BGP
The Border Gateway Protocol (BGP) is a standardized exterior gateway protocol designed to exchange routing and reachability information among autonomous systems (AS) on the internet. BGP is classified as a path-vector routing protocol, and it makes routing decisions based on paths, network policies, or rule sets configured by a network operator.
Configuration
Following is an example of a BGP configuration with one session.
{
"interfaces": {
"network": [
{
"interface": "eth1",
"address": "10.0.1.2/24",
"gateway": "10.0.1.1"
}
]
},
"bgp": [
{
"local-address": "10.0.1.2",
"peer-address": "10.0.1.1",
"raw-update-file": "test.bgp",
"local-as": 65001,
"peer-as": 65001,
"family": [ "ipv4-unicast", "ipv6-unicast" ]
}
]
}
{ "bgp": {} }
Every configured BGP peer both actively connects and passively listens on TCP port 179, matching real router behavior. If the peer also connects towards BNG Blaster at the same time, the resulting connection collision is resolved automatically per RFC 4271#section-6.8 by comparing BGP Identifiers, with the losing TCP connection closed via a NOTIFICATION (Cease, Connection Collision Resolution).
Attribute |
Description |
|---|---|
network-interface |
BGP local interface (source interface).
Default: first network interface from configuration
|
local-address |
BGP local IPv4/6 address (source address).
Default: network interface address
|
local-as |
BGP local AS.
Default: 65000 Range: 0 - 4294967295
|
peer-address |
Mandatory BGP peer IPv4/6 address.
|
peer-as |
BGP peer AS.
Default: local AS Range: 0 - 4294967295
|
hold-time |
BGP hold-time in seconds.
Default: 90 Range: 0 - 65535
|
id |
BGP identifier.
Default: 1.2.3.4
|
tos |
BGP IP TOS.
Default: 0 Range: 0 - 255
|
ttl |
BGP IP TTL.
Default: 255 Range: 0 - 255
|
tcp-ao-key |
TCP authentication key. TCP-AO (RFC 5925) master key, or the
legacy TCP MD5 (RFC 2385) secret if tcp-ao-algorithm is md5.
A recommended minimum length applies per tcp-ao-algorithm
(32 characters for hmac-sha-256-128, 20 for hmac-sha-1-96, 16 for
aes-128-cmac-96, none for md5) but is not enforced, so shorter
keys can be used to test interop with peers that accept them.
|
tcp-ao-algorithm |
TCP authentication algorithm. tcp-ao-key is ignored unless
this is also set to a value other than none, so TCP
authentication can be toggled on/off by changing only this
attribute, without removing tcp-ao-key from the config.
Any value other than none requires tcp-ao-key.
Default: none (disabled)
Values: none, hmac-sha-1-96, hmac-sha-256-128, aes-128-cmac-96,
md5
|
tcp-ao-key-id |
TCP-AO KeyID (SendID) sent with all segments. Mandatory for TCP-AO
(tcp-ao-key and tcp-ao-algorithm other than none or md5).
Not supported for md5 (RFC 2385 has no KeyID).
Range: 0 - 255
|
tcp-ao-rnext-key-id |
TCP-AO RNextKeyID, which is also the KeyID (RecvID) expected in
received segments. Not supported for md5.
Default: tcp-ao-key-id Range: 0 - 255
|
tcp-ao-exclude-options |
Exclude TCP options other than TCP-AO from the TCP-AO MAC
(RFC 5925 section 3.1), which must match the peer configuration.
Not supported for md5.
Default: false
|
reconnect |
Reconnect BGP session automatically.
Default: true
|
start-traffic |
Start global traffic after RAW update finished.
If enabled, the control command traffic-start is automatically
executed as soon as the BGP RAW update has finished.
Default: false
|
learn-routes |
Store received IPv4/IPv6 unicast, labeled unicast, EVPN and
L2VPN routes.
If disabled, received updates are not parsed.
Default: false
|
teardown-time |
BGP teardown time in seconds.
The session is closed after the notification at the
latest after this time or after 3 seconds. A session
with pending data (e.g. RAW update not read by the peer)
is reset (TCP RST) instead of closed (TCP FIN).
Default: 5 Range: 0 - 65535
|
raw-update-file |
BGP RAW update file.
|
family |
BGP families to be send in open message.
Default: ipv4/6-unicast, ipv4/6-labeled-unicast
Values:
ipv4-unicast, ipv6-unicast,
ipv4-multicast, ipv6-multicast,
ipv4-labeled-unicast, ipv6-labeled-unicast,
ipv4-vpn-unicast, ipv6-vpn-unicast,
ipv4-vpn-multicast, ipv6-vpn-multicast,
ipv4-flow, ipv6-flow, evpn, l2vpn
|
extended-nexthop |
BGP extended-nexthop families to be send in open message.
Default: None
Values: ipv4-unicast, ipv4-vpn-unicast
|
BGP Sessions
BGP sessions are opened with the capabilities for the following address families:
IPv4 unicast
IPv4 labeled unicast
IPv6 unicast
IPv6 labeled unicast
This can be changed using the family configuration option.
Authentication
BGP sessions can be authenticated with the TCP Authentication Option (TCP-AO, RFC 5925 and RFC 5926) using the algorithms hmac-sha-1-96, hmac-sha-256-128 or aes-128-cmac-96, or with the legacy TCP MD5 signature option (RFC 2385) using the algorithm md5.
{
"bgp": [
{
"local-address": "10.0.1.2",
"peer-address": "10.0.1.1",
"local-as": 65001,
"peer-as": 65001,
"tcp-ao-algorithm": "hmac-sha-1-96",
"tcp-ao-key": "BNGBlasterTCPAOKey01",
"tcp-ao-key-id": 1,
"tcp-ao-rnext-key-id": 1
}
]
}
The tcp-ao-key-id is sent as KeyID (SendID) and the tcp-ao-rnext-key-id
as RNextKeyID, which is also the KeyID (RecvID) expected in received segments.
Both are equal by default. Authentication applies to connections initiated by
the BNG Blaster and to connections accepted from the peer, including the
initial SYN. Only a single static key per session is supported (no key rollover).
TCP options other than TCP-AO are included in the MAC by default. Some
implementations exclude them by default (e.g. Junos without tcp-ao-option
enabled), which requires tcp-ao-exclude-options to be enabled. Otherwise,
both sides reject the segments of the other side (MAC verification failed).
Route Learning
Received routes are not stored by default. With learn-routes enabled,
the BNG Blaster stores all IPv4 and IPv6 unicast and labeled unicast routes
per session (Adj-RIB-In) together with next-hop, origin, AS path, MED,
local preference, communities, large communities and extended communities.
Routes are added, replaced or deleted with every received update or withdraw
and removed if the session goes down. Equal path attributes are stored
once and shared between routes.
{
"bgp": [
{
"local-address": "10.0.1.2",
"peer-address": "10.0.1.1",
"local-as": 65001,
"peer-as": 65001,
"learn-routes": true,
"family": [ "ipv4-unicast", "ipv6-unicast", "evpn" ]
}
]
}
The learned routes and counters can be displayed with the bgp-routes
and bgp-routes-stats commands.
$ sudo bngblaster-cli run.sock bgp-routes family ipv4-unicast
All routes matching a prefix are listed by adding prefix with match
set to exact (default) or longer (exact and longer prefixes).
$ sudo bngblaster-cli run.sock bgp-routes prefix 10.0.0.0/8 match longer
$ sudo bngblaster-cli run.sock bgp-routes-stats
AS numbers are shown as received. For peers without 4-octet AS capability, the AS4_PATH attribute is not merged and 4-octet AS numbers are shown as AS_TRANS (23456).
EVPN
With learn-routes enabled, the BNG Blaster learns all EVPN routes
received from the peer, which can be displayed with the bgp-evpn-routes
command. EVPN routes are used to resolve the labels of traffic
streams for L3 EVPN, EVPN VPWS (E-LINE) and EVPN E-LAN services. The routes
of an emulated PE are generated with bgpupdate --evpn-vpws or
bgpupdate --evpn-elan. See EVPN for details and how
to test EVPN services.
BGP L2VPN
With learn-routes enabled and the family l2vpn, the BNG Blaster learns
the BGP L2VPN label blocks (RFC 6624) received from the peer, which can be
displayed with the bgp-l2vpn-routes command and used to resolve
the pseudowire labels of traffic streams. The label blocks of an emulated PE are
generated with bgpupdate --l2vpn. See BGP L2VPN for details
and how to test BGP L2VPN services.
RAW Update Files
The BNG Blaster can inject BGP messages from a pre-compiled RAW update file into the defined sessions. A RAW update file is nothing more than a pre-compiled binary stream of BGP messages, typically but not limited to update messages.
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| |
+ +
| |
+ +
| Marker |
+ +
| |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Length | Type | ...
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
.
.
.
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| |
+ +
| |
+ +
| Marker |
+ +
| |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Length | Type | ...
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Those files can be created using the included BGP RAW update generator
script bgpupdate or manually using libraries like scapy or converters
from PCAP or MRT files.
The configured raw-update-file under the BGP session is loaded
during BNG Blaster startup phase and sent as soon as the session is
established.
The bgp-raw-update command allows sending further updates during
the session lifetime.
$ sudo bngblaster-cli run.sock bgp-raw-update file update1.bgp
This allows loading a full table after the BGP session has started and manually triggering a series of changes using incremental update files.
All BGP RAW update files are loaded once and can then be used for multiple sessions. This means that if two or more sessions reference the same file identified by file name, this file is loaded once into memory and used by multiple sessions.
Therefore for incremental updates, it may make sense to pre-load
them via the bgp-raw-update-files configuration option.
{
"bgp": [
{
"local-address": "10.0.1.2",
"peer-address": "10.0.1.1",
"raw-update-file": "start.bgp",
"local-as": 65001,
"peer-as": 65001
}
],
"bgp-raw-update-files": [
"update1.bgp",
"update2.bgp"
]
}
Incremental updates not listed here will be loaded dynamically as soon as referenced by the first session.
The bgp-sessions command shows the progress of the RAW
update file in raw-update-state (wait, sending or done).
The update counters (update-tx) are incremented once the whole file
is sent and acknowledged. The bytes of the file acknowledged by the peer
so far are shown in raw-update-bytes-acked (of raw-update-bytes).
The tcp object shows the bytes sent but not yet acknowledged
(send-queue), the free TCP send buffer (send-buffer-free) and
the receive window of the peer (peer-window). A peer-window of
zero means that the peer does not accept further data at the moment
(receiver backpressure).
The raw-update-start-epoch and raw-update-stop-epoch values show
when sending of the current RAW update file started and when it was
completely acknowledged, raw-update-duration the time in between.
Like the traffic stream *-epoch values, these are seconds of the
monotonic system clock (time since boot), not Unix time. This allows
convergence measurements by comparing the start of a RAW update with
the rx-first-epoch, rx-interface-changed-epoch or
rx-last-epoch of traffic streams. While a further RAW update is
sent, raw-update-stop-epoch and raw-update-duration still show
the previous update, so check raw-update-state for done before
using them.
BGP RAW Update Generator
The BGP RAW update generator is a simple tool to generate BGP RAW update streams for use with the BNG Blaster.
$ bgpupdate --help
usage: bgpupdate [-h] [-a ASN] -n ADDRESS [-N N] [-p PREFIX] [-P N] [-m LABEL]
[-M N] [-l LOCAL_PREF] [-f FILE] [-w] [-s STREAMS]
[--med MED] [--stream-tx-label LABEL]
[--stream-tx-inner-label LABEL] [--stream-rx-label LABEL]
[--stream-rx-label-num N] [--stream-pps N]
[--stream-interface IFACE] [--stream-group-id N]
[--stream-direction {upstream,downstream,both}]
[--stream-append] [--end-of-rib] [--append] [--pcap FILE]
[--log-level {warning,info,debug}] [--evpn-vpws] [--rd RD]
[--rd-increment] [--rt RT] [--rt-increment] [--esi ESI]
[--service-id ID] [--service-num N] [--mtu MTU]
[--control-word] [--primary] [--backup] [--encap-mpls]
[--stream-ce-interface IFACE] [--stream-ce-vlan VLAN]
[--stream-vpws-vlan VLAN] [--stream-vpws-inner-vlan VLAN]
[--stream-vpws-qinq] [--stream-vpws-arp]
[--stream-evpn-rd RD] [--stream-evpn-service-id ID]
[--stream-destination-mac MAC] [--stream-pe-address ADDRESS]
[--stream-ce-address ADDRESS] [--evpn-elan]
[--ethernet-tag TAG] [--mac MAC] [--l2vpn] [--ce-id ID]
[--label-block-offset N] [--label-block-size N]
[--encapsulation {ethernet-vlan,ethernet}]
[--stream-l2vpn-rd RD] [--stream-l2vpn-ce-id ID]
The BGP RAW update generator is a simple tool to generate BGP RAW update
streams for use with the BNG Blaster.
options:
-h, --help show this help message and exit
-a ASN, --asn ASN autonomous system number
-n ADDRESS, --next-hop-base ADDRESS
next-hop base address (IPv4 or IPv6)
-N N, --next-hop-num N
next-hop count
-p PREFIX, --prefix-base PREFIX
prefix base network (IPv4 or IPv6)
-P N, --prefix-num N prefix count
-m LABEL, --label-base LABEL
label base
-M N, --label-num N label count
-l LOCAL_PREF, --local-pref LOCAL_PREF
local preference
-f FILE, --file FILE output file
-w, --withdraw withdraw prefixes
-s STREAMS, --streams STREAMS
generate BNG Blaster traffic stream file
--med MED MED
--stream-tx-label LABEL
stream TX outer label
--stream-tx-inner-label LABEL
stream TX inner label
--stream-rx-label LABEL
stream RX label
--stream-rx-label-num N
stream RX label count
--stream-pps N stream packets per seconds
--stream-interface IFACE
stream interface
--stream-group-id N stream group identifier
--stream-direction {upstream,downstream,both}
stream direction
--stream-append append to stream file if exist
--end-of-rib add end-of-rib message
--append append to file if exist
--pcap FILE write BGP updates to PCAP file
--log-level {warning,info,debug}
logging Level
EVPN VPWS (E-LINE):
--evpn-vpws generate EVPN VPWS per-EVI Ethernet A-D routes (route
type 1)
--rd RD route distinguisher (ASN:N, ASNL:N or IPv4:N)
--rd-increment increment route distinguisher per service
--rt RT route target (ASN:N, ASNL:N or IPv4:N)
--rt-increment increment route targets per service
--esi ESI ethernet segment identifier (default 0)
--service-id ID local VPWS service identifier base (ethernet tag)
--service-num N VPWS service count
--mtu MTU L2 MTU (default 0)
--control-word request control word (C flag), E-LAN streams send and
expect control word
--primary set primary flag (P flag)
--backup set backup flag (B flag)
--encap-mpls add MPLS encapsulation extended community
--stream-ce-interface IFACE
stream CE interface (CE to PE streams)
--stream-ce-vlan VLAN
stream CE interface VLAN base (incremented per
service)
--stream-vpws-vlan VLAN
customer VLAN within VPWS base (incremented per
service, PE to CE streams)
--stream-vpws-inner-vlan VLAN
customer inner VLAN within VPWS (PE to CE streams)
--stream-vpws-qinq customer outer VLAN ethertype 0x88a8 (PE to CE
streams)
--stream-vpws-arp reply to ARP, ND and ICMP echo and learn CE MAC (PE to
CE streams)
--stream-evpn-rd RD route distinguisher of DUT routes (PE to CE streams)
--stream-evpn-service-id ID
DUT local VPWS service identifier base (default
--service-id)
--stream-destination-mac MAC
CE interface MAC address (PE to CE streams)
--stream-pe-address ADDRESS
PE side stream IPv4 address
--stream-ce-address ADDRESS
CE side stream IPv4 address
EVPN E-LAN:
EVPN E-LAN routes use the --rd, --rt, --esi, --service-num, --encap-mpls,
--control-word and --stream-* options of EVPN VPWS, where --stream-vpws-*
sets the customer VLAN
--evpn-elan generate EVPN E-LAN IMET (route type 3) and MAC/IP
routes (route type 2)
--ethernet-tag TAG ethernet tag (default 0)
--mac MAC MAC address advertised per EVI (e.g. PE interface MAC)
BGP L2VPN (RFC 6624):
BGP L2VPN routes use the --rd, --rt, --rd-increment, --rt-increment,
--service-num (instances), --mtu, --control-word and --stream-* options of
EVPN VPWS, where --stream-vpws-* sets the customer VLAN
--l2vpn generate BGP L2VPN label blocks (RFC 6624)
--ce-id ID local CE ID (default 1)
--label-block-offset N
label block offset, first remote CE ID (default 1)
--label-block-size N label block size (default 8)
--encapsulation {ethernet-vlan,ethernet}
encapsulation type (default ethernet-vlan)
--stream-l2vpn-rd RD route distinguisher of DUT routes (PE to CE streams)
--stream-l2vpn-ce-id ID
DUT CE ID
The Python BGP RAW update generator is a Python script that uses scapy to build BGP messages. Therefore this tool can be easily modified, extended, or used as a blueprint for your own tools to generate valid BGP update streams.
The following example shows how to generate a BGP update stream with IPv4 and labeled IPv6 prefixes (6PE).
100000 x IPv4 prefixes over 1000 next-hops
50000 x IPv6 prefixes over 1000 next-hops with 1000 different labels (label per next-hop)
50000 x IPv6 prefixes over 1000 next-hops with label 2
bgpupdate -f test.bgp -a 65001 -l 100 -n 10.0.0.1 -N 1000 -p 10.1.0.0/24 -P 100000
bgpupdate -f test.bgp -a 65001 -l 100 -n 10.0.0.1 -N 1000 -m 20001 -M 1000 -p fc66:1::/48 -P 50000 --append
bgpupdate -f test.bgp -a 65001 -l 100 -n 10.0.0.1 -N 1000 -m 2 -p fc66:2::/48 -P 50000 --append --end-of-rib
By default, the file is replaced but the option --append allows it to append to an existing file.
The last update to a file should include the option --end-of-rib (optional).
The option --streams <file> (-s) automatically generates corresponding traffic streams
for all prefixes. By default, this file is replaced but the option --stream-append allows
appending to an existing file.
bgpupdate -f test.bgp -a 65001 -l 100 -n 10.0.0.1 -N 1000 -p 10.1.0.0/24 -P 100000 -s streams.json
bgpupdate -f test.bgp -a 65001 -l 100 -n 10.0.0.1 -N 1000 -m 20001 -M 1000 -p fc66:1::/48 -P 50000 --append -s streams.json --stream-append
bgpupdate -f test.bgp -a 65001 -l 100 -n 10.0.0.1 -N 1000 -m 2 -p fc66:2::/48 -P 50000 --append --end-of-rib -s streams.json --stream-append
There are several options supported to further define the traffic streams like PPS and expected RX labels.
BGP Convergence Testing
The following project demonstrates how to measure the convergence between the BGP Control-Plane (CP) and the Data-Plane (DP) using the BNG Blaster. By utilizing BNG Blaster, we can analyze and monitor the time it takes for routing changes to propagate from the control-plane, where BGP updates occur, to the data-plane, where actual data packet forwarding happens.