Internet2 Network Security SIG

[David Farmer <>]

Based on my local evaluation of DNS root server routes available to me, I have dropped several such routes learned via our Internet2 R&E peering, but not all of them. In several cases I am utilizing alternate routes learned via Internet2 TR-CPS, that were significantly better than the route available from Internet2 R&E, but that were not preferred because of the higher local preference we give to R&E routes. Other cases I'm utilizing routes learned via direct local peering or Internet transit.

For the record, I'm only accepting B, H, and L roots via Internet2 R&E, I'm dropping (by origin ASN) all other DNS root servers learned via our Internet2 R&E peering. Note the B and H roots currently only have two severs each, therefore the Internet2 R&E peering provides as good or better connectivity to those roots as any other path available to me. 

Further, we have a separate direct peering with GPN and learn and prefer the KanREN L-root via that path. However in addition, I'm keeping the path learned via Internet2 R&E as a back up path to that node for robustness.

Based on my local evaluation, I have two recommendations;

1. Each regional network and/or campus should evaluate whether or not root sever routes learned via their R&E peering should be preferred over other options they likely have.

2. The NTAC should consider a policy for what root server routes to accept into the Internet2 R&E route table.  My recommendation is to not accept DNS root server anycast routes for nodes that are not hosted on the north american continent, particularly from International Partner R&E networks.

I believe all root severs operators have at least one node hosted somewhere on the north american continent.  Therefore, there is no advantage provided by accepting off-continent DNS root server routes into the Internet2 R&E route table, because there will always be a better alternate routes available.

See http://root-servers.org/   

Thanks

On Fri, Nov 3, 2017 at 10:42 AM, Steven Wallace <> wrote:

Brad,

I’m thinking out loud, so I wouldn't change anything without better advice :-)

steve

On Nov 3, 2017, at 11:35 AM, Brad Fleming <> wrote:

On Nov 3, 2017, at 10:03 AM, Dave Diller <> wrote:

I think we need to be careful WRT to routes to roots. Roots are anycast, and since most of us local-pref TR-CPS/I2, this could lead to suboptimal DNS requests, both in terms of path used, and concentrating queries to fewer serves. This may already be happening. It would be good for someone to check the I2/CPS routing tables for the root anycast prefixes.

MAX had an I2-facing instantiation of D-root for a while last year.  From what I remember, there really was not a lot of traffic to it, as compared to the commodity-facing ones, and they redeployed.

Kinda makes sense, due to lower visibility in an isolated network, versus worldwide.

But it did not seem to suck in a lot of traffic simply due to query concentration / localpref.

-dd

KanREN hosts and announces availability to an L-Root instance running on dedicated hardware in the Kansas City area. We announce:

199.7.82.0/23

199.7.83.0/24

2001:500:3::/48

2001:500:9e::/47 

2001:500:9f::/48

to TR-CPS as well as R&E. They requested we announce the prefixes at all peering points; however, it might make sense for us to withdraw the paths from I2 routing tables simply to avoid the situation Steve points out.

I don’t wanna drag the thread too far off it’s original purpose so feel free to hit me up unicast with any profanity-laden emails about our backwater, hair-brained schemes. :D

--
Brad Fleming
Assistant Director for Technology
Kansas Research and Education Network

--

===============================================
David Farmer              
Networking & Telecommunication Services
Office of Information Technology
University of Minnesota  
2218 University Ave SE        Phone: 612-626-0815
Minneapolis, MN 55414-3029   Cell: 612-812-9952
===============================================