1. RPSL: Police’ing’ the Net Anwar M. Haneef Electrical and Computer Engineering University of Massachusetts, Amherst

2. RFC-2622: Not the most fun thing to read on a Friday night

3. Aim of my talk Not to make you expert network managers Not to make you expert network managers I want all of you to go back home, knowing that you have learnt the BASICS of a new language I want all of you to go back home, knowing that you have learnt the BASICS of a new language Prepare you all for the next talk on the practical applications of RPSL Prepare you all for the next talk on the practical applications of RPSL

4. Agenda What is Routing Policy ? What is Routing Policy ? Why define Routing Policy ? Why define Routing Policy ? BGP Configuration BGP Configuration IRR Configuration IRR Configuration RPSL – Introduction RPSL – Introduction RPSL – Objects RPSL – Objects What’s next What’s next

5. Agenda What is Routing Policy ? What is Routing Policy ? Why define Routing Policy ? Why define Routing Policy ? BGP Configuration BGP Configuration IRR Configuration IRR Configuration RPSL – Introduction RPSL – Introduction RPSL – Objects RPSL – Objects What’s next What’s next

6. What is Routing Policy ? Public description of the relationships between external BGP peers Public description of the relationships between external BGP peers Can describe internal BGP peer relationships Can describe internal BGP peer relationships

7. Routing Policy  Who are the peers  What routes are  Originated by a peer  Imported from each peer  Exported to each peer  Preferred when multiple routes exist  What to do if no route exists Routing Policy Unfortunately, Chun gets to do all the really COOL stuff….. 

8. Routing Policy Example AS1 originates route “d” AS1 originates route “d” AS1 exports “d” to AS2, AS2 imports AS1 exports “d” to AS2, AS2 imports AS2 exports “d” to AS3, AS3 imports AS2 exports “d” to AS3, AS3 imports AS3 exports “d” to AS5, AS5 imports AS3 exports “d” to AS5, AS5 imports

9. Routing Policy Example AS5 also imports “d” from AS4 AS5 also imports “d” from AS4 Which route does it prefer? Which route does it prefer?

10. Agenda What is Routing Policy ? What is Routing Policy ? Why define Routing Policy ? Why define Routing Policy ? BGP Configuration BGP Configuration IRR Configuration IRR Configuration RPSL – Introduction RPSL – Introduction RPSL – Objects RPSL – Objects What’s next What’s next Agenda

11. Why define a Routing Policy ? Documentation Documentation Allows automatic generation of router configurations Allows automatic generation of router configurations Provides routing security Provides routing security Can peer originate the route? Can peer originate the route? Can peer act as transit for the route? Can peer act as transit for the route? Provides a debugging aid Provides a debugging aid Compare policy versus reality Compare policy versus reality No one ever does anything for documentation, but its good to have it No one ever does anything for documentation, but its good to have it

12. Agenda What is Routing Policy ? What is Routing Policy ? Why define Routing Policy ? Why define Routing Policy ? BGP Configuration BGP Configuration IRR Configuration IRR Configuration RPSL – Introduction RPSL – Introduction RPSL – Objects RPSL – Objects What’s next What’s next Agenda

13. BGP Configuration Too many routers Too many routers Too detailed, large & tedious Too detailed, large & tedious Consistency Consistency Heavy consequences of mistakes Heavy consequences of mistakes ?!?!?!

14. Agenda What is Routing Policy ? What is Routing Policy ? Why define Routing Policy ? Why define Routing Policy ? BGP Configuration BGP Configuration The Internet Routing Registry The Internet Routing Registry RPSL – Introduction RPSL – Introduction RPSL – Objects RPSL – Objects What’s next What’s next Agenda

15. IRR – What is it ? Database of Database of IP networks, IP networks, DNS domains, DNS domains, DNS domain Contact Persons and DNS domain Contact Persons and IP routing policies IP routing policies Data from the IRR may be used by anyone worldwide to help debug, configure, and engineer Internet routing and addressing. Data from the IRR may be used by anyone worldwide to help debug, configure, and engineer Internet routing and addressing. Currently, the IRR provides the only mechanism for validating the contents of a BGP session or mapping an AS number to a list of networks. Currently, the IRR provides the only mechanism for validating the contents of a BGP session or mapping an AS number to a list of networks.

16. Internet Routing Registry Policy and contact information Policy and contact information APNIC, ALTDB, BELLCA, TELSTRA etc. APNIC, ALTDB, BELLCA, TELSTRA etc.

17. Internet Routing Registry Route: 128.9.0.0/ 16 descr: ISI-NET origin: AS226 notify: Prue@isi.edu mnt-by: LN-MAINT-MCI changed: Prue@isi.edu 990420 source: CW

18. Internet Routing Registry person: Walt Prue address: USC/ Information Sciences Institute 4676 Admiralty Way Suite 1000 Marina del Rey, California USA phone: +1 310 822 1511 x89191 fax-no: +1 310 823 6714 e-mail: Prue@isi.edu nic-hdl: WP8 notify: Prue@isi.edu mnt-by: LN-MAINT-MCI changed: Prue@isi.edu 20000222 source: CW Internet Routing Registry

19. BGP Configuration from IRR  RPSL: Abstract, high level, per-as policies  IRR: Benefit from others’ data & delegation  RtConfig: Details/ tedious aspects automated RPSL IRR RtConfig

20. Agenda What is Routing Policy ? What is Routing Policy ? Why define Routing Policy ? Why define Routing Policy ? BGP Configuration BGP Configuration IRR Configuration IRR Configuration RPSL – Introduction RPSL – Introduction RPSL – Objects RPSL – Objects What’s next What’s next Agenda

21. Meet Mr. RPSL – An Introduction RPSL allows a network operator to be able to specify routing policies at various levels in the Internet hierarchy; for example at the Autonomous System (AS) level RPSL allows a network operator to be able to specify routing policies at various levels in the Internet hierarchy; for example at the Autonomous System (AS) level At the same time, policies can be specified with sufficient detail in RPSL so that low level router configurations can be generated from them. At the same time, policies can be specified with sufficient detail in RPSL so that low level router configurations can be generated from them. RPSL is extensible; new routing protocols and new protocol features can be introduced at any time RPSL is extensible; new routing protocols and new protocol features can be introduced at any time

22. Meet Mr. RPSL – An Introduction Object oriented language Object oriented language RPSL is based on RIPE-181, a language used to register routing policies and configurations in the IRR RPSL is based on RIPE-181, a language used to register routing policies and configurations in the IRR Operational use of RIPE-181 has shown that it is sometimes difficult (or impossible) to express a routing policy which is used in practice Operational use of RIPE-181 has shown that it is sometimes difficult (or impossible) to express a routing policy which is used in practice RPSL has been developed to address these shortcomings and to provide a language which can be further extended as the need arises RPSL has been developed to address these shortcomings and to provide a language which can be further extended as the need arises RPSL obsoletes RIPE-181 RPSL obsoletes RIPE-181

23. Meet Mr. RPSL – An Introduction RPSL was designed so that a view of the global routing policy can be contained in a single cooperatively maintained distributed database to improve the integrity of Internet's routing RPSL was designed so that a view of the global routing policy can be contained in a single cooperatively maintained distributed database to improve the integrity of Internet's routing RPSL is not designed to be a router configuration language RPSL is not designed to be a router configuration language RPSL is designed so that router configurations can be generated from the description of the policy for one autonomous system (aut-num class) combined with the description of a router (inet- rtr class), mainly providing router ID, autonomous system number of the router, interfaces and peers of the router, and combined with a global database mappings from AS sets to ASes (as-set class), and from origin ASes and route sets to route prefixes (route and route-set classes) RPSL is designed so that router configurations can be generated from the description of the policy for one autonomous system (aut-num class) combined with the description of a router (inet- rtr class), mainly providing router ID, autonomous system number of the router, interfaces and peers of the router, and combined with a global database mappings from AS sets to ASes (as-set class), and from origin ASes and route sets to route prefixes (route and route-set classes) The accurate population of the RPSL database can help contribute toward such goals as router configurations that protect against accidental (or malicious) distribution of inaccurate routing information, verification of Internet's routing, and aggregation boundaries beyond a single AS The accurate population of the RPSL database can help contribute toward such goals as router configurations that protect against accidental (or malicious) distribution of inaccurate routing information, verification of Internet's routing, and aggregation boundaries beyond a single AS

24. RPSL: Getting to know it RPSL constructs are expressed in one or more database "objects" which are registered in one of the registries RPSL constructs are expressed in one or more database "objects" which are registered in one of the registries Each database object contains some routing policy information and some necessary administrative data Each database object contains some routing policy information and some necessary administrative data When objects are registered in the IRR, they become available for others to query using a whois service When objects are registered in the IRR, they become available for others to query using a whois service Uses RIPE database style ( whois ) objects Uses RIPE database style ( whois ) objects

25. RPSL: Object Representation person: Randy Bush address: RGnet NOC 5147 Crystal Springs Drive NE 5147 Crystal Springs Drive NE 10361 NE Sasquatch 10361 NE Sasquatch Bainbridge Island, WE 98110 Bainbridge Island, WE 98110 USA USA phone: +1 206 780 0431 # day time fax-no: +1 206 780 0653 e-mail: randy@psg.com nic-hdl: RB366 remarks: This object is automatically converted from RIPE181 converted from RIPE181 mnt-by: RGNET-MAINT-MCI changed: randy@psg.com 19970614 source: MCI

26. RPSL: Object Representation person: Randy Bush address: RGnet NOC 5147 Crystal Springs Drive NE 5147 Crystal Springs Drive NE 10361 NE Sasquatch 10361 NE Sasquatch Bainbridge Island, WE 98110 Bainbridge Island, WE 98110 USA USA phone: +1 206 780 0431 # day time fax-no: +1 206 780 0653 e-mail: randy@psg.com nic-hdl: RB366 remarks: This object is automatically converted from RIPE181 converted from RIPE181 mnt-by: RGNET-MAINT-MCI changed: randy@psg.com 19970614 source: MCI Attribute name Attribute value Comment Continuation

27. Common Attributes for all classes descr: Short free text description of the object remarks: Free text comment attribute tech-c: Technical contact nic handles admin-c: Administrative contact nic handles notify: Emails to send notification of changes mnt-by: Maintainer authorized to do changes changed: changed: source: Registry

28. Agenda What is Routing Policy ? What is Routing Policy ? Why define Routing Policy ? Why define Routing Policy ? BGP Configuration BGP Configuration IRR Configuration IRR Configuration RPSL – Introduction RPSL – Introduction RPSL – Objects RPSL – Objects What’s next What’s next Agenda

29. RPSL Classes Person, Role, Maintainer Person, Role, Maintainer Route Route Set classes: as-set, route-set Set classes: as-set, route-set Autonomous System Autonomous System

30. RPSL Classes Person, Role, Maintainer Person, Role, Maintainer Person and Role objects are for contact information Person and Role objects are for contact information Maintainer objects are for authentication Maintainer objects are for authentication Route Route Set classes: as-set, route-set Set classes: as-set, route-set Autonomous System Autonomous System

31. Person Class person: Randy Bush address: RGnet NOC 5147 Crystal Springs Drive NE 5147 Crystal Springs Drive NE 10361 NE Sasquatch 10361 NE Sasquatch Bainbridge Island, WE 98110 Bainbridge Island, WE 98110 USA USA phone: +1 206 780 0431 # day time fax-no: +1 206 780 0653 e-mail: randy@psg.com nic-hdl: RB366 remarks: This object is automatically converted from RIPE181 converted from RIPE181 mnt-by: RGNET-MAINT-MCI changed: randy@psg.com 19970614 source: MCI Person class attributes Common attributes Maintenance

32. Role Class role: RIPE NCC Operations address: Singel 258 1016 AB Amsterdam 1016 AB Amsterdam The Netherlands The Netherlands phone: +31 20 535 4444 fax-no: +31 20 545 4445 e-mail: ops@ripe.net admin-c: CO19-RIPE tech-c: RW488-RIPE tech-c: JLSD1-RIPE nic-hdl: OPS4-RIPE notify: ops@ripe.net changed: roderik@ripe.net 19970926 source: RIPE The nic-hdl attributes of the person and role classes share the same name space.

33. Maintainer Class mntner: MAINT-RGNET descr: RGnet RADB maintainer admin-c: RB366 tech-c: RB366 upd-to: rw@rg.net mnt-nfy: randy@psg.com auth: PGPKEY-23F5CE3 mnt-by: MAINT-RGNET changed: randy@psg.com 19970804 source: RADB

34. Maintainer Class mntner: MAINT-RGNET descr: RGnet RADB maintainer admin-c: RB366 tech-c: RB366 upd-to: rw@rg.net mnt-nfy: randy@psg.com auth: PGPKEY-23F5CE3 mnt-by: MAINT-RGNET changed: randy@psg.com 19970804 source: RADB

35. Maintainer Class mntner: MAINT-RGNET descr: RGnet RADB maintainer admin-c: RB366 tech-c: RB366 upd-to: rw@rg.net mnt-nfy: randy@psg.com auth: PGPKEY-23F5CE3 mnt-by: MAINT-RGNET changed: randy@psg.com 19970804 source: RADB

36. Maintainer Class mntner: MAINT-RGNET descr: RGnet RADB maintainer admin-c: RB366 tech-c: RB366 upd-to: rw@rg.net mnt-nfy: randy@psg.com auth: PGPKEY-23F5CE3 mnt-by: MAINT-RGNET changed: randy@psg.com 19970804 source: RADB

37. Maintainer Class mntner: MAINT-RGNET descr: RGnet RADB maintainer admin-c: RB366 tech-c: RB366 upd-to: rw@rg.net mnt-nfy: randy@psg.com auth: PGPKEY-23F5CE3 mnt-by: MAINT-RGNET changed: randy@psg.com 19970804 source: RADB It defines access control for other objects in the database

38. Auth Attribute auth: PGPKEY-23F5CE3 auth: CRYPT-PW lz1A7/JnfkTI auth: MAIL-FROM cengiz@isi.edu auth: MAIL-FROM.*@canet.ca auth: NONE

39. RPSL Classes Person, Role, Maintainer Person, Role, Maintainer Route Route Specifies origin AS for a route Specifies origin AS for a route Can indicate membership of a route set Can indicate membership of a route set Set classes: as-set, route-set Set classes: as-set, route-set Autonomous System Autonomous System

40. Route Class route: 156.36.0.0/16 origin: AS2914 descr: my routes mnt-by: MAINT-RGNET tech-c: RB366 changed: randy@psg.com 19960829 source: RADB Policy Information Route 156.36.0.0/16 is originated by AS2914

41. Inter-AS Routing AS1 originates route “d” AS1 originates route “d” AS1 exports “d” to AS2, AS2 imports AS1 exports “d” to AS2, AS2 imports AS2 exports “d” to AS3, AS3 imports AS2 exports “d” to AS3, AS3 imports AS3 exports “d” to AS5, AS5 imports AS3 exports “d” to AS5, AS5 imports Hmm… looks familiar, doesn’t it ?

42. Route Class route: 156.36.0.0/16 origin: AS2914 descr: my routes mnt-by: MAINT-RGNET tech-c: RB366 changed: randy@psg.com 19960829 source: RADB Policy Information Route 156.36.0.0/16 is originated by AS2914

43. Some Notations AS Numbers AS2914 Address Prefixes 156.36.0.0/16 Route-set Names RS-VERIO AS-set Names AS-VERIO

44. Rules for Words Words can have - or _ in the middle Words can have - or _ in the middle RGNET-MAINT-MCI RGNET-MAINT-MCI Can have digits Can have digits RGNET-MAINT-MCI_ 1 RGNET-MAINT-MCI_ 1 Case insensitive Case insensitive rgnet-MaInT-MCI rgnet-MaInT-MCI

45. RPSL Classes Person, Role, Maintainer Person, Role, Maintainer Route Route Set classes: route-set, as-set Set classes: route-set, as-set Autonomous System Autonomous System

46. RPSL Classes Person, Role, Maintainer Person, Role, Maintainer Route Route Set classes: Route-set Set classes: Route-set Collects routes together with similar properties Collects routes together with similar properties Autonomous System Autonomous System

47. Route-Set route-set: rs-foo members: 128.9.0.0/16, 128.9.0.0/24, 128.8.0.0/16 128.8.0.0/16 descr: some address prefixes mnt-by: MAINT-RGNET tech-c: RB366 changed: randy@psg.com 19960829 source: RADB route-set: rs-bar members: 128.7.0.0/16, rs-foo

48. Route Set route-set: RS-BCMI2 descr: routes via BCM to be announced to I2 to I2 members: 128.249.0.0/16, 192.31.88.0/24,192.147.26.0/24 192.31.88.0/24,192.147.26.0/24 admin-c: JCY tech-c: SM346 mnt-by: MAINT-AS302 changed: smace@intt.org 20000213 source: demo

49. Indirect Members route-set: RS-ANS-IGP_ ONLY descr: ANS IGP aggregates mbrs-by-ref: ANY route: 207.25.17.0/24 origin: AS1675 member-of: RS-ANS-IGP_ ONLY mnt-by: MNT-ANS route: 192.157.69.0/24 origin: AS1675 member-of: RS-ANS-IGP_ ONLY mnt-by: MNT-ANS

50. Restricted Indirect Members route-set: RS-ANS-IGP_ ONLY descr: ANS IGP aggregates mbrs-by-ref: MNT-ANS, MNT-CENGIZ route: 207.25.17.0/24 origin: AS1675 member-of: RS-ANS-IGP_ ONLY mnt-by: MNT-ANS route: 192.157.69.0/24 origin: AS1675 member-of: RS-ANS-IGP_ ONLY mnt-by: MNT-ANS

51. Direct and Indirect Members route-set: RS-ANS-IGP_ ONLY descr: ANS IGP aggregates members: 207.25.17.0/24, 207.25.16.0/24, 207.25.20.0/24 207.25.20.0/24 mbrs-by-ref: MNT-ANS route: 207.25.17.0/24 origin: AS1675 member-of: RS-ANS-IGP_ ONLY mnt-by: MNT-ANS route: 192.157.69.0/24 origin: AS1675 member-of: RS-ANS-IGP_ ONLY mnt-by: MNT-ANS

52. More Specific Operators route-set: rs-martians descr: most ASes do not import these routes members: 0.0.0.0/0^32, 127.0.0.0/8^+, 10.0.0.0/8^+, 172.16.0.0/20^+, 10.0.0.0/8^+, 172.16.0.0/20^+, 192.168.0.0/16^+, 192.0.2.0/24^+, 192.168.0.0/16^+, 192.0.2.0/24^+, 128.0.0.0/16^+, 191.255.0.0/16^+, 128.0.0.0/16^+, 191.255.0.0/16^+, 192.0.0.0/24^+, 223.255.255.0/24^+, 192.0.0.0/24^+, 223.255.255.0/24^+, 224.0.0.0/3^+, 0.0.0.0/0^26-32 224.0.0.0/3^+, 0.0.0.0/0^26-32 Inclusive more specifics: ^+ Inclusive more specifics: ^+ Exclusive more specifics: ^- Exclusive more specifics: ^- Length n more specifics: ^n Length n more specifics: ^n Length n-m more specifics: ^n-m Length n-m more specifics: ^n-m Confusing isn’t it ?

53. Route-Set Name Spaces route-set: AS4763:RS-ROUTES:AS681 descr: prefix filter for AS681 members: 130.216.0.0/16,130.217.0.0/16, 132.181.0.0/16,138.75.0.0/16, 132.181.0.0/16,138.75.0.0/16, 139.80.0.0/16,140.200.0.0/16, 139.80.0.0/16,140.200.0.0/16, 156.62.0.0/16,192.73.21.0/24 156.62.0.0/16,192.73.21.0/24 tech-c: JA39 mnt-by: MAINT-TELSTRA-NZ changed: jabley@patho.gen.nz 19991118 source: RADB Sorry about that !!

54. RPSL Classes Person, Role, Maintainer Person, Role, Maintainer Route Route Set classes: As-set Set classes: As-set  Collect together Autonomous Systems with shared properties  Can be used in policy in place of AS  RPSL has hierarchical names Autonomous System Autonomous System

55. AS-Set Class as-set: AS-SESQUI-STUB descr: Single Homed Sesquinet Customer ASs Customer ASs members: AS1832, AS2712, AS302, AS3526, AS8 AS3526, AS8 tech-c: SB98 mnt-by: MAINT-AS114 source: RADB Same flexibility as route-set class

56. AS Set as-set: AS2764:AS_DOMESTIC descr: connect.com.au AS set members: AS4860, AS7469, AS7489, AS7543, AS7569, AS7592, AS7611, AS7701, AS9262, AS9298 AS7592, AS7611, AS7701, AS9262, AS9298 tech-c: MP151 admin-c: CC89 remarks: Customers with domestic connectivity only only mnt-by: MAINT-AS2764 changed: mrp@connect.com.au 19980607 Source: RADB

57. Indirect AS-Sets as-set: as-aads-mlpa descr: MLPA participants at the AADS NAP mbrs-by-ref: ANY admin-c: Andrew Schmidt tech-c: Mark Cnota notify: mlpa-participants@ aads. net mnt-by: MAINT-RSPEER changed: auto-mlpa@ aads. net 19971123 source: RADB aut-num: AS4550 member-of: as-aads-mlpa aut-num: AS683 member-of: as-aads-mlpa

58. Even more AS-Sets as-set: AS-YETANOTHERNET descr: ASs routed through YetAnotherNet members: AS5696, AS1808, AS1932, AS2900, AS3111, AS3365, AS3393, AS3844, AS3901, AS4314, AS3365, AS3393, AS3844, AS3901, AS4314,... AS-ACESRESEARCH, AS-ALPHA, AS-GST,... AS-ACESRESEARCH, AS-ALPHA, AS-GST, AS-DERU, AS-INQUO AS-DERU, AS-INQUO admin-c: IP Admin DW970 tech-c: IP Admin DW970 notify: ipadmin@winstar.net mnt-by: MAINT-AS5696 changed: hacker@yetanother.net 20000731 source: demo

59. To be Continued……. As per the SLA (Seminar Level Agreement) between myself and Chun, I HAVE to stop here As per the SLA (Seminar Level Agreement) between myself and Chun, I HAVE to stop here Hey, wanna sneak peak into the next lecture ?

60. A Sneak Peek How import/export policies are defined How import/export policies are defined Autonomous System Objects Autonomous System Objects How to announce your customers How to announce your customers Major Backbone Provider Regional Customers

61. More slimy gossip…… Setting preferences based on cost and other factors Setting preferences based on cost and other factors Peering Peering Registering Policies and more Registering Policies and more A B Slow link

62. So tune in, boys and girls, next class, same room, same time, for more exciting things to do with RPSL !

63. person: Anwar M. Haneef address: Multimedia Networks Laboratory address: 312 Knowles Engineering address: Dept. of Electrical and Computer Engg. address: University of Massachusetts, Amherst phone: +1 413 545 4847 fax-no: +1 413 545 1993 e-mail: a.m.haneef@ieee.org nic-hdl: AMH1 changed: ahaneef@ecs.umass.edu 20001030 source: UMASS Thank You !!!!