- NANOG - lists.nanog.org

Cisco IOS BGP Graceful-Restart Implementation query
by Florin Vlad Olariu 15 Nov '18

15 Nov '18

Hey there! In our environment we generally have ASR-1000X-2s everywhere peering via iBGP/eBGP. These routers have no redundant RPs, hence cannot keep forwarding traffic while the router reboots or crashes. As such, this is a clear example of a router that's only NSF-aware (or graceful-restart-aware) but not capable. The reason I enabled this is because, from RFC 4724: In addition, even if the speaker does not have the ability to preserve its forwarding state for any address family during BGP restart, it is still recommended that the speaker advertise the Graceful Restart Capability to its peer (as mentioned before *this is done by not including any <AFI, SAFI> in the advertised capability*). There are two reasons for doing this. The first is to indicate its intention of generating the End-of-RIB marker upon the completion of its initial routing updates, as doing this would be useful for routing convergence in general. The second is to indicate its support for a peer which wishes to perform a graceful restart. So what I would expect to see in the "show ip bgp neighbor <ip>" command, regarding Graceful Restart, would be something like the following: BGP neighbor is <IP>, remote AS <AS>, internal link [...] Neighbor capabilities: [...] Graceful Restart Capability: advertised and received Remote Restart timer is 120 seconds Address families advertised by peer: *none* Basically, GR is negotiated, but no address family is specified, effectively only using the EOR marker for routing convergence improvements. Instead, here's what the router specifies: BGP neighbor is <IP>, remote AS <AS>, internal link [...] Neighbor capabilities: [...] Graceful Restart Capability: advertised and received Remote Restart timer is 120 seconds Address families advertised by peer: *IPv4 Unicast (was not preserved, VPNv4 Unicast (was not preserved* My assumption is that the 'was not preserved' in the parentesis refers to the most recent restart of the neighbor, and it means that when the neighbor re-established the BGP connection, the GR Capability for IPv4 and VPNv4 AFIs did not set the "Forwarding bit" as specified by the GR-RFC: Once the session is re-established, if the "Forwarding State" bit for a specific address family is not set in the newly received Graceful Restart Capability, or if a specific address family is not included in the newly received Graceful Restart Capability, or if the Graceful Restart Capability is not received in the re-established session at all, then the Receiving Speaker MUST immediately remove all the stale routes from the peer that it is retaining for that address family. Clearly the Forwarding State bit is never going to be set by this type of router, due to hardware limitations. Here's my concern though: What happens when the router reboots, and the neighboring routers keep forwarding packets to this router because the GR-capabily did specify IPv4 and VPNv4 AFI/SAFI? This would clearly cause impact as traffic would be blackholed. I will try to simulate this and see how it behaves, I'll report back, but any info you have it would be greatly appreciated. -- Florin Vlad Olariu

1 0

Re: China ’s Maxim – Leave No Access Point Unexploited: The Hidden Story of China Telecom’ s BGP Hijacking
by Scott Weeks 14 Nov '18

14 Nov '18

--- alfie(a)fdx.services wrote: From: Alfie Pates <alfie(a)fdx.services> Never attribute to malice that which can be adequately explained by apathy. ------------------------------------------- Especially when they can do it without being seen as was discussed here years ago. I believe this was one of the discussions? https://www.nanog.org/meetings/nanog44/presentations/Tuesday/Kapela_steal_i… scott

1 0

Re: China ’s Maxim – Leave No Access Point Unexploited: The Hidden Story of China Telecom’ s BGP Hijacking
by Alfie Pates 14 Nov '18

14 Nov '18

Never attribute to malice that which can be adequately explained by apathy. ~A

1 0

verizon AS701 looking glass sever
by Roy Hockett 14 Nov '18

14 Nov '18

Does anyone have a bookmark for a looking glass server for Verizon/UUnet (AS701)? If someone from Verizon/UUnet noc can contact me offline, that would also be helpful.

2 1

Fitbit network contact
by Michael Crapse 13 Nov '18

13 Nov '18

Hoping to see if an network engineer from fitbit is on list. Our customers are having trouble logging into your app on our network. Perhaps an IP filtering/routing issue. Thanks

1 0

China ’s Maxim – Leave No Access Point Unexploited: The Hidden Story of China Telecom’ s BGP Hijacking
by Harley H 13 Nov '18

13 Nov '18

Curious to hear others' thoughts on this. https://scholarcommons.usf.edu/cgi/viewcontent.cgi?article=1050&context=mca This paper presents the view that several BGP hijacks performed by China Telecom had malicious intent. The incidents are: * Canada to Korea - 2016 * US to Italy - Oct 2016 * Scandinavia to Japan - April-May 2017 * Italy to Thailand - April-July 2017 The authors claim this is enabled by China Telecom's presence in North America.

6 6

Oracle abuse contact
by David Shaw 13 Nov '18

13 Nov '18

Hi, I could really use some help reaching someone at Oracle for a spam problem coming from 129.145.16.122. I've sent countless emails to their abuse contact with no response, tried their tech support chat system and even calling several times without any reaction beyond confusion. It's been almost two weeks now, and while I don't like asking on NANOG, I'm out of options. Any pointers would be very welcomed. David

3 2

Re: IGP protocol
by Scott Weeks 13 Nov '18

13 Nov '18

--- valdis.kletnieks(a)vt.edu wrote: On Mon, 12 Nov 2018 20:21:26 +0000, "Naslund, Steve" said: > 2. Most corporate networks will be running OSPF and/or EIGRP as an IGP. And I'm sure there's still some crazies out there using RIPv2. :) ---------------------------------------------- Yes, there are networks out there on the ragged edges doing that. They've been around since forever. I've worked for them. Show up on day 1: WTF??? Oh crap, what'd I get myself into *this* time?! scott

2 1

Zayo vs Coent
by Dovid Bender 12 Nov '18

12 Nov '18

Hi, We are in a facility where my only options are Cogent or Zayo. We plan on getting a 10G connection for a web crawler using v4 only. Looking for feedback on either or (keeping the politics out of it). TIA. Dovid

13 12

Escalation point at Google
by Alex Osipov 12 Nov '18

12 Nov '18

Hello – Does anyone have an escalation point or a human to speak to on the Google escalations or Google Safe Browsing team? Our entire SaaS business, 15 years in business, in a niche software industry with a good reputation has become blocked in ALL browsers. We are impacting 30k+ enterprise users in the financial space and have tried everything but all roads lead to automated systems. Can anyone please reach out with a contact if you have one? Sorry to spam this list if this is inappropriate content. Very desperate here. Thank you, Alex Osipov / CTO

4 3