Introduction Hi. In this video we’re going to review a new Cilium feature called eBGP multihop. This feature is coming with Cilium 1.14. eBGP multihop has been around for a long time, but it is only now coming to Cilium. To explain it, we have to go back to the origins of BGP. Initially, BGP peering was either done internally, which is iBGP, or externally between two different autonomous systems. The expectation was that you had a router in one organization, perhaps with autonomous system 65010, establishing an external BGP peering with another router in a different autonomous system, such as 65011. eBGP multihop overview Those two devices would normally be directly connected, point to point. There was no expectation that the traffic would traverse multiple routed hops. That was primarily for security reasons, because operators did not want BGP updates to travel through an arbitrary part of the network. To enforce that traditional behavior, eBGP used a TTL of 1 in the IP header. The next device would process the packet, the TTL would drop to 0, and the packet would go no further. That effectively ensured that the peering stayed between directly connected devices. TTL and multihop behavior Very quickly, though, there were use cases where operators wanted to establish external BGP sessions across multiple routed hops. That’s where eBGP multihop came in. The way we support eBGP multihop is by increasing the TTL. With Cilium, you can set the TTL to a higher value, for example 10. As the packet travels across the network, the TTL decreases at each hop, but it still has enough remaining to reach the remote BGP peer and establish the session. Packet inspection Let’s have a look at the demo. We’re going to use tcpdump and Wireshark to capture BGP traffic on TCP port 179 and show what happens to the TTL when we enable eBGP multihop. At first, the BGP peering session is already established and working fine, but multihop is not enabled yet. I capture the traffic and inspect the packets. If you look at the IP header, you can see the TTL is set to 1. Again, that is the expected behavior for a traditional eBGP session between directly connected peers. Configure multihop peering Now I edit the BGP peering policy and increase the TTL to 10. Then I capture the traffic again in a different pcap file. This time, when I inspect the BGP packets, the TTL is clearly set to 10. Policy configuration That means the packet can now traverse multiple hops. The TTL will still decrease along the way, but it remains high enough to reach the peer we want to connect to. That is exactly how eBGP multihop works. So this was just a quick update on a new Cilium 1.14 feature. I hope you found it useful. Thanks very much for watching.