Source INE
Route aggregation is the key for information hiding. It is critical to BGP because of
the tremendous amount of routing information passed on the Internet. There are
three basic ways to do summarization in BGP:
- Create a summary prefix in IGP and advertise it into BGP using the network
command. This is usually accomplished by creating a static route to Null0 in the
routing table of the advertising router. This is a common way to advertise local
prefixes into BGP. However, you cannot summarize external BGP prefixes using this
method.
- Use auto-summarization. As discussed in another task, this method summarizes
networks to their classful boundaries and only applies to redistributed prefixes or
when using the classful network command. It is not used in modern networks.
- Summarize prefixes found in BGP tables by using the aggregate-address command.This is the most flexible way to do summarization, because it may be applied to any paths learned by the BGP speaker.
The syntax for the command is aggregate-address <prefix> <mask>
For the command to work, there must be a subnet in the BGP table that is encompassed by
the summarized prefix. For example, if you issue the command aggregate-address
192.168.0.0 255.255.0.0 , at least one subnet, such as 192.168.1.0/24, must be in the
BGP table (Loc-RIB), but it does not necessarily need to be in the router’s routing
table (RIB).
If you do not specify any additional options to the command, it will create a new
prefix in the BGP table with an empty AS_PATH. It will look like the new prefix was
originated in the local AS. The new prefix will automatically have the weight value of
32768 and have a special attribute called ATOMIC_AGGREGATE assigned. The
new attribute is informational and tells the other BGP speakers that this prefix is a
result of route aggregation, and some information (like AS_PATH or other attributes)
from the original prefixes may be missing. In addition to the ATOMIC_AGGREGATE
attribute, BGP attaches another attribute called AGGREGATOR to the summarized
prefix. This attribute specifies the AS number and the BGP router-ID of the
aggregating router. Just like the ATOMIC_AGGREGATE, the new attribute is also
informational.
For every aggregate, the BGP process will install an automatic static route to Null0
for the new prefix, to prevent routing loops. Remember that the original (specific)
prefixes are still advertised, unlike in IGP, where summarization automatically
suppresses more specific prefixes.
BGP Aggregation – Summary Only
router bgp ***
aggregate-address 10.1.0.0 255.255.252.0 summary-only
BGP summarization using the aggregate address command creates new prefixes in the BGP table but does not suppress the advertisement of the specific prefixes that make up the summary. To generate just the summary prefix, use the option summary-only after the aggregate-address command. The BGP process will automatically suppress advertisement of the
prefixes in the BGP table encompassed by the new summary address.
R#show ip bgp | include 10.0.
s> 10.0.0.0/24 0.0.0.0 0 32768 i
*> 10.0.0.0/22 0.0.0.0 32768 i
s> 10.0.1.0/24 0.0.0.0 0 32768 i
s> 10.0.2.0/24 0.0.0.0 0 32768 i
s> 10.0.3.0/24 0.0.0.0 0 32768 i
BGP Aggregation – Suppress Map
When you specify the summary-only keyword, all specific prefixes are suppressed. It
is possible to suppress prefixes selectively, using a route-map associated via the
parameter suppress-map . The prefixes permitted by this route-map are suppressed;
prefixes denied by this route-map are NOT suppressed when performing
summarization.
ip prefix-list NET_2 permit 10.0.2.0/24
!
route-map SUPPRESS_MAP deny 10
match ip address prefix-list NET_2
!
route-map SUPPRESS_MAP permit 100
!
router bgp 200
aggregate-address 10.0.0.0 255.255.252.0 suppress-map SUPPRESS_MAP
The above example allows the 10.0.2.0/24 subnet to be leaked through the summary , the rest of the prefix’s are suppressed.Note the DENY Statement on the route-map.& Seq 100 blocks the rest.
BGP Aggregation – Unsuppress Map
It is often desirable to load-balance traffic ingress to the local AS, so that traffic to some subnets enters via one BGP peer and the other peer is used as the entry point for other subnets. Generally, to accomplish this, you need to advertise all specific prefixes on both uplinks and use AS_PATH prepending to modify prefixes’preference. This scheme implements load balancing and provides backup in case of any uplink failures.However, it is possible to achieve the same goal using a different technique. It is based on the fact that classless routing always prefers the most specific prefix to reach the destinations. If there is a specific prefix in the routing table (for example, 10.0.1.0/24) and the summary one (for example, 10.0.0.0/22), the router will prefer /24 and use /22 only if the most specific prefix vanishes. Thus, by configuring the
border BGP peers for advertising both the summary and selected specific prefixes, you may achieve the same load-balancing with the necessary level of redundancy. To implement this technique, you may use the unsuppress-map BGP feature. This feature can only be configured on the router that performs prefix aggregation using the command aggregate-address with summary-only .
ip prefix-list NET_1 permit 10.0.1.0/24
!
route-map UNSUPPRESS_MAP permit 10
match ip address prefix-list NET_1
!
router bgp 200
aggregate-address 10.0.0.0 255.255.252.0 summary-only
neighbor 155.1.37.7 unsuppress-map UNSUPPRESS_MAP
BGP Aggregation – AS-Set
It is important to remember that aggregation hides information previously found in the specific prefixes. This includes all attributes, such as NEXT_HOP, AS_PATH, and so on. The new prefix appears to be originated from within the local AS where aggregation is perfpormed. This causes no problems if all specific prefixes belong to
the local AS. However, when you summarize prefixes learned from other ASs, information hiding may result in the following dangerous consequences:
- Suboptimal routing, caused by loss of path information, such as AS_PATH, MED and
so on.
- Routing loops, because removing the AS_PATH attribute and replacing it with an
empty list prevents the BGP loop-detection mechanism from working properly.
The second issue is more dangerous.
To prevent it, it is possible to insert a special new member into the AS_PATH of the newly created summary prefix. This elementis called AS_SET and contains the AS numbers found in all AS_PATHs of the specific prefixes.This list of AS numbers is unordered, unlike the regular AS_SEQUENCE element. Its only use is for routing loop prevention; when BGP
receives a prefix, it scans the AS_PATH attribute. If the local AS number is found in any of the AS_SET or AS_SEQUENCE elements, the prefix is dropped. By default, the aggregated address in BGP will not include the AS-Set information.
To force the use of this information, specify the as-set option as follows: aggregate address <subnet> <mask> as-set
BGP Aggregation – Attribute-Map
When you use the as-set parameter to the aggregate-address command, the resulting prefix will inherit “additive” attributes of the specific prefixes. This includes the AS_PATH attributes, condensed into AS_SET and the community attributes, which are grouped together from all prefixes. We will explore community signaling in further detail, but for now remember that any prefix bearing the community attribute value of “no-export” is not advertised to the adjacent ASs.
route-map ATTR_MAP
set community none
router bgp 200
aggregate-address 112.0.0.0 248.0.0.0 summary-only as-set attribute-map ATTR_MAP
BGP Aggregation – Advertise Map
When using the as-set keyword with BGP aggregation, some of the specific prefix attributes got mixed together in the new prefix. Specifically, you should watch out for the resulting AS_SET and list of community attributes. In the previous task, you learned how to modify some of the aggregated prefix attributes. However, you cannot manipulate an important attribute such as AS_SET directly. Instead, you may specify the specific prefixes that will be used to make up the attribute list for the aggregate prefix. This is accomplished by using the advertise-map parameter to the aggregate-address command. The route-map used as advertise-map should permit specific prefixes to be used to compose the aggregate attributes, such as AS_SET. You can use only access-list, prefix-list, or as-path access-lists to match the specific
prefixes. Information from the prefixes denied by the route-map is not used when constructing the resulting summary-prefix. You may use this method to remove the prefixes with unwanted BGP community attributes as well.
ip prefix-list AS300_PREFIX permit 222.22.3.0/24
route-map ADVERTISE_MAP deny 10
match ip address prefix-list AS300_PREFIX
route-map ADVERTISE_MAP permit 100
router bgp 100
aggregate-address 222.22.0.0 255.255.252.0 summary-only as-set advertise-map ADVERTISE_MAP
DOVICHNETWORKS 