Subject: [idr] taxonomy of bogon filtering applied to route servers

From: "Michel Py" <[email-masked]>
Date: Sat, 20 Sep 2003 12:39:09 -0700

idr chairs and folks,

[I apologize in advance is this off-topic for this list]

I was recently looking at the issue of bogon route-servers, and it
struck me that there would be little work to adapt BGP Prefix-Based
Outbound Route Filtering (ORF) to change it into what is desperately
needed for bogons.

In a nutshell, the way I understand ORF is that the sending router sends
the receiving router a prefix-list (or distribute-list, or as-path
list). When the receiving router receives the prefix-list, it applies it
outbound towards the peer it received it from.

The enhancement that would be needed would be to make the receiving
router capable of applying the received prefix-list to other peers,
especially inbound. This would likely involve naming the received ORF
and making it available to other peers.

In other words, my idea is to use the ORF mechanism to propagate
prefix-lists to other peers, not for the purpose of filtering the routes
sent to a peer and their associated handling but for the purpose of
filtering inbound routes coming from other peers of the receiving ORF
router. I was wondering what this WG thinks about it.

I wrote a little taxonomy about IPv6 bogon filtering; this is very, very
crude and I welcome your comments.

Best,
Michel.

Taxonomy of bogon filtering.
============================

There are five basic ways to handle the bogon filtering issue:

1. Manually configured prefix-lists.
2. BGP feed of "bad" prefix aggregates.
3. BGP feed of anomalies.
4. BGP feed of "good" prefixes.
5. Derivative of BGP Prefix-Based Outbound Route Filtering (ORF).

1. Manually configured prefix-lists.
------------------------------------

This involves one or more volunteers to maintain a prefix-list that is
to be configured manually on routers. The issue with this is change
management: as we have seen with the 69/8 fiasco not that long ago, some
people do _not_ update their filters regularly, and when the bogon
prefix-list is modified it can take weeks to be upgraded, which is not
good. However, in terms of granularity, this is what gives the finest
control.

2. BGP feed of "bad" prefix aggregates.
---------------------------------------

This is the mechanism currently used by team cymru's bogon route servers
(http://www.cymru.com/BGP/bogon-rs.html). The issue with this is that
the domain of applicability is limited to networks that do not receive a
full feed. If one gets a full feed, this method does not prevent bad
prefixes if they are smaller than the bogon feed, because of the longest
match rule. So, this is an option only for networks with private peering
only and a default route outside, because a blackhole route is installed
to dump all the bogon traffic instead of sending it to the default
route.

3. BGP feed of anomalies.
-------------------------

A finer version of the previous one. Real-time monitoring of the routing
table at different points allows to build a list of bad announcements.
Contrary to the previous option, this allows to deal with specific
announcements. The issue with this is that it does not prevent the bad
announcement to be received, it actually adds another path that will be
made preferred to the offending announcement and used to dump the
traffic in a blackhole. Compared to the feeding of bad aggregates, this
method extends the domain of applicability to defaultless networks, at
the expense of aggravating the routing table size issue.

4. BGP feed of "good" prefixes.
-------------------------------

This is an IPv6-only topic that was discussed outside of idr. Please
don't pay attention to it in this context.

5. Derivative of BGP Prefix-Based Outbound Route Filtering (ORF).
-----------------------------------------------------------------

http://www.ietf.org/internet-drafts/draft-chen-bgp-prefix-orf-06.txt
http://www.ietf.org/internet-drafts/draft-ietf-idr-route-filter-09.txt
http://www.cisco.com/en/US/products/sw/iosswrel/ps1838/products_feature_
guide09186a0080134a57.html

Unfortunately the actual capabilities of this are that the filter-list
received from the peer is applied only outbound to the same peer. This
is a very promising technique for bogon route servers, but we need to
enhance it.

Please send comments.

Michel.

_______________________________________________
Idr mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/idr