Introduction to The Border Gateway Protocol Case Study using GNS3

Transcription

1 Introduction to The Border Gateway Protocol Case Study using GNS3 Sreenivasan Narasimhan 1, Haniph Latchman 2 Department of Electrical and Computer Engineering University of Florida, Gainesville, USA n.sreeni86@ufl.edu 1, latchman@ufl.edu 2 Abstract As the internet evolves to become a vital resource for many organizations, configuring The Border Gateway protocol (BGP) as an exterior gateway protocol in order to connect to the Internet Service Providers (ISP) is crucial. The BGP system exchanges network reachability information with other BGP peers from which Autonomous System-level policy decisions can be made. Hence, BGP can also be described as Inter-Domain Routing (Inter-Autonomous System) Protocol. It guarantees loop-free exchange of information between BGP peers. Enterprises need to connect to two or more ISPs in order to provide redundancy as well as to improve efficiency. This is called Multihoming and is an important feature provided by BGP. In this way, organizations do not have to be constrained by the routing policy decisions of a particular ISP. BGP, unlike many of the other routing protocols is not used to learn about routes but to provide greater flow control between competitive Autonomous Systems. In this paper, we present a study on BGP, use a network simulator to configure BGP and implement its route-manipulation techniques. Index Terms Border Gateway Protocol (BGP), Internet Service Provider (ISP), Autonomous System, Multihoming, GNS3. 1. INTRODUCTION Routing protocols are broadly classified into two types Link State routing (LSR) protocol and Distance Vector (DV) routing protocol.. In Distance vector routing protocol, each node shares its routing table with the neighbors periodically in contrast to Link State where updates are event-triggered. Examples of Link State would be Open Shortest Path First (OSPF) and Intermediate System-to-Intermediate System (ISIS) while Routing Information Protocol (RIP v1 and 2) are examples of Distance Vector. BGP is called a Policy Based routing protocol because the route-selection is done based on routing policies of an Autonomous System(AS). When BGP is running between routers belonging to different Autonomous Systems, it is called EBGP while BGP running between routers belonging to the same Autonomous system is called IBGP. Administrative Distance (AD value) is the first criterion that a router uses to determine which routing protocol to use if two protocols provide route information for the same destination [5]. BGP has an AD (Administrative Distance) value of 200 for IBGP (Inter-domain routes learnt by BGP) routes and 20 for EBGP (Exterior routes learnt by BGP) routes. BGP allows path- manipulations to be done by the AS. However, It is expected that the System Administrator has a clear understanding of its working. Figure 1. Internet using BGP [2]. In the figure, AS learns about the route /16 through ISP A. Suppose that route is announced to ISP B. ISP B may decide that the best path to /16 in ISP A is through AS Thus AS becomes a transit AS between /16 in ISP A and ISP B. This may not be acceptable for AS which is connected to both ISP A and ISP B in order to provide redundant connection to the Internet rather than to be a transit AS. BGP s policy based routing helps mitigate such problems. Version 4 of BGP has been deployed in the Internet since BGPv4 supports Classless Inter-Domain Routing (CIDR) and Variable Length Subnet Masking (VLSM). CIDR incorporates VLSM techniques and aggregation wherever necessary so that the number of routes in the global routing table does not increase exponentially. With the growing use of the Internet, the routing table of a core router of a major ISP, without CIDR, would typically contain more than entries. However, by using CIDR the BGP routes in the routing table would be reduced to just about routes, thereby reducing the memory and CPU power wasted on lookup.

2 2. BGP AND OTHER IGP PROTOCOLS Firstly, IGPs are routing protocols which are used to route packets within an autonomous system. On the other hand, BGP is an example of Exterior Gateway Protocol which is used to route packets between autonomous systems. IGPs decide the best path based on a certain predefined metric. For e.g. RIP uses hop count (number of layer 3 devices to be passed). EIGRP uses composite metric. BGP is a policy based routing protocol used for traffic flow control between autonomous systems. Unlike IGPs, it has multiple metrics - which are called as attributes using which it decides the route to the destination. BGP is a complicated routing protocol which should not be used unless one has a complete understanding of route filtering and BGP s path Selection process. It is not advisable to configure BGP on routers having low memory or when there is low bandwidth link between autonomous systems. An alternative is to use static (routes entered manually by the network administrator) or default routes. BGP provides multi-homing options, that is, BGP can be configured when the flow of traffic entering and leaving the AS has to be manipulated. Multi-roam is another scenario in which BGP is used. 3. GRAPHIC NETWORK SIMULATOR 3 AND THE CISCO IOS For implementing BGP,we use a software called as GNS3 which is a graphical network simulator that allows simulation of complex networks. It is an open source, free program [6]. Cisco IOS (originally Internetwork Operating System) is the software used on the vast majority of CISCO routers and switches. CISCO IOS uses a command line interface. According to the privilege level of the user, CISCO IOS allows only a set of commands to be used in each mode to ensure security and efficient operation. That is, the mode you are in determines the command you can use. Upon first connecting to the router, you are by default in unprivileged mode (characterized by > sign). You could then log on to enter the privileged mode (characterized by # sign) if a password has been set. The privileged mode is parent to many sub modes like Global configuration mode (characterized by #(config) sign) etc which is used to configure all features [4]. It is assumed that the reader has a basic understanding of networking concepts like routers, Autonomous Systems, VLSM etc. 4. NEIGHBOR-SHIP IN BGP There are thousands of routers all over the internet that run BGP representing over ASs. Any two routers that have formed a TCP connection to exchange BGP routing information are called BGP neighbors or BGP peers [2]. A BGP router has direct relationship with only a few number of BGP routers. As per rules, EBGP neighbors are to be directly connected. On the other hand, IBGP neighbors can be indirectly connected. The route to a particular neighbor can be learnt dynamically through any routing protocol or can be statically assigned. Information exchanged between BGP neighbors is what enables them to learn routes to any advertised network. Every router which has BGP configured on it is called a BGP speaker. BGP peer on the other hand is a BGP speaker that is configured to form a neighbor relationship with another BGP speaker for the purpose of directly exchanging BGP routing information with each other [2]. They can be internal or external. Two routers connected to each other and having BGP configured on them have to successfully pass the TCP three way handshakes before the neighbor-ship session can be established between them. 5. ATTRIBUTES BGP has a number of metrics each of which is called an attribute. When routers exchange routing information, attributes are also exchanged so that the path-selection process is based on a particular attribute known to both the routers. Attributes are basically of four types: 1. Well-known most popularly used attributes. 2. Mandatory as the name suggests, are mandatory 3. Transitive or Non-Transitive. 4. Partial. Combinations of these path attributes are also possible as in wellknown - mandatory, well- known - discretionary etc. Well-known attributes are usually the most manipulated attributes on all BGP implementations. They are usually propagated through the BGP routing information that is exchanged between BGP routers. They can be mandatory or discretionary. Attributes that are not well-known are termed as optional attributes. Optional attributes are not required to be supported by BGP configured routers. They can be transitive or Non- transitive. Optional- transitive attributes are also called as partial attributes. Upon receiving an optional- transitive attribute, which it does not support, a router still has to pass it to its peers. On the other hand, if it receives a non-transitive attribute, it can be dropped. BGP has the following attributes: a. AS path Autonomous System-Path or AS-path is a list of AS numbers the packet traverses to reach the destination b. Next-hop (if from a network belonging to a different AS)is an IP address of the entry point of the AS along the path to the destination c. Origin is used to inform all AS in the Internet how the prefixes (in BGP routing table, see Fig.2) originated. Legal values are IGP (i) by the use of network command, EGP (e) redistributed from EGP and Incomplete (?) redistributed from IGP or declared as a static route. d. Local preference is local to the AS. Default value is 100. Higher the value, higher is the preference e. MED Multi-Exit Discriminator or MED is used to advertise to EBGP neighbors an exit path to the destination network. Lowest MED is most desirable f. Weight (CISCO proprietary) is not propagated to other routers. Local to the router only. g. Others Items a, b, c are well-known mandatory attributes while d is an example of well-known-discretionary attribute. MED is an optional non-transitive attribute. Weight has the greatest priority among all the attributes listed above. 6. BGP PATH SELECTION PROCESS. BGP supports Multi-homing and Multi-roaming. Hence, the BGP forwarding table has multiple options to choose from to reach a particular network. Unlike IGP, paths are chosen based on policy rather than hop-count or Bandwidth (or any other metric for that matter). The BGP path-selection process is based on the process of elimination until a single best path is found. If it has the lowest AD value among all the routes submitted, it is registered in the routing table.

3 The Route Selection process is validated first by verifying whether it has a valid hop or not with no AS loops. Then paths are considered according to their priorities in the following order: 1. Highest Weight. 2. Highest Local Preference. 3. Originated by local router 4. Shortest AS-path 5. Lowest origin code (IGP < EGP < Incomplete) 6. Lowest MED 7. EBGP path > IBGP path 8. Higher preference to path through closest IGP neighbor (when in no synch mode. see VII) 9. Oldest route for EBGP path 10. Higher preference to lowest neighbor BGP router ID 11. Higher preference to lowest neighbor IP address A BGP routing table showing some of the metrics is as shown in Figure 2. Figure 3. Network as configured on GNS3. As shown in the above figure, We have configured 4 routers namely R1, R2, R3 and R4. Each of the routers is a BGP speaker. R1 is configured in AS 65100, R2 and R3 in AS while R4 is configured in AS Three loopback addresses are configured on each router as shown , , are in R1, , are in R2, , , in R3 and finally , , are configured in R4. Serial link exists between routers R1-R2 and R3-R4. A fast Ethernet link is used between R2-R3. Figure 2. Interpreting BGP routing table. A. BGP Synchronization Rule The BGP synchronization rule is Never use or forward a route learnt from an IBGP neighbor to an EBGP neighbor unless the same is learnt from any IGP protocol. If an autonomous system will be acting as a transit AS to pass traffic from one AS to another, all the routers in the transit AS have to learn routes to reach both the communicating AS through an IGP routing protocol. However, if the routes are advertised to the ASs before the routers in the transit AS have learnt the routes, then the packets would be dropped as they come in to the transit AS. To prevent this from happening BGP has to wait till IGP has propagated the routes to all the routers in the Transit AS. Thus BGP has to be synchronized with IGP. This mode is enabled by default. However, When an AS is not configured to act as a transit AS, Synchronization can be disabled. You can also disable synchronization when all the routers in the AS have been configured with BGP. Figure 4. BGP forwarding table. Synchronization is enabled by default. In Figure. 3, since synchronization is enabled at R2, it does not forward the paths learnt from its IBGP neighbor R3 and hence R1 does not know the routes to loopback addresses in R3 and R4. However, when synchronization is disabled at R2 then the forwarding table looks like

4 Figure 7. Route-Manipulation using Local-preference. B. Using AS-path Figure 5. BGP table with synchronization disabled. With Synchronization disabled, R2 advertises the loopback network configured on R3 and R4 to R1. Synchronization has been disabled by default in Cisco IOS Software Release 12.2(8) and later. When a route passes through an AS system, the AS number is added to an ordered list of AS the route has traversed. Route Manipulation using AS-path is similar to manipulation using local preference. Commands for route-manipulation using as-path are as follows 7. ROUTE-MANIPULATION Consider the network as shown in Figure 3. All of the routers are configured with BGP. Route-manipulation techniques are described as follows. A. Using Local-preference Local-Preference attribute determines the preference of an exit point from the AS. Thus, this attribute is used to select a particular exit point from the AS. Suppose we have incoming as well as outgoing traffic from multiple neighbors and would want that the traffic to the destination be routed through a particular neighbor. Then, such route-manipulations can be done using the following commands in global configuration mode. Figure 8. Commands for route-manipulation using as-path. Here all the traffic incoming from neighbor would have two AS numbers prepended in their path field as shown. Figure 6. Commands for route-manipulation using local-preference Now, all the routes incoming from neighbor /24 have local preference of Local-preference is local to AS, i.e. Routers within the same AS exchange this attribute. Figure. 9 Route-manipulation using as-path. C. Selective Route-manipulation using MED. The Multi-Exit Discriminator (MED) attribute is a suggestion to the external receiving AS about the preferred path into an AS which has multiple entry points. Attributes pertaining to a particular route can also be edited. You can edit weight, local preference, as-path and also MED of the route as shown in the example below.

5 E. Aggregation and route-filtering using route-filtering using prefix list. Border Gateway Protocol (BGP) allows the aggregation of specific routes into one route in such a way that advertisement of that single route is possible. It is used to reduce the number of routes registered in the routing table. [5]. On R3 router,after aggregation, the routing table now conatins 4 routes of 44 network 3 routes having /24 mask and 1aggregated route with /22 mask as follows. Figure 10. Example network for route-manipulation using MED Figure 11. Commands for route-manipulation using MED Here in this example we needed that the traffic from ip address be routed through and not from As you can see by increasing the metric of the route from we have sucessfully made the route through as the best path. Figure. 13 Routing table It is also possible to send only the summarized routes to the neighbor. An alternate way to send summarized routes is through prefix list. Prefix list will filter routes on the basis of prefix mask on R4 router, the commands are as follows. router bgp neighbor prefix-list abc out ip prefix-list abc seq 5 deny /8 ge 23 ip prefix-list abc seq 10 permit /0 le 32 This will filter all the routes of class A network /8 having mask greater than or equal to 23 from being sent to R3 router. Figure.12 route-manipulation using MED D. Route-manipulation using weight Weight is a CISCO proprietary attribute which has greater preference than any other attribute. It is assigned locally to a router and is not propagated to other routers. Route manipulation using weight as an atrribute is similar to that of using MED. Simply substitute the command set metric to set weight (to any number between 0 and 32768). However unlike metric, Higher the weight higher is the preference. F. Route-manipulation using Community list Community list is a tagging mechanism in which the routes in the list are tagged before they are sent. The receiving router matches the tag and performs route manipulation. Here in our e.g. on R4 router we will set a community string 8888 for all routes being sent to R3 router. The commands would be

6 8. CONCLUSION AND FUTURE WORK Figure14. Commands for setting Community list. This will set community string 8888 to all routes being sent to R3 router but as community string is non transitive, tag will not be forwarded to other AS. However, In order to forcefully send it we can use the command neighbor send-community BGP s role in the Internet Routing Infrastructure is paramount. Policy-Based routing techniques enable Enterprises and ISPs to interact efficiently. The BGP protocol is being used by both Service providers and Enterprise networks. The architectural design goals of these two groups are very different which results in deployment of BGP in different environments. The idea is to break out the goals, and provide corresponding solutions for each group so as to assist effective operation. In this paper, we discussed the policy based operation of BGP and analyzed the various parameters involved in its operation to provide such optimized solutions. Once a neighbor relationship has been established, the routers exchange routing information with each other. These routers are vulnerable to the Man in the Middle (MIN) attack as they have no way of authenticating the BGP update they receive from their neighbors. As discussed in section 6., a BGP update contains information about all the Autonomous Systems the packet has traversed to reach a particular AS. However, the attacker can inject fake AS numbers thereby compromising the authenticity of the update. Validation of the source and path of the BGP update message without much change in the existing architecture is critical. 9. REFERENCES Figure 15. Community list table The community String thus created can be used for Route manipulation. For e.g. Figure 16. Commands for Route-manipulation using Community list This will set weight for all routes having string CISCO IOS IP and IP routing configuration guide. 2. Building Scalable CISCO Internetworks, Volume 2, Student Guide Router IOS used include c7200 and c 3600 series y/handbook/bgp.html RFC for BGP Communication Networks by Alberto Leon Garcia, Indra Widjaja. 9. Secure Border Gateway Protocol (S-BGP), Stephen Kent, Charles Lynn, and Karen Seo, IEEE JOURNAL ON SELECTED AREAS IN COMMUNICATIONS, VOL. 18, NO. 4, APRIL Optimal Configuration for BGP Route Selection Thomas C. Bressoud, Rajeev Rastogi and Mark A. Smith. 11. Study on the AS relationship based inter-domain routing, Ruijun Wang; Hongjun Wang; Cuirong Wang; Yuan Gao, Parallel and Distributed Computing, Applications andtechnologies, PDCAT'2003. Proceedings of the Fourth International Conference, 2003, A Case Study in Understanding OSPF and BGP Interactions Using Efficient Experiment Design, D. Bauer M. Yuksel C. Carothers S. Kalyanaraman, Principles of Advanced and Distributed Simulation, PADS th Workshop, June Figure 17. BGP table showing the edited weight.