An Adaptive Policy Management Approach to Resolving BGP Policy Conflicts

Transcription

1 An Adaptive Policy Management Approach to Resolving BGP Policy Conflicts Ibrahim Matta Computer Science Boston University Joint work with: Selma Yilmaz Cisco Systems, CA 1/36

2 Border Gateway Protocol (BGP) Is the de facto inter-domain routing protocol of today s Internet Is policy-based allows ASes to share reachability information according to policies Import policy Accept routes from AS2 for destination A Export policy Always share routes with AS1 2/36

3 Border Gateway Protocol (BGP) BGP does not necessarily solve shortest path routing problem Best path is the path with the highest local preference value assigned by locally defined policies AS1 AS2 AS3 AS4 Path (AS3 AS2 AS1) may have higher preference value than (AS4 AS1) AS5 3/36

4 Problems with Policy-based Routing Collection of locally well-configured policies may cause global conflicts: BGP diverges ASes exchange routing messages indefinitely In this talk, focus on policy-induced oscillations only First shown by Varadhan et al. [USC Technical Report 1996] Statically checking for BGP convergence is NPcomplete [Griffin et al. Sigcomm 1999] 4/36

5 Abstract Model of BGP [Griffin Infocom 2] Stable Paths Problem (SPP) represents the static semantics of BGP Simple Path Vector Protocol (SPVP) represents the dynamic semantics of BGP is a distributed algorithm solving SPP An SPP is called safe if SPVP always converges 5/36

6 Stable Paths Problem (SPP) Nodes represent BGP routers, edges represent BGP sessions Node represents destination Each node has a set of permitted paths Each node v has a ranking function, λ v Example of an SPP instance: Most preferred Least preferred /36

7 Stable Paths Problem (SPP) An SPP instance may have multiple solutions SPVPmay diverge no solution SPVP diverges a unique solution does not mean that SPVP converges to that solution 2 Safe /36

8 Problems with Policy-based Routing An example of divergence (dispute wheel): Most preferred 13 Least preferred / / 1 1/1/1 2/1/2 1/1/1 2/2/1 1/2/2 3 1/1/1 2 8/36

9 Related Work & Talk Outline Static Solution: Gao&Rexford Algorithm [Infocom1] Dynamic Solutions: 1) SPVP Algorithm [Griffin et al. Infocom] 2) Cobb&Musunuri Algorithm [Globecomm4] Focus on dynamic solutions Our scheme (APM) overcomes prior limitations Convergence analysis of APM Simulation comparison 9/36 Conclusion

10 SPVP Algorithm history of path change events carried in Update messages If node u changes its current path from P old to P new If P new is more preferred than P old, path change event is (+, P new ) If P old is more preferred than P new, path change event is (-, P old ) Path whose adoption creates a cycle is suppressed Disadvantage History may get very long, may reveal preferences We want a local solution 1/36

11 SPVP SPVP may lead to simultaneous path eliminations Stabilizes to unreachable destination for all nodes We want to minimize path eliminations step node best path path assignment 1 (1) (+1) 2 (2) (+2) 3 (3) (+3) 1 1 (13) (+13)(+3) 2 (21) (+21)(+1) 3 (32) (+32)(+2) 2 1 (1) (-13)(+32)(+2) 2 (2) (-21)(+13)(+3) 3 (3) (-32)(+21)(+1) 3 1 (13) (+13)(-32)(+21)(+1) 2 (21) (+21)(-13)(+32)(+2) 3 (32) (+32)(-21)(+13)(+3) 4 1 (1) (-13)(+32)(-21)(+13)(+3) 2 (2) (-21)(+13)(-32)(+21)(+1) 3 (3) (-32) (+21)(-13)(+32)(+2) 5 1 epsilon 2 epsilon 3 epsilon 11/36

12 Cobb&Musunuri cost of node increased whenever its new path has lower rank If there is divergence, costs grow Costs are included in Update messages Node rejects better path if cost of next-hop node exceeds a threshold Disadvantages Aggregates paths through same node May lead to simultaneous path rejections We want to minimize path eliminations Re-setting costs may re-introduce resolved conflicts We want gradual probing 12/36

13 Cobb&Musunuri Cobb&Musunuri may lead to unnecessary path eliminations Assume threshold= All nodes stabilize to their lowest preferred paths We want to minimize loss in preference step node count best path 1 (1) 2 (2) 3 (3) 1 1 (13) 2 (21) 3 (32) (1) 2 1 (2) 3 1 (3) (13) 2 1 (21) 3 1 (32) (1) 2 2 (2) 3 2 (3) 5 1 won t use (13) since count(3) 2 2 won t use (21) since count(2) 2 3 won t use (13) since count(3) 2 13/36

14 Our Adaptive Policy Management (APM) Each node involved in a conflict observes route flaps Not every advertisement received is changing Safe path Make the safe path highest preferred path to stop oscillation (rank change) Each node keeps local history to detect flapping paths Countassociated with paths in local history No change to BGP messages Perform rank change probabilistically 14/36

15 Our APM in action Assume threshold= count(2) & (1) & (3) > min threshold, change rank with prob. α Direct paths are safe Node 2 stabilizes to its higher preferred path step node best path local history(path,count) path preference 1 (1) ((1),1) (13)>(1) 2 (2 ((2),1) (21)>(2) 3 (3) ((3),1) (32)>(3) 1 1 (13) ((13),1),((1),1) (13)>(1) 2 (21) ((21),1),((2),1) (21)>(2) 3 (32) ((32),1), ((3),1) (32)>(3) 2 1 (1) ((13),1), ((1),2) (13)>(1) 2 (2) ((21),1), ((2),2) (21)>(2) 3 (3) ((32),1), ((3),2) (32)>(3) 3 1 (13) ((13),2), ((1),2) (13)>(1) 2 (21) ((21),2), ((2),2) (21)>(2) 3 (32) ((32),2), ((3),2) (32)>(3) 4 1 (2) ((13),2), ((1),3) (1)>(13) 2 (1) ((21),2), ((2),3) (21)>(2) 3 (3) ((32),2), ((3),3) (32)>(3) 5 1 (1) (1)>(13) 2 (21) (21)>(2) 3 (3) (32)>(3) 15/36

16 Adaptive Policy Management (APM) count max_threshold min_threshold time Policy conflict free phase Policy conflict avoidance phase Policy conflict control phase max_threshold Due to probabilistic adjustment of path preferences, conflict may remain unresolved If count> max_threshold, suppress the path min_threshold To distinguish between temporary and persistent oscillations Each node independently classifies the state of the network by comparing count values against thresholds 16/36

17 Restoring Local Preferences with APM When the system stabilizes, peers exchange only keepalive messages Nodes use this as indication of convergence Probe the state for improvement, i.e. restoration, in their current policies Probabilistically restore local preference values May introduce instability back to system Use smaller probability β < α It s a feedback control system! E.g. recall TCP congestion operation: timeout vs. multiplicative decrease / linear increase (avoidance) 17/36

18 Convergence Analysis of APM Different path orderings at the nodes specify different states of the network and define different policies Goal: Ignoring recovery, show that starting from an arbitrary state of the system, APM converges to a stable state within a finite number of steps Proof idea: Use sub-stability property of the chosen paths 18/36

19 Definitions (assuming single policy conflict) Conflict-free node is a node which is not involved in any policy conflict and stabilized on its best path Non-flapping (stable) path P=(v,...,destination) is the best path of a conflict-free node v, and this path does not change over time 19/36

20 More Definitions (assuming single policy conflict) Observable safe path P=<u,v,, destination> of a node u is non-flapping path of peer v of node u all nodes along this path are conflict-free Conflicting safe-alternative node is involved in a policy conflict and observes a safe path which is not the most preferred path Conflicting node is involved in a policy conflict, and does not observe any safe path 2/36

21 Convergence Analysis of APM Example: Node 1: conflicting safe-alternative node with safe path (15) Node 2: conflicting safe-alternative node with safe path (25) Node 3: conflicting safe-alternative node with safe path (35) Node 4: conflicting node with no safe path Node 5: conflict-free node with stable path (5) Node 6: conflicting safe-alternative node with safe path (65) Conflicting safe-alternative nodes can break the conflict by holding onto their safe paths, i.e. path rank change If node 2 changes its path preference to prefer (25) more than (215): node 2 becomes conflict-free node path (25) becomes stable path path (425) becomes safe path at node 4 21/36..

22 Multiple Conflicts Example: Nodes in conflict 1 are: 1,2,3 Nodes in conflict 2 are: 4,5, Innermost conflict along path (35) is conflict 2 22/36

23 More Definitions (multiple policy conflicts) Innermost conflict along path P: may be involved in conflict C k-1 may be involved in conflict C i+1 Path P= u k u k-1 u i+1 u i u i-1 u 2 u 1 Conflict-free nodes involved in conflict C i C i is the innermost conflict along P Inactive node with observable safe path is a node that is not an active node on a dispute wheel, and its most preferred path is an observable safe path 23/36

24 Convergence Analysis of APM Theorem: During the execution of APM, size of the set of nodes that are conflict-free increases monotonically Proof: S = set of nodes that are conflict-free and stabilized on their paths S forms a routing tree rooted at the destination, and grows as the nodes in S advertise their chosen paths Using induction, show that S grows monotonically: Basis: S={}. Destination is added. Hypothesis: At step k, assume size of S is n, and up to this point S grew monotonically. Induction Step: Show that at step (k+1), size of S > n. 24/36

25 Convergence Analysis of APM At step (k+1): v advertises P v to u u v p v S with n nodes already stabilized on their paths Case I: At step k, u was a conflicting node and observing flap P1,P2,P1,P2.. Assume: u prefers P1 =(u,w)p w over P2 =(u,v)p v At step (k+1) one of the following occurs: a) v is in S and stabilized on P v, but w is not in S b) w is in S and stabilized on P w, but v is not in S c) both v and w are in S and stabilized on P v and P w, resp. 25/36

26 Convergence Analysis of APM At step (k+1): v advertises P v to u u v p v S with n nodes already stabilized on their paths Case I(a): u prefers path via w, but w is not in S - (u v)p v is observable safe path at node u Ex: u becomes conflicting safe-alternative node - u performs rank change and stabilizes on (u v)p v Node 2 advertises (2) to node S /36

27 Convergence Analysis of APM Case I(a) con t: At this step, inactive nodes with observable safe paths also enters S iteratively Ex: Node 4 performs rank change, stabilizes on (42) and enters S. At this point, node 6 becomes an inactive node with observable safe path (642) and enters S as well Node 2 advertises (2) to node S /36

28 At step (k+1): Convergence Analysis of APM Case I(b): u prefers path via w, and w is in S, v is not Ex using previous network: Node 5 advertises (5) to node S Node 4 stabilizes on (45) and becomes conflict-free 28/36

29 At step (k+1): Convergence Analysis of APM Case I(c): u prefers path via w, and both w and v are in S Node 5 and node 2 advertise (5) and (2), respectively, to node S Node 4 stabilizes on its most preferred path (45) and becomes conflict-free 29/36

30 Convergence Analysis of APM At step (k+1): v advertises P v to u u v p v S with n nodes already stabilized to their paths Case II: none of the advertised paths is permitted Ex: Node 5 advertises (56) and node 2 advertises (21) to node S Node 4 becomes conflict-free converging to epsilon 3/36

31 Simulation Results Compared performances of APM, SPVP, Cobb&Musunuri, BGP4 using SSFNet simulator APM versions min_threshold=2, max_threshold=3, ka_threshold=6 min_threshold=2, max_threshold=1, ka_threshold=6 Cobb&Musunuri versions cost_threshold=3 cost_threshold=1 SPVP suppress the path only after seeing same conflict twice Buffer size=5bytes; routing packets are given priority over data packets when there is congestion 31/36

32 Simulation Results Topology Path Rankings 32/36

33 Simulation Results Metric: Percentage of the nodes that cannot reach destination SPVP and Cobb&Musunuri algorithm eliminate high number of paths while enforcing stability APM with high max_threshold minimizes path eliminations at min loss in preference value (not shown) 33/36

34 Simulation Results APM has best Metric: Power = throughput/delay performance due to minimum number of path eliminations and small update messages SPVP has longest update messages and eliminates 43% of the paths BGP4 does not cause permanent path elimination 34/36

35 APM Conclusion is a dynamic distributed algorithm uses only local history allows ASes to adapt to the current state of the network, either conflict free or potentially conflicting can catch and resolve policy conflicts in heterogeneous settings 35/36

36 Future Work APM adds machinery to update local policies, which is not visible to policy writers Increase transparency Inform user of policy changes Use APM only to identify and characterize conflicts and report findings to user for manual fix Allow user to specify goal-oriented adaptation Some ASes may cheat by not following APM even when they are aware of a persistent oscillation Propose incentives to improve co-operation among ASes to deploy APM Prototype implementation 36/36