Understanding BGP misconfiguration
Proceedings of the 2002 conference on Applications, technologies, architectures, and protocols for computer communications
BGP Design and Implementation
| Hi-index | 0.00 |
Configuration of interdomain routing policies is notoriously difficult, despite their relatively simple structure. We believe that this difficulty arises in part due to the gap between a network's interdomain traffic goals and the interdomain routing policies which implement them. The gap arises because BGP policy accomplishes network goals indirectly, through interaction with the forwarding plane, and because these goals can often only be met when neighboring networks agree to implement certain policies. We present a case study of the formal verification of a real world BGP configuration, a load-balancing multi-homed network discussed in a book on BGP configuration. We invent a formal specification from the informal description of the example and prove that the BGP policy meets this specification. The goal of this study is to make explicit and precise, the principles used in reasoning about BGP policy. We aim to show not that verification is easy, but rather that this reasoning is far from trivial and that the difficulty in configuring BGP routers may lie not in writing policy, but in understanding the effects of this policy in a complex environment. The study also illustrates some of the benefits of formal specification and verification for BGP policy, namely that such efforts help in discovering ambiguities, inconsistencies and implicit assumptions in specifications and policies. The case study and proofs have been formalized in the Isabelle/HOL theorem prover and are available on the web.