On Sun, Jun 14, 2015 at 05:26:26PM -0700, Tim Osburn wrote:
This only requires at least 1 (or more) ISP (or companies running BGP) willing to setup a BGP over GRE tunnel to Brian's server to make this work. There are currently two ISP I know of willing to do this if Brian is willing to do this on the AMPRnet Server shown in the drawing.
I'm willing but not able. The server 'amprgw' is an old FreeBSD system that doesn't understand GRE. We have been discussing updating it to a more modern system (both hardware and software) but at this point it doesn't seem like that's going to happen. We've not been able to identify ANY router product that can do what the gateway needs to do in order to replace 'amprgw'.
I have an alternative suggestion, which would be to find an ISP or two that are willing to take over the IPIP tunnel routing.
They would BGP advertise /24 summary routes for the smaller tunnels, as well as appropriate routes for the wider tunneled subnets. That way there is no fixed route that blinds the tunnels to the BGP subnets. UCSD could still advertise the 44/8 overarching route (which I strongly believe is essential to preventing prefix hijacks), but since there would be more specific routes for the BGP and tunnel subnets, that wouldn't matter. It would only be necessary for the tunneled gateways to change their tunnel endpoint address -- there is no need for tunneled gateways to suddenly have to change software or overall configuration.
Flaws? - Brian