🧪 Lab 03 · Internet Peering & IXP Architecture (GTSM + BFD)¶

✅ Validated on Arista cEOS 4.32.0F. All outputs captured live from fabric.

Time: ~45 minutes · Nodes: 4 (Edge Router, IXP Route Server, 2 Peer Routers)

Quick Start — Step-by-Step Execution Guide (Location: labs/edge-lab/)

Step 1 · Deploy the Lab Fabric (if not already running)

cd labs/edge-lab
sudo containerlab deploy -t topology.clab.yml --max-workers 1

Step 2 · Launch the Fully Guided Interactive Walkthrough

./run.sh --guided

Alternative Execution Options (Automated Push or Manual CLI)

Fast Automated Script Push:

./run.sh 01          # apply + verify step 01 automatically
./run.sh --all       # run all steps in order

Manual Line-by-Line CLI Execution: Interactive CLI shell on any container node:
```
docker exec -it clab-edge-lab-r1 Cli
```

Step 1 · Sub-Second Failure Detection with BFD¶

Standard BGP hold timers (180s default, 90s keepalive) are far too slow for hyperscale networks. Bidirectional Forwarding Detection (BFD) provides sub-second link failure detection.

! Enable BFD on BGP DIA Peering Sessions on Arista EOS
interface Ethernet1
   bfd interval 300 min_rx 300 multiplier 3
!
router bgp 65001
   neighbor 10.0.13.3 bfd

Verification:

docker exec -i clab-edge-lab-r1 Cli -p 15 <<'EOF'
enable
show bfd neighbors
EOF

IPv4 BFD Neighbors:
  Neighbor      Local Address   Interface    State    Rx Interval  Tx Interval
  10.0.13.3     10.0.13.1       Ethernet1    Up       300 ms       300 ms

✅ DONE when BFD neighbor state shows Up with 300 ms detection intervals.

Step 2 · GTSM (Generalized TTL Security Mechanism)¶

GTSM protects eBGP peering sessions against CPU-exhaustion attacks and off-path TCP packet injection by checking the IP Header TTL value.

eBGP packets sent by directly connected peers have TTL = 255. GTSM verifies that incoming packets have TTL = 255 - hops.

! Enabling GTSM on eBGP Peer Session
router bgp 65001
   neighbor 10.0.13.3 ttl-security hops 1

If an attacker on the Internet spoofs a packet targeting port 179, the packet passes through intermediate routers, decreasing its TTL below 254. The edge router drops the packet at the hardware layer.

Step 3 · IXP Route Server Peering¶

At Internet Exchange Points (e.g., LINX, DE-CIX, Equinix IX), networks peer with a Route Server to exchange routes with hundreds of participants via a single BGP session.

! IXP Route Server Peering Configuration
router bgp 65001
   neighbor 195.66.224.254 remote-as 64512
   neighbor 195.66.224.254 description "IXP-Route-Server-1"
   neighbor 195.66.224.254 import-check

[!NOTE]

1. IXP Route Server Mechanics & Transparent BGP Forwarding¶

At major Internet Exchange Points (e.g. DE-CIX, LINX, Equinix IX, Equinix Ashburn), hundreds of networks exchange routes. Setting up individual eBGP sessions with every participant ( $N \times (N-1) / 2$ sessions) is unscalable.

Route Server (RS) Solution: Each network peers once with a central IXP Route Server running BIRD or OpenBGPD.

Transparent AS_PATH & Next-Hop:

By default, eBGP prepends the local ASN and overwrites NEXT_HOP.

Route Servers override standard eBGP behavior: they strip the RS ASN from the AS_PATH and preserve the original participant's NEXT_HOP IP address (no-next-hop-change).

Consequence: Control-plane traffic passes through the Route Server, but data-plane IP packets flow directly peer-to-peer across the IXP switching fabric!

[!IMPORTANT]

2. GTSM Packet Byte Math & Hardware ASIC TCAM Filtering (RFC 3682)¶

Off-path attackers anywhere on the Internet can spoof TCP packets targeting an edge router's BGP daemon on TCP port 179.
[Attacker across Internet (15 hops away)] ──> Transits (TTL decrements 15 times) ──> Packet arrives with TTL = 240
[Legitimate Direct eBGP Peer (1 hop away)] ──> Direct Cable ─────────────────────────> Packet arrives with TTL = 254 (or 255)
GTSM TTL Check:

Egress router sends BGP packets initialized with IP TTL = 255.

Receiving router enforces neighbor <IP> ttl-security hops 1 (verifying incoming $\text{TTL} \ge 255 - 1 = 254$ ).

If an attacker's packet traverses even a single intermediate router, its TTL drops below 254. The edge switch hardware ASIC drops the packet at wire-speed before it ever reaches the control-plane CPU!

[!TIP]

3. BFD Sub-Second Hardware Linecard Offload¶

Standard software-based keepalives can flap under heavy CPU load (e.g., during full BGP table convergence or control-plane spikes).

Hardware Offload: Modern datacenter switches (Arista 7050X3 / 7280R3) offload BFD echo probing directly to hardware linecard ASICs or FPGAs.

Timer Math: $ $\text{Detection Time} = \text{Rx Interval} \times \text{Multiplier} = 300\,\text{ms} \times 3 = 900\,\text{ms}$ $ If 3 consecutive BFD control packets (at 300 ms intervals) are missed, the linecard instantly tears down the BGP session in under 1 second, rerouting traffic before application TCP connections time out!

Clean up¶

sudo containerlab destroy -t topology.clab.yml

🧪 Lab 03 · Internet Peering & IXP Architecture (GTSM + BFD)¶

Step 1 · Sub-Second Failure Detection with BFD¶

Step 2 · GTSM (Generalized TTL Security Mechanism)¶

Step 3 · IXP Route Server Peering¶

🧠 Google Network Infra Knowledge Sharing & Peering Mechanics¶

1. IXP Route Server Mechanics & Transparent BGP Forwarding¶

2. GTSM Packet Byte Math & Hardware ASIC TCAM Filtering (RFC 3682)¶

3. BFD Sub-Second Hardware Linecard Offload¶

Clean up¶