Subject: A possible solution for source-based site-exit routing

From: "Aldrin Isaac" <[email-masked]>
Date: Thu, 21 Nov 2002 17:55:43 -0500

I would like to present a method for operationally simple source-based
site-exit routing that may or may not have been presented before.
Those who are familiar with MPLS VPNs will find analagies.

There are four new "things" defined by this method.

Source-constrained Route Table (SRT): is a routing table instance used
to distinguish destinations route entries that are reachable for a
specific Source Prefix (SP) from the same destination route entries
that are reachable for other SPs.  Route metrics for routes within an
SRT are processed independently of route metrics for routes in other
SRTs and the Base Routing Table (BRT).  ** There is one SRT per every
unique SP. **

Base Route Table (BRT): This one isn't new.  This route table carries
all routes that are not constrained by the source address.  Generally
this would be all internal routes.

Source-constrained Route Distinguisher (SRD): is an attribute given to
an external route (external-destination-prefix +
border-address/border-nexthop) that can be used for routing packets
whose source address matches a particular SP.  The value of the SRD is
simply the SP.  A destination route prefix with a particular SRD value
must not be considered by a routing protocol to be equivalent to the
same destination route prefix with another SRD value.  Border routers
import routes from an external peer directly into SRTs for each SP
routable via that peer.  The border routers export routes from the
BRT/SRTs into IGP/IBGP as normal, but routes from the SRTs are
additionally exported with the associated SRD.  Other routers within
the site import routes with an SRD into the SRT associated to the SP.

SRT Lookup Table (SRTLT): is the SP table whose input is a source
address and output is a reference to the SRT associated to the source
address.

Tying it all together is the...

Three Point Lookup (TPL): When a packet arrives at a router, the
router will first perform a lookup of the destination in the BRT.  If
the route does not exist in the BRT, it does a lookup in the SRTLT to
find the SRT whose SP best matches the packets source address.  If
SRTLT lookup fails for the source address or a destination route does
not exist in the SRT, then an ICMP Destination Unreachable is sent to
the source address.

If used, this feature would need to be enabled on all routers
participating in the sites IGP.  An SRD attribute would need to be
defined for all IGPs including IBGP.

In a simplified configuration, each border router would import a
static ::/0 route pointed towards each of it's external peers into the
SRTs whose SPs can be routed via those peers.  In which case ::/0
route should not exist in the BRT.  More precisely, a route should not
exist in the BRT if it exists in an SRT.

Comments?

-- aldrin

---

From: "Aldrin Isaac" <[email-masked]>
Date: Fri, 22 Nov 2002 09:40:55 -0500

Hi all,

Since I didn't get any comments on my previous email, I have tried to
present a brief explanation of how I arrived at it:

(1) If a multi-address host were connected such that each PA addressed
interface was directly connected to the network of the ISP who
assigned that interface's address, then we've reduced the problem down
to the similar level of simplicity as the home-pc that is connected to
a dsl ISP and a cable ISP.  This is the optimum environment for
host-based multi-homing solutions.

(2) However, since enterprises aren't going to do that for more
reasons than are worth discussing here, we could probably achieve the
same results by creating virtual topologies within the enterprise.
This could be done by placing each interface of every host on a VLAN
that is associated to the ISP that assigned its prefix.  The router
interface which is connected to that VLAN would be part of an MPLS VPN
to which the ISP is also connected.  This creates a similar
environment for the host as in (1).

(3) However, even (2) is a little too operationally complex.  But, if
we take the VPN routing tables in (2), and find a way to route-based
on the VPN only when the source address constraints require us to do
so, then we have what I described in my previous email.

If this idea has been presented and shot down in the past, I would
appreciate if someone could tell me so I can drop it.

Thanks

-- aldrin

---

From: "Aldrin Isaac" <[email-masked]>
Date: Fri, 22 Nov 2002 13:04:20 -0500

An interesting possibility with the use the of source-constrained
routing table approach.

With source-constrained routing an ISP can negotiate source address
blocks which it will forward for other ISPs/organizations that it
peers with.  This will give the ISP a little more control as to whom
it will provide transit for.  This is, of course, assuming the other
ISPs/organizations it is receiving traffic from are capable of
source-constrained routing.

This is simply to point out that a routing approach could be general
enough to provide multiple uses.

---

From: "marcelo bagnulo" <[email-masked]>
Date: Sat, 23 Nov 2002 17:20:43 +0100

Hi Aldrin,

Have you checked draft-huitema-multi6-hosts-01.txt section 4.2 Source
address dependent routing?
I think it presents something related to this.

Regards, marcelo

> -----Mensaje original-----
> De: [email-masked] [mailto:[email-masked]]En
> nombre de Aldrin Isaac
> Enviado el: jueves, 21 de noviembre de 2002 23:56
> Para: IETF-Multi6
> Asunto: A possible solution for source-based site-exit routing
>
>

---

From: Michael Richardson <[email-masked]>
Date: Mon, 25 Nov 2002 13:00:49 -0500

-----BEGIN PGP SIGNED MESSAGE-----

>>>>> "Aldrin" == Aldrin Isaac <[email-masked]> writes:
    Aldrin> (1) If a multi-address host were connected such that each PA addressed
    Aldrin> interface was directly connected to the network of the ISP who
    Aldrin> assigned that interface's address, then we've reduced the problem down
    Aldrin> to the similar level of simplicity as the home-pc that is connected to
    Aldrin> a dsl ISP and a cable ISP.  This is the optimum environment for
    Aldrin> host-based multi-homing solutions.

  I think that this is an important problem, but I'm going to ignore your
points (2) and (3), because they get into a specific solution too quickly. 

  The best mapping is the home-pc with both DSL and cable on a single NIC
card, using aliases for each side. Yes, having both DSL and cable modem on
a single hub is asking for trouble, but let's ignore this for a moment.

  The important part is that the host can directly see both networks of
each ISP, as you point out. The question is now:

  Q: what protocol does the host use to find out reacheability via each ISP?

  If the answer to above is not "the X variant of BGP/OSPF/RIPvX", but a new
protocol, then that is significant. There is a whole set of requirements that
we can write down here. When we can solve this problem, then we can move
onto:

  The enterprise situation is just the above protocol in a multihop
configuration, likely with layer(s) of "proxies" to distribute the load.

  You may been various kinds of virtual topologies to get the packets to
where they need to be, but that may in fact be specific to the kind of
technologies used inside the enterprise.

]                   At IETF55 in Atlanta, GA                    |  firewalls  [
]   Michael Richardson, Sandelman Software Works, Ottawa, ON    |net architect[
] [email-masked] http://www.sandelman.ottawa.on.ca/ |device driver[
] printk("Just another Debian GNU/Linux using, kernel hacking, security guy");[

---

From: "Aldrin Isaac" <[email-masked]>
Date: Mon, 25 Nov 2002 13:49:12 -0500

Marcelo,

Thanks for the pointer.  Michel Py pointed this out to me earlier as
well.  This is apparantly yet another doc I hadn't read.

After quickly scanning through 2000-2002 multi6 archives, I could not
find any discussion on possible implementations of 'source address
dependent routing' using the 'parallel routing tables' approach.
There is no discussion on implementations of this in Christian's draft
either.

-- aldrin

% -----Original Message-----
% From: marcelo bagnulo [mailto:[email-masked]]
% Sent: Saturday, November 23, 2002 11:21 AM
% To: Aldrin Isaac; IETF-Multi6
% Subject: RE: A possible solution for source-based site-exit routing
%
%
% Hi Aldrin,
%
% Have you checked draft-huitema-multi6-hosts-01.txt section
% 4.2 Source address dependent routing?
% I think it presents something related to this.
%
% Regards, marcelo