## Introduction

The purpose of this lab is to multihome our autonomous system on to the two transit providers in our lab.

## Lab Topology

The lab topology has been modified to include a second link from the border router to the other transit router. Note carefully the interfaces used.

The diagram is rather busy now, with all the links of all the scenarios explored in this lab series. However, it does show, in a condensed form, many of the connectivity challenges facing network operators today, and on completion of this and the next lab, will show you how to approach designing policies to handle these scenarios.

## Configuring the link to the Transit Provider

The lab instructors will have already configured the transit routers ready for each group’s second link. Please remember to discuss any problems with setting up BGP with the two Transit Operators. Don’t just assume that if eBGP doesn’t come up that the lab instructors will fix the problem for you in the background.

### Physical Link

Follow the guidelines in the IP Address Plan document to configure the link to the second upstream. Make sure that you can ping the upstream’s router using both IPv4 and IPv6 - if it doesn’t work, investigate why not.

Here is an typical configuration sample - note that we are following the same good practices as we did when we set up the other router interfaces on our network:

    interface GigabitEthernet 0/3
     description Link to Transit Provider N
     ip address <ipv4-ptp> 255.255.255.254
     no ip redirects
     no ip proxy-arp
     ipv6 address <ipv6-ptp>/127
     ipv6 nd prefix default no-advertise
     ipv6 nd ra suppress all
     no shutdown
    !

### IS-IS

Do not configure IS-IS towards the upstream provider! They are not part of your autonomous system.

## Configuring External BGP

We now configure eBGP with the second upstream. Again, the configuration on the two transit routers will have already been completed by the instructors, so once configured, the eBGP session should just come up and work.

Don’t forget to filter what you hear from the upstream, and what you send to them. As before, you should only accept a default route from them (they may send you more), and you should only send prefixes you originated!

We already should have the outbound community filters on the Border router from the earlier eBGP exercise. Check that they are still there.

And we still should have the inbound filter and route-maps accepting all transit provider routes.

Then we can set up the eBGP configuration towards the second transit provider. Here is a configuration sample, first for IPv4:

    router bgp X0
    !
     address-family ipv4
      neighbor <ipv4-ptp> remote-as <N-ASN>
      neighbor <ipv4-ptp> description eBGP with TRANSIT N
      neighbor <ipv4-ptp> password BGPlab
      neighbor <ipv4-ptp> route-map Transit-out out
      neighbor <ipv4-ptp> route-maps Transitv4-in in
      neighbor <ipv4-ptp> activate
    !

and then for IPv6:

    router bgp X0
    !
     address-family ipv6
      neighbor <ipv6-ptp> remote-as <N-ASN>
      neighbor <ipv6-ptp> description eBGP with TRANSIT N
      neighbor <ipv6-ptp> password BGPlab
      neighbor <ipv6-ptp> route-map Transit-out out
      neighbor <ipv6-ptp> route-map Transitv6-in in
      neighbor <ipv6-ptp> activate
    !

Once this has been configured, you should see a default route coming from the second upstream provider, and you should be able to see your aggregate being sent to them too.

If you see nothing from the upstream provider, check your filters first before asking the lab instructors. Check also with your lab instructors to make sure that they are seeing your IPv4 and IPv6 aggregates. Don’t just assume they will somehow look on your behalf.

The commands to see what you are receiving from the two Transit Providers are:

    show ip bgp neighbor <ipv4-ptp> routes
    show bgp ipv6 unicast neighbor <ipv6-ptp> routes

and to show what you are sending to the two Transit Providers:

    show ip bgp neighbor <ipv4-ptp> advertised-routes
    show bgp ipv6 unicast neighbor <ipv6-ptp> advertised-routes

Note that there are IPv4 versions of the IPv6 commands too, although they are a bit more to type than the versions given above:

    show bgp ipv4 unicast neighbor <ipv4-ptp> routes
    show bgp ipv4 unicast neighbor <ipv4-ptp> advertised-routes

### Confirmation

Check on the Core, Access and Peering Routers what you now see in the BGP table. Are there differences from earlier now that you have two transit providers? Can you explain what is happening, and why?

## Connectivity Testing

Run some traceroutes to other groups, and out to the Internet. Which way does your outbound traffic go? Does it go via Transit Provider 1 or Transit Provider 2 or the IXPs? Are you able to explain, by referring to the BGP Path Selection Process, why you see the chosen path for the destination you selected?

Check for both IPv4 and for IPv6 routes.

Here is an example from Group 4’s Border Router, taken from an earlier version of this workshop:

    B4>sh ip bgp
    BGP table version is 31, local router ID is 100.68.4.1
    Status codes: s suppressed, d damped, h history, * valid, > best, i - internal,
                  r RIB-failure, S Stale, m multipath, b backup-path, f RT-Filter,
                  x best-external, a additional-path, c RIB-compressed,
                  t secondary path,
    Origin codes: i - IGP, e - EGP, ? - incomplete
    RPKI validation codes: V valid, I invalid, N Not found

         Network          Next Hop            Metric LocPrf Weight Path
     *    0.0.0.0          100.122.1.6                            0 122 i
     *>                    100.121.1.6                            0 121 i
     *>i  100.68.1.0/24    100.68.4.3              20    170      0 10 i
     *                     100.122.1.6                    50      0 122 10 i
     *                     100.121.1.6                    50      0 121 10 i
     *    100.68.2.0/24    100.121.1.6                    50      0 121 20 i
     *                     100.122.1.6                    50      0 122 20 i
     *>i                   100.68.4.3               0    170      0 20 i
     *    100.68.3.0/24    100.121.1.6                    50      0 121 30 i
     *                     100.122.1.6                    50      0 122 30 i
     *>i                   100.68.4.3               0    200      0 30 i
     *>i  100.68.4.0/24    100.68.4.2               0    100      0 i
     *>i  100.68.4.28/30   100.68.4.2               0    100      0 i
     *>i  100.68.4.64/26   100.68.4.4               0    100      0 i
     *>i  100.68.5.0/24    100.68.4.3              20    170      0 50 i
     *                     100.122.1.6                    50      0 122 50 i
     *                     100.121.1.6                    50      0 121 50 i
     *>i  100.68.6.0/24    100.68.4.3               0    170      0 60 i
     *                     100.122.1.6                    50      0 122 60 i
     *                     100.121.1.6                    50      0 121 60 i
     *    100.68.7.0/24    100.121.1.6                    50      0 121 70 i
     *                     100.122.1.6                    50      0 122 70 i
     *>i                   100.68.4.3              20    170      0 70 i
     *    100.68.8.0/24    100.121.1.6                    50      0 121 80 i
     *                     100.122.1.6                    50      0 122 80 i
     *>i                   100.68.4.3               0    170      0 80 i
    ...etc...

Confirm that you see something similar - your primary path to all other groups will still be over the IXP. But your Border Router is now learning paths from the other Transit provider too.
And if we run a `traceroute` to Google’s public resolver from Group 4’s server:

    sysadm@srv4:~$ traceroute 8.8.8.8
    traceroute to 8.8.8.8 (8.8.8.8), 30 hops max, 60 byte packets
     1  gi0-4.c4.ws.nsrc.org (100.68.4.29)  1.082 ms  2.309 ms  3.334 ms
     2  gi0-1.b4.ws.nsrc.org (100.68.4.17)  1.332 ms  1.793 ms  2.051 ms
     3  gi0-4.tr1.ws.nsrc.org (100.121.1.6)  2.831 ms  4.558 ms  4.921 ms
     4  vtp.ws.nsrc.org (100.64.0.1)  2.285 ms  2.298 ms  2.542 ms
    <snip>
    10  72.14.197.162 (72.14.197.162)  29.863 ms  29.834 ms  29.810 ms
    11  * * *
    12  dns.google (8.8.8.8)  24.537 ms  21.769 ms  21.758 ms

Why did the traceroute exit via TR1 and not TR2?

## Appendix - Transit Router Configuration

This appendix shows the completed configuration used for the TR1 router in this lab supporting the connections to all 8 groups. The TR2 router has a very similar configuration.

    interface GigabitEthernet0/0
     description Link to TR2 (and to the world)
     ip address 100.121.0.0 255.255.255.254 secondary
     ip address 100.64.0.2 255.255.252.0
     ipv6 address 2001:18::/127
     ipv6 address 2001:DB8::2/64
     ipv6 nd prefix default no-advertise
     ipv6 nd ra suppress all
    !
    interface GigabitEthernet0/1
     description Link to AS10
     ip address 100.121.1.0 255.255.255.254
     ipv6 address 2001:18:0:10::/127
    !
    interface GigabitEthernet0/2
     description Link to AS20
     ip address 100.121.1.2 255.255.255.254
     ipv6 address 2001:18:0:11::/127
    !
    interface GigabitEthernet0/3
     description Link to AS30
     ip address 100.121.1.4 255.255.255.254
     ipv6 address 2001:18:0:12::/127
    !
    interface GigabitEthernet0/4
     description Link to AS40
     ip address 100.121.1.6 255.255.255.254
     ipv6 address 2001:18:0:13::/127
    !
    interface GigabitEthernet0/5
     description Link to AS50
     ip address 100.121.1.8 255.255.255.254
     ipv6 address 2001:18:0:14::/127
    !
    interface GigabitEthernet0/6
     description Link to AS60
     ip address 100.121.1.10 255.255.255.254
     ipv6 address 2001:18:0:15::/127
    !
    interface GigabitEthernet0/7
     description Link to AS70
     ip address 100.121.1.12 255.255.255.254
     ipv6 address 2001:18:0:16::/127
    !
    interface GigabitEthernet0/8
     description Link to AS80
     ip address 100.121.1.14 255.255.255.254
     ipv6 address 2001:18:0:17::/127
    !
    interface GigabitEthernet0/9
     description Link to SR1
     ip address 100.121.1.16 255.255.255.254
     ipv6 address 2001:18:0:18::/127
    !
    router bgp 121
     bgp log-neighbor-changes
     bgp deterministic-med
     no bgp default ipv4-unicast
     neighbor 2001:18::1 remote-as 122
     neighbor 2001:18::1 description eBGP with TR2
     neighbor 2001:18::1 ttl-security hops 1
     neighbor 2001:18::1 password BGPlab
     neighbor 2001:18:0:10::1 remote-as 10
     neighbor 2001:18:0:10::1 password BGPlab
     neighbor 2001:18:0:11::1 remote-as 20
     neighbor 2001:18:0:11::1 password BGPlab
     neighbor 2001:18:0:12::1 remote-as 30
     neighbor 2001:18:0:12::1 password BGPlab
     neighbor 2001:18:0:13::1 remote-as 40
     neighbor 2001:18:0:13::1 password BGPlab
     neighbor 2001:18:0:14::1 remote-as 50
     neighbor 2001:18:0:14::1 password BGPlab
     neighbor 2001:18:0:15::1 remote-as 60
     neighbor 2001:18:0:15::1 password BGPlab
     neighbor 2001:18:0:16::1 remote-as 70
     neighbor 2001:18:0:16::1 password BGPlab
     neighbor 2001:18:0:17::1 remote-as 80
     neighbor 2001:18:0:17::1 password BGPlab
     neighbor 2001:18:0:18::1 remote-as 131
     neighbor 2001:18:0:18::1 description eBGP with SR1
     neighbor 2001:18:0:18::1 ttl-security hops 1
     neighbor 2001:18:0:18::1 password BGPlab
     neighbor 100.121.0.1 remote-as 122
     neighbor 100.121.0.1 description eBGP with TR2
     neighbor 100.121.0.1 ttl-security hops 1
     neighbor 100.121.0.1 password BGPlab
     neighbor 100.121.1.1 remote-as 10
     neighbor 100.121.1.1 password BGPlab
     neighbor 100.121.1.3 remote-as 20
     neighbor 100.121.1.3 password BGPlab
     neighbor 100.121.1.5 remote-as 30
     neighbor 100.121.1.6 password BGPlab
     neighbor 100.121.1.7 remote-as 40
     neighbor 100.121.1.7 password BGPlab
     neighbor 100.121.1.9 remote-as 50
     neighbor 100.121.1.9 password BGPlab
     neighbor 100.121.1.11 remote-as 60
     neighbor 100.121.1.11 password BGPlab
     neighbor 100.121.1.13 remote-as 70
     neighbor 100.121.1.13 password BGPlab
     neighbor 100.121.1.15 remote-as 80
     neighbor 100.121.1.15 password BGPlab
     neighbor 100.121.1.17 remote-as 131
     neighbor 100.121.1.17 description eBGP with SR1
     neighbor 100.121.1.17 ttl-security hops 1
     neighbor 100.121.1.17 password BGPlab
     !
     address-family ipv4
      network 100.121.0.0 mask 255.255.0.0
      neighbor 100.121.0.1 activate
      neighbor 100.121.1.1 activate
      neighbor 100.121.1.1 default-originate
      neighbor 100.121.1.3 activate
      neighbor 100.121.1.3 default-originate
      neighbor 100.121.1.5 activate
      neighbor 100.121.1.5 default-originate
      neighbor 100.121.1.7 activate
      neighbor 100.121.1.7 default-originate
      neighbor 100.121.1.9 activate
      neighbor 100.121.1.9 default-originate
      neighbor 100.121.1.11 activate
      neighbor 100.121.1.11 default-originate
      neighbor 100.121.1.13 activate
      neighbor 100.121.1.13 default-originate
      neighbor 100.121.1.15 activate
      neighbor 100.121.1.15 default-originate
      neighbor 100.121.1.17 activate
      neighbor 100.121.1.17 default-originate
      distance bgp 200 200 200
     exit-address-family
     !
     address-family ipv6
      network 2001:18::/32
      neighbor 2001:18::1 activate
      neighbor 2001:18:0:10::1 activate
      neighbor 2001:18:0:10::1 default-originate
      neighbor 2001:18:0:11::1 activate
      neighbor 2001:18:0:11::1 default-originate
      neighbor 2001:18:0:12::1 activate
      neighbor 2001:18:0:12::1 default-originate
      neighbor 2001:18:0:13::1 activate
      neighbor 2001:18:0:13::1 default-originate
      neighbor 2001:18:0:14::1 activate
      neighbor 2001:18:0:14::1 default-originate
      neighbor 2001:18:0:15::1 activate
      neighbor 2001:18:0:15::1 default-originate
      neighbor 2001:18:0:16::1 activate
      neighbor 2001:18:0:16::1 default-originate
      neighbor 2001:18:0:17::1 activate
      neighbor 2001:18:0:17::1 default-originate
      neighbor 2001:18:0:18::1 activate
      neighbor 2001:18:0:18::1 default-originate
      distance bgp 200 200 200
     exit-address-family
    !
    ip route 0.0.0.0 0.0.0.0 100.64.0.1
    ip route 100.121.0.0 255.255.0.0 Null0
    !
    ipv6 route 2001:18::/32 Null0
    ipv6 route ::/0 2001:DB8::254
    !