BGP Best Current Practices. ISP Training Workshops

Transcription

1 BGP Best Curret Practices ISP Traiig Workshops 1

2 Cofigurig BGP Where do we start? 2

3 IOS Good Practices p ISPs should start off with the followig BGP commads as a basic template: router bgp bgp determiistic-med distace bgp o sychroizatio o auto-summary p If supportig more tha just IPv4 uicast eighbours o bgp default ipv4-uicast is also very importat ad required Replace with public ASN Make ebgp ad ibgp distace the same 3

4 Cisco IOS Good Practices p p p BGP i Cisco IOS is permissive by default Cofigurig BGP peerig without usig filters meas: All best paths o the local router are passed to the eighbour All routes aouced by the eighbour are received by the local router Ca have disastrous cosequeces Good practice is to esure that each ebgp eighbour has iboud ad outboud filter applied: router bgp eighbor remote-as eighbor prefix-list as64510-i i eighbor prefix-list as64510-out out 4

5 What is BGP for?? What is a IGP ot for? 5

6 BGP versus OSPF/ISIS p Iteral Routig Protocols (IGPs) examples are ISIS ad OSPF used for carryig ifrastructure addresses NOT used for carryig Iteret prefixes or customer prefixes desig goal is to miimise umber of prefixes i IGP to aid scalability ad rapid covergece 6

7 BGP versus OSPF/ISIS p BGP used iterally (ibgp) ad exterally (ebgp) p ibgp used to carry some/all Iteret prefixes across backboe customer prefixes p ebgp used to exchage prefixes with other ASes implemet routig policy 7

8 BGP versus OSPF/ISIS p DO NOT: distribute BGP prefixes ito a IGP distribute IGP routes ito BGP use a IGP to carry customer prefixes p YOUR NETWORK WILL NOT SCALE 8

9 Aggregatio 9

10 Aggregatio p Aggregatio meas aoucig the address block received from the RIR to the other ASes coected to your etwork p Subprefixes of this aggregate may be: Used iterally i the ISP etwork Aouced to other ASes to aid with multihomig p Ufortuately too may people are still thikig about class Cs, resultig i a proliferatio of /24s i the Iteret routig table Note: Same is happeig for /48s with IPv6 10

11 Cofigurig Aggregatio Cisco IOS p ISP has /19 address block p To put ito BGP as a aggregate: router bgp etwork mask ip route ull0 p The static route is a pull up route more specific prefixes withi this address block esure coectivity to ISP s customers logest match lookup 11

12 Aggregatio p Address block should be aouced to the Iteret as a aggregate p Subprefixes of address block should NOT be aouced to Iteret uless for traffic egieerig See BGP Multihomig presetatios p Aggregate should be geerated iterally Not o the etwork borders! 12

13 Aoucig Aggregate Cisco IOS p Cofiguratio Example router bgp 64511! etwork mask eighbor remote-as 101 eighbor prefix-list out-filter out ip route ull0! ip prefix-list out-filter permit /19 ip prefix-list out-filter dey /0 le 32 13

14 Aoucig a Aggregate p ISPs who do t ad wo t aggregate are held i poor regard by commuity p Registries publish their miimum allocatio size Aythig from a /20 to a /22 depedig o RIR Differet sizes for differet address blocks p No real reaso to see aythig loger tha a /22 prefix i the Iteret BUT there are curretly (Jue 2012) > /24s! p But: APNIC chaged (Oct 2010) its miimum allocatio size o all blocks to /24 IPv4 ru-out is startig to have a impact 14

15 Aggregatio Example / / /22 Iteret AS100 customer /23 p Customer has /23 etwork assiged from AS100 s /19 address block p AS100 aouces customers idividual etworks to the Iteret 15

16 Aggregatio Bad Example p p Customer lik goes dow Their /23 etwork becomes ureachable /23 is withdraw from AS100 s ibgp Their ISP does t aggregate its /19 etwork block /23 etwork withdrawal aouced to peers starts ripplig through the Iteret added load o all Iteret backboe routers as etwork is removed from routig table p Customer lik returs Their /23 etwork is ow visible to their ISP Their /23 etwork is readvertised to peers Starts ripplig through Iteret Load o Iteret backboe routers as etwork is reiserted ito routig table Some ISP s suppress the flaps Iteret may take mi or loger to be visible Where is the Quality of Service??? 16

17 Aggregatio Example Iteret /19 AS /19 aggregate customer /23 p Customer has /23 etwork assiged from AS100 s /19 address block p AS100 aouced /19 aggregate to the Iteret 17

18 Aggregatio Good Example p Customer lik goes dow their /23 etwork becomes ureachable /23 is withdraw from AS100 s ibgp p /19 aggregate is still beig aouced o BGP hold dow problems o BGP propagatio delays o dampig by other ISPs p Customer lik returs p Their /23 etwork is visible agai The /23 is re-ijected ito AS100 s ibgp p The whole Iteret becomes visible immediately p Customer has Quality of Service perceptio 18

19 Aggregatio Summary p Good example is what everyoe should do! Adds to Iteret stability Reduces size of routig table Reduces routig chur Improves Iteret QoS for everyoe p Bad example is what too may still do! Why? Lack of kowledge? Laziess? 19

20 Separatio of ibgp ad ebgp p May ISPs do ot uderstad the importace of separatig ibgp ad ebgp ibgp is where all customer prefixes are carried ebgp is used for aoucig aggregate to Iteret ad for Traffic Egieerig p Do NOT do traffic egieerig with customer origiated ibgp prefixes Leads to istability similar to that metioed i the earlier bad example Eve though aggregate is aouced, a flappig subprefix will lead to istability for the customer cocered p Geerate traffic egieerig prefixes o the Border Router 20

21 The Iteret Today (August 2012) p Curret Iteret Routig Table Statistics BGP Routig Table Etries Prefixes after maximum aggregatio Uique prefixes i Iteret Prefixes smaller tha registry alloc /24s aouced ASes i use

22 Efforts to improve aggregatio p The CIDR Report Iitiated ad operated for may years by Toy Bates Now combied with Geoff Husto s routig aalysis p p (covers both IPv4 ad IPv6 BGP tables) Results ed o a weekly basis to most operatios lists aroud the world Lists the top 30 service providers who could do better at aggregatig p RIPE Routig WG aggregatio recommedatio RIPE

23 Efforts to Improve Aggregatio The CIDR Report p Also computes the size of the routig table assumig ISPs performed optimal aggregatio p Website allows searches ad computatios of aggregatio to be made o a per AS basis Flexible ad powerful tool to aid ISPs Iteded to show how greater efficiecy i terms of BGP table size ca be obtaied without loss of routig ad policy iformatio Shows what forms of origi AS aggregatio could be performed ad the potetial beefit of such actios to the total table size Very effectively challeges the traffic egieerig excuse 23

24 24

25 25

26 26

27 Importace of Aggregatio p Size of routig table Router Memory is ot so much of a problem as it was i the 1990s Routers ca be specified to carry 1 millio+ prefixes p Covergece of the Routig System This is a problem Bigger table takes loger for CPU to process BGP updates take loger to deal with BGP Istability Report tracks routig system update activity bgpupdates.potaroo.et/istability/bgpupd.html 27

28 28

29 29

30 Receivig Prefixes 30

31 Receivig Prefixes p There are three scearios for receivig prefixes from other ASNs Customer talkig BGP Peer talkig BGP Upstream/Trasit talkig BGP p Each has differet filterig requiremets ad eed to be cosidered separately 31

32 Receivig Prefixes: From Customers p ISPs should oly accept prefixes which have bee assiged or allocated to their dowstream customer p If ISP has assiged address space to its customer, the the customer IS etitled to aouce it back to his ISP p If the ISP has NOT assiged address space to its customer, the: Check i the five RIR databases to see if this address space really has bee assiged to the customer The tool: whois h jwhois.apic.et x.x.x.0/24 p (jwhois queries all RIR databases) 32

33 Receivig Prefixes: From Customers p Example use of whois to check if customer is etitled to aouce address space: $ whois -h whois.apic.et ietum: etame: APNIC-AP descr: Asia Pacific Network Iformatio Cetre descr: Regioal Iteret Registry for the Asia-Pacific descr: 6 Cordelia Street descr: South Brisbae, QLD 4101 descr: Australia coutry: AU admi-c: AIC1-AP Portable meas its a tech-c: NO4-AP assigmet to the customer, the mt-by: APNIC-HM customer ca aouce it to you mt-irt: IRT-APNIC-AP chaged: hm-chaged@apic.et status: ASSIGNED PORTABLE chaged: hm-chaged@apic.et source: APNIC 33

34 Receivig Prefixes: From Customers p Example use of whois to check if customer is etitled to aouce address space: $ whois -h whois.ripe.et ietum: etame: UK-PIPEX descr: Verizo UK Limited coutry: GB ALLOCATED meas that this is Provider Aggregatable address org: ORG-UA24-RIPE space ad ca oly be aouced admi-c: WERT1-RIPE by the ISP holdig the allocatio tech-c: UPHM1-RIPE (i this case Verizo UK) status: ALLOCATED UNSPECIFIED remarks: Please sed abuse otificatio to abuse@uk.uu.et mt-by: RIPE-NCC-HM-MNT mt-lower: AS1849-MNT mt-routes: AS1849-MNT mt-routes: WCOM-EMEA-RICE-MNT mt-irt: IRT-MCI-GB source: RIPE # Filtered 34

35 Receivig Prefixes from customer: Cisco IOS p For Example: dowstream has /20 block should oly aouce this to upstreams upstreams should oly accept this from them p Cofiguratio o upstream router bgp 100 eighbor remote-as 101 eighbor prefix-list customer i! ip prefix-list customer permit /20 35

36 Receivig Prefixes: From Peers p A peer is a ISP with whom you agree to exchage prefixes you origiate ito the Iteret routig table Prefixes you accept from a peer are oly those they have idicated they will aouce Prefixes you aouce to your peer are oly those you have idicated you will aouce 36

37 Receivig Prefixes: From Peers p Agreeig what each will aouce to the other: Exchage of documetatio as part of the peerig agreemet, ad the ogoig updates OR Use of the Iteret Routig Registry ad cofiguratio tools such as the IRRToolSet 37

38 Receivig Prefixes from peer: Cisco IOS p For Example: Peer has /16, /18 ad /17 address blocks p Cofiguratio o local router router bgp 100 eighbor remote-as 101 eighbor prefix-list my-peer i! ip prefix-list my-peer permit /16 ip prefix-list my-peer permit /18 ip prefix-list my-peer permit /17 ip prefix-list my-peer dey /0 le 32 38

39 Receivig Prefixes: From Upstream/Trasit Provider p Upstream/Trasit Provider is a ISP who you pay to give you trasit to the WHOLE Iteret p Receivig prefixes from them is ot desirable uless really ecessary Traffic Egieerig see BGP Multihomig presetatios p Ask upstream/trasit provider to either: origiate a default-route OR aouce oe prefix you ca use as default 39

40 Receivig Prefixes: From Upstream/Trasit Provider p Dowstream Router Cofiguratio router bgp 100! etwork mask eighbor remote-as 101 eighbor prefix-list ifilter i eighbor prefix-list outfilter out ip prefix-list ifilter permit /0! ip prefix-list outfilter permit /19 40

41 Receivig Prefixes: From Upstream/Trasit Provider p Upstream Router Cofiguratio router bgp 101! eighbor remote-as 100 eighbor default-origiate eighbor prefix-list cust-i i eighbor prefix-list cust-out out ip prefix-list cust-i permit /19! ip prefix-list cust-out permit /0 41

42 Receivig Prefixes: From Upstream/Trasit Provider p If ecessary to receive prefixes from ay provider, care is required. Do t accept default (uless you eed it) Do t accept your ow prefixes p For IPv4: Do t accept private (RFC1918) ad certai special use prefixes: Do t accept prefixes loger tha /24 (?) p For IPv6: Do t accept certai special use prefixes: Do t accept prefixes loger tha /48 (?) 42

43 Receivig Prefixes: From Upstream/Trasit Provider p Check Team Cymru s list of bogos p For IPv4 also cosult: p For IPv6 also cosult: p Bogo Route Server: Supplies a BGP feed (IPv4 ad/or IPv6) of address blocks which should ot appear i the BGP table 43

44 Receivig IPv4 Prefixes router bgp 100 etwork mask eighbor remote-as 101 eighbor prefix-list i-filter i! ip prefix-list i-filter dey /0! Default ip prefix-list i-filter dey /8 le 32! Network Zero ip prefix-list i-filter dey /8 le 32! RFC1918 ip prefix-list i-filter dey /10 le 32! RFC6598 shared address ip prefix-list i-filter dey /19 le 32! Local prefix ip prefix-list i-filter dey /8 le 32! Loopback ip prefix-list i-filter dey /16 le 32! Auto-cofig ip prefix-list i-filter dey /12 le 32! RFC1918 ip prefix-list i-filter dey /24 le 32! TEST1 ip prefix-list i-filter dey /16 le 32! RFC1918 ip prefix-list i-filter dey /15 le 32! Bechmarkig ip prefix-list i-filter dey /24 le 32! TEST2 ip prefix-list i-filter dey /24 le 32! TEST3 ip prefix-list i-filter dey /3 le 32! Multicast ip prefix-list i-filter dey /0 ge 25! Prefixes >/24 ip prefix-list i-filter permit /0 le 32 44

45 Receivig IPv6 Prefixes router bgp 100 etwork 2020:3030::/32 eighbor 2020:3030::1 remote-as 101 eighbor 2020:3030::1 prefix-list v6i-filter i! ipv6 prefix-list v6i-filter permit 2001::/32 ipv6 prefix-list v6i-filter dey 2001::/32 le 128 ipv6 prefix-list v6i-filter dey 2001:db8::/32 le 128 ipv6 prefix-list v6i-filter permit 2002::/16 ipv6 prefix-list v6i-filter dey 2002::/16 le 128 ipv6 prefix-list v6i-filter dey 2020:3030::/32 le 128 ipv6 prefix-list v6i-filter dey 3ffe::/16 le 128 ipv6 prefix-list v6i-filter permit 2000::/3 le 48 ipv6 prefix-list v6i-filter dey ::/0 le 128! Teredo! Teredo subets! Documetatio! 6to4! 6to4 subets! Local Prefix! Old 6boe! Global Uicast 45

46 Receivig Prefixes p Payig attetio to prefixes received from customers, peers ad trasit providers assists with: The itegrity of the local etwork The itegrity of the Iteret p Resposibility of all ISPs to be good Iteret citizes 46

47 Prefixes ito ibgp 47

48 Ijectig prefixes ito ibgp p Use ibgp to carry customer prefixes do t use IGP p Poit static route to customer iterface p Use BGP etwork statemet p As log as static route exists (iterface active), prefix will be i BGP 48

49 Router Cofiguratio: etwork statemet p Example: iterface loopback 0 ip address ! iterface Serial 5/0 ip uumbered loopback 0 ip verify uicast reverse-path! ip route Serial 5/0! router bgp 100 etwork mask

50 Ijectig prefixes ito ibgp p Iterface flap will result i prefix withdraw ad reaouce use ip route... permaet p May ISPs redistribute static routes ito BGP rather tha usig the etwork statemet Oly do this if you uderstad why 50

51 Router Cofiguratio: redistribute static p Example: ip route Serial 5/0! router bgp 100 redistribute static route-map static-to-bgp <sip>! route-map static-to-bgp permit 10 match ip address prefix-list ISP-block set origi igp <sip>! ip prefix-list ISP-block permit /22 le 30 51

52 Ijectig prefixes ito ibgp p Route-map ISP-block ca be used for may thigs: settig commuities ad other attributes settig origi code to IGP, etc p Be careful with prefix-lists ad route-maps absece of either/both meas all statically routed prefixes go ito ibgp 52

53 Summary p Best Practices Covered: Whe to use BGP Whe to use ISIS/OSPF Aggregatio Receivig Prefixes Prefixes ito BGP 53

54 BGP Best Curret Practices ISP Traiig Workshops 54