Advanced Computer Networks

Transcription

1 Advanced Computer Networks External Routing - BGP protocol Prof. Andrzej Duda duda@imag.fr Contents Autonomous systems Interconnection of ASs Path vector routing BGP types of AS protocol structure of BGP interconnections attributes filtering Statistics Autonomous systems AS autonomous system border router internal router Set of routers under single technical administration using an interior gateway protocol ( like OSPF) and common metrics to route packets within the AS using an exterior gateway protocol (EGP like BGP) to route packets to other AS subnetwork interconnection layer 3 switch (bridge) AS - autonomy of management IP address allocation AS determines internal routing interconnection layer 2 VLAN static routes protocol (RIP, OSPF) host 3 4 AS Interconnection of AS AS structure one or more border routers all subnetworks inside an AS should be connected should learn about other subnetworks - the routing tables of internal routers should contain entries of all destination of the Internet AS number 16 bits public: private: Examples AS CICG-GRENOBLE, AS1717, AS Renater AS559 - SWITCH Teleinformatics Services (EPFL) AS OPENTRANSIT 5 autonomous system NAP, MAE, GIX, IXP border router subnetworks 6 1

2 Interconnection of AS Interconnection of AS Border routers interconnect AS advertise routes to internal subnetworks AS accepts the traffic there is an internal route to the destination - AS is able to forward packets to the destination, otherwise - black hole learn routes to external subnetworks Interconnection point NAP (Network Access Point), MAE (Metropolitan Area Ethernet), CIX (Commercial Internet exchange), GIX (Global Internet exchange), IXP, SFINX, LINX exchange of traffic - peering contract between ASs High-speed local area network connecting border routers of Ass D C Internet Router 1 Router 2 A B AS of a company Company can advertise its routes in different ways 7 8 Interconnection of AS Interconnection of AS D C D C Internet Internet Router 1 Router 2 A B AS of a company Router 1 Router 2 A B AS of a company A advertised through Router 1, B through Router 2 A and B advertised through both routers External packets use internal resources of the company 9 10 Advertisement of internal routes Advertisement of internal routes D C D C Internet Internet Router 1 Router 2 Router 1 Router 2 A AS of a company B A AS of a company B Router 1 advertises default route Routers 1 and 2 advertise different external routes Traffic from AS goes directly to the Internet 11 Traffic from AS goes to the Internet via private interconnection 12 2

3 Towards BGP Possible strategy exchange distances between ASs find best routes to destinations by Distance Vector problem: count to infinity find best routes to destinations by Link State metrics are not homogeneous scale - no. of AS greater than large OSPF networks policy routing more important than shortest path Path vector knowledge of the global state path: sequence of AS with attributes loop detection: AS appears twice global optimization and policy routing 13 A4 Hierarchical routing OSPF A1 A3 A2 Autonomous System A (ex: EPFL) BGP D5 area 1 D4 B4 BGP D1 area 0 B1 B3 area 2 D2 OSPF Autonomous System C ASs can be transit (B and D), stub (A) or multihomed (C). Only non stub domains need an AS number D3 B2 BGP Autonomous System B Autonomous System D BGP C4 IGRP C3 C1 C2 14 Path Vector routing n1, n2 A A:n1,n2 A:n1,n2 n3 n5 B C C A:n1,n2 C:n3 B A:n1,n2 B:n5 n4 D E D C A:n1,n2 D C: n3 D: n4 AS maintains a table of best paths known so far Table updated using local rules Suitable when BGP table in E dest n1 n2 n3 n4 n5 AS path B A B A D C D B Policy Routing Principle: computation of best path is restricted by explicit rules no global meaning for costs can be assumed (heterogeneous environments) global topology is fairly stable e.g. EPFL-Berkeley link n1 D1 = EPFL D1:n1 D1:n1 DY D2:n2 DX DY Through BGP D2 is not allowed to tell DY: D2 D1:n1 DY is allowed to tell DX: DY D2: n2 D2:n2 D2 = UCB example: backdoor link reserved for peer to peer traffic, should not be used by transit traffic of other AS n2 BGP (Border Gateway Protocol) BGP-4, RFC 1771 AS border router - BGP speaker peer-to peer relation with another AS border router connected communication on top of a TCP connection, port 179 (vs. datagram (RIP, OSPF)) external connections () with border routers of different AS internal connections () with border routers of the same AS BGP only transmits modifications Routes Route - unit of information destination (subnetwork prefix) stored as the NLRI (Network Layer Reachability Information) - <prefix length, IP address> equivalent to CIDR attributes of a path to the destination (e.g. list of AS) Advertised between a pair of BGP speakers Stored in the RIB (Routing Information Base) If route chosen to advertise BGP speaker can add or modify the path attributes

4 Stub AS Stub AS with private AS No. Operator AS BGP: AS Operator AS AS 454 BGP: AS 454 Client AS Client AS AS Stub AS - single connection to another AS BGP not necessary static routes may be sufficient BGP provides more control over routes 19 Operator changes the client AS number to its number limits the need for AS numbers 20 Non transit multi-homed AS Multi-homed AS with one exit Operator 1 AS Operator 2 AS Operator 1 AS Operator 2 AS Client AS Client AS BGP is recommended Client border router has two peer border routers Client strategies redundant route via Operator 2 different contracts with different operators Two exit points Multi-homed transit AS Operator 1 AS Operator AS Operator 2 AS Client AS Client AS Client AS Two exit points to one or two operators Motivated by geographic optimization or redundancy Can be generalized to N exit points Used for transit traffic by other AS

5 ebgb and ebgb and Border routers of different AS exchange route information using External BGP () peer border routers should be on the same subnetwork Border routers of AS exchange route information using Internal BGP () 25 Different internal BGP interconnections full mesh between all border routers (6 connections in ) confederations route reflectors 26 Confederations Route reflectors AS P1 AS P2 AS P3 RR RR RR cluster 1 cluster 2 cluster 3 AS decomposed into sub-as private AS number similar to OSPF areas inside sub-as (full interconnection) between sub-as 27 Cluster of routers one session between one client and RR CLUSTER_ID Route reflector re-advertises a route learnt via to avoid loops ORIGINATOR_ID attribute associated with the advertisement 28 configuration EGP and synchronization R5 R6 lo0 lo0 18.1/16 (OSPF) R2 configured on loopback interface (lo0) interface always up IP address associated with the interface routing guarantees packet forwarding to the interface 29 R5 advertises 18.1/16 to R6 via R6 transmits it to R2 via TCP connection between R6 and R2 R6 injects 18.1/16 into (OSPF - external route) R2 advertises it to R4 via Packet to 18.1/16 from R1 (OSPF) routing table of R2 should contain an entry for 18.1/16 established by (OSPF) R2 must wait for the entry before advertising via R4 30 5

6 Route server BGP principles n1,n n1 n2 n3,n4 n3 n4 Instead of n(n-1)/2 peer to peer connections n connections to Route Server To avoid loops ADVERTISER attribute indicates which router in the AS generated the route 31 Establish BGP session Update list of destinations reachable via each router path attributes such as degree of preference for a particular route 32 BGP principles BGP speaker withdraw n n2 n3 n4 updates in In filter policy Out filter policy updates out n1 no longer reachable Adj-RIB-in Loc-RIB Adj-RIB-out Incremental update withdraw n1 BGP process 33 Local configuration and Routing table 34 Components BGP messages Static description of policies what we advertise to others what we accept from others criteria for processing attributes Dynamic tables containing routing information Adj-RIB - Adjacency Routing Information Base received from other BGP speakers Adj-RIB-in selected for advertisement to other BGP speakers Adj-RIB-out internal, used by the local BGP speaker, routes chosen from Adj-RIB-in by the Decision Process by applying its local policies Loc-RIB 4 types OPEN KEEPALIVE NOTIFICATION UPDATE Size: from 19 to 4096 bytes Security by MD

7 OPEN message NOTIFICATION message First message of BGP session Indicates to the peer BGP router Id optional parameters Proposes a session duration between 3 to 90 sec max time between KEEPALIVE msgs or UPDATE choice of the smallest, 0 - no limit on duration Wait for KEEPALIVE Closes BGP session and TCP connection Error code and subcode Cancels all routes learnt by BGP (can be maintained if configured) Kind of reset in case of error no KEEPALIVE during hold time incorrect message state error UPDATE message Add or withdraw a route advertisement NLRI (Network Layer Reachability Information) list of network prefixes to add or withdraw List of attributes common to all network prefixes in NLRI origin, AS path, metrics, preferences Attribute = type, value, 4 flags UPDATE message 4 flags Well-known/Optional Well-known Mandatory/Discretionary Optional Transitive (let them pass)/nontransitive (eliminate) Partial (at least one router not processed)/complete On 1 byte/on 2 bytes UPDATE message sent when modification Two effects modification of the RIB table of the BGP process sending updates to neighbors BGP state machine Attributes IDLE open TCP connection NOTIFY CONNECTED SESSION ESTABLISHED send OPEN KEEPALIVE OPEN SENT Well-known Mandatory ORIGIN, AS_PATH, NEXT_HOP Well-known Discretionary LOCAL_PREF, ATOMIC_AGGREGATE Optional Transitive COMMUNITY, MULTI_EXIT_DISC (MED), AGGREGATOR Optional Nontransitive WEIGHT UPDATE KEEPALIVE

8 ORIGIN ORIGIN ORIGIN network network network not in routing table Source of information : route internal to the source AS route explicitly injected into BGP by network directive exists in the routing table EGP: route learned via BGP ORIGIN INCOMPLETE ORIGIN network redistribute INCOMPLETE: another origin (by redistribute directive) 43 AS_PATH AS1 AS /24 AS / / /23 Ordered path of AS the advertisement has traversed to reach a destination AS_SEQUENCE each AS adds its number to the list AS_SET aggregation of routes coming from different AS AS1: /24 AS_PATH: 1 AS2: /24 AS_PATH: 2 AS3: /23 AS_PATH: 3 {1 2} AS4: /23 AS_PATH: 4 3 {1 2} AS4 44 ATOMIC_AGGREGATE Atomic aggregation ATOMIC_AGGREGATE indicates information loss when aggregating routes prefix may cover prefixes subject to different policies, e.g. having different AS_PATH or other attributes forbids de-aggregation - route with ATOMIC_AGGREGATE cannot be made more specific not required if an aggregate carries the set of ASs that form the aggregate (aggregated with the AS_SET parameter) AGGREGATOR AS and router that has generated an aggregate / /24 AS 1276 AS AS /16 ATOMIC_AGGREGATE AGGREGATOR={875, } Aggregation Aggregation AS1 AS2 AS3 has /23 (two class C addresses /24 and /24) aggregates all addresses to /22 AS4 receives /24 AS /22 AS /22 AS_PATH: 3 {1 2} AS_PATH: 2 Overlapping routes (more specific and less specific) /22 47 AS1 AS2 More specific route is not always the better longer path through AS5 and AS6 AS4 receives /24 AS3 AS5 AS / /22 AS /22 AS_PATH: 3 {1 2} AS_PATH:

9 Atomic aggregation No aggregation /24 AS / /22 AS3 AS4 AS2 AS4 can advertise /22 AS_PATH: 4 {3 1 2} ATOMIC_AGGREGATE, AGGREGATOR={4, rtr-id} Atomic aggregation AS1 AS /24 AS / /24 If AS3 does not aggregate /23 AS_PATH: /24 AS_PATH: AS_PATH: 4 2 AS / / NEXT_HOP NEXT_HOP R6 R5 R1 R2 R3 R4 10.1/ /16 R3 advertises 10.2/16 to R1, NEXT_HOP = R4 IP address R6 advertises 10.1/16 to R5, NEXT_HOP = R6 IP address /24 AS 1276 Receives and stores: Receives and stores: AS 875 NLRI ORIGIN NEXT_HOP AS_PATH /24 I /24 NLRI ORIGIN NEXT_HOP AS_PATH /24 I Configuration on CISCO Choice of routes /24 router bgp 1276 AS neighbor remote-as 875 network AS /24 When multiple routes exist, choose one route to put into the BGP routing table Preference information local to a BGP router - WEIGHT local to an AS - LOCAL_PREF passed to other ASs - MED router bgp 875 neighbor remote-as 1276 network

10 WEIGHT LOCAL_PREF Associate a weight with a neighbor For a local choice at a BGP router neighbor IP-address weight weight-value The route passing via the neighbor of the largest weight will be chosen Never advertised 55 pref=100 R6 Advertised by (never by ebgb) that AS prefers a given AS_PATH when coming from different Ass done by an entry border router R6 associates pref=100, R2 pref=10 R1 R1 chooses the largest preference bgp default local-preference pref-value Examples prefer a faster or cheaper link R2 pref=10 56 MULTI_EXIT_DISC (MED) COMMUNITY R2 R5 {y} MED=50 {y, z} MED=5 {y} MED=20 Preference for a prefix list when there are several exit routers from an AS advertises its prefixes with MED 10, 20, 50 will accept the prefix with the smallest MED R6 R1 R3 {y} MED=10 R4 57 Mark routes which share a common property Signal routes that needs to be processed in a predefined way Standard well-known values NO_EXPORT - the route should not be advertised to peers outside a confederation NO_ADVERTIZE - the route should not be advertised to any peer Private values AS-no:value ( ) Transitive 58 COMMUNITY COMMUNITY n3 n1 (NO_EXPORT) n2 (NO_EXPORT) n3 COMM=672:X set LOCAL_PREF = X AS 672 primary attach COMM=672:100 AS 987 backup COMM=672:X set LOCAL_PREF = X attach COMM=672:50 Routes not propagated because of the COMMUNITY attribute Set LOCAL_PREF according to community values

11 Choice of the best route Internal routes advertisement Install the best route in Loc-RIB Decreasing priority NEXT_HOP accessible max WEIGHT max LOCAL_PREF route generated by the router the shortest AS_PATH ORIGIN > EGP > INCOMPLETE min MULTI_EXIT_DISC > External confederation > NEXT_HOP accessible via a neighbor route advertised by router having the smallest IP address From static declarations redistribute [static connected] ORIGIN: INCOMPLETE Semi-dynamic network <prefix> ORIGIN: Dynamic redistribute <> <parameters> ORIGIN: EGP Routing policy Route filtering Objectives choose from received routes choose from routes that can be advertised set route attributes Mechanisms prefix filtering AS_PATH filtering (regular expression matching) attribute manipulation prefix aggregation Associate an access list with a neighbor neighbor ID distribute-list no-of-the-list [in/out] Define an access list non-significant-bits (inverse of the netmask) if no action specified at the end of the list, apply "deny everything else" access-list No-of-the-list [deny/permit] IP-address non-significant-bits Route filtering Path filtering / /24 Associate a filter list with a neighbor neighbor ID filter-list no-of-the-list [in/out] /24 AS 1276 AS AS 875 router bgp 1276 network neighbor remote-as 1277 neighbor remote-as 875 neighbor distribute-list 1 out access-list 1 deny access-list 1 permit AS 1276 does not want to forward traffic to /24 of AS it does not re-advertise this prefix 65 Define a filter list ip as-path access-list no-of-the-list [deny/permit] regular-expression Regular expressions ^ beginning of the path $ end of the path. any character? one character _ matches ^ $ ( ) 'space' * any number of characters (zero included) + any number of characters (at least one) 66 11

12 Path filtering Path filtering Examples ^$ - local routes only (empty AS_PATH).* - all routes (all paths AS_PATH) ^300$ - AS_PATH = 300 ^300_ - all routes coming from 300 (e.g. AS_PATH = ) _300$ - all routes originated at 300 (e.g. AS_PATH = ) _300_ - all routes passing via 300 (e.g. AS_PATH = ) / /24 AS 1276 AS AS /24 router bgp 1276 network neighbor remote-as 1277 neighbor remote-as 875 neighbor filter-list 1 out ip as-path access-list 1 deny ^875$ ip as-path access-list 1 permit.* AS 1276 does not want to forward traffic for all internal routes of AS Route maps route-map map-tag [permit deny] instance-no first-instance-conditions: set match next-instance-conditions: set match... route-map SetMetric permit 10 match ip address 1 set metric 200 route-map SetMetric permit 20 set metric 300 Route maps / /24 AS 1276 AS AS /24 router bgp 1276 network neighbor remote-as 1277 neighbor remote-as 875 neighbor route-map SetMetric out access-list 1 permit Set metric 200 (MED) on route /24 69 Set metric 200 on route /24, 300 otherwise 70 Route maps neighbor route-map SetLocal in route-map SetLocal permit 10 set local-preference 300 Set LOCAL_PREF to 300 neighbor route-map AddASnum out route-map AddASnum permit 10 set as-path prepend Route dampening Route modification propagates everywhere successive UPDATE and WITHDRAW of a route Penalty for flapping routes penalty for ill-behaved routes if too ill-behaved, suppressed penalty halved at each half-life-time (configurable) Thresholds suppress-limit reuse-limit Prepend AS to AS_PATH (makes it longer)

13 Route dampening Some statistics penalty suppress-limit reuse-limit t 1 t 2 Route suppressed at t 1, restored at t 2 time Number of routes : exponential increase : CIDR : linear increase (10000/year) : return to exponential increase (42% per year) since 2001: return to linear increase, ~120,000 Number of ASs 51% per year for 4 last years AS effectively used Number of IP addresses 162,128,493 (Jul 2002) 7% per year Number of hosts BGP statistics BGP routing table entries examined: Total ASes present in the Internet Routing Table: Origin-only ASes present in the Internet Routing Table: Transit ASes present in the Internet Routing Table: 1883 Transit-only ASes present in the Internet Routing Table: 63 Average AS path length visible in the Internet Routing Table: 5.3 Max AS path length visible: 23 Number of addresses announced to Internet: Equivalent to 70 /8s, 128 /16s and 147 /24s Percentage of available address space announced: 31.9 Percentage of allocated address space announced:

14 Prefix length distribution /1:0 /2:0 /3:0 /4:0 /5:0 /6:0 /7:0 /8:17 /9:5 /10:8 /11:12 /12:46 /13:90 /14:239 /15:430 /16:7308 /17:1529 /18:2726 /19:7895 /20:7524 /21:5361 /22:8216 /23:9925 /24:64838 /25:185 /26:221 /27:126 /28:105 /29:85 /30:93 /31:0 /32:29 AS SWITCH AS559 SWITCH-AS SWITCH Teleinformatics Services Adjacency: 3 Upstream: 2 Downstream: 1 Upstream Adjacent AS list AS1299 TCN-AS Telia Corporate Network AS3549 GBLX Global Crossing Downstream Adjacent AS list AS4128 RG-SPARE RGnet, Inc. Prefix (AS Path) / / / AS CICG-GRENOBLE Looking glass at genbb1.opentransit.net AS1942 AS1942 FR-CICG-GRENOBLE Adjacency: 1 Upstream: 1 Downstream: 0 Upstream Adjacent AS list AS2200 AS2200 RENATER 2 Prefix (AS Path) / / / / Renater-2, OpenTransit (FT), Sprint 81 sh ip bgp BGP routing table entry for /16, version (metric 16) from ( ) Origin, localpref 100, valid, internal Community: 2200: : : : : :999 Originator: , Cluster list: (metric 16) from ( ) Origin, localpref 100, valid, internal Community: 2200: : : : : :999 Originator: , Cluster list: (metric 16) from ( ) Origin, localpref 100, valid, internal, best Community: 2200: : : : : : From genbb1.opentransit.net Looking glass at genbb1.opentransit.net Tracing the route to horus.imag.fr ( ) 1 P8-0-0.GENAR1.Geneva.opentransit.net ( ) 0 msec 0 msec 0 msec 2 P6-0-0.GENAR2.Geneva.opentransit.net ( ) 0 msec 4 msec 0 msec 3 P4-3.BAGBB1.Bagnolet.opentransit.net ( ) 8 msec 8 msec 8 msec [AS 2200] 16 msec 16 msec 16 msec 5 grenoble-pos1-0.cssi.renater.fr ( ) [AS 2200] 16 msec 20 msec 16 ms 6 tigre-grenoble.cssi.renater.fr ( ) [AS 2200] 20 msec 20 msec 20 msec 7 r-campus.grenet.fr ( ) [AS 1942] 20 msec 16 msec 16 msec 8 r-imag.grenet.fr ( ) [AS 1942] 20 msec 20 msec 20 msec 9 horus.imag.fr ( ) [AS 1942] 16 msec 20 msec 20 msec 83 sh ip bgp BGP routing table entry for /15, version (metric 13) from ( ) Origin, metric 100, localpref 85, valid, internal Community: 5511: :710 Originator: , Cluster list: (metric 13) from ( ) Origin, metric 100, localpref 85, valid, internal Community: 5511: :710 Originator: , Cluster list: (metric 13) from ( ) Origin, metric 100, localpref 85, valid, internal, best Community: 5511: :710 Originator: , Cluster list:

15 From genbb1.opentransit.net Conclusion Tracing the route to empc19.epfl.ch ( ) 1 P5-1.PASBB1.Pastourelle.opentransit.net ( ) 8 msec P4-1.PASBB1.Pastourelle.opentransit.net ( ) 8 msec P5-1.PASBB1.Pastourelle.opentransit.net ( ) 8 msec 2 P8-0.PASBB2.Pastourelle.opentransit.net ( ) 8 msec 8 msec 8 msec 3 Telia.GW.opentransit.net ( ) 8 msec 12 msec 8 msec 4 prs-bb1-pos0-3-0.telia.net ( ) [AS 1299] 8 msec 8 msec 8 msec 5 ffm-bb1-pos2-1-0.telia.net ( ) [AS 1299] 16 msec 16 msec 16 msec 6 zch-b1-pos6-1.telia.net ( ) [AS 1299] 48 msec 32 msec 48 msec 7 dante zch-b1.c.telia.net ( ) [AS 1299] 44 msec 36 msec 44 msec 8 swiez2-g3-2.switch.ch ( ) [AS 559] 36 msec 44 msec 36 msec 9 swils2-g2-3.switch.ch ( ) [AS 559] 36 msec 36 msec 36 msec 10 * * * BGP essential to the current structure of the Internet influence the choice of the routing - OSPF recommended AS numbers exhaustion - extending to 32 bits possible, but deployment difficult complex - policy management, filtering bad configuration - route suppression