- [Narrator] BGP creates updates
on a neighbor by neighbor basis.
So the more neighbors we have, the more updates we'll have,
and that's going to require
a lot more CPU resources on our routers.
If we're performing filtering with IP prefix lists
or distribute lists,
this is going to create an even higher demand on our CPU.
And that's where BGP peer groups can come into play.
If we have similar IP prefix lists
that we want to configure for multiple neighbors,
BGP peer groups will allow us
to group those neighbors together
and to share the same policies.
So that's as opposed to having to configure each neighbor
with the same policy on an individual basis,
we can group the policies together and apply those that way.
And that makes a much more efficient update process
and also a much more simple configuration.
This also allows us to use less resources
on each of our neighbor routers.
Here in our topology,
we have the routers R1 and R2,
both in autonomous system 65100.
And this is connecting out to a couple of ISPs.
We have ISP one in AS 65200, ISP two in AS 65400,
and we have a router acting as the public internet
between those in AS 65300.
Now I've already configured BGP between all of our devices.
And so let's say that what we want to do
is create a prefix list on router two.
Prefix lists are essentially access control lists
for route advertisements or for prefixes, in other words.
They contain ordered entries that are processed sequentially
from top to bottom, just as an ACL does.
So let's assume.
And it's a pretty normal assumption
that we would want to prevent router two
from receiving private IP addresses
from our ISPs, from the public internet.
Private IP addresses are not supposed to be routable
over the public internet.
So if we started receiving those,
that could be a security concern.
So let's go out to a live topology
and take a look at how we can do this.
As I said, I already have BGP configured everywhere
just for the sake of time.
So let's start working on
creating prefix lists and peer groups.
Let's go under global configuration mode,
by the way, I'm on router two,
which is connecting out to our ISP connections
and let's say IP prefix-list.
And if we look at contextual help,
we can follow that by the name of our prefix list.
I'm going to call that filter-IP.
And we want to add a deny statement first.
Remember we want to deny any private IP addresses
from reaching this router from the internet.
So let's first say deny.
And the first range we'll do it's 10.0.0.0.0/8.
And if we look at contextual help,
we can say that we want greater than or less than.
So we can either choose a minimum prefix link
to be matched or a maximum prefix link to be matched.
And I'm going to say LE which means less than,
and we'll say 32.
So what we're doing here is we're creating a range.
So that basically anything from 10.0.0.0/8,
all the way through slash 32 is going to be denied.
Slash nine, slash 10, slash 11, all the way up to slash 32.
So let's do that now for some of our other IP ranges.
We'll again use a deny statement,
we'll say 172.16.0.0/12 less than 32.
And we'll also do that for the IP range.
192.168.0.0/16 and again, less than 32.
So we have all of our deny statements in place,
and just like an ACL,
we have an implicit deny at the end here.
So we need to make an explicit permit option
that will allow all other traffic.
So let's again, say IP prefix-lists.
Instead of deny, this time we'll say permit.
Actually, I need to call out the name of that list first.
Almost got that backwards.
So filter-IP permit, and we'll say 0.0.0.0/0 less than 32.
So there we go.
Break out of here, let's exit out
and let's say show IP prefix-list.
And here you can see our prefix list named filter-IP.
We have four entries.
We have our three deny entries
and we have our permit statement at the end,
letting everything else in.
So that's good.
Now, the next thing we could do,
if we went back under global configuration mode,
what we could do is we could go under router BGP 65100,
which is the local autonomous system number
here on this router.
And we could say for our neighbor ISP one,
we could apply this prefix list in the incoming direction.
And then we can make another command statement for ISP two,
also applying the prefix list in the incoming direction.
However, since we have the same prefix list,
that's going to be applied to both neighbors,
to both ISP one and ISP two,
we can simply group those neighbors together
into a BGP peer group.
Now, that's not a huge deal here in this small lab,
since we only have two neighbors,
but imagine an enterprise environment where you may have
dozens and dozens of routers.
That's going to save you tons of time,
tons of router resources,
especially the more neighbors that you have.
So we're under global configuration mode.
We went under router BGP 65100,
and let's create our peer group.
We can say neighbor.
And then we can, if we look at contextual help,
we typically will put in the IP address of a neighbor,
but we can also give that a name and a neighbor tag
is what contextual help tells us.
So this is going to name our BGP peer group.
So I'm going to name that ISP-PG short for ISP peer group,
and that we want to use the key word peer-group
to identify this into a peer group.
So now instead of applying the prefix list
to each neighbor, we can simply apply that once
to this peer group instead.
So now let's say neighbor ISP-PG prefix-list.
And we'll follow that with the name of our prefix list,
which we previously created and called filter-IP.
And if we look at contextual help,
we also need to choose the direction on that.
And we want to do that in the inbound direction,
in our case with the keyword in.
So now we've applied our prefix list to our peer group.
We've defined a peer group,
but we still need to assign neighbors into the peer group.
Currently that peer group is empty.
And we can do that very simply by saying neighbor.
And we'll start with ISP one's address, 198.51.100.2,
and we'll use the key word peer-group
to assign that to a specific group.
If we look at contextual help,
you see that we follow that with the name of our peer group,
which is ISP-PG.
So that's good.
And you can see that momentarily
our neighborship went down,
the adjacency went down and then it came right back up.
So that's not unusual,
that's exactly what we would expect to see.
Let's do the same for ISP two.
So we'll also say neighbor 198.51.100.6
for ISP two, we'll say peer-group.
And we're adding that to the same peer group ISP-PG.
We'll hit Enter.
And again, we're going to see that reset
and we're going to see that adjacency come right back up.
So now as advertisements are arriving
and as BGP goes through its calculations
about which routes should be permitted,
which ones should be filtered.
Instead of performing that calculation for each neighbor
on our router, it's only going to do that one time.
It's only going to do that for this peer group
because the neighbors belong to the same peer group.
Again, not a huge advantage in this very small lab case
since we only have two neighbors,
but definitely helpful in a really,
really large enterprise environment.
So that's a look at creating a prefix list
and using BGP peer groups.