IS-IS Authentication – Cisco 300-420 Certification Exams – Routing Protocol Characteristics, EIGRP, and IS-IS

11Sep, 2024

IS-IS Operation and Design – Routing Protocol Characteristics, EIGRP, and IS-IS

This section discusses IS-IS areas, designated routers, authentication, and the Network Entity Title (NET). IS-IS defines areas differently from OSPF; area boundaries are links and not routers. IS-IS has no BDRs. Because IS-IS is an OSI protocol, it uses a NET to identify each router.

IS-IS NET Addressing

Although you can configure IS-IS to route IP, the communication between routers uses OSI PDUs. The NET is the OSI address used for each router to communicate with OSI PDUs. A NET address ranges from 8 to 20 bytes in length and is hexadecimal. It consists of an authority and format identifier (AFI), area ID, system ID, and selector (SEL), as shown in Figure 3-10. The system ID must be unique within the network. An example of an IS-IS NET is 49.0001.1290.6600.1001.00, which consists of the following parts:

Figure 3-10 IS-IS NET

AFI: 49
Area ID: 0001
System ID: 1290.6600.1001
SEL: 00

Level 2 routers use the area ID. The system ID must be the same length for all routers in an area. For Cisco routers, it must be 6 bytes in length. Usually, a router MAC address identifies each unique router. The SEL is configured as 00. You configure the NET with the router isis command. In this example, the domain authority and format identifier (AFI) is 49, the area is 0001, the system ID is 00aa.0101.0001, and the SEL is 00:

router isis
net 49.0001.00aa.0101.0001.00

IS-IS DRs

As with OSPF, IS-IS selects DRs on multiaccess networks. It does not choose a backup DR, as OSPF does. By default, the priority value is 64. You can change the priority value to a value from 0 to 127. If you set the priority to 0, the router is not eligible to become a DR for that network. IS-IS uses the highest system ID to select the DR if there is a tie with the priorities. On point-to-point networks, the priority is 0 because no DR is elected. In IS-IS, all routers in a multiaccess network establish adjacencies with all others in the subnetwork, and IS-IS neighbors become adjacent upon the discovery of one another. Both of these characteristics are different from OSPF behavior.

IS-IS Interface Types

IS-IS has only two network types (or interface types): point-to-point and broadcast. Unlike OSPF, IS-IS does not have nonbroadcast and point-to-multipoint interface types.

IS-IS Area Design

IS-IS uses a two-level hierarchy. Routers are configured to route Level 1 (L1), Level 2 (L2), or both Level 1 and Level 2 (L1/L2). Level 1 routers are like OSPF internal routers in a Cisco totally stubby area. (OSPF is covered in Chapter 4.) An L2 router is similar to an OSPF backbone router. A router that has both Level 1 and 2 routes is similar to an OSPF area border router (ABR). IS-IS does not define a backbone area like OSPF’s area 0, but you can consider the IS-IS backbone a continuous path of adjacencies among Level 2 ISs. When you are creating a backbone, there should never be Level 1 routers between L2-only or L1/L2 routers.

L1/L2 routers maintain separate link-state databases for the L1 routes and for the L2 routes. Also, the L1/L2 routers do not advertise L2 routes to the L1 area. L1 routers do not have information about destinations outside the area and use L1 routes to the L1/L2 routers to reach outside destinations.

As shown in Figure 3-11, IS-IS areas are not bounded by the L1/L2 routers but by the links between L1/L2 routers and L2 backbone routers.

Figure 3-11 IS-IS Areas and Router Types

With IS-IS, you can create three types of topologies:

Flat
Hierarchical
Hybrid

The IS-IS flat design consists of a single area. As shown in Figure 3-12, all routers are on the same level. There is no summarization with this design. This design is recommended for a small network.

Figure 3-12 IS-IS Flat Topology Design

An IS-IS hierarchical topology is recommended for large networks. A backbone area can be created, much as with OSPF, and can have other areas connected via L1/L2 routers, as shown in Figure 3-13. This design allows for network summarization.

Figure 3-13 IS-IS Hierarchical Topology Design

A hybrid IS-IS design is recommended for networks that might not be large enough for a backbone area. As shown in Figure 3-14, the IS-IS areas are connected using L1/L2 routers. This design allows for summarization between areas.

Figure 3-14 IS-IS Hybrid Topology Design

8Aug, 2024

IS-IS Authentication – Routing Protocol Characteristics, EIGRP, and IS-IS

IS-IS supports three types of plaintext authentication: link authentication, area authentication, and domain authentication. All these types support only plaintext password authentication. An RFC draft has added support for IS-IS MD5. The design recommendation is not to use any plaintext authentication and to use MD5 hashing for authentication. With MD5, a cryptographic hash is used instead of plaintext, and the password is never included in the PDU, thus making it more secure.

Routers in a common subnetwork (such as Ethernet or a private line) use link authentication. The plaintext password must be common only between the routers in the link. Level 1 and Level 2 routers use separate passwords. With area authentication, all routers in the area must use authentication and must have the same password.

Only L2 and L1/L2 routers use domain authentication. All L2 and L1/L2 routers must be configured for authentication and must use the same password.

IS-IS for IPv6

IS-IS in IPv6 functions the same as IS-IS in IPv4 and offers many of the same benefits. IPv6 enhancements to IS-IS allow IS-IS to advertise IPv6 prefixes in addition to IPv4 and OSI routes. Extensions to the IS-IS command-line interface (CLI) allow configuration of IPv6-specific parameters. IPv6 IS-IS extends the address families supported by IS-IS to include IPv6, in addition to OSI and IPv4.

IS-IS supports IPv6 as a separate protocol, as described in RFC 5308. The network layer protocol ID (NLPID) 142 (0x8E) identifies it as IPv6. Its operation and design retain the same characteristics as with IS-IS support for IPv4.

Multi-topologies for IS-IS are described in RFC 5120: M-ISIS: Multi Topology (MT) Routing in Intermediate System to Intermediate Systems (IS-ISs). M-ISIS allows for creating independent IP topologies within a single IS-IS domain. IPv4, IPv6, or IPv4/IPv6 may be configured on the interface for either Level 1, Level 2, or Level 1/2 routers. But if IPv4 and IPv6 are configured on the same interface, they must be running the same IS-IS level. It is important to know that if IPv4 and IPv6 are sharing the same topologies with the same router levels, there is no need for multi-topology or transition features.

IS-IS Summary

The characteristics of IS-IS are as follows:

It is a link-state protocol.
It uses OSI CNLP to communicate with routers.
It is a classless protocol (and supports VLSM and CIDR).
The default metric is set to 10 for all active interfaces.
IS-IS has two interface types: point-to-point and broadcast.
It uses a single path metric, with a single link maximum of 64 and a path maximum of 1024.
It sends partial route updates only when there are changes.
IS-IS authentication uses plaintext passwords.
The administrative distance is 115.
It is used in large networks and is sometimes attractive as compared to OSPF and EIGRP.
It is described in ISO/IEC 10589, reprinted by the IETF as RFC 1142.
IS-IS provides support for IPv4 and IPv6 as separate topologies.

1Jan, 2024

LSA Types – OSPF, BGP, and Route Manipulation

OSPF routers generate LSAs that are flooded within an area, between areas, and throughout the entire autonomous system. OSPF defines different LSA types for participating routers, DRs, ABRs, and ASBRs. Understanding the LSA types can help you with other OSPF concepts. Table 4-4 describes the major LSA types. For the ENSLD 300-420 exam, you need to know OSPF LSAs by type code (number) and by type name. Note that there are other LSA types that are not covered in this book.

Type 1 and Type 2 LSAs are intra-area LSAs that have an area-flooding scope. Type 3 LSAs provide summaries of destinations outside the local area but within the OSPF domain. Information carried in OSPF type 3 LSAs includes the network address, the network mask, and a metric. Type 4 LSAs provide reachability about the ASBR. Type 3 and Type 4 LSAs are interarea LSAs that have an area-flooding scope. ABRs exchange Type 3 and Type 4 LSAs. Type 5 LSAs advertise external destinations. Type 5 LSAs have a domain-flooding scope, which means they are flooded throughout all areas. Type 7 LSAs are originated by ASBRs in a not-so-stubby area (NSSA) and are similar to the Type 5 LSA and only flooded within the NSSA.

Table 4-4 Major LSA Types

Type Code	Type	Description
1	Router LSA	Produced by every router. Includes all the router’s links, interfaces, link states, and costs. This LSA type is flooded within a single area and does not travel into other areas.
2	Network LSA	Produced by every DR on every broadcast or NBMA network. It lists all the routers in the multiaccess network. This LSA type is contained within an area.
3	Summary LSA for ABRs	Produced by ABRs. It is sent into an area to advertise destinations outside the area.
4	Summary LSA for ASBRs	Originated by ABRs. Sent into an area by the ABR to advertise the IP addresses of the ASBRs. It does not advertise networks outside the OSPF network; only the ASBR does that.
5	Autonomous system external LSA	Originated by ASBRs. Advertises destinations external to the OSPF autonomous system, flooded throughout the whole OSPF autonomous system.
7	Not-so-stubby area (NSSA) external LSA	Originated by ASBRs in an NSSA. It is not flooded throughout the OSPF autonomous system but only to the NSSA. Similar to the Type 5 LSA.

Autonomous System External Path Types

The two types of autonomous system external paths are Type 1 (E1) and Type 2 (E2), and they are associated with Type 5 LSAs. ASBRs advertise external destinations whose cost can be just a redistribution metric (E2) or a redistribution metric plus the costs of each segment (E1) used to reach the ASBR.

By default, external routes are Type 2, which is the metric (cost) used in the redistribution. Type 1 external routes have a metric that is the sum of the redistribution cost plus the cost of the path to reach the ASBR.

11Nov, 2023

OSPF Stub Area Types – OSPF, BGP, and Route Manipulation

OSPF provides support for stub areas. The concept is to reduce the number of interarea or external LSAs that get flooded into a stub area. RFC 2328 defines OSPF stub areas. RFC 1587 defines support for NSSAs. Cisco routers use totally stubby areas, such as Area 2, as shown in Figure 4-6.

Figure 4-6 OSPF Stub Networks

Stub Areas

Consider Area 1 in Figure 4-6. Its only path to the external networks is via the ABR through Area 0. All external routes are flooded to all areas in the OSPF autonomous system. You can configure an area as a stub area to prevent OSPF external LSAs (Type 5) from being flooded into that area. A single default route is injected into the stub area instead. If multiple ABRs exist in a stub area, all of them inject the default route. Traffic originating within the stub area routes to the closest ABR.

Note that network summary LSAs (Type 3) from other areas are still flooded into the stub area’s Area 1.

Totally Stubby Areas

Let’s take Area 1 in Figure 4-6 one step further. The only path to get from Area 1 to Area 0 and other areas is through the ABR. A totally stubby area does not flood network summary LSAs (Type 3). It stifles Type 4 LSAs, as well. Like regular stub areas, totally stubby areas do not flood Type 5 LSAs. A totally stubby area sends just a single LSA for the default route. If multiple ABRs exist in a totally stubby area, all ABRs inject the default route. Traffic originating within the totally stubby area routes to the closest ABR.

NSSAs

Notice that Area 2 in Figure 4-6 has an ASBR. If this area is configured as an NSSA, it generates the external LSAs (Type 7) into the OSPF system while retaining the characteristics of a stub area to the rest of the autonomous system. There are two options for the ABR. First, the ABR for Area 2 can translate the NSSA external LSAs (Type 7) to autonomous system external LSAs (Type 5) and flood the rest of the internetwork. Second, the ABR is not configured to convert the NSSA external LSAs to Type 5 external LSAs; therefore, the NSSA external LSAs remain within the NSSA.

There is also an NSSA totally stub area. The difference is that the default NSSA has no default route unless the ABR is explicitly configured to advertise one. The NSSA totally stub area does receive a default route.

20Aug, 2023

Virtual Links – OSPF, BGP, and Route Manipulation

OSPF requires that all areas be connected to a backbone router. Sometimes, WAN link provisioning or failures can prevent an OSPF area from being directly connected to a backbone router. You can use virtual links to temporarily connect (virtually) an area to the backbone.

In Figure 4-7, Area 4 is not directly connected to the backbone. A virtual link is configured between Router A and Router B. The flow of the virtual link is unidirectional and must be configured in each router of the link. Area 2 becomes the transit area through which the virtual link is configured. Traffic between Areas 2 and 4 does not flow directly to Router B. Instead, the traffic must flow to Router A to reach Area 0 and then pass through the virtual link.

Figure 4-7 OSPF Virtual Link

OSPFv2 Router Authentication

OSPFv2 supports the authentication of routes using 64-bit plaintext, cryptographic Message Digest 5 (MD5), and Secure Hash (SHA) Standard authentication. Authentication can be performed on a per-area or per-interface basis. Plaintext authentication passwords do not need to be the same for the routers throughout the area, but they must be the same between neighbors.

MD5 authentication provides higher security than plaintext authentication. As with plaintext authentication, passwords do not have to be the same throughout an area, but they do need to be the same between neighbors. SHA-1 authentication is recommended because it is the most secure.

OSPF supports the National Institute of Standards and Technology (NIST) Secure Hash Standard family of algorithms for authentication.

OSPFv2 Summary

OSPFv2 is used in large enterprise IPv4 networks. The network topology must be hierarchical. OSPF is used in the enterprise campus building access, distribution, and core layers. OSPF is also used in the enterprise data center, WAN/MAN, and branch offices.

The characteristics of OSPFv2 follow:

Is a link-state routing protocol
Uses IP protocol 89
Is a classless protocol (supports VLSM and CIDR)
Uses cost as the metric (based on interface bandwidth, by default)
Provides fast convergence, using link-state updates and SPF calculation
Uses reduced bandwidth thanks to sending LSA updates only when changes occur
Labels routes as intra-area, interarea, external Type 1, or external Type 2
Supports authentication
Uses the Dijkstra algorithm to calculate the SPF tree
Has a default administrative distance of 110
Uses multicast address 224.0.0.5 (ALLSPFRouters) and multicast address 224.0.0.6 (ALLDRouters)
Provides good scalability and recommended for large networks

11Jun, 2023

OSPFv3 – OSPF, BGP, and Route Manipulation

RFC 5340 describes Open Shortest Path First version 3 (OSPFv3) as a routing protocol for IPv6 networks. OSPFv3 initially supported IPv6 networks only, but it has been updated to support both IPv6 and IPv4 networks. OSPF algorithms and mechanisms, such as flooding, router types, designated router election, backbone areas, stub areas and NSSAs, and SPF calculations, remain the same. Changes are made for OSPF to support IPv6 addresses, address hierarchy, and IPv6 for transport. OSPFv3 uses multicast group FF02::5 for all OSPF routers and FF02::6 for all designated routers.

OSPFv3 Changes from OSPFv2

The following are the major changes from OSPFv2 to OSPFv3:

IPv6 only: This newer version of OSPF runs over IPv6 only.
Support for IPv6 addressing: New LSAs have been created to carry IPv6 addresses and prefixes.
Per-link processing: OSPFv2 uses per-subnet processing. With link processing, routers in the same link can belong to multiple subnets.
Address semantics removed: Addresses are removed from the router and network LSAs. These LSAs now provide topology information.
No authentication in OSPFv3: OSPFv3 uses IPsec, the IPv6 authentication scheme.
New LSA: There is a new LSA for local-link flooding scope.
New intra-area-prefix LSA: This LSA, which carries all the IPv6 prefix information, is similar to an OSPFv2 router and network LSAs.
Neighbors identified by router ID: Neighbors are always identified by the router ID. This does not occur in OSPFv2 point-to-point and broadcast networks.
Options field changes: Two Options bits, the R bit and the V6 bit, have been added to the Options field for processing router LSAs during the SPF calculation.

Note

In OSPFv3, the router IDs, area IDs, and LSA link-state IDs remain 32 bits. Larger IPv6 addresses cannot be used.

OSPFv3 Areas and Router Types

OSPFv3 retains the same structure and concepts as OSPFv2. The area topology, interfaces, neighbors, link-state database, and routing table remain the same. RFC 2740 does not define new area types or router types.

The OSPF areas shown in Figure 4-2 and the router types shown in Figure 4-4 remain the same. These are the router types in relationship to the OSPF areas:

Internal router: An internal router is any router whose interfaces all belong to the same OSPF area. Such a router keeps only one link-state database.
ABR: An ABR is connected to more than one area, where one area is Area 0. Such a router maintains a link-state database for each area it belongs to. ABRs generate summary LSAs.
ASBR: This type of router injects external LSAs into the OSPF database (redistribution). These external routes are learned via either other routing protocols or static routes.
Backbone router: A backbone router has at least one interface attached to Area 0.

15Mar, 2022

MED Attribute – OSPF, BGP, and Route Manipulation

The multi-exit discriminator (MED) attribute tells an external BGP peer the preferred path into the autonomous system when multiple paths into the same autonomous system exist. In other words, MED influences which one of many paths a neighboring autonomous system uses to reach destinations within the autonomous system. It is an optional nontransitive attribute carried in eBGP updates. The MED attribute is not used with iBGP peers. The lowest MED value is preferred, and the default value is 0. Paths received with no MED are assigned a MED of 0. The MED is carried into an autonomous system but does not leave the autonomous system.

Consider the diagram shown in Figure 4-15. With all attributes considered equal, say that Router C selects Router A as its best path into AS 100, based on Router A’s lower router ID (RID). If Router A is configured with a MED of 200, Router C will select Router B as the best path to AS 100. No additional configuration is required on Router B because the default MED is 0.

Figure 4-15 MED Attribute

Community Attribute

Although it is not an attribute used in the routing-decision process, the community attribute groups routes and applies policies or decisions (accept, prefer) to those routes. It is a group of destinations that share some common property. The community attribute is an optional transitive attribute of variable length.

Atomic Aggregate and Aggregator Attributes

The atomic aggregate attribute informs BGP peers that the local router used a less specific (aggregated) route to a destination instead of using a more specific route.

The purpose of the attribute is to alert BGP speakers along the path that some information has been lost due to the route aggregation process, and the aggregate path might not be the best path to the destination. When some routes are aggregated by an aggregator, the aggregator does attach its RID to the aggregated route in the AGGREGATOR_ID attribute, and it sets the ATOMIC_AGGREGATE attribute (or not) based on whether the AS_Path information of the aggregated routes was preserved. The atomic aggregate attribute lets the BGP peers know that the BGP router used an aggregated route. A more specific route must be in the advertising router’s BGP table before it propagates an aggregate route.

When the atomic aggregate attribute is used, the BGP speaker has the option to send the aggregator attribute. The aggregator attribute includes the ASN and the IP address of the router that originated the aggregated route. In Cisco routers, the IP address used is the RID of the router that performs the route aggregation. Atomic aggregate is a well-known discretionary attribute, and aggregator is an optional transitive attribute.

10Jan, 2022

Weight Attribute – OSPF, BGP, and Route Manipulation

Weight is assigned locally on a router to specify a preferred path if multiple paths exist out of a router for a destination. Weights can be applied to individual routes or to all routes received from a peer. Weight is specific to Cisco routers and is not propagated to other routers. The weight value ranges from 0 to 65,535. Routes with a higher weight are preferred when multiple routes to a destination exist. Routes that are originated by the local router have a default weight of 32,768. The default weight for learned routes is 0.

You can use weight rather than local preference to influence the selected path to external BGP peers. The difference is that weight is configured locally and is not exchanged in BGP updates. On the other hand, the local preference attribute is exchanged between iBGP peers and is configured at the gateway router.

When the same destinations are advertised from both Router B and Router C, as shown in Figure 4-16, Router A prefers the routes from Router C over those from Router B because the routes received from Router C have a larger weight (600) locally assigned.

Figure 4-16 BGP Weight

Table 4-7 lists and describes the BGP attributes and their categories.

Table 4-7 BGP Attributes

BGP Attribute	Description	Category
Origin	Indicates the source of the path information: IGP, EGP, or incomplete.	Well-known mandatory
AS_Path	Lists the ASNs in the path to the destination.	Well-known mandatory
Next hop	Specifies the IP address of the router as the next hop to the destination.	Well-known mandatory
Local preference	Specifies the path to use to exit the AS.	Well-known discretionary
MED	Tells an external BGP peer the preferred path into the AS.	Optional non-transitive
Community	Groups routes and applies policies or decisions (accept, prefer) to those routes. (Not an attribute used in the routing-decision process.)	Optional transitive
Atomic aggregate	Informs BGP peers that the local router used a less specific (aggregated) route to a destination instead of using a more specific route.	Well-known discretionary
Weight	Specifies a preferred path if multiple paths exist out of a router for a destination. Assigned locally on a router.	Optional (Cisco specific)

15Nov, 2021

BGP Decision Process – OSPF, BGP, and Route Manipulation

By default, BGP selects only a single path to reach a specific destination (unless you specify maximum paths). The Cisco implementation of BGP uses a simple decision process. When the path is selected, BGP puts the selected path in its routing table and propagates the path to its neighbors.

To select the best path to a destination, Cisco routers running BGP use the following algorithm in the following order:

If the specified next hop is inaccessible, drop the path.

If the path is internal, and synchronization is enabled, and the path is not in the IGP, drop the path.

Prefer the path with the highest weight. (This step is Cisco specific, and weight is localized to the router.)

Prefer the path with the highest local preference. iBGP uses this path only to reach the preferred external BGP router.

Prefer the path that was locally originated via a network or aggregate BGP subcommand or through redistribution from an IGP. Local paths sourced by network or redistribute commands are preferred over local aggregates sourced by the aggregate-address command. (This step is Cisco specific.)

If no route was originated, prefer the route that has the shortest AS_Path.

If all paths have the same autonomous system path length, prefer the path with the lowest origin type. Paths with an origin type of IGP (lower) are preferred over paths originated from an EGP such as BGP, and EGP origin is preferred over a route with an incomplete origin. (IGP < EGP < incomplete.)

If the origin codes are the same, prefer the path with the lowest MED attribute. An eBGP peer uses this attribute to select a best path to the autonomous system. This attribute is exchanged between autonomous systems. (This step is a tiebreaker, as described in RFC 4271xxx.)

If the paths have the same MED, prefer the external (eBGP) path over the internal (iBGP) path.

If the paths are still the same, prefer the path through the closest IGP neighbor (best IGP metric). (This step is a tiebreaker, as described in RFC 4271xxx.)

Prefer the oldest known path.

Prefer the path with the BGP neighbor with the lowest BGP router ID. (The RFC that defines the BGP describes the router ID.)

Prefer the path with the minimum cluster list length.

Prefer the path with the lowest neighbor IP address.

After BGP decides on a best path, it marks that path with a > sign in the output of the show ip bgp command and adds it to the IP routing table.

Note

Options for influencing outbound routing decisions include weight, local preference, and AS path length. Options for influencing inbound routing decisions include AS path length, BGP communities, and MED.

Table 4-8 shows a summary of the BGP best path order.

Table 4-8 BGP Best Path Order

BGP Best Path Order

Highest weight

Highest local preference

Prefer local originated route

Shortest AS_Path

Lowest origin type

Lowest MED

Prefer eBGP over iBGP

Lowest IGP metric to the BGP next hop

Oldest path

Lowest BGP router ID source

Minimum cluster list length

Lowest neighbor address

5Feb, 2021

Default Metric – OSPF, BGP, and Route Manipulation

You should configure the metric of the redistributed routes to a metric other than 0. You can configure the metric in the redistribution command or configure a default seed metric. You can also use the command default-metric with OSPF. IS-IS does not use the default-metric command. The default-metric command is used to specify the seed metric that is used if a metric is not specified during redistribution. The default-metric command has the following syntax for EIGRP:

Click here to view code image

default-metric
bandwidth delay reliability load mtu

OSPF Redistribution

This section reviews a few things you need to remember when designing a network that will redistribute with OSPF.

When redistributing routes into OSPF, use the subnets keyword to permit subnetted routes to be received. If you do not use it, only the major network route is redistributed, without subnetworks. In other words, OSPF performs automatic summarization to IP classful network values. Also, unlike EIGRP and RIPv2, OSPF does not need a metric to be specified during redistribution; it also does not need a seed metric to be specified because it uses a default metric for redistributed routes.

By default, redistributed routes are classified as external Type 2 (E2) in OSPF. You can use the metric-type keyword to change the external route to an external Type 1 (E1). The network design can take into account the after-redistribution cost (Type 2) or the after-redistribution cost plus the path’s cost (Type 1).

In Figure 4-24, Router B is configured to perform mutual redistribution between EIGRP 100 and OSPF process ID 50. In this example, you can use route maps and access lists to prevent routing loops. The route maps permit or deny the networks that are listed in the access lists. The subnets keyword redistributes every subnet in EIGRP into OSPF. (This book does not cover exact configurations.)

Figure 4-24 OSPF and EIGRP Redistribution

Route Filtering

Filtering of routes can occur either on a redistribution point or in the routing domain to prevent some parts of the network from accessing other sections of the network. Route filtering could be used to filter routes when redistributing between routing protocols.

Filtering at a redistribution point provides the following benefits:

Avoids routing loops
Avoids suboptimal routing
Prevents certain routes from entering the domain

Transit Traffic

With BGP, you should be sure not to configure a network as a transit network between autonomous systems. A transit network can occur when connecting your enterprise network to two ISPs in a multihomed BGP configuration. When BGP routes get exchanged with multiple Internet service providers (ISPs), route filtering is used to prevent advertisement of private addresses and addresses that are out of the scope of the domain. The recommendation is to filter routes so that only the enterprise prefixes are advertised to the ISPs, as illustrated in Figure 4-25.

Figure 4-25 Avoiding BGP Transit Traffic