Researchers and network operators often say that BGP table transfers are slow. Despite this common knowledge, the reasons for slow BGP transfers are not well understood. This paper explains BGP table transfer delays by combining BGP messages collected at a large VPN provider backbone and controlled experiments with routers of three different vendors as well as a software BGP speaker. Our results show that table transfers both in the provider network and in the controlled experiments contain gaps, i.e., periods in which both the sending and receiving routers are idle, but no BGP routes are exchanged. Gaps can represent more than 90% of the table transfer time. Our analysis of a software router and discussions with router vendors indicate that gaps happen because of the timer-driven implementation of sending of BGP updates. Hence, gaps represent an undocumented design choice that gives preference to more controlled router load over faster table transfers.

Understanding slow BGP routing table transfers

Large enterprises often have sites that are spread in distant locations. These scattered sites need to interconnect with the same level of security and privacy as in a local area network. Virtual Private Networks (VPNs) were used to serve this need. A common VPN topology was composed of Multiprotocol extensions for the Border Gateway Protocol (MP-BGP) and Multiprotocol Label Switching (MPLS). This technology preserves privacy among multiple VPN via MPLS tunnels traffic isolation, whereas BGP distributes VPN route informations. Despite the wide deployment of BGP MPLS VPNs, the disadvantages of this VPN technology gradually be exposed with the VPN scale expanding.We have a study to the behavior of a large scale VPN. A simple analysis shows that slow routes convergence and slow route table transfer is the main reason. Slow routes convergence makes a increasing time to update exchange update routes between routers, meanwhile, Slow route table transfer leads to a lower utilization of provider backbone.

BGP performance analysis for large scale VPN

The flexibility and ease of setup of MPLS Virtual Private Networks (VPNs) and Virtual Private LAN Service (VPLS) motivate the large and growing user base of these services. It is therefore important for an Internet Service Provider (ISP) to ensure their uninterrupted operation, as also specified in service contracts. Although network monitoring is regarded as an essential activity to pursue this goal, existing monitoring approaches are often limited in the ability to capture the effects of VPN-related events such as reconfigurations and device failures. In this paper we provide several contributions: 1) a methodology to monitor the status of MPLS VPN and VPLS over time, which considers the BGP signaling messages sent by routers to propagate VPN information; the methodology is founded on an analysis of the observable effects of network events; it also envisions presenting the status of MPLS VPN and VPLS in an easy-to-understand visual form that allows to immediately spot potential anomalies; 2) an extensive discussion of the tradeoff between scalability of our monitoring approach and visibility of the effects of network events; 3) an architecture and prototype implementation of a tool based on our methodology; 4) a thorough experimentation of our approach in a realistic network scenario. As an example, the methodology allowed us to spot a subtle routing anomaly triggered by an implementation choice in the routing software used in our experiments.

Monitoring the status of MPLS VPN and VPLS based on BGP signaling information

Enterprises often have sites that are spread in distant locations. These sites need to interconnect with the same level of privacy as in a local-area network. Virtual Private Networks (VPNs) were introduced to serve this need. A common VPN technology uses Multiprotocol extensions for the Border Gateway Protocol (MP-BGP) and Multiprotocol Label Switching (MPLS). This technology allows a service provider to share its IP backbone among multiple VPN clients while preserving privacy. MPLS tunnels provide traffic isolation, whereas MP-BGP distributes VPN routes. Despite the wide deployment of BGP/MPLS VPNs[1], there have been only few studies to understand their behavior, mostly because of the lack of public data. Prior work focused on BGP convergence [3] and on integrity constraints to ensure connectivity [2].

/pdf/origin-of-route-explosion-in-virtual-private-networks-1szxl7tg54.pdf

Marc Capelle

Papers

Origin of route explosion in virtual private networks