Network Router Configuration: From Data Mining to Policy Management Context Proposition Comparison with other approaches State of the effort Next steps

Context IPeFR ARACS? Tools Configs DBMS Config Updates Routers

What We Learned Configuration errors are common Error correction record is mixed Vendor dependence causes problems Automation is good

What Is the Problem Much of configuration is still manual (how much cut & paste is involved?) Those managing configurations have limited time Vendor expertise seems to be required for too much of provisioning management Many configuration errors are benign

Why Should We Care Some configuration errors are NOT benign The network is becoming more complex The business is highly competitive Having the ability to manage routing policy in isolation may make us more responsive to our customers

Proposition Data model that stores pure policy (or as pure as we can make it) Compose complex policies as a composition of policy atoms Isolate vendor dependencies as much as possible

Proposition Manage BGP Attributes with tables giving them names and descriptions Names could be chosen by marketing Autogenerate policy documentation Manage Private AS allocation Use current address space management to generate customer specific prefix lists

Example CUST-FACE route map Deletes updates containing: Default routes, Loopback addresses, Martians Reserved Community Values Peers, private AS’s, Confederations in AS Path Applies a mixture of: Local Preference Policy Route Scope Policy

Filter route-map CUST-FACE deny 10 match community 105 ! 0:611 (0|7018):1000-65535 route-map CUST-FACE deny 20 match ip address prefix-list CF-martians ! Default route, loopback, martians route-map CUST-FACE deny 30 match as-path 99 ! Delete routes with as-paths containing peers, ! private AS’s, and Confederations

Communities only route-map CUST-FACE permit 100 match community 109 ! 7018:90 7018:20 set local-preference 90 set community 0:2000 7018:2000 additive ! route-map CUST-FACE permit 102 match community 108 ! 7018:80 7018:20 set local-preference 80 route-map CUST-FACE permit 104 match community 107 ! 7018:70 7018:20 set local-preference 70

Add Address Matching route-map CUST-FACE permit 130 match ip address prefix-list CF-CIDR ! AT&T Addresses match community 139 ! 7018:90 set local-preference 90 set community 0:2010 7018:2010 additive ! route-map CUST-FACE permit 132 match community 138 ! 7018:80 set local-preference 80

route-map CUST-FACE permit 140 match community 149 ! 7018:90 set local-preference 90 set community 0:2000 7018:2000 additive ! Default is to advertise ! route-map CUST-FACE permit 142 match community 148 ! 7018:80 set local-preference 80 set community 0:2000 7018:2000 additive route-map CUST-FACE permit 144 match community 147 ! 7018:70 set local-preference 70 route-map CUST-FACE permit 146

Community Table ------------------------------------------------------------------------------ name value scope description ATTAGG 7018:1000 I Aggregated AT&T-owned addresses ATTAGG0 0:1000 I Aggregated AT&T-owned addresses ADVERTISE 7018:2000 I Non ATTAG routes with external visibility ADVERTISE0 0:2000 I Non ATTAG routes with external visibility NOEXPORT 7018:2010 I AT&T no-export community NOEXPORT0 0:2010 I AT&T no-export community NOPEER 7018:2500 I Routes not to be announced to peers NOPEER0 0:2500 I Routes not to be announced to peers NOCINFRA 7018:3000 I NOC infrastructure NOCINFRA0 0:3000 I NOC infrastructure NOCVIS 7018:4000 I Networks that must be visible to the NOC NOCVIS0 0:4000 I Networks that must be visible to the NOC PEER 7018:5000 I Routes learned from peers PEER0 0:5000 I Routes learned from peers EADV 0:20 E Client advertise request

Other Tables Resource Tables BadPrefixSpace RsrvdCommunitySpace MartianSpace LocalSpace LocalAS PeerAS Community ExtendedCommunity Composition Tables CommunityCommunityIn CommunityCommunityOut CommunityPref PrefixCommunity AtomicTransformations CompositeTransformations

Benefits of This Approach We can reason about and manage policy directly Change policy and let the tools generate vendor dependent configurations Vendor Independence more easily accomplished

Policy BGP policy expert Vendor A Vendor B

State of the Effort Vaporware alert We have some preliminary tables We will be starting on a tool to generate Cisco configurations very soon

What’s Next Tools for configlet generation? Tools for some other vendors router? Yet another routing policy language?

Acknowledgements Joel Gottlieb Albert Greenberg Tim Griffin Harmen Van Der Linde