14 Jun
2015
14 Jun
'15
8:20 p.m.
On Sun, Jun 14, 2015 at 05:26:26PM -0700, Tim Osburn wrote:
This only requires at
least 1 (or more) ISP (or companies running BGP) willing to setup a
BGP over GRE tunnel to Brian's server to make this work. There are
currently two ISP I know of willing to do this if Brian is willing to
do this on the AMPRnet Server shown in the drawing.
I'm willing but not able. The server 'amprgw' is an old FreeBSD system
that doesn't understand GRE. We have been discussing updating it to
a more modern system (both hardware and software) but at this point
it doesn't seem like that's going to happen. We've not been able to
identify ANY router product that can do what the gateway needs to do
in order to replace 'amprgw'.
I have an alternative suggestion, which would be to find an ISP or two
that are willing to take over the IPIP tunnel routing.
They would BGP advertise /24 summary routes for the smaller tunnels, as well
as appropriate routes for the wider tunneled subnets. That way there is
no fixed route that blinds the tunnels to the BGP subnets. UCSD could
still advertise the 44/8 overarching route (which I strongly believe is
essential to preventing prefix hijacks), but since there would be more
specific routes for the BGP and tunnel subnets, that wouldn't matter.
It would only be necessary for the tunneled gateways to change their
tunnel endpoint address -- there is no need for tunneled gateways to
suddenly have to change software or overall configuration.
Flaws?
- Brian