BGP lab help
Thanks in advance for the assistance...
I know I'm missing something simple but I've been at it for a while and it's time to get a fresh set of eyes.
Working on the JNCIS-SP lab but can't get past the BGP config. I had it partially working, walked away, then came back and started over.
The topology is as follows. All devices are SRX100 or 210.
The only difference between the drawing and the configs is the subnet between R6 and R5. It was 172.19.200.0/30 I corrected the drawing but haven't corrected the configs.
In short I can't ping from AS65510 to 65511. I've isolated the problem to R1 and R5. Following are the traceroute results from R3 and R6.
root@SRX210-3> traceroute 84.25.2.1
traceroute to 84.25.2.1 (84.25.2.1), 30 hops max, 40 byte packets
1 172.18.100.1 (172.18.100.1) 9.473 ms 9.042 ms 7.943 ms
2 172.20.100.1 (172.20.100.1) 9.411 ms 2.795 ms 3.248 ms (R1 - R2)
3 172.30.100.1 (172.30.100.1) 8.575 ms 8.355 ms 14.689 ms (R2 - R4
4 172.40.100.2 (172.40.100.2) 8.853 ms 13.835 ms 8.512 ms (R4-R5)
5 * * *
6 * * *
root@SRX210-6> traceroute 84.25.1.1
traceroute to 84.25.1.1 (84.25.1.1), 30 hops max, 40 byte packets
1 172.19.200.1 (172.19.200.1) 6.434 ms 9.756 ms 9.810 ms
2 172.40.100.1 (172.40.100.1) 16.441 ms 15.607 ms 9.515 ms
3 172.30.100.2 (172.30.100.2) 9.815 ms 15.428 ms 9.508 ms
4 172.20.100.2 (172.20.100.2) 9.940 ms 9.498 ms 9.650 ms
5 * * *
6 * * *
The show route from R5 shows the route to 65511 but traffic dies at fe-0/0/2
root@SRX100-5> show route
inet.0: 18 destinations, 20 routes (18 active, 0 holddown, 0 hidden)
+ = Active Route, - = Last Active, * = Both
10.1.1.1/32 *[OSPF/10] 08:29:24, metric 3
> to 172.40.100.1 via fe-0/0/2.0
10.1.1.2/32 *[OSPF/10] 08:29:24, metric 2
> to 172.40.100.1 via fe-0/0/2.0
10.1.1.3/32 *[BGP/170] 07:54:13, localpref 100, from 10.1.1.1
AS path: 65510 I
> to 172.40.100.1 via fe-0/0/2.0
10.1.1.4/32 *[OSPF/10] 08:29:24, metric 1
> to 172.40.100.1 via fe-0/0/2.0
10.1.1.5/32 *[Direct/0] 08:30:50
> via lo0.0
10.1.1.6/32 *[BGP/170] 02:48:49, localpref 100
AS path: 65511 I
> to 172.19.200.2 via fe-0/0/3.0
84.25.1.0/24 *[BGP/170] 07:54:13, localpref 100, from 10.1.1.1
AS path: 65510 I
> to 172.40.100.1 via fe-0/0/2.0
84.25.2.0/24 *[BGP/170] 02:48:49, localpref 100
AS path: 65511 I
> to 172.19.200.2 via fe-0/0/3.0
172.18.100.0/30 *[OSPF/10] 07:38:57, metric 4
> to 172.40.100.1 via fe-0/0/2.0
172.19.200.0/30 *[Direct/0] 08:29:48
> via fe-0/0/3.0
[BGP/170] 02:48:49, localpref 100
AS path: 65511 I
> to 172.19.200.2 via fe-0/0/3.0
172.19.200.1/32 *[Local/0] 08:30:17
Local via fe-0/0/3.0
172.20.100.0/30 *[OSPF/10] 08:29:24, metric 3
> to 172.40.100.1 via fe-0/0/2.0
172.30.100.0/30 *[OSPF/10] 08:29:24, metric 2
> to 172.40.100.1 via fe-0/0/2.0
172.40.100.0/30 *[Direct/0] 08:30:14
> via fe-0/0/2.0
172.40.100.2/32 *[Local/0] 08:30:17
Local via fe-0/0/2.0
192.168.1.0/24 *[Direct/0] 08:30:12
> via fe-0/0/7.0
[BGP/170] 02:48:49, localpref 100
AS path: 65511 I
> to 172.19.200.2 via fe-0/0/3.0
192.168.1.105/32 *[Local/0] 08:30:17
Local via fe-0/0/7.0
224.0.0.5/32 *[OSPF/10] 08:30:55, metric 1
MultiRecv
I've tried static routes on R5 pointing to 84.25.2.0 without success.
Following is the config on R5. The R1 config is similar.
root@SRX100-5> show configuration | display set
set version 11.4R7.5
set system host-name SRX100-5
set system root-authentication encrypted-password
set system services ssh
set interfaces fe-0/0/2 unit 0 family inet address 172.40.100.2/30
set interfaces fe-0/0/3 unit 0 family inet address 172.19.200.1/30
set interfaces fe-0/0/7 unit 0 family inet address 192.168.1.105/24 (management network)
set interfaces lo0 unit 0 family inet address 10.1.1.5/32
set routing-options router-id 10.1.1.5
set routing-options autonomous-system 65512
set protocols bgp group internal-peers type internal
set protocols bgp group internal-peers local-address 10.1.1.5
set protocols bgp group internal-peers export nhs
set protocols bgp group internal-peers neighbor 10.1.1.1
set protocols bgp group internal-peers neighbor 10.1.1.2
set protocols bgp group internal-peers neighbor 10.1.1.4
set protocols bgp group external-peers type external
set protocols bgp group external-peers local-address 172.19.200.1
set protocols bgp group external-peers peer-as 65511
set protocols bgp group external-peers neighbor 172.19.200.2
set protocols ospf area 0.0.0.0 interface lo0.0 passive
set protocols ospf area 0.0.0.0 interface fe-0/0/2.0
set protocols ospf area 0.0.0.0 interface fe-0/0/3.0
set policy-options policy-statement nhs term 1 from protocol bgp
set policy-options policy-statement nhs term 1 then next-hop self
set security forwarding-options family mpls mode packet-based
Config from R6
root@SRX210-6> show configuration | display set
set version 11.4R5.5
set system host-name SRX210-6
set system root-authentication encrypted-password
set system services ssh
set interfaces fe-0/0/2 unit 0 family inet address 172.19.200.2/30
set interfaces fe-0/0/3 unit 0 family inet address 84.25.2.1/24
set interfaces fe-0/0/7 unit 0 family inet address 192.168.1.106/24
set interfaces lo0 unit 0 family inet address 10.1.1.6/32
set routing-options router-id 10.1.1.6
set routing-options autonomous-system 65511
set protocols bgp group external-peers type external
set protocols bgp group external-peers local-address 172.19.200.2
set protocols bgp group external-peers export adv-direct
set protocols bgp group external-peers peer-as 65512
set protocols bgp group external-peers neighbor 172.19.200.1
set policy-options policy-statement adv-direct term 1 from protocol direct
set policy-options policy-statement adv-direct term 1 then accept
set security forwarding-options family mpls mode packet-based
I don't like exporting directly connected routes. I'd rather have aggregate routes but couldn't get it to work. Best practice? Suggestions?
Again-- Thanks!
I know I'm missing something simple but I've been at it for a while and it's time to get a fresh set of eyes.
Working on the JNCIS-SP lab but can't get past the BGP config. I had it partially working, walked away, then came back and started over.
The topology is as follows. All devices are SRX100 or 210.
The only difference between the drawing and the configs is the subnet between R6 and R5. It was 172.19.200.0/30 I corrected the drawing but haven't corrected the configs.
In short I can't ping from AS65510 to 65511. I've isolated the problem to R1 and R5. Following are the traceroute results from R3 and R6.
root@SRX210-3> traceroute 84.25.2.1
traceroute to 84.25.2.1 (84.25.2.1), 30 hops max, 40 byte packets
1 172.18.100.1 (172.18.100.1) 9.473 ms 9.042 ms 7.943 ms
2 172.20.100.1 (172.20.100.1) 9.411 ms 2.795 ms 3.248 ms (R1 - R2)
3 172.30.100.1 (172.30.100.1) 8.575 ms 8.355 ms 14.689 ms (R2 - R4
4 172.40.100.2 (172.40.100.2) 8.853 ms 13.835 ms 8.512 ms (R4-R5)
5 * * *
6 * * *
root@SRX210-6> traceroute 84.25.1.1
traceroute to 84.25.1.1 (84.25.1.1), 30 hops max, 40 byte packets
1 172.19.200.1 (172.19.200.1) 6.434 ms 9.756 ms 9.810 ms
2 172.40.100.1 (172.40.100.1) 16.441 ms 15.607 ms 9.515 ms
3 172.30.100.2 (172.30.100.2) 9.815 ms 15.428 ms 9.508 ms
4 172.20.100.2 (172.20.100.2) 9.940 ms 9.498 ms 9.650 ms
5 * * *
6 * * *
The show route from R5 shows the route to 65511 but traffic dies at fe-0/0/2
root@SRX100-5> show route
inet.0: 18 destinations, 20 routes (18 active, 0 holddown, 0 hidden)
+ = Active Route, - = Last Active, * = Both
10.1.1.1/32 *[OSPF/10] 08:29:24, metric 3
> to 172.40.100.1 via fe-0/0/2.0
10.1.1.2/32 *[OSPF/10] 08:29:24, metric 2
> to 172.40.100.1 via fe-0/0/2.0
10.1.1.3/32 *[BGP/170] 07:54:13, localpref 100, from 10.1.1.1
AS path: 65510 I
> to 172.40.100.1 via fe-0/0/2.0
10.1.1.4/32 *[OSPF/10] 08:29:24, metric 1
> to 172.40.100.1 via fe-0/0/2.0
10.1.1.5/32 *[Direct/0] 08:30:50
> via lo0.0
10.1.1.6/32 *[BGP/170] 02:48:49, localpref 100
AS path: 65511 I
> to 172.19.200.2 via fe-0/0/3.0
84.25.1.0/24 *[BGP/170] 07:54:13, localpref 100, from 10.1.1.1
AS path: 65510 I
> to 172.40.100.1 via fe-0/0/2.0
84.25.2.0/24 *[BGP/170] 02:48:49, localpref 100
AS path: 65511 I
> to 172.19.200.2 via fe-0/0/3.0
172.18.100.0/30 *[OSPF/10] 07:38:57, metric 4
> to 172.40.100.1 via fe-0/0/2.0
172.19.200.0/30 *[Direct/0] 08:29:48
> via fe-0/0/3.0
[BGP/170] 02:48:49, localpref 100
AS path: 65511 I
> to 172.19.200.2 via fe-0/0/3.0
172.19.200.1/32 *[Local/0] 08:30:17
Local via fe-0/0/3.0
172.20.100.0/30 *[OSPF/10] 08:29:24, metric 3
> to 172.40.100.1 via fe-0/0/2.0
172.30.100.0/30 *[OSPF/10] 08:29:24, metric 2
> to 172.40.100.1 via fe-0/0/2.0
172.40.100.0/30 *[Direct/0] 08:30:14
> via fe-0/0/2.0
172.40.100.2/32 *[Local/0] 08:30:17
Local via fe-0/0/2.0
192.168.1.0/24 *[Direct/0] 08:30:12
> via fe-0/0/7.0
[BGP/170] 02:48:49, localpref 100
AS path: 65511 I
> to 172.19.200.2 via fe-0/0/3.0
192.168.1.105/32 *[Local/0] 08:30:17
Local via fe-0/0/7.0
224.0.0.5/32 *[OSPF/10] 08:30:55, metric 1
MultiRecv
I've tried static routes on R5 pointing to 84.25.2.0 without success.
Following is the config on R5. The R1 config is similar.
root@SRX100-5> show configuration | display set
set version 11.4R7.5
set system host-name SRX100-5
set system root-authentication encrypted-password
set system services ssh
set interfaces fe-0/0/2 unit 0 family inet address 172.40.100.2/30
set interfaces fe-0/0/3 unit 0 family inet address 172.19.200.1/30
set interfaces fe-0/0/7 unit 0 family inet address 192.168.1.105/24 (management network)
set interfaces lo0 unit 0 family inet address 10.1.1.5/32
set routing-options router-id 10.1.1.5
set routing-options autonomous-system 65512
set protocols bgp group internal-peers type internal
set protocols bgp group internal-peers local-address 10.1.1.5
set protocols bgp group internal-peers export nhs
set protocols bgp group internal-peers neighbor 10.1.1.1
set protocols bgp group internal-peers neighbor 10.1.1.2
set protocols bgp group internal-peers neighbor 10.1.1.4
set protocols bgp group external-peers type external
set protocols bgp group external-peers local-address 172.19.200.1
set protocols bgp group external-peers peer-as 65511
set protocols bgp group external-peers neighbor 172.19.200.2
set protocols ospf area 0.0.0.0 interface lo0.0 passive
set protocols ospf area 0.0.0.0 interface fe-0/0/2.0
set protocols ospf area 0.0.0.0 interface fe-0/0/3.0
set policy-options policy-statement nhs term 1 from protocol bgp
set policy-options policy-statement nhs term 1 then next-hop self
set security forwarding-options family mpls mode packet-based
Config from R6
root@SRX210-6> show configuration | display set
set version 11.4R5.5
set system host-name SRX210-6
set system root-authentication encrypted-password
set system services ssh
set interfaces fe-0/0/2 unit 0 family inet address 172.19.200.2/30
set interfaces fe-0/0/3 unit 0 family inet address 84.25.2.1/24
set interfaces fe-0/0/7 unit 0 family inet address 192.168.1.106/24
set interfaces lo0 unit 0 family inet address 10.1.1.6/32
set routing-options router-id 10.1.1.6
set routing-options autonomous-system 65511
set protocols bgp group external-peers type external
set protocols bgp group external-peers local-address 172.19.200.2
set protocols bgp group external-peers export adv-direct
set protocols bgp group external-peers peer-as 65512
set protocols bgp group external-peers neighbor 172.19.200.1
set policy-options policy-statement adv-direct term 1 from protocol direct
set policy-options policy-statement adv-direct term 1 then accept
set security forwarding-options family mpls mode packet-based
I don't like exporting directly connected routes. I'd rather have aggregate routes but couldn't get it to work. Best practice? Suggestions?
Again-- Thanks!
Comments
-
fredrikjj
Member Posts: 879
I'd say that the most likely reason is that the links between the ASes aren't known to the other AS. When R3 pings R6 it will source the packet from R3's ethernet address, not the 82.x.x.x network. If R6 doesn't have a route to that source, it will fail. Try sourcing the ping from the networks that are known in BGP (82.) -
keyser
Member Posts: 11 ■□□□□□□□□□
That was it. Thanks fredrikjj--
root@SRX210-6> ping source 84.25.2.1 84.25.1.1
PING 84.25.1.1 (84.25.1.1): 56 data bytes
64 bytes from 84.25.1.1: icmp_seq=0 ttl=60 time=3.820 ms
64 bytes from 84.25.1.1: icmp_seq=1 ttl=60 time=2.279 ms
64 bytes from 84.25.1.1: icmp_seq=2 ttl=60 time=2.307 ms
64 bytes from 84.25.1.1: icmp_seq=3 ttl=60 time=2.385 ms
64 bytes from 84.25.1.1: icmp_seq=4 ttl=60 time=2.867 ms
^C
--- 84.25.1.1 ping statistics ---
5 packets transmitted, 5 packets received, 0% packet loss
round-trip min/avg/max/stddev = 2.279/2.732/3.820/0.585 ms