BGP in depth lab 3 of 14
One policy in four languages
Kestrel Fibre has bought three small ISPs, and each runs a different vendor. Take one written routing policy and implement it as an IOS route map, a Junos policy statement, an EOS route map and a RouterOS filter chain, then prove each edge treats the same routes in the same way.
Run this lab
It needs Lite: its 5 nodes are set to 6 vCPU and 7,424 MB in total. That fits the free demo too.
In your workspace: Shared, then BGP in depth guided labs, then 03 - One policy in four languages
- Level
- Advanced
- Time
- About 120 minutes
- Nodes need
- 6 vCPU, 7,424 MB
- Smallest plan
- Lite
The scenario
Kestrel Fibre has grown by acquisition. Each of the four edges below belongs to a company it bought, and each runs a different vendor. The engineering lead has written a single routing policy, and you must implement it everywhere. The point isn't to make four configurations that look alike. It's to make four routers behave the same.
Policy KESTREL-EDGE-1
| # | Direction | Rule |
|---|---|---|
| 1 | In | Reject anything inside 10.0.0.0/8 (private address space) |
| 2 | In | Reject anything longer than /24 |
| 3 | In | Routes that passed through partner AS 64777: local preference 150, add community 64500:777 |
| 4 | In | Accept everything else unchanged |
| 5 | Out | Announce this edge's public /26 and nothing else |
| 6 | Out | On that /26: add one extra copy of your own AS, and add community 64500:100 |
TRANSIT sends all four edges the same table:
| Prefix | AS path | Expected result |
|---|---|---|
| 198.51.100.0/24 | 64999 64777 | Accepted by rule 3 |
| 198.18.0.0/24 | 64999 64888 | Accepted by rule 4 |
| 10.99.0.0/16 | 64999 | Rejected by rule 1 |
| 198.18.1.128/25 | 64999 | Rejected by rule 2 |
| Edge | AS | Public /26 | Internal network that must stay in |
|---|---|---|---|
| R1 | 64501 | 203.0.113.0/26 | 10.201.0.0/24 |
| SRX1 | 64502 | 203.0.113.64/26 | 10.202.0.0/24 |
| EOS1 | 64503 | 203.0.113.128/26 | 10.203.0.0/24 |
| CHR1 | 64504 | 203.0.113.192/26 | 10.204.0.0/24 |
| Device | Interface | Address | Connects to |
|---|---|---|---|
| TRANSIT | Loopback0 | 10.255.0.9/32 | |
| TRANSIT | Loopback1 | 198.51.100.1/24 | |
| TRANSIT | Loopback2 | 198.18.0.1/24 | |
| TRANSIT | Gi0/0 | 10.1.1.1/30 | R1 Gi0/0 |
| TRANSIT | Gi0/1 | 10.1.2.1/30 | SRX1 ge-0/0/0 |
| TRANSIT | Gi0/2 | 10.1.3.1/30 | EOS1 Ethernet1 |
| TRANSIT | Gi0/3 | 10.1.4.1/30 | CHR1 ether1 |
| R1 | Loopback0 | 10.255.0.1/32 | |
| R1 | Loopback1 | 203.0.113.1/26 | |
| R1 | Loopback2 | 10.201.0.1/24 | |
| R1 | Gi0/0 | 10.1.1.2/30 | TRANSIT Gi0/0 |
| SRX1 | ge-0/0/0 | 10.1.2.2/30 | TRANSIT Gi0/1 |
| SRX1 | lo0 | 10.255.0.2/32, 203.0.113.65/26, 10.202.0.1/24 | |
| EOS1 | Ethernet1 | 10.1.3.2/30 | TRANSIT Gi0/2 |
| EOS1 | Loopback0 | 10.255.0.3/32 | |
| EOS1 | Loopback1 | 203.0.113.129/26 | |
| EOS1 | Loopback2 | 10.203.0.1/24 | |
| CHR1 | ether1 | 10.1.4.2/30 | TRANSIT Gi0/3 |
| CHR1 | edge | 203.0.113.193/26 | |
| CHR1 | internal | 10.204.0.1/24 |
What you’ll practise
- Translate prefix, prefix-length and AS-path matches between IOS, Junos, EOS and RouterOS
- Set local preference, communities and AS-path prepends in all four languages
- State what each vendor does with a route that reaches the end of a policy
- Write AS-path regular expressions in each vendor's own style
- Show the routes a policy rejected, on each vendor
- Read a vSRX's zones and explain why BGP needs host-inbound traffic
The tasks
- The phrasebook
- Look at the mess first
- IOS
- Junos
- EOS
- RouterOS
- Prove all four agree
The Lab Tasks pane has the scenario, these tasks, the checks to run, hints and the full solution.
Topology and devices
The network as it opens in EVE-NG, drawn from the lab’s own canvas, and the image each node runs.
Every link, as text
- TRANSIT
Gi0/0to R1Gi0/0 - TRANSIT
Gi0/1to SRX1ge-0/0/0 - TRANSIT
Gi0/2to EOS1Ethernet1 - TRANSIT
Gi0/3to CHR1ether1
| Node | Device | Image in Add Node | Set to |
|---|---|---|---|
| TRANSIT | Cisco IOSv | vios-adventerprisek9-m.spa.159-3.m9 | 1 vCPU, 512 MB |
| R1 | Cisco IOSv | vios-adventerprisek9-m.spa.159-3.m9 | 1 vCPU, 512 MB |
| SRX1 | Juniper vSRX NextGen template | vsrxng-23.4R2-S3.9 | 2 vCPU, 4,096 MB |
| EOS1 | Arista vEOS | veos-4.33.1.1F | 1 vCPU, 2,048 MB |
| CHR1 | MikroTik RouterOS | mikrotik-7.14.2 | 1 vCPU, 256 MB |
How to open this lab
Sign in to your workspace at
lab.cloudlabbox.com.In File Manager, open Shared, then the folder
BGP in depth guided labs.Open
03 - One policy in four languagesand start its nodes, then open Lab Tasks for the scenario and the steps.
The lab is read-only. You can start the nodes and configure the devices, but changes to the topology can’t be saved. To change it, rebuild it in your own folder.
More BGP in depth labs
Related labs in other courses
CloudLabBox is independent of Arista Networks, Cisco, Juniper Networks and MikroTik. The lab follows exam topics and isn’t vendor training material; vendor names identify the exams and the images in the workspace.