<div dir="ltr">Dear Job,<div><br></div><div><div>First of all - I admire that huge ASes are ready to become pioneers and adopt new techniques to stop route propagation of bogon routes. Leading by example - is a perfect way to start curing current ecosystem of BGP.</div><div><br></div><div>But I have security consideration that filtering isn't a proper mechanism to reach this goal. Imagine next situation - if transit accidently prepends its paths with private AS number it will result in DoS for all stub networks connected to this transit. I think, better way is deprioritize bogon routes - this will stop propagation of such routes if there is any alternative and will not affect reachability in other cases.</div></div></div><div class="gmail_extra"><br><div class="gmail_quote">2016-06-02 22:43 GMT+03:00 Job Snijders <span dir="ltr"><<a href="mailto:job@ntt.net" target="_blank">job@ntt.net</a>></span>:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Dear fellow network operators,<br> <br> In July 2016, NTT Communications' Global IP Network AS2914 will deploy a<br> new routing policy to block Bogon ASNs from its view of the default-free<br> zone. This notification is provided as a courtesy to the network<br> community at large.<br> <br> After the Bogon ASN filter policy has been deployed, AS 2914 will not<br> accept route announcements from any eBGP neighbor which contains a Bogon<br> ASN anywhere in the AS_PATH or its atomic aggregate attribute.<br> <br> The reasoning behind this policy is twofold:<br> <br> - Private or Reserved ASNs have no place in the public DFZ. Barring<br> these from the DFZ helps improve accountability and dampen<br> accidental exposure of internal routing artifacts.<br> <br> - All AS2914 devices support 4-byte ASNs. Any occurrence of "23456"<br> in the DFZ is a either a misconfiguration or software issue.<br> <br> We are undertaking this effort to improve the quality of routing data as<br> part of the global ecosystem. This should improve the security posture<br> and provide additional certainty [1] to those undertaking network<br> troubleshooting.<br> <br> Bogon ASNs are currently defined as following:<br> <br> 0 # Reserved RFC7607<br> 23456 # AS_TRANS RFC6793<br> 64496-64511 # Reserved for use in docs and code RFC5398<br> 64512-65534 # Reserved for Private Use RFC6996<br> 65535 # Reserved RFC7300<br> 65536-65551 # Reserved for use in docs and code RFC5398<br> 65552-131071 # Reserved<br> 4200000000-4294967294 # Reserved for Private Use RFC6996<br> 4294967295 # Reserved RFC7300<br> <br> A current overview of what are considered Bogon ASNs is maintained at<br> NTT's Routing Policies page [2]. The IANA Autonomous System Number<br> Registry [3] is closely tracked and the NTT Bogon ASN definitions are<br> updated accordingly.<br> <br> We encourage network operators to consider deploying similar policies.<br> Configuration examples for various platforms can be found here [4].<br> <br> NTT staff is monitoring current occurrences of Bogon ASNs in the routing<br> system and reaching out to impacted parties on a weekly basis.<br> <br> Kind regards,<br> <br> Job<br> <br> Contact persons:<br> <br> Job Snijders <<a href="mailto:job@ntt.net">job@ntt.net</a>>, Jared Mauch <<a href="mailto:jmauch@us.ntt.net">jmauch@us.ntt.net</a>>,<br> NTT Communications NOC <<a href="mailto:noc@ntt.net">noc@ntt.net</a>><br> <br> References:<br> [1]: <a href="https://tools.ietf.org/html/draft-thomson-postel-was-wrong-00" rel="noreferrer" target="_blank">https://tools.ietf.org/html/draft-thomson-postel-was-wrong-00</a><br> [2]: <a href="http://www.us.ntt.net/support/policy/routing.cfm#bogon" rel="noreferrer" target="_blank">http://www.us.ntt.net/support/policy/routing.cfm#bogon</a><br> [3]: <a href="https://www.iana.org/assignments/as-numbers/as-numbers.xhtml" rel="noreferrer" target="_blank">https://www.iana.org/assignments/as-numbers/as-numbers.xhtml</a><br> [4]: <a href="http://as2914.net/bogon_asns/configuration_examples.txt" rel="noreferrer" target="_blank">http://as2914.net/bogon_asns/configuration_examples.txt</a><br> <br> </blockquote></div><br><br clear="all"><div><br></div>-- <br><div class="gmail_signature" data-smartmail="gmail_signature"><div dir="ltr"><div style="font-family:Helvetica;font-size:12px;border-collapse:collapse"><font color="#999999">| Alexander Azimov | HLL l QRATOR</font></div><div style="font-family:Helvetica;font-size:12px;border-collapse:collapse"><font color="#999999">| tel.: +7 499 241 81 92</font></div><div style="font-family:Helvetica;font-size:12px;border-collapse:collapse"><font color="#999999">| mob.: +7 915 360 08 86</font></div><div style="font-family:Helvetica;font-size:12px;border-collapse:collapse"><font color="#999999">| skype: mitradir</font></div><div style="font-family:Helvetica;font-size:12px;border-collapse:collapse"><font color="#999999">| mailto: <a href="mailto:aa@qrator.net" target="_blank">aa@qrator.net</a></font></div><div style="font-family:Helvetica;font-size:12px;border-collapse:collapse"><font color="#999999">| visit: <a href="http://www.qrator.net/" target="_blank">www.qrator.net</a></font></div></div></div> </div>