BGP foundations

Bringing up a BGP session takes a few lines of configuration. Most of the work, and most of the outages, come from policy: what you accept, what you prefer and what you pass on.

What to learn first

IP routing and CIDR

You should be comfortable with:

prefix lengths and subnet boundaries in binary
longest-prefix matching
connected, static and dynamic routes
default routes and more-specific routes
IPv4 and IPv6 addressing
the difference between forwarding and the routing control plane

APNIC Academy: Routing Fundamentals covers this and gives a first look at BGP, OSPF and IS-IS.

BGP concepts

Learn these before you learn any configuration syntax:

autonomous systems and AS numbers
eBGP and iBGP
session states and message types
how a network is originated
path-vector routing
address families
next-hop resolution
best-path selection
customer, provider and peer relationships

Material:

APNIC Academy: Introduction to BGP
DE-CIX BGP video playlist
BGP for networks who peer, Walter Tremmel's open book, written for his classroom training. He publishes it deliberately as a draft.
Interconnection Academy
APNIC IPv4/IPv6 BGP workshop playlist and the single Intro to BGP video

BGP attributes and policy

At minimum, know:

AS_PATH, used for loop detection and path policy
NEXT_HOP, and why a received path can be unusable
LOCAL_PREF, which picks your outbound path
MED, a weak hint between neighbouring ASes
standard, large and well-known communities
AS-path prepending, and why it often does less than you hope
why you can influence inbound traffic but never fully control it

Resources:

BGP communities 101 (DENOG10, 2018)
BGP Labs routing-policy exercises, including one on using communities in policy

A first lab

Use private ASNs and documentation prefixes only, and keep the lab away from any production routing.

Topology:

AS64512: your test network, two routers
AS64513: simulated provider A
AS64514: simulated provider B
192.0.2.0/24 originated by AS64512
198.51.100.0/24 originated by AS64513
203.0.113.0/24 originated by AS64514
prefixes from 2001:db8::/32 for the IPv6 version

Exercises:

Bring up one IPv4 and one IPv6 eBGP session.
Originate exactly one prefix from each AS.
Write explicit import and export policies that end in a deny.
Check that AS64512 exports only its own prefix.
Add the second provider and use local preference to choose the outbound path.
Prepend on one link and watch how the other ASes choose their path.
Attach a community and use it to set local preference.
Set a realistic prefix limit, exceed it, and see what your daemon does.
Try to leak provider A's routes to provider B and confirm the export policy blocks them.
Remove the export policy, watch the leak happen, restore the policy and write down how you rolled back.
Shut a session gracefully and check that traffic moves the way you expected.
Repeat everything for IPv6. An IPv4 policy does not protect IPv6.

Lab platforms

BGP Labs

BGP Labs has open-source exercises on eBGP, iBGP, routing policy, communities, route reflectors, prefix limits and failures. It runs on several network operating systems, among them FRRouting, Junos, RouterOS and VyOS.

Containerlab

Containerlab builds repeatable topologies from containers. Start with the FRRouting example, then try the peering lab.

FRRouting and BIRD

Both run on an ordinary Linux machine and cost nothing:

FRRouting documentation, with chapters on BGP, prefix lists and route maps
BIRD documentation. BIRD's filter language is close to what FreeTransit runs.

Don't paste a lab configuration into production until you know its defaults, the software version it was written for and how your platform differs.

Move on when

Go on to DN42 and the operations pages once you can:

rebuild the lab without following a configuration line by line
explain why each accepted and exported route is there
show that a simulated leak is blocked
recover from a broken policy through out-of-band access
check both your routing table and what you actually send to each neighbour

Learn before you apply