Subject: Re: [RPSEC] Back to the Basics: The AS Path

From: Sandy Murphy <[email-masked]>
Date: Mon, 24 Jan 2005 16:42:32 -0500 (EST)

>A ---- B ---- C ---- D ---- E
>
>AS A originates a route.  B doesn't wish AS E to use this route.

Ah, it is not to keep your peer from using the route, it is to
keep someone several hops away from using the route.

(There must be a reason why one would want to do this, but it's
just another example of weird policies that people want to
enforce.)

>When sets are involved, how do we determine adjancencies?

This is a difficult question for all solutions I know of.

One can be really loose - as long as there is one subset of the
set that can be assembled with the preceding and following sequences
of AS's to form a valid path, the path is OK.

One can be really strict - all paths composed of AS's in the set
with the preceding and following sequences of AS's must be OK
for the path to be OK.

Neither is satisfactory, from a protection point of view.  The
fact that the AS's in multiple sequences are bundled in the AS_SET
and lose the identify of the sequences they came from makes it really
hard to judge.

But I've been told be people who should know that AS_SET's are
actually rarely used.  That most places just re-originate.
Still true?

--Sandy

_______________________________________________
RPSEC mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/rpsec

---

From: Blaine Christian <[email-masked]>
Date: Mon, 24 Jan 2005 17:05:48 -0500

> just another example of weird policies that people want to

Funny enough, considering the group of people who are discussing this.  The
cited need was that when someone is hacking at you from a specific AS you
can deny your route to that AS.  BTW, I have only had one person say this
was something that they MIGHT want to use.  I have received no reports of
actual usage as of yet.  I had one person say they have seen it before but
very rarely.

> actually rarely used.  That most places just re-originate.

Last time I looked AS_SETs were rarely used.  A few years ago I was bit by a
combination of a certain vendor whose shall remain nameless and another
vendor who shall remain nameless.  Vendor A propagated an AS Set that
exceeded the alloted variable size on Vendor B.  Funny enough that caused
just about every router on the network to panic.  Believe it or not it was a
day one bug.

BTW, I am one of the many who, for a few years,was routinely slammed by
large scale BGP badness.  Most of the badness was due to code issues.  This
is why the attempt to modify the way BGP works is going to have to be dealt
with VERY carefully.

I believe AS_SET is still sparsely used.