 i
 * i                  10.255.0.2               0    100      0 64502 i
For 203.0.113.0/24 R1 holds two paths. Weight, local preference, AS path length, origin and MED are all equal, so the next rule applies: an eBGP path beats an iBGP path. R1 chooses ISP A (>) and keeps the path through R2 as the backup. R2 sees the mirror image and chooses ISP B. Neither router has been told to prefer anything.

From the company LAN side, ping 203.0.113.1 source 198.51.100.2 on R1 should succeed through ISP A, and the same ping on R2 through ISP B. On each ISP, show ip bgp should show the company prefix.

Stage 5: what to verify
Stage 5: what to verifyEach router should show one best path for each prefix.R1 tableBest path via ISP A for 203.0.113.0/24R2 tableLearns the prefix over iBGP and eBGPPing from the LANThe destination is reachable

On small screens, swipe sideways or focus the diagram and use the arrow keys.

Compare against the expected answer.

Three faults to find

Break the lab on purpose, one fault at a time, and use the output to find the cause before you reveal the answer.

Fault 1: remove next-hop-self from R1

On R2, show ip bgp 203.0.113.0 lists the R1 path with next hop 192.0.2.1 marked inaccessible, and it is not a valid path. R2 still uses ISP B, so traffic keeps working, but the backup through R1 is gone. Restore next-hop-self and confirm the path returns with next hop 10.255.0.1.

Fault 2: the COMPANY-ONLY prefix list says 198.51.100.0/23

The session stays Established, but R1's outbound filter no longer matches the company /24, so ISP A never learns it. show ip bgp neighbors 192.0.2.1 advertised-routes on R1 is empty. Prefix lists match exactly unless you add ge or le, so the fix is the right length, not a wider list.

Fault 3: shut down R1 Gi0/1 for a minute

OSPF loses the route to R2's loopback, the iBGP session drops and R1 and R2 stop sharing paths. Each keeps its own ISP, so the company stays reachable. The session returns once the link and the OSPF route are back. A route that BGP needs to build a session cannot come from BGP itself.

Technical references: Cisco IOS XE 17.x BGP configuration guide. All output is illustrative, written for this lesson.

Check what you built

Predict · scenario 1

R2 shows the path learned from R1 without a valid marker and the next hop 192.0.2.1. What is missing?

Predict · scenario 2

Both routers have an eBGP and an iBGP path to 203.0.113.0/24 with identical attributes. Which wins on each router?

Predict · scenario 3

The iBGP session is down but both eBGP sessions are up. Does company traffic stop?

FAQ

Why do both ISPs advertise the same prefix?
In this lab 203.0.113.0/24 stands for a remote destination that both providers can reach. Giving the company two paths to one prefix is what makes the path-selection lessons possible. Real providers would each carry it with a different AS path.
Why does R1 prefer ISP A and R2 prefer ISP B by default?
With equal weight, local preference, AS path length, origin and MED, BGP prefers an eBGP path over an iBGP path. Each router has one eBGP path to the prefix, so each chooses its own ISP.
Is next-hop-self needed on both routers?
Yes, if each router should let the other use its provider. Without it, R2 would receive R1's ISP A path with next hop 192.0.2.1, an address R2 cannot reach, and the path would be unusable.