CloudLabBox
Try the free demo

BGP in depth lab 13 of 14

Troubleshooting path selection and policy

Every session is up and the graphs look fine, yet customers are complaining. Six policy faults across IOS, Junos, EOS and RouterOS are hiding in Kestrel Fibre's network. None of them shows up as a down session. Work from symptoms to causes with each vendor's tools, and prove each fix with the path it actually chooses.

Run this lab

It needs Standard: its 6 nodes are set to 7 vCPU and 7,936 MB in total.

In your workspace: Shared, then BGP in depth guided labs, then 13 - Troubleshooting path selection and policy

Run it on Standard from £5 a day

The free demo can’t run it: it has 6 vCPU and 8 GB, and this lab’s nodes need 7 vCPU and 7,936 MB together. Every lab plan includes every guided lab.

Level
Advanced
Time
About 120 minutes
Nodes need
7 vCPU, 7,936 MB
Smallest plan
Standard

The scenario

All of Kestrel Fibre's BGP sessions are Established, so the monitoring is green. These are the rules the design says should hold:

#Rule
1Outbound traffic leaves through R1 (local preference 150 on routes from UP)
2R2 tags routes from customers, matched by AS path, with 64500:100
3R2 sets local preference 120 on customer routes that carry 64500:120
4R1 and SRX1 send only tagged customer routes to UP; SRX1 adds one prepend, so UP prefers R1
5Every router in AS 64500 can reach every customer route

And these are the complaints:

TicketWho saysWhat they say
1Finance"Why is our traffic going out through the expensive SRX1 link?"
2R1's owner"R1 can see EOS1's prefix, but can't use it"
3EOS1's customer"We send 64500:120, and it does nothing"
4CHR1's customer"UP can't reach us, though Kestrel can"
5CHR1's customer"Our second block, 192.0.2.128/25, isn't reachable from anywhere"
6Network design"UP should have two paths to each customer. It has one"
DeviceInterfaceAddressConnects to
R1Loopback010.255.0.1/32
R1Gi0/010.0.12.1/30R2 Gi0/0
R1Gi0/1172.16.1.1/30UP Gi0/0
R2Loopback010.255.0.2/32
R2Gi0/010.0.12.2/30R1 Gi0/0
R2Gi0/110.0.23.1/30SRX1 ge-0/0/0
R2Gi0/2172.16.3.1/30EOS1 Ethernet1
R2Gi0/3172.16.4.1/30CHR1 ether1
SRX1ge-0/0/010.0.23.2/30R2 Gi0/1
SRX1ge-0/0/1172.16.2.1/30UP Gi0/1
SRX1lo010.255.0.3/32
UPLoopback010.255.0.9/32
UPLoopback1198.51.100.1/24
UPGi0/0172.16.1.2/30R1 Gi0/1
UPGi0/1172.16.2.2/30SRX1 ge-0/0/1
EOS1Ethernet1172.16.3.2/30R2 Gi0/2
EOS1Loopback010.255.0.10/32
EOS1Loopback1203.0.113.1/25
CHR1ether1172.16.4.2/30R2 Gi0/3
CHR1lan1192.0.2.1/25
CHR1lan2192.0.2.129/25

What you’ll practise

  • Work from a traffic symptom to the rung of the decision process that caused it
  • Find an unreachable next hop on an iBGP route
  • Find a Junos policy term that never accepts
  • Find a leftover local preference that moved all traffic
  • Find a community that was never sent
  • Find an AS-path regular expression that matches nothing
  • Find a RouterOS chain that rejects by default

The tasks

  1. Method
  2. Ticket 1, the wrong exit
  3. Ticket 2, unusable next hop
  4. Ticket 3, the community that never arrived
  5. Ticket 4, the expression that matches nothing
  6. Ticket 5, end of the chain
  7. Ticket 6, the term that doesn't accept
  8. Prove every rule

The Lab Tasks pane has the scenario, these tasks, the checks to run, hints and the full solution.

Topology and devices

The network as it opens in EVE-NG, drawn from the lab’s own canvas, and the image each node runs.

Topology of Troubleshooting path selection and policy6 nodes, 6 links. Every link is listed as text below the diagram.R1R2SRX1UPEOS1CHR1Gi0/0Gi0/0Gi0/1ge-0/0/0Gi0/2Ethernet1Gi0/3ether1Gi0/1Gi0/0ge-0/0/1Gi0/1
6 nodes, with the interface names each link uses. On a narrow screen, scroll the diagram sideways.
Every link, as text
  • R1 Gi0/0 to R2 Gi0/0
  • R2 Gi0/1 to SRX1 ge-0/0/0
  • R1 Gi0/1 to UP Gi0/0
  • SRX1 ge-0/0/1 to UP Gi0/1
  • R2 Gi0/2 to EOS1 Ethernet1
  • R2 Gi0/3 to CHR1 ether1
Nodes in Troubleshooting path selection and policy, with the image each runs and the vCPU and RAM it’s set to
NodeDeviceImage in Add NodeSet to
R1Cisco IOSvvios-adventerprisek9-m.spa.159-3.m91 vCPU, 512 MB
R2Cisco IOSvvios-adventerprisek9-m.spa.159-3.m91 vCPU, 512 MB
SRX1Juniper vSRX NextGen templatevsrxng-23.4R2-S3.92 vCPU, 4,096 MB
UPCisco IOSvvios-adventerprisek9-m.spa.159-3.m91 vCPU, 512 MB
EOS1Arista vEOSveos-4.33.1.1F1 vCPU, 2,048 MB
CHR1MikroTik RouterOSmikrotik-7.14.21 vCPU, 256 MB

How to open this lab

  1. Sign in to your workspace at lab.cloudlabbox.com.

  2. In File Manager, open Shared, then the folder BGP in depth guided labs.

  3. Open 13 - Troubleshooting path selection and policy and start its nodes, then open Lab Tasks for the scenario and the steps.

The lab is read-only. You can start the nodes and configure the devices, but changes to the topology can’t be saved. To change it, rebuild it in your own folder.

More BGP in depth labs

All BGP in depth labs

CloudLabBox is independent of Arista Networks, Cisco, Juniper Networks and MikroTik. The lab follows exam topics and isn’t vendor training material; vendor names identify the exams and the images in the workspace.