Subject: [sidr] Routing policy based on RPKI

From: Jac Kloots <[email-masked]>
Date: Tue, 5 Nov 2013 22:38:41 +0100 (CET)

Oke guys,

I'm working on setting up a routing policy based upon origin validation. 
Having read the http://datatracker.ietf.org/doc/draft-ietf-sidr-origin-ops/ 
draft I got confused.

I've attached a ppt trying to make my problem clear. Am I making a thinking 
error here or doesn't it make any sense changing preference for valids and 
unknowns?

Who's helping me out on this.

Regards,

Jac

-- 
Jac Kloots
Network Services
SURFnet bv

---

From: Matthias Waehlisch <[email-masked]>
Date: Tue, 5 Nov 2013 15:04:37 -0800 (Pacific Normalzeit)

Hi Jac,

  actually, I'm confused about the statemet on slide 4: "Different 
validation states only happens when there is a less or more specific 
route announced."

  For example, ROA {1.2.0.0/16-24, AS 10}. BGP Update 1.2.0.0/16 with 
origin AS 10 is valid, but the same prefix with origin AS 20 is invalid.

  Can you clarify?

Thanks
  matthias

-- 
Matthias Waehlisch
.  Freie Universitaet Berlin, Inst. fuer Informatik, AG CST
.  Takustr. 9, D-14195 Berlin, Germany
.. mailto:[email-masked] .. http://www.inf.fu-berlin.de/~waehl
:. Also: http://inet.cpt.haw-hamburg.de .. http://www.link-lab.net

---

From: Pradosh Mohapatra <[email-masked]>
Date: Tue, 5 Nov 2013 17:20:23 -0800

Hello Jac,

> I'm working on setting up a routing policy based upon origin validation. Having read the http://datatracker.ietf.org/doc/draft-ietf-sidr-origin-ops/ draft I got confused.
> 
> I've attached a ppt trying to make my problem clear. Am I making a thinking error here or doesn't it make any sense changing preference for valids and unknowns?

Couple of points.

1) You are right that for the same destination prefix on the same router, the validation 
     state for the paths will be either _all_ [NotFound] or _all_ from the list [Valid, Invalid]. 
     This is based on the availability of the ROA on that router.

2) That said, it is still a good practice to set preference based on each validation state
      because of the distributed nature of the network (the ROA database on all routers
      in an AS will not be consistent) and because of incremental deployment of origin
      validation. Think of the following simple topology:

                                     R2
                         R1
                                     R3

      Suppose the same destination prefix 'p' is received on both R2 and R3. 'p' may not
      be present on R2's ROA database, making it 'NotFound'. At the same time, 'p' is
      present on R3's ROA database, making it 'Valid'. You would want to set the preference
      correctly through your routing policy so that R1 prefers R3 (assume R1 does not yet 
      support origin validation).

- Pradosh

---

From: Jac Kloots <[email-masked]>
Date: Wed, 6 Nov 2013 06:17:00 +0100 (CET)

Hi Matthias,

> origin AS 10 is valid, but the same prefix with origin AS 20 is invalid.

Yes, I'm trying to figure out in what situation a valid route has to be 
prefered over an unknown route, invalid routes are allready dropped by the 
validation routing-policy.

Say route A is announced (and isn't invalid).

1. This route will become Unknown when route A is not covered by a ROA. This 
Unknown route can either have or not have more-specific routes being 
announced. If no more specific routes are announced this is the best route 
(no preferring necessary).

2. If there are more specific routes for route A and these are covered by a 
ROA they will be Valid (invalids are already dropped). But since they are 
more specific to route A prefering them above the Unknown (less specific) 
route A makes no sense.

3. If there are more specific routes for route A and these aren't covered by 
a ROA they will be Unknown, goto 1.

Knowing this, I can't think of a reason to prefer valid routes over 
unknowns and that makes defining a routing policy (as shown in slide 8) a 
whole lot easier.

Jac

-- 
Jac Kloots
Network Services
SURFnet bv

---

From: Jac Kloots <[email-masked]>
Date: Wed, 6 Nov 2013 20:40:27 +0100 (CET)

Hi Pradosh,

>      validation. Think of the following simple topology:

I dont agree, the ROA database is the same everywhere. I verified and 
checked this between several routers having a validation database.

All routers have the same amount of ROAs.

>      support origin validation).

This thus won't happen.

Jac

-- 
Jac Kloots
Network Services
SURFnet bv

---

From: Alex Band <[email-masked]>
Date: Wed, 6 Nov 2013 20:55:07 +0100

Pradosh,

On 6 Nov 2013, at 20:40, Jac Kloots <[email-masked]> wrote:

> I dont agree, the ROA database is the same everywhere. I verified and checked this between several routers having a validation database.

Exactly, the published material in the repositories is always identical. The only reason local, validated ROA databases can be different is because of the update interval of the validation software that operators have running, i.e. I may have just fetched an update with new ROAs that you don’t have yet.

To give you some perspective, the RIPE NCC RPKI Validator fetches updates every four hours.

Alex Band
RIPE NCC

---

From: Randy Bush <[email-masked]>
Date: Wed, 06 Nov 2013 13:10:51 -0800

> The only reason local, validated ROA databases can be different is
> because of the update interval of the validation software that
> operators have running, i.e. I may have just fetched an update with
> new ROAs that you don’t have yet.

network partition affecting fetches of some repositories by some client
caches.  some caches hung for ghu knows how long dealing with apnic's
deviant repository structure.  ...

randy

---

From: Jac Kloots <[email-masked]>
Date: Thu, 7 Nov 2013 09:29:17 +0100 (CET)

Hi,

> deviant repository structure.  ...

Okey, so you want to build routing policies based on a non-steady state? I'd 
like to keep things simple and this surely doesn't make live easy. So I'd be 
building my routing policies on a steady state (and ROA databases would, 
with time, converge to a steady state).

Any thoughts on the reasoning I made for not prefering valids over unknowns?

Jac

-- 
Jac Kloots
Network Services
SURFnet bv

---

From: Randy Bush <[email-masked]>
Date: Thu, 07 Nov 2013 08:23:05 -0800

> Okey, so you want to build routing policies based on a non-steady
> state?

want?  not really.  have to because that's reality, sadly yes.

i have a tee shirt which says "all devices fail.  two devices will fail
at the same time.  global bgp never converges..."

randy