Monday, July 25, 2011

BGP Rule Of Synchronization


Recently I saw lots of discussions going around on Cisco Learning Network (CLN) about BGP Rule Of Synchronization. I feel the rule sounds quiet confusing to most of beginners. Following are the common confusions that people have:















Rule - " Route learned from One IBGP Peer cannot be advertised to another IBGP peer unless it's verified by the IGP Routing or IGP Routing table has match for same route in routing table."


Now to overcome this rule we have few options.


1. Run IGP.... hehe... Simple enough ? :-)


But problem with doing that is you need to redistributed BGP into IGP. If these are few BGP routes that not a big deal, but if we are talking about redistributing entire Global BGP Internet Routing Table... You gonna mess up with Your IGP, since IGPs are not designed to manage Route Tables this big.


2. Make BGP Peerings Full Mesh.


3. Route BGP updtes beteen EDGE BGP Devices of SP core using Tunnels such as GRE... of-course not a scalable solution though.


4. Run MPLS in the SP core and use concept of BGP free Core.



Common Confusions :

1. The Rule only applies to learned routes by IBGP peer from an EBGP Peer or also to it's locally Originated Routes ?

2. By IGP means do we have to run some sort of IGP like OSPF, EIGRP or RIP. Or it means IGP reach-ability in general which means static routing is valid solution too ?

Lets Bring Up the topology and see things in action.



So lets turn on "Synchronization"  and see how things are going.


BTW... In most of the modern IOS "Synchronization" is off by Default.















Now as discussed above to overcome " Synchronization" issue, we have few options:


1. Run IGP inside the domain.


2. Create Full Mesh Connectivity.


Since in our scenario, we don't have Full mesh connectivity, so lets turn of synchronization and Configure R3 as Route Reflectors(RR) first.


Route Reflectors and Confederations are two possible solutions BTW to overcome "BGP Rule of Split Horizon" which states that " One IBGP Learned Route Can not be advertised to another IBGP peer"


Lets Turn Sync off now and configure R3 as RR.








Ummm... Seems like we have some Next-Hop Issues. Lets fix those out.

What we have are two options:

1. Tell neighbor to use me as next hop ( nei x.x.x.x next-hop-self)
2. Configure a Route-Map, pointing myself as Next Hop IP  and configure it for  neighbor. ( nei x.x.x.x route-map out )

But it is important to Note that first options doesn't work if your local router is a RR :-)

See yourself....









Lets turn on "SYNC" back and this time instead of running an IGP, Lets see if I put static routes pointing to Null0 (IGP Reach-ability not IGP in itself) can help us.








Seems like the rule indeed talks about the IGP reach-ability and didn't specifically want us to run IGP Protocol.

Though all routes looks now valid and life looks all good, but when we try to ping R5's loopback from R1 with Source as loopback, the packets don't make through.

Reason being is that, static routes that we added are pointing to Null0. Which essentially is Black Holing all your packets.

Lets fix it :





Now Life Looks all good :-)


HTH...
Deepak Arora












Saturday, July 16, 2011

Some More Troubleshooting Fun With EIGRP



Recently I got this request from a friend working on CCNP. He was looking for some troubleshooting labs. So I thought to help him out with couple of labs and to other people who are preparing for CCNP TS exam.


So to add some fun I created this small troubleshooting lab last night. Below is the topology :




R1 should be able to reach R4's loopback and vice versa. For verification point of view the command -  R4#ping 1.1.1.1 so lo0 should have 100% success rate. Also R4 should be able to telnet R1 and get login prompt.


Here are the initial configuration files and GNS topology for you guys :


http://hotfile.com/dl/124210052/99638e1/EIGRP_ISSUE.rar.html


Also recently I saw a nice post from CCIE Anthony at blog.ipexpert.com which might help you along the way:


http://blog.ipexpert.com/2011/07/10/troubleshooting-eigrp-adjacencies


Again... Being a good network engineer, Avoid using "sh run" and instead try to find and fix the problem using other "show" commands.


HTH...
Deepak Arora

Tuesday, July 5, 2011

MPLS VPN Troubleshooting - Bob Calling For Help !!!

Finally after a long gap I am back with my tutorials and labs for learning and fun. Few weeks back I posted MPLS VPN Lab topology, So before explaining it step by step I thought to bring it as challenge for people who already know MPLS from R&S lab prospective and are looking for some troubleshooting stuff on it. So I am going to bring today a MPLS VPN TS challenge for them.

So our old friend BOB was sitting free on monday after noon and then he received an email containing the following topology and two fault tickets.




The topology has got two different MPLS VPNs. One is VPN blue and another is VPN red. VPN blue site 1 should be able to reach VPN blue site 2 and vice versa and same case with VPN RED. But both VPNs shouldn't be able to talk to each other.


Below is the link to download initials for lab along with GNS topology and IOS version details to run it. See if you can help BOB with this problem.


BTW.... Avoid removing configurations completely. Also being a excellent engineer, don't use "sh run" to show your skills.


http://hotfile.com/dl/123139611/4ae9ec6/MPLS_VPN_LAB_final_config.rar.html

HTH...
Deepak Arora

Friday, June 17, 2011

MPLS Layer 3 VPN Troubleshooting - My Personal Approach

While I am going for my Second CCIE R&S Lab attempt soon, I thought before leaving I must post my MPLS TS Strategy in general despite of fact I will get in my TS lab or not :

Ofcourse people who wanna know what went wrong with First attempt, here is the summary :  http://ieoc.com/forums/t/15436.aspx

Below are the summary steps:

Step 1

=======

CEF is running on MPLS enabled routers

sh ip cef


Step 2
======

loopback advertised into IGP on CE, Also Check IGP configuration like "no auto summary" and "redistribution seed metric, "autonomous system number in EIGRP VRF Configuration".

sh ip int b | e una

sh run | s r [eor]

Step 3
======

Check if VRF is created and applied to proper interface

sh run | s vrf

sh ip vrf detail

sh run int

Check if CE routes are coming to PE

sh ip route vrf


Step 4
======

Check for VRF route target import and export

sh run | s vrf

Step 5
======

Check if LDP is running all over, mpls ip is configured on MPLS facing interfaces.

sh mpls interface

sh mpls ldp neighbor

Step 6
======

Check for MP-BGP and IGP redistribution,

sh run | s r b

sh run | s r [reo]

Check for redistribute metric, For OSPF look for "match internal external 1 external 2" , For eigrp "redistribution metric" should be mentioned.

Step 7
======

Check for MPBGP Config on all routers, look for things like RR config, neighbor activate, send community extended or both, no synchronization, no auto summary, remote as, update source loopback 0

sh run | s r b

sh ip bgp vpnv4 all summ

sh ip bgp vpnv4 all

Step 8
======

Check for Control plane issues on all routers like:

1. ACL

sh access-list

2. CoPP

sh policy-map control-plane

3. Distribute List, Offset-List

sh run | i distribute offset

4. Route-map

sh route-map

5. Rate Limit

sh run | i rate

6. Next Hop and Route Recursion Issues

7. IGP Timers and Password mistmatch issues

8. PBR

sh run | i policy


HTH...
Deepak Arora