Login | Register For Free | Help
Search for: (Advanced)

Mailing List Archive: NANOG: users

Upstream BGP community support

 

 

First page Previous page 1 2 3 Next page Last page  View All NANOG users RSS feed   Index | Next | Previous | View Threaded


Brian.Dickson at concertia

Nov 2, 2009, 12:44 PM

Post #51 of 61 (626 views)
Permalink
RE: Upstream BGP community support [In reply to]

(Apologies for top-replying, but hey, it makes it easier to ignore stuff you've already read.)

I think the main things to consider in identifying what things "belong" in a standardized community are:
- is it something that is really global, and not local, in behaviour and scope?
- is it something that is mostly a signalling-of-intent "flag", and not a modification of path-selection?
--> (because) It should not require universal adoption to be useful - if it is ignored by A, and passed to B, will it still be useful/semantically correct?
- is it something that will either be applied by the originator to all instances of a given prefix (i.e. sending X to neighbour A and neighbour B, with community M);
- or something that will be applied by the originator to some instances of a given prefix (i.e. sending X to A with N, and X to B without N)
- is the intent being signalled easily understood, ideally in an absolute sense?

The two things I can think of, which would benefit from such a community, and where nearly-universal adoption would be of significant benefit, are:
(1) Blackhole this prefix, and;
(2) Use this prefix as a last resort only.
(Please add to this list if you think of any other cases meeting the above criteria).

Comments on particular proposed-standard-community cases follows...

I bring up (2) because it is otherwise *very* difficult to signal (or achieve), and often leads to potential wedgies.

The existing mechanisms to achieve (2) are often indistinguishable from Traffic Engineering - but this is very much not TE.

TE is "reduce load on this instance". (2) is "Don't use this for traffic unless you have no paths not marked with this community".

TE will typically be observed with small numbers of AS-prepending. (2) will be observed with large numbers of AS-prepending.

And, my guess would be, 80% of the prepending would not be needed if (2) were standardized and in use.

It might even reduce significantly the observed instances of wedgies and/or persistent oscillations in the wild.

Brian

-----Original Message-----
From: Jack Bates [mailto:jbates [at] brightok]
Sent: November-02-09 4:03 PM
To: Joel Jaeggli
Cc: nanog [at] nanog
Subject: Re: Upstream BGP community support

Joel Jaeggli wrote:
> more accessible and therefore more likely to be used, I don't think
> traffic engineering is something I particularly want to encourage to
> excess but RTBH is a know that more people need access to quite frankly.

I think creating a standard or at least a template might push more
people to adopt communities support and to use them. There are
definitely times it is useful to redirect traffic 2 ASN's away through a
longer route. In some cases (like my small self, I try to adopt policies
that allow communities to me to also be rewritten to the corresponding
peers communities to alter things as far as 3 ASN's away from my customer.

Jack


jmaimon at ttec

Nov 3, 2009, 6:45 AM

Post #52 of 61 (622 views)
Permalink
Re: Upstream BGP community support [In reply to]

Joel Jaeggli wrote:
> So this questions we have approached from time to time. Is there some
> worth to be had in finding some consensus (assuming such a thing is
> possible) on a subset of the features that people use communities for
> that could be standardized? particularly in the context of source based
> remote triggered blackholing this seemed a like a worthwhile effort.
>
> A standardized set means it can be cooked into documentation, training,
> and potentially even products.
>
> it doesn't mean that everyone will enable it, but if they do it would be
> nice to agree on some basi grounds rules. it should also be understood
> that many if not most localized community signaling uses would remain
> localized in terms of their documentation and use.
>
> joel
>

It might be a holy grail to have it completely automatable, but it would
seriously help just to have a couple standard ways to do things
published, product support could follow that.

I dont know if communities is really the best thing to keep overloading
this way. Whats wrong with dedicating a new attribute for automating policy?


joelja at bogus

Nov 3, 2009, 7:14 AM

Post #53 of 61 (617 views)
Permalink
Re: Upstream BGP community support [In reply to]

Joe Maimon wrote:
>
> I dont know if communities is really the best thing to keep overloading
> this way. Whats wrong with dedicating a new attribute for automating
> policy?

Well there's always flowspec, as an example...


smeuse at mara

Nov 5, 2009, 2:26 PM

Post #54 of 61 (608 views)
Permalink
Re: Upstream BGP community support [In reply to]

Randy Bush expunged (randy [at] psg):

> i try to complicate the internals of my network as little as possible,
> after all, complexity == opex and i value my time, it is a non-renewable
> resource.

I'm guessing you don't have the same financial constraints that others on this list have.

When you have "lots of traffic(tm)" to move around, and some paths are more 'spensive than others, you often don't have a choise but to muck with communities, or so I've heard....

-Steve


smeuse at mara

Nov 5, 2009, 2:33 PM

Post #55 of 61 (607 views)
Permalink
Re: Upstream BGP community support [In reply to]

Jack Bates expunged (jbates [at] brightok):

> I think creating a standard or at least a template might push more
> people to adopt communities support and to use them.


I put this up there with trynig to define inter-provider QoS. You are never going to get two business to agree to the same model.....and after all, community support is basically a business tool. I know from experience that some providers deliberately constrain their community support for business purposes, this goes back 10+ years.....

-Steve


jbates at brightok

Nov 5, 2009, 2:52 PM

Post #56 of 61 (608 views)
Permalink
Re: Upstream BGP community support [In reply to]

Steve Meuse wrote:
> I put this up there with trynig to define inter-provider QoS. You are never going to get two business to agree to the same model.....and after all, community support is basically a business tool. I know from experience that some providers deliberately constrain their community support for business purposes, this goes back 10+ years.....
>

While I agree, I was thinking more along the lines of easy tools to
provide the clueless with ways to do nifty things.


Jack


dr at cluenet

Nov 5, 2009, 3:04 PM

Post #57 of 61 (604 views)
Permalink
Re: Upstream BGP community support [In reply to]

On Mon, Nov 02, 2009 at 02:13:38PM -0600, Richard A Steenbergen wrote:
> Rather than simply double the size and break it
> up into 32:32, the designers reserved the top 16 bits for "type" and
> "subtype" attributes, leaving you only 48 bits to work with. Clearly the
> only suitable mapping for support of 32-bit ASNs on the Internet is
> 32:16, leaving us with exactly the same range of "data" values that we
> have today.

... which breaks schemes such as

65123:45678

where 45678 is the neighboring AS to apply the action defined by
65123 to. Seen those multiple times.

Of course using anything else then your own ASN in the "AS part" of
TE communities is certainly debatable.


Best regards,
Daniel

--
CLUE-RIPE -- Jabber: dr [at] cluenet -- dr [at] IRCne -- PGP: 0xA85C8AA0


ras at e-gerbil

Nov 5, 2009, 9:06 PM

Post #58 of 61 (606 views)
Permalink
Re: Upstream BGP community support [In reply to]

On Fri, Nov 06, 2009 at 12:04:18AM +0100, Daniel Roesen wrote:
> On Mon, Nov 02, 2009 at 02:13:38PM -0600, Richard A Steenbergen wrote:
> > Rather than simply double the size and break it
> > up into 32:32, the designers reserved the top 16 bits for "type" and
> > "subtype" attributes, leaving you only 48 bits to work with. Clearly the
> > only suitable mapping for support of 32-bit ASNs on the Internet is
> > 32:16, leaving us with exactly the same range of "data" values that we
> > have today.
>
> ... which breaks schemes such as
>
> 65123:45678
>
> where 45678 is the neighboring AS to apply the action defined by
> 65123 to. Seen those multiple times.
>
> Of course using anything else then your own ASN in the "AS part" of
> TE communities is certainly debatable.

Definitely a problem. The point of using 65123:45678 in the first place
(with a private ASN field in the "AS part") is to avoid stepping on
anyone else's ASN with your internal use community. Clearly we won't be
able to continue implementing this pattern AND fully support 32 bit
ASNs, so the type field is going to have to come to the rescue here.

Fortunately there is a "transitive" bit on the extended community type
that could be used to signal a behavior to your upstream network without
allowing that community to leak any further, so in theory one could use
something like that to do a "localtarget:45678:actiondata" tag without
poluting the namespace. Uou would lose the ability to send a community
to your "upstream's upstream", but that is probably of questionable
legitimacy anyhow. But the way I read RFC5668 and the IANA extended
community registry it doesn't look like there is an explicit definition
of a non-transitive target type, and the way I read RFC4360 it doesn't
look like the non-transitive value gets automatically reserved. So I
guess someone will need to request 0x4002 and 0x4202 non-transitive
target types for this purpose. Unless someone has a better idea of how
to handle the problem stated above?

--
Richard A Steenbergen <ras [at] e-gerbil> http://www.e-gerbil.net/ras
GPG Key ID: 0xF8B12CBC (7535 7F59 8204 ED1F CC1C 53AF 4C41 5ECA F8B1 2CBC)


dr at cluenet

Nov 6, 2009, 7:50 AM

Post #59 of 61 (604 views)
Permalink
Re: Upstream BGP community support [In reply to]

On Thu, Nov 05, 2009 at 11:06:56PM -0600, Richard A Steenbergen wrote:
> Definitely a problem. The point of using 65123:45678 in the first place
> (with a private ASN field in the "AS part") is to avoid stepping on
> anyone else's ASN with your internal use community.

Actually, as far as I have seen yet, it's more like being able to
derrive/describe community from ASN-to-act-on, e.g.

61234 meaning "prepend 3 times"
45678 meaning "this is the neighbor AS I want this to be applied to"

Best regards,
Daniel

--
CLUE-RIPE -- Jabber: dr [at] cluenet -- dr [at] IRCne -- PGP: 0xA85C8AA0


ras at e-gerbil

Nov 6, 2009, 12:34 PM

Post #60 of 61 (594 views)
Permalink
Re: Upstream BGP community support [In reply to]

On Fri, Nov 06, 2009 at 04:50:10PM +0100, Daniel Roesen wrote:
> On Thu, Nov 05, 2009 at 11:06:56PM -0600, Richard A Steenbergen wrote:
> > Definitely a problem. The point of using 65123:45678 in the first place
> > (with a private ASN field in the "AS part") is to avoid stepping on
> > anyone else's ASN with your internal use community.
>
> Actually, as far as I have seen yet, it's more like being able to
> derrive/describe community from ASN-to-act-on, e.g.
>
> 61234 meaning "prepend 3 times"
> 45678 meaning "this is the neighbor AS I want this to be applied to"

No I'm not saying otherwise. My point was that the reason it is
"65123:45678" instead of "45678:65123" is that they're using a value
from the private ASN range for the "action" tag, thus eliminating the
potential for collisions with anyone else's real ASNs. As you pointed
out, the ASN and Data fields are no longer going to be the same bit
size, so the "flipping the fields" trick will no longer work. The only
solution will be to add a non-transitive target type and do
"localtarget:45678:65123".

--
Richard A Steenbergen <ras [at] e-gerbil> http://www.e-gerbil.net/ras
GPG Key ID: 0xF8B12CBC (7535 7F59 8204 ED1F CC1C 53AF 4C41 5ECA F8B1 2CBC)


jimmy.changa007 at gmail

Jun 3, 2010, 11:03 PM

Post #61 of 61 (273 views)
Permalink
Re: Upstream BGP community support [In reply to]

Has anyone seen movement from HE on community support yet? I've heard
rumblings that they are looking to do something Q3/Q4 but my sales guy is
telling me that they will only support it if I go to a full 10Gb pipe.
Sounds more like an aggressive sales tactic, but was curious what others are
seeing.



On Fri, Nov 6, 2009 at 4:34 PM, Richard A Steenbergen <ras [at] e-gerbil>wrote:

> On Fri, Nov 06, 2009 at 04:50:10PM +0100, Daniel Roesen wrote:
> > On Thu, Nov 05, 2009 at 11:06:56PM -0600, Richard A Steenbergen wrote:
> > > Definitely a problem. The point of using 65123:45678 in the first place
> > > (with a private ASN field in the "AS part") is to avoid stepping on
> > > anyone else's ASN with your internal use community.
> >
> > Actually, as far as I have seen yet, it's more like being able to
> > derrive/describe community from ASN-to-act-on, e.g.
> >
> > 61234 meaning "prepend 3 times"
> > 45678 meaning "this is the neighbor AS I want this to be applied to"
>
> No I'm not saying otherwise. My point was that the reason it is
> "65123:45678" instead of "45678:65123" is that they're using a value
> from the private ASN range for the "action" tag, thus eliminating the
> potential for collisions with anyone else's real ASNs. As you pointed
> out, the ASN and Data fields are no longer going to be the same bit
> size, so the "flipping the fields" trick will no longer work. The only
> solution will be to add a non-transitive target type and do
> "localtarget:45678:65123".
>
> --
> Richard A Steenbergen <ras [at] e-gerbil> http://www.e-gerbil.net/ras
> GPG Key ID: 0xF8B12CBC (7535 7F59 8204 ED1F CC1C 53AF 4C41 5ECA F8B1 2CBC)
>
>

First page Previous page 1 2 3 Next page Last page  View All NANOG users RSS feed   Index | Next | Previous | View Threaded
 
 


Interested in having your list archived? Contact Gossamer Threads
 
  Web Applications & Managed Hosting Powered by Gossamer Threads Inc.