BGP Prefix Limit Configuration in Cisco, Juniper and Nokia - Interop

BGP Prefix Limit

Maximum Prefix-limit is used to control the BGP peer not to overload your BGP routing table and it helps to avoid the situation. let's explore how to configure in Cisco, Juniper, and Nokia router

Cisco Configuration

 !

router bgp 300

 neighbor 192.168.1.1

  address-family ipv4 unicast

   maximum-prefix <max-limit> <percentage> <Actions>

  !

 !

Juniper  Configuration

edit protocol
bgp {
        group nokia {
            neighbor 192.168.0.1 {
                family inet {
                    unicast {
                        prefix-limit {
                            maximum 1000;
                            teardown;
                        }
                    }

Nokia Configuration

/configure router bgp

            group "juniper"

                type external

                local-as 100

                neighbor 192.168.0.2

                    prefix-limit <family> <prefix-limit>

                    peer-as 200

                exit

   

BGP MD5 Configuration on Cisco - Juniper - Nokia Interop

 In this blog, I will explain the benefits of the MD5 concept and how to configure it on Cisco, Juniper, and Nokia Router

TCP-MD5

MD5 is used to protect the BGP session between the peers to form the secured session over the public Network. 

TCP MD5 option supports only one key for a connection. Further, it only supports the MD5 algorithm. The MD5 algorithm takes the “secret” from the key and the TCP segment for encryption and generates a message digest. This message digest is then copied to the MD5 digest field in the TCP segment and is sent to the receiving device.

Cisco XR

router bgp 300

 neighbor 192.168.1.1

  password encrypted 011D03104C0414042D4D4C

Juniper

edit protocols {                             

    bgp {

        group nokia {

            neighbor 192.168.0.1 {

                authentication-key "key"; ## SECRET-DATA

                }

      

Nokia

/configure router 

protocols {                             

    bgp {

     group "juniper"

                type external

                local-as 100

                neighbor 192.168.0.2

                    authentication-key "D8XsPtn4bCNLm" hash2

                    peer-as 200

                exit

BGP Protection - TTL Security Configuratoion Cisco, Juniper and Nokia

Hi Everyone,

In the blog, I am going to explain how TTL security is useful in BGP Session protection. Time to Live will be added to every packet and it will be reduced at each hop it transfers.

Consider someone who wants to hack your BGP session and will send the spoofed  BGP packets and try to negotiate with your BGP session. to avoid this kind of spoofing we use TTL Security

TTL security is a mechanism that evaluates the TTL value of incoming IP packets to ensure

that they have not been faked. The IP TTL value will be set to 255 by directly connected BGP

peers, making it impossible to relay spoof Internet protocol with TTL=255 through non

directly connected interfaces.

Cisco XR

router bgp 100
 neighbor-group ebgp
  ttl-security
 !
neighbor 192.168.1.1
  remote-as 100
  use neighbor-group ebgp
  address-family ipv4 unicast
  !
 !

Juniper 

protocols {                             
    bgp {
        group nokia {
            type external;
            neighbor 192.168.0.1 {
                ttl <1-255>;
                peer-as 100;
                local-as 200;
            }

Nokia vSR

router bgp 
 group "juniper"
                type external
                local-as 100
                ttl-security <1-255>
                neighbor 192.168.0.2
                    peer-as 200
                exit
            exit

How to add Cisco IOU Image on Eve-ng Up and Running

Step 1#

Download Linux L2/L3 adventerprise Image 

Step 2#

Upload the downloaded image to the EVE path /opt/unetlab/addons/iol/bin/ using WinSCP or Filezilla

Step 3#

Fix the permission for the added image using the below command

/opt/unetlab/wrappers/unl_wrapper -a fixpermissions

Step 4#

Create an iou keygen file Copy the Cisco IOU Image Script provided below and add to the script

vim /opt/unetlab/addons/iol/bin/ioukeygen.py

Esc:wq

Step 5#

Fix the permission for the Python script

chmod –x vim /opt/unetlab/addons/iol/bin/ioukeygen.py

Step 6#

Run the license generator script 

/opt/unetlab/addons/iol/bin/ioukeygen.py

copy the license generated by the script

Step 7#

Create iourc license file for your EVE

vim /opt/unetlab/addons/iol/bin/iourc

Paste the output captured in Step 6

Step 8#

Fix the permission and start practicing your lab by adding the image on eve-ng web

/opt/unetlab/wrappers/unl_wrapper -a fixpermissions

Cisco IOU Image Script#

#! /usr/bin/python3

print("*********************************************************************")

print("Cisco IOU License Generator - Kal 2011, python port of 2006 C version")

import os

import socket

import hashlib

import struct

# get the host id and host name to calculate the hostkey

hostid=os.popen("hostid").read().strip()

hostname = socket.gethostname()

ioukey=int(hostid,16)

for x in hostname:

 ioukey = ioukey + ord(x)

print("hostid=" + hostid +", hostname="+ hostname + ", ioukey=" + hex(ioukey)[2:])

# create the license using md5sum

iouPad1 = b'\x4B\x58\x21\x81\x56\x7B\x0D\xF3\x21\x43\x9B\x7E\xAC\x1D\xE6\x8A'

iouPad2 = b'\x80' + 39*b'\0'

md5input=iouPad1 + iouPad2 + struct.pack('!i', ioukey) + iouPad1

iouLicense=hashlib.md5(md5input).hexdigest()[:16]

print("\nAdd the following text to ~/.iourc:")

print("[license]\n" + hostname + " = " + iouLicense + ";\n")

with open("iourc.txt", "wt") as out_file:

   out_file.write("[license]\n" + hostname + " = " + iouLicense + ";\n")

print("^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^\nAlready copy to the file iourc.txt\n ")

print("You can disable the phone home feature with something like:")

print(" echo '127.0.0.127 xml.cisco.com' >> /etc/hosts\n")

# end of the script

Final output on eve-ng

Refer to the video with the steps