Service providers use routing policies that cause a border router to choose a path received over an iBGP session (of another border router) as the best path for a prefix even if it has an eBGP learned path. This practice is popularly known as active-backup topology and is done to define one exit or egress point for the prefix in the autonomous system and to use the other points as backups if the primary link or eBGP peering is unavailable.

The policy, though beneficial, causes the border router to hide the paths learned over its eBGP sessions from the autonomous system because the border router does not advertise any path for such prefixes. To cope with this situation, some routers advertise one externally learned path called the best external path. The best external behavior causes the BGP selection process to select two paths to every destination:

• The best path is selected from the complete set of routes known to that destination.
• The best external path is selected from the set of routes received from its external peers.

BGP advertises the best path to external peers. Instead of withdrawing the best path from its internal peers when it selects an iBGP path as the best path, BGP advertises the best external path to the internal peers.

The BGP Best External feature is an essential component of the Prefix-Independent Convergence (PIC) edge for both Internet access and MPLS VPN scenarios and makes alternate paths available in the network in the active-backup topology.

The BGP Best External feature uses a "best external route" as a backup path, which, according to draft-marques-idr-best-external, is the most preferred route among those received from external neighbors. The most preferred route from external neighbors can be the following:

• Two routers in different clusters that have an iBGP session between them.
• Two routers in different autonomous systems of a confederation that have an eBGP session between them.

The best external route might be different from the best route installed in the routing information base (RIB). The best route could be an internal route. By allowing the best external route to be advertised and stored, in addition to the best route, networks gain faster restoration of connectivity by providing additional paths that may be used if the primary path fails.

The BGP Best External feature is based on Internet Engineering Task Force (IETF) draft-marques-idr-best-external.txt. The BGP Best External feature advertises a best external route to its internal peers as a backup route. The backup route is stored in the RIB and Cisco Express Forwarding. If the primary path fails, the BGP PIC functionality enables the best external path to take over, enabling faster restoration of connectivity.

Figure 1

MPLS VPN: Best External at the Edge of MPLS VPN

Figure 1 shows an MPLS VPN using the BGP Best External feature. The network includes the following components:

• eBGP sessions exist between the provider edge (PE) and customer edge (CE) routers.
• PE1 is the primary router and has a higher local preference setting.
• Traffic from CE2 uses PE1 to reach router CE1.
• PE1 has two paths to reach CE1.
• CE1 is dual-homed with PE1 and PE2.
• PE1 is the primary path and PE2 is the backup path.

In Figure 1 , traffic in the MPLS cloud flows through PE1 to reach CE1. Therefore, PE2 uses PE1 as the best path and PE2 as the backup path.

PE1 and PE2 are configured with the BGP Best External feature. BGP computes both the best path (the PE1-CE1 link) and a backup path (PE2) and installs both paths into the RIB and Cisco Express Forwarding. The best external path (PE2) is advertised to the peer routers, in addition to the best path.

When Cisco Express Forwarding detects a link failure on the PE1-CE1 link, Cisco Express Forwarding immediately switches to the backup path PE2. Traffic is quickly rerouted due to local Fast Convergence in Cisco Express Forwarding using the backup path. Thus, traffic loss is minimized and fast convergence is achieved.

You can enable the BGP Best External feature in different modes, each of which protects VRFs in its own way:

• If you issue the bgp advertise-best-external command in VPNv4 address family configuration mode, it applies to all IPv4 VRFs. If you issue the command in this mode, you need not issue it for specific VRFs.
• If you issue the bgp advertise-best-external command in IPv4 address family configuration mode, it applies only that VRF.

1.    enable

2.    configure terminal

3.    router bgp autonomous-system-number

4.   Do one of the following:

5.    bgp advertise-best-external

6.    neighbor ip-address remote-as autonomous-system-number

7.    neighbor ip-address activate

8.    neighbor ip-address fall-over [b fd|route-map map-name]

9.    end

1.    enable

2.    show vrf detail

3.    show ip bgp ipv4 {mdt {all | rd | vrf} | multicast | tunnel| unicast} orshow ip bgp vpnv4{all| rd route-distinguisher | vrf vrf-name}[rib-failure][ip-prefix/length [longer-prefixes]][network-address[mask][longer-prefixes]][cidr-only][community][community-list][dampened-paths][filter-list] [flap-statistics][inconsistent-as][neighbors][paths [line]][peer-group][quote-regexp][regexp] [summary][labels]

4.    show bgp vpnv4 unicast vrf vrf-name ip-address

5.    show ip route vrf vrf-name repair-paths ip-address

6.    show ip cef vrf vrf-name ip-address detail

Router> enable
Router#

Router# show vrf detail
VRF test1 (VRF Id = 1); default RD 400:1; default VPNID <not set>
  Interfaces:
    Se4/0                   
Address family ipv4 (Table ID = 1 (0x1)):
  Export VPN route-target communities
    RT:100:1                 RT:200:1                 RT:300:1
    RT:400:1                
  Import VPN route-target communities
    RT:100:1                 RT:200:1                 RT:300:1
    RT:400:1                
  No import route-map
  No export route-map
  VRF label distribution protocol: not configured
  VRF label allocation mode: per-prefix
 
 Prefix protection with additional path enabled
Address family ipv6 not active.

Router# show ip bgp vpnv4 all
BGP table version is 1104964, local router ID is 10.2.2.2
Status codes: s suppressed, d damped, h history, * valid, > best, i - internal,
              r RIB-failure, S Stale, multipath, 
b backup-path, x best-external
Origin codes: i - IGP, e - EGP, ? - incomplete
   Network          Next Hop            Metric LocPrf Weight Path
Route Distinguisher: 11:12 (default for vrf blue)
*>i1.0.0.1/32       10.10.3.3                  0     200     0 1 ?
* i                 10.10.3.3                  0     200     0 1 ?
*                   10.0.0.1                                 0 1 ?
*bx                 10.0.0.1                   0             0 1 ?
*                   10.0.0.1                                 0 1 ?

Router# show bgp vpnv4 unicast vrf vpn1 10.10.10.10
BGP routing table entry for 10:10:10.10.10.10/32, version 10
Paths: (2 available, best #1, table vpn1)
  Advertise-best-external
  Advertised to update-groups:
    1          2         
  200
    10.6.6.6 (metric 21) from 10.6.6.6 (10.6.6.6)
    Origin incomplete, metric 0, localpref 200, valid, internal, best
    Extended Community: RT:1:1
    mpls labels in/out 23/23
  200
    10.1.2.1 from 10.1.2.1 (10.1.1.1)
    Origin incomplete, metric 0, localpref 100, valid, 
external, backup/repair,     advertise-best-external
    Extended Community: RT:1:1 , recursive-via-connected
    mpls labels in/out 23/nolabel

Router# show ip route vrf vpn1 repair-paths 
Routing Table: vpn1
Codes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGP
       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area 
       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
       E1 - OSPF external type 1, E2 - OSPF external type 2
       i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
       ia - IS-IS inter area, * - candidate default, U - per-user static route
       o - ODR, P - periodic downloaded static route, H - NHRP
       + - replicated route, % - next hop override
Gateway of last resort is not set
      10.0.0.0/8 is variably subnetted, 2 subnets, 2 masks
B        10.1.1.0/24 [200/0] via 10.6.6.6, 00:38:33
                    [RPR][200/0] via 10.1.2.1, 00:38:33
B        10.1.1.1/32 [200/0] via 10.6.6.6, 00:38:33
                    [RPR][200/0] via 10.1.2.1, 00:38:33
      10.0.0.0/8 is variably subnetted, 3 subnets, 2 masks
C        10.1.2.0/24 is directly connected, Ethernet0/0
L        10.1.2.2/32 is directly connected, Ethernet0/0
B        10.1.6.0/24 [200/0] via 10.6.6.6, 00:38:33
                     [RPR][200/0] via 10.1.2.1, 00:38:33

Router# show ip cef vrf test 10.71.8.164 detail

10.71.8.164/30, epoch 0, flags rib defined all labels
 recursive via 10.249.0.102 label 35
   nexthop 10.249.246.101 Ethernet0/0 label 25
 recursive via 10.249.0.104 label 28, 
repair
   nexthop 10.249.246.101 Ethernet0/0 label 24