1. Internet Networking Spring 2004 Tutorial 5 Safe “Peering Backup” Routing With BGP

2. BGP - Background Inter-AS routing protocol. The routers have no global knowledge of the topology Each router knows its neighbors The router chooses a path according to local policies. The router advertises paths it chose to the neighbors

3. Safe System We call a collection of routing policies safe if they can never lead to routing divergence. Example: Unsafe system AS1 AS2 AS0 (AS1,AS2,AS0) (AS1,AS0) (AS2,AS1,AS0) (AS2,AS0) Paths to AS0:

4. Global Coordination – Why Not? Many ASes may be unwilling to reveal their local policies to others Statically checking for convergence properties is NP-complete problem Even if convergence insured for certain topology, BGP might not converge after router/link failures or policy change

5. Why Not “ Shortest Path Routing ” ? This may contradict local policy (i.e. the case where an AS wants to route through its provider even if the route is not attractive in terms of its length). For example, there is a possibility that a router will prefer provider path over customer path – against its financial incentive.

6. Relationships Between AS Customer – Provider (transit) relation – the customer pays to the provider for traffic on the link. An AS will export to its providers paths it learned from its customers. An AS will export to its customer paths it learned from providers, customers and peers Peer-to-peer (peering) relation – the link is intended for traffic between two neighbors and their customers. An AS will export to its peers paths it learned from its customers only.

7. AS Graph - Example The export policies should prohibit the use of some of the paths: for example paths (6,0,3), (4,2,0) and (2,0,1) Possible Paths from 0 to 2: (0,2), (0,3,2), (0,3,4,2), (0,3,5,4,2), (0,6,5,3,2), (0,6,5,4,2) 65 34 201 Peer-to-peer Provider-to-customer

8. AS Graph Properties An AS graph is said to be an acyclic provider- customer digraph if the directed graph induced by provider–customer relations is acyclic. Example: if we added a provider-customer edge {0,5} in the previous graph, we would create a cycle. A path has a valley if it traverses a provider- costumer edge and then a costumer-provider edge. Example: paths (3,2,4), (6,1,0,3) – have a valley path (3,5,4) – has no valley

9. AS Graph Properties A path has a step if: There is a peer-to-peer edge followed by a peer-to-peer edge. Example: (2, 0, 1). There is a peer-to-peer edge followed by a costumer-provider edge. Example: (2, 0, 5). There is a provider-costumer edge followed by a peer-to-peer edge. Example: (3, 0, 1).

10. Export Policy The following table indicates whether or not AS announces a route to its neighbor depending on its relationship to the AS that send the route: These export rules ensure that no permitted path will have a step or a valley. providerpeercustomer YYY NNYpeer NNYprovider From To

11. The Safety Theorem Guideline: If for AS1 next hop of path P1 belongs to AS1’s customers, and next hop of path P2 belongs to AS1’s providers or peers, then AS1 should prefer P1 over P2. Why does this Guideline make sense? Theorem: Consider a BGP system where (a) there are only transit and peering relations, (b) all ASs follow the above Guideline (c) there is no provider-customer cycle (d) there is no valley (e) there is no step, then this BGP system is safe.

12. Peering Backup “Peering Backup” is a new relation (agreement) between neighboring ASs AS-1 and AS-2 (recall that we have considered in the past only “peering” and “transit”) The idea is that if the connectivity of AS-1 through its provider is lost, then AS-1 is allowed to send packets through AS-2 even if they are not destined for AS-2 siblings, and vice versa. More formally, we permit a path that includes a step. Since such a paths should be used only in the case of failure, it will always have lower preference than a primary path.

13. Paths categories Provider-costumer, peer-to-peer: w vu P

14. Paths categories peer-to-pee, customer-provider v wu P

15. Paths categories peer-to-peer, peer-to-peer: wvu P

16. Export Policies for supporting peering backup The new policy can form valley paths. E.g. 2-0-1-3 To avoid this, paths received from a provider should be marked not only as a backup, but using an additional flag, and AS that gets such a marked path should never export it to its provider. providerpeercustomer YYY Y(backup) Ypeer NY(backup)Yprovider From To 2 0 1 3

17. Backup Path - Example Paths (5,3,4,2) or (1,0,2,4) are legal backup paths Path (3,0,6) is not legal 65 34 201 backup peering Provider-to-customer backup peering backup peering

18. Backup Path - Example Example of the propagation of an announcement of a backup path: AS0 sends path (0,1) to AS6, but the path is not accepted (and therefore is not propagated further) while link (6,1) is up. When link (6,1) is broken, AS6 accepts the backup path (6,0,1) and announces it to AS5.

19. Ranking backup paths Example: Suppose that AS3’s policy is: prefer routing through AS2. Suppose that AS2’s policy is: prefer routing through AS3. Consequently, we get routing divergence 2 3 01 (2,3,1,0) (3,2,1,0) (1,0)

20. Ranking backup paths – solution I Ranks backup paths based on the path “length” (number of ASs). Ensures that the system is safe, Very restrictive: prefer a provider path with two steps over customer path with one step. Note: giving a priority to customer- based routes, might result in an unsafe system.

21. Ranking backup paths – solution II Paths with smaller number of steps should be preferred. Among paths with the same number of steps customer paths should be preferred. Among customer paths with the same number of steps the shorter one should be preferred This policy is consistent with the commercial relationships between nodes and also ensures that the system is inherently safe (i.e. safe under any failures)

22. Avoidance Level In order to implement the policy we associated a new attribute, called avoidance level, to each path. For each step edge the avoidance level of the path should be increased. Each router may increase the avoidance level by different value – it just should be positive. Avoidance level may be increased when adding any edge, not only a step. The path with lower avoidance level should be preferred.

23. Increasing Avoidance Level The following table indicates when the avoidance level attribute should be increased. (R indicates that its increase is required while O indicates that its increase is optional providerpeercustomer OOO RROpeer ROprovider