When do you need ebgp-multihop, and what are the alternatives?
Show the answer
Say this first
eBGP sends with TTL 1 and expects the peer on a directly connected subnet. If I peer between loopbacks, for
example to share load across parallel links, or through another device, I need neighbor x ebgp-multihop N
to raise the TTL, plus a route to the peer's address, usually static. Between loopbacks of directly connected
routers, disable-connected-check is tidier because it keeps TTL 1. ttl-security hops N (GTSM) is the
security opposite: send with TTL 255 and only accept packets that arrive with a TTL close to 255.
Go deeper
Loopback peering across two parallel links
R1 (AS 64500) and R5 (AS 64510) are joined by two links, 10.0.15.0/30 and 10.0.15.4/30:
interface Loopback0
ip address 10.255.0.1 255.255.255.255
!
ip route 10.255.0.5 255.255.255.255 10.0.15.2
ip route 10.255.0.5 255.255.255.255 10.0.15.6
!
router bgp 64500
neighbor 10.255.0.5 remote-as 64510
neighbor 10.255.0.5 update-source Loopback0
neighbor 10.255.0.5 disable-connected-checkR5 mirrors it. The two static routes give equal-cost paths to the loopback, so one BGP session survives a link failure and traffic shares both links.
Through a firewall or another router
router bgp 64500
neighbor 10.255.0.5 ebgp-multihop 2Use the smallest hop count that works.
GTSM
neighbor 192.0.2.1 ttl-security hops 1 makes both sides send with TTL 255 and drop BGP packets that arrive
with a lower TTL than a directly connected peer could produce. A spoofed packet from far away cannot arrive with
such a high TTL. It cannot be combined with ebgp-multihop on the same neighbor.
They will ask next
Why not set ebgp-multihop 255 and forget about it?
The session could then form over unexpected long paths after a failure, and you give up the protection that a low TTL gives. Set what the topology needs.
What goes wrong with multihop eBGP through a firewall?
The firewall must allow TCP 179 in both directions and must not strip TCP options, or MD5 authentication breaks. Some firewalls also randomise sequence numbers, which breaks MD5 too.
Traps
- Forgetting the route to the peer's loopback. Multihop does not create reachability.