BGP Assessment

0:00OK, here we go with our first major task in this journey into the CCIE practice exam. Our first task is going to be all about bringing up the internet backbone. There's seven routers that we need to work with in the internet backbone. They're all labeled starting with ISP hyphen, something. So that's what we're going to be focusing in this video. This is going to be a major BGP assessment. So get ready. Let's get started with task number one, the internet network. All right, so without further ado, let's have some fun here and start bringing this lab to life.

0:31So what I'm going to focus on first is the internet section here. This is going to be ISPs 100, ISP 200, 300, 400-1, 2, 3, and 4. Those are the ones that we want to bring to life first. So that way when we bring all of our branches to life, all of them will have connectivity over the internet and that simulates that way. As a quick refresher, this traffic will be sent outbound towards this NAT-out router, which if you've got it set up right in your environment, this will actually send it outbound toward the actual internet. So our LAN devices will actually be able to simulate the internet when the time comes.

1:04So let's take a look at these lab tests here, if I jump over to the left-hand side and choose lab test. I'm focused on the internet network section first. And here's also what I'm going to do. I'm going to bring the consoles of these devices up by using secure CRT. So when I give them a click here and launch secure CRT, and I'm going to do a little split screen action like this. Here we go. So I'll choose ISP 200, 300-- come on 300, there we go-- 400-1 2, 3, and 4.

1:38Cool, so all of my consoles are up here. Let's start by just getting a little lay of the land. I'll do ISP 100, show IP interface brief. In fact, let's clean this up a little bit. I've got a little quick shortcut item here. So this is show IP interface brief, exclude unassigned and administratively down. So this just shows me all of the IP addresses that are assigned currently. The layout is like this, the 192.168s typically are going to be used for anything outside of the internet. So this is how our customers connect into the internet.

2:08It's also how we connect to the NAT outbound router two. The 172.30s are going to be BGP neighbors if they're in a different autonomous system. So if we look at the topology here, let me move things around just a little bit so we can work with this a little bit better. Hit over a couple times, great. So ISP 100 is going to have only eBGP neighbor relationships-- so we think. We'll see what the tasks have in store for us. Same thing's going to be for ISP 200 because there's only-- let's just say show IP-- actually, you know what?

2:41I've got that quick button here at the bottom. Let's just do that. So that way it's nice and easy and clean. There we go. So, again, we've got the 172.30s. So I see there's going to be three 172.30s, and then, of course, a loopback. Same thing with ISP 300. Let's get into enable privilege mode. It takes the lay of the land there, OK? Let's do this one, the 400s. Just doing the lay of the land, get our feet a little settled here. Take a look at the IP addresses, cool. Now, notice here in the ISP 400s, we're going to be doing some iBGP relationships and some more configurations beyond that.

3:17So those internal BGPs are going to be 172.31. If I was to jump back to ISP 400-1, I see I've got the 192.168s. Again, that's so it can connect, too. It looks like it's got two outbound connections to R9 and R8. So that's going to be customer one and customer two's routers. All right, let's take a look at ISP 400-3. Cool, there we go. I also see some outbound connections here for customer one and customer two, and then the internal 172.31s.

3:55And let's give this one a run. OK, so now we've got a lay of the land. We've seen all of the IP addresses. Why wait any longer? Let's just start from the top. Configure BGP on all routers in the ISP network according to the following. So this task, so this internet network task is going to be almost exclusively BGP. But that does not mean this is the only place that we will see BGP throughout this journey. We will absolutely see BGP again. It's just that the internet network section is going to be heavily focused on BGP. So let's get to it.

4:25ISP 100 should operate in ASN 100. So let's do router BGP 100. There we go. So that's operating in AS 100. 200 operates in 200. 300 operates in 300. So let's get that done, conf t router BGP 200, cool. ISP 300. Config t router BGP 300, cool. Now, ISP 400s should all operate in AS 400, but like so. ISP 400-1 and ISP 400-2 should participate in a confederation, ASN 65005, and use authentication Cisco.

4:58Now, I believe that's 400-1 and 400-2 should authenticate to each other. 400-3 and 400-4 should participate in a confederation, the same confederation. But ASN 65006 can use authentication CISCO1. All right, so we're doing a confederation here. Let's get it going. This is going to be router BGP for 400-1. We said that's 65005. So they're going to be participating in the local autonomous system of 65005, representing ASN400 as part of the confederation.

5:35So let's say BGP confederation identifier is going to be 400. And BGP confederation peers, we're expecting to be 65006, OK? Same thing is going to be on ISP 400-2. So I'm going to give this a do show run, section BGP, and just copy and paste-- very cool. Here we go. Config t, paste it in. There we go. So now my confederation is set up for 65005. We also need to configure the neighbor relationship between these two, such that it uses authentication.

6:12So let's say neighbor, this was going to be-- do we want to do this by loopbacks? We probably do want to do this by loopbacks, don't we? OK, so the loopback address on 400-2 is 142.142.142.142. And the issue that I have here, just looking at this, is that these don't have-- nope. Do show IP route. These don't have routes to each other. So let's do this in order to make this happen.

6:44Let's just make this come to life real quick by saying router OSPF1. Let's just run OSPF between all of the devices in ISP 400. So I'm going to say router OSPF 1 network. We need to turn the network on for one of these commands. Let's do 172.31.41.0. These are all 24-bit masks in this area, or in this topology.

7:14And this was 43, cool. If I jump back over here, we'll back out of BGP configuration real quick, OSPF 1 network 172.31.41.0. So it's area 0. That'll bring that to life real quick. And 24, that'll bring that to life real quick. Let's bring these to life with the OSPF real quick-- network 172.31.34.0 area 0 and 43, cool.

7:59Router OSPF 1 network 172.31.34.0 area 0 and 24 right here. OK, so if I give this a do show IP OSPF interface brief, let's verify that those are participating here. And do show IP OSPF neighbors. We're in a DROTHER state, which means it might be coming to life. Looks like I'm getting some full adjacencies over here.

8:30Now we need to get those loopbacks into OSPF so that we can make our BGP neighbor relationships based on the loopback addresses. So let's get those loopbacks in. And I'm going to do a network statement instead of a redistributor connected because-- actually, you know what? Yeah, I'm going to do it that way. OK, 141. Let's do 0.0.0.0 area 0. Over here, I'm going to do network 142.142.142.142 0.0.0.0, area 0.

9:09Let's jump over here, network 143-- ah, hit Enter too many times-- 143.143.143.143 0.0.0.0, area 0. Why can't I type? There we go. And ISP 400, network 144.144.144.144 0.0.0.0-- I always forget that wildcard mask. All right, so at this point, let's do a do show IP route OSPF.

9:41Cool, I'm starting to see-- OK, I got all the loopbacks in. So at this point, I can start building my BGP relationships. So I'll go back into BGP. This is 65005 on ISP 400-1. Just making sure you all can see me OK. Yeah, OK, we're good. And I'm going to say neighbor is going to be-- we were going to do authentication between ISP 400-1 and ISP 400-2, and a different password between 400-3 and 400-4.

10:14So I'll say 142.142.142.142. Remote AS is going to be 65005. We're going to do update so that it's peered based on the loopback address. And let's throw in that password, shall we? Password was all caps, CISCO. Let's bring this BGP relationship to life over here. And we're going to say new-- nope, nope, nope, got to be in BGP-- 65005.

10:45And we've got our neighbor statement, 141.141.141.141. Remote AS 65005, update source loopback. OK, and lastly, the password. Let's let it sit for a second and just verify that this comes to life. Come on, baby. Give me a BGP relationship. Do a debug BGP IPv4 unicast.

11:17Is that it? All right, I think that's a good sign. Do show BGP IPv4 unicast summary. OK, we've got an up. No prefixes received because we're not advertising any prefixes into BGP at this time. But it looks like everything is doing good. Do undebug all-- oops, all-- there we go. Cool, debugging is turned off. So the relationship between 400-1 and 400-2 is brought to life.

11:50So we've got that one checked off. Let's bring up 400-3 and 400-4. So let's exit out of this-- router BGP-- this is 65006. And this is now going to be our neighbor statement of 144.144.144.144. Remote AS is going to be our remote AS because this is an internal BGP session. We're going to do the update source loopback. And we need to do a password.

12:21This was password CISCO1. Cool, all right, let's do this guy over here, which is going to be ISP 400-4, router BGP 65006, neighbor 143.143.143.143. Remote AS is our AS because it's internal. Update source loopback and password is CISCO1.

12:51Let's do do debug BGP IPv4 unicast, watch it come to life. Come on, baby. Cool, looking good, adjacency is up. We've got the little ADJ change neighbor status of up. Give me one second so I can mute this. This keeps going off. All right, there we go-- silent mode. Sorry about that. OK, now we've got the BGP relationship between 400-- within the local autonomous system.

13:27Now we need to get that outside of local autonomous system, but still within the confederation. So this is going to be peers between 65005 and 65006. So this is going to be ISP 400-1 over here to 400-3, and ISP 400-2 to ISP 400-4. So on the side, we're going to say neighbor 143.143.143.143. remote autonomous system, 65006 update source, loopback 0.

14:03There's no authentication requirement here. So I'm not worried about it. Let me do a do undebug all here. There we go, OK? Neighbor 141, which is the loopback address of 400-1, remote autonomous system, 65005. Update source-- entered too many times there. Update source, loopback 0. OK, so that should bring that relationship to life. Let's do 400-2 and 400-4.

14:36There we go. So neighbor statement here, autonomous system 65006. Update source, loopback 0, cool. And in the other direction, neighbor 142.142.142.142, remote autonomous system-- nope, there's 65005. And update source, loopback 0, OK?

15:08Just let everything come to life-- do. Active open failed. No route to peer. No route? Do show IP route OSPF. What's up with that? You definitely have a route to peer, buddy. No route to peer? Do ping, 142.142.142.142 source loopback 0, OK?

15:39Well, we definitely have connectivity. Oh, OK, do show run section BGP. Where did I go wrong? Do show BGP IPv4 unicast-- nope, summary.

16:12We definitely have not established a connection for 142. Oh, I didn't configure the confederation-- duh. OK, BGP confederation identifier 400, BGP confederation peers 65005. And did I do the same thing here? Do show run-- bet I didn't-- section BGP, y'all. BGP confederation identifier 400, BGP confederation peers 65005.

16:52Still says no route to peer, ugh. Do show run section BGP, OK? I did type this right. And it does have a route because I can ping it. Do show run section BGP, do show IP route, OK?

17:30So not only does router three here see the route to router two through one and three-- so this is some tomfoolery here. Do show IP route. It learns the route via OSPF. OK. active open field. OK, let's see. What's going on over here? Do show run section BGP.

18:1165006 update source loopback 0. Do show run section BGP 65005. Update source loopback 0. Show IP route. Do ping 144.144.144.144 source from loopback 0.

18:44Roundtrip traffic, but this guy says there is no route for 142. OK, let's do this. No, just wipe these out real quick. Try it again.

19:18Make sure I'm into BGP configuration, yeah, OK. Neighbor is 142.142.142.142. The remote autonomous system is 65005. Neighbor, 142.142.142.142. Update source, loopback 0. Oh, do I not have a loopback? Do I have a loopback?

19:53Active open failed, no route to peer. Why do you think you have no route to peer? Let's try this because this is going from-- even though this is part of the confederation, this is going from loopback to loopback.

20:24So it could behave like an eBGP. So let's do this. Let's do eBGP-- nope, that's not it. It is the eBGP multihop. Let's do neighbor 142.142.142.142, eBGP multihop. Let's give it a 5. And let's do the same thing on the other direction, neighbor 144.144.144.144, eBGP multihop.

20:56Give it a 5. Let's see what happens. Ah, look at that. Yep, OK, so because we are peering between autonomous systems, even though they're within the same confederation, it still behaves like an eBGP relationship. So we have to have multihop. So that means the same thing is going to be true over here between one and three. And I see that relationship never came up either. So 143.143.143.143-- nope, 3. EBGP multihop 5. Just give myself some padding.

21:27It doesn't specify anything like that. Neighbor 141.140-- nope, this is 2. Do that in 2. We'll do this on 3. Neighbor 141.141.141.141, eBGP multihop 5. And let's give it a second. There we go. Neighbor adjacency is up. OK, so now I have my adjacency for autonomous system 400 up.

21:58Next step is step five, form eBGP relationships between directly connected neighbors in different autonomous systems. So eBGP relationships are going to be from 400 to 200, 400-2 to 300, 400-4 to 200, 400-4 to 300, 300 to 100, and 200 to 100. So let's actually start from 100 and work our way out. So we're going to go into router BGP 100. Neighbor is going to be-- in this case, we actually can see what our IP addresses are. Do show IP interface brief.

22:30OK, our first neighbor adjacency is going to be 172.30. 200 is going to be for autonomous system 200. You remember autonomous system is going to be 200. Neighbor adjacency here for the 103 is going to be between 100 and 300. So I just used 103 right there. 103.30, I think is what I set him at? We'll verify that. OK, so that's going to be ISP 100's neighbor adjacency statements.

23:02Let's do ISP 200, BGP 200. Let's bring up 100 first, 172.30.200.100. Remote autonomous system is 100. Let's bring up-- now we're connecting to 400-2 and 400-4. I have no idea what those IP addresses are. OK, 172.30.42.something. Hiccups-- got to look. Let's see.

23:36So we've got 172.30.42, is going to be 400-2, OK? 42 is 400-2, which is .20 Autonomous system is 400. Uh-oh. Cannot configure the local system as neighbor because I am looking at the wrong IP address. So this is 400-2, 24-- oh, 42-40.

24:09I was looking at the 31s, of course. Yeah, I did that on purpose. I'm tricking myself up. I even said, like, I'm going to do this to trick myself. And that is exactly what happened. So if that one-- and this one is going to be 24.40, OK? So then on this side, I will say neighbor 172.30.42.20. Autonomous system is 200. And over here, we'll say neighbor-- let's do do show IP interface brief.

24:43Do show IP interface brief. So I'll take a look. OK, neighbor is 172.30.24.20. Autonomous system is going to be 200. So this should bring my eBGP relationships up. There they go. They came up to life right there. And from ISP 200's perspective, do show BGP IPv4 unicast summary because we don't have any prefixes advertised yet. OK, I see my three eBGP relationships for ISP 200 are now brought to life.

25:14Everything shows in the upstate with the timer kicking there. So let's move on to ISP 300. Let's give it a show IP interface brief because I can already tell I'm going to need it. Router BGP 300. Neighbor, let's bring up the relationship to ISP 100 first, .100. Remote autonomous system 100, neighbor 172.30.43.40, and then 34.40, cool.

25:49So from 400-2, neighbor 172.30.43.30. Remote autonomous system, 300. And from 400-4, do show-- OK, let's just do undebug all. Do undebug all, OK? Do show IP interface brief. Neighbor is going to be 172.30.34.30. Remote autonomous system is 300, OK?

26:20Do show BGP IPv4 unicast summary. And I see all my relationships are alive here-- cool, cool, cool, cool, cool. All right, so step 5 is done, form eBGP relationships between all directly connected neighbors in different autonomous systems on ISP 300. Should check that neighbors are only one hop away. So that's going to be the TTL statements. Let's see. Is this is a neighbor statement? I believe it is.

26:51Neighbor, 172.30.103.100. TTL Security, hops-- let's just say-- you know what? I know it says one hop away. I feel like I should say it needs to just-- OK. Fine, fine, fine, fine. You win, one hop. One hop away, 30.43 and 40 and 34.

27:24So we're checking the TTL on these that we should be receiving, that they are only one hop away. So this is checking that the TTL on these that comes in is going to be one hop away. Cool, advertise all loopbacks into BGP. All right, so let's do this. It doesn't say how. We could do a redistribute connected. We could also do network statements. In fact, I am-- you know what? Just to make things easy on me since it doesn't specify, I am going to do redistribute connected on any of the ISPs that have my endpoints, my customer endpoints connected to them.

28:06So that way it also brings in those. And I don't have to do so many network statements here. And then it gets really clustered. So let's do-- should I go into IP address family redistribute connected? Cool, so we're bringing in the connected routes into the IPv4 unicast address family on 400-1. I also see 400-3 is going to do some redistribution because I have the customer addresses here, redistribute connected. And then I have ISP 100, which also has some customer routes that I'm going to bring in, redistribute connected.

28:47Now, something that I'm expecting to have a problem with here is the confederation items here. There's probably going to need to be some next hop self. Otherwise, some routes are not going to be resolvable. But I also need to do network statements on ISP 200, 300, 402, and 404. So let's do network-- what is the loopback here? 130? OK, network 130.130.130.130 mask 255.255-- this is on ISP 300.

29:18Cool, looking good there. 200, we need to do the same thing. This is 140-- nope, this is 400-2. We need to go to ISP 200. Do show IP interface brief network statement 120.120.120.120 mask 255. Cool, and then we had 400-2 and 400-4. OK, so I was on the right one after all, 142.142.142.142, mask 255.255.255.255 and 400-4, 144.144.144.144 mask 255.255.255.255.

30:04And my hunch, like I said, was that we're going to have some next hop self problems for routes. So in this case, I'm looking at, like, ISP 300. It's going to be advertising its loopback over here to 400-2 and 400-4. My expectation is that 400-3 won't know how to reach that. So let's just check it out. Oh, look at that. Something just changed there. Aha, 30 went down, probably because of the TTL, didn't it?

30:34Probably because of the TTL-- let's fix that. We probably needed that TTL statement to go in two directions, don't you think? So let's say 172.30.34.30 TTL security hops 1 and neighbor 172.30.43.30 TTL security hops 1.

31:15And here come the relationships one more time. Let's fix ISP 102.172.30.103.30 TTL-- oops, I'm in the address family. So the issue here is that the TTL security has to be in two directions. The hold timer on BGP was three minutes. So three minutes just passed. And they probably dropped out because the hold timer was not-- because the TTL security, the hops were not matching on both sides.

31:47We hadn't agreed on that security feature yet. But the relationships are coming back now that I've set it up to be in two directions. So like I was saying, I'm expecting ISP 300 to advertise its loopback into ISP 400. But the distant routers won't be able to receive it. So let's verify that real quick. I'm going to look at do show BGP IPv4 unicast. And let's see. So that was 130.130.130.130. And sure enough, I don't know how to get there because this next hop is the path to ISP 300.

32:20And I haven't learned about that route via OSPF or via BGP. So I can either advertise this in to BGP, or which-- you know what? I probably should just advertise all of these links into BGP. I probably should just do redistribute connected everywhere, actually. That way every router knows about every path within the environment. Let me look ahead and make sure I don't have any-- oh, look at that. I do have something, advertise all routes into BGP. Well, there you go.

32:50ASN 400 should show-- ASN 400 router should show incomplete. So there's redistribution. All of the routes should show an origination of I. So should have done network statements on ISP 100. And redistribute connected is what we need to do on all of the items in ISP 400. So without further ado, let's just get that going-- IPv4 just redistribute connected, cool.

33:22And let's do this on two, address family IPv4 unicast, redistribute connected-- cool. Now that that's done I can go over here now to 400-3, press up. And sure enough, now I can actually get to the 130. I now actually have a little carat here showing that I have a best path forward. And it does show as originating internally. Now, this one is showing-- this is ISP 100's loopback. It's showing as incomplete.

33:53We do need to fix that because it says all other routes should show an origination of I. So let's do this, do show run section BGP. And let's wipe out my address family IPv4 unicast and no redistribute connected, exit. Now we have to take it through all these network statements. Man, why did I do this to myself? OK, OK, lots of network statements.

34:24Oops, got to go network statements are in IPv4 unicast. There we go, network. All right, 192.168.198.0 mask 255. They're all 24-bit masks. So keep it easy, at least in that regard. Seven-- now, jumping ahead, I see I've got one in 10 and 11. So 10, 11.

34:56Now let's do the 172.30s. 172.30.103.0 200. And lastly, the loopback. 100.100.100.100. Wipe out this guy here-- cool. So if I now jump back, let's see what we got.

35:33Looking a lot better. I think we have now accomplished our goal. All right, cool. So that knocks out seven and eight. ISP 400-1's loopback should not be advertised outside of ASN 400. So there's a few ways you could do that. You could do a route map that filters it out. Or the easier way is actually going to be BGP communities. So let's do this. Let's say-- time to start sending some communities, do show run section BGP-- cool.

36:06Tackle my first neighbor, 142.142.142.142, send community, both, and 143. Cool, let's do-- got to forward these communities on throughout the topology, section BGP. Neighbor 144.144.144.144, send community-- was that an address family when you do that?

36:42Must be. Neighbor, 144.144.144.144 send community, yep, both, cool. We'll send it back to 141 just for good measure and for cleanliness sake. 400-3 show run section BGP, neighbor 141.141.141.141 send community both and 144.

37:20And lastly, we're going to do this coming back this way, 143.143.143.143, send community both, and 142. That's what we needed. Cool, so now we're sending the communities. Now we actually need to set a community. So let's do a route map, a prefix list and a route map. OK, IP prefix list.

37:52What am I going to call this prefix list? Let's call this 400-1 loop sequence 5 permit. And the prefix is 141.141.141.141/32. Let's make a route map that matches it. Route map-- what's a clever name to call this? Loop com for community string? I don't know. I'm not good at names, guys.

38:22I'm sorry. Match IP address prefix. And let's just grab this right here-- cool. Set community. OK, let's take a look at our options so we can see. We want to do no export, do not export to the next autonomous system because we do want to keep it within advertise. We do want it to go outside of this autonomous system. So we're going to export it out of our autonomous system and into the confederation peer system.

38:57But it won't go outside of that. So let's do no export. And now we're going to set our new neighbor statements, router BGP 65005. And now our neighbor statement 143.143.143.143 route map. Nope, not remote. Is that in the address family? For unicast neighbor 143.143.143.143 route map.

39:35And what do we call that route map? Loop com. Nope, out. You know what I did? That route map has an implicit deny all. So we need to fix that, don't we? Route map, loop com, sequence 20-- ick-- permit 20.

40:09There we go. Show route map. OK, so at this point, let's see. Do show BGP IPv4 unicast. OK, we still are receiving 141.141.141.141, which is cool. But now if I do show BG-- actually, let's just do show IP route BGP, still have 141 there.

40:45Let's do clear BGP IPv4 unicast, star. Let's just bounce them all. Actually, I wonder if that-- I think it might actually be that we didn't want that sequence twinning.

41:18No route map loop com permit 20. Do show route map. Do clear BGP IPv4 unicast. Oh, not parentheses. Bounce them all again. OK, OK, still receiving it here from ISP 200's perspective.

42:09Let's bounce this. Do clear BGP IPv4 unicast star and do clear BGP IPv4 unicast star because I just don't want to wait. Still sending it outbound.

42:49Hmm. Let's do show BGP IPv4 unicast 141.141.141.141. I don't see the community being set here. Is this because we redistributed this?

43:26Yeah, actually, BGP 65005 address family IPv4 unicast network 141.141.141.141, mask 255.255.255.255. I am going to set that route map back to have a permit statement map. There's a loop-comm 20, show route-map, OK, exit, exit.

44:02Show BGP IPv4 unicast. 141.141.141.141.

44:35Might be something wrong with our prefix list? Access-list standard. Loop ACL permit host. Exit. Show route map. Loop-comm permit 10 match IP access prefix list.

45:10Grr, I can never remember what I type. No. And this loop, ACL is what I named this.

45:51Bounce the neighbors. Ah, well, it's looking better and not advertised to any peer. Unicast 142.142.142.142. Not advertised with any peer. No best path available, though. That is peculiar. Show BGP IPv4-- you know why?

46:41I think we're looking good. Cool, let's now check over here. No, still got it.

47:17OK, so here we've got the community of no exports set. Here we've got the community not set, learn from router two. So let's do, do clear BGP IPv4 unicast all. Let's bounce the session. Back on, looking better. OK, cool. Now, from this point of view, if I do do clear BGP IPv4 unicast star, bounce the session, no more 141.

48:14But no more 140s anyways. Show route map.

49:07There we go. It just took a moment. Just took a moment to resync. Everything's OK. Just took a moment to resync. And we're all good here. It almost had me freaking out. OK, all right, should not be advertised outside. OK, so 9 is done. Configure ISP 300 to only advertise its loopback to ISP 400-4. So we want ISP 300 to only send its loopback outbound towards 400-4. We're not going to send it towards ISP 100. And we're not going to send it outbound towards ISP 400-2.

49:39Well, that's pretty simple to do. There's no really struggle here. We can just use a route map that stops the advertisement in that direction. So let's do configure. Let's do IP access list standard. Let's call this loop something simple like that. Permit post and our loopback was-- do show IP interface brief permit 130.130.130.130.

50:13Let's create the route map, route map. When in doubt, make a route map. Let's call it stop loop. Permit 10, match-- no, no, no, not permit 10, deny 10. Match IP address, what do we call that? Loop. And then we'll do route map stop loop permit 20. So if I do, do show route map, I see that my first set is going to stop the advertisement of the loopback.

50:47The second one is going to permit the advertisement of everything else. So I did a route map config, a router of BGP 300. My neighbor towards 400-2, what is neighbor towards 400-2? Do show IP interface brief, 43. So come on, mouse. Address family IPv4 unicast. My neighbor statement is 172.30.43.40.

51:21Route map was stop loop. Route out. And the same thing was 103.100, OK? Do clear BGP IP list-- because I'm just bouncing them. I'm just clearing them at this point. I want to wait for all these things to sync up. So we're just going to reset them all. So at this point, I stopped the advertisement towards IS-- let's just see on ISP 100.

51:52Show BGP IPv4 unicast. So that was 130. We're are learning 130 via 200, which is probably good because it learned it from 400, who relayed it to 200, and so on. So if I acutally check out 200-- show BGP IPv4 unicast-- I'm learning I don't even have 130. So we're just waiting for it to expire at this point on 100's point of view. Cool, so that looks good.

52:23All right, moving on. So 300 advertises its loopback to only 400-4. The next step is configure BGP, such that ISP 400-4 does not advertise that loopback outside of the local autonomous system. So let's do that. Exit.

52:54Exit. We're going to create an access list. Standard-- let's call it 300 loop, something like that. Invalid access list name. 300 loop, maybe? No. OK, because it wants me to loop 300-- cool. All right, permit post 130.130.130.130.

53:24Route map, it's called just loop 300 again, permit 10, match IP address, loop 300, set community. This is going to be no advertise. Just don't advertise it outside of our local autonomous system. Cool, and then we're going to say everything else goes. So route map loop 300, permit 20-- cool.

53:58And now we're going to go back into router BGP 65006. My neighbor over here is 143-- nope. This guy has to be done-- route maps have to be done in the address family mode. OK, route map-- nope, not route map. It's getting towards the end. Hang in there. 143.143.143.143, route map. And what was that called? Loop 300? Cool-- nope, out-- OK.

54:28All right, so now we get fun. Configure ISP 100 to propagate a default route. Does ISP 100 have a default route ISP? It does have a default route. Can I ping the internet and such? Sure can. So let's propagate this default route. OK, there's two ways to do this. You have to have a couple of commands to make this happen. BGP 100, first, is a default information-- is that in address family mode?

55:05Information originate. Second is a redistribute static. OK, that should do the trick. We have default information originate as well as redistribute static. It is a static default route. So that should do the trick. In just a moment, I should start seeing-- there it is. Default route is being learned this way. Can I ping? There we go. So ISP 200 can now reach the internet, thanks to that default route.

55:37Configure ASN 400 such that traffic entering ASN 400 will enter through ASN 400-4. So we need to make 400-2 look less attractive somehow, maybe by prepending an additional autonomous system hop to the end of it. So let's do routes that we're advertising destined this way should be coming out of 400-2 should have extra autonomous system hops. So to do that, we need to do an AS path ACL.

56:08And I always forget this part. Let's just give it a number, permit, and our regional exposure. So routes that originate from us-- carat, dollar sign-- that's how we do that. And we are going to be using a route map to append autonomous system hops to the end of that. So route map, we'll call this prepend not append. That's what I should have said, prepend, permit. And we will say match AS path 1.

56:42That's it. Match AS path 1. And then we will say set, and that's going to be AS path, right? AS path, prepend, and then however many autonomous systems. Let's just three or something like that. Let's now do the rest of them. We're going to do a route map. We called this prepend, right? Permit 20, OK? All good there. Now we need to advertise those additional hops to ISP 200 and 300. So let's go back and do config t router BGP 65005, address family IPv4 unicast.

57:19Neighbors this direction was 200. Shoot, I'll never remember that. Do show IP interface brief. OK, neighbor 172.30.42.20 route map, prepend. Out. Out. I always forget the out, always forget the out. This is going to be 43.30 prepend out.

57:51So now the routes originating from 400-2 will look like it has to go through 400 three times. OK, configure ASN 200 and 300 to summarize ASN 400's loopbacks as they are advertised to ASN 100. So that's the 141s through 144s. So we're trying to do the aggregate address command, but not on ISP 100 knocks. We're doing it on 200 and 300. We'll do to router of BGP 200, address family IPv4 unicast, the aggregate address command.

58:29And it wants to know what the address is. So let's say I did 128.0.0.0. What would the mask be that would encompass 144? Actually, we could do something more specific than that. Let's think. Think, think, think, think. 128, 32, 38 plus 8. So 138.0.0.0 and then an 8-bit block size would put me up to 146.

59:01So that would be 54, 52, 40-- no. 254, 252-- 248, right?

59:32248, yeah, I think this is it. I don't have any other parameters at this one. Well, that's not going to work, is it? OK, it doesn't like that. OK, think. OK, because it's 8-bit block size. So math-- 128, 136.

1:00:06Nope, that wouldn't work because that would go up to 144. So it's got to be 128. And that would need to be a 32-bit size to reach over 144 because the 16-bit size would stop at 144. So the 32-bit size-- 8, 40, 224, OK.

1:00:38And this is what also needs to be on ISP 300. So we should, after a while, start filtering those out into the summary addresses.

1:01:14Let's just bounce it, let it all sync up. While it's thinking about that, we'll come back to this. Create the summary such that ISP 400-2's loopback is accessed through ISP 300. So ISP 300 is going to have to leak ISP 400-2's loopback, which is 142.142.142.

1:01:50So let's look at ISP 300 here for a second. Do I have a route? Yep, I have a specific route to 142.142.142. So I can create a route map that leaks that out. Let's do this, IP access list standard. It's actually an unsuppress, I keep saying. So let's just call it unsuppress. I'm not even sure if I'm spelling unsuppress right. And I don't care. They're not going to judge me for spelling on the exam, I hope. 142.142.142.142, cool, exit, route map.

1:02:25Unsuppress-- I'm never going to spell it right. Match IP address unsuppress. Yup, that's really all we need to do on that case. Router BGP 300, router BGP 300. This is going to go into address. I'm pretty sure you have to do the unsuppressed map on the neighbor statement?

1:02:59Ah, yes! OK, so now ISP 300 should be advertising 142.142.142.142 outbound. Perform a soft reset outbound from 300 to 100. Clear BGP IPv4 unicast 172.30.103.100 soft outbound. That should do the trick.

1:03:42Cool, cool, cool, cool, cool, cool, cool, cool, cool. All right, I think we've just about accomplished all of our goals here. There's a lot of goals. We did a lot of good work today, a lot of fun. I'm just curious about this aggregate address.

1:04:24Oh, you know what I did? The aggregate address, that's not going to work. Summary only. Ah! There we go. I knew I was missing something. It was still sending those more specific prefixes. Router BGP 300, address family IPv4 unicast. Where is that aggregate address command?

1:04:55There you are-- there. OK, bounce them all one more time. Now, yeah, all right. Let's let it sync up, find its feet.

1:05:28There we go. I love it. There's the summary address. There's the more specific prefix coming in. I love it. This makes me happy. This is great. Cool, so that's it. That summarizes our first task there, bringing the internet network to life-- really took our BGP skills up a notch. So that's it. That's it for the first one. In the next one, what we are going to work on is the MPLS network.

1:05:58We're not going to bring layer 3 VPN to life. We're just going to bring the network to life. And then we're going to bring the customer sites to life. And then we'll bring the MPLS layer 3 VPN and DMVPN to life after that. So that's it. That's it for me. That's it for the first task here, bringing the internet network to life. Thanks for stopping by, y'all. See you in the next one.