Chuyên đề mạng thế hệ mới mạng thế hệ mớimạng thế hệ mới ngnmang the he moigiáo trình mạng thế hệ mớitài liệu mạng thế hệ mới ngngiáo trình mạng thế hệ mới ngnmạng thế hệ mới ngn là gìtổng quan về mạng thế hệ mới ngncấu trúc mạng thế hệ mới ngncông nghệ mạng thế hệ mới ngn
Interdomain Routing BGP (cont’) Prométhée Spathis promethee.spathis@lip6.fr Thème NPA, LIP6 Paris, FRANCE • Interdomain routing protocol for the Internet – Prefix-based path-vector protocol – Policy-based routing based on AS Paths – Evolved during the past 15 years • 1989 : BGP-1 [RFC 1105] – Replacement for EGP (1984, RFC 904) • 1990 : BGP-2 [RFC 1163] • 1991 : BGP-3 [RFC 1267] • 1995 : BGP-4 [RFC 1771] – Support for Classless Interdomain Routing (CIDR) Border Gateway Protocol Components of BGP • BGP protocol – Definition of how two BGP neighbors communicate – Message formats, state machine, route attributes, etc. – Standardized by the IETF • Policy specification – Flexible language for filtering and manipulating routes – Indirectly affects the selection of the best route – Varies across vendors, though constructs are similar • BGP decision process – Complex sequence of rules for selecting the best route – De facto standard applied by router vendors – Being codified in a new RFC for BGP coming soon BGP Operations Establish session on TCP port 179 Exchange all active routes Exchange incremental updates AS1 AS2 While connection is ALIVE exchange route UPDATE messages BGP session Four Basic Messages • Open: Establishes BGP session (uses TCP port #179) • Notification: Report unusual conditions • Update: Inform neighbor of new routes that become active Inform neighbor of old routes that become inactive • Keepalive: Inform neighbor that connection is still viable Incremental Protocol • A node learns multiple paths to destination – Stores all of the routes in a routing table – Applies policy to select a single active route – … and may advertise the route to its neighbors • Incremental updates – Announcement Upon selecting a new active route, add node id to path … and (optionally) advertise to each neighbor – Withdrawal If the active route is no longer available … send a withdrawal message to the neighbors • Update messages – Advertisement New route for the prefix (e.g., 12.34.158.0/24) Attributes such as the AS path (e.g., “2 1”) – Withdrawal Announcing that the route is no longer available • Numerous BGP attributes – AS path – Next-hop IP address – Local preference – Multiple-Exit Discriminator – … Update Messages Advertising a prefix • When a router advertises a prefix to one of its BGP neighbors: – information is valid until first router explicitly advertises that the information is no longer valid – BGP does not require routing information to be refreshed – if node A advertises a path for a prefix to node B, then node B can be sure node A is using that path itself to reach the destination. BGP Route AS 88 Princeton 128.112.0.0/16 AS path = 88 Next Hop = 192.0.2.1 AS 7018 AT&T AS 12654 RIPE NCC RIS project 192.0.2.1 128.112.0.0/16 AS path = 7018 88 Next Hop = 12.127.0.121 12.127.0.121 • Destination prefix (e.g,. 128.112.0.0/16) • Route attributes, including – AS path (e.g., “7018 88”) – Next-hop IP address (e.g., 12.127.0.121) BGP at AS YYY will never accept a route with ASPATH containing YYY. AS 7018 12.22.0.0/16 ASPATH = 1 333 7018 877 Don’t Accept! AS 1 Interdomain Loop Prevention Forwarding Table Forwarding Table Joining BGP and IGP Information AS 7018 AS 88 192.0.2.1 128.112.0.0/16 10.10.10.10 BGP 192.0.2.1128.112.0.0/16 destination next hop 10.10.10.10192.0.2.0/30 destination next hop 128.112.0.0/16 Next Hop = 192.0.2.1 128.112.0.0/16 destination next hop 10.10.10.10 + 192.0.2.0/30 10.10.10.10 An AS is Not a Single Node • Multiple routers in an AS – Need to distribute BGP information within the AS – Internal BGP (iBGP) sessions between routers AS1 AS2 eBGP iBGP Internal BGP (I-BGP) • Used to distribute routes learned via EBGP to all the routers within an AS • I-BGP and E-BGP are same protocol in that – same message types used – same attributes used – same state machine – BUT use different rules for readvertising prefixes • Rule #1: prefixes learned from an E-BGP neighbor can be readvertised to an I-BGP neighbor, and vice versa • Rule #2: prefixes learned from an I-BGP neighbor cannot be readvertised to another I-BGP neighbor AS PATH Attribute AS7018 128.112.0.0/16 AS Path = 88 AS 1239 Sprint AS 1755 Ebone AT&T AS 3549 Global Crossing 128.112.0.0/16 AS Path = 7018 88 128.112.0.0/16 AS Path = 3549 7018 88 AS 88 128.112.0.0/16 Princeton Prefix Originated AS 12654 RIPE NCC RIS project AS 1129 Global Access 128.112.0.0/16 AS Path = 7018 88 128.112.0.0/16 AS Path = 1239 7018 88 128.112.0.0/16 AS Path = 1129 1755 1239 7018 88 128.112.0.0/16 AS Path = 1755 1239 7018 88 Attributes are Used to Select Best Routes 192.0.2.0/24 pick me! 192.0.2.0/24 pick me! 192.0.2.0/24 pick me! 192.0.2.0/24 pick me! Given multiple routes to the same prefix, a BGP speaker must pick at most one best route (Note: it could reject them all!) BGP Path Selection • Simplest case – Shortest AS path – Arbitrary tie break • Example – Four-hop AS path preferred over a three-hop AS path – AS 12654 prefers path through Global Crossing • But, BGP is not limited to shortest- path routing – Policy-based routing AS 3549 Global Crossing 128.112.0.0/16 AS Path = 3549 7018 88 AS 12654 RIPE NCC RIS project AS 1129 Global Access 128.112.0.0/16 AS Path = 1129 1755 1239 7018 88 In fairness: could you do this “right” and still scale? Exporting internal state would dramatically increase global instability and amount of routing state AS 4 AS 3 AS 2 AS 1 Mr. BGP says that path 4 1 is better than path 3 2 1 Duh! Shorter Doesn’t Always Mean Shorter AS 4AS 3 AS 2 AS 1 135.207.0.0/16 135.207.0.0/16 ASPATH = 3 2 1 IP Packet Dest = 135.207.44.66 Traffic Often Follows ASPATH … But It Might Not AS 4AS 3 AS 2 AS 1 135.207.0.0/16 135.207.0.0/16 ASPATH = 3 2 1 IP Packet Dest = 135.207.44.66 AS 5 135.207.44.0/25 ASPATH = 5 135.207.44.0/25 AS 2 filters all subnets with masks longer than /24 135.207.0.0/16 ASPATH = 1 From AS 4, it may look like this packet will take path 3 2 1, but it actually takes path 3 2 5 BGP Attributes Value Code Reference 1 ORIGIN RFC1771] 2 AS_PATH [RFC1771] 3 NEXT_HOP [RFC1771] 4 MULTI_EXIT_DISC [RFC1771] 5 LOCAL_PREF [RFC1771] 6 ATOMIC_AGGREGATE [RFC1771] 7 AGGREGATOR [RFC1771] 8 COMMUNITY [RFC1997] 9 ORIGINATOR_ID [RFC2796] 10 CLUSTER_LIST [RFC2796] 11 DPA [Chen] 12 ADVERTISER [RFC1863] 13 RCID_PATH / CLUSTER_ID [RFC1863] 14 MP_REACH_NLRI [RFC2283] 15 MP_UNREACH_NLRI [RFC2283] 16 EXTENDED COMMUNITIES [Rosen] 255 reserved for development From IANA: http://www.iana.org/assignments/bgp-parameters Most important attributes Not all attributes need to be present in every announcement BGP Policy: Influencing Decisions Best Route Selection Apply Import Policies Best Route Table Apply Export Policies Install forwarding Entries for best Routes. Receive BGP Updates Best Routes Transmit BGP Updates Apply Policy = filter routes & tweak attributes Based on Attribute Values IP Forwarding Table Apply Policy = filter routes & tweak attributes Open ended programming. Constrained only by vendor configuration language • Routing Information Base – Store all BGP routes for each destination prefix – Withdrawal message: remove the route entry – Advertisement message: update the route entry • Selecting the best route – Consider all BGP routes for the prefix – Apply rules for comparing the routes – Select the one best route Use this route in the forwarding table Send this route to neighbors BGP Decision Process: Path Selection on a Router Highest Local Preference Shortest ASPATH Lowest MED i-BGP < e-BGP Lowest IGP cost to BGP egress Lowest router ID traffic engineering Enforce relationships Throw up hands and break ties Route Selection Summary BGP Decision Process: Multiple Steps • Highest local preference – Set by import policies upon receiving advertisement • Shortest AS path – Included in the route advertisement • Lowest origin type – Included in advertisement or reset by import policy • Smallest multiple exit discriminator – Included in the advertisement or reset by import policy • Smallest internal path cost to the next hop – Based on intradomain routing protocol (e.g., OSPF) • Smallest next-hop router id – Final tie-break • Import policy – Filter unwanted routes from neighbor E.g. prefix that your customer doesn’t own – Manipulate attributes to influence path selection E.g., assign local preference to favored routes • Export policy – Filter routes you don’t want to tell your neighbor E.g., don’t tell a peer a route learned from other peer – Manipulate attributes to control what they see E.g., make a path look artificially longer than it is BGP Policy: Applying Policy to Routes Customers and Providers Customer pays provider for access to the Internet provider customer IP traffic provider customer peer peer customerprovider Peers provide transit between their respective customers Peers do not provide transit between peers Peers (often) do not exchange $$$ traffic allowed traffic NOT allowed The “Peering” Relationship Peering Provides Shortcuts Peering also allows connectivity between the customers of “Tier 1” providers. peer peer customerprovider Import Policy: Local Preference • Favor one path over another – Override the influence of AS path length – Apply local policies to prefer a path • Example: prefer customer over peer AT&T Sprint Yale Tier-2 Tier-3 Local-pref = 100 Local-pref = 90 Internal BGP and Local Preference • Example – Both routers prefer the path through AS 100 on the left – … even though the right router learns an external path I-BGP AS 256 AS 300 Local Pref = 100 Local Pref = 90 AS 100 AS 200 Import Policy: Filtering • Discard some route announcements – Detect configuration mistakes and attacks • Examples on session to a customer – Discard route if prefix not owned by the customer – Discard route that contains other large ISP in AS path AT&T Princeton USLEC 128.112.0.0/16 Export Policy: Filtering • Discard some route announcements – Limit propagation of routing information • Examples – Don’t announce routes from one peer to another – Don’t announce routes for network-management hosts AT&T Princeton Sprint 128.112.0.0/16 UUNET network operator • Modify attributes of the active route – To influence the way other ASes behave • Example: AS prepending – Artificially inflate the AS path length seen by others – To convince some ASes to send traffic another way AT&T Princeton USLEC 128.112.0.0/16 Sprint 88 88 88 Export Policy: Attribute Manipulation An AS is Not a Single Node • Multiple connections to neighboring ASes – Multiple border routers may learn good routes – … with the same local-pref and AS path length 1 2 3 4 5 6 7 Multiple links Multiple Exit Discriminator Attribute (MED) • when AS’s interconnected via 2 or more links • AS announcing prefix sets MED • enables AS(3) to indicate its preference • AS(1) receiving prefix uses MED to select link • a way to specify how close a prefix is to the link it is announced on • Tell your neighbor what you want – MED attribute to indicate receiver preference – Decision process picks route with smallest MED – Can use MED for “cold potato” routing – But, have to get your neighbor to accept MEDs 1 3 “3 4 5” with MED=2 “3 4 5” with MED=1 Multiple Exit Discriminator Attribute (MED) BGP Policy Configuration • Routing policy languages are vendor-specific – Not part of the BGP protocol specification – Different languages for Cisco, Juniper, etc. • Still, all languages have some key features – Policy as a list of clauses – Each clause matches on route attributes – … and either discards or modifies the matching routes • Configuration done by human operators – Implementing the policies of their AS – Business relationships, traffic engineering, security, … • Common relationships – Customer-provider – Peer-peer – Backup, sibling, … • Implementing in BGP – Import policy Ranking customer routes over peer routes – Export policy Export only customer routes to peers and providers Policies in Practice : Business Relationships Customer-Provider Relationship • Customer pays provider for access to Internet – Customer needs to be reachable from everyone – Provider exports customer’s routes to everybody – Customer exports provider’s routes to customers • Customer does not want to provide transit service – Customer does not export from one provider to another d d AT&T Princeton Princeton AT&T Traffic tothe customer Traffic from the customer advertisements traffic Peer-Peer Relationship • Peers exchange traffic between customers – AS exports only customer routes to a peer – AS exports a peer’s routes only to its customers Sprint AT&T Traffic to/from the peer and its customers d advertisements traffic Princeton UBC [...]... policy changes General Statistics Route Flap • • • • • • When a router/link goes down and up, it leads – BGP session down – BGP route withdrawal by neighbor BGP routers – BGP session reset – Route exchanges • When it repeats, it is considered route flap – BGP “storms” • Route flap damping “…allows a BGP speaker to take into account the past stability of a route in deciding whether to use or re-advertise... routers or sessions • BGP session failures – Due to equipment failures, maintenance, etc – Or, due to congestion on the physical path • Changes in routing policy – Reconfiguration of preferences – Reconfiguration of route filters • Persistent protocol oscillation – Conflicts between policies in different ASes BGP Session Failure Routing Change: Before and After • BGP runs over TCP – BGP only sends updates... backup link using community BGP guarantees • BGP is not guaranteed to converge on a stable routing Policy interactions could lead to “livelock” protocol oscillations • Corollary: BGP is not guaranteed to recover from network failures 3 Disaster strikes primary link and the backup takes over 4 Primary link is restored but some traffic remains pinned to backup What Problem is BGP Solving? Underlying problem... connectivity • BGP is solving a hard problem – Routing protocol operating at a global scale – With tens of thousands of independent networks – That each have their own policy goals – And all want fast convergence • Key features of BGP – Prefix-based path-vector protocol – Incremental updates (announcements and withdrawals) – Policies applied at import and export of routes – Internal BGP to distribute... many ASes Conclusions Discussion • BGP protocol vs policy – Protocol is simple – Policy is complicated • BGP policy is a black art – Indirect way of specifying policy – Manipulating attributes to influence decisions – Filtering routes to scope the routing information • Common examples of policy today – Business relationships – Traffic engineering – Security • Is BGP trying to do too many things? –... engineering – Security • Is BGP trying to do too many things? – Policy – Scalability – Convergence • Is BGP too indirect for its own good? – AS only learns some routes from its neighbors – And applies policies to indirectly pick the routes • Too many protocols involved? – External BGP – Internal BGP – Intradomain protocol ... 3 (1,0) (1,2,0) (1,3,0) (2,0) (2,1,0) (2,3,0) (2,1,3,0) 1 2 0 3 Time Between Steps in Path Exploration BGP Converges Slowly, if at All • Minimum route advertisement interval (MRAI) – Minimum spacing between announcements – For a particular (prefix, peer) pair • Advantages – Provides a rate limit on BGP updates – Allows grouping of updates within the interval • Disadvantages – Adds delay to the convergence... explore many alternate paths – … to find the highest-ranked path that is still available • Fortunately, in practice – Most popular destinations have very stable BGP routes – And most instability lies in a few unpopular destinations • Still, lower BGP convergence delay is a goal – Can be tens of seconds to tens of minutes – High for important interactive applications – … or even conventional application,... don’t pass to BGP neighbors Communities Example So Many Choices peer provider • 1:100 peer customer • To Customers – Customer routes AS 4 – 1:100, 1:200, 1:300 • 1:200 • To Peers – Peer routes – 1:100 • 1:300 • To Providers – Provider Routes AS5 AS 3 – 1:100 Import Export AS 2 AS 1 AS 1 Which route should AS5 pick to 13.13.0.0./16? 13.13.0.0/16 134 LOCAL PREFERENCE Traffic engineering with BGP • For inbound... relationships – Outbound route f iltering • Enf orce order of route pref erence – provider < peer < customer ISP route From provider From peer From peer From customer From customer How Can Routes be Colored? BGP Communities! Export Routes provider route customer route peer route To provider customer route ISP route Used for signally within and between ASes From provider To peer By convention, first 16 bits