IK2205 Interdomain routing Exam Answers should be well structured and readable, remember that quality is better than quantity.

Transcription

1 Information The duration of the exam is 4 hours ( ). Answers should be well structured and readable, remember that quality is better than quantity. Write your name and personal-id/date-of-birth on each page. No help material is allowed. Answers will be posted on the course web within 2 weeks after the exam. Results will be published in Daisy no later than June 29, Complaints about the grading should be sent by to IK2205@ict.kth.se, no later than July 13, Be sure you specify where and in what sense you believe the grading is wrong in your particular case when you file the grading complaint. The exam consists of 2 parts: Part A and Part B. Part A is a set of questions with short answers. Answers longer than the word limit will be truncated, meaning that we will disregard from the part of your answer that exceeds the word limit during the exam marking. Part B is a smaller set of questions that require more elaborative answers. To pass the exam you need to attain a certain number of points (preliminary 75%) on Part A. Higher grades (A-C or 4-5) will be based on the total score (Part A + Part B). Part B will not be graded for those who do not pass Part A. Preliminary grading is as follows: Points Grade (A-F) points on Part A and points in total A points on Part A and points in total B points on Part A and points in total C points on Part A and points in total D points on Part A and passed compensatory assignment E points on Part A (compensatory assignment offered) Fx 0-20 points on Part A F (Fail) Points Grade (U-5) points on Part A and points in total points on Part A and points in total points on Part A and points in total points on Part A (compensatory assignment offered) U 0-20 points on Part A U (Fail) Good Luck! 1/12

2 Exam Part A (30p) (Note the word limits) 1) Various true/false statements (10p) Mark the following statements as true or false. Don t write t or f, since it may be hard to differ between the two if the hand-writing is indistinct. Note: You will get 1p for each correct answer You will get -1p for each wrong answer You will get 0p for each no answer You will not get less than 0p in total on this question A. A prefix /24 will match access-list 101 permit ip (1p) B. The purpose with the AS_PATH attribute is to prevent loops inside an AS. (1p) C. BGP KEEPALIVE messages are sent periodically even when the BGP peering is down. (1p) D. BGP synchronization is a mechanism BGP speakers use to exchange routing updates during BGP neighbor negotiation. (1p) E. When a BGP speaker learns multiple routes to the same destination with the same attributes, it will prefer EBGP path to IBGP path. (1p) F. AS1 can use a regular expression ^1$ for outbound update filtering to advertise only locally originated routes. (1p) G. The MED attribute is used to indicate to an external AS the preference among multiple links into our own AS. (1p) H. Peer group can be used to prevent loops inside an AS. (1p) I. All the rules of IBGP apply inside each sub-as in a confederation. (1p) J. In route flap dampening, a penalized route will be activated again once the penalty is decayed below the reuse-limit. (1p) A. True B. False (BGP uses AS_PATH to prevent loop between ASes) C. False (KEEPALIVE is sent after the peering is established) D. False (BGP synchronization is not used for this purpose) E. True F. False (The regular expression should be ^$) G. True H. False (Loop can still occurs) I. True J. True 2) Various short answers (10p) Answer the following questions with short answers. Note: You will get 1p for each entirely correct answer Word limit per question: 40 words A. What transport protocol does BGP use? Briefly explain why? (1p) B. BGP path attributes are classified into four categories. To what category does the NEXT_HOP attribute belong? (1p) 2/12

3 C. What BGP message is sent whenever an error occurs? (1p) D. What are the three basic blocks (parts) of a BGP UPDATE message? (1p) E. How can you arrange so that the routes you advertise to your BGP peer are not advertised further to any other BGP speakers? (1p) F. How should you prevent your network from becoming a transit autonomous system if you are dual homing to the Internet? (1p) G. Why would we want an interior gateway protocol to wait for BGP to converge before allowing its peers to route through the local router? (1p) H. What does symmetrical traffic mean in the context of BGP? I. What is the main purpose with the two concepts route reflectors and confederations? (1p) J. BGP offers a mechanism to control route instability. What is the name of that mechanism? (1p) A. TCP is used to ensure transport reliability (and simplify the complexity in BGP protocol design). B. Well-known mandatory. C. NOTIFICATION message. D. Unreachable route, Path attribute and NLRI. E. By setting community NO_ADVERTISE when advertise the routes to your peer. F. Only advertise your locally originated prefixes to external peers (e.g. by using AS_PATH filtering). G. To prevent traffic from being dropped. H. It means that traffic will leave an AS from a given exit point and also enter the AS at the same point. I. To increase scalability (by relaxing the full-mesh requirement) J. Route dampening (or route flap dampening). 3) BGP strengths and weaknesses (2p) (Word limit: 50) Give two strengths and two weaknesses of the BGP routing protocol (without comparing it to any other routing protocols) Strengths - Routing policy control (flexible in defining routing policy) - Diverse administration control (relatively easy to define scope of administrative boundaries) - Handling large prefix counts (high scalability) Weaknesses - slow convergence time (which could also leads to instability) - increased complexity (Since BGP relies on IGP, so it introduces additional dependencies, which increases complexity) - prone to error and was design with little consideration in security issues 4) BGP path attribute (2p) (Word limit: 80) 3/12

4 Arrange the following attributes in their respective category to table 1 below: LOCAL_PREF, MED, ORIGIN, COMMUNITY Well-known mandatory Well-know discretionary Optional nontransitive Optional transitive Well-known mandatory Well-know discretionary Optional nontransitive Optional transitive ORIGIN LOCAL_PREF MED COMMUNITY 5) BGP extensions (2p) (Word limit: 100) Briefly describe the two methods to implement BGP extensions. How a BGP speaker communicates to a peer about this new extension, in which message the new extension is sent, and what would happen if the BGP peer does not support this extension? BGP extension can be implemented as either a new BGP capability or a new community. BGP capability is negotiated during neighbor negotiation process through OPEN message. If the BGP speaker does not understand this new capability, it will reset the connection and renegotiate without this new capability. The BGP community will be attached with the PATH attribute in the UPDATE message. If the BGP speaker does not understand about this new community, it will simply ignore it. 6) BGP policy conflicting with IGP (2p) (Word limit: 100) Given the figure above, AS1 has two links to external network. One link is used as primary link to send and receive traffic during normal operation and the other link is used as a backup link, which is only used when the primary link fails. To achieve this AS1 has configured to set LOCAL_PREF = 300 on the default route received via primary link and LOCAL_PREF = 200 on the default route received via backup link. In addition, RTA and RTD also inject the default route into IGP. The network administrator has noticed that there is a loop between RTC and RTD. Describe four possible solutions to solve this problem. 4/12

5 Make sure that when the default got injected into IGP, the IGP metric will be lower at RTA and much higher at RTD so that the traffic will only follow one path toward RTA out. Make sure that only one default route on the primary link is injected into IGP. And the default route on the backup link will be injected only when the primary link fail. If RTB and RTC can run BGP, then it is also possible to run IBGP full-mesh so that all routers can have the same view of the network. If it is possible to add a physical link between RTA and RTD, then doing so would solve the problem. 7) Controlling IGP expansion (2p) (Word limit: 100) One scalable way of managing IGP expansion is to segment an AS into multiple regions separated by IBGP. Briefly explain the overview of how this is done. Also, give one drawback of this method compared to the solution in which an AS is segmented into multiple regions separated by EBGP. The AS can be divided into multiple regions, each running different and independent IGPs. Regions are logically interconnected via a full IBGP mesh. With this design, the stability of one region would not affect the stability of another. The main drawback of this method is that it does not have the flexibility to set policies for each region. 5/12

6 Exam Part B (20p) (No word limits) 8) BGP Scenario (14p) In AS1, RTA, RTB, RTC, RTD, RTE, RTF, and RTG inject /24, /24, /24, /24, /24, /24 and /24 respectively into BGP using the network command. RTH, RTI, RTJ, RTK, and RTL inject /24, /24, /24, /24, and /24 respectively into BGP using the redistribute command. In AS2, RTW and RTX inject /24, /24 respectively into BGP using the network command. RTY and RTZ inject /24, and /24 respectively into BGP using the redistribute command. In addition, RTY injects the aggregated route ( /20) into BGP with the aggregate-address command. For BGP decision, when a BGP speaker learns the same prefix from multiple paths, if all path attributes are equal and IGP metric to the NEXT_HOP are also equal then the BGP speaker will prefer to use the path learned from the peer router with the least alphabetical order. For example, if RTO learned /24 from RTM and RTN and the prefix has the same path attributes and IGP metric to both NEXT_HOP are equal, then RTO should prefer to use the path learned from RTM. 6/12

7 Currently, AS1 is not yet connected to any other ASes and cluster 13 is disconnected from the rest of the network. There are only two active clusters; namely cluster 11 in Stockholm and cluster 12 in Kista as shown in the figure above. Assume that the routing protocols have converged. Answer the question A and B. A. Write down all prefixes as well as NEXT_HOP and ORIGIN values of the best BGP routes that RTC learns from its peers. (2p) B. Write down all prefixes as well as NEXT_HOP and ORIGIN values of the best BGP routes that RTK learns from its peers. (2p) Assume that cluster 13 is now connected to both cluster 11 and cluster 12 with two new links. Link1 ( /30) connects RTE and RTH. RTE has IP address and RTH has IP address Link2 ( /30) connects RTE and RTD. RTE has IP address and RTD has IP address Assume that OSPF and IBGP are running on the links and the routing protocols have converged. Answer the question C, D, and F. C. Write down all prefixes as well as NEXT_HOP and ORIGIN values of the best BGP routes that RTF learns from its peers. (2p) D. Write down all prefixes as well as NEXT_HOP and ORIGIN values of the NEW best BGP routes that RTC learns from its peers in additional to what RTC have learned earlier in Question A. (1p) E. Write down all prefixes as well as NEXT_HOP and ORIGIN values of the NEW best BGP routes that RTK learns from its peers in additional to what RTK have learned earlier in Question B. (1p) Continue with the scenario where all clusters in AS1 are interconnected, assume that AS1 and AS2 are now connected with two new links. Link3 ( /30) connects RTD and RTX. RTD has IP address and RTX has IP address Link4 ( /30) connects RTH and RTY. RTH has IP address and RTY has IP address EBGP are running on the border routers on both links. In addition, RTH originates a default route in OSPF using the command defaultinformation originate always that propagates to all routers in AS1. For IGP routing, if a router learns two equal-cost paths from two different links in IP routing table, the router will prefer to use the path learned from the router with the least alphabetical order. For example, if RTO learned /24 from RTM and RTN, RTO should prefer to use the path learned from RTM. F. Write down all prefixes as well as NEXT_HOP and ORIGIN values of the BGP routes from AS2 that RTK learned. In addition, state which of those routes that RTK will consider as best routes. (2p) Continue with the scenario where AS1 and AS2 are connected. Now, RTD added a configuration to inject only the aggregated route ( /18) to AS2 (RTD does not advertise any specific routes to AS2). G. Explain how the ICMP echo request sent from on RTC to on RTZ traverses the network. (1p) H. Explain how the ICMP echo request sent from on RTX to on RTJ traverses the network. (1p) I. Explain how the ICMP echo request sent from on RTY to on RTG traverses the network. (1p) 7/12

8 J. Explain how the ICMP echo request sent from on RTL to on RTW traverses the network. (1p) Example answer for A, B, C, D, E and F (the information is of course incorrect, but this is the expected level of detail in your answer): Network NEXT_HOP ORIGIN BEST ROUTE(for answer F) / IGP YES / INCOMPLETE NO Note: NEXT_HOP is for locally originated route on the router. However, you only need to answer about learned routes from other peers. Example answer for G,H,I, and J (on RTN) -> RTO -> RTP -> (on RTQ) (on RTQ) -> RTR -> RTS -> packet dropped Grading method for A-F: We use point-deduction method. You can make two mistakes without your points being deducted. Afterwards, we deduct one point for every two mistakes you make. For example, if you make 2 mistakes, no point is deducted. 3-4 mistakes, 1 point is deducted. 5-6 mistakes, 2 points are deducted. Each cell in the table counts as a mistake. Grading method for G-J: You only get a point if you answer correctly. A. RTC Network NEXT_HOP ORIGIN / IGP / IGP / IGP ( / IGP) / INCOMPLETE / INCOMPLETE / INCOMPLETE / INCOMPLETE B. RTK Network NEXT_HOP ORIGIN / IGP / IGP / IGP / IGP / INCOMPLETE / INCOMPLETE / INCOMPLETE ( / INCOMPLETE) / INCOMPLETE C. RTF Network NEXT_HOP ORIGIN / IGP / INCOMPLETE / INCOMPLETE / INCOMPLETE / IGP ( / IGP) / IGP D. RTC learned no new routes. 8/12

9 E. RTK new routes after links to cluster 13 were established Network NEXT_HOP ORIGIN / IGP / IGP / IGP F. RTK learned routes from AS2, after two new links were established Network NEXT_HOP ORIGIN BEST ROUTE / IGP YES / IGP YES / IGP YES / INCOMPLETE YES / INCOMPLETE YES G (RTC) -> RTD -> RTX -> RTY -> (RTZ) H (RTX) -> RTD -> RTC -> RTB -> RTA -> RTH -> RTK -> (RTJ) I (RTY) -> RTH -> RTE -> (RTG) J (RTL) -> RTA -> RTH -> RTY -> RTX -> (RTW) 9/12

10 9) BGP policies (6p) From the figure, AS1, AS2, AS3, AS4, AS5 and AS31 have the aggregated address prefixes /18, /18, /18, /18, /20, and /20 respectively. AS4 has 3 border routers (RTA, RTB, and RTC) running IBGP in full mesh. AS4 is dual-homed to two providers; namely AS2 and AS3. AS4 connected to AS2 and AS3 on link 1 and link 2 respectively. AS4 has two private peerings; one with AS31 on link 3 and another with AS5 on link 4. AS5 is multi-homed to many providers, namely AS2, AS4, and AS31, and has IP address block from AS2. AS31 is a customer of AS3 and has IP address block from it. AS4 will use a direct link to communicate with its customer AS5. Otherwise, AS4 will use a primary/backup configuration in which all traffic should come and go over link1 (primary link) during normal operation, and use link2 (backup link) only when link1 fails. AS4 also allow transit traffic over link 1 and link 2 for other ASes only when those ASes have no other possible path to forward traffic except via AS4. But only traffic from/to AS31 and AS5 are allowed to transit over link 3 and link 4 respectively. AS5 would always communicate directly with AS4. This means traffic to/from AS4 should be sent/received directly over link 4. All other traffic should come and go over other links. But if the links to other ASes fail, AS5 will use link 4 for all traffic. AS4 has a private peering with AS31 on link 3. This link is solely used for private communication between the AS31 and AS4. In addition, AS31 can use this link for transit only when all other links of AS31 fail (when both AS31-AS3 link and AS31-AS5 link fail). Currently, each AS always advertises its aggregated route to other ASes. In addition, all ASes support BGP community according to RFC /12

11 and are willing to accept routes with community values defined as shown in Table 1. Community Local preference ASN: None 100 ASN:50 50 Table 1: Community values used by all ASes All ASes have a policy to pass along any community attributes if the best route has a community attribute set to it (even if the AS does not support that specific community attribute). Otherwise, there is no other policy configured in any of the ASes at the moment. You must help AS4 to configure its interdomain policy to control inbound and outbound traffic so that the traffic behavior of the whole scenario will be the same as described above. Explain what must be done on each router (RTA, RTB, and RTC) to achieve the following: A. Outbound traffic control (2p) B. Inbound traffic control (4p) You don t have to write down the actual configuration, but you need to explain conceptually how it can be achieved. Example answer (the information is of course incorrect, but this is the expected level of detail in your answer): Outbound traffic control Policy on RTA: For all incoming updates on link5, set MED to 10 Policy on RTB: For all incoming updates from AS6, set LOCAL_PREF to 300 Policy on RTC: For all incoming update from AS6, prepend AS_PATH 3 additional hops Inbound traffic control Policy on RTA: For all incoming update of route originated from AS7, set MED to 20 set community to 20:30 on all other routes. Policy on RTB: For all outgoing update, set LOC_PREF to 300 Policy on RTC: For all locally originated routes, prepend AS_PATH 3 additional hops when advertise Don t send all other routes in the update. A. Outbound traffic control Policy on RTA (on Link1): For all incoming updates, set LOCAL_PREF=200 Policy on RTB: On Link2: For all incoming updates, set LOCAL_PREF=100 On Link3: For incoming updates of route originated from AS31 ( /20), set LOCAL_PREF=300. Filter out the rest of incoming updates Policy on RTC (on Link4): 11/12

12 For incoming updates of route originated from AS5 ( /20), set LOCAL_PREF=300. Filter out the rest of incoming updates B. Inbound traffic control Policy on RTA (on Link 1): Advertise /18 with community 1:300, 2:300, 3:300 Advertise all other routers with community 2:50 Policy on RTB: On Link 2: Advertise /18 with no modification Advertise all other routers with community 3:50 and prepend 1 additional hop On Link 3: Advertise /18 with community 31:300 and NO_EXPORT Advertise all other routes with community 31:50 NO_EXPORT Policy on RTC (on Link 4): Advertise /18 with community 5:300 and NO_EXPORT Advertise all other routes with community 5:50 NO_EXPORT 12/12