Re: [c-nsp] RPKI extended-community RFC8097

2020-12-19 Thread Saku Ytti
On Sat, 19 Dec 2020 at 13:45, Lukas Tribus wrote: > soft-reconfig inbound always amounts to 100 MB of memory consumption > for a v4 + v6 full feed as of last week on 32-bit XR. I can live with > 100MB of memory consumption per full feed, so I'm doing soft-reconfig > inbound always everywhere. Thi

Re: [c-nsp] RPKI extended-community RFC8097

2020-12-19 Thread Lukas Tribus
Hello Jakob, On Fri, 18 Dec 2020 at 07:58, Jakob Heitz (jheitz) wrote: > > Hi Lukas, Mark, Ben, > > The default bestpath prefix-validate behavior treats invalid routes > as unfeasible and prefers valid routes over not-found. > > The default bestpath prefix-validate behavior cannot be used unless

Re: [c-nsp] RPKI extended-community RFC8097

2020-12-19 Thread Lukas Tribus
On Sat, 19 Dec 2020 at 10:40, Gert Doering wrote: > > Hi, > > On Sat, Dec 19, 2020 at 10:13:36AM +0100, Robert Raszuk wrote: > > See even if you validate in route map you may just mark it not-eligible or > > set higher local pref for VALID etc I am not sure how anyone could > > come with the

Re: [c-nsp] RPKI extended-community RFC8097

2020-12-19 Thread Gert Doering
Hi, On Sat, Dec 19, 2020 at 11:02:16AM +0100, Robert Raszuk wrote: > > As far as I know, no way to set "ineligible" from a route-map. Is there? > > A workaround could be to set unreachable next hop instead of dropping :) > That automatically disables such path from best path comparison yet it >

Re: [c-nsp] RPKI extended-community RFC8097

2020-12-19 Thread Robert Raszuk
> As far as I know, no way to set "ineligible" from a route-map. Is there? A workaround could be to set unreachable next hop instead of dropping :) That automatically disables such path from best path comparison yet it keeps in BGP. But as said implementation could make it easier with a knob. T

Re: [c-nsp] RPKI extended-community RFC8097

2020-12-19 Thread Gert Doering
Hi, On Sat, Dec 19, 2020 at 10:13:36AM +0100, Robert Raszuk wrote: > See even if you validate in route map you may just mark it not-eligible or > set higher local pref for VALID etc I am not sure how anyone could > come with the idea to just drop there. In the face of invalid more-specifics,

Re: [c-nsp] RPKI extended-community RFC8097

2020-12-19 Thread Mark Tinka
On 12/19/20 11:13, Robert Raszuk wrote: Jakob, It has been a while, but IIRC the original idea for the validation was that regardless if this is done by configuration enabling pre-best path eligibility or in route map no path will be dropped. At no point in the BGP design discussions there

Re: [c-nsp] RPKI extended-community RFC8097

2020-12-19 Thread Mark Tinka
On 12/19/20 10:45, Saku Ytti wrote: I think the community largely got blindsided by this, I suspect marketability of the whole solution would have been a lot poorer if this argument was thrown around at standardisation. However, that ship has sailed, we can implement new cheaper methods, but

Re: [c-nsp] RPKI extended-community RFC8097

2020-12-19 Thread Robert Raszuk
Jakob, It has been a while, but IIRC the original idea for the validation was that regardless if this is done by configuration enabling pre-best path eligibility or in route map no path will be dropped. At no point in the BGP design discussions there was a plan to automatically do any of this. So

Re: [c-nsp] RPKI extended-community RFC8097

2020-12-19 Thread Ben Maddison via cisco-nsp
--- Begin Message --- Hi Jakob, On 12/18, Jakob Heitz (jheitz) wrote: > There is an issue with route-maps. > > Testing the RPKI validity in route-map causes BGP REFRESH messages. > Lots of them. > soft-reconfig helps, but that causes risk of memory exhaustion and does > not fix the internal CPU u

Re: [c-nsp] RPKI extended-community RFC8097

2020-12-19 Thread Saku Ytti
On Fri, 18 Dec 2020 at 22:07, Jakob Heitz (jheitz) via cisco-nsp wrote: > Testing the RPKI validity in route-map causes BGP REFRESH messages. > Lots of them. I think the community largely got blindsided by this, I suspect marketability of the whole solution would have been a lot poorer if this a