Wednesday, September 26, 2018

Dealing with "Forced Policy Based Routing" requests

Hello Redditors,

Here's the scenario:

  • Micro Datacenter provider (basically colo + internet transit using our own AS)
  • We have multiple IP blocks both v4 and v6 that we lease to our customers (or they can bring theirs and we broadcast via BGP under our own AS or allow them to peer with us so they use theirs)
  • We buy transit from 3 different major ISP (lets call them A, B, and C) and are also connected to 1 IX

All normal so far, the problem is, lately I've getting the following kind of requests that management wants applied no matter what:

If it was incoming traffic, no major issues, a combination of prepending or directly selectively withdrawing the prefixes would do the trick, but this is outbound traffic, for very specific subnets. Which the network was never meant to do, thus now we have the situation were I'm getting forced to do PBR routes on every single hop in our edge, to achieve what they want. I've tried to explain all the risks involved with this, specially considering the fact that I have to keep messing with key devices to get this done, but so far, they just say "make it work, the customer wants it".

It's not that we don't optimize the outgoing traffic, we actually keep monitoring and paying attention to latency or loss complains to adapt our global routing policies. Is that specific customers wants for whatever reason to use only a specific transit outbound.

Have you dealt with this before? what was your way to making management understand we must stop accepting those requests until the network is purpose built for such things?

I've also been thinking lately on how to achieve this, quick, simple and cleanly. So far my ideas are:

  1. Use a single edge router for each ISP (those routers will never peer with each other and will always prefer the local ISP routes) and then use "service routers" that our customers connect to, and do all the policy based routing in those service routers. Problem is the amount of peering we will need on each edge, can't use route-reflectors here, they'll then select the best route and we need to do that independantly on each service router
  2. Tell customers to gtfo because we're a transit with internal routing policies and if they want a specific transit outbound they should peer with them directly (yeah, bad business option...)
  3. Option number one but using VRFs so I can have multiple routes active by using different RDs (ISP-01 RD 65500:1, ISP-02 RD 65500-2, and so on). This allows me to use a RR

Is there any other way? am I overthinking this? do take into account that I know I'm not providing any network topology, so what I want to know is a way to achieve this by a redesign.



No comments:

Post a Comment