- mice-discuss - lists.micemn.net

Re: Route Server BGP communities (& OS upgrades) - 5/22/2016

by Mike Horwath

> On May 18, 2016, at 11:34, Matthew Beckwell <matthewb(a)AITECH.NET> wrote: > > Doug & Chih, Thanks for your efforts on this. > > Mike H, can you post to MICE-ANNOUNCE? Of course! -- Mike Horwath via iPad.

May 18, 2016

Re: Route Server BGP communities (& OS upgrades) - 5/22/2016

by Steve Howard

May 18, 2016

Re: Route Server BGP communities (& OS upgrades) - 5/22/2016

by Chris Wopat

The idea is to ONLY clear these specific action communities, leaving all other communities alone. -- Chris Wopat Network Engineer, WiscNet wopat(a)wiscnet.net 608-210-3965

May 18, 2016

Re: Route Server BGP communities (& OS upgrades) - 5/22/2016

by Andrew Hoyos

Chris is referring to deleting the communities that the route server is using to take action (i.e.: it should be transparent in that regard and not leak communities). The original example I had sent on how to do this in Bird has this as part of it as well, and would be considered standard and best practice. These shouldn’t be leaked back and forth between participants. see: https://gitlab.labs.nic.cz/labs/bird/wikis/Route_server_with_community_base… function bgp_out(int peeras) { if !bgp_out_comm(peeras) then return false; # Remove IXP related communities bgp_community.delete([(0,*)]); bgp_community.delete([(myas,*)]); bgp_ext_community.delete([(ro,0,*)]); bgp_ext_community.delete([(ro,myas,*)]); return true; } -- Andrew Hoyos hoyosa(a)gmail.com > On May 18, 2016, at 1:00 PM, Steve Howard <showard(a)paulbunyan.net> wrote: > > Like I said. Perhaps I don't understand the question... > > I understand the statement "If an IX participant wants to control traffic directly with another peer, they would work with that participant to use their possibly pre existing action communities." But, how will that work if all communities are cleared by the route servers? Or are you saying only strip the communities that the route server uses to take action? > > > On 05/18/2016 12:49 PM, Chris Wopat wrote: >> The route servers are performing the action of not advertising. It shouldn't be on all IX participants to perform action on these communities or they wouldn't work as intended. >> >> If an IX participant wants to control traffic directly with another peer, they would work with that participant to use their possibly pre existing action communities. >> >> -- >> Chris Wopat >> Network Engineer, WiscNet >> wopat(a)wiscnet.net 608-210-3965 >> >> From: Steve Howard <showard(a)PAULBUNYAN.NET> >> Sent: May 18, 2016 12:23 PM >> To: MICE-DISCUSS(a)LISTS.IPHOUSE.NET >> Subject: Re: [MICE-DISCUSS] Route Server BGP communities (& OS upgrades) - 5/22/2016 >> >> On 05/18/2016 12:03 PM, Chris Wopat wrote: >>> On 05/18/2016 11:53 AM, Doug McIntyre wrote: >>>> Would you want the export function to >>>> clear any communities it had at the end? (Something that is NOT done >>>> right now). >>> >>> Yes, I would consider it standard practice to clear action communities after the action was taken so they don't propagate/leak beyond AS 53679. >>> >>> IX members may wish to filter them on import as well [1]. Both is probably the most sane outcome. >>> >>> [1] - ras's BGP community presentation is always good to review - https://www.nanog.org/meetings/nanog40/presentations/BGPcommunities.pdf >>> >>> >> >> Perhaps I don't understand the specific question? But, I would prefer that the communities not be stripped. If they are stripped, how would we pass action communities onto other MICE members that require action on their networks? Perhaps just strip out the 53679:* communities would be a better choice? >> >> To unsubscribe from the MICE-DISCUSS list, click the following link: >> http://lists.iphouse.net/cgi-bin/wa?SUBED1=MICE-DISCUSS&A=1 >> >> >> To unsubscribe from the MICE-DISCUSS list, click the following link: >> http://lists.iphouse.net/cgi-bin/wa?SUBED1=MICE-DISCUSS&A=1 >> > > > To unsubscribe from the MICE-DISCUSS list, click the following link: > http://lists.iphouse.net/cgi-bin/wa?SUBED1=MICE-DISCUSS&A=1 >

May 18, 2016

Re: Route Server BGP communities (& OS upgrades) - 5/22/2016

by Richard Laager

It seems pretty obvious to me that the route servers shouldn't clear ALL communities. Whether they need to clear 53679:* is another question. -- Richard

May 18, 2016

Re: Route Server BGP communities (& OS upgrades) - 5/22/2016

by Steve Howard

May 18, 2016

Re: Route Server BGP communities (& OS upgrades) - 5/22/2016

by Chris Wopat

The route servers are performing the action of not advertising. It shouldn't be on all IX participants to perform action on these communities or they wouldn't work as intended. If an IX participant wants to control traffic directly with another peer, they would work with that participant to use their possibly pre existing action communities. -- Chris Wopat Network Engineer, WiscNet wopat(a)wiscnet.net 608-210-3965 ________________________________ From: Steve Howard <showard(a)PAULBUNYAN.NET> Sent: May 18, 2016 12:23 PM To: MICE-DISCUSS(a)LISTS.IPHOUSE.NET Subject: Re: [MICE-DISCUSS] Route Server BGP communities (& OS upgrades) - 5/22/2016 On 05/18/2016 12:03 PM, Chris Wopat wrote: On 05/18/2016 11:53 AM, Doug McIntyre wrote: Would you want the export function to clear any communities it had at the end? (Something that is NOT done right now). Yes, I would consider it standard practice to clear action communities after the action was taken so they don't propagate/leak beyond AS 53679. IX members may wish to filter them on import as well [1]. Both is probably the most sane outcome. [1] - ras's BGP community presentation is always good to review - https://www.nanog.org/meetings/nanog40/presentations/BGPcommunities.pdf Perhaps I don't understand the specific question? But, I would prefer that the communities not be stripped. If they are stripped, how would we pass action communities onto other MICE members that require action on their networks? Perhaps just strip out the 53679:* communities would be a better choice? ________________________________ To unsubscribe from the MICE-DISCUSS list, click the following link: http://lists.iphouse.net/cgi-bin/wa?SUBED1=MICE-DISCUSS&A=1

May 18, 2016

Re: Route Server BGP communities (& OS upgrades) - 5/22/2016

by Steve Howard

May 18, 2016

Re: Route Server BGP communities (& OS upgrades) - 5/22/2016

by Chris Wopat

On 05/18/2016 11:53 AM, Doug McIntyre wrote: > Would you want the export function to > clear any communities it had at the end? (Something that is NOT done > right now). Yes, I would consider it standard practice to clear action communities after the action was taken so they don't propagate/leak beyond AS 53679. IX members may wish to filter them on import as well [1]. Both is probably the most sane outcome. [1] - ras's BGP community presentation is always good to review - https://www.nanog.org/meetings/nanog40/presentations/BGPcommunities.pdf -- Chris Wopat Network Engineer, WiscNet wopat(a)wiscnet.net 608-210-3965

May 18, 2016

Re: Route Server BGP communities (& OS upgrades) - 5/22/2016

by Doug McIntyre

On Wed, May 18, 2016 at 11:30:25AM -0500, Chris Wopat wrote: > Is it possible to see examples of the config? Or at least verify that these > communities are stripped out on the route server after the action is taken? Here's what I'm doing now function bgp_out_comm(int peeras) { if ! (source = RTS_BGP ) then return false; if peeras > 65535 then { if (ro,0,peeras) ~ bgp_ext_community then return false; if (ro,MICEAS,peeras) ~ bgp_ext_community then return true; if ((ro,0,MICEAS) ~ bgp_ext_community) then return false; } else { if ((0,peeras) ~ bgp_community) || ((ro,0,peeras) ~ bgp_ext_community) then return false; if ((MICEAS,peeras) ~ bgp_community) || ((ro,MICEAS,peeras) ~ bgp_ext_community) then return true; if ((0, MICEAS) ~ bgp_community) || ((ro,0,MICEAS) ~ bgp_ext_community) then return false; } return true; } The route server would need to keep the community state, this is the export function per peer back out. So I guess I'm not understanding the last part of the request. Would you want the export function to clear any communities it had at the end? (Something that is NOT done right now). -- Doug McIntyre <merlyn(a)iphouse.net> ~.~ ipHouse ~.~ Network Engineer/Provisioning/Jack of all Trades

May 18, 2016