Reinforcing the Kitchen Sink.

Transcription

1 Reinforcing the Kitchen Sink. Aligning Error Handling in BGP-4 with Modern Network Requirements. Rob Shakir Netnod Autumn Meeting 2011

2 Extending BGP-4: ibgp Across an L3VPN VIRTUAL ibgp CE1 1 L3VPN 2 CE2 ebgp ebgp LOCAL_PREF AS_PATH... PACKED ATTR_SET LOCAL_PREF AS_PATH... UNPACKED LOCAL_PREF AS_PATH... Customer sees ibgp attributes despite the fact the UPDATE passed through ebgp in the SP L3VPN Topology. Neat looks like a useful extension to me!

3 DFZ, meet ATTR_SET INTERNET ROUTING TABLE AS65535 ASBR INTERNET DFZ AS64512 ASBR L3VPN ATTR_SET LOCAL_PREF AS_PATH... ATTR_SET intended in an VPNv4 context! But it was leaked to the DFZ ATTR_SET is not valid in this context! UPSTREAM AS UPDATE ATTR_SET NOTIFICATION JunOS

4 A familiar story? AS4_PATH RI NCC/Duke Experimental AS_HOPLIMIT All of these are new or unrecognised attributes! But... IPv4 Unicast

5 A familiar story? AS4_PATH RI NCC/Duke Experimental AS_HOPLIMIT All of these are new or unrecognised attributes! But... IPv4 Unicast IPv6 Unicast

6 A familiar story? AS4_PATH RI NCC/Duke Experimental AS_HOPLIMIT All of these are new or unrecognised attributes! But... IPv4 Unicast IPv6 Unicast MPLS L3VPN (VPNv[46])

7 A familiar story? AS4_PATH RI NCC/Duke Experimental AS_HOPLIMIT All of these are new or unrecognised attributes! But... MPLS PWE3 IPv4 Unicast (L2VPN) IPv6 Unicast MPLS L3VPN (VPNv[46])

8 A familiar story? AS4_PATH RI NCC/Duke Experimental AS_HOPLIMIT All of these are new or unrecognised attributes! But... MPLS PWE3 IPv4 Unicast (L2VPN) VPLS IPv6 Unicast Membership MPLS L3VPN (VPNv[46])

9 A familiar story? AS4_PATH RI NCC/Duke Experimental AS_HOPLIMIT All of these are new or unrecognised attributes! But... MPLS M-VPN PWE3 MDT VPLS IPv4 Unicast IPv6 Unicast (L2VPN) Membership Membership MPLS L3VPN (VPNv[46])

10 A familiar story? AS4_PATH RI NCC/Duke Experimental AS_HOPLIMIT All of these are new or unrecognised attributes! But... MPLS M-VPN PWE3 MDT VPLS IPv4 Unicast IPv6 Unicast Link TE for Alto (L2VPN) Membership Membership MPLS L3VPN (VPNv[46])

11 A familiar story? AS4_PATH RI NCC/Duke Experimental AS_HOPLIMIT All of these are new or unrecognised attributes! But... MPLS M-VPN PWE3 MDT VPLS IPv4 Unicast The IPv6 kitchen Unicast Link sink? TE for Alto (L2VPN) Membership Membership MPLS L3VPN (VPNv[46])

12 A familiar story? AS4_PATH RI NCC/Duke Experimental AS_HOPLIMIT All of these are new or unrecognised attributes! But... MPLS M-VPN PWE3 MDT VPLS IPv4 Unicast The IPv6 kitchen Unicast Link sink? TE for Alto (L2VPN) Membership Membership MPLS L3VPN (VPNv[46]) BGP is the generic, scalable signalling mechanism for IP/MPLS networks.

13 Protecting Networks from BGP Failures (Today) BGP SAKER A TCP/BGP SESSION 1 - AFI 1 TCP/BGP SESSION 2- AFI 2 BGP SAKER B BGP SAKER A UPDATE BGP SAKER B BGP SAKER A NOTIFICATION BGP SAKER B Multi-Session BGP - either kludged (lo4, lo6 ), or pre-standard! (Implemented and on-by-default in 12.2(33)SRC+)

14 Problems with Multi-Session INTERNET INTERNET INTERNET INTERNET INTERNET RR INTERNET INTERNET IPv4 IPv6 Internet Networks BCP: IPv4 Unicast over IPv4 transport. IPv6 Unicast over IPv6 transport. (or 6 over IPv4 transport) L3VPN L3VPN VPN Networks BCP: VPNv4 over IPv4 transport. VPNv4 L3VPN L3VPN L3VPN L3VPN RR L3VPN L3VPN All routes (or topologies) are affected due to a single error within their <AFI,SAFI>! RT 1:1 RT 1:2 RT 1:3

15 What are the requirements for the protocol? When an invalid UPDATE is received, stop sending NOTIFICATION. If we lose UPDATE contents, have a way to recover the RIB. If we must restart a session, don t cause a forwarding outage. Have better ways to monitor errors in UPDATE messages. (Stretched out to 8,500 words in draft-ietf-grow-ops-reqs-for-bgp-error-handling )

16 Message Processing Complexities. In stream processing, not all errors are created equal. MARKER HEADER: MSG LEN = 128 TOTAL PATH ATTRIBUTES LEN = 2000 MP_REACH_NLRI COMMUNITY AS_PATH If we have length discrepancies this can mean that we can t accurately locate path attributes. Critical error no safe NLRI extraction. Invalid attribute contents we can parse the message, but something is malformed. Semantic error we know exactly which NLRI are contained. MARKER HEADER: MSG LEN = 128 TOTAL PATH ATTRIBUTES MP_REACH_NLRI COMMUNITY AS4_PATH: (65535)

17 Handling Critical Errors. RTR A ON ERROR GR RTR B ON ERROR GR RTR A FIB RIB UPDATE RTR B FIB RIB Received UPDATE invalid - cannot extract NLRI. RTR A NOTIFICATION RTR B! FIB STALE RIB IP DATA FIB STALE RIB! RTR A ON RTR B FIB FIB RIB IP DATA RIB Re-use existing graceful-restart functionality to maintain forwarding on NOTIFICATION.

18 Handling Semantic Errors. RTR A UPDATE ADVERTISE /24 RTR B Received UPDATE invalid - but concerns /24 RTR A RTR B UPDATE WITHDRAW /24 via RTR A Erroneous advertisement interpreted as withdrawl of the NLRI. RTR A RTR B IP DST /24 Null0 ONE-TIME ORF RTR A RE-REQUEST ROUTES RTR B ROUTE REFRESH RTC

19 Making errors visible to the NOC Today, an error with a BGP session is very visible to a NOC! BGP to is down - NOTIFICATION received (3/4) NOC OSS SNMP/ SYSLOG BGP ROUTER NOTIFICATION Without NOTIFICATION, we need a new way to signal an error occurred NOC OSS SNMP/ SYSLOG BGP ROUTER UPDATE ORATIONAL BGP ROUTER Local system generated invalid UPDATE /24 and /16 withdrawn by MUP NLRI: / /16

20 So, where next? Requirements are being pushed in the IETF GROW WG Please review them! Numerous drafts in progress in the IDR working group solutions work. New error handling mechanisms proposed in JUNOS, IOS, TiMOS Feature request these mechanisms with your vendors of choice!

21 Questions? Thanks (especially to Netnod!)

22 Further interest? I m always happy to discuss operational issues, and thoughts on solutions! Rob Shakir <rjs@rob.sh> +44(0) Relevant IETF Working Groups: Global Routing Operations WG GROW: Inter-domain Routing IDR: Mailing lists at: