Deploying 32-bit ASNs

Transcription

1 Deployig 32-bit ASNs ISP Workshops These materials are licesed uder the Creative Commos Attributio-NoCommercial 4.0 Iteratioal licese ( Last updated 26 th September

2 Ackowledgemets p This material origiated from the Cisco ISP/IXP Workshop Programme developed by Philip Smith & Barry Greee p Use of these materials is ecouraged as log as the source is fully ackowledged ad this otice remais i place p Bug fixes ad improvemets are welcomed Please workshop (at) bgp4all.com Philip Smith 2

3 32-bit ASNs p Stadards documets Descriptio of 32-bit ASNs p Textual represetatio p New exteded commuity p p AS is reserved as iterface betwee 16-bit ad 32-bit ASN world 3

4 32-bit ASNs termiology p 16-bit ASNs Refers to the rage 0 to p 32-bit ASNs Refers to the rage to (or the exteded rage) p 32-bit ASN pool Refers to the rage 0 to

5 Gettig a 32-bit ASN p Nowadays: Stadard applicatio process to the RIRs Or via upstream provider Sample RIR policy p p Bootstrap phase from From 1st Jauary 2007 p 32-bit ASNs were available o request From 1st Jauary 2009 p p 32-bit ASNs were assiged by default 16-bit ASNs were oly available o request From 1st Jauary 2010 p No distictio ASNs assiged from the 32-bit pool 5

6 Represetatio (1) p Iitially three formats proposed for the ASN rage : asplai asdot asdot+ p I reality: Most operators favour traditioal plai format A few prefer dot otatio (X.Y): p asdot for , e.g 2.4 p asdot+ for , e.g But regular expressios will have to be completely rewritte for asdot ad asdot+!!! 6

7 Represetatio (2) p Rewritig regular expressios for asdot/asdot+ otatio p Example: ^[0-9]+$ matches ay ASN (16-bit ad asplai) This ad equivalets extesively used i BGP multihomig cofiguratios for traffic egieerig p Equivalet regexp for asdot is: ^([0-9]+) ([0-9]+\.[0-9]+)$ p Equivalet regexp for asdot+ is: ^[0-9]+\.[0-9]+$ 7

8 Chages p 32-bit ASNs are backward compatible with 16-bit ASNs p There is o flag day p If you have a 16-bit ASN ow you do NOT eed to: Throw out your old routers Replace your 16-bit ASN with a 32-bit ASN p You do eed to be aware that: Your customers will come with 32-bit ASNs ASN is ot a bogo! You will eed a router supportig 32-bit ASNs to use a 32-bit ASN locally p If you have a proper BGP implemetatio, 32-bit ASNs will be trasported siletly across your etwork 8

9 How does it work? p If local router ad remote router support cofiguratio of 32-bit ASNs BGP peerig is cofigured as ormal usig the 32-bit ASN p If local router ad remote router do ot support cofiguratio of 32-bit ASNs BGP peerig ca oly use a 16-bit ASN p If local router oly supports 16-bit ASN ad remote router/etwork has a 32-bit ASN Compatibility mode is iitiated 9

10 Compatibility Mode (1) p Local router oly supports 16-bit ASN ad remote router uses 32-bit ASN p BGP peerig iitiated: Remote asks local if 32-bit supported (BGP capability egotiatio) Whe local says o, remote the presets AS23456 Local eeds to be cofigured to peer with remote usig AS23456 p Þ Operator of local router has to cofigure BGP peerig with AS

11 Compatibility Mode (2) p Local router supports oly 16-bit ASNs, peerig with router supportig 32-bit ASNs Peerig set up with AS23456 (trasitio AS) router bgp eighbor remote-as eighbor descriptio ebgp with AS eighbor prefix-list AS i i eighbor prefix-list AS out out! Remote router cofigures ormal BGP peerig: router bgp eighbor remote-as eighbor descriptio ebgp with AS eighbor prefix-list AS64510-i i eighbor prefix-list AS64510-out out! 11

12 Compatibility Mode (3) p BGP peerig iitiated (cot): BGP sessio established usig AS bit ASN icluded i a ew BGP attribute called AS4_PATH p Result: p (as opposed to AS_PATH for 16-bit ASNs) 16-bit ASN world sees 16-bit ASNs ad stadig i for each 32-bit ASN 32-bit ASN world sees 16 ad 32-bit ASNs 12

13 Example: p Iteret with 32-bit ad 16-bit ASNs p AS-PATH legth maitaied AS 123 AS AS / / / / AS /16 AS / / /

14 What has chaged? p Two ew BGP attributes: AS4_PATH p Carries 32-bit ASN path ifo AS4_AGGREGATOR p Carries 32-bit ASN aggregator ifo Well-behaved BGP implemetatios will simply pass these alog if they do t uderstad them p Trasitio AS AS23456 (AS_TRANS) Reserved for peerig betwee old (16-bit AS oly) ad ew BGP implemetatios 14

15 What do they look like? p ASPLAIN format for IPv4 prefix origiated by AS as4-7200#sh ip bgp /20 BGP routig table etry for /20, versio Paths: (1 available, best #1, table default) from ( ) Origi IGP, localpref 100, valid, iteral, best 15

16 What do they look like? p ASDOT format for IPv4 prefix origiated by AS3.5 (aka AS196613) as4-7200#sh ip bgp /20 BGP routig table etry for /20, versio Paths: (1 available, best #1, table default) from ( ) Origi IGP, localpref 100, valid, iteral, best 16

17 What do they look like? p 16-bit ASN world view of IPv4 prefix origiated by AS BGP-view1>sh ip bgp /20 BGP routig table etry for /20, versio Paths: (1 available, best #1, table Default-IP-Routig-Table) from ( ) Origi IGP, localpref 100, valid, exteral, best Trasitio AS 17

18 If 32-bit ASN ot supported: p Iability to distiguish betwee peer ASes usig 32-bit ASNs They will all be represeted by AS23456 Could be problematic for trasit provider s policy Workaroud: use BGP commuities istead p Iability to distiguish prefix s origi AS How to tell whether origi is real or fake? The real ad fake both represeted by AS23456 (There should be a better solutio here!) 18

19 If 32-bit ASN ot supported: p Icorrect NetFlow summaries: Prefixes from 32-bit ASNs will all be summarised uder AS23456 Traffic statistics eed to be measured per prefix ad aggregated Makes it hard to determie peerability of a eighbourig etwork p Uiteded filterig by peers ad upstreams: Eve if IRR supports 32-bit ASNs, ot all tools i use ca support ISP may ot support 32-bit ASNs which are i the IRR ad do t realise that AS23456 is the trasitio AS 19

20 Implemetatios (May 2011) p p p p Cisco IOS-XR 3.4 owards Cisco IOS-XE 2.3 owards Cisco IOS 12.0(32)S12, 12.4(24)T, 12.2SRE, 12.2(33)SXI1 owards Cisco NX-OS 4.0(1) owards p Quagga (patches for ) p OpeBGPd 4.2 (patches for 3.9 & 4.0) p p p Juiper JuOSe & JuOS 9.1 owards Redback SEOS Force10 FTOS7.7.1 owards p used to have a complete list 20

21 Curret Status (September 2017) p The etire 16-bit ASN pool has bee assiged to the RIRs Aroud bit ASNs are visible o the Iteret p Each RIR has a block of 32-bit ASNs Out of assigmets, aroud are visible o the Iteret p See 21

22 Optioal Materials 22

23 Cisco Routers Supportig 4-byte ASNs p CRS IOS-XR 3.4 owards p GSR IOS-XR 3.4 owards IOS 12.0(32)S12, 12.0(33)S ad 12.0(32)SY8 owards p ASR1000 IOS-XE 2.3 owards p Nexus Switches NX-OS 4.0(1) owards 23

24 Cisco Routers Supportig 4-byte ASNs p Catalyst 6500 IOS 12.2(33)SXI1 owards p 7600 IOS 12.2(33)SRE1 owards p 7200 series IOS 12.0(32)S12, 12.0(33)S, 12.2(33)SRE1, 12.4(24)T, 15.0 owards p 7301 IOS 12.2(33)SRE1, 12.4(24)T, 15.0 owards 24

25 Cisco Routers Supportig 4-byte ASNs p 3900/2900/1900 series IOS 15.0 owards p 3800/2800/1800/800 series IOS 12.4(24)T ad IOS 15.0 owards p 3745/3725 IOS 12.4(24)T p AS5350/5400 IOS 12.4(24)T ad IOS 15.0 owards 25

26 Cisco Routers NOT supportig 4-byte ASNs p Routers which will ever support 4-byte ASNs iclude: 2500 series 2600 series 3600 series AS

27 Deploymet Tips How to deploy 32-bit ASNs i the backboe etwork 27

28 Deploymet Scearios p Typical ISP desig is thus: ISIS/OSPF for IGP, carryig loopback ad poit to poit lik addresses ibgp mesh (full/rr/cofederatio) to carry customer ad Iteret prefixes p All routers support 4-byte ASNs: Proceed with ibgp desig as ormal p Not all routers support 4-byte ASNs: Three viable optios 28

29 ibgp optios 1. Retur 4-byte ASN to the RIR ad request 2-byte ASN istead Works if RIR is willig to do so Works as log as there are 2-byte ASNs remaiig 2. Routers which support 4-byte ASNs ru ibgp mesh Routers which do ot support 4-byte ASNs either ru i private ASN (as a pseudo-customer) or do ot ru BGP at all 3. The BGP Cofederatio hack 29

30 BGP Cofederatio hack p Useful if oly border routers ca support 4-byte ASNs Remaiig backboe ad aggregatio routers caot support 4- byte ASNs p How? The etire etwork rus withi oe private AS The border routers declare to their ebgp eighbours that they are really i 4-byte ASN cofederatio 30

31 Example: p Routers X, A ad C support 4-byte ASNs p Router Y ad B do ot Cofed C A AS B /16 X AS / / / / Y AS / / / /16 31

32 The Rules p All routers with ebgp eighbours (customer, peer, upstream) must support 4-byte ASNs p Remaiig routers withi the etwork do ot have to support 4-byte ASNs p Etire backboe operates i AS65534 Or ay oe private ASN from to p Oly the ebgp speakig routers are cofederatio aware 32

33 Router X Cofiguratio p Router X is i AS Supports 4-byte ASNs iterface FastEtheret 0/0 descriptio Lik to RouterA ip address ! router bgp eighbor remote eighbor ebgp with RouterA etwork mask ! ip route ull0 33

34 Router A Cofiguratio iterface Loopback 0 ip address ! iterface FastEtheret 0/0 descriptio Lik to RouterX ip address ! router bgp bgp cofederatio idetifier eighbor remote eighbor ebgp with RouterX eighbor remote eighbor ibgp with RouterB eighbor ext-hop-self eighbor remote eighbor ibgp with RouterC eighbor ext-hop-self! 34

35 Router B Cofiguratio p Router B is i AS65534 (Cofederatio ) Does ot support cofiguratio of 4-byte ASNs iterface Loopback 0 ip address ! router bgp eighbor remote eighbor ibgp with RouterA eighbor ext-hop-self eighbor remote eighbor ibgp with RouterC eighbor ext-hop-self etwork mask ! ip route ull0 35

36 Router C Cofiguratio iterface Loopback 0 ip address ! iterface FastEtheret 0/0 descriptio Lik to RouterY ip address ! router bgp bgp cofederatio idetifier eighbor remote 123 eighbor ebgp with RouterY eighbor remote eighbor ibgp with RouterA eighbor ext-hop-self eighbor remote eighbor ibgp with RouterB eighbor ext-hop-self! 36

37 Router Y Cofiguratio p Router Y is i AS123 Does ot support cofiguratio of 4-byte ASNs iterface FastEtheret 0/0 descriptio Lik to RouterC ip address ! router bgp 123 eighbor remote eighbor ebgp with RouterC i AS etwork mask ! ip route ull0 37

38 Commetary p Oly the edge routers, Router A ad C, eed to kow about the cofederatio ad carry the cofederatio cofiguratio Router B (ad ay other router participatig i the ibgp) believe they are ruig i AS65534 The edge routers will remove the iteral AS ad preset the cofederatio AS to ebgp eighbours 38

39 BGP o Router X p Router X supports 4-byte ASNs Sees AS ad AS123 trasit RouterX>sh ip bgp BGP table versio is 4, local router ID is Status codes: s suppressed, d damped, h history, * valid, > best, i - iteral, r RIB-failure, S Stale Origi codes: i - IGP, e - EGP,? - icomplete Network Next Hop Metric LocPrf Weight Path *> i *> i *> i 39

40 BGP o Router A p Router A supports 4-byte ASNs ibgp with B ad C, ebgp with X RouterA>sh ip bgp BGP table versio is 4, local router ID is Status codes: s suppressed, d damped, h history, * valid, > best, i - iteral, r RIB-failure, S Stale Origi codes: i - IGP, e - EGP,? - icomplete Network Next Hop Metric LocPrf Weight Path *>i i *>i i *> i 40

41 BGP o Router B p Router B does ot support 4-byte ASNs ibgp with B ad C; 4-byte ASNs see as AS23456 RouterB>sh ip bgp BGP table versio is 4, local router ID is Status codes: s suppressed, d damped, h history, * valid, > best, i - iteral, r RIB-failure, S Stale Origi codes: i - IGP, e - EGP,? - icomplete Network Next Hop Metric LocPrf Weight Path *>i i *> i *>i i 41

42 BGP o Router C p Router C supports 4-byte ASNs ibgp with A ad B, ebgp with Y RouterC>sh ip bgp BGP table versio is 4, local router ID is Status codes: s suppressed, d damped, h history, * valid, > best, i - iteral, r RIB-failure, S Stale Origi codes: i - IGP, e - EGP,? - icomplete Network Next Hop Metric LocPrf Weight Path *> i *>i i *>i i 42

43 BGP o Router Y p Router Y does ot support 4-byte ASNs ebgp with C; 4-byte ASNs see as AS23456 RouterY>sh ip bgp BGP table versio is 4, local router ID is Status codes: s suppressed, d damped, h history, * valid, > best, i - iteral, r RIB-failure, S Stale Origi codes: i - IGP, e - EGP,? - icomplete Network Next Hop Metric LocPrf Weight Path *> i *> i *> i 43

44 BGP Cofederatio hack p Not really a hack, but a workaroud so that o-ebgp speakig backboe routers ca participate i ibgp usig 4-byte ASNs p Importat: ebgp routers (border ad aggregatio edge) must support 4- byte ASNs Multiple iteral ASNs ca work provided that iteral AS edge routers (eibgp speakers) support 4-byte ASNs too; they require: bgp cofederatio idetifier <4-byte-ASN> 44

45 Summary p Deployig 4-byte ASNs ca be doe three ways: Etire ibgp mesh (upgradig software ad/or routers as appropriate) Omit o-4-byte ASN routers from ibgp mesh, or treat them as pseudo BGP customers (like RFC2270) Usig the BGP Cofederatio hack p Or retur 4-byte ASN to RIR i exchage for 2-byte ASN (if possible) 45

46 Deployig 32-bit ASNs ISP Workshops 46