Pruebas con BGP y peer con una dirección IP de HSRP

Fecha: julio del 2019

Escenario

Este laboratorio se realizó para analizar la utilización de una IP virtual de HSRP como peer de BGP,

teniendo en cuenta que este utiliza unicast para establecer vecindad e intercambiar rutas.

Generalmente en CCNA se aprende a que HSRP se utiliza para que dispositivos finales, y que esta

IP virtual es solo de “entrada”, para ser utilizada por los dispositivos de la LAN y no para transmitir

por ella, como sería necesario en BGP para establecer vecindad con otro router.

Este escenario no analiza BGP sino la utilización de HSRP como peer.

Este escenario es posible de dos maneras:

- un router que utiliza dos peers BGP para obtener redundancia.

- Un router que utiliza un peer BGP con IP virtual vía HSRP.

1.- Pruebas con dos peers:

*Jul 19 13:08:09.739: %BGP-5-ADJCHANGE: neighbor 10.0.0.2 Up

*Jul 19 13:08:09.743: %BGP-5-ADJCHANGE: neighbor 10.0.0.3 Up

1.1.- Verificación inicial:

Router_C#sh ip route

---resumido---

10.0.0.0/8 is variably subnetted, 2 subnets, 2 masks

C 10.0.0.0/29 is directly connected, Vlan1

L 10.0.0.6/32 is directly connected, Vlan1

192.168.2.0/24 is variably subnetted, 2 subnets, 2 masks

C 192.168.2.0/24 is directly connected, Vlan2

L 192.168.2.1/32 is directly connected, Vlan2

B 192.168.10.0/24 [20/0] via 10.0.0.2, 00:05:51

B 192.168.20.0/24 [20/0] via 10.0.0.2, 00:05:51

B 192.168.30.0/24 [20/0] via 10.0.0.2, 00:05:51

Router_C#

1.2.- Simulamos la caída de uno de los peers:

Router_C#

*Jul 19 13:11:50.337: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0, changed state to down

*Jul 19 13:11:51.349: %LINK-3-UPDOWN: Interface FastEthernet0, changed state to down

*Jul 19 13:14:46.091: %BGP-3-NOTIFICATION: sent to neighbor 10.0.0.2 4/0 (hold time expired) 0 bytes

*Jul 19 13:14:46.091: %BGP-5-NBR_RESET: Neighbor 10.0.0.2 reset (BGP Notification sent)

*Jul 19 13:14:46.091: %BGP-5-ADJCHANGE: neighbor 10.0.0.2 Down BGP Notification sent

*Jul 19 13:14:46.091: %BGP_SESSION-5-ADJCHANGE: neighbor 10.0.0.2 IPv4 Unicast topology base removed from

session BGP Notification sent

Router_C#

1.3.- Verificamos la conmutación al otro peer:

Router_C#sh ip route

---resumido---

10.0.0.0/8 is variably subnetted, 2 subnets, 2 masks

C 10.0.0.0/29 is directly connected, Vlan1

L 10.0.0.6/32 is directly connected, Vlan1

192.168.2.0/24 is variably subnetted, 2 subnets, 2 masks

C 192.168.2.0/24 is directly connected, Vlan2

L 192.168.2.1/32 is directly connected, Vlan2

B 192.168.10.0/24 [20/0] via 10.0.0.3, 00:00:55

B 192.168.20.0/24 [20/0] via 10.0.0.3, 00:00:55

B 192.168.30.0/24 [20/0] via 10.0.0.3, 00:00:55

Router_C#

1.4.- Verificamos paquetes perdidos en la conmutación:

Tiempo de espera agotado para esta solicitud.

Respuesta desde 192.168.2.1: Host de destino inaccesible.

Respuesta desde 192.168.10.1: bytes=32 tiempo=1ms TTL=254

Estadísticas de ping para 192.168.10.1:

Paquetes: enviados = 80, recibidos = 52, perdidos = 28

(35% perdidos),

Tiempos aproximados de ida y vuelta en milisegundos:

Mínimo = 1ms, Máximo = 10ms, Media = 1ms

Control-C

2.- Pruebas con un peer HSRP:

2.1.- Verificamos si utiliza la IP 10.0.0.1 (HSRP) para contactar el peer:

Podemos determinar que para transmitir utiliza la IP real de la interface, tal como se menciona en

la descripción del laboratorio, en esta captura 10.0.0.2 intenta encontrar el peer BGP 10.0.0.6.

2.2.- Capturando con una PC configurada con la IP del peer BGP:

Realizamos esta prueba para verificar que sucede cuando el router tiene una respuesta ARP de la

IP del peer, puede verse que intenta establecer una sesión TCP al port 179 (BGP) y es rechazada

ya que la PC no corre procesos BGP.

2.3.- Captura del rechazo de peer A->C y la negociación C->A:

Podemos analizar que el router A contacta al router C (10.0.0.6) utilizando la IP real (10.0.0.2),

este al no tenerlo configurado como peeer en el BGP rechaza la conexión. Luego el router C

contacta al router A a la IP virtual (10.0.0.1) configurada como peer en el BGP y la sesión se

establece. Tal como se mencionaba, la IP virtual es de “entrada” o para responder una vez

que se la utiliza, y no por tráfico generado por el propio router.

Router_A#debug ip bgp all

Jul 23 14:07:31.599: BGP: 10.0.0.6 active went from Idle to Active

Jul 23 14:07:31.599: BGP: 10.0.0.6 open active, local address 10.0.0.2

Jul 23 14:07:33.599: BGP: 10.0.0.6 open failed: Connection refused by remote host

---omitido---

Jul 23 14:07:52.063: BGP: 10.0.0.6 passive open to 10.0.0.1

Jul 23 14:07:52.063: BGP: 10.0.0.6 passive went from Idle to Connect

Jul 23 14:07:52.063: BGP: ses global 10.0.0.6 (0x84F94B8C:0) pas Setting open delay timer to 60 seconds.

Jul 23 14:07:52.067: BGP: 10.0.0.6 passive rcv message type 1, length (excl. header) 38

Jul 23 14:07:52.067: BGP: ses global 10.0.0.6 (0x84F94B8C:0) pas Receive OPEN

---omitido---

Router_A#

2.4.- Verificación inicial:

Router_A#sh standby

Vlan1 - Group 0

State is Active

5 state changes, last state change 00:06:46

Virtual IP address is 10.0.0.1

Active virtual MAC address is 0000.0c07.ac00

Local virtual MAC address is 0000.0c07.ac00 (v1 default)

Hello time 3 sec, hold time 10 sec

Next hello sent in 0.288 secs

Preemption enabled

Active router is local

Standby router is unknown

Priority 100 (default 100)

Group name is "hsrp-Vl1-0" (default)

Router_A#

Router_B#sh standby

Vlan1 - Group 0

State is Standby

7 state changes, last state change 00:00:06

Virtual IP address is 10.0.0.1

Active virtual MAC address is 0000.0c07.ac00

Local virtual MAC address is 0000.0c07.ac00 (v1 default)

Hello time 3 sec, hold time 10 sec

Next hello sent in 0.976 secs

Preemption disabled

Active router is 10.0.0.2, priority 100 (expires in 9.088 sec)

Standby router is local

Priority 90 (configured 90)

Group name is "hsrp-Vl1-0" (default)

Router_B#

Router_C#sh ip route

---resumido---

10.0.0.0/8 is variably subnetted, 2 subnets, 2 masks

C 10.0.0.0/29 is directly connected, Vlan1

L 10.0.0.6/32 is directly connected, Vlan1

192.168.2.0/24 is variably subnetted, 2 subnets, 2 masks

C 192.168.2.0/24 is directly connected, Vlan2

L 192.168.2.1/32 is directly connected, Vlan2

B 192.168.10.0/24 [20/0] via 10.0.0.1, 00:00:23 (redes aprendidas vía Router_A)

B 192.168.20.0/24 [20/0] via 10.0.0.1, 00:00:23

B 192.168.30.0/24 [20/0] via 10.0.0.1, 00:00:23

Router_C#

2.5.- Simulamos caída de Router_A:

*Jul 19 12:43:38.721: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0, changed state to down

*Jul 19 12:43:39.733: %LINK-3-UPDOWN: Interface FastEthernet0, changed state to down

*Jul 19 12:44:26.489: %BGP-5-NBR_RESET: Neighbor 10.0.0.1 reset (Peer closed the session)

*Jul 19 12:44:26.489: %BGP-5-ADJCHANGE: neighbor 10.0.0.1 Down Peer closed the session

*Jul 19 12:44:26.489: %BGP_SESSION-5-ADJCHANGE: neighbor 10.0.0.1 IPv4 Unicast topology base removed from/

/session Peer closed the session

Router_C#sh ip route (no hay redes aprendidas por BGP)

---resumido---

10.0.0.0/8 is variably subnetted, 2 subnets, 2 masks

C 10.0.0.0/29 is directly connected, Vlan1

L 10.0.0.6/32 is directly connected, Vlan1

192.168.2.0/24 is variably subnetted, 2 subnets, 2 masks

C 192.168.2.0/24 is directly connected, Vlan2

L 192.168.2.1/32 is directly connected, Vlan2

Router_C#

*Jul 19 12:44:40.837: %BGP-5-ADJCHANGE: neighbor 10.0.0.1 Up (Router_B se volvió Active y negoció BGP con Router_C)

Router_C#

2.6.- Verificamos convergencia contra Router_B:

Router_C#sh ip route

---resumido---

10.0.0.0/8 is variably subnetted, 2 subnets, 2 masks

C 10.0.0.0/29 is directly connected, Vlan1

L 10.0.0.6/32 is directly connected, Vlan1

192.168.2.0/24 is variably subnetted, 2 subnets, 2 masks

C 192.168.2.0/24 is directly connected, Vlan2

L 192.168.2.1/32 is directly connected, Vlan2

B 192.168.10.0/24 [20/0] via 10.0.0.1, 00:00:15 (redes aprendidas vía Router_B)

B 192.168.20.0/24 [20/0] via 10.0.0.1, 00:00:15

B 192.168.30.0/24 [20/0] via 10.0.0.1, 00:00:15

Router_C#

2.7.- Verificación de HSRP:

Router_B#sh standby

Vlan1 - Group 0

State is Active

8 state changes, last state change 00:02:18

Virtual IP address is 10.0.0.1

Active virtual MAC address is 0000.0c07.ac00

Local virtual MAC address is 0000.0c07.ac00 (v1 default)

Hello time 3 sec, hold time 10 sec

Next hello sent in 1.824 secs

Preemption disabled

Active router is local

Standby router is unknown

Priority 90 (configured 90)

Group name is "hsrp-Vl1-0" (default)

Router_B#

2.8.- Recuperación de la conectividad luego de la conmutación de peers:

Tiempo de espera agotado para esta solicitud.

Respuesta desde 192.168.2.1: Host de destino inaccesible.

Tiempo de espera agotado para esta solicitud.

Respuesta desde 192.168.10.1: bytes=32 tiempo=1ms TTL=254

Estadísticas de ping para 192.168.10.1:

Paquetes: enviados = 35, recibidos = 26, perdidos = 9

(25% perdidos),

Tiempos aproximados de ida y vuelta en milisegundos:

Mínimo = 1ms, Máximo = 1ms, Media = 1ms

Control-C

2.9.- Retorno del Router_A como activo (debido al preempt):

Respuesta desde 192.168.10.1: bytes=32 tiempo=1ms TTL=254

Respuesta desde 192.168.10.1: bytes=32 tiempo=1ms TTL=254 (negocia activo)

Respuesta desde 192.168.2.1: Host de destino inaccesible.

Tiempo de espera agotado para esta solicitud.

Respuesta desde 192.168.2.1: Host de destino inaccesible.

Respuesta desde 192.168.10.1: bytes=32 tiempo=1ms TTL=254 (retorno vía preempt)

Respuesta desde 192.168.10.1: bytes=32 tiempo=1ms TTL=254

2.10.- Verificación de los router-id de los peers que intervienen en el HSRP:

2.10.1.- En funcionamiento normal:

Router_C#sh ip bgp neighbors

BGP neighbor is 10.0.0.1, remote AS 34001, external link

BGP version 4, remote router ID 192.168.30.1

BGP state = Established, up for 00:00:46

Last read 00:00:46, last write 00:00:45, hold time is 180, keepalive interval is 60 seconds

Neighbor sessions:

1 active, is multisession capable (disabled)

---omitido---

Router_C#

*Jul 23 13:50:36.346: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0, changed state to down

*Jul 23 13:50:37.358: %LINK-3-UPDOWN: Interface FastEthernet0, changed state to down

*Jul 23 13:50:51.730: %BGP-5-NBR_RESET: Neighbor 10.0.0.1 reset (Peer closed the session)

*Jul 23 13:50:51.730: %BGP-5-ADJCHANGE: neighbor 10.0.0.1 Down Peer closed the session

*Jul 23 13:50:51.730: %BGP_SESSION-5-ADJCHANGE: neighbor 10.0.0.1 IPv4 Unicast topology base removed from session Peer closed the session

*Jul 23 13:50:59.638: %BGP-5-ADJCHANGE: neighbor 10.0.0.1 Up

Router_C#

2.10.1.- En contingencia:

Router_C#sh ip bgp neighbors

BGP neighbor is 10.0.0.1, remote AS 34001, external link

BGP version 4, remote router ID 192.168.30.2

BGP state = Established, up for 00:01:43

Last read 00:00:01, last write 00:00:01, hold time is 180, keepalive interval is 60 seconds

Neighbor sessions:

1 active, is not multisession capable (disabled)

---omitido---

Router_C#

2.11.- Se configuran mismos router-id (para agilizar la convergencia ?):

Router_A#conf t

Enter configuration commands, one per line. End with CNTL/Z.

Router_A(config)#router bgp 34001

Router_A(config-router)#bgp router-id 10.0.0.1

Router_A(config-router)#end

Router_A#

Router_A#clear ip bgp * (reiniciamos BGP)

Router_A#

Router_B#conf t

Enter configuration commands, one per line. End with CNTL/Z.

Router_B(config)#router bgp 34001

Router_B(config-router)#bgp router-id 10.0.0.1

Router_B(config-router)#end

Router_B#

Router_B#clear ip bgp * (reiniciamos BGP)

Router_B#

2.12.- Verificamos en funcionamiento normal:

Router_C#sh ip bgp neighbors

BGP neighbor is 10.0.0.1, remote AS 34001, external link

BGP version 4, remote router ID 10.0.0.1

BGP state = Established, up for 00:00:11

Last read 00:00:11, last write 00:00:11, hold time is 180, keepalive interval is 60 seconds

Neighbor sessions:

1 active, is not multisession capable (disabled)

---omitido---

Router_C#

2.13.- Verificamos en contingencia:

Router_C#sh ip bgp neighbors

BGP neighbor is 10.0.0.1, remote AS 34001, external link

BGP version 4, remote router ID 10.0.0.1

BGP state = Established, up for 00:00:35

Last read 00:00:35, last write 00:00:35, hold time is 180, keepalive interval is 60 seconds

Neighbor sessions:

1 active, is not multisession capable (disabled)

---omitido---

Router_C#

2.14.- Tiempos de convergencia con este método:

Respuesta desde 192.168.10.1: bytes=32 tiempo=1ms TTL=254

Tiempo de espera agotado para esta solicitud.

Respuesta desde 192.168.2.1: Host de destino inaccesible.

Tiempo de espera agotado para esta solicitud.

Respuesta desde 192.168.10.1: bytes=32 tiempo=1ms TTL=254

3.- Configuración de los equipos:

Router_A#sh runn (sólo lo mas relevante)

Building configuration...

Current configuration : 1563 bytes

hostname Router_A

interface FastEthernet0

description Backbone BGP

interface FastEthernet1

interface FastEthernet2

interface FastEthernet3

switchport trunk allowed vlan 1,10,20,30,1001-1005

switchport mode trunk

interface Vlan1

ip address 10.0.0.2 255.255.255.248

standby 0 ip 10.0.0.1

standby 0 preempt

interface Vlan10

ip address 192.168.10.1 255.255.255.0

interface Vlan20

ip address 192.168.20.1 255.255.255.0

interface Vlan30

ip address 192.168.30.1 255.255.255.0

router bgp 34001

no synchronization

bgp log-neighbor-changes

network 192.168.10.0

network 192.168.20.0

network 192.168.30.0

neighbor 10.0.0.6 remote-as 34000

no auto-summary

end

Router_A#

Router_B# sh runn (sólo lo mas relevante)

Building configuration...

Current configuration : 1344 bytes

hostname Router_B

interface FastEthernet0

description Backbone BGP

interface FastEthernet1

interface FastEthernet2

interface FastEthernet3

switchport trunk allowed vlan 1,10,20,30,1001-1005

switchport mode trunk

interface FastEthernet4

interface Vlan1

ip address 10.0.0.3 255.255.255.0

standby 0 ip 10.0.0.1

standby 0 priority 90

interface Vlan10

ip address 192.168.10.1 255.255.255.0 (para facilitar las pruebas es misma IP que Router_A

! pero sin conectar al mismo segmento para no tener

interface Vlan20 IPs duplicadas ni problemas de ARP)

ip address 192.168.20.1 255.255.255.0

interface Vlan30

ip address 192.168.30.1 255.255.255.0

router bgp 34001

bgp log-neighbor-changes

network 192.168.10.0

network 192.168.20.0

network 192.168.30.0

neighbor 10.0.0.6 remote-as 34000

end

Router_B#

Router_C# sh runn (sólo lo mas relevante)

Building configuration...

Current configuration : 1592 bytes

hostname Router_C

interface FastEthernet0

description Backbone BGP

spanning-tree portfast

interface FastEthernet1

description Backbone BGP

spanning-tree portfast

interface FastEthernet2

description Port Mirroring Wireshark

interface FastEthernet3

switchport access vlan 2

interface FastEthernet4

interface Vlan1

ip address 10.0.0.6 255.255.255.248

interface Vlan2

ip address 192.168.2.1 255.255.255.0

router bgp 34000

bgp log-neighbor-changes

network 192.168.2.0

neighbor 10.0.0.1 remote-as 34001

monitor session 1 source interface Fa0

monitor session 1 destination interface Fa2

end

Router_C#

(2019) Packets for everybody

Rosario, Argentina