This archive is retained to ensure existing URLs remain functional. It will not contain any emails sent to this mailing list after July 1, 2024. For all messages, including those sent before and after this date, please visit the new location of the archive at https://mailman.ripe.net/archives/list/[email protected]/
[db-wg] Route(6) objects
- Previous message (by thread): [db-wg] Route(6) objects
- Next message (by thread): [db-wg] Route(6) objects
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]
Nick Hilliard
nick at foobar.org
Fri Jul 7 18:25:20 CEST 2023
Did your ddos provider say that their upstreams required exact route6 matches for your announcements? The bgp session between you and your DDOS provider definitely won't require this, and the likelihood is that a covering /32 route6: object will be sufficient in many cases for your provider's providers. I.e. you won't have serious connectivity problems if there aren't exact matches for your /48s. In any event, this isn't really catered for in RPSL. Some organisations implement strict filtering on route objects; others loose. RPKI might be a better option, as it allows you to specify a prefix length range. See RFC 9319 for some suggestions. Nick Kaupo Ehtnurm via db-wg wrote on 07/07/2023 16:11: > Hello > > Sorry, you didn't say. > But starting to manually advertise /48 to my DDoS protection provider beats the purpose of automatic DDoS protection. > > Lugupidamisega / Best regards, > > Kaupo Ehtnurm > > > Network & System administrator > WaveCom AS > ISO 9001 & 27001 Certified DC and verified VMware Cloud > kaupo at wavecom.ee | +372 5685 0002 > Endla 16, Tallinn 10142 Estonia | [ http://www.wavecom.ee/ | www.wavecom.ee ] > > ----- Original Message ----- > From: "Randy Bush via db-wg" <db-wg at ripe.net> > To: "Kaupo Ehtnurm via db-wg" <db-wg at ripe.net> > Sent: Friday, July 7, 2023 6:05:53 PM > Subject: Re: [db-wg] Route(6) objects > >> Here the problem is "for longer defensive prefixes" >> For example in normal situation I advertise /32 to my ip transit providers. >> When DDoS happens then one of my providers will start advertisin 1x/48 >> of my /32 prefix to hi-jack the route from us and filter it. > i did not say that your provider advertised, did i? > >>> By doing this the internet will always (also under normal >>> circumstances) prefer that one provider. >>> >>> 0 - register irr and rpki objects for aggregates and for longer >>> defensive prefixes >>> >>> 1 - announce only aggregates to both providers >>> >>> 2 - when ddosed, >>> - do not change announcement of aggregate to non-mediating >>> - deaggregate announcement to mediating provider >>> >>> 3 - when ddos ends, return to state 1 > randy > -------------- next part -------------- An HTML attachment was scrubbed... URL: </ripe/mail/archives/db-wg/attachments/20230707/3fbb3510/attachment.html>
- Previous message (by thread): [db-wg] Route(6) objects
- Next message (by thread): [db-wg] Route(6) objects
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]
[ db-wg Archives ]