Re: [Sidrops] WGLC for draft-ietf-sidrops-ov-clarify-00

["Montgomery, Douglas (Fed)" <[e-mail]>]

Sorry for being late on the call for comments, but I have a question about the draft and the implications for OV that I wanted to discuss.

The new draft makes it clear that routes that originate internal to an AS that get distributed into iBGP MUST be marked by default.


“ This means that, on a router, all routes in BGP, absent operator
   configuration otherwise, MUST have been marked because they were
   either received via BGP (whether eBGP or iBGP), redistributed from an
   IGP, static, or directly connected, or any other distribution into
   BGP.

   When redistributing into BGP from connected, static, IGP, iBGP, etc.,
   there is no AS_PATH in the input to allow RPKI validation of the
   originating AS.  In such cases, the router SHOULD use the AS of the
   router's BGP configuration.”

In a situation where internal more specific routes are redistributed into iBGP for use internal to the AS, but summarized into an aggregate before being originated in eBGP, and the ROA for the eBGP aggregate is set tight (e.g., equal to the aggregate length), how do we suggest this is to be handled?

For example I use /24s internally, but only originate a /16 externally, and have a ROA with MaxLength=16.   Without further configuration/action this would result in the internal /24s would be marked Invalid, but clearly I don’t want them to be deprefed or dropped.

The choices seem to be that I have the ability to write route policy that exempts local routes from the an overall policy (e.g., drop invalid, unless it is a locally generated iBGP route), or I create SLURM entries to make the /24s valid, only in my AS, but not in the public RPKI data?   Either of these choices has some configuration complexity.

Are there other ways of handling this.   Do implementations provide enough policy knobs to allow me to apply OV policies to some iBGP routes, but not others (e.g., locally originated)?

dougm
--
Doug Montgomery, Manager Internet  & Scalable Systems Research @ NIST

From: Sidrops <[e-mail]> on behalf of Keyur Patel <[e-mail]>
Date: Wednesday, February 28, 2018 at 4:04 PM
To: "[e-mail]" <[e-mail]>
Subject: [Sidrops] WGLC for draft-ietf-sidrops-ov-clarify-00

The draft can be found at: https://datatracker.ietf.org/doc/draft-ietf-sidrops-ov-clarify/<https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fdatatracker.ietf.org%2Fdoc%2Fdraft-ietf-sidrops-ov-clarify%2F&data=02%7C01%7Cdougm%40nist.gov%7C568a00049ec0477f3e9a08d57eeed716%7C2ab5d82fd8fa4797a93e054655c61dec%7C1%7C0%7C636554486639810261&sdata=qdbUfO9UmUil0ifJi591o%2F8cIVY2L5%2BaGoQc0PF59rA%3D&reserved=0>.