Re: Generic anycast addresses...

[Fred Baker <[e-mail]>]

> On May 29, 2019, at 5:28 PM, Toerless Eckert <[e-mail]> wrote:
> 
> AFAIK, all the successful deployments of anycast even across the Internet
> are based on using addresses belonging to one organization, and
> that organization is able to control where the member instances
> are in the Internet and what apps they are used for and therefore
> one org can ensure the deployment model works. Example:
> anycast in DNS/CDN.
> 
> Whenever a solution attempts to go beyond this, it becomes difficult,
> and thorough understanding of rfc7094 i probably useful. Alas, there
> seems to be no good "great working anycast deployment recipes" RFC,
> which would probably be more helpful.

I second the observation. I'll add a bit: in anycast deployments for DNS, scope is handled using BGP, and is measured in policy hops, not router interfaces. My context here is that I am associated with ISC, which operates one of the DNS root services and is an anycast operation.

The issue I see is that not all servers are equal even within an anycast service. Without naming names (although there are many that could be named), imagine this scenario: there is an instance (call it "A") that is generally reachable through some domain, perhaps Central Asia, and there is some other instance (call it "B") that happens to be located in that domain but by policy only serves a smaller area, such as the systems located in a data center. Within the locality, the anycast instance near B announces its route with the community "No-export", meaning that it may be distributed freely in IBGP but is not to be exported in EBGP to a routing neighbor.

In that scenario, now place two users of the anycast service (which I will call "a" and "b" respectively) on either side of the dividing line between A and B. In routing, a will access the service at A, and b will access the service at B, even though they are each at most one routing hop from B and perhaps many EBGP hops from A.

From my perspective, this proposal would appear to work well in the Internet as it existed in 1983, but by acting in ignorance of the routing policy in force, fails dramatically at any time after the development of BGP.

I might suggest soliciting the comments of current operators of anycast services.
--------------------------------------------------------------------------------
Victorious warriors win first and then go to war,
Defeated warriors go to war first and then seek to win.
     Sun Tzu