BGP Backdoor Routes

When your router learns about a prefix through EBGP and an IGP (RIP, OSPF or EIGRP) then it will always prefer the external BGP route. EBGP uses an administrative distance of 20 so it’s preferred over OSPF (110), RIP (120) or EIGRP (90).

This can introduce a problem, let me show you a scenario:

Above you see 3 routers, R1,R2 and R3. Imagine R1 and R2 are two sites from a customer and R3 is the ISP router.

R1 and R2 have a fast “backdoor” link and OSPF is configured to exchange some prefixes between the two sites. To illustrate this I have added a loopback interface on these two routers.

R1 and R2 are also configured to use EBGP with R3, they advertise the same prefixes as they do in OSPF. This introduces a problem:

Above you see that R1 learns about the 2.2.2.2 /32 prefix through BGP (R3) and OSPF (R2). Since EBGP has a lower (thus better) AD it will install this path in its routing table. The same thing applies to R2 for the 1.1.1.1 /32 prefix.

Let’s take a look at this scenario on our routers, I’ll configure OSPF and BGP and you will learn how to fix this problem.

OSPF Configuration

First we’ll configure R1 and R2 to run OSPF. I’ll advertise their loopback interfaces:

R1(config)#router ospf 1
R1(config-router)#network 192.168.12.0 0.0.0.255 area 0
R1(config-router)#network 1.1.1.1 0.0.0.0 area 0

R2(config)#router ospf 1
R2(config-router)#network 192.168.12.0 0.0.0.255 area 0
R2(config-router)#network 2.2.2.2 0.0.0.0 area 0

Nothing special here, just a basic OSPF configuration. Here’s what the routing table of R1 and R2 looks like now:

R1#show ip route ospf | include 2.2
O        2.2.2.2 [110/2] via 192.168.12.2, 00:00:12, FastEthernet0/0

R2#show ip route ospf | include 1.1
O        1.1.1.1 [110/2] via 192.168.12.1, 00:00:27, FastEthernet0/0

They learned about each others prefixes, great! Our next move is configuring BGP…

BGP Configuration

R1 and R2 will both peer with R3 and I’ll advertise their loopback interfaces in BGP:

R1(config-router)#neighbor 192.168.13.3 remote-as 3
R1(config-router)#network 1.1.1.1 mask 255.255.255.255

R2(config-router)#neighbor 192.168.23.3 remote-as 3
R2(config-router)#network 2.2.2.2 mask 255.255.255.255

R3(config)#router bgp 3
R3(config-router)#neighbor 192.168.13.1 remote-as 1   
R3(config-router)#neighbor 192.168.23.2 remote-as 2

Just a plain and simple BGP configuration. Now look again at the routing table of R1 and R2:

R1#show ip route | incl 2.2 
B        2.2.2.2 [20/0] via 192.168.13.3, 00:00:45

R2#show ip route | incl 1.1
B        1.1.1.1 [20/0] via 192.168.23.3, 00:01:23

R1 and R2 will now use R3 to reach each others loopback interfaces. This happens because the AD of EBGP is 20 while OSPF has an AD of 110. As a result, OSPF is removed from the routing table. So how do we fix this? You could change the administrative distance manually but this tutorial is about the “backdoor” feature so let’s see how it works.

BGP Backdoor Configuration

We have to configure the network that we want to use our “backdoor” for, here’s what it looks like:

R1(config-router)#network 2.2.2.2 mask 255.255.255.255 backdoor

R2(config-router)#network 1.1.1.1 mask 255.255.255.255 backdoor

You use the network command but add the backdoor keyword at the end.

Verification

Let’s see what changed:

R1#show ip route | incl 2.2
O        2.2.2.2 [110/2] via 192.168.12.2, 00:00:42, FastEthernet0/0

R2#show ip route | incl 1.1
O        1.1.1.1 [110/2] via 192.168.12.1, 00:00:28, FastEthernet0/0

Great! Our routers now prefer the OSPF routes again. The prefixes are still in BGP as you can see here:

R1#show ip bgp         
BGP table version is 7, local router ID is 1.1.1.1
Status codes: s suppressed, d damped, h history, * valid, > best, i - internal,
              r RIB-failure, S Stale, m multipath, b backup-path, x best-external, f RT-Filter
Origin codes: i - IGP, e - EGP, ? - incomplete

   Network          Next Hop            Metric LocPrf Weight Path
*> 1.1.1.1/32       0.0.0.0                  0         32768 i
r> 2.2.2.2/32       192.168.13.3                           0 3 2 i

R2#show ip bgp
BGP table version is 7, local router ID is 2.2.2.2
Status codes: s suppressed, d damped, h history, * valid, > best, i - internal,
              r RIB-failure, S Stale, m multipath, b backup-path, x best-external, f RT-Filter
Origin codes: i - IGP, e - EGP, ? - incomplete

   Network          Next Hop            Metric LocPrf Weight Path
r> 1.1.1.1/32       192.168.23.3                           0 3 1 i
*> 2.2.2.2/32       0.0.0.0                  0         32768 i

This is a good thing. When the backdoor link fails we can still use the information from BGP, let’s simulate that:

R1(config)#interface FastEthernet 0/0
R1(config-if)#shutdown

Shutting the interface will cause the OSPF adjacency to drop. Here’s what the routing tables look like when that happens:

R1#show ip route | incl 2.2
B        2.2.2.2 [200/0] via 192.168.13.3, 00:00:28

R2#show ip route | incl 1.1
B        1.1.1.1 [200/0] via 192.168.23.3, 00:00:10

Excellent we now have our BGP information in the routing table. This output also reveals how the backdoor command really works…if you look closely you can see that it changed the AD from 20 to 200.

hostname R1
!
ip cef
!
interface Loopback0
 ip address 1.1.1.1 255.255.255.255
!
interface FastEthernet0/0
 ip address 192.168.12.1 255.255.255.0
!
interface FastEthernet0/1
 ip address 192.168.13.1 255.255.255.0
!
router ospf 1
 network 1.1.1.1 0.0.0.0 area 0
 network 192.168.12.0 0.0.0.255 area 0
!
router bgp 1
 bgp log-neighbor-changes
 network 1.1.1.1 mask 255.255.255.255
 network 2.2.2.2 mask 255.255.255.255 backdoor
 neighbor 192.168.13.3 remote-as 3
!
end

hostname R2
!
ip cef
!
interface Loopback0
 ip address 2.2.2.2 255.255.255.255
!
interface FastEthernet0/0
 ip address 192.168.12.2 255.255.255.0
!
interface FastEthernet0/1
 ip address 192.168.23.2 255.255.255.0
!
router ospf 1
 network 192.168.12.0 0.0.0.255 area 0
 network 2.2.2.2 0.0.0.0 area 0
!
router bgp 2
 bgp log-neighbor-changes
 network 2.2.2.2 mask 255.255.255.255
 network 1.1.1.1 mask 255.255.255.255 backdoor
 neighbor 192.168.23.3 remote-as 3
!
end

hostname R3
!
ip cef
!
interface FastEthernet0/0
 ip address 192.168.13.3 255.255.255.0
!
interface FastEthernet0/1
 ip address 192.168.23.3 255.255.255.0
!
router bgp 3
 bgp log-neighbor-changes
 neighbor 192.168.13.1 remote-as 1 
 neighbor 192.168.23.2 remote-as 2
!
end

That’s all there is to it, I hope you enjoyed this tutorial! If you have any other questions, feel free to leave a comment.