Subject: [sidr] Exchange Point Prefixes

From: Danny McPherson <[email-masked]>
Date: Wed, 29 Jul 2009 09:44:04 -0600

Folks,
Wondering if anyone has given thought to how exchange
point prefixes will be handled in the RPKI model?  As
you likely know, many ISPs originate and announce these
prefixes from their own AS, and use not only internally,
but usually advertise to "customer peers", in order to
not break uRPF related stuff, and allow reachability for
diagnostics and the like by downstream ASN, etc..

How would this be accommodated with the current model?

-danny

---

From: Terry Manderson <[email-masked]>
Date: Wed, 29 Jul 2009 09:14:37 -0700

Danny,

Certainly one to add to the use-cases material.

Off the top of my head, from my interpretation the IX operator (presumably
who does not have an ASN) would issue a ROA for each and every IX
participant's AS to announce the IX prefix from the customer AS.

If the IX does have an AS, the might like to announce from their own AS and
then perhaps attempt to control route distribution. Meaning they would
create a ROA for their own prefix.

If the IX does not participate in RPKI, the prefix can be announced by
anyone with any origin, and distributed as far and wide as filters will
allow.

(even in the face of any RIR 'rules' about advertising of IX prefixes)

Terry

On 30/07/09 1:44 AM, "Danny McPherson" <[email-masked]> wrote:

> _______________________________________________
> sidr mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/sidr

---

From: Danny McPherson <[email-masked]>
Date: Wed, 29 Jul 2009 10:24:26 -0600

> create a ROA for their own prefix.

Well, most of the time there's direct interconnection there
and the IX operator isn't in the Network layer path or even
necessarily a participate in routing with IXP connectors..

> (even in the face of any RIR 'rules' about advertising of IX prefixes)

Until RPKI is deployed ubiquitously and filters are all
based upon it.

-danny

---

From: Christopher Morrow <[email-masked]>
Date: Wed, 29 Jul 2009 12:31:04 -0400

> but usually advertise to "customer peers", in order to

ideally they should only need this prefix internally (for reachability
of the next-hop for learned routes). That could be short-circuited as
well with resetting the next-hop to the loopback of the ISP router
connected to the exchange.

> How would this be accommodated with the current model?

I think that the model allows you to have unverified routes, and
(depending upon the implementation, of which there aren't any live
ones) preference or filter based on this fact. So, perhaps leave a
filter-hole to permit this prefix to be used...

-Chris

---

From: Terry Manderson <[email-masked]>
Date: Wed, 29 Jul 2009 09:32:54 -0700

> necessarily a participate in routing with IXP connectors..

ack.

> Until RPKI is deployed ubiquitously and filters are all

I cannot foresee a situation where RPKI is truly ubiquitous.

Terry

---

From: Danny McPherson <[email-masked]>
Date: Wed, 29 Jul 2009 10:33:33 -0600

> connected to the exchange.

E.g., MTR breaks..  Traceroute breaks with uRPF, etc.. for customer
ASNs if they don't have the route.

> filter-hole to permit this prefix to be used...

Yes, but long term we have to accommodate this, that's
my concern/

-danny

---

From: Randy Bush <[email-masked]>
Date: Wed, 29 Jul 2009 18:43:31 +0200

> point prefixes will be handled in the RPKI model?

i must be missing something.

the exchange operator issues a roa for all asns they wish to allow to
announce the prefix.

randy

---

From: Stephen Kent <[email-masked]>
Date: Wed, 29 Jul 2009 12:45:51 -0400

Danny,

I'm not sure I understand how an IXP's connectivity affects their 
ability to authorize the relevant ISPs to advertise the prefix. The 
IXP would do this by issuing a ROA for each ISP in question, which 
means it posts the ROAs to the repository system. That authorizes 
each ISP to send a BGP update containing the prefix in question, and 
with the ISP's AS# as the origin.  There is not need for the IXP to 
generate or transmit any BGP updates.

Steve

---

From: Danny McPherson <[email-masked]>
Date: Wed, 29 Jul 2009 12:05:01 -0600

> generate or transmit any BGP updates.

Gotcha, I think the model Randy outlined (i.e., the IXP provider
would issues ROA with all the participants AS numbers so that they
can announce the prefix) is what would need to happen, that makes
sense to me.

Thanks!

-danny