[PPT] - Dont Mind the Gap: Bridging Network-wide Objectives and PowerPoint Presentation

SLIDE 1

Don’t Mind the Gap: Bridging Network-wide Objectives and Device-level Configurations

Ryan Beckett (Princeton, MSR) Ratul Mahajan (MSR) Todd Millstein (UCLA) Jitu Padhye (MSR) David Walker (Princeton)

SLIDE 2

2

50-80% of outages from configuration changes

Juniper 2008

~60% of network downtime is caused by human error

Yankee group 2002

Configuring Networks is Error-Prone

SLIDE 3

3

YouTube/Pakistan incident: Could something similar whack your site?

Configuring BGP properly is key to avoidance, 'Net registry official says

By Carolyn Duffy Marsan

Network World | Mar 10, 2008 1:00 AM PT

In light of Pakistan Telecom/YouTube incident, Internet registry official explains how you can avoid having your web site victimized by such an attack. When Pakistan Telecom blocked YouTube's traffic one Sunday evening in February, the ISP created an international incident that wreaked havoc on the popular video site for more than two hours. RIPE NCC, the European registry for Internet addresses, has conducted an analysis of what happened during Pakistan Telecom's hijacking of YouTube's traffic and the steps that YouTube took to stop the attack. We posed some questions to RIPE NCC's Chief Scientist Daniel Karrenberg about the YouTube incident. Here's what he had to say: How frequently do hijacking incidents like the Pakistan Telecom/YouTube incident happen? Misconfigurations of iBGP (internal BGP, the protocol used between the routers in the same Autonomous System) happen regularly and are usually the result of an error. One such misconfiguration caused the Pakistan Telecom/YouTube incident. It appears that the Pakistan Telecom/YouTube incident was not an "attack" as some have labeled it, but a configuration error. (See Columnist Johna Till Johnson's take on the topic.) What is significant about the YouTube incident?

Sign In | Register
Configuring Networks is Error-Prone

SLIDE 4

4

Configuring Networks is Error-Prone

YouTube/Pakistan incident: Could something similar whack your site?

Configuring BGP properly is key to avoidance, 'Net registry official says

By Carolyn Duffy Marsan

Network World | Mar 10, 2008 1:00 AM PT

In light of Pakistan Telecom/YouTube incident, Internet registry official explains how you can avoid having your web site victimized by such an attack. When Pakistan Telecom blocked YouTube's traffic one Sunday evening in February, the ISP created an international incident that wreaked havoc on the popular video site for more than two hours. RIPE NCC, the European registry for Internet addresses, has conducted an analysis of what happened during Pakistan Telecom's hijacking of YouTube's traffic and the steps that YouTube took to stop the attack. We posed some questions to RIPE NCC's Chief Scientist Daniel Karrenberg about the YouTube incident. Here's what he had to say: How frequently do hijacking incidents like the Pakistan Telecom/YouTube incident happen? Misconfigurations of iBGP (internal BGP, the protocol used between the routers in the same Autonomous System) happen regularly and are usually the result of an error. One such misconfiguration caused the Pakistan Telecom/YouTube incident. It appears that the Pakistan Telecom/YouTube incident was not an "attack" as some have labeled it, but a configuration error. (See Columnist Johna Till Johnson's take on the topic.) What is significant about the YouTube incident?

Sign In | Register
←

SLIDE 5

5

Configuring Networks is Error-Prone

YouTube/Pakistan incident: Could something similar whack your site?

Configuring BGP properly is key to avoidance, 'Net registry official says

By Carolyn Duffy Marsan

Network World | Mar 10, 2008 1:00 AM PT

In light of Pakistan Telecom/YouTube incident, Internet registry official explains how you can avoid having your web site victimized by such an attack. When Pakistan Telecom blocked YouTube's traffic one Sunday evening in February, the ISP created an international incident that wreaked havoc on the popular video site for more than two hours. RIPE NCC, the European registry for Internet addresses, has conducted an analysis of what happened during Pakistan Telecom's hijacking of YouTube's traffic and the steps that YouTube took to stop the attack. We posed some questions to RIPE NCC's Chief Scientist Daniel Karrenberg about the YouTube incident. Here's what he had to say: How frequently do hijacking incidents like the Pakistan Telecom/YouTube incident happen? Misconfigurations of iBGP (internal BGP, the protocol used between the routers in the same Autonomous System) happen regularly and are usually the result of an error. One such misconfiguration caused the Pakistan Telecom/YouTube incident. It appears that the Pakistan Telecom/YouTube incident was not an "attack" as some have labeled it, but a configuration error. (See Columnist Johna Till Johnson's take on the topic.) What is significant about the YouTube incident?

Sign In | Register
←

2/5/2016 China routing snafu briefly mangles interweb • The Register http://www.theregister.co.uk/2010/04/09/china_bgp_interweb_snafu/ 1/4

Configuring Networks is Error-Prone

YouTube/Pakistan incident: Could something similar whack your site?

Configuring BGP properly is key to avoidance, 'Net registry official says

By Carolyn Duffy Marsan

Network World | Mar 10, 2008 1:00 AM PT

In light of Pakistan Telecom/YouTube incident, Internet registry official explains how you can avoid having your web site victimized by such an attack. When Pakistan Telecom blocked YouTube's traffic one Sunday evening in February, the ISP created an international incident that wreaked havoc on the popular video site for more than two hours. RIPE NCC, the European registry for Internet addresses, has conducted an analysis of what happened during Pakistan Telecom's hijacking of YouTube's traffic and the steps that YouTube took to stop the attack. We posed some questions to RIPE NCC's Chief Scientist Daniel Karrenberg about the YouTube incident. Here's what he had to say: How frequently do hijacking incidents like the Pakistan Telecom/YouTube incident happen? Misconfigurations of iBGP (internal BGP, the protocol used between the routers in the same Autonomous System) happen regularly and are usually the result of an error. One such misconfiguration caused the Pakistan Telecom/YouTube incident. It appears that the Pakistan Telecom/YouTube incident was not an "attack" as some have labeled it, but a configuration error. (See Columnist Johna Till Johnson's take on the topic.) What is significant about the YouTube incident?

Sign In | Register
←

2/5/2016 China routing snafu briefly mangles interweb • The Register http://www.theregister.co.uk/2010/04/09/china_bgp_interweb_snafu/ 1/4

Internet‐Wide Catastrophe—Last Year

One year ago today TTNet in Turkey (AS9121) pretended to be the entire

Internet. And unfortunately for the rest of the Internet, many large

network providers believed them (or at least believed them in part). As far as anyone knows, it was a mistake, not a malicious act. But the consequences were far from benign: for several hours a large number of Internet users were unable to reach a large number of Internet sites. Twelve months later we can take a look at what happened, and whether we’ve learned much in the intervening time. Early Christmas Eve morning 2004, TTNet (AS9121) started announcing

The New Threat: Targeted Internet Traffic Misdirection

NOVEMBER 19, 2013

Egypt Leaves the Internet

JANUARY 27, 2011

Internet Touches Half Million Routes: Outages Possible Next Week

AUGUST 13, 2014

Authors Archives Popular HOME TOPICS PRESENTATIONS ABOUT OUTAGES DYN CONTENT HUB

« Previous Story Next Story »

100,000s of lines of config

SLIDE 10

Fundamental Tradeoff?

10

Distributed Centralized Distributed Centralized Control Mechanism OSPF RIP BGP SDN Scalability Robustness Complexity Scalability Robustness Complexity Configuration

SLIDE 11

Fundamental Tradeoff?

11

Ideal

Distributed Centralized Distributed Centralized Control Mechanism OSPF RIP BGP SDN Scalability Robustness Complexity Scalability Robustness Complexity Configuration

SLIDE 12

Propane Overview

12

Propane Topology BGP Configs Compiler

0,0 2,1 1,1 0,1

SLIDE 13

Propane System

13

AS 1 AS 2 AS 3

Uniform abstractions for intra- and inter-domain routing

I) Language for expressing network-wide objectives with:

Path constraints and preferences in case of failures

SLIDE 14

14

Propane System

2) Compiler for a purely distributed implementation Policy

SLIDE 15

15

Propane System

Generate BGP configs for each router Compiler guarantees policy-compliance for all failures

2) Compiler for a purely distributed implementation

BGP BGP BGP BGP

SLIDE 16

Example: A DC network with traditional configs

16

Global Prefixes Local Prefixes GP1 GP2 LP1 LP2 Peer2 Y X D C A B E F H G Peer1 Y C D A B G H E F Goals

Local prefixes reachable only internally
Global prefixes reachable externally
Aggregate global prefixes as GP
Prefer leaving through Peer1 over Peer2
Prevent transit traffic between peers

SLIDE 17

Configuration Attempt

Don’t export from G, H to external
Aggregate externally as GP

Goals

Local prefixes reachable only internally
Global prefixes reachable externally
Aggregate global prefixes as GP
Prefer leaving through Peer1 over Peer2
Prevent transit traffic between peers

Example: A DC network with traditional configs

Global Prefixes Local Prefixes GP1 GP2 LP1 LP2 Peer2 Y X D C A B E F H G Peer1 Y C D A B G H E F

17

GP

SLIDE 18

18

Global Prefixes Local Prefixes GP1 GP2 LP1 LP2 Peer2 Y X D C A B E F H G Peer1 Y C D A B G H E F GP Configuration Attempt

Don’t export from G, H to external
Aggregate externally as GP

Example: A DC network with traditional configs

Goals

Local prefixes reachable only internally
Global prefixes reachable externally
Aggregate global prefixes as GP
Prefer leaving through Peer1 over Peer2
Prevent transit traffic between peers

SLIDE 19

19

Configuration Attempt

Don’t export from G, H to external
Aggregate externally as GP
X,Y block routes through each other

Example: A DC network with traditional configs

Goals

Local prefixes reachable only internally
Global prefixes reachable externally
Aggregate global prefixes as GP
Prefer leaving through Peer1 over Peer2
Prevent transit traffic between peers

Global Prefixes Local Prefixes GP1 GP2 LP1 LP2 Peer2 Y X D C A B E F H G Peer1 Y C D A B G H E F

SLIDE 20

20

Global Prefixes Local Prefixes GP1 GP2 LP1 LP2 Peer2 Y X D C A B E F H G Peer1 Y C D A B G H E F GP GP Configuration Attempt

Don’t export from G, H to external
Aggregate externally as GP
X,Y block routes through each other

Example: A DC network with traditional configs

Goals

Local prefixes reachable only internally
Global prefixes reachable externally
Aggregate global prefixes as GP
Prefer leaving through Peer1 over Peer2
Prevent transit traffic between peers

SLIDE 21

21

Global Prefixes Local Prefixes GP1 GP2 LP1 LP2 Peer2 Y X D C A B E F H G Peer1 Y C D A B G H E F Goals

Local prefixes reachable only internally
Global prefixes reachable externally
Aggregate global prefixes as GP
Prefer leaving through Peer1 over Peer2
Prevent transit traffic between peers

Example: A DC network with traditional configs

GP1 traffic dropped GP Configuration Attempt

Don’t export from G, H to external
Aggregate externally as GP
X,Y block routes through each other

SLIDE 22

22

Aggregation-Induced Black Hole!

Example: A DC network with traditional configs

Global Prefixes Local Prefixes GP1 GP2 LP1 LP2 Peer2 Y X D C A B E F H G Peer1 Y C D A B G H E F GP Configuration Attempt

Don’t export from G, H to external
Aggregate externally as GP
X,Y block routes through each other

Goals

Local prefixes reachable only internally
Global prefixes reachable externally
Aggregate global prefixes as GP
Prefer leaving through Peer1 over Peer2
Prevent transit traffic between peers

GP1 traffic dropped

SLIDE 23

23

Goals

Local prefixes reachable only internally
Global prefixes reachable externally
Aggregate global prefixes as GP
Prefer leaving through Peer1 over Peer2
Prevent transit traffic between peers

Example: A DC network with traditional configs

Global Prefixes Local Prefixes GP1 GP2 LP1 LP2 Peer2 Y X D C A B E F H G Peer1 Y C D A B G H E F

SLIDE 24

24

Example: A DC network with Propane

define Destination = {GP1 => end(A) GP2 => end(B) LP1 => end(E) LP2 => end(F) true => exit(Peer1 >> Peer2)} Global Prefixes Local Prefixes GP1 GP2 LP1 LP2 Peer2 Y X D C A B E F H G Peer1 Y C D A B G H E F

SLIDE 25

25

define Destination = {GP1 => end(A) GP2 => end(B) LP1 => end(E) LP2 => end(F) true => exit(Peer1 >> Peer2)} define Locality = {LP1 | LP2 => internal}

Example: A DC network with Propane

Global Prefixes Local Prefixes GP1 GP2 LP1 LP2 Peer2 Y X D C A B E F H G Peer1 Y C D A B G H E F

SLIDE 26

26

define Destination = {GP1 => end(A) GP2 => end(B) LP1 => end(E) LP2 => end(F) true => exit(Peer1 >> Peer2)} define Locality = {LP1 | LP2 => internal} define transit(X,Y) = enter(X|Y) and exit(X|Y)

Example: A DC network with Propane

Global Prefixes Local Prefixes GP1 GP2 LP1 LP2 Peer2 Y X D C A B E F H G Peer1 Y C D A B G H E F

SLIDE 27

27

define Destination = {GP1 => end(A) GP2 => end(B) LP1 => end(E) LP2 => end(F) true => exit(Peer1 >> Peer2)} define Locality = {LP1 | LP2 => internal} define transit(X,Y) = enter(X|Y) and exit(X|Y) define NoTransit = {true => !transit(Peer1,Peer2)}

Example: A DC network with Propane

Global Prefixes Local Prefixes GP1 GP2 LP1 LP2 Peer2 Y X D C A B E F H G Peer1 Y C D A B G H E F

SLIDE 28

28

define Destination = {GP1 => end(A) GP2 => end(B) LP1 => end(E) LP2 => end(F) true => exit(Peer1 >> Peer2)} define Locality = {LP1 | LP2 => internal} define transit(X,Y) = enter(X|Y) and exit(X|Y) define NoTransit = {true => !transit(Peer1,Peer2)} define Main = Destination & Locality & NoTransit & agg(GP, in -> out)

Example: A DC network with Propane

Global Prefixes Local Prefixes GP1 GP2 LP1 LP2 Peer2 Y X D C A B E F H G Peer1 Y C D A B G H E F

SLIDE 29

Compilation Propane Compiler Topology BGP Configs

29

SLIDE 30

Compilation Propane Compiler Topology BGP Configs

30

1 2 1

State Machines

Constraints

n Policy

SLIDE 31

Compilation Propane Compiler Topology BGP Configs

31

0,0 2,1 1,1 0,1 1 2 1

Product Graph State Machines

Jointly analyze with topology

SLIDE 32

Compilation: A simple Example

32

Y

A C D E B

X

end(Y) & (path(A,C,D) >> any)

SLIDE 33

Compilation: A simple Example

33

Y

A C D E B

X

Convert to Regex

XACDY >> (Σ*)Y end(Y) & (path(A,C,D) >> any)

SLIDE 34

Reversed Automata from Policies

34

Policy:

1. XACDY
2. (Σ*)Y

Y

A C D E B

X

More preferred paths Less preferred paths

SLIDE 35

Reversed Automata from Policies

35

1 2 3 4 5 Y D C A X Y Y

A C D E B

X

Σ

1

Policy:

1. XACDY
2. (Σ*)Y

SLIDE 36

Reversed Automata from Policies

36

1 2 3 4 5 Y D C A X

Reversed automata tracks BGP message flow

Y

A C D E B

X Y

Σ

1

Policy:

1. XACDY
2. (Σ*)Y

SLIDE 37

Constructing the Product Graph (PG)

37

1 2 3 4 5 Y D C A X Y

Σ

1 {1,2}

(D,2,1) (C,3,1) (A,4,1) (X, -, 1) (X,5,1) (Y,1,1) (-,0,0) (D, -,1) (E, -,1) (B, -,1)

{2}

(C, -,1) (A, -,1)

Y

A C D E B

X

SLIDE 38

Constructing the Product Graph (PG)

38

1 2 3 4 5 Y D C A X Y

Σ

1

(X,5,1)

Topology Location Automata States

Y

A C D E B

X

SLIDE 39

Constructing the Product Graph (PG)

39

1 2 3 4 5 Y D C A X Y

Σ

1

1 {1,2}

(D,2,1) (C,3,1) (A,4,1) (X, -, 1) (X,5,1) (Y,1,1) (-,0,0) (D, -,1) (E, -,1) (B, -,1)

{2}

(C, -,1) (A, -,1)

Y D C A X

Accept:

Preferences

Y

A C D E B

X

SLIDE 46

Constructing the Product Graph (PG)

46

1 2 3 4 5 Y D C A X Y

Σ

1 {1,2}

(D,2,1) (C,3,1) (A,4,1) (X, -, 1) (X,5,1) (Y,1,1) (-,0,0) (D, -,1) (E, -,1) (B, -,1)

{2}

(C, -,1) (A, -,1)

Y

A C D E B

X

SLIDE 47

Compilation to BGP:

47

Idea 1: Restrict advertisements to edges

Encode state in a BGP community tag
Incoming edges — import filters
Outgoing edges — export filters

Let BGP find some allowed path dynamically

(D,2,1) (C,3,1) (A,4,1) (X, -, 1) (X,5,1) (Y,1,1) (-,0,0) (D, -,1) (E, -,1) (B, -,1)

{2} {1,2}

(C, -,1) (A, -,1)

SLIDE 52

Compilation to BGP:

52

Idea 2: Find preferences Let BGP find the best path dynamically

Direct BGP towards best path
Under all combinations of failures

58

end(Y) & (path(A,C,D) >> any)

AS 100

Y

A C D E B

X lp←100 lp←101 MED←80 MED←81 filter(Y) filter(Y)

SLIDE 59

Implementation

Written in 7000 lines of F# Generates Quagga configurations A number of other analyses & features

59

SLIDE 60

Benchmarks

60

Configurations from a large cloud provider Policy described in English documents Datacenter and Backbone policies

SLIDE 61

Policy Size

61

Without prefix/peer definitions Datacenter policy: 31 lines of Propane Backbone policy: 43 lines of Propane Conventional BGP configurations are 1000s of lines

SLIDE 62

Compilation Time

62

Data center (< 9 min) Backbone (< 3 min)

Compile for each prefix equivalence class Compile for each equivalence class in parallel 8 core, 3.6 GHz Intel Xeon processor

SLIDE 63

Configuration Size

63

Reuse community values across peers Merge import/export behaviors across peers Optimizations yield 50-100x decrease in config size Avoid using community tags when unambiguous

Optimizations Results

Configurations ~1000-10000 lines per router

SLIDE 64

64

Propane: Summary

Centralized network programmability Distributed implementation via BGP Uniform abstractions for Inter- and Intra-domain routing

High-level language Compiler

Static analysis guarantees policy compliance for all failures Scales to reasonably sized network topologies Core policy in 30-50 lines of Propane vs. 1000s Constraints specify preferred paths and backups in case of failure