فهم BGP RPKI مع التقرير الرسمي ل XR7 Cisco8000

• صالح - يشير إلى العثور على البادئة وزوج AS في جدول ذاكرة التخزين المؤقت ل RPKI. 

• غير موجود - يشير إلى أن البادئة ليست من بين البادئات الصالحة أو غير الصالحة.

يناقش هذا القسم كل بادئة وحالتها بالتفصيل.

1. 203.0.113.0/24 - صالح

قام نظير eBGP في AS 8100 بإنشاء هذا الموجه والإعلان عنه لعقدة Cisco8000. بما أن أصل AS (8100) يطابق أصل AS في ROA (تم إستلامه من أداة التحقق من الصحة)، يتم تمييز هذه البادئة بأنها صحيحة ويتم تثبيتها في جدول توجيه الموجه.

RP/0/RP0/CPU0:Cisco8000#show bgp rpki table | in "203.0.113.0|Max"

Thu Jan 21 00:21:26.026 UTC

  Network               Maxlen          Origin-AS         Server

  203.0.113.0/24                24       8100              192.168.122.120

يتم تثبيت المسار في جدول BGP.

RP/0/RP0/CPU0:Cisco8000#show bgp 203.0.113.0/24

Thu Jan 21 05:30:13.858 UTC

BGP routing table entry for 203.0.113.0/24

Versions:

  Process           bRIB/RIB  SendTblVer

  Speaker                 31          31

Last Modified: Jan 21 00:03:33.344 for 05:26:40

Paths: (1 available, best #1)

  Not advertised to any peer

  Path #1: Received by speaker 0

  Not advertised to any peer

  8100

    10.0.12.2 from 10.0.12.2 (192.168.122.105)

      Origin incomplete, metric 0, localpref 100, valid, external, best, group-best

      Received Path ID 0, Local Path ID 1, version 31

      Origin-AS validity: valid

ونظرا لأن هذه هي أفضل بادئة BGP وصالحة أيضا لكل RPKI، يتم تثبيتها بنجاح في جدول التوجيه.

RP/0/RP0/CPU0:Cisco8000#show route 203.0.113.0/24

Thu Jan 21 00:29:43.667 UTC




Routing entry for 203.0.113.0/24

  Known via "bgp 100", distance 20, metric 0

  Tag 8100, type external

  Installed Jan 21 00:03:33.731 for 00:26:10

  Routing Descriptor Blocks

    10.0.12.2, from 10.0.12.2, BGP external

      Route metric is 0

  No advertising protos.

RP/0/RP0/CPU0:Cisco8000#show bgp origin-as validity invalid

Thu Jan 21 00:34:38.171 UTC

BGP router identifier 10.1.1.1, local AS number 100

BGP generic scan interval 60 secs

Non-stop routing is enabled

BGP table state: Active

Table ID: 0xe0000000   RD version: 33

BGP main routing table version 33

BGP NSR Initial initsync version 2 (Reached)

BGP NSR/ISSU Sync-Group versions 0/0

BGP scan interval 60 secs


Status codes: s suppressed, d damped, h history, * valid, > best

              i - internal, r RIB-failure, S stale, N Nexthop-discard

Origin codes: i - IGP, e - EGP, ? - incomplete

   Network            Next Hop            Metric LocPrf Weight Path

*  203.0.113.1/24     10.0.12.2                0             0 8100 ?

RP/0/RP0/CPU0:Cisco8000#show bgp rpki table 203.0.113.1/24 max 24

Thu Jan 21 00:37:05.615 UTC


RPKI ROA entry for 203.0.113.1/24-24

  Origin-AS: 10021 from 192.168.122.120

Version: 124211

RP/0/RP0/CPU0:Cisco8000#show bgp 203.0.113.1/24

Thu Jan 21 05:37:26.714 UTC

BGP routing table entry for 203.0.113.1/24

Versions:

  Process           bRIB/RIB  SendTblVer

  Speaker                 32          32

Last Modified: Jan 21 00:03:33.344 for 05:33:53

Paths: (1 available, no best path)

  Not advertised to any peer

  Path #1: Received by speaker 0

  Not advertised to any peer

  8100

    10.0.12.2 from 10.0.12.2 (192.168.122.105)

      Origin incomplete, metric 0, localpref 100, valid, external

      Received Path ID 0, Local Path ID 0, version 0

      Origin-AS validity: invalid

RP/0/RP0/CPU0:Cisco8000#show bgp 192.168.122.1/32

Thu Jan 21 05:44:39.861 UTC

BGP routing table entry for 192.168.122.1/32

Versions:

  Process           bRIB/RIB  SendTblVer

  Speaker                 33          33

Last Modified: Jan 21 00:03:33.344 for 05:41:06

Paths: (1 available, best #1)

  Not advertised to any peer

  Path #1: Received by speaker 0

  Not advertised to any peer

  8100

    10.0.12.2 from 10.0.12.2 (192.168.122.105)

      Origin incomplete, metric 0, localpref 100, valid, external, best, group-best

      Received Path ID 0, Local Path ID 1, version 33

      Origin-AS validity: not-found

router bgp 100

 address-family ipv4 unicast

  bgp bestpath origin-as allow invalid

 !

RP/0/RP0/CPU0:Cisco8000#show bgp

Thu Jan 21 06:21:34.294 UTC

BGP router identifier 10.1.1.1, local AS number 100

BGP generic scan interval 60 secs

Non-stop routing is enabled

BGP table state: Active

Table ID: 0xe0000000   RD version: 34

BGP main routing table version 34

BGP NSR Initial initsync version 2 (Reached)

BGP NSR/ISSU Sync-Group versions 0/0

BGP scan interval 60 secs




Status codes: s suppressed, d damped, h history, * valid, > best

              i - internal, r RIB-failure, S stale, N Nexthop-discard

Origin codes: i - IGP, e - EGP, ? - incomplete

   Network            Next Hop            Metric LocPrf Weight Path

*> 203.0.113.0/24     10.0.12.2                0             0 8100 ?

*> 203.0.113.1/24     10.0.12.2                0             0 8100 ?

*> 192.168.122.1/32   10.0.12.2                0             0 8100 ?

RP/0/RP0/CPU0:Cisco8000#show bgp 203.0.113.1/24

Thu Jan 21 06:23:26.994 UTC

BGP routing table entry for 203.0.113.1/24

Versions:

  Process           bRIB/RIB  SendTblVer

  Speaker                 34          34

Last Modified: Jan 21 06:05:31.344 for 00:17:55

Paths: (1 available, best #1)

  Not advertised to any peer

  Path #1: Received by speaker 0

  Not advertised to any peer

  8100

    10.0.12.2 from 10.0.12.2 (192.168.122.105)

      Origin incomplete, metric 0, localpref 100, valid, external, best, group-best

      Received Path ID 0, Local Path ID 1, version 34

      Origin-AS validity: invalid

RP/0/RP0/CPU0:Cisco8000#show bgp origin-as validity

Thu Jan 21 06:36:31.041 UTC

BGP router identifier 10.1.1.1, local AS number 100

BGP generic scan interval 60 secs

Non-stop routing is enabled

BGP table state: Active

Table ID: 0xe0000000   RD version: 34

BGP main routing table version 34

BGP NSR Initial initsync version 2 (Reached)

BGP NSR/ISSU Sync-Group versions 0/0

BGP scan interval 60 secs




Status codes: s suppressed, d damped, h history, * valid, > best

              i - internal, r RIB-failure, S stale, N Nexthop-discard

Origin codes: i - IGP, e - EGP, ? - incomplete

Origin-AS validation codes: V valid, I invalid, N not-found, D disabled

    Network            Next Hop            Metric LocPrf Weight Path

V*> 203.0.113.0/24     10.0.12.2                0             0 8100 ?

I*> 203.0.113.1/24     10.0.12.2                0             0 8100 ?

N*> 192.168.122.1/32   10.0.12.2                0             0 8100 ?

router bgp 100

 rpki route 192.168.122.1/32 max 32 origin 8100

RP/0/RP0/CPU0:Cisco8000#show bgp origin-as validity

Thu Jan 21 06:36:34.151 UTC

BGP router identifier 10.1.1.1, local AS number 100

BGP generic scan interval 60 secs

Non-stop routing is enabled

BGP table state: Active

Table ID: 0xe0000000   RD version: 35

BGP main routing table version 35

BGP NSR Initial initsync version 2 (Reached)




Status codes: s suppressed, d damped, h history, * valid, > best

              i - internal, r RIB-failure, S stale, N Nexthop-discard

Origin codes: i - IGP, e - EGP, ? - incomplete

Origin-AS validation codes: V valid, I invalid, N not-found, D disabled

    Network            Next Hop            Metric LocPrf Weight Path

V*> 203.0.113.0/24     10.0.12.2                0             0 8100 ?

I*> 203.0.113.1/24     10.0.12.2                0             0 8100 ?

V*> 192.168.122.1/32   10.0.12.2                0             0 8100 ?

route-policy Invalid

  if validation-state is invalid then

    set weight 12345

  endif

end-policy

!




router bgp 100

  remote-as 8100

  address-family ipv4 unicast

   route-policy Invalid in

  !

 !

!

RP/0/RP0/CPU0:Cisco8000#show bgp 203.0.113.1/24

Thu Jan 21 06:57:33.816 UTC

BGP routing table entry for 203.0.113.1/24

Versions:

  Process           bRIB/RIB  SendTblVer

  Speaker                 38          38

Last Modified: Jan 21 06:54:04.344 for 00:03:29

Paths: (1 available, best #1)

  Not advertised to any peer

  Path #1: Received by speaker 0

  Not advertised to any peer

  8100

    10.0.12.2 from 10.0.12.2 (192.168.122.105)

      Origin incomplete, metric 0, localpref 100, weight 12345, valid, external, best, group-best

      Received Path ID 0, Local Path ID 1, version 38

      Origin-AS validity: invalid

router bgp 100

 address-family ipv4 unicast

  bgp origin-as validation signal ibgp

csr2#show ip bgp 203.0.113.1/24

BGP routing table entry for 203.0.113.1/24, version 14

Paths: (1 available, best #1, table default)

  Not advertised to any peer

  Refresh Epoch 1

  8100

    10.0.12.2 from 10.0.13.1 (10.1.1.1)

      Origin IGP, metric 0, localpref 100, valid, internal, best

      Extended Community: 0x4300:0:2

      rx pathid: 0, tx pathid: 0x0

      Updated on Jan 21 2021 18:16:56 UTC

Jan 22 18:28:41.360: BGP: 10.0.12.1 rcv message type 5, length (excl. header) 4

Jan 22 18:28:41.360: BGP: 10.0.12.1 rcvd REFRESH_REQ for afi/safi: 1/1, refresh code is 0

router bgp 100

 address-family ipv4 unicast

  bgp bestpath origin-as use validity         

 !

RP/0/RP0/CPU0:Cisco8000#show processes memory detail location 0/RP0/CPU0 | in $

Fri Jan 22 17:19:57.945 UTC

JID        Text       Data       Stack      Dynamic    Dyn-Limit  Shm-Tot    Phy-Tot       Process

1069           2M        71M       132K        25M      7447M        50M        74M        bgp


RP/0/RP0/CPU0:Cisco8000#show bgp rpki server summary

Fri Jan 22 17:12:09.073 UTC

Hostname/Address    Transport     State         Time          ROAs (IPv4/IPv6)

192.168.122.120     TCP:3323      NONE          00:00:25      N/A

RP/0/RP0/CPU0:Cisco8000#show bgp rpki server summary

Fri Jan 22 17:23:46.769 UTC


Hostname/Address    Transport     State         Time          ROAs (IPv4/IPv6)

192.168.122.120     TCP:3323      ESTAB         00:02:42      172796/28411


RP/0/RP0/CPU0:Cisco8000#show processes memory detail location 0/RP0/CPU0 | in $

Fri Jan 22 17:24:14.659 UTC

JID        Text       Data       Stack      Dynamic    Dyn-Limit  Shm-Tot    Phy-Tot     Process

1069           2M        99M       132K        53M      7447M        50M       102M       bgp

RP/0/RP0/CPU0:Cisco8000#show bgp rpki server summary

Fri Jan 22 17:23:46.769 UTC


Hostname/Address    Transport     State         Time          ROAs (IPv4/IPv6)

192.168.122.120     TCP:3323      ESTAB         00:02:42      172796/28411

RP/0/RP0/CPU0:Cisco8000#show processes memory detail location 0/RP0/CPU0 | in $

Fri Jan 22 17:24:14.659 UTC

JID        Text       Data       Stack      Dynamic    Dyn-Limit  Shm-Tot    Phy-Tot     Process

1069           2M        99M       132K        53M      7447M        50M       102M       bgp