] defines BGP Network Layer Reachability Information (NLRI) [RFC 4760
] that can be used to distribute traffic Flow Specifications amongst BGP speakers in support of traffic filtering. The primary intention of [RFC 8955
] is to enable downstream autonomous systems to signal traffic filtering policies to upstream autonomous systems. In this way, traffic is filtered closer to the source and the upstream autonomous systems avoid carrying the traffic to the downstream autonomous systems only to be discarded. [RFC 8955
] also enables more granular traffic filtering based upon upper-layer protocol information (e.g., protocol or port numbers) as opposed to coarse IP destination prefix-based filtering. Flow Specification NLRIs received from a BGP peer is subject to validity checks before being considered feasible and subsequently installed within the respective Adj-RIB-In.
The validation procedure defined within [RFC 8955
] requires that the originator of the Flow Specification NLRI match the originator of the best-match unicast route for the destination prefix embedded in the Flow Specification. The aim is to make sure that only speakers on the forwarding path can originate the Flow Specification. Let's consider the particular case where the Flow Specification is originated in any location within the same Local Domain as the speaker performing the validation (for example, by a centralized BGP route controller), and the best-match unicast route is originated in another Local Domain. In order for the validation to succeed for a Flow Specification received from an iBGP peer, it would be necessary to disseminate such Flow Specification NLRI directly from the specific border router (within the Local Domain) that is advertising the corresponding best-match unicast route to the Local Domain. Those border routers would be acting as de facto route controllers. This approach would be, however, operationally cumbersome in a Local Domain with numerous border routers having complex BGP policies.
illustrates this principle. R1 (the upstream router) and RR (a route reflector) need to validate the Flow Specification whose embedded destination prefix has a best-match unicast route (dest-route) originated by ASBR2. ASBR2 could originate the Flow Specification, and it would be validated when received by RR and R1 (from their point of view, the originator of both the Flow Specification and the best-match unicast route will be ASBR1). Sometimes the Flow Specification needs to be originated within AS1. ASBR1 could originate it, and the Flow Specification would still be validated. In both cases, the Flow Specification is originated by a router in the same forwarding path as the dest-route. For the case where AS1 has thousands of ASBRs, it becomes impractical to originate different Flow Specification rules on each ASBR in AS1 based on which ASBR each dest-route is learned from. To make the situation more tenable, the objective is to advertise all the Flow Specifications from the same route controller.
R1(AS1) --- RR(AS1) --- ASBR1(AS1) --- ASBR2(AS2)
This document describes a modification to the validation procedure described in [RFC 8955
], by allowing Flow Specification NLRIs to be originated from a centralized BGP route controller located within the Local Domain and not necessarily in the data-forwarding path. While the proposed modification cannot be used for inter-domain coordination of traffic filtering, it greatly simplifies distribution of intra-domain traffic filtering policies within a Local Domain that has numerous border routers having complex BGP policies. By relaxing the validation procedure for iBGP, the proposed modification allows Flow Specifications to be distributed in a standard and scalable manner throughout the Local Domain.
Throughout this document, some references are made to AS_CONFED_SEQUENCE segments; see Sections [4.1
] and [5
]. If AS_CONFED_SET segments are also present in the AS_PATH, the same considerations apply to them. Note, however, that the use of AS_CONFED_SET segments is not recommended [RFC 6472
]. Refer to [CONFED-SET
] as well.