- mice-discuss - lists.micemn.net

Re: Attribute Length Error today

by DeLong, Owen

I believe we publish IRR records automatically through our IPAM. IIRC, we use the RIPE and RADB IRRs. Owen > On Dec 14, 2017, at 12:18 , Richard Laager <rlaager(a)WIKTEL.COM> wrote: > > At the last UG, we discussed IRR-based filtering. Does Akamai publish IRR records? > > -- > Richard

Dec. 15, 2017

Re: Attribute Length Error today

by Andrew Hoyos

On Dec 14, 2017, at 4:22 PM, Richard Laager <rlaager(a)WIKTEL.COM> wrote: > > I'm still interested in their opinion, as well as anyone else's, on IRR. I’d fully support IRR based filtering on the route servers. Maintaining an AS-SET and associated route objects is pretty trivial. We’re already doing this today on a number of IX’s (Equinix, SIX, NWAX, etc) -- Andrew Hoyos hoyosa(a)gmail.com

Dec. 14, 2017

Re: Attribute Length Error today

by Richard Laager

On 12/14/2017 02:22 PM, Jeremy Lumby wrote: > Didn't Akamai stop using the route servers? Therefore it wouldn't really > matter. I'm not sure if they use the route servers. I'm still interested in their opinion, as well as anyone else's, on IRR. -- Richard

Dec. 14, 2017

Re: Attribute Length Error today

by Jeremy Lumby

Didn't Akamai stop using the route servers? Therefore it wouldn't really matter. Jeremy LumbyMinnesota VoIP9217 17th Ave SSuite 216Bloomington MN 55425Main 612-355-7740Direct 612-392-6814EFax 952-873-7425jlumby(a)mnvoip.com <div> </div><div> </div><div>-------- Original message --------</div><div>From: Richard Laager <rlaager(a)WIKTEL.COM> </div><div>Date: 12/14/17 2:18 PM (GMT-06:00) </div><div>To: MICE-DISCUSS(a)LISTS.IPHOUSE.NET </div><div>Subject: Re: [MICE-DISCUSS] Attribute Length Error today </div><div> </div>-------- Original message --------From: Richard Laager <rlaager(a)WIKTEL.COM> Date: 12/14/17 2:18 PM (GMT-06:00) To: MICE-DISCUSS(a)LISTS.IPHOUSE.NET Subject: Re: [MICE-DISCUSS] Attribute Length Error today At the last UG, we discussed IRR-based filtering. Does Akamai publish IRR records? -- Richard

Dec. 14, 2017

Re: Attribute Length Error today

by Richard Laager

At the last UG, we discussed IRR-based filtering. Does Akamai publish IRR records? -- Richard

Dec. 14, 2017

Re: Attribute Length Error today

by DeLong, Owen

Akamai has no plans to publish ROAs at this time. The reality is that in its current state RPKI is a high overhead method for explaining to the world which origin ASN to prepend in order to more convincingly hijack routes. Owen > On Dec 13, 2017, at 12:46 , Doug McIntyre <merlyn(a)IPHOUSE.NET> wrote: > > On Fri, Dec 08, 2017 at 11:06:50PM -0600, Richard Laager wrote: >> Zero length is a subset of “doesn’t start with their AS”, so if we filter on that condition, hopefully we will catch that too. > > > BIRD is probably the best tool for the job for doing the import BGP filtering for > conditions based on either AS Path = 0 or start with their AS. > It sounds like people want the BGP import function to change to include something like > > function route_import(int asn) > { > .... > if bgp_path.first != asn then return false; > if bgp_path.len > 25 then return false; > if bgp_next_hop != from then return false; > return true; > } > > Are there other conditions that should be filtered on? (this is taken > mostly from Ondřej Surý's examples). > > As for doing RPKI, it looks like BIRD v2.0 supports that in some fashion, but that > would have to be tested out in a lab. How many members would have an ROA already? > > > -- > Doug McIntyre <merlyn(a)iphouse.net> > ~.~ ipHouse ~.~ > Network Engineer/Provisioning/Jack of all Trades

Dec. 14, 2017

Re: Attribute Length Error today

by Richard Laager

On 12/13/2017 02:46 PM, Doug McIntyre wrote: > if bgp_path.first != asn then return false; > if bgp_path.len > 25 then return false; > if bgp_next_hop != from then return false; While I am not familiar with BIRD's syntax, if I am reading these correctly, they seem like reasonable conditions. -- Richard

Dec. 13, 2017

Re: Attribute Length Error today

by Jason Hanke

This is the tool we're using at IX Denver: https://arouteserver.readthedocs.io/en/latest/index.html RPKI is currently turned off at IX Denver. Doug,If you're interested then I'll unicast you the output of the script. It's a bit large for the list. On Wed, Dec 13, 2017 at 2:46 PM, Doug McIntyre <merlyn(a)iphouse.net> wrote: > On Fri, Dec 08, 2017 at 11:06:50PM -0600, Richard Laager wrote: >> >> Zero length is a subset of “doesn’t start with their AS”, so if we filter >> on that condition, hopefully we will catch that too. > > > > BIRD is probably the best tool for the job for doing the import BGP > filtering for > conditions based on either AS Path = 0 or start with their AS. > It sounds like people want the BGP import function to change to include > something like > > function route_import(int asn) > { > .... > if bgp_path.first != asn then return false; > if bgp_path.len > 25 then return false; > if bgp_next_hop != from then return false; > return true; > } > > Are there other conditions that should be filtered on? (this is taken > mostly from Ondřej Surý's examples). > > As for doing RPKI, it looks like BIRD v2.0 supports that in some fashion, > but that > would have to be tested out in a lab. How many members would have an ROA > already? > > > > -- > Doug McIntyre <merlyn(a)iphouse.net> > ~.~ ipHouse ~.~ > Network Engineer/Provisioning/Jack of all Trades -- Jay Hanke CTO Neutral Path Communications 3 Civic Center Plaza, Suite 204 Mankato, MN 56001 (507) 327-2398 mobile jayhanke(a)neutralpath.net www.neutralpath.net

Dec. 13, 2017

Re: Attribute Length Error today

by Doug McIntyre

On Fri, Dec 08, 2017 at 11:06:50PM -0600, Richard Laager wrote: >Zero length is a subset of “doesn’t start with their AS”, so if we filter on that condition, hopefully we will catch that too. BIRD is probably the best tool for the job for doing the import BGP filtering for conditions based on either AS Path = 0 or start with their AS. It sounds like people want the BGP import function to change to include something like function route_import(int asn) { .... if bgp_path.first != asn then return false; if bgp_path.len > 25 then return false; if bgp_next_hop != from then return false; return true; } Are there other conditions that should be filtered on? (this is taken mostly from Ondřej Surý's examples). As for doing RPKI, it looks like BIRD v2.0 supports that in some fashion, but that would have to be tested out in a lab. How many members would have an ROA already? -- Doug McIntyre <merlyn(a)iphouse.net> ~.~ ipHouse ~.~ Network Engineer/Provisioning/Jack of all Trades

Dec. 13, 2017

Re: Please Welcome SW MN Broadband to MICE!

by Doug McIntyre

On Wed, Dec 13, 2017 at 11:20:34AM -0600, Jason Hanke wrote: >Name: Southwest MN Broadband >Port: xe-0/0/12 (NP Remote) >ASN: 25715 >IPv4: 206.108.255.40/24 >IPv6: 2001:504:27:0:0:6473::1/64 >Peering Contact: support(a)mysmbs.com > >Route Server: Yes The route servers are all set for them. Welcome! -- Doug McIntyre <merlyn(a)iphouse.net> ~.~ ipHouse ~.~ Network Engineer/Provisioning/Jack of all Trades

Dec. 13, 2017