1. Tutorial 5 Safe Routing With BGP Based on: http://www.ieee-infocom.org/2001/paper/573.ps http://www.research.att.com/~jrex/papers/sigmetrics00.ps Internet Networking Spring 2002

2. Inter-AS routing protocol. The routers have no global knowledge of the topology Each router knows its neighbors The router chooses a path according to local policies. The router advertises paths it choused to the neighbors BGP - Background

3. Safe System We call a collection of routing policies safe if they can never lead to BGP divergence. AS1 AS2 AS0 - dest (2,0) (0) (1,0) (0) Example: Unsafe system

4. Global Coordination – Why Not? Many ASes may be unwilling to reveal their local policies to others Statically checking for convergence properties is NP-complete problem Even if convergence insured for certain topology, BGP might not converge after router/link failures or policy change

5. Shortest Path Routing – Why Not Not enables local preferences. Not enables a router to give his neighbors a hint, which path to use. There is a possibility that a router will prefer provider path over customer path – against its financial incentive.

6. Relationships Between AS Customer – Provider relation – the customer pays to the provider for traffic on the link. An AS will export to its providers paths it learned from its customers. An AS will export to its customer paths it learned from providers,customers and peers Peer-to-peer relation – the link is intended for traffic between two neighbors. An AS will export to its peers paths is learned from its customers only.

7. AS Graph - Example Due to export policies some of the paths are not possible – for example paths (6,0,3), (4,2,0) and (2,0,1) 65 34 201 Peer-to-peer Provider-to-customer

8. AS Graph Properties Acyclic provider-customer digraph – The directed graph induced by provider –customer relations is acyclic. No-valley – If path traverses provider-customer edge, there is no customer- provider edge later in the path -Example: path (3,2,4) in the previous slide No step – there is no peer-to-peer edge followed by peer-to-peer or customer-provider edge and no provider- customer edge followed by peer-to-peer edge. - Example: paths (4,2,0) and (2,0,1) from the previous slide.

9. The Safety Theorem Guideline: If for AS’s r next hop of path P1 belongs to r’s customers and next hop of path P2 belongs to r’s providers or peers, then P1 should be preferred over P2. Theorem: For a BGP system that has only provider-customer and peer-peer relations, if all ASes follow the Guideline,then the BGP system is safe.

10. Why Does The Guideline Make Sense Guideline doesn’t restrict the preference among customer routes or among provider and peer routes, which leaves the router some flexibility in selecting local policies. ISP has financial incentive to follow the guideline, since it shouldn’t pay the customer to carry traffic.

11. The Safety Theorem Proof The proof is by induction starting from the destination router. The new update goes from the initiator upstream and affect all routers that have directed path to the destination. So all of them get to stable state in finite time Then if we go on the rest of the routers in linear order from provider to customer, each neighbor of such a router already in its stable state or doesn’t advertise its path to the neighbors.

12. BGP System With Backup Links AS may have an additional relation with its neighbors – backup relation. For example two ASes can establish a backup agreement to provide connectivity to the rest of the Internet for each other, in case of provider failure. More formally, we permit path that includes a step. Since this paths should be used only in case of failure they will always have lower preference than any other, primary path.

13. New Export Policy Since now backup paths are allowed, export policy for each AS has changed: providerpeercustomer YYY Y(backup) Ypeer NY(backup)Yprovider From To The new policy can form valley paths. To avoid it, paths received from provider should be marked and AS that gets such a marked path should never export it to its provider

14. Backup Path - Example 65 34 201 Peer-to-peer Provider-to-customer In the graph paths (5,3,4,2) or (1,0,2,4) are legal backup paths,but (3,2,4) is not legal in any case.

15. Global Significance of Backup Path. Each path that includes a step edge should be marked as backup path.Otherwise the system is unsafe. In the following example router 2 shouldn’t prefer (2,3,1,0) over (2,1,0) just because (2,3,1) is not a backup path. 2 34 01

16. Ranking Among Backup Paths Simplest policy ranks backup paths based on the path length. It ensures that system is safe, but this policy is very restrictive and also can rank backup path with two steps over path with one step. Using the same customer-prefer policy as for primary paths between backup paths can result in unsafe system.

17. Ranking Among Backup Paths- Solution Paths with smaller number of steps should be preferred Among paths with the same number of steps customer paths should be preferred. Among customer paths with the same number of steps the shorter one should be preferred This policy is consistent with the commercial relationships between nodes and also ensures that the system is inherently safe.(I.e. safe under any failures)

18. Avoidance Level In order to implement the policy we attach an attribute called avoidance level to each path and the path with lower avoidance level should be preferred. For each step edge the avoidance level of the path should be increased. Each router may increase the avoidance level by different value – it just should be positive. Avoidance level may be increased when adding any edge, not only a step.

19. Increasing Avoidance Level The following table indicates when the avoidance level attribute should be increased. R indicates that the increase is required, O indicates that it is optional: providerpeercustomer OOO RROpeer ROprovider From To

20. Implementing the Policy With BGP One of the attributes included in route announcement is c_set – set of community values. We assume that each AS w has defined the following set of community values: (w:bu:l) - tag for backup route of avoidance level l. (w:up) – tag for upstream routes