Internet2 Network Security SIG

[Brad Fleming <>]

I believe in some versions of Junos adding the flowspec family causes GRES and nonstop routing to fail for the session. So you take a hard reset on all address families in the event of a RE switchover. That might have been resolved in newer versions of Junos so might be a moot issue in your case.

An approach (not necessarily a good one) is stand up OoB BGP sessions that carry unicast and flowspec routes. it can do triage on received routes and perform validation. Then it can peer with your core but only exchange flowspec details. Again, not the prettiest solution but I think would check all the boxes.

--
Brad Fleming
Assistant Director for Technology
Kansas Research and Education Network
Office: 785-856-9805
Mobile: 785-865-7231
NOC: 785-856-9820

On May 23, 2018, at 11:13 AM, Karl Newell <> wrote:

As we make progress on our BGP flowspec testing and pilot, we’ll periodically ask this group for some guidance.  Our first question is related to BGP session/family establishment. 

 

Our preference is to add the flow family to our existing BGP sessions, so we can rely on flowspec validation (requires flowspec routes to align with best unicast routes).  We would like to set a peer max-prefix limit on the flow family; there is a maximum number of flowspec routes supported on the Juniper MX960.  If we use the existing BGP session, exceeding the flow max-prefix will tear down the session which tears down the unicast family as well.

 

One alternative is to use a separate session for flowspec.  We’ll need to disable flowspec validation and rely on peer prefix lists.

 

Options:

1. Use the existing BGP session, enable the flow family
   1. Use a max-prefix limit such that normal behavior shouldn’t trip the threshold (caveat: we don’t know what normal behavior is) – maybe 100 flowspec routes?

                                                               i.      Clearly communicate max-prefix limit and its implications (possible unicast teardown)

                                                             ii.      Configure a limit without a teardown but a peer could send an excessive amount of flowspec routes

2. Set up a new BGP session and disable flowspec validation
   1. Use existing peer prefix lists for validation

Thoughts, comments, questions?

Cheers,

Karl

 

--

Karl Newell

Cyberinfrastructure Security Engineer

Internet2

520-344-0459