Re: DOs and DONTs for small ISP

[Brandon Martin <lists.nanog () monmotha net>]

On 6/3/19 9:56 AM, Jon Lewis wrote:
> 3) Don't advertise one transit provider's routes to another.  Each should
>     be filtering your routes, but you never know.  Come up with, and use
>     BGP communities to control route propagation.  As you grow, it sucks
>     having to update prefix-list filters in multiple places every time
>     something changes...like a new customer with their own IPs.

To reiterate all this, FILTER EVERYTHING.

To start with, explicitly specify in a route-map or similar everything 
you want to advertise.  I usually create a separate route-map for each 
transit/peer and include what I want to advertise via prefix lists (for 
my IP space) and/or communities (for downstream BGP-speaking customers 
if anticipated).

When you turn on the session, check what you're squawking AND WHAT 
YOU'RE FILTERING.  You shouldn't be filtering anything you don't expect. 
 Belt + suspenders.

The same goes for anything you accept.  Obviously for a blended full 
transit BGP edge router, you're probably going to accept almost 
everything.  But if you only want default + on-net, try to filter using 
communities from the peer, etc.  Again, right when you turn on the 
session, "sh ip bgp ... filtered" of whatever's equivalent on your 
platform.  If you're filtering something you don't expect to be 
receiving at all, figure out where the misunderstanding or 
misconfiguration lies.

And of course it goes without saying that, if you've got BGP speaking 
customers, you filter the heck out of them.  Use ROAs and/or RPKI if you 
can to automatically generate filter lists.  Encourage your upstreams to 
do the same if they're filtering you (and they probably are, or at least 
should be, if you're new).  Remember that you are responsible for every 
route you advertise, at the end of the day, even if you only advertised 
it because a downstream network made a boo-boo and you didn't filter it.

Filters are useful on your IGP, too, but there's so many ways to set all 
that up that it's a bit more difficult to come up with nearly universal 
best practices.  Generally speaking, be careful with redistribution, 
never distribute BGP into IGP or vice versa unless you have a really, 
really good reason to, and consider filters between both IGP 
areas/regions or protocols (e.g. RIP coming into OSPF) as well as on 
redistributions of static/connected to prevent simple typos on a static 
route or interface configuration from taking down more than just local 
stuff.

It's way, way easier to remove or relax filters later if they prove more 
of an operational hazard than asset than it is to add or tighten them if 
they prove insufficient.
--
Brandon Martin