URPF on small BGP-enabled customers?

Fri Jun 3 13:58:48 UTC 2005

christian.macnevin at uk.bnpparibas.com wrote:
> At an old transit provider I was at, we had a pig of a time dealing with
> uRPF. It doesn't like asymmetric routing at all, which is commonplace when
> you've got customers homed at exchange points for one.

This is why I say there should be a feature that will work like a dynamic
ACL but is fed from BGP.  All the prefixes you learn from customer A via
BGP are put into an automatic ACL, default is deny.  Then you apply this
dynamic ACL to the interface the customer is connected to.  Of course it
still doesn't work if you send traffic from prefixes you don't announce but
for 70-80% of the cases it's a big step forward in automation.  This also
gets rid of any differences between ACL on the forwarding plane and on the
routing protocol plane.  All prefix filters are defined in BGP configuration.
Forwarding layer follows and never gets out of sync again.

Random example syntax:

  router bgp 65500
    neighbor 192.168.2.2 remote-as 65501
    neighbor 192.168.2.2 dynamic ACL 10001 receive  #put received prefixes here
    neighbor 192.168.2.2 prefix-list CUST65501
    ... #usual stuff

  #only this one is controlled
  ip prefix-list extended CUST65501
    permit ip 172.16.0.0/16 any
    permit ip 10.0.0.0/8 any

  #ACL on interface follows BGP received prefixes
  interface f0/0/0
    ip access-group 10001 in  #same as in BGP neighbor config

And Voila!  Problem automagically solved.

-- 
Andre