1

Is it possible to have a rule/policy in BGP to avoid a given ISP for the traffic?

Ex.: traffic from the USA should touch middle east ISPs if the target/source is not from/to there.

I am not sure it is possible.

Many thanks!

9
  • It’s possible, but complicated. You need to create regex as-lists. You also need to know all the ASNs of the ISPs you want to avoid. – Ron Trunk Jan 23 '20 at 13:33
  • do you have any URL/doc for it? really thanks! – HolcombSimons Jan 23 '20 at 13:53
  • Is it a Cisco router? – Ron Trunk Jan 23 '20 at 13:58
  • Remember that BGP is a routing protocol, and routing protocols do not actually route the traffic, they only exchange routing information with neighbor routers. Once your packets are in the hands of other ISPs, you have no control over the path taken. That is really the key to IP, and it is the reason we have IP. IP was designed so that the end devices do not know or care about the path taken. – Ron Maupin Jan 23 '20 at 14:45
  • RonMaupin is correct, but you can choose to not accept routes that have been advertised from specific ISPs. – Ron Trunk Jan 23 '20 at 15:08
1

In theory, it may work. In practice, this really is impossible.

First, you cannot link ISPs to countries. Many networks span multiple countries, some are present in nearly every (larger) country in the world.

Then there's the routing challenge: you could of course refuse to learn routes if they go through a specific autonomous system (ASN). That would result in routes not going through these networks (but possibly still specific countries) at best, and no routes left in many cases, making parts of the internet unreachable.

In addition, these routes are only used for outbound traffic. For inbound traffic, you don't control how traffic reaches your network, so it's very well possible these specific networks (or countries) are used.

1
  • Practically speaking, it would be difficult to monitor traffic ( I assume that’s what the OP is concerned about) if you only see one half of the session. – Ron Trunk Jan 23 '20 at 17:24
1

In practical terms, no -- or not really. Once traffic leaves your network, you no longer have any control over it. All you can do is not hand traffic to networks that you know are crossing undesirable locations. But again, if it's not your network, how do you know where it goes.

In the Land of Theory(tm), you can create an as-path filter to ignore routes announced with any "bad" AS(s):

ip as-path access-list 1 deny _666_
ip as-path access-list 1 deny _999_
ip as-path access-list 1 permit .*

Some ISPs have many ASN's. And one AS can span many regions.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.