Routing Basics

ISP Training Workshops

1
Routing Concepts
p IPv4
p Routing
p Forwarding
p Some definitions
p Policy options
p Routing Protocols

2
IPv4
p Internet uses IPv4
■ Addresses are 32 bits long
■ Range from 1.0.0.0 to 223.255.255.255
■ 0.0.0.0 to 0.255.255.255 and 224.0.0.0 to
255.255.255.255 have “special” uses
p IPv4 address has a network portion and a
host portion

3
IPv4 address format
p Address and subnet mask
■ written as
■ 12.34.56.78 255.255.255.0 or
■ 12.34.56.78/24
■ mask represents the number of network bits in
the 32 bit address
■ the remaining bits are the host bits

4
What does a router do?

5
A day in a life of a router

find path
forward packet, forward packet, forward
packet, forward packet...
find alternate path
forward packet, forward packet, forward
packet, forward packet…
repeat until powered off

6
Routing versus Forwarding
p Routing = building
maps and giving
directions
p Forwarding =
moving packets
between interfaces
according to the
“directions”

7
IP Routing – finding the path
p Path derived from information received
from a routing protocol
p Several alternative paths may exist
■ best path stored in forwarding table
p Decisions are updated periodically or as
topology changes (event driven)
p Decisions are based on:
■ topology, policies and metrics (hop count,
filtering, delay, bandwidth, etc.)

8
IP route lookup
p Based on destination IP address
p “longest match” routing
■ More specific prefix preferred over less specific
prefix
■ Example: packet with destination of
10.1.1.1/32 is sent to the router announcing
10.1/16 rather than the router announcing
10/8.

9
IP route lookup
p Based on destination IP address
10/8
Packet: Destination R3 announced
IP address: 10.1.1.1 from here

R1 R2

R4
10/8 → R3
10.1/16
10.1/16 → R4 announced from
20/8 → R5 here
30/8 → R6
…..
R2’s IP routing table 10
IP route lookup:
Longest match routing
p Based on destination IP address
10/8
Packet: Destination R3 announced
IP address: 10.1.1.1 from here

R1 R2

R4
10/8 → R3 10.1.1.1 && FF.0.0.0 10.1/16
10.1/16 → vs. Match! announced from
R4 10.0.0.0 && FF.0.0.0 here
20/8 → R5
30/8 → R6
R2…’s..IP routing table 11
IP route lookup:
Longest match routing
p Based on destination IP address
10/8
Packet: Destination R3 announced
IP address: 10.1.1.1 from here

R1 R2

10/8 → R3 R4
10.1/16
10.1/16 → R4 10.1.1.1 && FF.FF.0.0
vs. Match as wea
lln
! nounced from
20/8 → R5 here
10.1.0.0 && FF.FF.0.0
30/8 → R6
…..
R2’s IP routing table 12
IP route lookup:
Longest match routing
p Based on destination IP address
10/8
Packet: Destination R3 announced
IP address: 10.1.1.1 from here

R1 R2

R4
10/8 → R3 R 4
10.1/16 → 10.1/16
20/8 → R5 announced from
10.1.1.1 && FF.0.0.0
30/8 → R6 vs. Does not match! here
….. 20.0.0.0 && FF.0.0.0
R2’s IP routing table 13
IP route lookup:
Longest match routing
p Based on destination IP address
10/8
Packet: Destination R3 announced
IP address: 10.1.1.1 from here

R1 R2

R4
10/8 → R3 10.1/16
10.1/16 → R4 announced from
20/8 → R5 10.1.1.1 && FF.0.0.0 here
30/8 → R6 vs. Does not match!
30.0.0.0 && FF.0.0.0
…..
R2’s IP routing table 14
IP route lookup:
Longest match routing
p Based on destination IP address
10/8
Packet: Destination R3 announced
IP address: 10.1.1.1 from here

R1 R2

R4
10/8 → R3 10.1/16
10.1/16 → R4 Longest match, 16 bit netmaskannounced from
20/8 → R5 here
30/8 → R6
…..
R2’s IP routing table 15
IP Forwarding
p Router decides which interface a packet is
sent to
p Forwarding table populated by routing
process
p Forwarding decisions:
■ destination address
■ class of service (fair queuing, precedence, others)
■ local requirements (packet filtering)
p Forwarding is usually aided by special
hardware

16
 Routing Tables Feed the Forwarding Table

Routing Information Base (RIB)

Forwarding Information Base (FIB)

BGP 4 Routing Table

OSPF – Link State Database

Connected Routes

Static Routes

17
RIBs and FIBs
p FIB is the Forwarding Table
■ It contains destinations and the interfaces to get to those
destinations
■ Used by the router to figure out where to send the
packet
■ Careful! Some people still call this a route!
p RIB is the Routing Table
■ It contains a list of all the destinations and the various
next hops used to get to those destinations – and lots of
other information too!
■ One destination can have lots of possible next-hops –
only the best next-hop goes into the FIB

18
Explicit versus Default Routing
p Default:
■ simple, cheap (cycles, memory, bandwidth)
■ low granularity (metric games)
p Explicit (default free zone)
■ high overhead, complex, high cost, high
granularity
p Hybrid
■ minimise overhead
■ provide useful granularity
■
requires some filtering knowledge
19
Egress Traffic
p How packets leave your network
p Egress traffic depends on:
■ route availability (what others send you)
■ route acceptance (what you accept from
others)
■ policy and tuning (what you do with routes
from others)
■ Peering and transit agreements

20
Ingress Traffic
p How packets get to your network and your
customers’ networks
p Ingress traffic depends on:
■ what information you send and to whom
■ based on your addressing and AS’s
■ based on others’ policy (what they accept from
you and what they do with it)

21
Autonomous System (AS)
AS 100

p Collection of networks with same routing policy

p Single routing protocol
p Usually under single ownership, trust and
administrative control
22
Definition of terms
p Neighbours
■ AS’s which directly exchange routing information
■ Routers which exchange routing information
p Announce
■ send routing information to a neighbour
p Accept
■ receive and use routing information sent by a neighbour
p Originate
■ insert routing information into external announcements
(usually as a result of the IGP)
p Peers
■ routers in neighbouring AS’s or within one AS which
exchange routing and policy information
23
Routing flow and packet flow
packet flow
accept announce
AS 1 announce
routing flow
accept AS 2
packet flow

For networks in AS1 and AS2 to communicate:

AS1 must announce to AS2
AS2 must accept from AS1
AS2 must announce to AS1
AS1 must accept from AS2
24
Routing flow and Traffic flow
p Traffic flow is always in the opposite
direction of the flow of Routing information
■ Filtering outgoing routing information inhibits
traffic flow inbound
■ Filtering inbound routing information inhibits
traffic flow outbound

25
Routing Flow/Packet Flow:
With multiple ASes

AS 1
AS 34
N1
AS16
AS 8
N16

p For net N1 in AS1 to send traffic to net N16 in AS16:

■ AS16 must originate and announce N16 to AS8.
■ AS8 must accept N16 from AS16.
■ AS8 must announce N16 to AS1 or AS34.
■ AS1 must accept N16 from AS8 or AS34.
p For two-way packet flow, similar policies must exist for N1
26
Routing Flow/Packet Flow:
With multiple ASes

AS 1
AS 34
N1
AS16
AS 8
N16

p As multiple paths between sites are

implemented it is easy to see how
policies can become quite complex.
27
Routing Policy
p Used to control traffic flow in and out of an
ISP network
p ISP makes decisions on what routing
information to accept and discard from its
neighbours
■ Individual routes
■ Routes originated by specific ASes
■ Routes traversing specific ASes
■ Routes belonging to other groupings
p Groupings which you define as you see fit
28
Routing Policy Limitations
red
red
Internet AS99

green green

packet flow
p AS99 uses red link for traffic to the red AS and
the green link for remaining traffic
p To implement this policy, AS99 has to:
■ Accept routes originating from the red AS on the red link
■ Accept all other routes on the green link
29
Routing Policy Limitations
red
red Internet
AS22 AS99

green green

packet flow
p AS99 would like packets coming from the green AS to use the
green link.
p But unless AS22 cooperates in pushing traffic from the green
AS down the green link, there is very little that AS99 can do to
achieve this aim
30
Routing Policy Issues
p Mid-August 2012:
■ 422000 prefixes
p Not realistic to set policy on all of them individually
■ 42000 origin AS’s
p Too many to try and create individual policies for
p Routes tied to a specific AS or path may
be unstable regardless of connectivity
p Solution: Groups of AS’s are a natural
abstraction for filtering purposes

31
 Routing Protocols
We now know what routing means…
…but what do the routers get up
to?
And why are we doing this anyway?

32
1: How Does Routing Work?
p Internet is made up of the ISPs who
connect to each other’s networks
p How does an ISP in Kenya tell an ISP in
Japan what customers they have?
p And how does that ISP send data packets
to the customers of the ISP in Japan, and
get responses back
■ After all, as on a local ethernet, two way packet
flow is needed for communication between two
devices
33
2: How Does Routing Work?
p ISP in Kenya could buy a direct connection
to the ISP in Japan
■ But this doesn’t scale – thousands of ISPs,
would need thousands of connections, and cost
would be astronomical
p Instead, ISP in Kenya tells his
neighbouring ISPs what customers he has
■ And the neighbouring ISPs pass this
information on to their neighbours, and so on
■ This process repeats until the information
reaches the ISP in Japan
34
3: How Does Routing Work?
pThis process is called “Routing”
pThe mechanisms used are called “Routing
Protocols”
pRouting and Routing Protocols ensures that
the Internet can scale, that thousands of
ISPs can provide connectivity to each other,
giving us the Internet we see today

35
4: How Does Routing Work?
p ISP in Kenya doesn’t actually tell his neighbouring
ISPs the names of the customers
■ (network equipment does not understand names)
p Instead, he has received an IP address block as a
member of the Regional Internet Registry serving
Kenya
■ His customers have received address space from this
address block as part of their “Internet service”
■ And he announces this address block to his neighbouring
ISPs – this is called announcing a “route”

36
Routing Protocols
p Routers use “routing protocols” to
exchange routing information with each
other
■ IGP is used to refer to the process running on
routers inside an ISP’s network
■ EGP is used to refer to the process running
between routers bordering directly connected
ISP networks

37
What Is an IGP?
p Interior Gateway Protocol
p Within an Autonomous System
p Carries information about internal
infrastructure prefixes
p
Two widely used IGPs:
■ OSPF
■ ISIS

38
Why Do We Need an IGP?
p ISP backbone scaling
■ Hierarchy
■ Limiting scope of failure
■ Only used for ISP’s infrastructure addresses,
not customers or anything else
■ Design goal is to minimise number of prefixes
in IGP to aid scalability and rapid convergence

39
What Is an EGP?
p Exterior Gateway Protocol
p Used to convey routing information
between Autonomous Systems
p De-coupled from the IGP
p Current EGP is BGP

40
Why Do We Need an EGP?
p Scaling to large network
■ Hierarchy
■ Limit scope of failure
p Define Administrative Boundary
p Policy
■ Control reachability of prefixes
■ Merge separate organisations
■ Connect multiple IGPs

41
Interior versus Exterior
Routing Protocols
p Interior p Exterior
■ automatic neighbour ■ specifically
discovery configured peers
■ generally trust your ■ connecting with
IGP routers outside networks
■ prefixes go to all ■ set administrative
IGP routers boundaries
■ binds routers in one ■ binds AS’s together
AS together

42
Interior versus Exterior
Routing Protocols
p Interior p Exterior
■ Carries ISP ■ Carries customer
infrastructure prefixes
addresses only ■ Carries Internet
■ ISPs aim to keep prefixes
the IGP small for ■ EGPs are
efficiency and independent of ISP
scalability network topology

43
Hierarchy of Routing Protocols
Other ISPs
BGP4

BGP4
and OSPF/ISIS

BGP4 Static/BGP4

IXP Customers

44
FYI: Cisco IOS Default Administrative
Distances
Route Source Default Distance

Connected Interface 0
Static Route 1
Enhanced IGRP Summary Route 5
External BGP 20
Internal Enhanced IGRP 90
IGRP 100
OSPF 110
IS-IS 115
RIP 120
EGP 140
External Enhanced IGRP 170
Internal BGP 200
45
Unknown 255
 46

Router Security (IPv4 & IPv6)

 Router Security (IPv4 & IPv6)
• Control Plane
• Management Plane
• Data Plane
 Management Plane Filters
• Authenticate Access
• Define Explicit Access To/From Management
Stations
– SNMP
– Syslog
– TFTP
– NTP
– SSH, Telnet, etc.
 Securing SNMP

access-list 99 permit 192.168.1.250

access-list 99 permit 192.168.1.240

snmp-server community N3T-manag3m3nt ro 99

 Securing SSH
ipv6 access-list AUTHORIZED_IPV6_HOST
permit ipv6 host 2405:7600:0:6::250 any
deny ipv6 any any log
!
ip access-list extended AUTHORIZED_IPV4_HOST
permit tcp host 103.21.75.5 any eq 22
deny tcp any any log
!
line vty 0 4
access-class AUTHORIZED_IPV4_HOST in
ipv6 access-class AUTHORIZED_IPV6_HOST in
Secure Access with Passwords and
Logout Timers
line console 0
login
password console-pw
exec-timeout 1 30
!
line vty 0 4
login
password vty-pw
exec-timeout 5 00
!
enable secret enable-secret
username bob secret bob-secret
 Authenticate Individual Users
username mike secret mike-secret
username john secret john-secret
username chris secret chris-secret
username staff secret group-secret
Restrict Access To Trusted Hosts

• Use filters to specifically permit hosts to access an

infrastructure device
• Example
access-list 103 permit tcp host 192.168.200.7 192.168.1.0
0.0.0.255 eq 22 log-input
access-list 103 permit tcp host 192.168.200.8 192.168.1.0
0.0.0.255 eq 22 log-input
access-list 103 permit tcp host 192.168.100.6 192.168.1.0
0.0.0.255 eq 23 log-input
access-list 103 deny ip any any log-input
!
line vty 0 4
access-class 103 in
transport input ssh
 Telnet using SSH
‘Jumphost’
Peer Customer

Conference
Net
2 NetFlow,
SNMP
1
Syslog, TFTP, NOC
1. SSH to NOC AAA, DNS,
2. Telnet to router SMTP
 Banner – What Is Wrong ?

banner login ^C

You should not be on this device.

Please Get Off My Router!!

^C
 More Appropriate Banner

!!!! WARNING !!!!

You have accessed a restricted device.
All access is being logged and any
unauthorized access will be prosecuted to
the full extent of the law.
 Centralized Log (syslog)
Facility Type Keyword Description
Router(config)# logging 192.168.0.30 auth Authorization system
cron Cron facility
Router(config)# logging trap 3
daemon System daemon
Router(config)# logging facility local3 kern Kernel
local0-7 Locally defined messages
lpr Line printer system
mail Mail system
news USENET news
Trap: sys9 System use
Emergency: 0 sys10 System use
Alert: 1 sys11 System use
Critical: 2 sys12 System use
Error: 3 sys13 System use
Warning: 4 sys14 System use
Notice: 5 syslog System log
Informational: 6 user User process
Debug: 7 uucp UNIX-to-UNIX copy
system
Configuration change logging
Router# configure terminal
Router(config)# archive
Router(config-archive)# log config
Router(config-archive-log-config)# logging enable
Router(config-archive-log-config)# logging size 200
Router(config-archive-log-config)# hidekeys
Router(config-archive-log-config)# notify syslog

768962: Feb 1 20:59:45.081 UTC: %PARSER-5-CFGLOG_LOGGEDCMD: User:fakrul logged

command:!exec: enable
768963: Feb 1 21:03:17.160 UTC: %PARSER-5-CFGLOG_LOGGEDCMD: User:fakrul logged
command:no ipv6 prefix-list dhakacom_AS23956_IN_IPv6 description
768965: Feb 1 21:03:19.182 UTC: %SYS-5-CONFIG_I: Configured from console by fakrul on
vty0 (2405:7600:0:6::250)
 Turn Off Unused Services
Feature Description Default Recommendation Command

CDP Proprietary layer 2 protocol Enabled no cdp run

between Cisco devices

TCP small servers Standard TCP network services: 11.3: disabled 11.2: This is a legacy feature, no service tcp-
echo, chargen, etc enabled disable it explicitly small-servers

UDP small servers Standard UDP network 11.3: disabled 11.2: This is a legacy feature, no service udp-
services: echo, discard, etc enabled disable it explicitly small-servers

Finger Unix user lookup service, allows Enabled Unauthorized persons don’t no service
remote listing of logged in need to know this, disable it. finger
users.

HTTP server Some Cisco IOS devices offer Varies by device If not in use, explicitly no ip http
web-based configuration disable, otherwise restrict server
access
Bootp server Service to allow other routers Enabled This is rarely needed and may no ip bootp
to boot from this one open a security hole, disable server
it
 Turn Off Unused Services
Feature Description Default Recommendation Command

PAD Service Router will support Enabled Disable if not no service

X.25 packet assembler explicitly needed pad
service
IP source Feature that allows a Enabled Can be helpful in no ip
routing packet to specify its attacks, disable it source-route
own route
Proxy ARP Router will act as a Enabled Disable this service no ip proxy-
proxy for layer 2 unless the router is arp
address resolution serving as a LAN
bridge
IP directed Packets can identify a Enabled (11.3 Directed broadcast no ip
broadcast target LAN for & earlier) can be used for directed-
broadcasts attacks, disable it broadcast
Configuration (Templates)
!configure timezone ! turn off unnecessary services (interface)
service timestamps debug uptime Interface GigabitEthernet0/0
service timestamps log datetime localtime no ip redirects
service password-encryption no ip directed-broadcast
clock timezone UTC +6 no ip proxy arp
no cdp enable

! turn off unnecessary services (global)

! turn on logging and snmp
no ip domain-lookup
logging 192.168.253.56
no cdp run snmp-server communityTxo~QbW3XM ro 98
no ip http server !
no ip source-route access-list 99 permit 192.168.253.0 0.0.0.255
no service finger access-list 99 deny any log
no ip bootp server access-list 98 permit host 192.168.253.51
no service udp-small-servers access-list 98 deny any log
!
no service tcp-small-servers
Configuration (Templates)
line vty 0 4 !Turn on NTP
access-class 99 in ntp authenticate
exec-timeout 2 0 ntp authentication-key 1 md5 -UN&/6[oh6
transport input ssh ntp trusted-key 1
! ntp access-group peer 96
line con 0 ntp server 192.168.254.57 key 1
access-class 99 in access-list 96 permit host 192.168.254.57
exec-timeout 2 0 access-list 96 deny any log
!
banner motd #
!!!! WARNING !!!!
You have accessed a restricted device.
All access is being logged and any
unauthorized access will be prosecuted to
the full extent of the law.
#
Securing The Data Path
• Filtering and rate limiting are
primary mitigation
techniques
• Edge filter guidelines for
ingress filtering
(BCP38/BCP84)
• Null-route and black-hole
any detected malicious traffic
• Netflow is primary method
used for tracking traffic flows
• Logging of Exceptions
 Data Plane (Packet) Filters
• Most common problems
– Poorly-constructed filters
– Ordering matters in some devices
• Scaling and maintainability issues with filters are
commonplace
• Make your filters as modular and simple as
possible
• Take into consideration alternate routes
– Backdoor paths due to network failures
 Filtering Deployment Considerations
• How does the filter load into the router?
• Does it interrupt packet flow?
• How many filters can be supported in hardware?
• How many filters can be supported in software?
• How does filter depth impact performance?
• How do multiple concurrent features affect
performance?
• Do I need a standalone firewall?
 General Filtering Best Practices
• Explicitly deny all traffic and only allow what you need
• The default policy should be that if the firewall doesn't
know what to do with the packet, deny/drop it
• Don't rely only on your firewall for all protection of
your network
• Implement multiple layers of network protection
• Make sure all of the network traffic passes through the
firewall
• Log all firewall exceptions (if possible)
 Filtering Recommendations
• Log filter port messages properly
• Allow only internal addresses to enter the
router from the internal interface
• Block packets from outside (untrusted) that
are obviously fake or commonly used for
attacks
• Block packets that claim to have a source
address of any internal (trusted) network.
 Filtering Recommendations
• Block incoming loopback packets and RFC 1918
networks
– 127.0.0.0
– 10.0.0.0 – 10.255.255.255
– 172.16.0.0 – 172.31.0.0
– 192.168.0.0 – 192.168.255.255
• Block multicast packets (if NOT using multicast)
• Block broadcast packets (careful of DHCP &
BOOTP users)
• Block incoming packets that claim to have same
destination and source address
 DoS Filtering
(* these networks were reallocated and are actually used)

Description Network
default 0.0.0.0 /8
loopback 127.0.0.0 /8
RFC 1918 10.0.0.0 /8
RFC 1918 172.16.0.0 /12
RFC 1918 192.168.0.0 /16
Net Test 192.0.2.0 /24
Testing devices * 192.18.0.0 /15
IPv6 to IPv4 relay * 192.88.99.0 /24
RFC 1918 nameservers * 192.175.48.0 /24
End-node auto configuration * 169.254.0.0 /16
Example Incoming IPv4 Bogon Packet
Filter
ip access-list extended DSL-Incoming
deny ip 127.0.0.0 0.255.255.255 any log
deny ip 10.0.0.0 0.255.255.255 any log
deny ip 169.254.0.0 0.0.255.255 any log
deny ip 172.16.0.0 0.15.255.255 any log
deny ip 192.168.0.0 0.0.255.255 any log
deny ip 224.0.0.0 15.255.255.255 any log
permit icmp any any ttl-exceeded
permit icmp any any echo-reply
permit icmp any any echo
permit tcp any any eq 22 log
permit udp host <ip address> eq domain <subnet range>
permit udp host <ip address> eq domain <subnet range>
permit udp host <ip address> <subnet range> eq ntp
permit udp host <ip address> <subnet range> eq ntp
permit tcp any <my sybnet> established
deny ip any any log
 Example Incoming IPv4 Bogon Packet
Filter
• Bogon and fullbogon peering use different
ASNs
• Advertise all fullbogons (IPv4 and IPv6) over a
single BGP peering session
• For details: http://www.team-
cymru.org/Services/Bogons/bgp.html
RFC2827 (BCP38) – Ingress Filtering
• If an ISP is aggregating routing announcements for
multiple downstream networks, strict traffic filtering
should be used to prohibit traffic which claims to have
originated from outside of these aggregated
announcements.
• The ONLY valid source IP address for packets
originating from a customer network is the one
assigned by the ISP (whether statically or dynamically
assigned).
• An edge router could check every packet on ingress to
ensure the user is not spoofing the source address on
the packets which he is originating.
 Guideline for BCP38
• Networks connecting to the Internet
– Must use inbound and outbound packet filters to
protect network
• Configuration example
– Outbound—only allow my network source
addresses out
– Inbound—only allow specific ports to specific
destinations in
 Techniques for BCP 38
• Static ACLs on the edge of the network
• Unicast RPF strict mode
• IP source guard
Example Outgoing Packet Filter

access-list 121 permit ip 192.168.1.250

0.0.0.255 any
access-list 121 deny ip any any log
!
interface serial 1/1/1.3
Description Link to XYZ
ip access-group 121 in
 Infrastructure Filters
• Permit only required protocols and deny ALL others to infrastructure space
- Filters now need to be IPv4 and IPv6!
- Applied inbound on ingress interfaces
• Basic premise: filter traffic destined TO your core routers
• Develop list of required protocols that are sourced from outside your AS
and access core routers
- Example: eBGP peering, GRE, IPSec, etc.
- Use classification filters as required
• Identify core address block(s)
- This is the protected address space
- Summarization is critical for simpler and shorter filters
 References
• Articles, documents and templates from Team
CYMRU http://www.team-
cymru.org/ReadingRoom/
• Google for the information specifics from the
vendors you use: “<vendor> security
template”
 78

Route Optimization
Route Optimization 79

Routes :
 Default Route Only
 Default + Full Routes
 Partial Routes
Route Optimization 80

Default Route Only – Why :

 Routers that are not capable to handle Full Internet Routing Table,
receive default route only.
 For advertisement, always prefer to advertise locally originated
default route in BGP.
Route Optimization 81

Default Route Only – Why :

Route Optimization 82

Default Route Only – Why :

Route Optimization 83

Default + Full Routes – Why :

 Its better to have both Default and Full Routes from Upstream if your
router supports that.
 Full Routes give you the access to all destinations with specific
address.
 If your upstream can’t give you any specific route for any destination,
Default Route might come handy for that destination.
Route Optimization 84

Partial Routes – Why :

 You don’t need to make your routing table heavy by taking
unnecessary Full Routing Table from multiple upstreams.
 If you have multiple upstream from same region, like east or west,
you can take Full Route from one upstream since both of them are
likely to have same kind of reachability. For redundancy purpose, you
can have Default Route from other.
Route Optimization 85

Partial Routes – Why :

 If you have multiple upstreams from different regions, like east and
west, you might want to take partial routing tables from both of them
to make your routing table lite but still efficient.
 You can take 2 or 3 as path distant from both the upstream to have
good reachability along with Default Route.
Route Optimization 86

Partial Routes – Why :

 Default Route is necessary to reach those destinations which are far
away from 2 or 3 as path distant.
 You need to use Regular Expression for AS Paths to receive Partial
Routes from Upstream.
Route Optimization 87

Partial Routes – Why :

 Some Regular Expressions
 ip as-path access-list 65 permit _XXX$
 ip as-path access-list 65 permit ^[0-9]+$
 ip as-path access-list 65 permit ^[0-9]+_[0-9]+$
 ip as-path access-list 65 permit ^[0-9]+_[0-9]+_[0-9]+$
This ACL allows 3 AS Path Distance.
(Regex breakdown: ^ means match, [0-9] indicates any numeral, + means any
number of the previous expression, _ is a space, and $ is end-of-line)
 Regular Expression
• Like Unix regular expressions
– . Match one character
– * Match any number of preceding expression
– + Match at least one of preceding expression
– ^ Beginning of line
– $ End of line
– \ Escape a regular expression character
– _ Beginning, end, white-space, brace
– | Or
– () brackets to contain expression
– [] brackets to contain number ranges
 Regular Expressions

Reg Expression Comments

.* match anything
^$ match routes local to this AS
_1800$ originated by AS1800
^1800_ received from AS1800
_1800_ via AS1800
_790_1800_ via AS1800 and AS790
^1800(_1800)*$ multiple AS1800 in sequence (used to
match AS-PATH prepends)
^23956(_23956)*(_55531|_58581)*$ AS 55531 or 58581 via AS 23956 and can
do AS-PATH prepends
 Regular Expressions

Reg Expression Comments

^[0-9]+$ Match AS_PATH length of one
^[0-9]+_[0-9]+$ Match AS_PATH length of two
^[0-9]+_[0-9]+_[0-9]+$ Match AS_PATH length of three
^[0-9]+_[0-9]+_[0-9]+_[0-9]+$ Match AS_PATH length of four
Routing Basics
ISP Training Workshops