BGP(Broader Gateway Protocol)边界网关协议的十三条选路规则详情

1.优先选择具有最大weight值的路由

·Weight属性回顾:

 ·CISCO私有,越大越优先

 ·作用范围是本地路由器(不传递),该值既不会被包含在update消息中,也不会传递给任何BGP邻居

 ·范围0-65535

 ·如果路由是从其他邻居学过来的,则(在本地该路由的WT)默认值是0

 ·本地network产生的路由weight是32768

 ·本地重分发的直连接口路由,静态路由的weight为32768

 ·本地汇总产生的BGP路由weight值也为32768

实验:修改weight值的方法

 

R1(config)#router bgp 100

R1(config-router)#neighbor 10.1.13.3 remote-as 345

R1(config-router)#network 100.0.1.0 mask 255.255.255.0

R2(config-if)#router bgp 200

R2(config-router)#neighbor 10.1.25.5 remote-as 345

R2(config-router)#bgp router-id 2.2.2.2

R2(config-router)#network 100.0.1.0 mask 255.255.255.0

R3(config-if)#router ospf 1

R3(config-router)#router-id 3.3.3.3

R3(config-router)#network 10.1.34.3 0.0.0.0 a 0

R3(config-router)#network 3.3.3.3 0.0.0.0 a 0

R3(config-router)#router bgp 345

R3(config-router)#bgp router-id 3.3.3.3

R3(config-router)#neighbor 10.1.13.1 remote-as 100

R3(config-router)#neighbor 4.4.4.4 remote-as 345

R3(config-router)#neighbor 4.4.4.4 update-source lo0

R4(config)#router ospf 1  

R4(config-router)#router-id 4.4.4.4

R4(config-router)#network 10.1.34.4 0.0.0.0 a 0

R4(config-router)#network 10.1.45.4 0.0.0.0 a 0

R4(config-router)#network 4.4.4.4 0.0.0.0 a 0

R4(config)#router bgp 345

R4(config-router)#neighbor 3.3.3.3 remote-as 345

R4(config-router)#neighbor 3.3.3.3 update-source lo0

R4(config-router)#neighbor 5.5.5.5 remote-as 345

R4(config-router)#neighbor 5.5.5.5 up lo0  

R5(config)#router ospf 1

R5(config-router)#network 5.5.5.5 0.0.0.0 a 0  

R5(config-router)#network 10.1.45.5 0.0.0.0 a 0

R5(config-router)#router-id 5.5.5.5

R5(config)#router bgp 345

R5(config-router)#bgp router-id 5.5.5.5

R5(config-router)#neighbor 10.1.25.2 remote-as 200

R5(config-router)#neighbor 4.4.4.4 remote-as 345

R5(config-router)#neighbor 4.4.4.4 update-source lo0

R3(config-router)#neighbor 4.4.4.4 next-hop-self

R5(config-router)#neighbor 4.4.4.4 next-hop-self

R4(config-router)#do sh ip bgp     //此时优选的是R3

     Network          Next Hop            Metric LocPrf  Weight  Path

 * i 100.0.1.0/24     5.5.5.5                  0    100      0     200   i

 *>i                  3.3.3.3                0   100      0     100    i

如果让;路由100.0.1.1优选R5;

方法一:修改weight值

R4(config-router)#router bgp 345     

R4(config-router)#neighbor 5.5.5.5 weight  10

R4(config)#do sh ip bgp

     Network          Next Hop            Metric LocPrf Weight  Path

 *>i 100.0.1.0/24     5.5.5.5                  0    100     10   200 i

 * i                  3.3.3.3                  0    100    0   100 i

方法二:

R4(config)#acc 1 permit 100.0.1.0/24

R4(config)#route-map test permit 10

R4(config-route-map)#match ip address 1

R4(config-route-map)#set weight 100

R4(config)#router bgp 345

R4(config-router)#neighbor 5.5.5.5 route-map test in   //只能是in方向的,因为weight是不能传的。

R4(config)#do sh ip bgp

     Network          Next Hop            Metric LocPrf Weight Path

 * i 100.0.1.0/24     3.3.3.3                  0    100      0 100 i

 *>i                  5.5.5.5                  0    100    100 200 i

2.优选具有最大的Locl-Pref值的路由

 ·公认自决属性,值越大越优先

 ·LOCAL-PREF只能在IBGP Peer之间传递,只能在AS 内部传。

 ·默认情况下,本地始发的路由的LP为100

   -可用bgp default local-preference ?修改默认值

 ·BGP路由器在向其EBGP邻居发送路由更新时,不能携带LP属性,但是对方会在本地为这条路由敷一个默认值,也就是100.然后在传递给自己的IBGP邻居

 ·本地networt及重分发的路由,LP默认100.并能在AS内向其他IBGP邻居传输,传输过程中非部署策略,否则LP不变。

实验:让R4从R5访问100.0.1.0,通过route-map修改本地优先级

R5(config)#ip prefix-list 1 permit 100.0.1.0/24

R5(config)#route-map test per 10

R5(config-route-map)#match ip add prefix-list 1

R5(config-route-map)#set local-preference 101

R5(config)#router bgp 345

R5(config-router)#neighbor 4.4.4.4 route-map test out

R4(config)#do sh ip bgp

     Network          Next Hop            Metric  LocPrf  Weight Path

 * i 100.0.1.0/24     3.3.3.3                  0      100      0   100 i

 *>i                  5.5.5.5                  0   101       0   200 i

此实验可以在R3做,和R5的一样,也可以在R5上做,把in改成out。

在R4上做:

3. 优选起源于本地的路由(如本地Network、aggreget或redistribute的)既下一跳是0.0.0.0(在BGP表中,当前路由器通告的路由的下一跳为0.0.0.0)

 

R3(config)#ip route 8.0.0.0 255.0.0.0 null 0

R3(config)#router bgp 345

R3(config-router)#network 8.0.0.0 mask 255.0.0.0

R4(config)#ip route 8.0.0.0 255.0.0.0 null 0

R4(config)#router bgp 345

R4(config-router)#network 8.0.0.0 mask 255.0.0.0

R4(config)#do sh ip bgp

     Network          Next Hop            Metric LocPrf Weight Path

 *>  8.0.0.0          0.0.0.0                  0         32768 i

 * i                  3.3.3.3                  0    100      0 i

R4(config)#route-map test permit   //修改weight值为0.

R4(config-route-map)#set weight 0

R4(config-route-map)#router bgp 345

R4(config-router)#network 8.0.0.0 mask 255.0.0.0 route-map test

4.优选AS-path最短的路由

 ·as-path的策略,只能在AS之间执行,因为as-path只会在离开AS的时候发生改变,只会在EBGP之间发生变化。

 ·规则补充:在做聚合路由时,使用as-set关键字后产生的AS-path列表中的{}里的AS号长度只算一个AS号的长度

 ·在联邦内的AS-PATH列表中的()内的AS号长度不做计算依据

 

R3(config)#ip prefix-list 1 permit 100.0.1.0/24

R3(config)#route-map test

R3(config-route-map)#match ip add per 1

R3(config-route-map)#set as-path prepend 888

R3(config)#router bgp 345

R3(config-router)#neighbor 10.1.13.1 route-map test in

R3(config)#do cle ip bgp *

R3(config)#do sh ip b    //如果在R1上做,path就会变成100.800

     Network          Next Hop            Metric LocPrf Weight   Path

 *   100.0.1.0/24     10.1.13.1                0             0  888 100 i

5.Origin(IGP>BGP>incommplete)

 ·这条路由的起源类型

 ·不推荐用此规则来影响BGP决策或数据走向

实验:让100.0.1.0优选R5

方法一:修改Origin值

R1(config)#ip prefix-list 1 permit 100.0.1.0/24

R1(config)#route-map test

R1(config-route-map)#match ip add prefix-list 1

R1(config)#router bgp 100

R1(config-router)#redistribute connected route-map test  使用重发布

R1(config)#do sh ip bgp

     Network          Next Hop            Metric LocPrf Weight Path

 *>  100.0.1.0/24     0.0.0.0                  0         32768   ?

R4(config)#do sh ip bgp

     Network          Next Hop            Metric LocPrf Weight Path

 * i 100.0.1.0/24     3.3.3.3                  0    100      0  100  ?

 *>i                  5.5.5.5                  0    100   0  200  i // i>e>?,优选R5

方法二:使用route-map做引入路由方式

R1(config)#route-map test permit 10

R1(config-route-map)#set origin incomplete

R1(config)#router bgp 100

R1(config-router)#network 100.0.1.0 mask 255.255.255.0

6.优选MED最小的路由,默认情况下仅有当所有的备选路由来自同一AS才会比较MED

 ·MED属性:

   -可选非传递属性,值越小越优先,一般用于AS之间影响BGP路由决策

 ·MED属性设置方法:

-将IGP路由引入BGP时关联Routre-map进行设置

   -对BGP Peer应用IN/OUT方向的Route-map进行设置

   -非Route-map(自动)方式:

       ·使用network或redistribute方式将IGP路由引入BGP时,MED将继承   

         IGP路由的Metric(直连路由及静态路由的Metric为0)

       ·使用aggregate-address方式引入路由,则MED为空。

 ·MED注意事项:

   -默认情况下,只比较来自同一邻居AS的BGP路由的MED值,就是说如果同一个目的地的两条路由来自不同的AS,则不进行MED值的比较,如果仍希望比较来自不同邻接AS对的路由,可使用如下命令。

     ·bgp always-compare-med  //用这条命令进行比较

   -MDE只是在直连相连的自制系统间影响业务量,而不会跨越AS传递

实验

R4(config)#route-map test

R4(config-route-map)#match ip add prefix-list 1

R4(config-route-map)#set metric 100   //修改metric值

R4(config-route-map)#router bgp 345

R4(config-router)#neighbor 3.3.3.3 route-map test in   //对R3做

R4(config-router)#bgp always-compare-med

R4(config)#do sh ip bgp

     Network          Next Hop            Metric  LocPrf Weight Path

 * i 100.0.1.0/24         3.3.3.3               100    100      0 100 i

 *>i                   5.5.5.5                 0    100      0 200 i

7.优选EBGP邻居发来的路由(相对于IBGP邻居学来的),在联邦EBGP和IBGP中首选联邦EBGP路由

实验:

R4(config)#router bgp 345

R4(config-router)#neighbor 3.3.3.3 route-reflector-client   //将R4配置成路由反射器,将R3上的10.0.1.0路由传递该R5。

R5(config)#do sh ip bgp

     Network          Next Hop            Metric LocPrf  Weight  Path

 * i 100.0.1.0/24     3.3.3.3                  0    100      0    100   i  //IBGP传过来的

 *>                   10.1.25.2             0             0   200   i  //EBGP传过来的

 

8. 优选到BGP NEXT-HOP最近的邻居

 ·注意:这里严格的说应该这样表述:我从两个BGP邻居各收到一条路由,这两条BGP路由有相同的路由前缀,首先这两条BGP路由的NEXT-HOP是不相同的,否则不具有可比性,那么我比较本地到达这两个NEXT-HOP的IGP度量值,谁metric小,我就会选谁。

 

实验:

R4(config)#int s1/0  

R4(config-if)#ip os

R4(config-if)#ip ospf co

R4(config-if)#ip ospf cost 1111   //在与R3的接口下,修改cost值,是路由从R5过来。

R4(config)#do sh ip bgp

     Network          Next Hop            Metric LocPrf Weight Path

 * i 100.0.1.0/24     3.3.3.3                  0    100      0 100 i

 *>i                  5.5.5.5                  0    100      0 200 i

R4(config)#do sh ip rou

O        3.3.3.3 [110/1112] via 10.1.34.3, 00:02:21, Serial1/0   //比较到达下一跳的metric值,优选小的metric值。

O        5.5.5.5 [110/65] via 10.1.45.5, 1d20h, Serial1/1

为什么优选R3???

9.BGP负载均衡

 ·当前面的8条选路原则都无法优选出最优路由时,并且在BGP 进程下面配置了maximun-paths[ibgp]n,n的取值为2-6,那么将执行等价负载均衡,也就是将这些等代价的BGP路径都放进IP路由表使用,但是要注意,虽然这些路径在本地都用了,最终却只有一条BGP路径是best最优的。

 ·具备等价负载均衡条件的候选路径需满足如下条件:

   -必须有相同的路径属性,如weight、LP、AS-PATH(不仅是长度,整个AS-PATH包括AS号都要相同)、origin code、MED及IGP的Distance值

   -每一条路径的下一跳都不相同。

 ·maximum-path[ibgp]n

   -如果不关联ibgp关键字,那么只会对extenal路由执行等价负载均衡(默认只对EBGP路由)

   -如果要对Internal路由做负载均衡,则需关联ibgp关键字

   -如果不配置maximum-paths,那么将进行下一跳选路原则。

实验:删除R1R2上的BGP,建立AS为12的BGP

R4(config)#do sh ip bgp 100.0.1.0   //符合等值负载均衡的条件的。

  12

    5.5.5.5 (metric 65) from 5.5.5.5 (5.5.5.5)

      Origin IGP, metric 0, localpref 100, valid, internal

      rx pathid: 0, tx pathid: 0

  Refresh Epoch 1

  12, (Received from a RR-client)

    3.3.3.3 (metric 65) from 3.3.3.3 (3.3.3.3)

      Origin IGP, metric 0, localpref 100, valid, internal, best

      rx pathid: 0, tx pathid: 0x0

R4(config)#do sh ip rou

      5.0.0.0/32 is subnetted, 1 subnets

O        5.5.5.5 [110/65] via 10.1.45.5, 1d22h, Serial1/1

B        100.0.1.0 [200/0] via 3.3.3.3, 00:01:50    //因为3.3.3.3是best,所以下一跳优选3.3.3.3,在进行递归,

      3.0.0.0/32 is subnetted, 1 subnets

O        3.3.3.3 [110/65] via 10.1.34.3, 00:01:55, Serial1/0  //3.3.3.3不是直连,在递归3.3.3.3的下一跳是10.1.34.3 s1/0直连

R4(config)#do sh ip cef 100.0.1.0

100.0.1.0/24

  nexthop 10.1.34.3 Serial1/0

R4(config)#router bgp 345

R4(config-router)#no maximum-paths ibgp 2

R4(config)#do sh ip bgp 100.0.1.0

Multipath: iBGP

  Advertised to update-groups:

     27        

  Refresh Epoch 1

  12, (Received from a RR-client)

    3.3.3.3 (metric 65) from 3.3.3.3 (3.3.3.3)

      Origin IGP, metric 0, localpref 100, valid, internal, multipath, best  //multipath代表符合负载均衡条件的

      rx pathid: 0, tx pathid: 0x0

  Refresh Epoch 1

  12

    5.5.5.5 (metric 65) from 5.5.5.5 (5.5.5.5)

      Origin IGP, metric 0, localpref 100, valid, internal, multipath(oldest)

      rx pathid: 0, tx pathid: 0

R4(config)#do sh ip rou   //此时路由表里会出现两个下一跳

B        100.0.1.0 [200/0] via 5.5.5.5, 00:06:58

                   [200/0] via 3.3.3.3, 00:06:58

10.优选最老的EBGP路由,降低滚翻的影响(此条主要对EBGP路由起效,但是现在基本不用该条,因不确定性太大)

11.BGP邻居的RID越小越优先  

 

R1(config)#router bgp 123

R1(config-router)#bgp router-id 1.1.1.1  //把RID值改小

R2(config)#do sh ip bgp 100.0.1.0

    10.1.12.1 from 10.1.12.1 (1.1.1.1)

      Origin IGP, metric 0, localpref 100, valid, internal, best

      rx pathid: 0, tx pathid: 0x0

  Refresh Epoch 1

  Local

    10.1.23.3 from 10.1.23.3 (100.0.1.1)

      Origin IGP, metric 0, localpref 100, valid, internal

      rx pathid: 0, tx pathid: 0

R1(config-router)#bgp router-id 111.111.111.111   //大RID值改大

R2(config)#do sh ip bgp 100.0.1.0

    10.1.12.1 from 10.1.12.1 (111.111.111.111)

      Origin IGP, metric 0, localpref 100, valid, internal

      rx pathid: 0, tx pathid: 0

  Refresh Epoch 1

  Local

    10.1.23.3 from 10.1.23.3 (100.0.1.1)

      Origin IGP, metric 0, localpref 100, valid, internal, best

 ·规则补充:如果一条路径包含RR属性originator属性值将在规则11的最优路径选择过程中代替RouterID

就是说如果有RR出现,则两个RID值相等,就不能用11比较

 

12.优选Cluster-List最短的路由

 

 

R1(config)#int lo0

R1(config-if)#ip add 1.1.1.1 255.255.255.0

R1(config)#int lo1

R1(config-if)#ip add 11.11.11.11 255.255.255.0

R1(config-if)#router ospf 1

R1(config-router)#network 10.1.12.1 0.0.0.0 a 0

R1(config-router)#network 1.1.1.1 0.0.0.0 a 0

R1(config)#router bgp 123

R1(config-router)#neighbor 2.2.2.2 remote-as 123

R1(config-router)#neighbor 2.2.2.2 update-source lo0

R1(config-router)#network 11.11.11.0 mask 255.255.255.0

R2(config)#int lo0

R2(config-if)#ip add 2.2.2.2 255.255.255.0

R2(config)#router ospf 1

R2(config-router)#network 10.1.12.2 0.0.0.0 a 0

R2(config-router)#network 10.1.23.2 0.0.0.0 a 0

R2(config-router)#network 2.2.2.2 0.0.0.0 a 0

R2(config)#router bgp 123

R2(config-router)#neighbor 1.1.1.1 remote-as 123

R2(config-router)#neighbor 10.1.12.1 remote-as 123

R2(config-router)#neighbor 1.1.1.1 update-source lo0          

R2(config-router)#neighbor 3.3.3.3 remote-as 123

R2(config-router)#neighbor 3.3.3.3 update-source lo0

R2(config-router)#nei 1.1.1.1 route-reflector-client   //配置路由反射器

R3(config)#int lo0

R3(config-if)#ip add 3.3.3.3 255.255.255.0

R3(config-if)#router ospf 1

R3(config-router)#network 3.3.3.3 0.0.0.0 a 0

R3(config-router)#network 10.1.23.3 0.0.0.0 a 0

R3(config)#router bgp 123

R3(config-router)#neighbor 2.2.2.2 remote-as 123

R3(config-router)#neighbor 2.2.2.2 update-source lo0

R3(config-router)#neighbor 1.1.1.1 remote-as 123

R3(config-router)#neighbor 1.1.1.1 update-source lo0

R3(config)#do sh ip bgp 11.11.11.11   //都是IBGP邻居关系

    1.1.1.1 (metric 129) from 1.1.1.1 (1.1.1.1)  

      Origin IGP, metric 0, localpref 100, valid, internal, best  

      rx pathid: 0, tx pathid: 0x0

    1.1.1.1 (metric 129) from 2.2.2.2 (2.2.2.2)

      Origin IGP, metric 0, localpref 100, valid, internal

      Originator: 1.1.1.1, Cluster list: 2.2.2.2  

      rx pathid: 0, tx pathid: 0   //因为这个是11 的RR情况,就是1.1.1.1和1.1.1.1比,比不出来,所以用规则12来比较。

Cluster list: 2.2.2.2 //比较。因为1.1.1.1更本就没有,所以选择上面的1.1.1.1最优。

13.选择邻居IP地址(BGP的neighbor配置中的那个地址最小的路由)

 

 

  • 2
    点赞
  • 6
    收藏
    觉得还不错? 一键收藏
  • 1
    评论
This book had its origins in the Multiprocessor System-on-Chip (MPSoC) Work- shop, which has been held every summer since 2001. We started the workshop to bring together a broad range of people who need to be involved in SoC design. MPSoCs are much more complex than ASICs and so require traditionally separate disciplines to converge. Computer architecture, real-time operating systems, embedded software, computer-aided design, and circuit design are all fields that must contribute to successful MPSoC designs. An outstanding cross-section of experts from these disciplines attended the workshop and gave tutorial lectures that introduced their fields to the broader audience. We started to talk about how to make use of all the information that was presented at the workshop and make it available to a broader audience. After some debate we decided to organize a book of contributed chapters. The contents of the book evolved somewhat as we developed it. Some of the workshop speakers didn’t have enough room in their schedules for the consider- able effort it takes to write a chapter. As a result, we ended up asking several other groups of people to write chapters. This allowed us to bring more perspectives into the discussion of MPSoC design. Thanks to a great deal of effort, the book is now a reality. We believe that it will be useful to both professionals who want to know more about multiprocessor SoCs and students who are studying the subject. We hope that this collection of material will be informative and long-lasting. We’d like to thank the IEEE Circuits and Systems Society and the European Design and Automation Association for their sponsorship of the MPSoC Workshop over the years. We would like to thank all the participants—speakers and attendees—of the MPSoC workshops. We would WMSPR 8/11/04 3:08 PM Page xix like to thank all of the authors for their work in creating these chapters. We would like to thank the book’s reviewers: Nikil Dutt, University of California, Irvine; Axel Jantsch, Royal Institute of Technology (Stockholm, Sweden); Dan Phillips, Rochester Institute of Technology; Miodrag Potkonjak, UCLA; Gerald E. Sobelman, University of Minnesota; and James M. Ziobro, Rochester Institute of Technology. And we would like to thank the staff at Morgan Kaufman/Elsevier for their tire- less efforts to make this book a reality. Ahmed Amine Jerraya, Grenoble, France Wayne Wolf, Princeton, New Jersey
PAGE 1 CHAPTER ONE INTRODUCTION nformation security continuous monitoring (ISCM) is defined as maintaining ongoing awareness of information security, vulnerabilities, and threats to support organizational risk management decisions. 2 This publication specifically addresses assessment and analysis of security control effectiveness and of organizational security status in accordance with organizational risk tolerance. Security control effectiveness is measured by correctness of implementation and by how adequately the implemented controls meet organizational needs in accordance with current risk tolerance (i.e., is the control implemented in accordance with the security plan to address threats and is the security plan adequate).3 • Maintaining situational awareness of all systems across the organization; Organizational security status is determined using metrics established by the organization to best convey the security posture of an organization’s information and information systems, along with organizational resilience given known threat information. This necessitates: • Maintaining an understanding of threats and threat activities; • Assessing all security controls; • Collecting, correlating, and analyzing security-related information; • Providing actionable communication of security status across all tiers of the organization; and • Active management of risk by organizational officials. Communication with all stakeholders is key in developing the strategy and implementing the program. This document builds on the monitoring concepts introduced in NIST SP 800-37 Rev. 1, Guide for Applying the Risk Management Framework to Federal Information Systems: A Security Life Cycle Approach. An ISCM program helps to ensure that deployed security controls continue to be effective and that operations remain within stated organizational risk tolerances in light of the inevitable changes that occur over time. In cases where security controls are determined to be inadequate, ISCM programs facilitate prioritized security response actions based on risk. An ISCM strategy is meaningful only within the context of broader organizational needs, objectives, or strategies, and as part of a broader risk management strategy, enabling timely 2 The terms “continuous” and “ongoing” in this context mean that security controls and organizational risks are assessed and analyzed at a frequency sufficient to support risk-based security decisions to adequately protect organization information. Data collection, no matter how frequent, is performed at discrete intervals. 3 NIST SP 800-53A, as amended, defines security control effectiveness as “the extent to which the controls are implemented correctly, operating as intended, and producing the desired outcome with respect to meeting the security requirements for the system.”

“相关推荐”对你有帮助么?

  • 非常没帮助
  • 没帮助
  • 一般
  • 有帮助
  • 非常有帮助
提交
评论 1
添加红包

请填写红包祝福语或标题

红包个数最小为10个

红包金额最低5元

当前余额3.43前往充值 >
需支付:10.00
成就一亿技术人!
领取后你会自动成为博主和红包主的粉丝 规则
hope_wisdom
发出的红包
实付
使用余额支付
点击重新获取
扫码支付
钱包余额 0

抵扣说明:

1.余额是钱包充值的虚拟货币,按照1:1的比例进行支付金额的抵扣。
2.余额无法直接购买下载,可以购买VIP、付费专栏及课程。

余额充值