BGP Labs: Part I

PAW3L
9 min readMay 22, 2023

--

BGP basic Lab 1

— For creating neighbors in BGP, the neighbor IP may not be directly connected but must be reachable.
— Example: 20.0.0.2 is a Neighbour of 30.0.0.4 which is not directly connected. But they are reachable via OSPF
— R2, R3 and R4 are running OSPF for reachability

NOTE: Loopbacks are still not reachable.

R5#ping 1.1.1.1

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 1.1.1.1, timeout is 2 seconds:
UUUUU

R1#ping 5.5.5.5

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 5.5.5.5, timeout is 2 seconds:
UUUUU
Success rate is 0 percent (0/5)

BGP Configuration:-

R1#sh run | sec bgp
router bgp 100
no synchronization
bgp log-neighbor-changes
network 1.0.0.0
network 10.0.0.0
neighbor 10.0.0.2 remote-as 200
no auto-summary
R1#

R2#sh run | sec bgp
router bgp 200
no synchronization
bgp log-neighbor-changes
network 10.0.0.0
network 20.0.0.0
neighbor 10.0.0.1 remote-as 100
neighbor 30.0.0.4 remote-as 200
no auto-summary
R2#

R4#sh run | sec bgp
router bgp 200
no synchronization
bgp log-neighbor-changes
network 30.0.0.0
network 40.0.0.0
neighbor 20.0.0.2 remote-as 200
neighbor 40.0.0.5 remote-as 300
no auto-summary
R4#

R5#sh run | sec bgp
router bgp 300
no synchronization
bgp log-neighbor-changes
network 5.0.0.0
network 40.0.0.0
neighbor 40.0.0.4 remote-as 200
no auto-summary
R5#
R5#

===============================================================

BGP basic Lab 2 (BGP Neighborship via loopbacks)

RIP is running to provide connectivity.
We need to inform router to update source address to loopback

RIP configuration in all routers:-

R1(config)#
R1(config)#router rip
R1(config-router)#ver 2
R1(config-router)#no auto
R1(config-router)#network 0.0.0.0
R1(config-router)#exit
R1(config)#exit

R1#sh run | sec bgp
router bgp 100
no synchronization
bgp log-neighbor-changes
neighbor 3.3.3.3 remote-as 100
neighbor 3.3.3.3 update-source Loopback0
no auto-summary
R1#

R3#sh run | sec bgp
router bgp 100
no synchronization
bgp log-neighbor-changes
neighbor 1.1.1.1 remote-as 100
neighbor 1.1.1.1 update-source Loopback0
no auto-summary
R3#

===============================================================

BGP basic Lab 3 (EBGP multi-hop)

-Here we are forming neighborship between two different AS (External BGP)
-By default, TTL value is 1
-TTL value remains same in IBBP but keeps decreasing by 1 in EBGP AS to AS

-Here we are forming neighborship via loopbacks.
-By default TTL value of BGP packet will be 1.
-TTL value will become 0 when it will reach G1/0.
-But packet needs to reach Loo0 which us beyond G1/0.
-So minimum TTL value 2 is required. We will set TTL Value as 2 then it will form neighborship.

Static router between Loopbacks to provide reachability.

R1(config)#ip route 10.0.0.0 255.0.0.0 10.0.0.2
R1(config)#ip route 2.0.0.0 255.0.0.0 10.0.0.2

R2(config)#ip route 10.0.0.0 255.0.0.0 10.0.0.1
R2(config)#ip route 1.0.0.0 255.0.0.0 10.0.0.1

R1#sh run | sec bgp
router bgp 100
bgp log-neighbor-changes
neighbor 2.2.2.2 remote-as 200
neighbor 2.2.2.2 ebgp-multihop 2
neighbor 2.2.2.2 update-source Loopback0
R1#

R2#sh run | sec bgp
router bgp 200
bgp log-neighbor-changes
neighbor 1.1.1.1 remote-as 100
neighbor 1.1.1.1 ebgp-multihop 2
neighbor 1.1.1.1 update-source Loopback0
R2#

===============================================================

BGP basic Lab 4 (neighborship via interface)

OSPF is running on all routes for connectivity

R1(config)#router ospf 1
R1(config-router)#
R1(config-router)#netw
R1(config-router)#network 0.0.0.0 0.0.0.0 area 0
R1(config-router)#
R1(config-router)#exit

R1#sh run | sec bgp
router bgp 500
no synchronization
bgp log-neighbor-changes
network 1.0.0.0
network 4.0.0.0
network 10.0.0.0
neighbor 2.2.2.2 remote-as 500
no auto-summary
R1#

R2#sh run | sec bgp
router bgp 500
no synchronization
bgp log-neighbor-changes
network 1.0.0.0
network 2.0.0.0
network 20.0.0.0
neighbor 3.3.3.2 remote-as 500
no auto-summary
R2#

R3#sh run | sec bgp
router bgp 500
no synchronization
bgp log-neighbor-changes
network 2.0.0.0
network 3.0.0.0
network 30.0.0.0
neighbor 1.1.1.1 remote-as 500
no auto-summary
R3#

R4#sh run | sec bgp
router bgp 500
no synchronization
bgp log-neighbor-changes
network 3.0.0.0
network 4.0.0.0
network 40.0.0.0
neighbor 2.2.2.1 remote-as 500
no auto-summary
R4#

===============================================================

BGP basic Lab 5 (neighborship via loopback)

We are making neighborship by loopback.

OSPF is running to provide connectivity.

R1(config)#
R1(config)#router ospf 1
R1(config-router)#
R1(config-router)#netw
R1(config-router)#network 0.0.0.0 0.0.0.0 area 0
R1(config-router)#
R1(config-router)#exit
R1(config)#

R1#sh run | sec bgp
router bgp 500
no synchronization
bgp log-neighbor-changes
neighbor 12.0.0.1 remote-as 500
neighbor 12.0.0.1 update-source Loopback0
neighbor 13.0.0.1 remote-as 500
neighbor 13.0.0.1 update-source Loopback0
neighbor 14.0.0.1 remote-as 500
neighbor 14.0.0.1 update-source Loopback0
no auto-summary
R1#

R2#sh run | sec bgp
router bgp 500
no synchronization
bgp log-neighbor-changes
neighbor 11.0.0.1 remote-as 500
neighbor 11.0.0.1 update-source Loopback0
neighbor 13.0.0.1 remote-as 500
neighbor 13.0.0.1 update-source Loopback0
neighbor 14.0.0.1 remote-as 500
neighbor 14.0.0.1 update-source Loopback0
no auto-summary
R2#

R3#sh run | sec bgp
router bgp 500
no synchronization
bgp log-neighbor-changes
neighbor 11.0.0.1 remote-as 500
neighbor 11.0.0.1 update-source Loopback0
neighbor 12.0.0.1 remote-as 500
neighbor 12.0.0.1 update-source Loopback0
neighbor 14.0.0.1 remote-as 500
neighbor 14.0.0.1 update-source Loopback0
no auto-summary
R3#

R4#sh run | sec bgp
router bgp 500
no synchronization
bgp log-neighbor-changes
neighbor 11.0.0.1 remote-as 500
neighbor 11.0.0.1 update-source Loopback0
neighbor 12.0.0.1 remote-as 500
neighbor 12.0.0.1 update-source Loopback0
neighbor 13.0.0.1 remote-as 500
neighbor 13.0.0.1 update-source Loopback0
no auto-summary
R4#

===============================================================

BGP basic Lab 6 (Authentication and Peer group)

-For authentication we can apply password while forming a neighborship
-If password doesn't match, neighborship will not come up

-If we have to right same command multiple time, we can create a Peer- group (group of common commands)

-OSPF is running on all routers to provide reachability

R4#sh run | sec ospf
router ospf 4
log-adjacency-changes
network 0.0.0.0 255.255.255.255 area 0
R4#

R1#sh run | sec bgp
router bgp 500
no synchronization
bgp log-neighbor-changes
neighbor CCIE peer-group
neighbor CCIE remote-as 500
neighbor CCIE password cisco123
neighbor CCIE update-source Loopback0
neighbor CCIE version 4
neighbor 12.0.0.1 peer-group CCIE
neighbor 13.0.0.1 peer-group CCIE
neighbor 14.0.0.1 peer-group CCIE
no auto-summary
R1#

R2#sh run | sec bgp
router bgp 500
no synchronization
bgp log-neighbor-changes
neighbor CCIE peer-group
neighbor CCIE remote-as 500
neighbor CCIE password cisco123
neighbor CCIE update-source Loopback0
neighbor CCIE version 4
neighbor 11.0.0.1 peer-group CCIE
neighbor 13.0.0.1 peer-group CCIE
neighbor 14.0.0.1 peer-group CCIE
no auto-summary
R2#

R3#sh run | sec bgp
router bgp 500
no synchronization
bgp log-neighbor-changes
neighbor CCIE peer-group
neighbor CCIE remote-as 500
neighbor CCIE password cisco123
neighbor CCIE update-source Loopback0
neighbor CCIE version 4
neighbor 11.0.0.1 peer-group CCIE
neighbor 12.0.0.1 peer-group CCIE
neighbor 14.0.0.1 peer-group CCIE
no auto-summary
R3#

R4#sh run | sec bgp
router bgp 500
no synchronization
bgp log-neighbor-changes
neighbor CCIE peer-group
neighbor CCIE remote-as 500
neighbor CCIE password cisco123
neighbor CCIE update-source Loopback0
neighbor CCIE version 4
neighbor 11.0.0.1 peer-group CCIE
neighbor 12.0.0.1 peer-group CCIE
neighbor 13.0.0.1 peer-group CCIE
no auto-summary
R4#

===============================================================

BGP basic Lab 7 (Route Reflector)

-Route reflectors are used to avoid making full mesh neighborship
-One router is server and other routers as clients
-Client has to make neighborship only with servers. Client will have only one Neighbour
-There will be no neighborship between client to client
-If any update comes to the client, it will update server first and server will update other clients.
-If we have multiple servers, all clients will make neighborship with all servers and all servers will make neighborship with each other.
-Client will update both servers and all other clients will get update from both servers. Every client will get update from both servers, and based on the best router clients will keep only one route as best routers.
-Multiple servers are used for redundancy

R2#sh run | sec bgp // R2 is server
router bgp 500
no synchronization
bgp log-neighbor-changes
network 1.0.0.0
network 2.0.0.0
network 20.0.0.0
neighbor 1.1.1.1 remote-as 500
neighbor 1.1.1.1 route-reflector-client
neighbor 2.2.2.2 remote-as 500
neighbor 2.2.2.2 route-reflector-client
no auto-summary
R2#

R1#sh run | sec bgp
router bgp 500
no synchronization
bgp log-neighbor-changes
network 1.0.0.0
network 10.0.0.0
neighbor 1.1.1.2 remote-as 500
no auto-summary
R1#

R3#sh run | sec bgp
router bgp 500
no synchronization
bgp log-neighbor-changes
network 2.0.0.0
network 30.0.0.0
neighbor 2.2.2.1 remote-as 500
no auto-summary
R3#

BGP Lab 8 (E-BGP-1)

R1#sh run | sec bgp
router bgp 500
no synchronization
bgp log-neighbor-changes
network 1.0.0.0
network 10.0.0.0
neighbor 1.1.1.2 remote-as 500
no auto-summary
R1#

R2#sh run | sec bgp
router bgp 500
no synchronization
bgp log-neighbor-changes
network 1.0.0.0
network 2.0.0.0
network 20.0.0.0
neighbor 1.1.1.1 remote-as 500
neighbor 2.2.2.2 remote-as 600
neighbor 2.2.2.2 ebgp-multihop 2
no auto-summary
R2#

R3#sh run | sec bgp
router bgp 600
no synchronization
bgp log-neighbor-changes
network 2.0.0.0
network 30.0.0.0
neighbor 2.2.2.1 remote-as 500
neighbor 2.2.2.1 ebgp-multihop 2
no auto-summary
R3#

R3#ping 10.1.1.1 source fastEthernet 0/0

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.1.1.1, timeout is 2 seconds:
Packet sent with a source address of 30.1.1.1
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 52/60/72 ms
R3#

R1#ping 30.1.1.1 source fastEthernet 0/0

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 30.1.1.1, timeout is 2 seconds:
Packet sent with a source address of 10.1.1.1
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 60/67/80 ms
R1#

===============================================================

BGP Lab 9 (E-BGP -2)

-OSPF is running in R2, R3 and R4 for reachability.

R1#sh run | sec bgp
router bgp 100
no synchronization
bgp log-neighbor-changes
network 10.0.0.0
network 11.0.0.0
neighbor 11.1.1.2 remote-as 200
no auto-summary
R1#

R2#sh run | sec ospf
router ospf 2
log-adjacency-changes
network 0.0.0.0 255.255.255.255 area 0
R2#

R2#sh run | sec bgp
router bgp 200
no synchronization
bgp log-neighbor-changes
network 11.0.0.0
network 20.0.0.0
network 22.0.0.0
neighbor 11.1.1.1 remote-as 100
neighbor 33.1.1.2 remote-as 200
no auto-summary
R2#

R4#
R4#sh run | sec bgp
router bgp 200
no synchronization
bgp log-neighbor-changes
network 33.0.0.0
network 40.0.0.0
neighbor 22.1.1.1 remote-as 200
no auto-summary
R4#

===============================================================

BGP Lab 10 (E-BGP via Loopback)

R1(config)#
R1(config)#ip route 12.0.0.0 255.0.0.0 1.1.1.2
R1(config)#
R1(config)#ip route 12.0.0.0 255.0.0.0 2.2.2.2 10
R1(config)#

R2(config)#
R2(config)#ip route 11.0.0.0 255.0.0.0 1.1.1.1
R2(config)#ip route 11.0.0.0 255.0.0.0 2.2.2.1 10
R2(config)#

R1#sh run | sec bgp
router bgp 500
no synchronization
bgp log-neighbor-changes
network 1.0.0.0
network 2.0.0.0
network 10.0.0.0
network 11.0.0.0
neighbor 12.0.0.1 remote-as 600
neighbor 12.0.0.1 ebgp-multihop 3
neighbor 12.0.0.1 update-source Loopback0
no auto-summary
R1#

R2#sh run | sec bgp
router bgp 600
no synchronization
bgp log-neighbor-changes
network 1.0.0.0
network 2.0.0.0
network 12.0.0.0
network 20.0.0.0
neighbor 11.0.0.1 remote-as 500
neighbor 11.0.0.1 ebgp-multihop 3
neighbor 11.0.0.1 update-source Loopback0
no auto-summary
R2#

--

--

PAW3L

#WHOAMI: Network Security Engineer || Penetration Testing Enthusiast || CTF Player