Interconnection Automation For All - GPF 2023
0 likes16 views
Matt "Grizz" Griswold and Chris Grundemann are both IX founders, internetworking experts, and automation proponents. With around 4 decades of combined experience they are now turning to sharing what they've learned about automating BGP and interconnection through a set of open source tools, along with support and services for those that need it. This talk will share what they have learned both from personal experience as well as through dozens of recent interviews with IX operators and interconnection engineers over the past several months. Including common challenges and best practices. The highlight of the talk will be announcing and describing two open source automation tools built to make interconnection and BGP easier for everyone. One is ixCtl, which is built to automate the most common and problematic tasks involved in running an internet exchange point, particularly configuring and managing secure route servers. The other is PeerCtl, which is built to automate the most common and problematic tasks involved in interconnecting an AS; from bilateral and multilateral peering to PNI and also transit connections. Code for both (along with several other tools) is available on GitHub: https://github.com/fullctl
![Not Alone
● PeeringDB
● NetBox (& Nautobot)
● Kentik [tooling/telemetry]
● BGPQ4
● Global Traceroute
● IXP Manager
● Peering Manager
● Rancid
https://openpipes.net](https://image.slidesharecdn.com/interconnectionautomationforall-230620165431-0b422f56/85/Interconnection-Automation-For-All-GPF-2023-27-320.jpg)
More Related Content
Similar to Interconnection Automation For All - GPF 2023 (20)
Recently uploaded (19)
Interconnection Automation For All - GPF 2023
- 2. Agenda 1. Who are we? 2. What are we talking about? 3. What have we learned? 4. What are we doing about it? 5. What can you do to help? 6. What else should be done? 7. Comments thinly veiled as questions.
- 3. Chris Grundemann ● 20+ years in networking ● Co-founder of IX-Denver ● OIX Director ● 8 patents in NetTech ● Co-founder and CSO at FullCtl ● 20+ years in software development ● Co-founder of UIX / ChIX ● OIX Director ● PeeringDB Maintainer ● Co-Founder and CTO at FullCtl Matt “Grizz” Griswold
- 4. Sure, but why are you here? ● Age of Interconnection ● BGP is hard (for some) ● Lack of Standardization (for all) ● Lack of Automation (for many) ?
- 5. Age of Interconnection ● Peering managers on cruise ships ● Death of peering?
- 6. Age of Interconnection ● Cloud ● COVID ● Beyond LAN & WAN ● Digital Equity ● Security ● Reliability
- 7. But… BGP is hard (for some) ● For many, it’s a FLW, despite being a TLA ● Traditionally avoided by most ○ Enterprise ○ Public Sector ○ SMB (of course?) ● Also hard to find at ○ WISPS ○ FISPS ○ Electric Co-ops ● And now we have RPKI
- 8. Plus: Lack of Standardization ● Most networks heterogeneous ○ And Bespoke ● Unique policy requirements ○ TE, etc. ● Communities in use by ISP/IX/etc ○ More than just RTBH ● How-to request interconnection ○ Coordination can be painful ● LOAs ○ Don’t get us started…
- 9. And: Lack of Automation ● Almost nobody has “enough” ● Many lacking SoT ● Most lacking end-to-end flow ● Hard to automate w/out standard(s) ● Tough to test w/out lab (dev env)
- 10. So… What are we going to do about it? ● ixCtl ● PeerCtl ● PrefixCtl ● …you get the idea
- 11. So… What are we going to do about it? ● ixCtl ● PeerCtl ● PrefixCtl ● …you get the idea ● Taking the best of all of “us” and embedding that knowledge into simple tools
- 13. FullCtl Suite ● modern, modular, Unix philosophy services ● 100% API driven ● manage infrastructure ● automate provisioning ● source of truth for wider automation efforts https://github.com/fullctl/
- 14. Foundations :: aaaCtl https://github.com/fullctl/aaactl Granular Permissions Fine grained user and role permissions down to each object level Audit logs Audit logs for other running services. Oauth | SAML Integrates with existing aaa services. Azure AD, Okta, PeeringDB, et al Oauth | SAML Integrates with existing aaa services. Azure AD, Okta, PeeringDB, etc
- 15. Foundations :: aaaCtl ● Authentication and Authorization gateway ○ Client - integrates with existing directories ○ Provider - can be used as a SoT ● RBAC permissioning ● Audit logging https://github.com/fullctl/aaactl
- 16. Foundations :: DeviceCtl ● Source of truth for devices ● Bidirectional sync to other sources of truth ○ Netbox, Nautobot, Proprietary systems, etc ○ PeeringDB facilities, geoloc data ● Caching and verification https://github.com/fullctl/devicectl
- 17. Metadata :: PrefixCtl Used as a SoT for prefixes Bidirectional sync Attaches and updates metadata ● IRR ● RPKI status ● IP reputation ● Geoloc data https://github.com/fullctl/prefixctl *OSS coming soon
- 18. ixCtl An automation platform purpose built for internet exchange operators. ● modern, modular application ● 100% API driven ● manage infrastructure ● automate provisioning ● source of truth for wider automation efforts ● connected networks get access to the PeerCtl dashboard https://github.com/fullctl/ixctl
- 19. ixCtl turnkey route servers 1. Click “import” to pull baseline data on connected networks from PeeringDB 2. Hit “configure route server” and add basic info to generate secure configurations 3. 1 time ansible (VM/BM) or helm (k8s) deploy for managed containers, or curl into your own setup 4. enjoy karmic bliss, knowing that your route servers are automatically contributing to the good of the internet! https://github.com/fullctl/ixctl
- 20. ixCtl - Not “Just” Route Servers ● SoT for devices and ports ● Building graphs ● Manage members / IX-F output for PeeringDB, etc ● Allow member access to update mac address, max prefix, etc https://github.com/fullctl/ixctl
- 21. ixCtl - Coming Soon ● Public Portal ● Client Portal ● LOA Generation ● AS112 Configuration ● Advanced Route Server Management ● Automated Switch Configuration ● $your_idea_here https://github.com/fullctl/ixctl
- 22. PeerCtl Interconnection automation and workflow management. ● modern, modular, Unix philosophy services ● 100% API driven ● manage infrastructure ● automate provisioning ● source of truth for wider automation efforts ● Open Source or As A Service https://github.com/fullctl/peerctl
- 23. PeerCtl Peering Toolkit 1. You select an IX. PeerCtl shows you all of the possible peers at that location. 2. You select a peer. PeerCtl provides BGP configurations and email templates to get connected. 3. You want more. PeerCtl shows you all of the other mutual exchanges where you can interconnect with this peer. https://github.com/fullctl/peerctl
- 24. PeerCtl - but wait, there’s more ● All kinds of “peers” ○ Bilateral, multilateral, PNI, transit, transport ● Source of truth for your Interconnection efforts ○ Sync with third party inventory via DeviceCtl ○ Stay virtual with PDB Ports ● Extensibility ○ PeerCtl BGP configurations are extensible and customizable with templates ○ Templates also allow you to extract peering data for other uses ○ Email templates with override also (and pdb contacts, etc) ● “show BGP summary” ○ View all sessions at once ● Import from network ○ Pull in existing BGP sessions https://github.com/fullctl/peerctl
- 25. PeerCtl - Coming Soon ● Public Peering Portal ○ for third parties to use when requesting peering with your network ● “Where To Peer” Improvements ○ integrating traffic analysis to provide intelligent recommendations ● PeeringDB Integration Improvements ○ enable pushing updates to PeeringDB from PeerCtl ○ enable you to add networks to PeerCtl that are not listed in PeeringDB ● UX Improvements ○ enhanced alerting, along with interface design improvements https://github.com/fullctl/peerctl
- 26. Wanna Play? https://account.fullctl.io Contact us about lab demos.
- 27. Not Alone ● PeeringDB ● NetBox (& Nautobot) ● Kentik [tooling/telemetry] ● BGPQ4 ● Global Traceroute ● IXP Manager ● Peering Manager ● Rancid https://openpipes.net
- 28. What else can we do? Time for comments thinly veiled as questions... FullCtl.com