So, hello, so I will talk about automating BGPP rings in DN42 and how you can do the same.
And I hope you would want to do the same after.
To start, I'm here some cartoon.
I work as an HP system and we're just better at the University of Luxembourg.
I've worked on two years for a long time, I contribute to small things they are in there,
especially PKG-Bull in the afternoon.
It's also my first time presenting that for them.
So just to start, I explain what is DN42.
It's a decent whereas network aimed at milling the real internet and it's an educational
frequent where you can test, where you can manipulate internet technologies and protocols
without in a safe environment, without any risk of breaking the real internet.
It's a real world knife which means it's a novel in network and it aims also at replicating
different sort of bandwidth of latencies.
It's used to, mainly to Internet, it's used mainly as an encryption bring-wood.
Also, at internet for interconnecting community such as the care species,
omelaps sometimes some events and it's ideal for testing any internet protocols,
such as BGP of course.
It's completely community driven so nobody is paid to work on DN42 to my knowledge.
It's completely obvious network.
It's another network so it's built above the internet using mainly VPN tunnels.
I've seen a lot of why you're getting two naps, especially.
It's quite large scale, why not Internet scale but there's something like one thousand participants.
So one thousand, one thousand to the most system numbers and I think around two thousand
goods, two thousand IPv4 plus IPv6 prefixes.
It's also technology-admostic so you're on-coach to use first to join, but if you want to join
the moscisco switch up to you and it's used private address space for IPv4 IPv6 and
private ASN numbers.
So this is actually a visualization of the DN42 network.
You see each dot is an AS and the links are piling, piling links.
So it's a very old ecosystem in the DN42, it's a source of proof which is the registry.
Basically big git repository with all the objects for ASN numbers prefixes.
It's also identity services with a wiz, there's a C, there's a for native and DNS for
the DN42 TLU which is only valid inside the DN42.
It supports R.O.A.R.PKI, there is plenty of community services posted internally like
looking glasses, IRC servers, boards, real-time maps, share servers, share servers or quite
nice because you can connect to the other side of the network and see what happens to
your packets and use standard Linux commands to debug your network in example.
For the web pages with your server, with you are quite nice to generate some traffic.
Vice gaming servers has a whole list on the DN42 website.
So I have to explain a bit my part of the network, my network, experimental network on
the DN42 is called flip-flap, raise my yes number in the top right corner and my
prefixes.
It's based on VPN servers in many geopolitical locations, it's mainly built with
DBN-13 and Bird, so it's multi-home and multi-pop, so I have many routers and many
pop, the point of presence which is a router and many peering.
I use wire gap tunnels personally and I have a full mesh network inside my network
between my servers.
You can actually follow my guide, I push all my nuts on my blog and all my system configs
on GitHub and it was something which was missing when I experimented with DN42 in the
beginning, so all my system configs on them.
This is my registry objects, so to participate to DN42, you have to make up your
pull request with your objects, you need a maintenance object, yes, autonomous system
object, you need of course prefixes, routes, you can have a domain name, so this is
my objects.
What's important is actually to define source of authentication in your maintenance
and your objects, so like a GPG key and such key or both, and this is the map of my small
network.
We're bigger networks inside DN42, but mine is quite nice because it's an international
with four countries in Europe and two in North America, so I have a real life, latencies,
I go to the internet, and I make use of two main dynamic routing protocols, BGP for
internal, for the external routing, so we have inter-AS routing and Babel internally, which
works quite well for an other level of the network.
So nice setup, but what was very, very nice in the story?
No, the frame is that, after setting this up, I had like zero traffic on my network, so
that was nice, but I wanted to play more, and by the main limitation is that I had just
had nothing of peers and I had no transit, so I wanted to scale up my network, and I
provided a lot of automatic playing service, so that people can request BGP pairing session
with me, and it's configured automatically on my side.
So I wrote a small tool, which is called DN42 SSDotopia, sorry for the lack of inspiration.
I, it's a self-service CLI over SSH to request and setup BGP pairing sessions, it's aims to
be kiss.
I have one instance of the S of the Daymond pair pop, it features authentication against
the DN42 Wall Street, so there's nothing to configure manually for the other participants.
It's a custom SSDotable M1 using Paramico, so some of you may know Paramico, because
it's a Python library to write SSH clients, but you can also use it to write SSDotable M1s.
It's a custom CLI, based on the CMD class, and it generates why you're got to know and
about the BGP doing configuration, and it's a mighty license, so you can just fuck on GitHub,
face the link, and demo time, that's very impressive part of the talk.
You can SSH to one of my pop, so here as a I impersonate another participant, you have access,
you have access to my custom CI, some commands, you can use the command tier creates to
give your why you're got endpoint information, and register it, plus a link local IPv6
address for the internal connection, and if you use peer config, there's a summary of
the configuration on both sides, plus an extract of configuration for why you're got and
both.
Okay, then you can just peer status, and because it's a periodic task in the background,
you can generate the ping session every five minutes, so 4, 3, and 5 minutes after, the
way I'll get a tunnel is done, and the BGP ping session is up, so that's it for the
tool, so personally I set it up on all my pops, in a, so the user's can just set it to it,
I'm important for you to find it all, and use peer create, peer config, peer list, peer
remove, and peer status commands, so that I demonstrate it just before, but it's actually
how it works, the user request, the ping session, the two, the demand commits to a local
database, and raise a periodic task, which queries a local database and applies a config, so
local database is actually a SQLite, so it's right for it, and I want it to keep it
like this, so I hope now you want to try a Dien 42, and peer remove me, how to join the party,
you need at least one host with a public IP, so most of Dien 42 seems to be above IPv6,
which means you don't even have to pay for an IPv4, you submit a product request to the
Git-based registry, then you connect with reverse, via manual or automatic pairing, so
there's a lot of things happening on IRC, in the legalist, and step 3, step 3, you set up
your BGP voter, personally I did it on with Dien and BIRT 2, which is the most documented way
of doing it, but you can use whatever implementation you want, so that is a big getting
started guide on the Dien 42 website, but you can have a look, so my advice is a start small,
this was my first network actually, and yeah, I don't need two pops at the same location
and five peering sessions, and actually I lost it, because it was a physical server and
it died, so if I can give a few tips for people who want to try, avoid diameter, it's
full west-fade, and they get the idea of it, especially, you want to try to have different
geographic location, and the way you're doing it is a good service, sorry for that, try to
you're going to replicate your installation several times, so if you personally, I automatically
did everything with terraform and end on C-ball, and actually my own C-ball, but I linked
very, just deeply in my auto-paying service, so you can have a look if you want to replicate,
and other tips, if you want to keep your Dien 42 in front structure, if you want to maintain
it, it should be quite low cost, so you can use ways to don't try to stay, but one of the
big drawback is the latency and latency, and actually if you want to have network traffic
and transit, you can abuse a public code free tiers, or promotional credits, I will not make
a advertisement for crowds, you can buy low cost dedicated servers, but what I did in the beginning
and what I lost some, how I lost my personal choice, or how community providers, and I want to
thank a boxy BSD, which actually provide free instances, so as a conclusion, this is the progression
of my AS in the past year, you see the moment I introduced Dien 42s, such the auto-paying,
in April, at that moment I had a linear, linear creation of peer-wing sessions, between me,
and my AS progressed in the wrong king of Dien 42 auto-paying systems to position 22, I think now I'm 18.
So it's a smooth up shift mode, but it's a left work, yeah it's ranking by some traleti and now
as a conclusion, so I think my auto-paying service quickly simplifies peering in Dien 42,
by automating configuration exchange, it's not faster than using E-maps or IRC,
for future work, I think I should really improve the configuration generation and deeper
progress process, because actually at the moment, it's a bit of glue involved with bash scripts,
but I like to support GPG based authentication, because I know some people don't use
a, some people don't use SSH authentication in the registry, so I like to support GPG and
what I would really like is to see over AS maintenance,
what I would really like is to see over Dien 42 AS maintenance, trying adopt my service and trying it,
as a broader vision, I think we should create more peerings between Dien 42, I think it's
two-some threat at the moment and one of my initial parameters was that I have no real note
transit for my AS, and I think if we had more automatic peering services, we've been the Dien 42
network, when it would be less centralized and I think it's what we should aim for,
and I still have some time, what I would really like to say is it's really an awesome
unique environment to learn about networking, Dien 42, and if I hope you want to try now,
it's a lot better than what you can do in a classroom or in our lab with services
at the same place with one millisecond latency, here you will have a real
something which looks like real world with flip-flopping links, packet loss,
latency range, latency is an important way to choose, but what's it?
So thank you for attention, left as an exercise, you can download this slide,
you risk your code, but it's on Dien 42, so you have to join first,
and I shall have any questions.
So I have some connections with ripe, which you might know about, and an L-nog,
which is the Dutch network operators group, and I've seen some interest in the Dien 42 networks
already there, but do you know if there's any presence like the L-nog
ring project available in Dien 42, which is a monitoring system like looking glass with shell
servers, they might be interested in actually deploying there as well, do you know anything with that?
Absolutely not, I'm sorry. No worries, thank you very much, but I'm interested.
We can plot after the griddle. Any more questions?
Okay, then that's it, thank you very much.
Thank you very much, thank you very much.