Troubleshooting guide

Example Configurations

Example 8: Using BGP Communities in an MPLS Network to Change Local

Preference

The most common application for BGP community strings occurs in MPLS networks. Since MPLS

providers tend to ignore the AS path attribute and the MED, a community string is often sent to signal the

provider that the local preference should be changed. The change in local preference is necessary so that

one prefix is seen as less preferable than another identical prefix. Consider the network in

Figure 10 on

page 53. There are three Internet-provisioned sites on an MPLS network (Primary, Secondary, and

Tertiary) that will provide Internet access to remote sites on the network that do not have their own Internet

circuits. All PE routers within the MPLS cloud are fully meshed iBGP neighbors. Routing information for

the MPLS AS, including local preference information for exiting the AS, is synchronized among each of

these PE routers.

The Primary site does not advertise a community string, and its prefixes are adopted with the default

LOCAL_PREF value of 100. This local preference setting is the highest advertised in the MPLS network,

making the Primary site the preferred connection for Internet traffic for the remote sites. A community

string is used to manipulate the local preference in the MPLS cloud for the Secondary site, which will

provide backup Internet access for the remote locations, if the Primary site’s connection fails. A different

community string is used to manipulate the local preference for the Tertiary site to make it the third backup

Internet connection. In this example, the MPLS provider has configured the community string 65000:90

for the Secondary site with a LOCAL_PREF value of 90. The community policy is defined using the

command set community 65000:90 under a route map (BGP-OUT) on the AOS device at the Secondary

site. Similarly, the MPLS provider has configured the community string 65000:70 for the Tertiary site with

a LOCAL_PREF value of 70. The community policy is defined using the command set community

65000:70 under a route map (BGP-OUT) on the AOS device at the Tertiary site. The local preference

attribute is shared and synchronized among all iBGP neighbors in the AS and serves to select the exit point

out of the AS when multiple exit points exist for a particular route. In this example, the default route is

chosen by local preference and triggers all of the PE routers to send customer Internet traffic to the

designated Internet-provisioned customer site. Since the route with the largest local preference is preferred

in BGP, the MPLS cloud will prefer the prefix with a LOCAL_PREF value of 100, 90, and finally 70,

respectively.

The final configuration consideration is whether the Secondary and Tertiary sites prefer their own Internet

connections to the Primary connection. Some organizations perform monitoring at the Primary site to keep

track of their employees browsing habits, or to filter out certain sites from being available for browsing. In

either case, the LOCAL_PREF value of the default route (learned from RIP in this example) must be set to

either above or below the default LOCAL_PREF value in BGP (100) and redistributed into BGP. These

settings allow the failover and failback Internet operations to function correctly. The Secondary site in this

example prefers to use its own Internet connection rather than the Primary connection. So, the Secondary

site’s default prefix is redistributed into BGP and a route map (REDISTRIBUTE) is used to modify the

LOCAL_PREF to the value 110 (a value greater than 100). The Tertiary site prefers to use the Primary site

for Internet connectivity. Like the Secondary site, the Tertiary site’s default prefix is also redistributed into

BGP. However, the LOCAL_PREF value is set to 90 (a value less than 100).

The local Internet connection at the Primary, Secondary, and Tertiary sites must be

monitored by some device to determine when a failure occurs. Although this task can be

performed by most AOS devices, this topic will not be covered in this configuration guide.

For purposes of this example, the external firewall (see Figure 10 on page 53) will be

monitoring the connection and advertising the default route to the MPLS router using RIP.