routing-wg

Download

routing-wg@ripe.net

November 1996

1 participants
2 discussions

hierarchical auth with route objects
by Schmitz＠RUS.Uni-Stuttgart.DE 05 Dec '96

05 Dec '96

Dear colleagues, hierarchical authorization in the RIPE-db as a new feature presented at the last RIPE meeting is not limited to inetnum objects or the domain name space. It is also applicable to route objects. However, it has not yet been implemented for route objects because no consensus was found on how to do it. With this mail I want to start the discussion again. Please note, that this is only the draft of a draft - nothing final. So drop your comments here! In my opinion, route objects are not much different from inetnum objects regarding hierarchical authorization. Both span a certain range of IP addresses and in both cases hierarchical authorization controls definition of IP subranges. Following this reasoning it seems to be simple to implement within the IP prefix tree. However, route objects are not standing alone but are logically linked to AS objects via the origin tag. Applying hierarchical authorization within the IP prefix tree *alone* does allow uncontrolled creation of route objects of differing origin. Therefore, AS objects which match the origin AS of a route object may be considered as parent objects of route objects. I think this is a very useful approach (even though it links different types of objects in one authorization hierarchy). There have been ideas that route objects should only be created if proper address allocation occured. However, it has also been pointed out that it is not a good idea to mix address allocation and routing for several rea- sons, e.g. some registries are pure routing registries and all registries should have the same structure. Moreover, changes in routing might make changes in address registration necessary (and vice versa). There have been some good comments on this topic on the database wg mailing list. Never- theless, if no route objects exist for allocated address space, any AS owner may generate route objects uncontrolled in this registry (creation of objects in one registry which are protected by hierarchical authorization in another is also not covered but this is an entirely different problem). Obviously, there are still some loose ends. But I think that the approach of AS objects as parents of route objects from corresponding origin com- bined with hierarchical authorization within the IP prefix tree is very useful and may be applied here. Shall we go for this? Regards Joachim Schmitz _____________________________________________________________________________ Dr. Joachim Schmitz schmitz(a)noc.dfn.de DFN Network Operation Center Rechenzentrum der Universitaet Stuttgart ++ 711 685 5553 voice Allmandring 30 ++ 711 678 8363 FAX D-70550 Stuttgart FRG (Germany) _____________________________________________________________________________

3 2

final minutes of the routing WG session at RIPE 25
by Schmitz＠RUS.Uni-Stuttgart.DE 02 Nov '96

02 Nov '96

Dear Routing WG members, since there have been no additional comments on the minutes of our session at RIPE 25 I conclude that the minutes are accepted as is. I updated some URLs but there is no other change. The final version of the minutes is appended below. Thanks again to Mike Norris who took them. Regards Joachim -------- RIPE 25, Amsterdam Routing Working Group Report of Meeting, 23rd September 1996 1. Opening and Administrivia Willem van der Scheun, Chairman, presided and welcomed people to the meeting. There were 89 attenders. Mike Norris took minutes. 2. Agenda bashing A draft agenda of business, circulated by the Chairman in the previous week, was agreed. 3. Chairman of the Routing WG Willem announced that his day job prevented him from devoting the time necessary to chairmanship of the WG and that he was standing down. He was pleased to say that Joachim Schmitz would accept his proposal to be Chairman, and this proposal was endorsed by the meeting. Members thanked Willem for his work as Chairman and guidance of the WG. Joachim chaired the remainder of the meeting. 4. Report from the RIPE NCC Daniel Karrenberg said that the RIPE NCC planned to resume its studies of route aggregation. An exercise he had conducted earlier in 1996 and reported to RIPE 24 had revealed plenty of room for improvement. Individual reports to those responsible for over-specific routing had resulted in significant improvements. Since then, however, the aggregation situation had disimproved. Daniel's impression was that some ISPs didn't care or wouldn't take the trouble to correct matters. Further remedial action was needed and the Contributors' Committee supported the NCC in this work. Skilled staff would soon be appointed and they would help ISPs in promoting route aggregation. While neither RIPE nor the NCC could take action against any offenders, the use of peer pressure among the ISPs could be used in a positive manner to improve the position. The meeting encouraged ISPs to supply BGP data to the NCC on request for the purpose of analysing route aggregation. New Action: the NCC would report on route aggregation at RIPE 26. 5. Working Experience with Route Object Editor (ROE) ftp://ftp.ripe.net/ripe/presentations/ripe-m25-jschmitz-work-exp-roe.html Joachim Schmitz reported on his experience with ROE. This was part of the RA Toolset and had been written by Cengiz Alaettinoglu. Its purpose was to view and manipulate route objects and to compare them with operational routes. It worked on routes as objects from Internet routing registries (IRRs) and as determined from routers (by means of input BGP tables). Compiled with C++ in a Tcl/Tk environment, ROE was easy to install. With its GUI it was easy to use. As not all IRRs were aligned in the way they worked, ROE displayed separate route registrations where appropriate. Joachim found it slow in operation, although Cengiz later indicated that this was probably due to network and server performance and not to the ROE program execution. It was also not clear to Joachim whether live or mirrored IRR data was used. He suggested that the program could be improved by allowing more configuration options and greater clarity in some of the messages. This and other feedback should be directed to Cengiz. Overall, he recommended ROE for operational use, particularly for complex routing tasks. 6. Progressive BGP route flap dampening ftp://ftp.ripe.net/ripe/presentations/ripe-m25-tbarber-bgp-damp.html Tony Barber gave a presentation on the strategies used by UUnet-Pipex to reduce the effects of route flapping and to try to prevent router table overflow. These were: - route dampening - prefix filtering - more router memory They had encountered many instabilities from peers and found that many ISPs had not deployed CIDR; this gave rise to more flapping as more routes, and particularly more specific ones, were advertised. Tony explained the parameters used for route dampening on a Cisco router. He had arrived at the following re-use times for various route sizes: /24 and greater ~160 minutes /23 and /22 ~60 minutes /21 and less ~30 minutes He recommended filtering out all prefixes more specific than /24. While route dampening consumed router memory, this was more or less balanced by a reduction in routing CPU cycles. He recommended that if route dampening was to be widely deployed in Europe, consistency was important. In this sense, the Routing WG should agree on guidelines for parameters to be used. In discussion, the following points were made: - aggregation works in reducing router load and route flapping. - route flapping is often a feature of certain autonomous systems rather than a function of prefix length. - much instability was due to configuration changes and errors as distinct from link failures. - making dampening dependent on prefix length could penalise many stable /24s. - it might be useful to discriminate against /24s in the 192.0.0.0/8 block (the swamp). - the focus should be on keeping noise out of the system rather than trying to mitigate against it once in the system. In summary, it was agreed that route dampening was an important topic and that more discussion was needed. 7. Routing Policy analysis tools http://www.isi.edu/ra/Presentations Cengiz Alaettinoglu of ISI presented a review of recent developments and updates in the RA toolset, now at version 3.4.0. The set of front-end tools used a number of back-end libraries, which made program development easier. It required RAWhoisd v3.0 and had been ported to several operating systems. Cengiz gave details of availability (URL = http://www.isi.edu/ra/RAToolSet as official reference or copies also available from ftp://ftp.isi.edu/ra/RAToolSet/RAToolSet-3.4.1.tar.gz or ftp://ftp.ra.net/routing.arbiter/tools/RAToolSet/RAToolSet-3.4.1.tar.gz ) and of the mailing list (ratoolset(a)isi.edu, subscription via robot majordomo(a)isi.edu) The toolset was made available for demonstration purposes to attenders of RIPE 25. RtConfig generated the BGP access list part ofrouter configuration from route objects. It was now used in production by some major network operators. ROE was again shown, with reference to review options before submitting a changed route object. The AS object editor (AOE) was not implemented, though it was on demo at RIPE 25. CIDRAdvisor identifies 'safe' aggregates by route originators as well as aggregates for proxies. Cengiz showed the effects of using various radius values for the distance that aggregation should hold. Summary of Actions ------------------ Action 22.10 on Joachim Schmitz To trigger the discussion on the mailing list of the Routing WG, which focus to choose for a future tool development project and to come to consensus on it Action 24.4 on Joachim Schmitz To investigate the status of the CIDR FAQ and see whether additions are needed, probably by triggering a discussion on the mailing list New action 25.R1 on Daniel Karrenberg/RIPE NCC To report on the results from the route aggregation analysis on the 26th RIPE meeting New action 25.R2 on Joachim Schmitz To coordinate making the presentations at the Routing WG available. This action is already done. Mike Norris 23/9/96 _____________________________________________________________________________ Dr. Joachim Schmitz schmitz(a)noc.dfn.de DFN Network Operation Center Rechenzentrum der Universitaet Stuttgart ++ 711 685 5553 voice Allmandring 30 ++ 711 678 8363 FAX D-70550 Stuttgart FRG (Germany) _____________________________________________________________________________

1 0