3

We own a few blocks of IP addresses. At several distinct sites we currently advertise our own prefixes on our routers to our upstream transit provider. We are not anycasting. One /24 is originated out of one location, another at another location, etc.

In order to simplify network management we may want our provider to advertise our prefix from their ASN on our behalf. Our provider has the capability to do this. I am wondering if there are any 'gotchas' as I want to get ahead of them?

My plan is roughly to:

  • Drop BGP on our routers with the provider.
  • Have them advertise.
  • Put original IP that was on routers on either provider equipment or L3 switch with a static router to the provider.

I'm worried about the possibility of 'blackholing' traffic.

  • The provider mentioned I should update the routing DB (radb.net) prior to making this change. Our IP addresses are currently in use. Will updating the RADB prematurely cause other providers to reject routes to my prefixes while I am awaiting the change?

  • How long should you typically wait after changing the routing DB? I assume that providers 'suck down' this DB at different times to build their prefix lists.

  • How risky is this in your opinion? There's always a chance that random providers or even my provider's upstream peers do not update their prefix lists and reject routes originated from a foreign AS.

2
  • Any problems will be 99% "political", as your provider has hinted. As the address space is publicly assigned to you, there are various public databases that will need to be set to indicate who is allowed to announce the prefix -- or others may see the space as "hijacked". (one would presume these DBs have already been setup for your AS and transit AS's; they just need to be changed to show someone else as the origin.) – Ricky Jun 2 '20 at 21:51
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can post and accept your own answer. – Ron Maupin Dec 17 '20 at 18:25
2

This sounds like the proper way to do this and is similar to what I've done in the past for a few of my customers.

You should be able to create multiple entries in the routing DB, one for the prefix originating from your ASN and one from your ISP's ASN.

Many larger networks update their prefix filters about once a day, so personally I'd create the objects and just wait for a few days before moving the prefix to the other ASN. However, if one you're moving your prefix to one of your current upstreams, most likely their peers and upstreams will already accept the prefix now (since they're providing IP transit), so except for another source ASN they don't see any change. So from that perspective, risks are quite low.

If you made RPKI ROAs for your prefix, make sure to create additional ones so your prefix won't be marked as invalid by validating networks once you move the prefix.

4
  • Thanks for the response. Do I only have to worry about my immediate transit provider (who's announcing the prefix)'s peers or could some random ISP 4 hops down the line go "AS33333 is not allowed to originate that... reject!" – NOCWarrior980 Jun 2 '20 at 23:29
  • I can't answer that for every router on the internet of course, but typically network only filter what they receive form their peers. I have never seen networks do full AS path filtering for every prefix they receive using routing databases. What you're describing resembles what RPKI does, and if you don't have any ROAs published (or published correct ROAs for both situations) you have nothing to worry about. – Teun Vink Jun 3 '20 at 5:32
  • Thanks. In the interim period, when you updated the DB saying your carrier is advertising while you are still advertising did you have issues or did their providers respect the historical records. – NOCWarrior980 Jun 3 '20 at 12:26
  • To be clear: you just create two records: one for your current ASN and one for the ISP's ASN. As long as there is one correct entry, prefix filters generators will add the prefix to the list for networks to accept the prefix. So there won't be any problems. – Teun Vink Jun 3 '20 at 19:55
0

Wait more than 24-hours after performing the related IRR database update. I try to allow two calendar days for wiggle room.

I'd consider whether you are really going to simplify anything by doing this. What happens if you change providers at one of your locations? Suddenly, you have a new degree of complication and potential cause of outages, which is outside your control, which your provider(s) may insist on doing on their own schedule.

Many layer-3 switches support BGP. You can still reduce your equipment, etc. to simplify your sites as you describe.

3
  • Thanks. Would you recommend updating on ARIN itself or on radb.net? – NOCWarrior980 Jun 2 '20 at 22:23
  • I would check what your ISP is using and use that. Best chance that is what their upstreams are using to build their filters. – Teun Vink Jun 3 '20 at 5:33
  • Choose either ARIN or RADB and use whichever one for all your IRR objects. Don't use more than one IRR database unless you're sure what you're doing. RADB is better at providing technical help if you need it, but of course, you pay them a subscription fee for that privilege. – Jeff Wheeler Jun 3 '20 at 17:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.