Hurricane Electric Route Filtering Algorithm

The following is from http://routing.he.net/algorithm.html . This outlines the criteria HE.NET uses for filtering routes from peers and customers.

This is the route filtering algorithm for customers and peers that have explicit filtering:

1. Attempt to find an as-set to use for this network.
1.1 Inspect the aut-num for this ASN to see if we can extract from their IRR policy for what they would announce to Hurricane by finding export or mp-export to AS6939, ANY, or AS-ANY.
1.2 Also see if they set what looks like a valid IRR as-set name in peeringdb.

2. Collect the received routes for all BGP sessions with this ASN. This details both accepted and filtered routes.

3. For each route, perform the following rejection tests:
3.1 Reject default routes 0.0.0.0/0 and ::/0.
3.2 Reject paths using BGP AS_SET notation (i.e. {1} or {1 2}, etc). See draft-ietf-idr-deprecate-as-set-confed-set.
3.3 Reject prefix lengths less than minimum and greater than maximum. For IPv4 this is 8 and 24. For IPv6 this is 16 and 48.
3.4 Reject bogons (RFC1918, documentation prefix, etc).
3.5 Reject exchange prefixes for all exchanges Hurricane Electric is connected to.
3.6 Reject routes that have RPKI status INVALID_ASN or INVALID_LENGTH based on the origin AS and prefix.

4. For each route, perform the following acceptance tests:
4.1 If the origin is the neighbor AS, accept routes that have RPKI status VALID based on the origin AS and prefix.
4.2 If the prefix is an announced downstream route that is a subnet of an accepted originated prefix that was accepted due to either RPKI or an RIR handle match, accept the prefix.
4.3 If RIR handles match for the prefix and the peer AS, accept the prefix.
4.4 If this prefix exactly matches a prefix allowed by the IRR policy of this peer, accept the prefix.
4.5 If the first AS in the path matches the peer and path is two hops long and the origin AS is in the expanded as-set for the peer AS and either the RPKI status is VALID or there is an RIR handle match for the origin AS and the prefix, accept the prefix.

5. Reject all prefixes not explicitly accepted

RPKI and misconceptions

After my blog post about Hurricane Electric and RPKi support, I was seeing some comments by folks that warrant some clarification. I put together a short midnight podcast on this.  To summarize
1. route original validation is not the same as having ROA’S with your RIR
2. If you have an ASN you should have a peering DB entry
3.ROAs have nothing to do with your router supporting RPKI

ARIN resources and the Service Provider

Internet Service Providers (ISPs) can be intimidated by all of the facets of working with the American Registry of Internet Numbers (ARIN). I have put together a guide that outlines common things you, as a service provider, need to do.

This guide is not an end-all how-to. Throughout, I am posting videos and links taken from the ARIN site to help. This article is more of an outline of what a service provider needs to do.

The majority of the steps below will be done through ARIN’s online ticketing system.

This is broken down into the following Sections
1. Create a Point of Contact (POC) record
2. Creating an Organization (ORG-ID)
3. Requesting an Autonomous System Number (ASN)
4. Requesting IPv6 space
5. Requesting IPV4 space
6. Source Validation
7. Reverse DNS
8. Routing Registry
9. RPKI
10. Notes and tips

Creating a Point of Contact (POC)
Point of Contact (POC) records are the foundation of your ARIN account. This record is the way you manage your resources. There are different types of POC accounts. https://www.arin.net/resources/guide/account/records/poc/ will tell you everything you need to know about POC records. Creating this record will take mere minutes to make.

Creating an Organization
Once you have a POC record created, you will create an Organization and associate your POC with that ORG-ID. ARIN will attach your resources to your org-id. You will need your federal EIN and your registered business address for this stage. This stage takes a few days to get verified due to ARIN needing to verify you are who you say you are

Requesting an ASN
An Autonomous System Number (ASN) will be the first resource an ISP will request. The ASN allows you to participate in BGP by advertising your IP blocks to peers. The ASN will require to state your routing policy, usually BGP, and at least two peers, you will be establishing BGP. If you don’t have two peers, say your plans in this section.

Once you have met the criteria and you will be asked to fill out an officer attest paper. This statement is a paper stating the information you have submitted is correct and truthful. Once you will out this form and submit it you will then receive an invoice. Once this invoice is paid, you will receive your ASN. This stage can take several days, depending on how much back and forth goes on, asking to clarify information.

Request IPv6 space
I put this as the next stage for a few reasons. The first is you should be moving toward IPv6. At the very least, dual-stack your network. Second, requesting IPV6 space will get you familiar with how ARIN looks at requests.

You are required to state how your network is laid out, what type of network, and how you plan to deploy addresses. Be prepared to give a diagram of your system. You may have to go back and forth a few times, depending on how much detail you provided on your first request.

Just like your ASN, you will be required to sign another office attest, pay the bill, and then the Ip space will be allocated.

Requesting IPV4 space
Requesting IPV4 space is pretty close to requesting V6 space, but ARIN is more strict on their criteria these days due to the shortage of space. If you are looking to transition you can get. /24 of v4 for your v6 transition.

If you choose to request IPV4 space you will be put on a waiting list with others who have also requested space. Details on the waiting list can be found at https://www.arin.net/resources/guide/ipv4/waiting_list/ . ARIN is currently doing quarterly distributions to folks on the waitlist*. I put an asterisk on the previous statement because there are several variables listed at the waitlist site linked above. Some include:

  • Only organizations holding an aggregate of a /20 or less of IPv4 address space may apply and be approved.
  • The maximum-size aggregate that an organization may qualify for at any one time is a /22.

The site says they do quarterly distributions. I believe this gives ARIN time to reclaim IP space and do a cleanup on it. Depending on when you submit you may have to wait several months or longer for an allocation.

As with V6 space and ASN, you have to do another officer attest, pay your invoice, and then it is allocated.

Origin AS
Origin AS validation is a check and balance. From Arin’s https://www.arin.net/resources/registry/originas/
The Origin Autonomous System (AS) field is an optional field collected by ARIN during all IPv4 and IPv6 block transactions (allocation and assignment requests, reallocation and reassignment actions, transfer and experimental requests). This additional field is used by IP address block holders (including legacy address holders) to record a list of the Autonomous System Numbers (ASNs), separated by commas or whitespace, from which the addresses in the address block(s) may originate.

This is simply a field you fill in on your ARIN account. When you get IP space from ARIN this is *usually* automatic.

Reverse DNS
You will need to point your IP blocks to your or hosted DNS servers for the reverse entries. Many different entities pay attention to reverse DNS entries. If you have clients who run mail servers or similar services, you will need a reverse DNS entry. More information at https://www.arin.net/resources/manage/reverse/

Routing Registry
More and more companies, such as Hurricane Electric, are requiring routing registry entries. I did a pretty in-depth article on routing registries. https://blog.j2sw.com/networking/routing-registries-and-you/
ARIN now has a web-based system for setting up route objects. This web mehtod takes some of the learning curve out of adding things into the ARIN registry. Many exchanges, including FD-IX, are moving toward routing registry support.

RPKI
RPKI is another validation method for verifying you are the proper owner of resources, especially IP blocks. https://www.arin.net/resources/manage/rpki/ . Hosted RPKI is the easiest way to get started with RPKI.

I did an article related to RPKI at https://blog.j2sw.com/networking/bgp/hurricane-electric-now-requires-irr-and-rpki/

Notes
Working with ARIN is a pretty straightforward, but sometimes confusing for the newbie. I offer a package for $799 (plus ARIN fees) where I do all the above for you. I have done this so much over the years we have templates and other shortcuts for the various things done.

If you choose to do this on your own some tips.
1. Don’t be afraid to provide more detail than asked.
2. The ARIN helpdesk is actually helpful. If you get stuck call or e-mail them. They have probably answered your question before and are willing to help.
3. Be prepared to provide information about your network, especially with IPv4 requests. ARIN is wanting to know if you are/will be using resources efficiently.

If you get IPv4 space I would recommend adding the new IP block to your advertisements. Allow it to be learned by the various reverse Geolocation folks. After a week check your blocks using the links on this page: http://thebrotherswisp.com/index.php/geo-and-vpn/. This applies to space allocated from ARIN or purchased from a broker.

If you are looking to purchase blocks for a broker, yu need to get pre-approval from ARIN. Learn more at https://www.arin.net/resources/registry/transfers/preapproval/

Hurricane Electric now requires IRR and filters invalid RPKI

If you are a Hurricane Electric customer you may be receiving e-mails like the following:

Dear ASXXX,

Routing Security Report for ASXXX

Hurricane Electric cares about your routing security.  We filter all BGP sessions using prefix filters based on IRR and RPKI.

This report is being sent to help you identify prefixes which may need either their IRR or RPKI information created or updated 
and to also help you identify possibly hijacked routes you may be accepting and reannouncing.  

Routes with RPKI status INVALID_ASN strongly indicate a serious problem.

IPv4 SUMMARY

Routes accepted: 3
Routes rejected: 3
Routes with RPKI status VALID: 0
Routes with RPKI status INVALID: 0

IPv6 SUMMARY

Routes accepted: 1
Routes rejected: 0
Routes with RPKI status VALID: 0
Routes with RPKI status INVALID: 0

We currently do not have a valid as-set name for your network.  Please add an export line to your aut-num ASXXXX 
that references your as-set name.  For example,

export: to AS-ANY announce your-as-set-name

If you do not currently have an as-set, we recommend you create one named ASXXXX:AS-ALL

Your as-set should contain just your ASN and your customers' ASNs and/or as-sets (not your peers or upstream providers).

What does this mean for you as a service provider? If you use Hurricane Electric as transit or peer with them on an exchange you will need to have ROAs for your blocksand have routing registry objects. I did a tutorial based upon Arin which can be found at: https://blog.j2sw.com/networking/routing-registries-and-you/

In short you need to do the following:

  • Create a mntner object (equivalent of a user account) to give you the ability to create IRR objects in your selected IRR database
  • Create an aut-num to represent your autonomous system and describe its contact information (admin and technical) and your routing policy
  • Create an as-set to describe which autonous system numbers your peers should expect to see from you (namely your own and your transit customers)
  • Create a route/route6 object for every prefix originated from your network
  • Update your peeringdb profile to include your IRR peering policy
  • Generate RPKI https://www.arin.net/resources/manage/rpki/roa_request/#creating-a-roa-in-arin-online

Clarification:
Some folks are confusing having valid ROAs with your router supporting RPKI with route origin validation in real-time. These two are separate things. You create ROA records with your RIR, such as ARIN, which has nothing to do with route validation on your router.

Also, HE is filtering any RPKI INVALID routes. Does this mean they are requiring RPKI? You be the judge.



A secure BGP routing infrastructure using RPKI

This content is for Patreon subscribers of the j2 blog. Please consider becoming a Patreon subscriber for as little as $1 a month. This helps to provide higher quality content, more podcasts, and other goodies on this blog.
To view this content, you must be a member of Justin Wilson's Patreon
Already a qualifying Patreon member? Refresh to access this content.