Case
Clean-up of a large BGP estate, with weekly drift checks
Deze case is voorlopig alleen in het Engels beschikbaar.
Samenvatting
Het probleem
BGP sessions built up over years: a share of them down for weeks without anyone being paged, filtering that differed from router to router, and no single view of what each session was meant to carry.
Wat we deden
Collected every router’s configuration read-only and reviewed every session: state, import and export policy, prefix limits, authentication and RPKI validation. Moved per-session policy into templates in a peering management tool, set up a daily IRR prefix-list refresh and a weekly check that each router matches what the templates would render, and shut the sessions that had been down for weeks.
Resultaat
Stale sessions shut, prefix limits added to peering sessions, and the NOC gets a weekly report of any router that has drifted from its templates.
Meer in detail
Reading before changing
The review started with a collector that logs in to each router with a read-only account, runs show commands, strips secrets and writes the result to a git repository. Every finding afterwards points at a specific line on a specific router, and anyone on the team can check it.
Policy as data
Hand-edited policy is where drift comes from. Moving per-session import and export policy into central templates meant a change is made once and rendered to every router the same way. A weekly job renders the expected configuration, compares it with what is actually on each router, and predicts which changes would reset a session before anyone pushes them.
Housekeeping that stays done
Customer prefix lists are rebuilt from the IRR every day, so a customer’s new prefix doesn’t wait for a ticket. Sessions that have been down for weeks are disabled on a schedule, with the list kept as a record, so they stop hiding real failures in the monitoring.