Understanding Route Redistribution
Franck Le Geoffrey G. Xie Hui Zhang Carnegie Mellon University Naval Postgraduate School Carnegie Mellon University [email protected] [email protected] [email protected]
Abstract—Route redistribution (RR) has become an integral option local to a router. It designates the dissemination of part of IP network design as the result of a growing need routing information from one protocol process to another for disseminating certain routes across routing protocol bound- within the same router. For routers in the RIP instance to learn aries. While RR is widely used and resembles BGP in several nontrivial aspects, surprisingly, the safety of RR has not been the prefixes in the OSPF instance, a router (e.g., D or E) needs systematically studied by the networking community. This paper to run both a process of RIP and a process of OSPF and inject presents the first analytical model for understanding the effect the OSPF routes into the RIP instance. of RR on network wide routing dynamics and evaluating the As such, router vendors introduced RR to address a need safety of a specific RR configuration. We first illustrate how from network operations. We recently looked at the configura- easily inaccurate configurations of RR may cause severe routing instabilities, including route oscillations and persistent routing tions of some large university campus networks and found that loops. At the same time, general observations regarding the root RR is indeed widely used. However, contrary to traditional causes of these instabilities are provided. We then introduce a routing protocols, there is no standard or RFC formally formal model based on the general observations to represent defining the functionality of RR. Significant efforts are usually and study the safety of route redistribution. Using the model, we associated with the design and analysis of a routing protocol to prove that given a RR configuration, determining whether the redistributions result in a cycle is NP-hard. Given this complexity, ensure its correctness and stability but the specification of RR we present a sufficient condition, which can be checked in did not receive as much attention. Consequently, RR is often polynomial time with the proposed analytical model, for ensuring misconfigured leading to sub-optimal routing and even severe the safety of a RR configuration. Finally, the paper proposes instabilities such as route oscillations and persistent routing potential changes to the current RR protocol to guarantee safety. loops. The risks of route redistribution have been acknowledged I. INTRODUCTION by router vendors and network operators, but there is currently Recent studies show that some enterprise networks rival no general guideline to configure RR correctly. Solutions are carrier networks in terms of scale and complexity of routing developed on an ad-hoc basis for specific situations [3] but design [1]. One may even argue that because of a more most existing solutions do not satisfy network design goals. dynamic business environment fueled by acquisitions and RR has two main objectives. The first one is to propagate mergers, large enterprise networks may be more difficult to routing information between different routing instances for control and manage than carrier networks. One source of this connectivity purposes as described earlier. The second objec- difficulty stems from the fact that the routing structure of a tive is route back up: in the event of a network failure (e.g., large enterprise network typically consists of multiple domains link B-C of Figure 1 being down), routing instances should or routing instances [1]. Routing instances form for many provide alternate forwarding paths to each other (e.g., router reasons. Company acquisitions, departments administered by C should still be able to reach router A through the C-E-F - different teams, and multi-vendor equipments may lead to D-A path.) However, to avoid route oscillations and routing such situations [2]. Alternatively, network administrators may loops, according to current vendor recommendation [2], a intentionally create separate routing instances to filter routes, route received from a routing instance must not be re-injected limit reachability and enforce policies [3]. back into that same instance. Such a strong restriction pre- Routers within one routing instance typically run the same vents domain back-up. In addition, most of existing solutions routing protocol to fully share reachability information and apply to scenarios with only two routing instances, but large they by default do not exchange routing information with operational networks often include more than two routing routers in other routing instances. Consider the network de- instances [1]. picted in Figure 1. It consists of two routing instances. Routers In short, RR has become an integral part of IP network in the RIP instance do not have visibility of the addresses and design but its stability seems sensitive to network failures and subnet prefixes in the OSPF instance and vice versa. To allow configuration errors. To the best of the authors’ knowledge this the exchange of routing information between different routing paper is the first to analyze route redistribution and attempt to instances, router vendors have introduced a feature called route identify the origins of the observed instabilities. Our work is redistribution. Route redistribution (RR) is a configuration based on two key insights. First, we observe that the way RR effects the flow of routes is very similar to that of a 1Minor revisions, February 9, 2008. distance vector routing protocol, albeit with a larger scope In Proceedings of ICNP’07, Beijing, China. RIP OSPF Routing Instance 1 Routing Instance 2 RIP OSPF 27
Router A Router D Router G
Local Routing Routing Routing Local RIB Process Process Process RIB (e.g., RIB RIB RIB (e.g., Router B Router F Static) (RIP) (OSPF 27) (OSPF 27) Connec −ted)
Router’s FIB Router’s FIB Router E Router H Router C Router D Router G
Fig. 1. An example enterprise network that consists of two routing instances. Fig. 2. Router’s route selection procedure. Router D may need to perform Without route redistribution, the routers in the RIP instance do not have route selection among three routing processes while G may need to select knowledge of the destinations in the OSPF instance, and vice-versa. between two. D and G belong to the same OSPF routing instance. since the routes are passed between routing instances. Second, routes to a same destination prefix. Upon creation, each routing the policy-based functionality of RR makes it resemble BGP process is assigned a protocol-specific default administrative in several nontrivial ways. distance. For example, the default administrative distance (AD) The rest of the paper is organized as follows. Section II is 110 for OSPF and 120 for RIP. The administrator may provides a tutorial of the concepts related to the RR procedure. override the default AD of a protocol, according to local policy Section III illustrates some of the instabilities that route and on a per-router per-prefix basis, as part of the protocol redistribution can cause. Section IV introduces a model to configuration. The administrative distance values are local to abstract the dynamics of the RR procedure. The model helps a router and are not propagated in any signaling message. to identify the formation of route oscillations and persistent Among the routing processes announcing a route to P , the routing loops as will be demonstrated in Section V. In Section one with the lowest administrative distance will be selected. VI, we show that determining whether a configuration of We will refer to it as the selected routing process for P and the route redistribution can converge to a state containing a cycle route subsequently installed in the FIB the active route for P . is NP-hard. This complexity has motivated us to develop a If multiple processes present the same lowest administrative sufficient condition for RR safety. The result is presented in distance, the router picks one of them using a nondeterministic Section VI. Finally in Section VII, we propose a set of changes and vendor-specific algorithm. Fig. 2 illustrates the adminis- to the RR procedure itself aimed at creating a protocol that is trative distance based route selection procedure on two routers inherently safe, i.e., free of instabilities even if misconfigured. (D and G in the enterprise network shown in Fig. 1). Router D has three concurrent routing processes: OSPF, RIP, and II. BACKGROUND the built-in process for handling local static routes or direct Although a router may run multiple routing protocols at the connected subnets. When the OSPF and RIP processes present same time, it forwards packets according to routes stored in independent routes to P at the same time, the router will select a protocol-agnostic table called Forwarding Information Base the route from the OSPF processs because of its lower AD (FIB). Routing instabilities such as oscillations and loops are value (110 vs. 120). always the consequence of some routers installing some wrong routes in their FIBs. As background information for the rest of B. Route Redistribution the paper, this section briefly explains how a router populates A router running multiple routing processes does not by its FIB and describes the role of route redistribution in that default redistribute routes among these processes. Route redis- procedure. Without loss of generality, all discussions are with tribution (RR) must be explicitly configured. The RR configu- respect to a single destination prefix, denoted by P , unless ration and operation can be complex. Contrary to most routing noted otherwise. protocols which optimize a metric, RR is driven by policies, making it very similar to BGP. As in BGP, access control A. Route Selection lists can be applied and tags can be assigned to the different A router that runs multiple routing protocols actually in- prefixes. In Cisco, route-map allows network administrators stantiates a separate routing process for each protocol. Each to filter the routes, prioritize the received announcements instantiated routing process has its own Routing Information (by assigning different AD values) and modify the attributes Base (RIB) to store protocol-specific routing information. of the redistributed routes. Figure 3(a) provides an example These processes may offer routes to P at the same time and of a Cisco configuration redistributing routes from a RIP the router then must select one of the routes to include in process into an OSPF one. The route-map statements filter the the FIB. To add flexibility to the selection procedure, router route and modify the attributes of the redistributed routes. In vendors have introduced a configurable integer parameter per- Juniper routers, RR is specified through routing policies (i.e., routing process, called administrative distance [4], to facilitate import and export statements). Figure 3(b), extracted from [5], a logic for ranking a set of routing processes that supply provides an example of a JUNOS configuration redistributing
2 router ospf 27 policy−statement rip−2−ospf { redistribute rip metric 200 subnets from protocol rip; Routing Routing route−map rip−2−ospf then { Instance 1 Instance 2 Router C distance ospf external 200 metric 5; RIP (120) OSPF (110) Workgroup Switch ! accept; CiscoSystems Catalyst route−map rip−2−ospf permit 10 } match ip address 100 } set metric−type type−1 } Router B set tag 22 Router E Workgroup Switch Workgroup Switch CiscoSystems Catalyst ospf { Catalyst CiscoSystems export rip−2−ospf; } (a) (b) Router D Router A Routing Workgroup Switch Workgroup Switch CiscoSystems Catalyst CiscoSystems Catalyst Instance 3 Fig. 3. (a) Excerpt of a Cisco RR configuration for router D of the example IGRP (100) enterprise network. The “redistribute” command enables RR from the RIP process into the OSPF process. A route-map is applied to enforce policies. E (b) Excerpt of a Juniper RR configuration for router of the same network. Fig. 4. Scenario 1. The network consists of three routing instances and routers C, E and D are performing mutual route redistribution. The values the routes from a RIP process into an OSPF one. in brackets represent the AD of the routing instances. When configuring a route redistribution, a number of per- route parameters are involved. A metric value is assigned have a profound impact on how the network as a whole to each new route in the target routing process (i.e., the populates the FIBs. process that receives the route). The metric can be manually III. ILLUSTRATION OF ROUTING INSTABILITIES configured. If not specified, a default value is assigned to the redistributed route. The value of the metric is important since Inaccurate RR configurations can cause sub-optimal routing, the target routing process may disseminate a redistributed route route oscillations and routing loops. This section illustrates the to other routers within the same routing instance and when two latter issues. For the other instabilities, please see [2] and that happens the value of the metric may influence the router [3]. We have validated all the described scenarios (including selection outcomes at these routers. Additional route attributes the permanent oscillations in section V) – with the exception can be specified depending on the target routing process. As an of scenario 2 (section III-B). It was difficult to create the example, in OSPF, a route can be injected either as a Type 1 or required race conditions. The validation environment consisted Type 2 route. Each route type presents its own properties [6]. of 5 routers (Cisco 2600, IOS Version 12.2). All these attributes affect the route selection (within a routing A. Scenario 1: Persistent Routing Loop instance) and when misconfigured can cause instabilities as The first scenario is a network composed of three routing illustrated in the subsequent sections. processes (see Figure 4). The experiment revealed a persistent While RR is a complex, policy-driven vector protocol like routing loop because of route redistribution. BGP, there is no RFC or other form of standards about it. The example network can be that of a company with three Vendor Web sites or manuals usually only provide guidelines office branches, each running their own routing instance. and sample configuration files. It took us many hours of A separate group may administer each site. RR is enabled reading and experimentation to identify the following two between every two routing instances to allow connectivity very basic operational characteristics of RR. First, a route is between the sites, and every redistributing router performs redistributed only if it is active, i.e., present in the router’s FIB. mutual RR so that the routing instances can backup each other Consequently, RR is not a transitive operation. For example, in the event of network failure. let’s consider a router running three routing processes X, Y We consider a prefix P connected to router A and redis- and Z. Suppose that redistributions from X to Y and from tributed into the RIP instance. Alternatively, P can be origi- Y to Z are configured. If initially no route to P exists in the nated from another RIP router or injected into RIP through FIB and the router learns a route to P through X, the route other means including BGP. The following describes the is redistributed into Y . However, the route will not be further sequence of observed events that caused a persistent routing redistributed into Z from Y because Y is not the selected loop for packets sent to destinations in P . process for P . Second, a router seems able to differentiate We use the following notation throughout the paper: routing locally redistributed routes from routes that routing processes instances are numbered (1, 2, ...), routers are labeled (A, B, learn from their protocol operations. Routes redistributed from ...), and routing processes are denoted by
3 its FIB, preferring the route from 2. Consequently, Routing Routing D (respectively, C) stops announcing the route into Instance 2 Instance 1 Router C 2 but redistributes the route from 2 to 1. Workgroup Switch CiscoSystems Catalyst OSPF (110) RIP (120) t3 Because both routers cease to advertise the route into
Router B Router E 2, this routing instance no longer has a route to the Workgroup Switch Workgroup Switch CiscoSystems Catalyst CiscoSystems Catalyst destination. t4 C and D only have one way to reach the destination Router A Router D
Workgroup Switch Workgroup Switch Catalyst (i.e., through C.1 and D.1). Therefore, they each CiscoSystems Catalyst CiscoSystems update their FIB and redistribute the route from 1 into 2. Noting that the states at (t1) and (t4) are identical, the route Fig. 5. Routers C and D are performing mutual route redistribution. The oscillates between the two routing instances. redistribution can result in persistent routing loops (C-B-D-E-C) for prefixes One may argue that such oscillations, even though possible, originated from the RIP domain or injected into the RIP domain (e.g., through are not likely to occur in practice. For these oscillations to router A) happen, the signaling messages from the redistributing routers RIP into IGRP (i.e., D.1 into D.3). must be processed in a specific sequence order. Routers’ load, t4 C’s FIB presents a route to P . The installed route link delay and other factors will most probably disrupt this is from OSPF (i.e., C.2) and E is the next-hop: C synchronization putting an end to the oscillation. We later receives two routes from RIP (from B) and OSPF show that RR can actually cause permanent route oscillations, (from E). Since OSPF presents a lower AD (110 vs. independent of any race conditions. 120), the latter route is selected. ODEL FOR OUTE EDISTRIBUTION t5 As B receives the route from A and the redistributed IV. A M R R one from C, we observe 2 cases. To analyze RR, we introduce a model consisting of three • If the route from C presents a lower metric, C distinct components – 1) Per-Router Route Selection and RR becomes the next-hop, causing a routing loop Logics, 2) Route Propagation Graph, and 3) Network-wide RR (B-C-E-D-B). Logic. The first component abstracts the router behavior. We • If the route from A presents a lower metric, A introduce two logics corresponding to the local route selection remains the next-hop resulting in a sub-optimal and RR procedures. These logics enable the derivation of the path (D, E, C, B, A) from D to A. actual active routes and of the routes that are redistributed at When repeating the experiment, the loop sometimes formed each redistributing router. While these logics provide a local in the opposite direction (B-D-E-C-B) because of a different view of the operations at each router, we also need a global order of routing message arrivals. view of the interactions between the redistributing routers in This configuration consisted of three routing instances. order to determine the paths taken by the data traffic from However, networks with only two routing instances can be each routing instance. To analyze the exchange of routing vulnerable as well. The configuration in Figure 5 shows an information between the redistributing routers, we propose a example. The network may be migrating from RIP to OSPF. second component of the model – the route propagation graph. Mutual redistribution is performed at two redistributing routers This graph provides a global view of the routing instances to exchange routing information and to allow domain back up. present in a network and their RR configuration. Finally, an When C first redistributed the route from C.1 into C.2, D integration of the two previous components produces the third received two choices and preferred D.2 because of the lower component – a network-wide RR logic. This last component AD. Then, D redistributed D.2 into D.1 and B switched to models the dynamic exchange of routing information between use D as its next-hop when the redistributed route had a lower the routers and consequently allow us to predict the paths metric value, resulting in a routing loop C-B-D-E-C. taken by the data packets. Understanding these data flows can reveal the formation of oscillations, routing loops and other B. Scenario 2: Route Oscillation instabilities. The configuration in Figure 5 can also experience severe The model applies to existing routing protocols with the route oscillations. [3] describes a similar scenario and explains exception of BGP because both the route selection and route that the following hypothetical sequence of events can cause redistribution logics of this protocol differ from those of other route flapping. If C and D simultaneously redistribute P into routing protocols. In terms of route selection logic, BGP routing process 2 and then update their FIB at the “same” processes first look at the BGP AS PATH parameter to decide time, the route flaps between the 2 routing instances: whether to consider a route whereas other routing protocols t1 C (respectively, D) learns a route from C.1 (respec- consider all incoming routes. BGP’s route redistribution logic tively, D.1). C (respectively, D) redistributes P from also differs from that of other routing protocols: each vendor C.1 into C.2 (respectively, from D.1 into D.2.) has defined its own set of proprietary options for redistributing t2 D (respectively, C) receives two routes from 1 and 2. BGP from and into existing IGPs [7], [8], [9]. As the AD of 2 is lower, D (respectively, C) updates The proposed model could be extended to include BGP, but
4 ROUTE SELECTION LOGIC RR LOGIC 6: selected-process(P) ← x Filters Filters Routing Routing Routing 7: selected-process(P).ad ← x.ad Process Process Process RIB 8: Select best route from selected-process(P) (according Filters Filters Routing Routing Routing to metric) and install it in F IB
Process AD based Selection
Process Redistribution Process RIB 9: active-route(P) ← selected best route FIB 10: end if 11: end for Filters Filters Routing Routing Routing Then, the router redistributes the active route according to Process Process Process RIB the RR logic. Filters Local Routing Route Process (e.g., static) RIB Procedure RR at router r
Fig. 6. Per-router route selection and route redistribution logics. A router 1: for all routing process y ∈ RP such that redistribution of first selects the preferred routing process based on the AD values. Then, it P from selected-process(P) to y is enabled do installs the best route in the FIB, and redistributes the active route according 2: if permitted by RR filter between the two processes to the configured policies. then we decide to set aside this protocol to keep the model simple. 3: redistribute active(P ) into y, and 4: set route attributes according to the RR filter A. The Per-Router Route Selection and RR Logics 5: end if A router’s operations related to RR can be decomposed into 6: end for two main steps (see Figure 6). First, the router selects the best It is important to note that a redistributed route is marked 1 route according to the route selection logic , and installs it in with the local FIB as the source of the route or stored outside the FIB. A routing process possesses a route to P in its RIB the target process’s regular RIB, and as such it will not either because it has originated the prefix or because it has be offered back to the same FIB. For the same reason, a received a route advertisement from a neighbor router and the redistributed route will be removed if the original active route route has passed the import filter(s) configured for this routing is no longer present in the FIB. process. Among the routing processes offering a route to P , the router chooses the one with the lowest AD. And, within B. The Route Propagation Graph this selected routing process, the router picks the best route. To analyze RR, we extend the routing instance graph, The installed route is also called the active route. Then, the introduced in [1] to represent the network-wide static RR router redistributes the active route according to the RR logic. configuration among routing instances. The following route selection logic is triggered either when We define a weighted directed graph G =
5
£¡£¡£¡£
¤¡¤¡¤¡¤
£¡£¡£¡£
¤¡¤¡¤¡¤ £¡£¡£¡£
¤¡¤¡¤¡¤ originating routing
£¡£¡£¡£
¤¡¤¡¤¡¤ £¡£¡£¡£
¤¡¤¡¤¡¤ in the RR graph for a specific activation sequence. The
£¡£¡£¡£
¤¡¤¡¤¡¤
£¡£¡£¡£ ¤¡¤¡¤¡¤ process Instance 2 network-wide RR logic uses a variable called candidate-list, C OSPF CL, for storing the list of all routers from R to be activated, (110)
S
¡ ¡ ¡ ¡ ¡ ¡ ¡ ¡ ¡ and another variable for tracking the subset of routers
¢¡¢¡¢¡¢¡¢¡¢¡¢¡¢¡¢¡¢
¡ ¡ ¡ ¡ ¡ ¡ ¡ ¡ ¡
¢¡¢¡¢¡¢¡¢¡¢¡¢¡¢¡¢¡¢ ¡ ¡ ¡ ¡ ¡ ¡ ¡ ¡ ¡
¢¡¢¡¢¡¢¡¢¡¢¡¢¡¢¡¢¡¢ C
¡ ¡ ¡ ¡ ¡ ¡ ¡ ¡ ¡
¢¡¢¡¢¡¢¡¢¡¢¡¢¡¢¡¢¡¢
¡ ¡ ¡ ¡ ¡ ¡ ¡ ¡ ¡
¢¡¢¡¢¡¢¡¢¡¢¡¢¡¢¡¢¡¢
¡ ¡ ¡ ¡ ¡ ¡ ¡ ¡ ¡
¢¡¢¡¢¡¢¡¢¡¢¡¢¡¢¡¢¡¢ ¡ ¡ ¡ ¡ ¡ ¡ ¡ ¡ ¡
¢¡¢¡¢¡¢¡¢¡¢¡¢¡¢¡¢¡¢ activated at each time step. We represent actual route
¡ ¡ ¡ ¡ ¡ ¡ ¡ ¡ ¡ ¢¡¢¡¢¡¢¡¢¡¢¡¢¡¢¡¢¡¢
¡ ¡ ¡ ¡ ¡ ¡ ¡ ¡ ¡ Instance 1
¢¡¢¡¢¡¢¡¢¡¢¡¢¡¢¡¢¡¢ ¡ ¡ ¡ ¡ ¡ ¡ ¡ ¡ ¡
¢¡¢¡¢¡¢¡¢¡¢¡¢¡¢¡¢¡¢ E E
¡ ¡ ¡ ¡ ¡ ¡ ¡ ¡ ¡
¢¡¢¡¢¡¢¡¢¡¢¡¢¡¢¡¢¡¢ ¡ ¡ ¡ ¡ ¡ ¡ ¡ ¡ ¡
¢¡¢¡¢¡¢¡¢¡¢¡¢¡¢¡¢¡¢RIP ¡ ¡ ¡ ¡ ¡ ¡ ¡ ¡ ¡
¢¡¢¡¢¡¢¡¢¡¢¡¢¡¢¡¢¡¢ redistribution events by solid edges. A redistribution edge
¡ ¡ ¡ ¡ ¡ ¡ ¡ ¡ ¡
¢¡¢¡¢¡¢¡¢¡¢¡¢¡¢¡¢¡¢
¡ ¡ ¡ ¡ ¡ ¡ ¡ ¡ ¡
¢¡¢¡¢¡¢¡¢¡¢¡¢¡¢¡¢¡¢ ¡ ¡ ¡ ¡ ¡ ¡ ¡ ¡ ¡
¢¡¢¡¢¡¢¡¢¡¢¡¢¡¢¡¢¡¢(120) ¡ ¡ ¡ ¡ ¡ ¡ ¡ ¡ ¡
¢¡¢¡¢¡¢¡¢¡¢¡¢¡¢¡¢¡¢ D ¡ ¡ ¡ ¡ ¡ ¡ ¡ ¡ ¡
¢¡¢¡¢¡¢¡¢¡¢¡¢¡¢¡¢¡¢ ¡ ¡ ¡ ¡ ¡ ¡ ¡ ¡ ¡ ¢¡¢¡¢¡¢¡¢¡¢¡¢¡¢¡¢¡¢ changes from dashed to solid, i.e., is activated, if (1) the route Instance 3 to be redistributed is active and (2) the policy configured D IGRP (100) for that edge permits this route to be redistributed. Also, we represent the data paths by thick solid arrows. Finally, a Fig. 7. Illustration of the route propagation graph of the network in scenario routing instance colored in white indicates that it does not 1. The values in brackets indicate the default AD of the routing instances. have a route to P , whereas a routing instance colored in dark In addition, for every router r ∈ R, we need to represent means that the routing instance does. all the routing processes running on r, including the ones that are not part of the RR configuration. The reason is that these Procedure Network-wide RR routing processes affect the route selection and RR logics. For Initialization example, consider a router r running three routing processes 1: t = 0 x, y, and z. Even though the redistribution from x into y is 2: Insert the redistributing routers that have an edge either enabled, x may not redistribute any route into y when z is the from or to an originating vertex into CL. selected routing process at r. A routing process of r which Main loop participates in routing instance w but is not part of the RR 1: while CL 6= EMPTY SET do configuration is represented by an edge from w to w marked 2: t++ by r (Figure 10). 3: Remove a subset S of routers from CL It is important to note that each vertex is a routing instance, 4: for all router r ∈ S concurrently do but a router deals with routing processes, each of which is a 5: Execute route-selection logic at r member of a routing instance. When a route is redistributed 6: if r’s selected routing process has changed then into a routing instance, every routing process of that instance 7: //let r.u denotes the new selected routing process should eventually receive an advertisement of that route. 8: De-activate all edges labeled r The RR graph of the network in Figure 4 is illustrated in 9: if there is no configured redistribution from nor to Figure 7. The dashed edge from RIP to OSPF, labeled C, r.u then indicates that router C is configured to redistribute P from 10: Activate edge
6 other than u pointing into u then t=0
LEGEND Instance 2 ¨¦¨¦¨¦¨
29: Color u in dark ©¦©¦©¦© ¨¦¨¦¨¦¨
©¦©¦©¦© OSPF
¨¦¨¦¨¦¨
©¦©¦©¦© ¨¦¨¦¨¦¨
©¦©¦©¦© originating routing C
¨¦¨¦¨¦¨
©¦©¦©¦© ¨¦¨¦¨¦¨
©¦©¦©¦© (110) ¨¦¨¦¨¦¨
30: ©¦©¦©¦© process ¨¦¨¦¨¦¨
end if ©¦©¦©¦©
¥¦¥¦¥¦¥¦¥¦¥¦¥¦¥¦¥¦¥
§¦§¦§¦§¦§¦§¦§¦§¦§
¥¦¥¦¥¦¥¦¥¦¥¦¥¦¥¦¥¦¥
§¦§¦§¦§¦§¦§¦§¦§¦§ ¥¦¥¦¥¦¥¦¥¦¥¦¥¦¥¦¥¦¥
§¦§¦§¦§¦§¦§¦§¦§¦§ C ¥¦¥¦¥¦¥¦¥¦¥¦¥¦¥¦¥¦¥
§¦§¦§¦§¦§¦§¦§¦§¦§ ¥¦¥¦¥¦¥¦¥¦¥¦¥¦¥¦¥¦¥
31: §¦§¦§¦§¦§¦§¦§¦§¦§ ¥¦¥¦¥¦¥¦¥¦¥¦¥¦¥¦¥¦¥
end for configured route §¦§¦§¦§¦§¦§¦§¦§¦§
¥¦¥¦¥¦¥¦¥¦¥¦¥¦¥¦¥¦¥
§¦§¦§¦§¦§¦§¦§¦§¦§
¥¦¥¦¥¦¥¦¥¦¥¦¥¦¥¦¥¦¥
§¦§¦§¦§¦§¦§¦§¦§¦§
¥¦¥¦¥¦¥¦¥¦¥¦¥¦¥¦¥¦¥
§¦§¦§¦§¦§¦§¦§¦§¦§Instance 1 ¥¦¥¦¥¦¥¦¥¦¥¦¥¦¥¦¥¦¥
redistribution §¦§¦§¦§¦§¦§¦§¦§¦§ E E
¥¦¥¦¥¦¥¦¥¦¥¦¥¦¥¦¥¦¥
§¦§¦§¦§¦§¦§¦§¦§¦§ ¥¦¥¦¥¦¥¦¥¦¥¦¥¦¥¦¥¦¥
32: §¦§¦§¦§¦§¦§¦§¦§¦§RIP
¥¦¥¦¥¦¥¦¥¦¥¦¥¦¥¦¥¦¥
end while §¦§¦§¦§¦§¦§¦§¦§¦§
¥¦¥¦¥¦¥¦¥¦¥¦¥¦¥¦¥¦¥
§¦§¦§¦§¦§¦§¦§¦§¦§
¥¦¥¦¥¦¥¦¥¦¥¦¥¦¥¦¥¦¥
§¦§¦§¦§¦§¦§¦§¦§¦§ ¥¦¥¦¥¦¥¦¥¦¥¦¥¦¥¦¥¦¥
active route §¦§¦§¦§¦§¦§¦§¦§¦§(120)
¥¦¥¦¥¦¥¦¥¦¥¦¥¦¥¦¥¦¥ §¦§¦§¦§¦§¦§¦§¦§¦§
¥¦¥¦¥¦¥¦¥¦¥¦¥¦¥¦¥¦¥ D §¦§¦§¦§¦§¦§¦§¦§¦§ ¥¦¥¦¥¦¥¦¥¦¥¦¥¦¥¦¥¦¥ We refer to the sequence of RR graphs in an activation redistribution §¦§¦§¦§¦§¦§¦§¦§¦§ Instance 3 D sequence as routing states. We say that a routing state is stable data path IGRP when all the redistributing routers have selected their best CL = {C, D} (100) option among the available choices and there is no signaling message in transit in the network (i.e., CL and S are empty). S = {C, D}
V. DISCLOSURE OF INSTABILITIES USING RR MODEL t=2 Instance 2 t=1 Instance 2 OSPF OSPF C C
This section and the next one (section VI) present two (110) (110)
¦ ¦ ¦ ¦ ¦ ¦ ¦ ¦ ¦ ¦¦¦¦¦¦¦¦¦
¦ ¦ ¦ ¦ ¦ ¦ ¦ ¦ ¦ ¦¦¦¦¦¦¦¦¦
¦ ¦ ¦ ¦ ¦ ¦ ¦ ¦ ¦ ¦¦¦¦¦¦¦¦¦
¦ ¦ ¦ ¦ ¦ ¦ ¦ ¦ ¦ ¦¦¦¦¦¦¦¦¦ ¦¦¦¦¦¦¦¦¦
applications of the RR model. This section studies the net- ¦ ¦ ¦ ¦ ¦ ¦ ¦ ¦ ¦
¦ ¦ ¦ ¦ ¦ ¦ ¦ ¦ ¦ ¦¦¦¦¦¦¦¦¦
¦¦¦¦¦¦¦¦¦ ¦ ¦ ¦ ¦ ¦ ¦ ¦ ¦ ¦ C C
¦ ¦ ¦ ¦ ¦ ¦ ¦ ¦ ¦ ¦¦¦¦¦¦¦¦¦
¦ ¦ ¦ ¦ ¦ ¦ ¦ ¦ ¦ ¦¦¦¦¦¦¦¦¦ ¦¦¦¦¦¦¦¦¦
¦ ¦ ¦ ¦ ¦ ¦ ¦ ¦ ¦ S = {E}
¦ ¦ ¦ ¦ ¦ ¦ ¦ ¦ ¦ ¦¦¦¦¦¦¦¦¦
¦ ¦ ¦ ¦ ¦ ¦ ¦ ¦ ¦ ¦¦¦¦¦¦¦¦¦
¦ ¦ ¦ ¦ ¦ ¦ ¦ ¦ ¦ ¦¦¦¦¦¦¦¦¦
¦ ¦ ¦ ¦ ¦ ¦ ¦ ¦ ¦ ¦¦¦¦¦¦¦¦¦
¦ ¦ ¦ ¦ ¦ ¦ ¦ ¦ ¦ ¦¦¦¦¦¦¦¦¦
¦ ¦ ¦ ¦ ¦ ¦ ¦ ¦ ¦ ¦¦¦¦¦¦¦¦¦
¦ ¦ ¦ ¦ ¦ ¦ ¦ ¦ ¦ ¦¦¦¦¦¦¦¦¦ ¦¦¦¦¦¦¦¦¦
work wide routing dynamics: section V-A explains how the ¦ ¦ ¦ ¦ ¦ ¦ ¦ ¦ ¦ Instance 1 Instance 1
¦ ¦ ¦ ¦ ¦ ¦ ¦ ¦ ¦ ¦¦¦¦¦¦¦¦¦ ¦¦¦¦¦¦¦¦¦
¦ ¦ ¦ ¦ ¦ ¦ ¦ ¦ ¦ E E E E
¦ ¦ ¦ ¦ ¦ ¦ ¦ ¦ ¦ ¦¦¦¦¦¦¦¦¦
¦ ¦ ¦ ¦ ¦ ¦ ¦ ¦ ¦ ¦¦¦¦¦¦¦¦¦
¦ ¦ ¦ ¦ ¦ ¦ ¦ ¦ ¦ ¦¦¦¦¦¦¦¦¦ ¦¦¦¦¦¦¦¦¦
¦ ¦ ¦ ¦ ¦ ¦ ¦ ¦ ¦ RIP RIP ¦ ¦ ¦ ¦ ¦ ¦ ¦ ¦ ¦ ¦¦¦¦¦¦¦¦¦
¦ ¦ ¦ ¦ ¦ ¦ ¦ ¦ ¦ ¦¦¦¦¦¦¦¦¦
¦ ¦ ¦ ¦ ¦ ¦ ¦ ¦ ¦ ¦¦¦¦¦¦¦¦¦
¦ ¦ ¦ ¦ ¦ ¦ ¦ ¦ ¦ ¦¦¦¦¦¦¦¦¦
¦ ¦ ¦ ¦ ¦ ¦ ¦ ¦ ¦ ¦¦¦¦¦¦¦¦¦
¦ ¦ ¦ ¦ ¦ ¦ ¦ ¦ ¦ ¦¦¦¦¦¦¦¦¦
¦ ¦ ¦ ¦ ¦ ¦ ¦ ¦ ¦ ¦¦¦¦¦¦¦¦¦ ¦¦¦¦¦¦¦¦¦
developed RR model allows us to analyze the propagation of ¦ ¦ ¦ ¦ ¦ ¦ ¦ ¦ ¦ (120) (120)
¦ ¦ ¦ ¦ ¦ ¦ ¦ ¦ ¦ ¦¦¦¦¦¦¦¦¦
¦ ¦ ¦ ¦ ¦ ¦ ¦ ¦ ¦ ¦¦¦¦¦¦¦¦¦
¦ ¦ ¦ ¦ ¦ ¦ ¦ ¦ ¦ ¦¦¦¦¦¦¦¦¦
¦¦¦¦¦¦¦¦¦ ¦ ¦ ¦ ¦ ¦ ¦ ¦ ¦ ¦ D D
¦ ¦ ¦ ¦ ¦ ¦ ¦ ¦ ¦ ¦¦¦¦¦¦¦¦¦ ¦¦¦¦¦¦¦¦¦ routing information and to detect potential instabilities in a ¦ ¦ ¦ ¦ ¦ ¦ ¦ ¦ ¦ Instance 3 Instance 3 D D network. Based on the derived insight, section V-B reveals IGRP IGRP (100) (100) new instabilities that RR can cause. New CL = {C} New CL = {E}
A. Detection of Instabilities S = {C} The routing states can expose instabilities that can re- sult from RR. Considering a routing state, we define a t=3 Instance 2 t=4 Instance 2 OSPF OSPF C C
cycle as a set of k distinct routers r1, r2, ..., rk ∈ R such (110) (110)
¦ ¦ ¦ ¦ ¦ ¦ ¦ ¦ ¦
¦ ¦ ¦ ¦ ¦ ¦ ¦ ¦
¦¦¦¦¦¦¦¦¦
¦¦¦¦¦¦¦¦¦
¦ ¦ ¦ ¦ ¦ ¦ ¦ ¦ ¦
¦ ¦ ¦ ¦ ¦ ¦ ¦ ¦
¦¦¦¦¦¦¦¦¦
¦¦¦¦¦¦¦¦¦
¦ ¦ ¦ ¦ ¦ ¦ ¦ ¦ ¦
¦ ¦ ¦ ¦ ¦ ¦ ¦ ¦ ¦¦¦¦¦¦¦¦¦
C ¦¦¦¦¦¦¦¦¦ ¦ ¦ ¦ ¦ ¦ ¦ ¦ ¦ ¦
, , ..., E, ¦¦¦¦¦¦¦¦¦ C
that k k k ¦¦¦¦¦¦¦¦¦
¦ ¦ ¦ ¦ ¦ ¦ ¦ ¦ ¦
¦ ¦ ¦ ¦ ¦ ¦ ¦ ¦
¦¦¦¦¦¦¦¦¦
¦¦¦¦¦¦¦¦¦
¦ ¦ ¦ ¦ ¦ ¦ ¦ ¦ ¦
¦ ¦ ¦ ¦ ¦ ¦ ¦ ¦
¦¦¦¦¦¦¦¦¦
¦¦¦¦¦¦¦¦¦
¦ ¦ ¦ ¦ ¦ ¦ ¦ ¦ ¦
¦ ¦ ¦ ¦ ¦ ¦ ¦ ¦ ¦¦¦¦¦¦¦¦¦
S = {D} ¦¦¦¦¦¦¦¦¦
¦ ¦ ¦ ¦ ¦ ¦ ¦ ¦ ¦
¦ ¦ ¦ ¦ ¦ ¦ ¦ ¦
¦¦¦¦¦¦¦¦¦ ¦¦¦¦¦¦¦¦¦
¦ ¦ ¦ ¦ ¦ ¦ ¦ ¦ ¦ Instance 1 ¦ ¦ ¦ ¦ ¦ ¦ ¦ ¦
¦¦¦¦¦¦¦¦¦
¦¦¦¦¦¦¦¦¦Instance 1 ¦ ¦ ¦ ¦ ¦ ¦ ¦ ¦ ¦
¦ ¦ ¦ ¦ ¦ ¦ ¦ ¦ E E
¦¦¦¦¦¦¦¦¦
¦¦¦¦¦¦¦¦¦ ¦ ¦ ¦ ¦ ¦ ¦ ¦ ¦ ¦ E E
¦¦¦¦¦¦¦¦¦
¦¦¦¦¦¦¦¦¦
¦ ¦ ¦ ¦ ¦ ¦ ¦ ¦ ¦
¦ ¦ ¦ ¦ ¦ ¦ ¦ ¦ ¦¦¦¦¦¦¦¦¦
RIP ¦¦¦¦¦¦¦¦¦ ¦ ¦ ¦ ¦ ¦ ¦ ¦ ¦ ¦
¦ ¦ ¦ ¦ ¦ ¦ ¦ ¦ RIP ¦¦¦¦¦¦¦¦¦
¦¦¦¦¦¦¦¦¦
¦ ¦ ¦ ¦ ¦ ¦ ¦ ¦ ¦
¦ ¦ ¦ ¦ ¦ ¦ ¦ ¦
¦¦¦¦¦¦¦¦¦
¦¦¦¦¦¦¦¦¦
¦ ¦ ¦ ¦ ¦ ¦ ¦ ¦ ¦
¦ ¦ ¦ ¦ ¦ ¦ ¦ ¦
¦¦¦¦¦¦¦¦¦
¦¦¦¦¦¦¦¦¦
¦ ¦ ¦ ¦ ¦ ¦ ¦ ¦ ¦
¦ ¦ ¦ ¦ ¦ ¦ ¦ ¦ (120)
¦¦¦¦¦¦¦¦¦
¦¦¦¦¦¦¦¦¦ ¦ ¦ ¦ ¦ ¦ ¦ ¦ ¦ ¦
¦ ¦ ¦ ¦ ¦ ¦ ¦ ¦ (120) ¦¦¦¦¦¦¦¦¦
u1 = u +1 ¦¦¦¦¦¦¦¦¦
time t, and . A cycle is permanent if there exists a ¦ ¦ ¦ ¦ ¦ ¦ ¦ ¦ ¦ D
k ¦ ¦ ¦ ¦ ¦ ¦ ¦ ¦
¦¦¦¦¦¦¦¦¦
¦¦¦¦¦¦¦¦¦ D
¦ ¦ ¦ ¦ ¦ ¦ ¦ ¦ ¦
¦ ¦ ¦ ¦ ¦ ¦ ¦ ¦
¦¦¦¦¦¦¦¦¦ ¦¦¦¦¦¦¦¦¦ time tc, such that for all t > tc, the cycle is present in G. Instance 3 Instance 3 D D IGRP IGRP A permanent cycle in a RR graph does not imply the New CL = {D} (100) (100) existence of a persistent routing loop. As described in section New CL = { } III, depending on the internal metrics within the routing Fig. 8. Illustration of an activation sequence and the corresponding routing instances, either a persistent routing loop may form, or a states for the network in scenario 1. sub-optimal routing path may arise. Both consequences are selected routing process and redistributes the route unwanted and consequently, permanent cycles are undesirable. from E.3 into E.2. The edge from E.3 to E.2 The RR model allows us to analyze the propagation of becomes solid to indicate that the corresponding routing information for different activation sequences and redistribution is active. Since C is connected to 2, consequently, detect the potential formation of cycle. Figure 8 C is added to CL(t=2). CL(t=2) = {C}. illustrates an activation sequence which converges to a perma- t=3 We assume S(t=3) = {C}. Router C has two choices nent cycle in the network of Figure 4. to reach P (through C.1 and C.2). Because C.2’s t=0 A route P is originated by the RIP routing instance AD is lower than the one from C.1, C.2 becomes (1). Routers C and D are connected to 1. Conse- the selected routing process at C and C redistributes quently, CL(t=0) = {C, D}. from C.2 into C.1. The edge from C.1 to C.2 is t=1 We assume S(t=1) = {C, D} ⊆ CL(t=0). We de-activated and instead the one from C.2 to C.1 is run the route selection and RR logics at routers C active. We have CL(t=3) = {D}. and D. C learns a route to P through C.1 and t=4 We assume S(t=4) = {D}. D has only one choice to redistributes it from C.1 into C.2. The corresponding the destination (i.e., through D.1). No other router edge (from C.1 to C.2) becomes solid to indicate than D announces a route to P into 3. Therefore, that the redistribution is active. Router E which is D maintains its selected routing process (D.1), and connected to 2 is inserted into CL. Similarly, D CL(t=4) = EMPTY SET. learns a route to P and redistributes it from D.1 to D.3. The edge from D.1 to D.3 also becomes solid. The paths (thick arrows) taken by the data packets to reach We have CL(t=1) = {E}. P are represented in the final graph. They form a cycle that t=2 We assume S(t=2) = {E}. We run the route selection reveals the potential formation of a routing loop. and RR logics at router E. Router E is receiving Some configurations of RR always converge to a state a route to P through E.2 and E.3. Because E.3 containing a cycle (independently of the activation sequence) presents a lower AD (100), E selects E.3 as its (e.g., Figure 4). Other configurations always converge to a
7
#####
$$$$$
#####
$$$$$ 0&0&0&0&0
A B 1&1&1&1&1 A
#####
$$$$$ 0&0&0&0&0
1&1&1&1&1
#####
0&0&0&0&0 $$$$$
1&1&1&1&1 C A B
##### 0&0&0&0&0
$$$$$ 1&1&1&1&1
0&0&0&0&0
##### 1 A 2 B 3 1&1&1&1&1
$$$$$ 1 2 3 4
0&0&0&0&0
##### 1&1&1&1&1
$$$$$ t=0
0&0&0&0&0
(90) (100) (90) 1&1&1&1&1(80) (110) (90) (80)
#####
$$$$$ 0&0&0&0&0 D C, 105 1&1&1&1&1
Sequence 1 D 105, C Sequence 2
.&.&.&.&.
4 /&/&/&/&/ A
.&.&.&.&. /&/&/&/&/
(80) .&.&.&.&. /&/&/&/&/
C A B
.&.&.&.&.
/&/&/&/&/
.&.&.&.&.
/&/&/&/&/
1 2 3 4
.&.&.&.&.
/&/&/&/&/
.&.&.&.&.
t=1 /&/&/&/&/(80) (110) (90) (80)
.&.&.&.&. /&/&/&/&/
1 A 2 3
1 2 3
A
(90) (100) (90)
(90) (100) (90)
%&%&%&%&%
'&'&'&'&' A
%&%&%&%&%
'&'&'&'&'
%&%&%&%&%
'&'&'&'&' %&%&%&%&%
4 '&'&'&'&' C A B 4 %&%&%&%&%
'&'&'&'&'1 2 3 4 %&%&%&%&%
(80) t=2 '&'&'&'&'
(80) %&%&%&%&%
'&'&'&'&'(80) (110) (90) (80)
%&%&%&%&%
'&'&'&'&'
1 A 2 3
1 A 2 B 3
(90) (100) (90)
(&(&(&(&(
(90) (100) (90) )&)&)&)&) A
(&(&(&(&(
D )&)&)&)&)
(&(&(&(&(
)&)&)&)&) (&(&(&(&(
)&)&)&)&) C A B (&(&(&(&(
)&)&)&)&)1 2 3 4 (&(&(&(&(
t=3 )&)&)&)&)
(&(&(&(&(
)&)&)&)&)(80) (110) (90) (80) (&(&(&(&( 4 )&)&)&)&) (80) 4
(80)
*&*&*&*&*
+&+&+&+&+ A
*&*&*&*&*
+&+&+&+&+
*&*&*&*&*
+&+&+&+&+
*&*&*&*&*
+&+&+&+&+
C A B
*&*&*&*&*
+&+&+&+&+
1 2 3 4
1 A 2 3
*&*&*&*&*
+&+&+&+&+
1 A 2 B 3
t=4
*&*&*&*&*
+&+&+&+&+(80) (110) (90) (80)
(90) (100) (90)
*&*&*&*&*
(90) (100) (90) +&+&+&+&+ D C, 105
105, C ,&,&,&,&,
4 -&-&-&-&- A ,&,&,&,&,
4 -&-&-&-&- ,&,&,&,&,
(80) -&-&-&-&- ,&,&,&,&,
(80) -&-&-&-&- C A B ,&,&,&,&,
-&-&-&-&-1 2 3 4
t=5 ,&,&,&,&,
-&-&-&-&-
,&,&,&,&,
-&-&-&-&-(80) (110) (90) (80)
!!!!!
""""
,&,&,&,&,
-&-&-&-&-
!!!!!
""""
!!!!!
""""
!!!!! """"
1 A 2 B 3
!!!!!
""""
!!!!!1 A 2 B 3
(90) (100) (90) """"
!!!!!
""""(90) (100) (90) !!!!!
D """" 2&2&2&2&2
C, 105 3&3&3&3&3 A
2&2&2&2&2
3&3&3&3&3
2&2&2&2&2
3&3&3&3&3 2&2&2&2&2
3&3&3&3&3 C A B 2&2&2&2&2
3&3&3&3&31 2 3 4 2&2&2&2&2
4 105, C t=6 3&3&3&3&3 2&2&2&2&2
3&3&3&3&3(80) (110) (90) (80) 2&2&2&2&2 (80) D 4 3&3&3&3&3 (80)
Fig. 10. Scenario 4. Illustration of permanent route flap. Router A runs 3 A. Configured Route Active Route routing processes but no redistribution is enabled neither from nor to 4. Data Path Redistribution Redistribution The routing states highlight the formation of permanent oscillations since the states at t=2 and t=6 are identical. Fig. 9. Scenario 3. Detection of persistent routing loops. Sequence 1 does not result in any routing loop but sequence 2 discloses a potential routing and from A.4. Because A.4 has a lower AD, A.4 loop. The values on the edges represent the customized AD: router C has a becomes the selected routing process. Consequently, customized AD (105) value for routing process 4, overriding the default value (80). A stops redistributing from A.2 into A.3. t=5 Because A stopped redistributing from A.2 into A.3, cycle-free state. Some configurations can converge to a state B no longer receives any announcement. B removes which includes a cycle depending on the activation sequence the route and stops announcing it into B.4. (for example, scenario 3 of Figure 9). Finally, some configu- t=6 Consequently, A.4 no longer receives a route to the rations may converge after some arbitrary time (section III-B, destination either. Instead, A learns the route from Figure 5) and others may always diverge (section V-B). A.2 and redistributes it into A.3. We note that this We say that a RR configuration is safe if for all activa- state is identical to the one at t=2. A permanent tion sequences, the execution of the network-wide RR logic route oscillation has formed. This instability has been converges to a cycle free state. observed in the conducted experiments. B. Disclosure of New Instabilities These permanent oscillations come from the fact that the redistribution of the routes into the routing processes depends Vendor documentation [2], [3] mentioned the potential for- on the routes present in the FIB, which in turn depend on the mation of routing loop, sub-optimal routing and route flapping routes present in the routing processes. Section II explained in certain race conditions as illustrated in section III. Our that routes redistributed from a router does not directly impact model shows new instabilities that can result from RR. Perma- the local route selection. However, since the redistributed nent route oscillations, independent from any race conditions, routes may get further redistributed, those routes can come can indeed appear due to improper RR configuration. back and ultimately affect the route selection outcomes. To demonstrate the formation of permanent route oscilla- tions, we consider the topology in scenario 4 (Figure 10). The VI. TOWARDS INSTABILITY-FREE RR CONFIGURATION corresponding RR graph is depicted at the top of the figure (t=0). A prefix is originated by routing instance 1. In this section, we investigate how to determine if a given t=1 C learns a route to the prefix through C.1 and RR configuration can result in instabilities. First, we demon- redistributes the route from C.1 into C.2. strate that determining whether a configuration can converge t=2 A learns a route through A.2 and redistributes the to a state containing a cycle is a NP-hard problem. The route from A.2 into A.3. complexity of the task motivates the search for sufficient t=3 B receives the route through B.3, installs it in its conditions. In section VI-B, we introduce a sufficient condition FIB and redistributes the route from B.3 into B.4. guaranteeing that a RR configuration does not result in any t=4 A receives two routes to the destination: from A.2 persistent routing loop or oscillations.
8 Such graph can be computed from B in polynomial times. Xj Xj (80) (80) a j b j Figure 13 provides an illustration of the graph for B = (X1 ∨ X2 ∨ X3) ∧ (X1 ∨ X2 ∨ X3) ∧ (X1 ∨ X2 ∨ X3) Yj . We now show (80) that the transformation of B into G is a reduction
a j b j ⇒ We show that if B has a satisfying assignment, there
4545454
6565656
4545454
6565656
4545454
6565656
4545454
6565656 4545454
6565656o is an activation sequence such that G converges and the final
4545454
6565656 4545454
6565656(90) 4545454 6565656 state includes a cycle of active redistributions
a j b j a j b j
7575757 9595959
8585858 :5:5:5:
7575757 9595959
8585858 :5:5:5:
7575757 9595959 :5:5:5:
8585858 of G, the router gj (1 ≤ j ≤ n) or gj redistributes a route
7575757 9595959
8585858 :5:5:5:
7575757 9595959
:5:5:5:
8585858o o
7575757 9595959
8585858 :5:5:5:
7575757 9595959 :5:5:5:
8585858(90) (90) X X C 9595959
7575757 from or into the routing instance . As such, each
:5:5:5: 8585858 j j k
(b) X j = TRUE (c) X j= FALSE routing instance Ck has a route to P . Then, ∀k ∈ [1, m], the router fk redistributes the route from Ck into Uk. X Fig. 11. Conversion of variable into subgraph. Each variable j is repre- Every router ek is running four processes (Uk, Uk+1, Wk sented by the topology in figure (a). Depending on the activation sequence, we can obtain two different stable routing states depicted by figures (b) and and Zk). We show that Uk is the selected routing process at ek: (c). We associate the redistribution outcome of figure (b) with TRUE assigned Only processes Uk and Uk+1 have a route. Zk does not have a X X to j and that of figure (c) with FALSE assigned to j . route since router dk picks Ck as its selected routing process. Z A. Complexity of Route Redistribution Analysis Consequently, no router announces a route to k, and neither Zk nor Wk have a route to P . Between Uk and Uk+1, Uk presents a lower administrative distance at e and is therefore We show that given a RR configuration, determining k preferred. As such ∀k ∈ [1, m], the router e learns a route to whether the redistributions converge to a state containing a k P from U and redistributes it into U +1. cycle is NP-hard. k k The redistributions converge, and
9 Uk (100)
f k d Ck k Vk (80) (90)
g 1 g 3 g 2
X X X 1 X1 2 X2 3 X3 (80) b (80) (80) a b (80) (80) b (80) a 1 1 2 2 a 3 3
Y1 Y2 Y3 (80) (80) (80) e k b 1 b 3 Wk Z k
a 2 b 2 (80) (80) ;5;5;5;
a 1 <5<5<5< a ;5;5;5;
<5<5<5< 3
;5;5;5;
<5<5<5<
;5;5;5;
<5<5<5< ;5;5;5; <5<5<5 ;5;5;5; d <5<5<5< ;5;5;5; <5<5<5<(90) k ;5;5;5; <5<5<5< Fig. 12. Construction of the sub-graph for clause Ck = X1 ∨ X2 ∨ X3 90, e 3 90, e 90, e U U 1 U2 2 3 1 (100) (100) (100) f f 3 f 1 2 d d C d 2 V C3 3 V3 C1 1 V1 2 2 (80) (90) (80) (90) (80) (90) g 1 g 3 g 2 g 3 g 1 g 2 g 2 g X X X g 3 1 1 X1 2 X2 3 X3 (80) (80) (80) (80) (80) a 1 b 1 a 2 b 2 a 3 b 3 (80) Y Y Y1 2 3 (80) (80) (80) e e e 2 W 3 Z W 1 Z b 3 W2 Z 2 3 3 1 1 b 1 a (80) (80) (80) (80) 2 b 2 (80) (80) =>=>=>= ?>?>?>? a =>=>=>= a ?>?>?>? 3 1 =>=>=>= ?>?>?>? =>=>=>= ?>?>?>?o =>=>=>= ?>?>?>? =>=>=>= d ?>?>?>? =>=>=>= ?>?>?>?(90) 2 d =>=>=>= d ?>?>?>? 3 1 Fig. 13. Graph for B = (X1 ∨ X2 ∨ X3) ∧ (X1 ∨ X2 ∨ X3) ∧ (X1 ∨ X2 ∨ X3). that has a true value. safe from permanent routing loops and oscillations: u ∈ V B. A Sufficient Condition for Safety 1) For all vertices , there is a redistribution path from an originating vertex o ∈ O to u. We say that there is a Given the complexity of the RRC-CD problem, we present redistribution path from o to u if there exists u1, u2, ..., a sufficient condition, which can be checked in polynomial uk ∈ V , and r0, r1, ..., rk ∈ R, such that 10 @A@A@A@ BABABAB @A@A@A@ BABABAB @A@A@A@ BABABAB originating routing @A@A@A@ BABABAB @A@A@A@ BABABAB @A@A@A@ BABABAB process t=0 t=1 @A@A@A@ BABABAB Instance 2 Instance 2 Instance 2 Instance 2 OSPF OSPF OSPF OSPF C, 90 C, 90 C, 90 (110) (110) (110) (110) 90, C PHPHPHPHPHPHPHPHPHP RHRHRHRHRHRHRHRHRHR QHQHQHQHQHQHQHQHQHQ SHSHSHSHSHSHSHSHSHS PHPHPHPHPHPHPHPHPHP RHRHRHRHRHRHRHRHRHR QHQHQHQHQHQHQHQHQHQ SHSHSHSHSHSHSHSHSHS EAEAEAEAEAEAEAEAEAE CACACACACACACACACAC FAFAFAFAFAFAFAFAF DADADADADADADADADAD PHPHPHPHPHPHPHPHPHP RHRHRHRHRHRHRHRHRHR QHQHQHQHQHQHQHQHQHQ SHSHSHSHSHSHSHSHSHS EAEAEAEAEAEAEAEAEAE CACACACACACACACACAC FAFAFAFAFAFAFAFAF DADADADADADADADADAD PHPHPHPHPHPHPHPHPHP RHRHRHRHRHRHRHRHRHR EAEAEAEAEAEAEAEAEAE CACACACACACACACACAC QHQHQHQHQHQHQHQHQHQ SHSHSHSHSHSHSHSHSHS FAFAFAFAFAFAFAFAF DADADADADADADADADAD 90, C 90, C 90, C EAEAEAEAEAEAEAEAEAE CACACACACACACACACAC PHPHPHPHPHPHPHPHPHP RHRHRHRHRHRHRHRHRHR FAFAFAFAFAFAFAFAF DADADADADADADADADAD QHQHQHQHQHQHQHQHQHQ SHSHSHSHSHSHSHSHSHS EAEAEAEAEAEAEAEAEAE CACACACACACACACACAC FAFAFAFAFAFAFAFAF DADADADADADADADADAD PHPHPHPHPHPHPHPHPHP RHRHRHRHRHRHRHRHRHR QHQHQHQHQHQHQHQHQHQ SHSHSHSHSHSHSHSHSHS EAEAEAEAEAEAEAEAEAE CACACACACACACACACAC FAFAFAFAFAFAFAFAF DADADADADADADADADAD PHPHPHPHPHPHPHPHPHP RHRHRHRHRHRHRHRHRHR QHQHQHQHQHQHQHQHQHQ SHSHSHSHSHSHSHSHSHS EAEAEAEAEAEAEAEAEAE CACACACACACACACACAC FAFAFAFAFAFAFAFAF DADADADADADADADADAD PHPHPHPHPHPHPHPHPHP RHRHRHRHRHRHRHRHRHR QHQHQHQHQHQHQHQHQHQ SHSHSHSHSHSHSHSHSHS EAEAEAEAEAEAEAEAEAE CACACACACACACACACAC FAFAFAFAFAFAFAFAF DADADADADADADADADAD Instance 1 S = {C} Instance 1 PHPHPHPHPHPHPHPHPHP RHRHRHRHRHRHRHRHRHR SHSHSHSHSHSHSHSHSHS Instance 1 Instance 1 QHQHQHQHQHQHQHQHQHQ EAEAEAEAEAEAEAEAEAE CACACACACACACACACAC FAFAFAFAFAFAFAFAF DADADADADADADADADAD RHRHRHRHRHRHRHRHRHR PHPHPHPHPHPHPHPHPHP E E E E QHQHQHQHQHQHQHQHQHQ SHSHSHSHSHSHSHSHSHS EAEAEAEAEAEAEAEAEAE CACACACACACACACACAC FAFAFAFAFAFAFAFAF E DADADADADADADADADAD E E PHPHPHPHPHPHPHPHPHP RHRHRHRHRHRHRHRHRHR QHQHQHQHQHQHQHQHQHQ SHSHSHSHSHSHSHSHSHS EAEAEAEAEAEAEAEAEAE CACACACACACACACACAC FAFAFAFAFAFAFAFAF DADADADADADADADADAD PHPHPHPHPHPHPHPHPHP RHRHRHRHRHRHRHRHRHR EAEAEAEAEAEAEAEAEAE CACACACACACACACACAC QHQHQHQHQHQHQHQHQHQ SHSHSHSHSHSHSHSHSHS FAFAFAFAFAFAFAFAF RIP DADADADADADADADADADRIP RIP RIP EAEAEAEAEAEAEAEAEAE CACACACACACACACACAC PHPHPHPHPHPHPHPHPHP RHRHRHRHRHRHRHRHRHR FAFAFAFAFAFAFAFAF DADADADADADADADADAD QHQHQHQHQHQHQHQHQHQ SHSHSHSHSHSHSHSHSHS EAEAEAEAEAEAEAEAEAE CACACACACACACACACAC FAFAFAFAFAFAFAFAF DADADADADADADADADAD PHPHPHPHPHPHPHPHPHP RHRHRHRHRHRHRHRHRHR QHQHQHQHQHQHQHQHQHQ SHSHSHSHSHSHSHSHSHS EAEAEAEAEAEAEAEAEAE CACACACACACACACACAC FAFAFAFAFAFAFAFAF DADADADADADADADADAD PHPHPHPHPHPHPHPHPHP RHRHRHRHRHRHRHRHRHR QHQHQHQHQHQHQHQHQHQ SHSHSHSHSHSHSHSHSHS EAEAEAEAEAEAEAEAEAE CACACACACACACACACAC FAFAFAFAFAFAFAFAF (120) DADADADADADADADADAD(120) PHPHPHPHPHPHPHPHPHP RHRHRHRHRHRHRHRHRHR SHSHSHSHSHSHSHSHSHS QHQHQHQHQHQHQHQHQHQ(120) (120) EAEAEAEAEAEAEAEAEAE CACACACACACACACACAC FAFAFAFAFAFAFAFAF DADADADADADADADADAD RHRHRHRHRHRHRHRHRHR D, 90 PHPHPHPHPHPHPHPHPHP QHQHQHQHQHQHQHQHQHQ SHSHSHSHSHSHSHSHSHS EAEAEAEAEAEAEAEAEAE CACACACACACACACACAC D, 90 D, 90 FAFAFAFAFAFAFAFAF DADADADADADADADADAD PHPHPHPHPHPHPHPHPHP RHRHRHRHRHRHRHRHRHR QHQHQHQHQHQHQHQHQHQ SHSHSHSHSHSHSHSHSHS Instance 3 Instance 3 Instance 3 Instance 3 90, D 90, D IGRP IGRP 90, D IGRP 90, D IGRP (100) (100) CL = {C, D} (100) New CL = {D, E} (100) (a) (b) S = {E} Fig. 14. The AD for C.1 and D.1 are customized to the value 90. The graph in (a) represents the corresponding primary route propagation graph. t=3 t=2 Instance 2 Instance 2 The graph in (b) depicts the state whereto RR converges. OSPF OSPF C, 90 (110) C, 90 (110) JHJHJHJHJHJHJHJHJHJ GHGHGHGHGHGHGHGHGHG KHKHKHKHKHKHKHKHK IHIHIHIHIHIHIHIHIHI JHJHJHJHJHJHJHJHJHJ GHGHGHGHGHGHGHGHGHG KHKHKHKHKHKHKHKHK primary route propagation graph satisfies conditions (1) and IHIHIHIHIHIHIHIHIHI JHJHJHJHJHJHJHJHJHJ GHGHGHGHGHGHGHGHGHG KHKHKHKHKHKHKHKHK IHIHIHIHIHIHIHIHIHI JHJHJHJHJHJHJHJHJHJ GHGHGHGHGHGHGHGHGHG KHKHKHKHKHKHKHKHK IHIHIHIHIHIHIHIHIHI JHJHJHJHJHJHJHJHJHJ GHGHGHGHGHGHGHGHGHG KHKHKHKHKHKHKHKHK 90, C IHIHIHIHIHIHIHIHIHI 90, C JHJHJHJHJHJHJHJHJHJ GHGHGHGHGHGHGHGHGHG KHKHKHKHKHKHKHKHK IHIHIHIHIHIHIHIHIHI JHJHJHJHJHJHJHJHJHJ GHGHGHGHGHGHGHGHGHG KHKHKHKHKHKHKHKHK IHIHIHIHIHIHIHIHIHI JHJHJHJHJHJHJHJHJHJ GHGHGHGHGHGHGHGHGHG KHKHKHKHKHKHKHKHK Instance 1 IHIHIHIHIHIHIHIHIHIInstance 1 JHJHJHJHJHJHJHJHJHJ GHGHGHGHGHGHGHGHGHG KHKHKHKHKHKHKHKHK (3) converges to a stable state: each redistributing router IHIHIHIHIHIHIHIHIHI JHJHJHJHJHJHJHJHJHJ GHGHGHGHGHGHGHGHGHG KHKHKHKHKHKHKHKHK E E S = {D} IHIHIHIHIHIHIHIHIHI E E JHJHJHJHJHJHJHJHJHJ GHGHGHGHGHGHGHGHGHG KHKHKHKHKHKHKHKHK IHIHIHIHIHIHIHIHIHI JHJHJHJHJHJHJHJHJHJ GHGHGHGHGHGHGHGHGHG KHKHKHKHKHKHKHKHK RIP IHIHIHIHIHIHIHIHIHIRIP JHJHJHJHJHJHJHJHJHJ GHGHGHGHGHGHGHGHGHG KHKHKHKHKHKHKHKHK IHIHIHIHIHIHIHIHIHI JHJHJHJHJHJHJHJHJHJ GHGHGHGHGHGHGHGHGHG KHKHKHKHKHKHKHKHK IHIHIHIHIHIHIHIHIHI JHJHJHJHJHJHJHJHJHJ GHGHGHGHGHGHGHGHGHG KHKHKHKHKHKHKHKHK receives a route from its preferred routing process and will IHIHIHIHIHIHIHIHIHI JHJHJHJHJHJHJHJHJHJ GHGHGHGHGHGHGHGHGHG KHKHKHKHKHKHKHKHK (120) IHIHIHIHIHIHIHIHIHI(120) JHJHJHJHJHJHJHJHJHJ GHGHGHGHGHGHGHGHGHG KHKHKHKHKHKHKHKHK D, 90 IHIHIHIHIHIHIHIHIHI D, 90 JHJHJHJHJHJHJHJHJHJ GHGHGHGHGHGHGHGHGHG KHKHKHKHKHKHKHKHK select it. Finally, condition (2) ensures that no routing loop IHIHIHIHIHIHIHIHIHI 90, D Instance 3 Instance 3 can exist. The construction of the graph and the verification IGRP 90, D IGRP of the 3 conditions can clearly be performed in polynomial New CL = {E} (100) New CL = {D} (100) times. S = {E} To illustrate the utility of the sufficient condition, again t=4 t=5 consider the network configuration used for scenario 1 of Instance 2 Instance 2 OSPF OSPF section III. By assigning the value 90 to C.1’s and to D.1’s C, 90 (110) C, 90 (110) LHLHLHLHLHLHLHLHLHL NHNHNHNHNHNHNHNHNHN MHMHMHMHMHMHMHMHM OHOHOHOHOHOHOHOHOHO LHLHLHLHLHLHLHLHLHL NHNHNHNHNHNHNHNHNHN MHMHMHMHMHMHMHMHM OHOHOHOHOHOHOHOHOHO LHLHLHLHLHLHLHLHLHL NHNHNHNHNHNHNHNHNHN OHOHOHOHOHOHOHOHOHO AD, the configuration complies with the sufficient condition MHMHMHMHMHMHMHMHM LHLHLHLHLHLHLHLHLHL NHNHNHNHNHNHNHNHNHN OHOHOHOHOHOHOHOHOHO MHMHMHMHMHMHMHMHM 90, C 90, C LHLHLHLHLHLHLHLHLHL NHNHNHNHNHNHNHNHNHN MHMHMHMHMHMHMHMHM OHOHOHOHOHOHOHOHOHO LHLHLHLHLHLHLHLHLHL NHNHNHNHNHNHNHNHNHN MHMHMHMHMHMHMHMHM OHOHOHOHOHOHOHOHOHO LHLHLHLHLHLHLHLHLHL NHNHNHNHNHNHNHNHNHN OHOHOHOHOHOHOHOHOHO MHMHMHMHMHMHMHMHM S = {C} LHLHLHLHLHLHLHLHLHL NHNHNHNHNHNHNHNHNHN OHOHOHOHOHOHOHOHOHO MHMHMHMHMHMHMHMHMInstance 1 Instance 1 LHLHLHLHLHLHLHLHLHL NHNHNHNHNHNHNHNHNHN OHOHOHOHOHOHOHOHOHO and is guaranteed to converge to an acyclic routing state. The MHMHMHMHMHMHMHMHM LHLHLHLHLHLHLHLHLHL NHNHNHNHNHNHNHNHNHN OHOHOHOHOHOHOHOHOHO MHMHMHMHMHMHMHMHM E E E E LHLHLHLHLHLHLHLHLHL NHNHNHNHNHNHNHNHNHN MHMHMHMHMHMHMHMHM OHOHOHOHOHOHOHOHOHO LHLHLHLHLHLHLHLHLHL NHNHNHNHNHNHNHNHNHN OHOHOHOHOHOHOHOHOHO MHMHMHMHMHMHMHMHMRIP RIP LHLHLHLHLHLHLHLHLHL NHNHNHNHNHNHNHNHNHN MHMHMHMHMHMHMHMHM OHOHOHOHOHOHOHOHOHO LHLHLHLHLHLHLHLHLHL NHNHNHNHNHNHNHNHNHN MHMHMHMHMHMHMHMHM OHOHOHOHOHOHOHOHOHO LHLHLHLHLHLHLHLHLHL NHNHNHNHNHNHNHNHNHN MHMHMHMHMHMHMHMHM OHOHOHOHOHOHOHOHOHO LHLHLHLHLHLHLHLHLHL NHNHNHNHNHNHNHNHNHN OHOHOHOHOHOHOHOHOHO corresponding primary route propagation graph is depicted MHMHMHMHMHMHMHMHM(120) (120) LHLHLHLHLHLHLHLHLHL NHNHNHNHNHNHNHNHNHN OHOHOHOHOHOHOHOHOHO MHMHMHMHMHMHMHMHM D, 90 D, 90 LHLHLHLHLHLHLHLHLHL NHNHNHNHNHNHNHNHNHN MHMHMHMHMHMHMHMHM OHOHOHOHOHOHOHOHOHO in Figure 14a. In contrast to Figure 8, for all activation Instance 3 Instance 3 90, D 90, D sequences the route redistributions converge to the same safe IGRP IGRP (100) (100) state (Figure 14b) where the edges from the primary route New CL = {C} New CL = { } propagation graph are active. Figure 15 illustrates the transient Fig. 15. Illustration of an activation sequence when the AD for C.1 and and final states for one of the activation sequences. D.1 are set to 90. The redistributions converge to a cycle-free state. The router redistribution model and the sufficient condition allow one to perform “what if” analysis and detect the configu- x mainly announces to y that it has a route to P . y does ration errors before deployment. [11] introduces the concept of not have a global view of the topology but only know that a robust configuration which remains safe after node failures. x is the next-hop for P . [14], [15] studied properties for A similar analysis can be carried out for route redistribution vectoring algorithms and showed that strict monotonicity (SM) but the details are outside the scope of this paper. was an important one. Monotonicity means that the weight A new area of research consists in identifying operational of a redistributed route should be larger than the one of guidelines (i.e., constraints on actual configuration parameters) the initially received route. However, current RR does not for achieving properties such as safety and robustness. [13] satisfy monotonicity. The AD value of a routing process can constitutes a first step in this line of research. be set to any value and consequently, at a same router, a redistributed route may present a higher preference than the VII. TOWARDS A SAFE-BY-DESIGN RR PROTOCOL initially received route. The previous sections address problems associated with B. An Approach Based on Dynamic Route Tag the current RR procedure defined by vendors. They focused on methods that can be implemented using existing router Modern routing protocols (e.g., RIPv2, OSPFv2, EIGRP), features. In this section, we investigate longer-term solutions. which support the CIDR format, allow an integer tag to be We consider possible extensions and modifications to the RR associated with an external route. This tag was designed to procedure so that desired properties can be safely supported. provide a label of the external route being redistributed. The The aim is to derive a RR protocol that is safe by design, i.e., usages of this field were left out of the routing protocol it will always converge to an acyclic routing state, even in the specifications and were to be specified in a separate document. presence of configuration errors. We propose to utilize this unused external route tag to ensure that RR is strictly monotonous. The route tag should A. RR and Strict Monotonicity carry a counter that is incremented by at least one when re- The analysis of RR operations reveals that RR behaves injected from a routing instance to another one. The route like a distance vector protocol. When a routing process x selection procedure needs to be upgraded to take the route redistributes a route to a prefix P to a routing process y, tag into consideration. When receiving multiple routes to a 11 same destination, a router should first consider the route tag. wide RR logic and provides an analytical model to address the Routes with lower route tag value should be preferred. Finally, problem. The model precisely defines how a RR configuration to address the count-to-infinity problem, existing solutions can influences the route selection outcomes at different routers be adopted: a maximum counter value can be defined (RIP and as such provides the first formal specification of the defines the maximum count as 16 [16]) or hold down timers RR procedure. Detailed applications of the model are also [17] can be implemented. presented. Not only can the model be used to explain why Such modifications make RR SM [15]. Applying the frame- loops may form and routes may oscillate for certain RR con- work from [15], RR is well captured by the scope product figurations, it can also be used to derive sufficient conditions operator ([15], section 3.2): RR is used between the rout- for an instability-free RR configuration. The analytical results ing instances, and within each routing instance, the routing give clues indicating that the current RR procedure may have instance’s routing protocol is applied. As long as this latter fundamental weaknesses and raise the question if it requires algebra – i.e., the one used in each routing instance – is SM, non-trivial changes to the RR procedure to address these the resulting routing remains SM [15]. weaknesses. The paper exposes this issue and proposes a set An important question meriting further investigation is how of functional modifications as the first step towards deriving to design new modifications to the RR procedure that not only a safe RR protocol. guarantee the correctness of the procedure but also preserve X. ACKNOWLEDGMENTS most of the benefits offered by route redistribution. In order to achieve this goal, we need to fully understand the operational The authors thank John Gibson, Orathai Sukwong and needs of the RR procedure first. To this end, empirical studies Marcin Pohl for their help in setting up the presented experi- of route redistribution usages in operational networks are ments, and Sihyung Lee as well as Steve McManus for their required. comments. This research was sponsored by the NSF under both NeTS Grant CNS-0520210 and a Graduate Research VIII. RELATED WORK Fellowship. Views and conclusions contained in this document Few documents address route redistribution. [18] and [19] are those of the authors and should not be interpreted as have short sections on routing protocol interactions. They representing the official policies, either expressed or implied, briefly describe the challenges and risks of route redistribution. of the U.S. government. [20] is an IETF standard specifying the interaction between OSPF and BGP/IDRP. However, the document is specific REFERENCES to these 3 protocols and does not deal with other routing [1] D. Maltz, G. Xie, J. Zhan, H. Zhang, G. Hjalmtysson, and A. Greenberg, protocols. [2] and [3] are vendor reports presenting possible “Routing Design in Operational Networks: A Look from the Inside,” in Proc. ACM SIGCOMM, 2004. consequences of redistribution (such as sub-optimal routing, [2] “Redistributing Routing Protocols,” Cisco, September 2006. routing loops or delayed convergence.) To prevent those unde- [3] “OSPF Redistribution Among Different OSPF Processes,” Cisco, Jan- sired effects, [2] recommends preventing information received uary 2006. [4] “What is Administrative Distance?” Cisco, March 2006. from a routing process u from being re-advertised back into u. [5] Dwyer, Chowbay, Pavlichek, Downing, Sonderegger, Thomas, and However, such an approach violates one of the goals of route Pavlichek, Juniper Networks Reference Guide: JUNOS Routing, Con- redistribution i.e., the ability for routing instances to back-up figuration, and Architecture. Addison-Wesley, 2002. [6] “OSPF Design Guide,” Cisco, April 2006. each other in case of failures. [3] focuses on redistribution [7] “Using OSPF in an MPLS VPN Environment,” Cisco, 2002. between multiple instances of OSPF. The report mentions [8] “EIGRP MPLS VPN PE-CE Site of Origin (SoO),” Cisco, 2003. that OSPF routes are susceptible to instabilities. A number [9] “ERX Routing Protocols Configuration Guide, Vol. 2,” Juniper. [10] L. Gao and J. Rexford, “Stable Internet Routing Without Global Coor- of solutions are proposed. Some of the approaches allow dination,” in Proc. ACM SIGMETRICS, 2000. partial backup but do not satisfy all objectives. When network [11] T. Griffin, F. B. Shepherd, and G. T. Wilfong, “The stable paths problem partitions happen within a routing instance, internal routers and interdomain routing.” IEEE/ACM Trans. Netw., 2002. [12] T. H. Cormen, C. E. Leiserson, R. L. Rivest, and C. Stein, Introduction still loose connectivity. Finally, [7], [8] and [9] are proprietary to Algorithms, Second Edition. The MIT Press, 2001. extensions addressing the redistribution from BGP into specific [13] F. Le and G. Xie, “On Guidelines for Safe Route Redistributions,” in protocols (e.g., OSPF, EIGRP). However, these extensions can Proc. ACM SIGCOMM Internet Network Management Workshop, 2007. [14] J. L. Sobrinho, “Network routing with path vector protocols: Theory still result in instabilities and do not address the redistributions and applications,” in Proc. ACM SIGCOMM, 2003. between IGP processes. [15] T. G. Griffin and J. L. Sobrinho, “Metarouting,” in Proc. ACM SIG- COMM, 2005. IX. CONCLUSION [16] C. Hedrick, Routing Information Protocol, Request for Comments 1058, 1998. Route redistribution continues to be a popular choice for [17] J. Doyle, OSPF and IS-IS: Choosing an IGP for Large-Scale Networks. disseminating routes between routing protocols because it Addison-Wesley, 2005. is relatively easy to configure and it has the flexibility to [18] F. B. (Editor), Requirements for IP Version 4 Routers, Request for Comments 1812, 1995. support a wide range of policy-based scenarios. However, [19] J. T. Moy, OSPF Anatomy of An Internet Routing Protocol. Addison- RR misconfigurations are also common and the consequences Wesley, 1998. include permanent routing loops and persistent route flaps. [20] K. Varadhan, S. Hares, and Y. Rekhter, BGP4/IDRP for IP—OSPF Interaction, Request for Comments 1745, 1994. This paper takes the position that most of the misconfig- urations are due to a lack of understanding of the network 12