I've been telling people how to run BGP in their networks for many years, so it's high time I checked whether what I tell people gels with published best practices. So I typed "BGP best practices" in a Google search box... and got many pages with results. It took me two days to work through that.

But it turns out most of the search results are limited in some way: they only focus on one vendor, only on one small aspect of BGP, are outdated, or just not very good. However, there are four documents that I think deserve qualified recommendations, and one honorable mention:

ANSSI BGP configuration best practices. This is a relatively long document, but it gets very to the point while also explaining why each practice is necessary or useful, and how to implement it.

Philip Smith's BGP Best Current Practices Philip Smith has given this presentation around the world since at least 2005. So make sure you find a recent version of these slides. The slides have a ton of practices, but very little in the way of explanation why they're necessary or useful. I'm sure he covers that in the presentation, it's just not on these slides.

NSA's A Guide to Border Gateway Protocol (BGP) Best Practices Unsurprisingly, this covers just BGP security practices.

The Mutually Agreed Norms for Routing Security (MANRS) Network Operator Actions. This MANRS guide is not exactly a best practices guide. Rather, it goes into the four MANRS principles of network operation:

Prevent propagation of incorrect routing information (filters)
Prevent traffic with spoofed source addresses
Facilitate communication between network operators
Facilitate validation of routing information (RPKI)

It does have extensive guidance and examples on how to set everything up to accomplish these goals.

Honorable mention: NIST's Border Gateway Protocol Security recommendations. This has some good background information, but as the document was published in 2007 and not updated, it's not a good source of current best practices.

Permalink

Time to write a new BGP book

▼ 20 years ago this month, my book BGP: building reliable networks with the Border Gateway Protocol was published by O'Reilly.

My 20 author copies of the book arrived a bit later:

Back in those days, publishers would only order a print run if they thought they could sell those copies in a reasonable amount of time. (I think print runs of about 1000 copies to be sold within a year.) If not, no more print runs, and the book would be out of print.

But right around the time sales dipped below the levels required for continued print runs, it started to become possible to have books printed on demand. These days, print on demand shops will print a single book on demand, and you wouldn't know the difference between such a book and a traditionally printed one. So it looks like the old book will be available "in print" forever.

But isn't all the info in the book completely outdated by now?

Perhaps surprisingly, a large part of the book is still current and relevant. When the book was published, BGP version 4 had been around for about a decade. And BGP version 4 is still what we use today. But there have been many (optional) additions to the protocol, and the environment in which BGP finds itself today has evolved.

So time for something new. However, doing an update of the existing book was not in the cards.

So instead, I'm currently writing a new BGP book. This one will be shorter and focus on core BGP topics. It will also have lots of examples that you can try out yourself in a "BGP mini lab".

Keep an eye on this page for updates.

Permalink - posted 2022-09-29

What are the best BGP best practices?

Time to write a new BGP book

Time to write a new BGP book

Skyline #15, regenboog vlak na zonsopkomst

Schenkkade Den Haag

Skyline #14: heatwave edition

Olivia Newton-John: Xanadu