!
! SOLUTION CONFIG — BORDER-1
! Blueprint: §1.5 BGP — policies, communities, AS-path manipulation
!
version 17.6
service timestamps log datetime msec
service timestamps debug datetime msec
service password-encryption
no ip domain lookup
ip routing
logging buffered 64000
!
hostname BORDER-1
!
enable algorithm-type scrypt secret Lab@2024#EI
!
interface Loopback0
 description Router-ID
 ip address 10.255.3.1 255.255.255.255
 ipv6 address 2001:db8:ff:3::1/128
 no shutdown
!
interface GigabitEthernet1
 description iBGP link to EDGE-1
 ip address 10.0.201.1 255.255.255.254
 no shutdown
!
interface GigabitEthernet2
 description eBGP to ISP-A (AS 65100)
 ip address 198.51.100.1 255.255.255.252
 no shutdown
!
! Standard community list — mark inbound ISP-A routes (§1.5.c.iv)
ip community-list standard COM-ISP-A permit 65001:100
ip community-list standard COM-PREFER-PRIMARY permit 65001:200
ip community-list standard COM-BACKUP-ONLY permit 65001:300
!
! Prefix lists (§1.5.c)
ip prefix-list PL-DEFAULT permit 0.0.0.0/0
ip prefix-list PL-LOOPBACKS permit 10.255.0.0/16 le 32
ip prefix-list PL-RFC1918-DENY deny 10.0.0.0/8 le 32
ip prefix-list PL-RFC1918-DENY deny 172.16.0.0/12 le 32
ip prefix-list PL-RFC1918-DENY deny 192.168.0.0/16 le 32
ip prefix-list PL-RFC1918-DENY permit 0.0.0.0/0 le 32
!
! Route maps for policy (§1.5.c.i attribute manipulation)
route-map RM-ISP-A-IN permit 10
 description Accept default route from ISP-A
 match ip address prefix-list PL-DEFAULT
 set community 65001:100 65001:200
 set local-preference 150
!
route-map RM-ISP-A-IN deny 20
 description Block RFC1918 from ISP
 match ip address prefix-list PL-RFC1918-DENY
!
route-map RM-ISP-A-IN permit 30
 description Accept other routes with community tag
 set community 65001:100
 set local-preference 100
!
route-map RM-ISP-A-OUT permit 10
 description Advertise only our loopbacks to ISP-A
 match ip address prefix-list PL-LOOPBACKS
 ! Remove private communities before sending to ISP (§1.5.d.i)
 set community none
!
route-map RM-ISP-A-OUT deny 20
!
router bgp 65001
 bgp router-id 10.255.3.1
 bgp log-neighbor-changes
 !
 ! iBGP to EDGE-1
 neighbor 10.0.201.0 remote-as 65000
 neighbor 10.0.201.0 description iBGP-to-EDGE-1
 neighbor 10.0.201.0 password Fp6&kN3@sX
 neighbor 10.0.201.0 bfd
 !
 ! eBGP to ISP-A (§1.5.a)
 neighbor 198.51.100.2 remote-as 65100
 neighbor 198.51.100.2 description eBGP-ISP-A
 neighbor 198.51.100.2 ttl-security hops 1
 neighbor 198.51.100.2 password Fp6&kN3@sX
 !
 address-family ipv4
  network 10.255.3.1 mask 255.255.255.255
  !
  neighbor 10.0.201.0 activate
  neighbor 10.0.201.0 send-community both
  neighbor 10.0.201.0 next-hop-self
  !
  neighbor 198.51.100.2 activate
  neighbor 198.51.100.2 route-map RM-ISP-A-IN in
  neighbor 198.51.100.2 route-map RM-ISP-A-OUT out
  ! Remove private AS before advertising (§1.5.d.i)
  neighbor 198.51.100.2 remove-private-as
 !
!
line vty 0 15
 transport input ssh
!
end