- mice-discuss - lists.micemn.net

Re: Route Server BGP communities (& OS upgrades) - 5/22/2016

by Richard Laager

It seems pretty obvious to me that the route servers shouldn't clear ALL communities. Whether they need to clear 53679:* is another question. -- Richard

May 18, 2016

Re: Route Server BGP communities (& OS upgrades) - 5/22/2016

by Steve Howard

May 18, 2016

Re: Route Server BGP communities (& OS upgrades) - 5/22/2016

by Chris Wopat

The route servers are performing the action of not advertising. It shouldn't be on all IX participants to perform action on these communities or they wouldn't work as intended. If an IX participant wants to control traffic directly with another peer, they would work with that participant to use their possibly pre existing action communities. -- Chris Wopat Network Engineer, WiscNet wopat(a)wiscnet.net 608-210-3965 ________________________________ From: Steve Howard <showard(a)PAULBUNYAN.NET> Sent: May 18, 2016 12:23 PM To: MICE-DISCUSS(a)LISTS.IPHOUSE.NET Subject: Re: [MICE-DISCUSS] Route Server BGP communities (& OS upgrades) - 5/22/2016 On 05/18/2016 12:03 PM, Chris Wopat wrote: On 05/18/2016 11:53 AM, Doug McIntyre wrote: Would you want the export function to clear any communities it had at the end? (Something that is NOT done right now). Yes, I would consider it standard practice to clear action communities after the action was taken so they don't propagate/leak beyond AS 53679. IX members may wish to filter them on import as well [1]. Both is probably the most sane outcome. [1] - ras's BGP community presentation is always good to review - https://www.nanog.org/meetings/nanog40/presentations/BGPcommunities.pdf Perhaps I don't understand the specific question? But, I would prefer that the communities not be stripped. If they are stripped, how would we pass action communities onto other MICE members that require action on their networks? Perhaps just strip out the 53679:* communities would be a better choice? ________________________________ To unsubscribe from the MICE-DISCUSS list, click the following link: http://lists.iphouse.net/cgi-bin/wa?SUBED1=MICE-DISCUSS&A=1

May 18, 2016

Re: Route Server BGP communities (& OS upgrades) - 5/22/2016

by Steve Howard

May 18, 2016

Re: Route Server BGP communities (& OS upgrades) - 5/22/2016

by Chris Wopat

On 05/18/2016 11:53 AM, Doug McIntyre wrote: > Would you want the export function to > clear any communities it had at the end? (Something that is NOT done > right now). Yes, I would consider it standard practice to clear action communities after the action was taken so they don't propagate/leak beyond AS 53679. IX members may wish to filter them on import as well [1]. Both is probably the most sane outcome. [1] - ras's BGP community presentation is always good to review - https://www.nanog.org/meetings/nanog40/presentations/BGPcommunities.pdf -- Chris Wopat Network Engineer, WiscNet wopat(a)wiscnet.net 608-210-3965

May 18, 2016

Re: Route Server BGP communities (& OS upgrades) - 5/22/2016

by Doug McIntyre

On Wed, May 18, 2016 at 11:30:25AM -0500, Chris Wopat wrote: > Is it possible to see examples of the config? Or at least verify that these > communities are stripped out on the route server after the action is taken? Here's what I'm doing now function bgp_out_comm(int peeras) { if ! (source = RTS_BGP ) then return false; if peeras > 65535 then { if (ro,0,peeras) ~ bgp_ext_community then return false; if (ro,MICEAS,peeras) ~ bgp_ext_community then return true; if ((ro,0,MICEAS) ~ bgp_ext_community) then return false; } else { if ((0,peeras) ~ bgp_community) || ((ro,0,peeras) ~ bgp_ext_community) then return false; if ((MICEAS,peeras) ~ bgp_community) || ((ro,MICEAS,peeras) ~ bgp_ext_community) then return true; if ((0, MICEAS) ~ bgp_community) || ((ro,0,MICEAS) ~ bgp_ext_community) then return false; } return true; } The route server would need to keep the community state, this is the export function per peer back out. So I guess I'm not understanding the last part of the request. Would you want the export function to clear any communities it had at the end? (Something that is NOT done right now). -- Doug McIntyre <merlyn(a)iphouse.net> ~.~ ipHouse ~.~ Network Engineer/Provisioning/Jack of all Trades

May 18, 2016

Re: Route Server BGP communities (& OS upgrades) - 5/22/2016

by Richard Laager

> On May 18, 2016, at 11:34, Matthew Beckwell <matthewb(a)AITECH.NET> wrote: > > maybe we can convince Richard to throw up a section on the micemn.net technical page that lists the communities? :) Yes, will do. I have a few updates pending from the new members in the last couple days. I should have this all done in a few hours. -- Richard

May 18, 2016

Re: Route Server BGP communities (& OS upgrades) - 5/22/2016

by Matthew Beckwell

Doug & Chih, Thanks for your efforts on this. Mike H, can you post to MICE-ANNOUNCE? And maybe we can convince Richard to throw up a section on the micemn.net technical page that lists the communities? :) Thanks guys. ~Matthew On Wed, May 18, 2016 at 11:11 AM, Doug McIntyre <merlyn(a)iphouse.net> wrote: > Thanks to Chih Chen's help at the U of Wisc, I have testing done for > phase1 of the BGP communities exporting that have been requested. > (Phase2 would be doing prepends, but I'll have to lab up that > functionality as I saw the export function grow 10 times or so before I > stopped). > Most of the delay was waiting for others to test with me. > > I plan on implementing this MICE site wide on Sunday, 5/22/2016, starting > at > around 10:00PM - 11:59PM. > > All the testing looked good to us during testing, the functions > behaved as expected. This function is an expansion of what was tested > before. > ipHouse has had this export function on it since the end of winter. > > It is written to properly handle 32-bit ASNs (I believe, that part was > provided > by the BIRD WIKI author). And of course IPv4 and IPv6 make no difference. > > The communities supported by this setup will include > > 0:peerAS -- Don't export route prefix to this peer. > 53679:peerAS -- Always export route prefix to this peer. > 0:53679 -- Don't export route prefix to all MICE peers. > > > The steps of actually implementing this would be non-eventful, but I know > some will want to drop for it. > > > > ALSO, we really should upgrade the OS that is running the route > servers too. So I'll be doing OS updates and other upgrades that will > upgrade BIRD as well in the same window. BIRD moves from > 1.4.5 -> 1.5.0. The release notes say it mostly is OSPF changes, > I expect no problems in this update, BIRD has been very stable, and the OS > has been stable in production use here. > > Thanks. > > -- > Doug McIntyre <merlyn(a)iphouse.net> > ~.~ ipHouse ~.~ > Network Engineer/Provisioning/Jack of all Trades >

May 18, 2016

Re: Route Server BGP communities (& OS upgrades) - 5/22/2016

by Chris Wopat

On 05/18/2016 11:11 AM, Doug McIntyre wrote: > Thanks to Chih Chen's help at the U of Wisc, I have testing done for > phase1 of the BGP communities exporting that have been requested. > (Phase2 would be doing prepends, but I'll have to lab up that > functionality as I saw the export function grow 10 times or so before I stopped). > Most of the delay was waiting for others to test with me. > > I plan on implementing this MICE site wide on Sunday, 5/22/2016, starting at > around 10:00PM - 11:59PM. > > All the testing looked good to us during testing, the functions > behaved as expected. This function is an expansion of what was tested before. > ipHouse has had this export function on it since the end of winter. > > It is written to properly handle 32-bit ASNs (I believe, that part was provided > by the BIRD WIKI author). And of course IPv4 and IPv6 make no difference. > > The communities supported by this setup will include > > 0:peerAS -- Don't export route prefix to this peer. > 53679:peerAS -- Always export route prefix to this peer. > 0:53679 -- Don't export route prefix to all MICE peers. > > > The steps of actually implementing this would be non-eventful, but I know > some will want to drop for it. > > > > ALSO, we really should upgrade the OS that is running the route > servers too. So I'll be doing OS updates and other upgrades that will > upgrade BIRD as well in the same window. BIRD moves from > 1.4.5 -> 1.5.0. The release notes say it mostly is OSPF changes, > I expect no problems in this update, BIRD has been very stable, and the OS > has been stable in production use here. Great work folks, glad to see this coming in to production. Is it possible to see examples of the config? Or at least verify that these communities are stripped out on the route server after the action is taken? Cheers, -- Chris Wopat Network Engineer, WiscNet wopat(a)wiscnet.net 608-210-3965

May 18, 2016

Route Server BGP communities (& OS upgrades) - 5/22/2016

by Doug McIntyre

Thanks to Chih Chen's help at the U of Wisc, I have testing done for phase1 of the BGP communities exporting that have been requested. (Phase2 would be doing prepends, but I'll have to lab up that functionality as I saw the export function grow 10 times or so before I stopped). Most of the delay was waiting for others to test with me. I plan on implementing this MICE site wide on Sunday, 5/22/2016, starting at around 10:00PM - 11:59PM. All the testing looked good to us during testing, the functions behaved as expected. This function is an expansion of what was tested before. ipHouse has had this export function on it since the end of winter. It is written to properly handle 32-bit ASNs (I believe, that part was provided by the BIRD WIKI author). And of course IPv4 and IPv6 make no difference. The communities supported by this setup will include 0:peerAS -- Don't export route prefix to this peer. 53679:peerAS -- Always export route prefix to this peer. 0:53679 -- Don't export route prefix to all MICE peers. The steps of actually implementing this would be non-eventful, but I know some will want to drop for it. ALSO, we really should upgrade the OS that is running the route servers too. So I'll be doing OS updates and other upgrades that will upgrade BIRD as well in the same window. BIRD moves from 1.4.5 -> 1.5.0. The release notes say it mostly is OSPF changes, I expect no problems in this update, BIRD has been very stable, and the OS has been stable in production use here. Thanks. -- Doug McIntyre <merlyn(a)iphouse.net> ~.~ ipHouse ~.~ Network Engineer/Provisioning/Jack of all Trades

May 18, 2016