Re: Destination-IP-Origin-AS Filter for BGP Flow Specification

Haibo,

On Tue, Nov 05, 2019 at 08:11:12AM +0000, Wanghaibo (Rainsword) wrote:
> PS: Netflow is already supporting statistical traffic based on Dest-IP-Origin-AS, it already download Dest-IP-Origin-AS to FIB entry, this prosess can be reused.

>From a forwarding perspective, this is the detail that bothers me.

Flowspec right now is currently independent of FIB state.  It functions on
the firewall layer, which is typically implemented prior to FIB.

What this feature implies is something roughly like:
Packet comes in, hits rule to check dst-as.
dst-as lookup needs to happen as one of:
- communicate to BGP routing process. (not likely to scale)
- trigger a FIB lookup, check returned dst-as.  Violates pipelining in many
  architectures.
- Have the entire FIB's dst-as-map pushed into memory for firewall,
  implement as a longest-match lookup on that collection.

-- Jeff

_______________________________________________
Idr mailing list
[email protected]
https://www.ietf.org/mailman/listinfo/idr