Bogons via BGP

What is a bogon, and why should I filter it?

A bogon prefix is a route that should never appear in the Internet routing table. A packet routed over the public Internet (not including over VPNs or other tunnels) should never have a source address in a bogon range. These are commonly found as the source addresses of DDoS attacks.

Ref:http://www.team-cymru.org/Services/Bogons/

How the bgp deterministic-med Command Differs from the bgp always-compare-med Command

Enabling the bgp deterministic-med command ensures the comparison of the MED variable when choosing routes advertised by different peers in the same autonomous system. Enabling the bgp always-compare-med command ensures the comparison of the MED for paths from neighbors in different autonomous systems.

 The bgp always-compare-med command is useful when multiple service providers or enterprises agree on a uniform policy for setting MED. Thus, for network X, if Internet Service Provider A (ISP A) sets the MED to 10, and ISP B sets the MED to 20, both ISPs agree that ISP A has the better performing path to X.

Note: The bgp deterministic-med and bgp always-compare-med commands are not enabled by default. Also, the two commands are separate; enabling one does not automatically enable the other.

Ref:
http://www.cisco.com/en/US/tech/tk365/technologies_tech_note09186a0080094925.shtml http://www.cisco.com/en/US/tech/tk365/technologies_tech_note09186a0080094431.shtml

BGP route reflectors

Route Reflector rules 

A BGP router implementing route reflector functionality propagates BGP routes according to these rules: Locally originated routes and routes received from EBGP neighbors and selected as best routes are propagated to all BGP peers (internal and external). Routes received from an IGBP peer that is not a route-reflector client and selected as best routes are propagated to all EBGP peers and all IGBP peers configured as route-reflector clients. Routes received from a route-reflector client and selected as best routes are propagated to all BGP peers (internal and external). Whenever an IBGP route is reflected (propagated to another IBGP peer), the route reflector appends two optional, non-transitive attributes to the BGP route: If the route does not have the Originator ID attribute (it has not been reflected before), the router ID of the IBGP peer from which the route has been received is copied into the Originator ID attribute. If the route does not have the Cluster list attribute, it’s added to the route. The value configured with the bgp cluster-id router configuration command (or the router ID of the route reflector if the cluster-id is not configured) is prepended to the Cluster list attribute. Route reflector does not change or remove any other attributes of the reflected routes (even non-transitive attributes), ensuring that the IBGP routes are not changed within the autonomous system.  

Loop Detection and Avoidance The BGP routers implementing original route reflector RFC (RFC 1966) use the following mechanisms to detect route-reflector-related loops: If the Originator ID in an incoming IBGP route update is equal to the BGP router ID, the update is ignored (reflected route was propagated back to its originator). If the Cluster ID of a route-reflector appears in the Cluster list attribute of an incoming IBGP update, the update is ignored (route reflector loop). The route reflector functionality was introduced in IOS release 11.1. It’s therefore relatively safe to assume that every Cisco router encountered in a production network supports it. Although the mechanisms specified in RFC 1966 ensure loop-free IBGP operation regardless of the actual topology of the IBGP sessions, RFC 4456 added new route selection rules that improve the actual convergence within an AS and reduce the amount of BGP updates propagated across the AS: Routes with shorter Cluster list attribute are preferred. This rule ensures that all routers select routes with minimum number of reflections, significantly reducing the amount of unnecessary BGP updates (remember: only best routes selected by a route reflector are reflected to its clients). The Originator ID attribute of a reflected route should be used as the Router ID attribute when comparing otherwise identical IBGP routes, ensuring the stability of route selection across AS regardless of the route reflectors.

Ref:http://wiki.nil.com/BGP_route_reflectors

Feature Information for Cisco IOS Scripting with Tcl

Table 4 Feature Information for Cisco IOS Scripting with Tcl
Feature Name

Releases

Feature Information

Cisco IOS Scripting with Tcl


12.3(2)T
12.3(7)T
12.2(25)S
12.2(33)SXH
12.2(33)SRC
12.2(33)SB
Cisco IOS XE 3.1.0SG


The Cisco IOS Scripting with Tcl feature provides the ability to run Tcl version 8.3.4 commands from the Cisco IOS command-line interface.

The following commands were introduced or modified: scripting tcl encdir, scripting tcl init, scripting tcl low-memory, tclquit, tclsh.

Tcl SNMP MIB Access


12.3(7)T
12.2(25)S
12.2(33)SXH
12.2(33)SRC
12.2(33)SB
Cisco IOS XE 3.1.0SG


The Tcl SNMP MIB Access feature introduces a set of UNIX-like SNMP commands to make access to Simple Network Management Protocol (SNMP) MIB objects easier.

The following section has more information:

•Using the Tcl Shell to Access SNMP MIB Objects.

TCL UDP and VRF support


15.1(1)T


The Tcl UDP and VRF feature provides support for UDP sockets in IOS Tcl.

The following commands were introduced or modified: fconfigure, socket, udp_open, udp_peek.

Feature Information for Cisco IOS Scripting with Tcl

Can I combine EEM applets with Tcl shell?

event manager applet Clear
event syslog pattern "OSPF-5-ADJCHG.*to FULL"
action 1.0 cli command "enable"
action 1.1 cli command "tclsh flash:tcl/clearL0.tcl"

Can I combine EEM applets with Tcl shell?: When I've been describing the limitations of kron , ??? quickly asked an interesting question: “as I cannot insert extra input keystrokes wi...

Send email from a CISCO router with specifc source IP

1. In case of CISCO EEM, need to use NAT, see below example
 Set the source IP address of EEM SMTP session


2. TCL script

If you use Tcl, you could write your own SMTP client and use the -myaddr parameter in the socket call to specify the source IP address.

socket ?options? host port

socket

change-source-ip-address-of-eem-smtp

3. EEM SMTP Library Command Extensions

smtp_send_email

Sourceaddr: $_email_ipaddr

EEM SMTP Library Command Extensions

Cisco TCL scripts sites

www.packetlevel.ch
ioshints
Tclsh_on_Cisco_IOS_tutorial