December 1996 - routing-wg - mailman.ripe.net

Progressive BGP route flap dampening
by Christian Panigl, ACOnet/UniVie +43 1 4065822-383 02 Jan '97

02 Jan '97

Dear Routing WG members, sorry for not having had the opportunity to participate in the last few meetings. I'm trying hard for the January meeting ! In the meantime let me initiate an e-mail discussion wrt route flap dampening (I'm appending the relevant part of the minutes of the Sept. meeting, where further discussion was requested). Recently, following a scheduled router-maintenance on an Ebone backbone router, I had problems to communicate with NORDUnet (haven't explicitely tried PIPEX ;-) from /24 networks for about 2 hours ! This reminded me of the "progressive route flap dampening" discussion, and increased my motivation for throwing my 0.02 EUROs into the routing-wg list: - I can't beleive that it's really necessary and reasonable to kill a network (regardless of prefix-length) for two hours if it's flapping twice maybe within half an hour but not more frequently within a month ! - Imagine you're SW-upgrading a router and (very unlikely, as we all know ;-} detect that you have to step back ... BINGO, it's perfectly and innocently electrocuted :-( - I'd suggest that dampening (regardless of prefix length) shouldn't start before AT LEAST three flaps are happening in a row (let's say within half an hour). - Dampening should lockout real network instabilities not make worse even scheduled maintenance ! - Besides, I know applications where it might be perfectly reasonable to announce a single *providerindependent* /24 and where it's contraproductive and politically incorrect to include it into an ISP aggregate ! A solution could be to ask Internic/RIPE to define "PI" address-ranges which can and should be excluded from the /24 hostility acts. Kind regards Christian ===== Following quoted from = = RIPE 25, Amsterdam = Routing Working Group = Report of Meeting, 23rd September 1996 = = [...] = =6. Progressive BGP route flap dampening = ftp://ftp.ripe.net/ripe/presentations/ripe-m25-tbarber-bgp-damp.html = = Tony Barber gave a presentation on the strategies used by = UUnet-Pipex to reduce the effects of route flapping and to = try to prevent router table overflow. These were: = = - route dampening = - prefix filtering = - more router memory = = They had encountered many instabilities from peers and found = that many ISPs had not deployed CIDR; this gave rise to more = flapping as more routes, and particularly more specific ones, = were advertised. = = Tony explained the parameters used for route dampening on a = Cisco router. He had arrived at the following re-use times = for various route sizes: = = /24 and greater ~160 minutes = /23 and /22 ~60 minutes = /21 and less ~30 minutes = = He recommended filtering out all prefixes more specific than /24. = = While route dampening consumed router memory, this was more or = less balanced by a reduction in routing CPU cycles. = = He recommended that if route dampening was to be widely = deployed in Europe, consistency was important. In this sense, = the Routing WG should agree on guidelines for parameters to = be used. = = In discussion, the following points were made: = = - aggregation works in reducing router load and route = flapping. = = - route flapping is often a feature of certain autonomous = systems rather than a function of prefix length. = = - much instability was due to configuration changes and = errors as distinct from link failures. = = - making dampening dependent on prefix length could = penalise many stable /24s. = = - it might be useful to discriminate against /24s in the = 192.0.0.0/8 block (the swamp). = = - the focus should be on keeping noise out of the system = rather than trying to mitigate against it once in the = system. = = In summary, it was agreed that route dampening was an = important topic and that more discussion was needed. = ===== End quote

2 1

RAToolSet version 3.5.0 is now released
by Cengiz Alaettinoglu 17 Dec '96

17 Dec '96

RAToolSet version 3.5.0 is now available from: http://www.isi.edu/ra/RAToolSet ftp://ftp.isi.edu/ra/RAToolSet This version contains the beta release of aoe, Autonomous System Object Editor: aoe simplifies the creation of aut-num objects by employing some heuristics to add and modify as-in and as-out attributes. For example, given a BGP dump from a router inside your AS, aoe parses the AS_PATH attributes in the BGP dump, and determines the peer ASes, and the import policies for each peer AS. A template based mechanism is provided for users to create their own heuristics to augment the heuristics that we provide. aoe can register the aut-num object in the IRR after editing is done. aoe is implemented by WeeSan Lee. RtConfig has couple of new features: -supress_martian option -@RtConfig networks commands -@RtConfig default commands There are also some minor bug fixes. Please refer to the man pages for the details. We will be presenting the new features during the upcoming ietf. Precompiled binary versions for selected OSes will be made available after the IETF. As usual, bug reports, suggestions for improvements and particularly patches are welcome. Cengiz -- Cengiz Alaettinoglu Information Sciences Institute (310) 822-1511 University of Southern California http://www.isi.edu/~cengiz

2 1

RAToolSet 3.5.0 has in/out bug with export policy
by David M. Meyer 07 Dec '96

07 Dec '96

It looks like RtConfig 3.5.0 confuses "in" and "out" when a distribute-list command (instead of a route-map) is generated from an export command. In this case, the export policy is NOT ANY. To see this, consider the following RtConfig code: @RtConfig set cisco_map_name = "AS2914-EXPORT" @RtConfig export AS7396 198.32.162.100/32 AS2914 205.238.48.3/32 @RtConfig set cisco_map_name = "AS2914-IMPORT" @RtConfig import AS7396 198.32.162.100/32 AS2914 205.238.48.3/32 and consider this aut-num for AS7396: aut-num: AS7396 as-name: OREGON-IX descr: Oregon Exchange Route views (route-views.oregon-ix.net) as-in: from AS2914 100 accept ANY AND NOT {0.0.0.0/0} as-in: from AS3333 100 accept ANY AND NOT {0.0.0.0/0} as-in: from AS2497 100 accept ANY AND NOT {0.0.0.0/0} as-out: to AS2914 announce NOT ANY as-out: to AS3333 announce NOT ANY as-out: to AS2497 announce NOT ANY guardian: meyer(a)ns.uoregon.edu admin-c: DMM65 tech-c: DMM65 notify: nethelp(a)ns.uoregon.edu mnt-by: MAINT-AS3582 changed: meyer(a)ns.uoregon.edu 961206 source: RADB ` Then RtConfig 3.5.0 generates no access-list 1 access-list 1 deny ip 0.0.0.0 255.255.255.255 0.0.0.0 255.255.255.255 ! router bgp 7396 neighbor 205.238.48.3 distribute-list 1 in no access-list 2 access-list 2 deny ip 0.0.0.0 0.0.0.0 0.0.0.0 0.0.0.0 access-list 2 permit ip 0.0.0.0 255.255.255.255 0.0.0.0 255.255.255.255 ! ! no route-map AS2914-IMPORT route-map AS2914-IMPORT permit 1 match ip address 2 ! router bgp 7396 neighbor 205.238.48.3 route-map AS2914-IMPORT in neighbor 205.238.48.3 distribute-list 2 in Note that router bgp 7396 neighbor 205.238.48.3 distribute-list 1 in should be router bgp 7396 neighbor 205.238.48.3 distribute-list 1 out ^^^ At least this is what I would have expected. Dave

2 1

hierarchical auth with route objects
by Schmitz＠RUS.Uni-Stuttgart.DE 05 Dec '96

05 Dec '96

Dear colleagues, hierarchical authorization in the RIPE-db as a new feature presented at the last RIPE meeting is not limited to inetnum objects or the domain name space. It is also applicable to route objects. However, it has not yet been implemented for route objects because no consensus was found on how to do it. With this mail I want to start the discussion again. Please note, that this is only the draft of a draft - nothing final. So drop your comments here! In my opinion, route objects are not much different from inetnum objects regarding hierarchical authorization. Both span a certain range of IP addresses and in both cases hierarchical authorization controls definition of IP subranges. Following this reasoning it seems to be simple to implement within the IP prefix tree. However, route objects are not standing alone but are logically linked to AS objects via the origin tag. Applying hierarchical authorization within the IP prefix tree *alone* does allow uncontrolled creation of route objects of differing origin. Therefore, AS objects which match the origin AS of a route object may be considered as parent objects of route objects. I think this is a very useful approach (even though it links different types of objects in one authorization hierarchy). There have been ideas that route objects should only be created if proper address allocation occured. However, it has also been pointed out that it is not a good idea to mix address allocation and routing for several rea- sons, e.g. some registries are pure routing registries and all registries should have the same structure. Moreover, changes in routing might make changes in address registration necessary (and vice versa). There have been some good comments on this topic on the database wg mailing list. Never- theless, if no route objects exist for allocated address space, any AS owner may generate route objects uncontrolled in this registry (creation of objects in one registry which are protected by hierarchical authorization in another is also not covered but this is an entirely different problem). Obviously, there are still some loose ends. But I think that the approach of AS objects as parents of route objects from corresponding origin com- bined with hierarchical authorization within the IP prefix tree is very useful and may be applied here. Shall we go for this? Regards Joachim Schmitz _____________________________________________________________________________ Dr. Joachim Schmitz schmitz(a)noc.dfn.de DFN Network Operation Center Rechenzentrum der Universitaet Stuttgart ++ 711 685 5553 voice Allmandring 30 ++ 711 678 8363 FAX D-70550 Stuttgart FRG (Germany) _____________________________________________________________________________

3 2