AS5408 GR-NET Greek Research & Technology Network, http://www.grnet.gr

aut-num: AS5408
as-name: GR-NET
descr: Greek Research & Technology Network, http://www.grnet.gr
remarks:
+#######################################################################
+# ROUTING POLICY FOR GRNET (AS5408) #
+#######################################################################
+
+ GRNET BGP communities:
+ ========================
+
+ Well-defined communities:
+ +---------------------------------------------------------------+
+ | ...not much to say. Most important ones are: |
+ +---------------------------------------------------------------+
+ NO_EXPORT
+ NO_ADVERTISE
+
+ Informational Communities:
+ +---------------------------------------------------------------+
+ | These communities tag the source of the routes. They can ONLY |
+ | be appended by GRNET. Routes with this tag received by any |
+ | peer will be rejected! |
+ +---------------------------------------------------------------+
+ 5408:1001 Routes received from GEANT
+ 5408:1002 Routes received from AIX
+ 5408:1003 Routes received from GRNET Customers
+ 5408:1006 Routes receivied from AMSIX
+
+ Routing Manipulation:
+ +---------------------------------------------------------------+
+ | This set of communities are available to all GRNET clients |
+ | in order to allow them to manipulate their |
+ | routing: |
+ | |
+ | Primary/Backup Link selection: The customers can indicate |
+ | their primary or backup link by tagging the routes with |
+ | communities 5408:120 and 5408:110 respectively. Customers |
+ | that are single-homed to GRNET MAY omit 5408:120 on their |
+ | primary link. However, multi-homed customers (to GRNET and to |
+ | a third upstream) MUST use both communities. |
+ | |
+ | Prepending: GRNET clients can request prepending of AS5408 on |
+ | their AS PATH upon receval of the routes or before announcing |
+ | to AIX. |
+ | |
+ | Announcement Control: GRNET customers can prevent |
+ | their routes from being announced to GEANT and AIX by tagging |
+ | them with the appropriate community. |
+ +---------------------------------------------------------------+
+ 5408:120 Primary Link (Higher Local Preference)
+ 5408:110 Backup Link (Lower Local Preference)
+ 5408:2005 Prepend 5 times
+ 5408:3003 Prepend 3 times when announcing to AIX
+ 5408:3005 Prepend 5 times when announcing to AIX
+ 5408:4001 Don't announce to AIX
+ 5408:4005 Don't announce to GEANT
+ 5408:4006 Don't annouce to AMSIX
+
+ BlackHole, Rate-Limiting and other tools:
+ +---------------------------------------------------------------+
+ | This set of communities are available to all GRNET clients. |
+ | Blackhole community can be used to absorb |
+ | an attack to a specific host. Rate-limiting and TCP-SYN |
+ | rate-limiting can be used to restrict at attack to a small, |
+ | tolerable rate (the value may vary depending on GRNET |
+ | equipment, typical values are 1 Mbps and 8 kbps respectively. |
+ | LBE can be used to give Less than Best Effort treatment to |
+ | traffic destined towards a misbehaving (usually consuming too |
+ | much bandwidth) host. |
+ | IMPORTANT: These communities can only be used in combination |
+ | with "no-export", and can only be applied to /32 routes!!! |
+ +---------------------------------------------------------------+
+ 5480:666, no-export Blackhole traffic TOWARDS this route
+ (/32 only)
+ 5480:667, no-export Rate-Limit traffic TOWARDS this route
+ (/32 only)
+ 5480:668, no-export Rate-Limit TCP-SYN traffic TOWARDS this
+ route (/32 only)
+ 5480:7666, no-export Less then Best Effort (LBE) to traffic
+ TOWARDS this route (/32 only)
+
+ GRNET internal:
+ +---------------------------------------------------------------+
+ | These routes are intended for use only by specific GRNET |
+ | projects. They are not public and they MUST not be used by |
+ | non-intended Autonomous Systems. |
+ +---------------------------------------------------------------+
+ 5480:350-399 Reserved for QoS-QPPB via anstool
+ (anstool.grnet.gr). No-export may be
+ necessary for non-aggregated space
+ (see above).
+ 5480:555, no-advertise RTS-QOS (Teleteaching) (/32 only)
+
+
+
+ LOCAL PREFERENCES IN GRNET:
+ =============================
+
+ LocalPref 150: - AS112 anycast service, undependably of the
+ peering from where it is received. In this
+ manner, the closest source is selected.
+
+ LocalPref 120: - GRNET Customers (Default, or with 5408:120)
+ - Special Customers (KROOT, SYZEYXIS, IME,...)
+ - Multihomed GRNET customer routes
+ received from AIX/GEANT whith 5408:120
+ - Locally Generated GRNET Aggregates
+
+ LocalPref 110: - GRNET Customers with 5408:110
+ - Statically routed GRNET customers
+ (redistributed into BGP)
+
+ LocalPref 105: - AIX routes (not including multihomed GRNET
+ routes with 5408:120)
+
+ LocalPref 102: - AMSIX direct peering routes
+
+ LocalPref 100: - GEANT (MED=0 Primary, MED=20 Secondary)
+ - RTSQoS Project
+
+ LocalPref 98: -AMSIX route server routes
+ ######################################################################
+
+
remarks:
+=======================================================================
+ iBGP (AS5408)
+ ----------------------------------------------------------------------
+ PEER DESCRIPTION:
+ Full-mesh iBGP peerings.
+ Import Policy: Blackhole routes tagged with 6408:666
+ Export Policy: Advertize all routes (FIRT)
+ ======================================================================
import: from prng-as5408-ibgp
 accept ANY;
 REFINE {
 # Distributed black-hole routing
 from prng-as5408-ibgp
 accept community.contains(5408:666)
 AND community.contains(NO_EXPORT);
 # set next-hop = 192.168.0.1
 # Normal routes
 from prng-as5408-ibgp
 accept ANY;
 }
export: to prng-as5408-ibgp-part
 announce {193.0.0.0/21} OR
 AS5408:RS-ROUTES^0-24 OR
 AS5408:AS-GRNET-CUSTOMERS^0-24 OR
 AS5408:AS-GRNET-SPECIAL-AS^0-24 OR
 (<^AS-AIX> AND
 NOT community.contains(5408:1001) AND
 NOT community.contains(5408:1006));
export: to prng-as5408-ibgp
 announce ANY;
+ 
+ 
remarks:
+=======================================================================
+ GEANT (AS20965)
+ ----------------------------------------------------------------------
+ PEER DESCRIPTION:
+ GEANT is the Internet Upstream for GRNET
+ Import Policy: Accept all routes,
+ Set Local Preference 100 for primary, 90 for backup
+ Higher Local Preference for routes of multihomed
+ clients tagged with 5408:120
+ Export Policy: Announce all GRNET routes except from those tagged
+ with 5408:4005 (don't-announce-to-geant) and
+ aix routes (5408:1002).
+=======================================================================
import: from AS20965
 action pref=70; community.append(5408:1001);
 accept (AS112) AND
 NOT community.contains(5408:1002) AND
 NOT community.contains(5408:1003) AND
 NOT community.contains(5408:1006);
 REFINE {
 from AS20965 62.40.124.89
 accept ANY;
 from AS20965 62.40.124.141
 action med=20;
 accept ANY;
 }
import: from AS20965
 action community.append(5408:1001);
 accept {0.0.0.0/0^0-24} AND
 NOT community.contains(5408:1002) AND
 NOT community.contains(5408:1003) AND
 NOT community.contains(5408:1006);
 REFINE {
 from AS20965 62.40.124.89
 accept ANY;
 from AS20965 62.40.124.141
 action med=20;
 accept ANY;
 }
 REFINE {
 from AS20965
 action pref=100;
 accept community.contains(5408:120)
 AND AS5408:AS-MULTIHOMED^0-24;
 from AS20965
 accept ANY;
 }
export: to AS20965
 # action aspath.prepend(AS5408,AS5408,AS5408,AS5408,AS5408);
 announce (AS5408:RS-ROUTES^0-24 OR
 AS5408:AS-TO-GEANT^0-24)
 AND NOT community.contains(5408:1002)
 AND NOT community.contains(5408:1006)
 AND NOT community.contains(5408:4005);
remarks:
+=======================================================================
+ AMSIX direct and indirect peerings (through route servers)
+ ----------------------------------------------------------------------
+ PEER DESCRIPTION:
+ These are the direct and indirect peers in AMSIX of GRNET
+ Import Policy: Reject routes tagged with special communities
+ (5408:1001,5408:1002,5408:1003)
+ Accept all other routes that
+ (a) have the appropriate AS path and
+ (b) originate from the peer (or behind it)
+ For these, and according to the received communities:
+ (i) Set the appropriate local preference
+ (ii) Mark incoming routes with community 5408:1006
+ Export Policy: Announce all GRNET clients except from those
+ tagged with don't-announce-to-AMSIX (5408:4006). Also
+ double check that AIX/GRIX(5408:1002) & GEANT (5408:1001)
+ routes are not announced.
+=======================================================================
import: from AS15169
 action pref=118;
 community.append(5408:1006);
 community.append(5408:4001);
 community.append(5408:4005);
 accept AS-GOOGLE;
import: from AS6777
 action pref=122;
 community.append(5408:1006);
 community.append(5408:4001);
 community.append(5408:4005);
 accept ANY;
export: to AS15169
 announce (AS5408:RS-ROUTES^0-24
 OR AS5408:AS-TO-GEANT^0-24)
 AND NOT community.contains(5408:1001)
 AND NOT community.contains(5408:1002)
 AND NOT community.contains(5408:4006);
export: to AS6777
 action aspath.prepend(AS5408,AS5408,AS5408,AS5408,AS5408);
 announce (AS5408:RS-ROUTES^0-24
 OR AS5408:AS-TO-GEANT^0-24)
 AND NOT community.contains(5408:1001)
 AND NOT community.contains(5408:1002)
 AND NOT community.contains(5408:4006);
+ 
+ 
remarks:
+=======================================================================
+ GRIX & AIX Peers
+ ----------------------------------------------------------------------
+ PEER DESCRIPTION:
+ These are the GRIX & AIX Peers of GRNET
+ Import Policy: Reject routes tagged with special communities
+ (5408:1001,5408:1003)
+ Accept all other routes that
+ (a) have the appropriate AS path and
+ (b) originate from the peer (or behind it)
+ For these, and according to the received communities:
+ (i) Set the appropriate local preference
+ (ii) Prepend, if neccessary (5408:3003/5408:3005)
+ Routes of AIX clients which are also multihomed to
+ GRENT may receive elevated Local Preference, if they
+ are tagged with 5408:120.
+ --> AIX HAS A WORSE MED (20) <--
+ Export Policy: Announce all GRNET clients except from those
+ tagged with don't-announce-to-aix (5408:4001). Also
+ double check that AIX (5408:1002) & GEANT (5408:1001)
+ routes are not announced.
+=======================================================================
import: from AS-AIX # In case AS112 ever appears from AIX...
 action pref=70; community.append(5408:1002);
 accept (AS112) AND
 ( PeerAS:AS-TO-AIX^0-24
 OR PeerAS:RS-TO-AIX^0-24 ) AND
 NOT community.contains(5408:1001) AND
 NOT community.contains(5408:1003) AND
 NOT community.contains(5408:1006);
import: from AS-AIX
 action pref=115; community.append(5408:1002);
 accept NOT community.contains(5408:1001)
 AND NOT community.contains(5408:1003)
 AND NOT community.contains(5408:1006)
 AND (PeerAS:AS-TO-AIX^0-24
 OR PeerAS:RS-TO-AIX^0-24 )
 AND <^PeerAS>;
 REFINE {
 from AS-ANY
 action pref=100;
 accept community.contains(5408:120)
 AND AS5408:AS-MULTIHOMED^0-24;
 from AS-ANY accept ANY;
 }
 REFINE {
 from AS-ANY 83.212.8.0 # GRIX
 accept ANY;
 from AS-ANY 195.130.89.0 # AIX
 action med=20;
 accept ANY;
 }
export: to prng-as5408-aix
 announce (AS5408:RS-ROUTES^0-24
 OR AS5408:AS-TO-AIX^0-24)
 AND NOT community.contains(5408:1001)
 AND NOT community.contains(5408:1002)
 AND NOT community.contains(5408:1006)
 AND NOT community.contains(5408:4001);
 REFINE {
 to prng-as5408-aix
 action aspath.prepend(AS5408,AS5408,AS5408);
 announce community.contains(5408:3003);
 to prng-as5408-aix
 action aspath.prepend(AS5408,AS5408,AS5408,AS5408,AS5408);
 announce community.contains(5408:3005);
 to prng-as5408-aix announce ANY;
 }
export: to prng-as5408-grix
 announce (AS5408:RS-ROUTES^0-24
 OR AS5408:AS-TO-AIX^0-24)
 AND NOT community.contains(5408:1001)
 AND NOT community.contains(5408:1002)
 AND NOT community.contains(5408:1006)
 AND NOT community.contains(5408:4001);
 REFINE {
 to prng-as5408-grix
 action aspath.prepend(AS5408,AS5408,AS5408);
 announce community.contains(5408:3003);
 to prng-as5408-grix
 action aspath.prepend(AS5408,AS5408,AS5408,AS5408,AS5408);
 announce community.contains(5408:3005);
 to prng-as5408-grix announce ANY;
 }
+ 
+ 
remarks:
+=======================================================================
+ GRNET Clients
+ ----------------------------------------------------------------------
+ PEER DESCRIPTION:
+ These are the normal GRNET clients (Universities, Research orgs, etc)
+ Import Policy: Reject routes tagged with special communities
+ (5408:1001,5408:1002)
+ Accept all other routes that
+ (a) have the appropriate AS path and
+ (b) originate from the client (or behind it)
+ For these, and according to the received communities:
+ (i) Blackhole routes tagged with 6408:666
+ (cannot be described in RPSL, but it is implemented)
+ (ii) Set the appropriate local preference
+ (iii) Prepend, if neccessary (5408:3003/5408:3005)
+ Fragments of the RIPE route objects are only accepted
+ within GRNET (NO_EXPORT)
+ Local Preference (on backup links) can be lowered by
+ using the appropriate community (5408:110).
+ Export Policy: Announce:
+ (a) either all routes (FIRT)
+ (b) or a partial routing table, consiting of GRNET
+ normal and special clients.
+=======================================================================
import: from prng-as5408-grnet-customers
 action pref=100; community.append(5408:1003);
 accept NOT community.contains(5408:1001) AND
 NOT community.contains(5408:1002) AND
 NOT community.contains(5408:1006) AND
 community.contains(5408:666) AND
 community.contains(NO_EXPORT) AND
 (PeerAS^32 OR PeerAS:AS-TO-GRNET^32) AND
 <^PeerAS+PeerAS:AS-TO-GRNET*$>;
 # set next-hop = 192.168.0.1
import: from prng-as5408-grnet-customers
 action community.append(5408:1003);
 accept NOT community.contains(5408:1001) AND
 NOT community.contains(5408:1002) AND
 NOT community.contains(5408:1006) AND
 community.contains(NO_EXPORT) AND
 (PeerAS^0-32 OR PeerAS:AS-TO-GRNET^0-32)
 AND <^PeerAS+PeerAS:AS-TO-GRNET*$>;
 REFINE {
 from AS-ANY
 action pref=110;
 accept community.contains(5408:110);
 from AS-ANY
 action pref=100;
 accept ANY;
 }
import: from prng-as5408-grnet-customers
 action community.append(5408:1003);
 accept NOT community.contains(5408:1001) AND
 NOT community.contains(5408:1002) AND
 NOT community.contains(5408:1006) AND
 (PeerAS OR PeerAS:AS-TO-GRNET) AND
 <^PeerAS+PeerAS:AS-TO-GRNET*$>;
 REFINE {
 from AS-ANY
 action aspath.prepend(AS5408,AS5408,AS5408,AS5408,AS5408);
 accept community.contains(5408:2005);
 from AS-ANY accept ANY;
 }
 REFINE {
 from AS-ANY
 action pref=110;
 accept community.contains(5408:110);
 from AS-ANY
 action pref=100;
 accept ANY;
 }
export: to prng-as5408-grnet-firt
 announce ANY;
export: to prng-as5408-grnet-customers
 announce {193.0.0.0/21} OR
 AS5408:RS-ROUTES^0-24 OR
 AS5408:AS-GRNET-CUSTOMERS^0-24 OR
 AS5408:AS-GRNET-SPECIAL-AS^0-24 OR
 (<^AS-AIX> AND NOT community.contains(5408:1001));
+ 
+ 
remarks:
+=======================================================================
+ K-ROOT mirror @ AIX
+ ----------------------------------------------------------------------
+ PEER DESCRIPTION:
+ K-ROOT mirror @ AIX. Accept K-Root routes, announce default route
+=======================================================================
import: from AS25152
 action pref=100;
 community.append(5408:4005);
 community.append(5408:4006);
 community.append(5408:1002);
 accept {193.0.14.0/24, 195.251.59.0/28}
 AND NOT community.contains(5408:1001)
 AND NOT community.contains(5408:1003)
 AND NOT community.contains(5408:1006);
export: to AS25152
 announce {0.0.0.0/0^0};
+ 
+ 
remarks:
+=======================================================================
+ AS112 Project @ GRNET
+ ----------------------------------------------------------------------
+ PEER DESCRIPTION:
+ AS112 Project. Announce nothing; Elavate Local Pref for AS112 route.
+=======================================================================
import: from AS112
 action pref=70;
 community.append(5408:1003);
 accept (AS112) AND <^AS112+$> AND
 NOT community.contains(5408:1001) AND
 NOT community.contains(5408:1002) AND
 NOT community.contains(5408:1006);
export: to AS112
 announce NOT ANY;
+ 
+ 
remarks:
+=======================================================================
+ SYZEYXIS
+ ----------------------------------------------------------------------
+ PEER DESCRIPTION:
+ SYZEYXIS. announce GRNET routes, route within GRNET *only*.
+=======================================================================
import: from AS65052
 action pref=100;
 community.append(5408:1003);
 community.append(5408:4001);
 community.append(5408:4005);
 accept NOT community.contains(5408:1001) AND
 NOT community.contains(5408:1002) AND
 NOT community.contains(5408:1006) AND
 community.contains(5408:666) AND
 community.contains(NO_EXPORT) AND
 (AS65052^32) AND <^AS65052+$>;
 # set next-hop = 192.168.0.1
import: from AS65052
 action pref=100;
 community.append(5408:1003);
 community.append(5408:4001);
 community.append(5408:4005);
 accept NOT community.contains(5408:1001) AND
 NOT community.contains(5408:1002) AND
 NOT community.contains(5408:1006) AND
 (AS65052) AND <^AS65052+$>;
export: to AS65052
 announce AS5408:RS-ROUTES^0-24 OR
 AS5408:AS-GRNET-CUSTOMERS^0-24;
+ 
+ 
remarks:
+=======================================================================
+ AKAMAI
+ ----------------------------------------------------------------------
+ PEER DESCRIPTION:
+ AKAMAI. Accept no routes. Announce GRNET customers.
+=======================================================================
import: from AS21357
 accept NOT ANY;
export: to AS21357
 announce AS5408:RS-ROUTES^0-24 OR
 AS5408:AS-GRNET-CUSTOMERS^0-24
+ 
+ 
remarks:
+=======================================================================
+ ROUTE-COLLECTOR
+ ----------------------------------------------------------------------
+ PEER DESCRIPTION:
+ ROUTE-COLLECTOR. Accept no routes. Announce everything
+=======================================================================
import: from AS65501
 accept NOT ANY;
export: to AS65501
 announce ANY;
+ 
+ 
remarks:
+=======================================================================
+ IME
+ ----------------------------------------------------------------------
+ PEER DESCRIPTION:
+ IME. announce GRNET routes, route within GRNET *only*.
+=======================================================================
import: from AS65001 ####### TEMP AS!!!! ########
 action pref=100;
 community.append(5408:1003);
 community.append(5408:4001);
 community.append(5408:4005);
 accept NOT community.contains(5408:1001) AND
 NOT community.contains(5408:1002) AND
 NOT community.contains(5408:1006) AND
 community.contains(5408:666) AND
 community.contains(NO_EXPORT) AND
 (AS65001^32) AND <^AS65001+$>;
 # set next-hop = 192.168.0.1
import: from AS65001
 action pref=100;
 community.append(5408:1003);
 community.append(5408:4001);
 community.append(5408:4005);
 accept NOT community.contains(5408:1001) AND
 NOT community.contains(5408:1002) AND
 NOT community.contains(5408:1006) AND
 (AS65001) AND <^AS65001+$>;
export: to AS65001
 announce AS5408:RS-ROUTES^0-24 OR
 AS5408:AS-GRNET-CUSTOMERS^0-24;
+ 
+ 
remarks:
+=======================================================================
+ GRNET RTS QOS Project (AS65500)
+ ----------------------------------------------------------------------
+ PEER DESCRIPTION:
+ RTS-QoS Project.
+ Accept all grnet /32 routes with '5408:555 no-advertise' community
+ Announce nothing.
+=======================================================================
import: from AS65500
 action community.append(5408:555);
 community.append(NO_ADVERTISE);
 accept AS5408:RS-ROUTES^0-32 OR
 AS5408:AS-GRNET-CUSTOMERS^0-32;
export: to AS65500
 announce NOT ANY;
+ 
remarks:
+#######################################################################
+# END OF ROUTING POLICY FOR GRNET #
+#######################################################################
+
admin-c: GN1931-RIPE
tech-c: GN1931-RIPE
mnt-by: GRNET-NOC
source: RIPE
changed: alioumis(at)noc.grnet.gr 20091007

Peer and upstream distribution

Brief information