1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
|
<pre>Internet Engineering Task Force (IETF) N. Hilliard
Request for Comments: 7948 INEX
Category: Informational E. Jasinska
ISSN: 2070-1721 BigWave IT
R. Raszuk
Bloomberg LP
N. Bakker
Akamai Technologies B.V.
September 2016
<span class="h1">Internet Exchange BGP Route Server Operations</span>
Abstract
The popularity of Internet Exchange Points (IXPs) brings new
challenges to interconnecting networks. While bilateral External BGP
(EBGP) sessions between exchange participants were historically the
most common means of exchanging reachability information over an IXP,
the overhead associated with this interconnection method causes
serious operational and administrative scaling problems for IXP
participants.
Multilateral interconnection using Internet route servers can
dramatically reduce the administrative and operational overhead
associated with connecting to IXPs; in some cases, route servers are
used by IXP participants as their preferred means of exchanging
routing information.
This document describes operational considerations for multilateral
interconnections at IXPs.
Status of This Memo
This document is not an Internet Standards Track specification; it is
published for informational purposes.
This document is a product of the Internet Engineering Task Force
(IETF). It represents the consensus of the IETF community. It has
received public review and has been approved for publication by the
Internet Engineering Steering Group (IESG). Not all documents
approved by the IESG are a candidate for any level of Internet
Standard; see <a href="./rfc7841#section-2">Section 2 of RFC 7841</a>.
Information about the current status of this document, any errata,
and how to provide feedback on it may be obtained at
<a href="http://www.rfc-editor.org/info/rfc7948">http://www.rfc-editor.org/info/rfc7948</a>.
<span class="grey">Hilliard, et al. Informational [Page 1]</span></pre>
<hr class='noprint'/><!--NewPage--><pre class='newpage'><span id="page-2" ></span>
<span class="grey"><a href="./rfc7948">RFC 7948</a> IXP BGP Route Server Operations September 2016</span>
Copyright Notice
Copyright (c) 2016 IETF Trust and the persons identified as the
document authors. All rights reserved.
This document is subject to <a href="https://www.rfc-editor.org/bcp/bcp78">BCP 78</a> and the IETF Trust's Legal
Provisions Relating to IETF Documents
(<a href="http://trustee.ietf.org/license-info">http://trustee.ietf.org/license-info</a>) in effect on the date of
publication of this document. Please review these documents
carefully, as they describe your rights and restrictions with respect
to this document. Code Components extracted from this document must
include Simplified BSD License text as described in Section 4.e of
the Trust Legal Provisions and are provided without warranty as
described in the Simplified BSD License.
Table of Contents
<a href="#section-1">1</a>. Introduction . . . . . . . . . . . . . . . . . . . . . . . . <a href="#page-3">3</a>
<a href="#section-1.1">1.1</a>. Notational Conventions . . . . . . . . . . . . . . . . . <a href="#page-3">3</a>
<a href="#section-2">2</a>. Bilateral BGP Sessions . . . . . . . . . . . . . . . . . . . <a href="#page-3">3</a>
<a href="#section-3">3</a>. Multilateral Interconnection . . . . . . . . . . . . . . . . <a href="#page-4">4</a>
<a href="#section-4">4</a>. Operational Considerations for Route Server Installations . . <a href="#page-6">6</a>
<a href="#section-4.1">4.1</a>. Path Hiding . . . . . . . . . . . . . . . . . . . . . . . <a href="#page-6">6</a>
<a href="#section-4.2">4.2</a>. Route Server Scaling . . . . . . . . . . . . . . . . . . <a href="#page-6">6</a>
<a href="#section-4.2.1">4.2.1</a>. Tackling Scaling Issues . . . . . . . . . . . . . . . <a href="#page-7">7</a>
<a href="#section-4.2.1.1">4.2.1.1</a>. View Merging and Decomposition . . . . . . . . . <a href="#page-7">7</a>
<a href="#section-4.2.1.2">4.2.1.2</a>. Destination Splitting . . . . . . . . . . . . . . <a href="#page-8">8</a>
<a href="#section-4.2.1.3">4.2.1.3</a>. NEXT_HOP Resolution . . . . . . . . . . . . . . . <a href="#page-8">8</a>
<a href="#section-4.3">4.3</a>. Prefix Leakage Mitigation . . . . . . . . . . . . . . . . <a href="#page-8">8</a>
<a href="#section-4.4">4.4</a>. Route Server Redundancy . . . . . . . . . . . . . . . . . <a href="#page-9">9</a>
<a href="#section-4.5">4.5</a>. AS_PATH Consistency Check . . . . . . . . . . . . . . . . <a href="#page-9">9</a>
<a href="#section-4.6">4.6</a>. Export Routing Policies . . . . . . . . . . . . . . . . . <a href="#page-10">10</a>
<a href="#section-4.6.1">4.6.1</a>. BGP Communities . . . . . . . . . . . . . . . . . . . <a href="#page-10">10</a>
<a href="#section-4.6.2">4.6.2</a>. Internet Routing Registries . . . . . . . . . . . . . <a href="#page-10">10</a>
<a href="#section-4.6.3">4.6.3</a>. Client-Accessible Databases . . . . . . . . . . . . . <a href="#page-10">10</a>
<a href="#section-4.7">4.7</a>. Layer 2 Reachability Problems . . . . . . . . . . . . . . <a href="#page-11">11</a>
<a href="#section-4.8">4.8</a>. BGP NEXT_HOP Hijacking . . . . . . . . . . . . . . . . . <a href="#page-11">11</a>
<a href="#section-4.9">4.9</a>. BGP Operations and Security . . . . . . . . . . . . . . . <a href="#page-13">13</a>
<a href="#section-5">5</a>. Security Considerations . . . . . . . . . . . . . . . . . . . <a href="#page-13">13</a>
<a href="#section-6">6</a>. References . . . . . . . . . . . . . . . . . . . . . . . . . <a href="#page-13">13</a>
<a href="#section-6.1">6.1</a>. Normative References . . . . . . . . . . . . . . . . . . <a href="#page-13">13</a>
<a href="#section-6.2">6.2</a>. Informative References . . . . . . . . . . . . . . . . . <a href="#page-14">14</a>
Acknowledgments . . . . . . . . . . . . . . . . . . . . . . . . . <a href="#page-15">15</a>
Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . <a href="#page-15">15</a>
<span class="grey">Hilliard, et al. Informational [Page 2]</span></pre>
<hr class='noprint'/><!--NewPage--><pre class='newpage'><span id="page-3" ></span>
<span class="grey"><a href="./rfc7948">RFC 7948</a> IXP BGP Route Server Operations September 2016</span>
<span class="h2"><a class="selflink" id="section-1" href="#section-1">1</a>. Introduction</span>
Internet Exchange Points (IXPs) provide IP data interconnection
facilities for their participants, using data link-layer protocols
such as Ethernet. The Border Gateway Protocol (BGP) [<a href="./rfc4271" title=""A Border Gateway Protocol 4 (BGP-4)"">RFC4271</a>] is
normally used to facilitate exchange of network reachability
information over these media.
As bilateral interconnection between IXP participants requires
operational and administrative overhead, BGP route servers [<a href="./rfc7947" title=""Internet Exchange BGP Route Server"">RFC7947</a>]
are often deployed by IXP operators to provide a simple and
convenient means of interconnecting IXP participants with each other.
A route server redistributes BGP routes received from its BGP clients
to other clients according to a prespecified policy, and it can be
viewed as similar to an EBGP equivalent of an Internal BGP (IBGP)
[<a href="./rfc4456" title=""BGP Route Reflection: An Alternative to Full Mesh Internal BGP (IBGP)"">RFC4456</a>] route reflector.
Route servers at IXPs require careful management, and it is important
for route server operators to thoroughly understand both how they
work and what their limitations are. In this document, we discuss
several issues of operational relevance to route server operators and
provide recommendations to help route server operators provision a
reliable interconnection service.
<span class="h3"><a class="selflink" id="section-1.1" href="#section-1.1">1.1</a>. Notational Conventions</span>
The keywords "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
"SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and
"OPTIONAL" in this document are to be interpreted as described in
[<a href="./rfc2119" title=""Key words for use in RFCs to Indicate Requirement Levels"">RFC2119</a>].
The phrase "BGP route" in this document should be interpreted as the
term "Route" described in [<a href="./rfc4271" title=""A Border Gateway Protocol 4 (BGP-4)"">RFC4271</a>].
<span class="h2"><a class="selflink" id="section-2" href="#section-2">2</a>. Bilateral BGP Sessions</span>
Bilateral interconnection is a method of interconnecting routers
using individual BGP sessions between each pair of participant
routers on an IXP, in order to exchange reachability information. If
an IXP participant wishes to implement an open interconnection policy
-- i.e., a policy of interconnecting with as many other IXP
participants as possible -- it is necessary for the participant to
liaise with each of their intended interconnection partners.
Interconnection can then be implemented bilaterally by configuring a
BGP session on both participants' routers to exchange network
reachability information. If each exchange participant interconnects
with each other participant, a full mesh of BGP sessions is needed,
as shown in Figure 1.
<span class="grey">Hilliard, et al. Informational [Page 3]</span></pre>
<hr class='noprint'/><!--NewPage--><pre class='newpage'><span id="page-4" ></span>
<span class="grey"><a href="./rfc7948">RFC 7948</a> IXP BGP Route Server Operations September 2016</span>
___ ___
/ \ / \
..| AS1 |..| AS2 |..
: \___/____\___/ :
: | \ / | :
: | \ / | :
: IXP | \/ | :
: | /\ | :
: | / \ | :
: _|_/____\_|_ :
: / \ / \ :
..| AS3 |..| AS4 |..
\___/ \___/
Figure 1: Full-Mesh Interconnection at an IXP
Figure 1 depicts an IXP platform with four connected routers,
administered by four separate exchange participants, each of them
with a locally unique Autonomous System (AS) number: AS1, AS2, AS3,
and AS4. The lines between the routers depict BGP sessions; the
dotted edge represents the IXP border. Each of these four
participants wishes to exchange traffic with all other participants;
this is accomplished by configuring a full mesh of BGP sessions on
each router connected to the exchange, resulting in six BGP sessions
across the IXP fabric.
The number of BGP sessions at an exchange has an upper bound of
n*(n-1)/2, where n is the number of routers at the exchange. As many
exchanges have large numbers of participating networks, the amount of
administrative and operation overhead required to implement an open
interconnection scales quadratically. New participants to an IXP
require significant initial resourcing in order to gain value from
their IXP connection, while existing exchange participants need to
commit ongoing resources in order to benefit from interconnecting
with these new participants.
<span class="h2"><a class="selflink" id="section-3" href="#section-3">3</a>. Multilateral Interconnection</span>
Multilateral interconnection is implemented using a route server
configured to distribute BGP routes among client routers. The route
server preserves the BGP NEXT_HOP attribute from all received BGP
routes and passes them with unchanged NEXT_HOP to its route server
clients according to its configured routing policy, as described in
[<a href="./rfc7947" title=""Internet Exchange BGP Route Server"">RFC7947</a>]. Using this method of exchanging BGP routes, an IXP
participant router can receive an aggregated list of BGP routes from
all other route server clients using a single BGP session to the
route server instead of depending on BGP sessions with each router at
the exchange. This reduces the overall number of BGP sessions at an
<span class="grey">Hilliard, et al. Informational [Page 4]</span></pre>
<hr class='noprint'/><!--NewPage--><pre class='newpage'><span id="page-5" ></span>
<span class="grey"><a href="./rfc7948">RFC 7948</a> IXP BGP Route Server Operations September 2016</span>
Internet exchange from n*(n-1)/2 to n, where n is the number of
routers at the exchange.
Although a route server uses BGP to exchange reachability information
with each of its clients, it does not forward traffic itself and is
therefore not a router.
In practical terms, this allows dense interconnection between IXP
participants with low administrative overhead and significantly
simpler and smaller router configurations. In particular, new IXP
participants benefit from immediate and extensive interconnection,
while existing route server participants receive reachability
information from these new participants without necessarily having to
modify their configurations.
___ ___
/ \ / \
..| AS1 |..| AS2 |..
: \___/ \___/ :
: \ / :
: \ / :
: \__/ :
: IXP / \ :
: | RS | :
: \____/ :
: / \ :
: / \ :
: __/ \__ :
: / \ / \ :
..| AS3 |..| AS4 |..
\___/ \___/
Figure 2: IXP-Based Interconnection with Route Server
As illustrated in Figure 2, each router on the IXP fabric requires
only a single BGP session to the route server, from which it can
receive reachability information for all other routers on the IXP
that also connect to the route server.
Multilateral and bilateral interconnections between different
autonomous systems are not exclusive to each other, and it is not
unusual to have both sorts of sessions configured in parallel at an
IXP. This configuration will lead to additional paths being
available to the BGP Decision Process, which will calculate a best
path as normal.
<span class="grey">Hilliard, et al. Informational [Page 5]</span></pre>
<hr class='noprint'/><!--NewPage--><pre class='newpage'><span id="page-6" ></span>
<span class="grey"><a href="./rfc7948">RFC 7948</a> IXP BGP Route Server Operations September 2016</span>
<span class="h2"><a class="selflink" id="section-4" href="#section-4">4</a>. Operational Considerations for Route Server Installations</span>
<span class="h3"><a class="selflink" id="section-4.1" href="#section-4.1">4.1</a>. Path Hiding</span>
"Path hiding" is a term used in [<a href="./rfc7947" title=""Internet Exchange BGP Route Server"">RFC7947</a>] to describe the process
whereby a route server may mask individual paths by applying
conflicting routing policies to its Loc-RIB. When this happens,
route server clients receive incomplete information from the route
server about network reachability.
There are several approaches that may be used to mitigate against the
effect of path hiding; these are described in [<a href="./rfc7947" title=""Internet Exchange BGP Route Server"">RFC7947</a>]. However,
the only method that does not require explicit support from the route
server client is for the route server itself to maintain an
individual Loc-RIB for each client that is the subject of conflicting
routing policies.
<span class="h3"><a class="selflink" id="section-4.2" href="#section-4.2">4.2</a>. Route Server Scaling</span>
While deployment of multiple Loc-RIBs on the route server presents a
simple way to avoid the path-hiding problem noted in <a href="#section-4.1">Section 4.1</a>,
this approach requires significantly more computing resources on the
route server than where a single Loc-RIB is deployed for all clients.
As the BGP Decision Process [<a href="./rfc4271" title=""A Border Gateway Protocol 4 (BGP-4)"">RFC4271</a>] must be applied to all Loc-RIBs
deployed on the route server, both CPU and memory requirements on the
host computer scale approximately according to O(P * N), where P is
the total number of unique paths received by the route server, and N
is the number of route server clients that require a unique Loc-RIB.
As this is a super-linear scaling relationship, large route servers
may derive benefit from deploying per-client Loc-RIBs only where they
are required.
Regardless of whether any Loc-RIB optimization technique is
implemented, the route server's theoretical upper-bound network
bandwidth requirements will scale according to O(P_tot * N), where
P_tot is the total number of unique paths received by the route
server, and N is the total number of route server clients. In the
case where P_avg (the arithmetic mean number of unique paths received
per route server client) remains roughly constant even as the number
of connected clients increases, the total number of prefixes will
equal the average number of prefixes multiplied by the number of
clients. Symbolically, this can be written as P_tot = P_avg * N. If
we assume that in the worst case, each prefix is associated with a
different set of BGP path attributes, so must be transmitted
individually, the network bandwidth scaling function can be rewritten
as O((P_avg * N) * N) or O(N^2). This quadratic upper bound on the
network traffic requirements indicates that the route server model
may not scale well for larger numbers of clients.
<span class="grey">Hilliard, et al. Informational [Page 6]</span></pre>
<hr class='noprint'/><!--NewPage--><pre class='newpage'><span id="page-7" ></span>
<span class="grey"><a href="./rfc7948">RFC 7948</a> IXP BGP Route Server Operations September 2016</span>
In practice, most prefixes will be associated with a limited number
of BGP path attribute sets, allowing more efficient transmission of
BGP routes from the route server than the theoretical analysis
suggests. In the analysis above, P_tot will increase monotonically
according to the number of clients, but it will have an upper limit
of the size of the full default-free routing table of the network in
which the IXP is located. Observations from production route servers
have shown that most route server clients generally avoid using
custom routing policies, and consequently, the route server may not
need to deploy per-client Loc-RIBs. These practical bounds reduce
the theoretical worst-case scaling scenario to the point where route
server deployments are manageable even on larger IXPs.
<span class="h4"><a class="selflink" id="section-4.2.1" href="#section-4.2.1">4.2.1</a>. Tackling Scaling Issues</span>
The problem of scaling route servers still presents serious practical
challenges and requires careful attention. Scaling analysis
indicates problems in three key areas: route processor CPU overhead
associated with BGP Decision Process calculations, the memory
requirements for handling many different BGP path entries, and the
network traffic bandwidth required to distribute these BGP routes
from the route server to each route server client.
<span class="h5"><a class="selflink" id="section-4.2.1.1" href="#section-4.2.1.1">4.2.1.1</a>. View Merging and Decomposition</span>
View merging and decomposition, outlined in [<a href="#ref-RS-ARCH" title=""A Route Server Architecture for Inter-Domain Routing"">RS-ARCH</a>], describes a
method of optimizing memory and CPU requirements where multiple route
server clients are subject to exactly the same routing policies. In
this situation, multiple Loc-RIB views can be merged into a single
view.
There are several variations of this approach. If the route server
operator has prior knowledge of interconnection relationships between
route server clients, then the operator may configure separate
Loc-RIBs only for route server clients with unique routing policies.
As this approach requires prior knowledge of interconnection
relationships, the route server operator must depend on each client
sharing their interconnection policies either in an internal
provisioning database controlled by the operator or in an external
data store such as an Internet Routing Registry Database.
Conversely, the route server implementation itself may implement
internal view decomposition by creating virtual Loc-RIBs based on a
single in-memory master Loc-RIB, with delta differences for each
prefix subject to different routing policies. This allows a more
fine-grained and flexible approach to the problem of Loc-RIB scaling,
at the expense of requiring a more complex in-memory Loc-RIB
structure.
<span class="grey">Hilliard, et al. Informational [Page 7]</span></pre>
<hr class='noprint'/><!--NewPage--><pre class='newpage'><span id="page-8" ></span>
<span class="grey"><a href="./rfc7948">RFC 7948</a> IXP BGP Route Server Operations September 2016</span>
Whatever method of view merging and decomposition is chosen on a
route server, pathological edge cases can be created whereby they
will scale no better than fully non-optimized per-client Loc-RIBs.
However, as most route server clients connect to a route server for
the purposes of reducing overhead, rather than implementing complex
per-client routing policies, edge cases tend not to arise in
practice.
<span class="h5"><a class="selflink" id="section-4.2.1.2" href="#section-4.2.1.2">4.2.1.2</a>. Destination Splitting</span>
Destination splitting, also described in [<a href="#ref-RS-ARCH" title=""A Route Server Architecture for Inter-Domain Routing"">RS-ARCH</a>], describes a
method for route server clients to connect to multiple route servers
and to send non-overlapping sets of prefixes to each route server.
As each route server computes the best path for its own set of
prefixes, the quadratic scaling requirement operates on multiple
smaller sets of prefixes. This reduces the overall computational and
memory requirements for managing multiple Loc-RIBs and performing the
best-path calculation on each.
In practice, the route server operator would need all route server
clients to send a full set of BGP routes to each route server. The
route server operator could then selectively filter these prefixes
for each route server by using either BGP Outbound Route Filtering
[<a href="./rfc5291" title=""Outbound Route Filtering Capability for BGP-4"">RFC5291</a>] or inbound prefix filters configured on client BGP
sessions.
<span class="h5"><a class="selflink" id="section-4.2.1.3" href="#section-4.2.1.3">4.2.1.3</a>. NEXT_HOP Resolution</span>
As route servers are usually deployed at IXPs where all connected
routers are on the same Layer 2 broadcast domain, recursive
resolution of the NEXT_HOP attribute is generally not required and
can be replaced by a simple check to ensure that the NEXT_HOP value
for each received BGP route is a network address on the IXP LAN's IP
address range.
<span class="h3"><a class="selflink" id="section-4.3" href="#section-4.3">4.3</a>. Prefix Leakage Mitigation</span>
Prefix leakage occurs when a BGP client unintentionally distributes
BGP routes to one or more neighboring BGP routers. Prefix leakage of
this form to a route server can cause serious connectivity problems
at an IXP if each route server client is configured to accept all BGP
routes from the route server. It is therefore RECOMMENDED when
deploying route servers that, due to the potential for collateral
damage caused by BGP route leakage, route server operators deploy
prefix leakage mitigation measures in order to prevent unintentional
prefix announcements or else limit the scale of any such leak.
Although not foolproof, per-client inbound prefix limits can restrict
the damage caused by prefix leakage in many cases. Per-client
<span class="grey">Hilliard, et al. Informational [Page 8]</span></pre>
<hr class='noprint'/><!--NewPage--><pre class='newpage'><span id="page-9" ></span>
<span class="grey"><a href="./rfc7948">RFC 7948</a> IXP BGP Route Server Operations September 2016</span>
inbound prefix filtering on the route server is a more deterministic
and usually more reliable means of preventing prefix leakage but
requires more administrative resources to maintain properly.
If a route server operator implements per-client inbound prefix
filtering, then it is RECOMMENDED that the operator also builds in
mechanisms to automatically compare the Adj-RIB-In received from each
client with the inbound prefix lists configured for those clients.
Naturally, it is the responsibility of the route server client to
ensure that their stated prefix list is compatible with what they
announce to an IXP route server. However, many network operators do
not carefully manage their published routing policies, and it is not
uncommon to see significant variation between the two sets of
prefixes. Route server operator visibility into this discrepancy can
provide significant advantages to both operator and client.
<span class="h3"><a class="selflink" id="section-4.4" href="#section-4.4">4.4</a>. Route Server Redundancy</span>
As the purpose of an IXP route server implementation is to provide a
reliable reachability brokerage service, it is RECOMMENDED that
exchange operators who implement route server systems provision
multiple route servers on each shared Layer 2 domain. There is no
requirement to use the same BGP implementation or operating system
for each route server on the IXP fabric; however, it is RECOMMENDED
that where an operator provisions more than a single server on the
same shared Layer 2 domain, each route server implementation be
configured equivalently and in such a manner that the path
reachability information from each system is identical.
<span class="h3"><a class="selflink" id="section-4.5" href="#section-4.5">4.5</a>. AS_PATH Consistency Check</span>
[<a id="ref-RFC4271">RFC4271</a>] requires that every BGP speaker that advertises a BGP route
to another external BGP speaker prepends its own AS number as the
last element of the AS_PATH sequence. Therefore, the leftmost AS in
an AS_PATH attribute should be equal to the AS number of the BGP
speaker that sent the BGP route.
As [<a href="./rfc7947" title=""Internet Exchange BGP Route Server"">RFC7947</a>] suggests that route servers should not modify the
AS_PATH attribute, a consistency check on the AS_PATH of a BGP route
received by a route server client would normally fail. It is
therefore RECOMMENDED that route server clients disable the AS_PATH
consistency check towards the route server.
<span class="grey">Hilliard, et al. Informational [Page 9]</span></pre>
<hr class='noprint'/><!--NewPage--><pre class='newpage'><span id="page-10" ></span>
<span class="grey"><a href="./rfc7948">RFC 7948</a> IXP BGP Route Server Operations September 2016</span>
<span class="h3"><a class="selflink" id="section-4.6" href="#section-4.6">4.6</a>. Export Routing Policies</span>
Policy filtering is commonly implemented on route servers to provide
prefix distribution control mechanisms for route server clients. A
route server "export" policy is a policy that affects prefixes sent
from the route server to a route server client. Several different
strategies are commonly used for implementing route server export
policies.
<span class="h4"><a class="selflink" id="section-4.6.1" href="#section-4.6.1">4.6.1</a>. BGP Communities</span>
Prefixes sent to the route server are tagged with specific standard
BGP Communities [<a href="./rfc1997" title=""BGP Communities Attribute"">RFC1997</a>] or Extended Communities [<a href="./rfc4360" title=""BGP Extended Communities Attribute"">RFC4360</a>]
attributes, based on predefined values agreed between the operator
and all clients. Based on these Communities values, BGP routes may
be propagated to all other clients, a subset of clients, or none.
This mechanism allows route server clients to instruct the route
server to implement per-client export routing policies.
As both standard BGP Communities and Extended Communities values are
restricted to 6 octets or fewer, it is not possible for both the
global and local administrator fields in the BGP Communities value to
fit a 4-octet AS number. Bearing this in mind, the route server
operator SHOULD take care to ensure that the predefined BGP
Communities values mechanism used on their route server is compatible
with 4-octet AS numbers [<a href="./rfc6793" title=""BGP Support for Four-Octet Autonomous System (AS) Number Space"">RFC6793</a>].
<span class="h4"><a class="selflink" id="section-4.6.2" href="#section-4.6.2">4.6.2</a>. Internet Routing Registries</span>
Internet Routing Registry databases (IRRDBs) may be used by route
server operators to construct per-client routing policies. "Routing
Policy Specification Language (RPSL)" [<a href="./rfc2622" title=""Routing Policy Specification Language (RPSL)"">RFC2622</a>] provides a
comprehensive grammar for describing interconnection relationships,
and several toolsets exist that can be used to translate RPSL policy
description into route server configurations.
<span class="h4"><a class="selflink" id="section-4.6.3" href="#section-4.6.3">4.6.3</a>. Client-Accessible Databases</span>
Should the route server operator not wish to use either BGP
Communities or the public IRRDBs for implementing client export
policies, they may implement their own routing policy database system
for managing their clients' requirements. A database of this form
SHOULD allow a route server client operator to update their routing
policy and provide a mechanism for allowing the client to specify
whether they wish to exchange all their prefixes with any other route
server client. Optionally, the implementation may allow a client to
specify unique routing policies for individual prefixes over which
they have routing policy control.
<span class="grey">Hilliard, et al. Informational [Page 10]</span></pre>
<hr class='noprint'/><!--NewPage--><pre class='newpage'><span id="page-11" ></span>
<span class="grey"><a href="./rfc7948">RFC 7948</a> IXP BGP Route Server Operations September 2016</span>
<span class="h3"><a class="selflink" id="section-4.7" href="#section-4.7">4.7</a>. Layer 2 Reachability Problems</span>
Layer 2 reachability problems on an IXP can cause serious operational
problems for IXP participants that depend on route servers for
interconnection. Ethernet switch forwarding bugs have occasionally
been observed to cause non-transitive reachability. For example,
given a route server and two IXP participants, A and B, if the two
participants can reach the route server but cannot reach each other,
then traffic between the participants may be dropped until such time
as the Layer 2 forwarding problem is resolved. This situation does
not tend to occur in bilateral interconnection arrangements, as the
routing control path between the two hosts is usually (but not
always, due to IXP inter-switch connectivity load-balancing
algorithms) the same as the data path between them.
Problems of this form can be partially mitigated by using
Bidirectional Forwarding Detection (BFD) [<a href="./rfc5881" title=""Bidirectional Forwarding Detection (BFD) for IPv4 and IPv6 (Single Hop)"">RFC5881</a>]. However, as this
is a bilateral protocol configured between routers, and as there is
currently no protocol to automatically configure BFD sessions between
route server clients, BFD does not currently provide an optimal means
of handling the problem. Even if automatic BFD session configuration
were possible, practical problems would remain. If two IXP route
server clients were configured to run BFD between each other and the
protocol detected a non-transitive loss of reachability between them,
each of those routers would internally mark the other's prefixes as
unreachable via the BGP path announced by the route server. As the
route server only propagates a single best path to each client, this
could cause either sub-optimal routing or complete connectivity loss
if there were no alternative paths learned from other BGP sessions.
<span class="h3"><a class="selflink" id="section-4.8" href="#section-4.8">4.8</a>. BGP NEXT_HOP Hijacking</span>
Item 2 in <a href="./rfc4271#section-5.1.3">Section 5.1.3 of [RFC4271]</a> allows EBGP speakers to change
the NEXT_HOP address of a received BGP route to be a different
Internet address on the same subnet. This is the mechanism that
allows route servers to operate on a shared Layer 2 IXP network.
However, the mechanism can be abused by route server clients to
redirect traffic for their prefixes to other IXP participant routers.
<span class="grey">Hilliard, et al. Informational [Page 11]</span></pre>
<hr class='noprint'/><!--NewPage--><pre class='newpage'><span id="page-12" ></span>
<span class="grey"><a href="./rfc7948">RFC 7948</a> IXP BGP Route Server Operations September 2016</span>
____
/ \
| AS99 |
\____/
/ \
/ \
__/ \__
/ \ / \
..| AS1 |..| AS2 |..
: \___/ \___/ :
: \ / :
: \ / :
: \__/ :
: IXP / \ :
: | RS | :
: \____/ :
: :
....................
Figure 3: BGP NEXT_HOP Hijacking Using a Route Server
For example, in Figure 3, if AS1 and AS2 both announce BGP routes for
AS99 to the route server, AS1 could set the NEXT_HOP address for
AS99's routes to be the address of AS2's router, thereby diverting
traffic for AS99 via AS2. This may override the routing policies of
AS99 and AS2.
Worse still, if the route server operator does not use inbound prefix
filtering, AS1 could announce any arbitrary prefix to the route
server with a NEXT_HOP address of any other IXP participant. This
could be used as a denial-of-service mechanism against either the
users of the address space being announced by illicitly diverting
their traffic or the other IXP participant by overloading their
network with traffic that would not normally be sent there.
This problem is not specific to route servers, and it can also be
implemented using bilateral BGP sessions. However, the potential
damage is amplified by route servers because a single BGP session can
be used to affect many networks simultaneously.
Because route server clients cannot easily implement next-hop policy
checks against route server BGP sessions, route server operators
SHOULD check that the BGP NEXT_HOP attribute for BGP routes received
from a route server client matches the interface address of the
client. If the route server receives a BGP route where these
addresses are different and where the announcing route server client
is in a different AS to the route server client that uses the next-
hop address, the BGP route SHOULD be dropped. Permitting next-hop
<span class="grey">Hilliard, et al. Informational [Page 12]</span></pre>
<hr class='noprint'/><!--NewPage--><pre class='newpage'><span id="page-13" ></span>
<span class="grey"><a href="./rfc7948">RFC 7948</a> IXP BGP Route Server Operations September 2016</span>
rewriting for the same AS allows an organization with multiple
connections into an IXP configured with different IP addresses to
direct traffic off the IXP infrastructure through any of their
connections for traffic engineering or other purposes.
<span class="h3"><a class="selflink" id="section-4.9" href="#section-4.9">4.9</a>. BGP Operations and Security</span>
BGP route servers SHOULD be configured and operated in compliance
with [<a href="./rfc7454" title=""BGP Operations and Security"">RFC7454</a>] with the exception of <a href="#section-11">Section 11</a>, "BGP Community
Scrubbing", which may not necessarily apply on a route server,
depending on the route server operator policy.
<span class="h2"><a class="selflink" id="section-5" href="#section-5">5</a>. Security Considerations</span>
On route server installations that do not employ path-hiding
mitigation techniques, the path-hiding problem outlined in
<a href="#section-4.1">Section 4.1</a> could be used by an IXP participant to prevent the route
server from sending any BGP routes for a particular prefix to other
route server clients, even if there was a valid path to that
destination via another route server client.
If the route server operator does not implement prefix leakage
mitigation as described in <a href="#section-4.3">Section 4.3</a>, it is trivial for route
server clients to implement denial-of-service attacks against
arbitrary Internet networks by leaking BGP routes to a route server.
Route server installations SHOULD be secured against BGP NEXT_HOP
hijacking, as described in <a href="#section-4.8">Section 4.8</a>.
<span class="h2"><a class="selflink" id="section-6" href="#section-6">6</a>. References</span>
<span class="h3"><a class="selflink" id="section-6.1" href="#section-6.1">6.1</a>. Normative References</span>
[<a id="ref-RFC2119">RFC2119</a>] Bradner, S., "Key words for use in RFCs to Indicate
Requirement Levels", <a href="https://www.rfc-editor.org/bcp/bcp14">BCP 14</a>, <a href="./rfc2119">RFC 2119</a>,
DOI 10.17487/RFC2119, March 1997,
<<a href="http://www.rfc-editor.org/info/rfc2119">http://www.rfc-editor.org/info/rfc2119</a>>.
[<a id="ref-RFC7947">RFC7947</a>] Jasinska, E., Hilliard, N., Raszuk, R., and N. Bakker,
"Internet Exchange BGP Route Server", <a href="./rfc7947">RFC 7947</a>,
DOI 10.17487/RFC7947, September 2016,
<<a href="http://www.rfc-editor.org/info/rfc7947">http://www.rfc-editor.org/info/rfc7947</a>>.
<span class="grey">Hilliard, et al. Informational [Page 13]</span></pre>
<hr class='noprint'/><!--NewPage--><pre class='newpage'><span id="page-14" ></span>
<span class="grey"><a href="./rfc7948">RFC 7948</a> IXP BGP Route Server Operations September 2016</span>
<span class="h3"><a class="selflink" id="section-6.2" href="#section-6.2">6.2</a>. Informative References</span>
[<a id="ref-RFC1997">RFC1997</a>] Chandra, R., Traina, P., and T. Li, "BGP Communities
Attribute", <a href="./rfc1997">RFC 1997</a>, DOI 10.17487/RFC1997, August 1996,
<<a href="http://www.rfc-editor.org/info/rfc1997">http://www.rfc-editor.org/info/rfc1997</a>>.
[<a id="ref-RFC2622">RFC2622</a>] Alaettinoglu, C., Villamizar, C., Gerich, E., Kessens, D.,
Meyer, D., Bates, T., Karrenberg, D., and M. Terpstra,
"Routing Policy Specification Language (RPSL)", <a href="./rfc2622">RFC 2622</a>,
DOI 10.17487/RFC2622, June 1999,
<<a href="http://www.rfc-editor.org/info/rfc2622">http://www.rfc-editor.org/info/rfc2622</a>>.
[<a id="ref-RFC4271">RFC4271</a>] Rekhter, Y., Ed., Li, T., Ed., and S. Hares, Ed., "A
Border Gateway Protocol 4 (BGP-4)", <a href="./rfc4271">RFC 4271</a>,
DOI 10.17487/RFC4271, January 2006,
<<a href="http://www.rfc-editor.org/info/rfc4271">http://www.rfc-editor.org/info/rfc4271</a>>.
[<a id="ref-RFC4360">RFC4360</a>] Sangli, S., Tappan, D., and Y. Rekhter, "BGP Extended
Communities Attribute", <a href="./rfc4360">RFC 4360</a>, DOI 10.17487/RFC4360,
February 2006, <<a href="http://www.rfc-editor.org/info/rfc4360">http://www.rfc-editor.org/info/rfc4360</a>>.
[<a id="ref-RFC4456">RFC4456</a>] Bates, T., Chen, E., and R. Chandra, "BGP Route
Reflection: An Alternative to Full Mesh Internal BGP
(IBGP)", <a href="./rfc4456">RFC 4456</a>, DOI 10.17487/RFC4456, April 2006,
<<a href="http://www.rfc-editor.org/info/rfc4456">http://www.rfc-editor.org/info/rfc4456</a>>.
[<a id="ref-RFC5291">RFC5291</a>] Chen, E. and Y. Rekhter, "Outbound Route Filtering
Capability for BGP-4", <a href="./rfc5291">RFC 5291</a>, DOI 10.17487/RFC5291,
August 2008, <<a href="http://www.rfc-editor.org/info/rfc5291">http://www.rfc-editor.org/info/rfc5291</a>>.
[<a id="ref-RFC5881">RFC5881</a>] Katz, D. and D. Ward, "Bidirectional Forwarding Detection
(BFD) for IPv4 and IPv6 (Single Hop)", <a href="./rfc5881">RFC 5881</a>,
DOI 10.17487/RFC5881, June 2010,
<<a href="http://www.rfc-editor.org/info/rfc5881">http://www.rfc-editor.org/info/rfc5881</a>>.
[<a id="ref-RFC6793">RFC6793</a>] Vohra, Q. and E. Chen, "BGP Support for Four-Octet
Autonomous System (AS) Number Space", <a href="./rfc6793">RFC 6793</a>,
DOI 10.17487/RFC6793, December 2012,
<<a href="http://www.rfc-editor.org/info/rfc6793">http://www.rfc-editor.org/info/rfc6793</a>>.
[<a id="ref-RFC7454">RFC7454</a>] Durand, J., Pepelnjak, I., and G. Doering, "BGP Operations
and Security", <a href="https://www.rfc-editor.org/bcp/bcp194">BCP 194</a>, <a href="./rfc7454">RFC 7454</a>, DOI 10.17487/RFC7454,
February 2015, <<a href="http://www.rfc-editor.org/info/rfc7454">http://www.rfc-editor.org/info/rfc7454</a>>.
[<a id="ref-RS-ARCH">RS-ARCH</a>] Govindan, R., Alaettinoglu, C., Varadhan, K., and D.
Estrin, "A Route Server Architecture for Inter-Domain
Routing", 1995,
<<a href="http://www.cs.usc.edu/assets/003/83191.pdf">http://www.cs.usc.edu/assets/003/83191.pdf</a>>.
<span class="grey">Hilliard, et al. Informational [Page 14]</span></pre>
<hr class='noprint'/><!--NewPage--><pre class='newpage'><span id="page-15" ></span>
<span class="grey"><a href="./rfc7948">RFC 7948</a> IXP BGP Route Server Operations September 2016</span>
Acknowledgments
The authors would like to thank Chris Hall, Ryan Bickhart, Steven
Bakker, and Eduardo Ascenco Reis for their valuable input.
Authors' Addresses
Nick Hilliard
INEX
4027 Kingswood Road
Dublin 24
Ireland
Email: nick@inex.ie
Elisa Jasinska
BigWave IT
ul. Skawinska 27/7
Krakow, MP 31-066
Poland
Email: elisa@bigwaveit.org
Robert Raszuk
Bloomberg LP
731 Lexington Ave.
New York, NY 10022
United States of America
Email: robert@raszuk.net
Niels Bakker
Akamai Technologies B.V.
Kingsfordweg 151
Amsterdam 1043 GR
Netherlands
Email: nbakker@akamai.com
Hilliard, et al. Informational [Page 15]
</pre>
|
