BGP Labs: Multivendor External Routers

Here’s a quick update on the BGP Labs project status: now that netlab release 1.6.4 is out, I could remove the dependency on using Cumulus Linux as the external BGP router.

You can use any device that is supported by bgp.session and bgp.policy plugins as the external BGP router. You could use Arista EOS, Aruba AOS-CX, Cisco IOSv, Cisco IOS-XE, Cumulus Linux or FRR as external BGP routers with netlab release 1.6.4, and I’m positive Jeroen van Bemmel will add Nokia SR Linux to that list.

If you’re not ready for a netlab upgrade, you can keep using Cumulus Linux as external BGP routers (I’ll explain the behind-the-scenes magic in another blog post, I’m at the Deep Conference this week).

For more details, read the updated BGP Labs Software Installation and Lab Setup guide.

netlab 1.6.4: Support for Multi-Lab Projects; More BGP Goodies

Features in netlab release 1.6.4 were driven primarily by the needs of my BGP labs project:

• bgp.session plugin (formerly known as ebgp.utils plugin) got support for BFD, passive BGP peers and remove-private-as option.
• bgp.policy plugin implements basic BGP routing policy tools, including per-neighbor weights, local preference and MED.
• You can enable external tools in user defaults and use default groups to create user- or project-wide groups in the defaults files.
• Version-specific lab topology files allow netlab to select a lab topology that is a best fit for the netlab release you’re running.

Numerous platforms already support the new BGP nerd knobs:

netlab 1.6.4: Support for Multi-Lab Projects; More BGP Goodies

Features in netlab release 1.6.4 were driven primarily by the needs of my BGP labs project:

• bgp.session plugin (formerly known as ebgp.utils plugin) got support for BFD, passive BGP peers and remove-private-as option.
• bgp.policy plugin implements basic BGP routing policy tools, including per-neighbor weights, local preference and MED.
• You can enable external tools in user defaults and use default groups to create user- or project-wide groups in the defaults files.
• Version-specific lab topology files allow netlab to select a lab topology that is a best fit for the netlab release you’re running.

Numerous platforms already support the new BGP nerd knobs:

Video: History of BGP Route Leaks

I’ll be talking about Internet routing security at the Deep conference in a few days, and just in case you won’t be able to make it¹ ;) here’s the first bit of my talk: a very brief history of BGP route leaks².

Note: you’ll find more Network Security Fallacies videos in the How Networks Really Work webinar.

Video: History of BGP Route Leaks

I’ll be talking about Internet routing security at the Deep conference in a few days, and just in case you won’t be able to make it¹ ;) here’s the first bit of my talk: a very brief history of BGP route leaks².

Note: you’ll find more Network Security Fallacies videos in the How Networks Really Work webinar.

BGP Labs: Build Larger Networks with IBGP

After going through the BGP basics, it’s time to build a network that has more than one BGP router in it, starting with the simplest possible topology: a site with two WAN edge routers.

BGP Labs: Build Larger Networks with IBGP

After going through the BGP basics, it’s time to build a network that has more than one BGP router in it, starting with the simplest possible topology: a site with two WAN edge routers.

Will Network Devices Reject BGP Sessions from Unknown Sources?

TL&DR: Violating the Betteridge’s Law of Headlines, the answer is “Yes, but the devil is in the details.”

It all started with the following observation by Minh Ha left as a comment to my previous BGP session security blog post:

I’d think it’d be obvious for BGP routers to only accept incoming sessions from configured BGP neighbors, right? Because BGP is the most critical infrastructure, the backbone of the Internet, why would you want your router to accept incoming session from anyone but KNOWN sources?

Following my “opinions are good, facts are better” mantra, I decided to run a few tests before opinionating¹.

Will Network Devices Reject BGP Sessions from Unknown Sources?

TL&DR: Violating the Betteridge’s Law of Headlines, the answer is “Yes, but the devil is in the details.”

It all started with the following observation by Minh Ha left as a comment to my previous BGP session security blog post:

I’d think it’d be obvious for BGP routers to only accept incoming sessions from configured BGP neighbors, right? Because BGP is the most critical infrastructure, the backbone of the Internet, why would you want your router to accept incoming session from anyone but KNOWN sources?

Following my “opinions are good, facts are better” mantra, I decided to run a few tests before opinionating¹.

Worth Reading: AI Risks

Bruce Schneier wrote a thoughtful article on the various perceptions of AI Risks including this gem:

As the science-fiction author Ted Chiang has said, fears about the existential risks of AI are really fears about the threat of uncontrolled capitalism, and dystopias like the paper clip maximizer are just caricatures of every start-up’s business plan.

Enjoy!

Worth Reading: AI Risks

Bruce Schneier wrote a thoughtful article on the various perceptions of AI Risks including this gem:

As the science-fiction author Ted Chiang has said, fears about the existential risks of AI are really fears about the threat of uncontrolled capitalism, and dystopias like the paper clip maximizer are just caricatures of every start-up’s business plan.

Enjoy!

BGP Labs: TCP-AO Protection of BGP Sessions

A few days after I published the EBGP session protection lab, Jeroen van Bemmel submitted a pull request that added TCP-AO support to netlab. Now that the release 1.6.3 is out, I could use it to build the Protect BGP Sessions with TCP Authentication Option (TCP-AO) lab exercise.

BGP Labs: TCP-AO Protection of BGP Sessions

A few days after I published the EBGP session protection lab, Jeroen van Bemmel submitted a pull request that added TCP-AO support to netlab. Now that the release 1.6.3 is out, I could use it to build the Protect BGP Sessions with TCP Authentication Option (TCP-AO) lab exercise.

netlab 1.6.3: BGP Nerd Knobs

netlab release 1.6.3 added numerous BGP nerd knobs:

• You can create EBGP multihop sessions in the global routing table when using Arista EOS, Cisco IOSv, Cisco IOS-XE, FRR and Cumulus Linux 4.x.
• ebgp.utils plugin supports TCP-AO, configurable BGP timers, and Generic TTL Security Mechanism (TTL session protection)
• BGP neighbor reports hide irrelevant columns.

We also:

netlab 1.6.3: BGP Nerd Knobs

netlab release 1.6.3 added numerous BGP nerd knobs:

• You can create EBGP multihop sessions in the global routing table when using Arista EOS, Cisco IOSv, Cisco IOS-XE, FRR and Cumulus Linux 4.x.
• ebgp.utils plugin supports TCP-AO, configurable BGP timers, and Generic TTL Security Mechanism (TTL session protection)
• BGP neighbor reports hide irrelevant columns.

We also:

Worth Reading: Some Thoughts on Digital Twins

I encountered several articles explaining the challenges of simulating your network in a virtual lab in the last few months, including:

• Some thoughts on digital twins by Jeff McLaughlin
• Network Simulation is hard – Part 1, Part 2 – by Pete Crocker
• Twenty-five open-source network emulators and simulators you can use in 2023 by Brian Linkletter

Enjoy!

Worth Reading: Some Thoughts on Digital Twins

I encountered several articles explaining the challenges of simulating your network in a virtual lab in the last few months, including:

• Some thoughts on digital twins by Jeff McLaughlin
• Network Simulation is hard – Part 1, Part 2 – by Pete Crocker
• Twenty-five open-source network emulators and simulators you can use in 2023 by Brian Linkletter

Enjoy!

Worth Reading: Introduction of EVPN at DE-CIX

Numerous Internet Exchange Points (IXP) started using VXLAN years ago to replace tradition layer-2 fabrics with routed networks. Many of them tried to avoid the complexities of EVPN and used VXLAN with statically-configured (and hopefully automated) ingress replication.

A few went a step further and decided to deploy EVPN, primarily to deploy Proxy ARP functionality on EVPN switches and reduce the ARP/ND traffic. Thomas King from DE-CIX described their experience on APNIC blog – well worth reading if you’re interested in layer-2 fabrics.

Worth Reading: Introduction of EVPN at DE-CIX

Numerous Internet Exchange Points (IXP) started using VXLAN years ago to replace tradition layer-2 fabrics with routed networks. Many of them tried to avoid the complexities of EVPN and used VXLAN with statically-configured (and hopefully automated) ingress replication.

A few went a step further and decided to deploy EVPN, primarily to deploy Proxy ARP functionality on EVPN switches and reduce the ARP/ND traffic. Thomas King from DE-CIX described their experience on APNIC blog – well worth reading if you’re interested in layer-2 fabrics.

Video: What Is Software-Defined Data Center

A few years ago, I was asked to deliver a What Is SDDC presentation that later became a webinar. I forgot about that webinar until I received feedback from one of the viewers a week ago:

If you like to learn from the teachers with the “straight to the point” approach and complement the theory with many “real-life” scenarios, then ipSpace.net is the right place for you.

I haven’t realized people still find that webinar useful, so let’s make it viewable without registration, starting with What Problem Are We Trying to Solve and What Is SDDC.