RFC 6382

Unique Origin Autonomous System Numbers (ASNs) per Node for Globally Anycasted Services

📅 published October 2011, from ietf

Unique Origin Autonomous System Numbers (ASNs) per Node for Globally Anycasted Services 🌸

Okay bestie, this is RFC 6382 💖 It's a Request for Comments from the Internet Engineering Task Force (IETF), written by D. McPherson, R. Donnelly, and F. Scalzo, all from Verisign, Inc. 🦋 It's a Best Current Practice (BCP: 169), so it's giving official recommendations, not just a suggestion 👑 Its category is Best Current Practice, its ISSN is 2070-1721, and it's dated October 2011. It doesn't obsolete or update any other documents, so it's a standalone queen 💅

Abstract ✨

This doc makes recommendations about using unique origin autonomous system numbers (ASNs) per node for globally anycasted critical infrastructure services 🏗️ The whole point is to create routing system discriminators for a given anycasted prefix. Network management and monitoring techniques, or other operational mechanisms, may employ this new discriminator in whatever manner best accommodates their operating environment.

Status of This Memo 📜

This memo documents an Internet Best Current Practice. 🎀

This document is a product of the Internet Engineering Task Force (IETF). It represents the consensus of the IETF community. It has received public review and has been approved for publication by the Internet Engineering Steering Group (IESG). Further information on BCPs is available in Section 2 of RFC 5741.

Information about the current status of this document, any errata, and how to provide feedback on it may be obtained at http://www.rfc-editor.org/info/rfc6382. 🔗

Copyright Notice ⭐

This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (http://trustee.ietf.org/license-info) in effect on the date of publication of this document. Please review these documents carefully, as they describe your rights and restrictions with respect to this document. Code Components extracted from this document must include Simplified BSD License text as described in Section 4.e of the Trust Legal Provisions and are provided without warranty as described in the Simplified BSD License. 🫶

Table of Contents 📑

1. Introduction ....................................................2
2. Terminology .....................................................4
3. Recommendation for Unique Origin ASNs ...........................5
4. Additional Recommendations for Globally Anycasted Services ......6
5. Security Considerations .........................................7
6. Deployment Considerations .......................................7
7. Acknowledgements ................................................9
8. IANA Considerations .............................................9
9. References ......................................................9
   9.1. Normative References .......................................9
   9.2. Informative References .....................................9

1. Introduction 🦋

IP anycasting [RFC4786] has been deployed for an array of network services since the early 1990s. It gives a given network resource a more distributed presence, locally and/or globally, with a more robust and resilient footprint. That commonly means better localization and absorption of systemic query loads, plus better protection against distributed denial-of-service (DDoS) attacks, network partitions, and other similar incidents. A large part of the Internet root DNS infrastructure, as well as many other resources, has been anycasted for nearly a decade. 🌈

The benefits of anycasting network services are proven, but some issues come up when you assert routing system reachability for a common network identifier from multiple locations. Anycasting in BGP requires injecting reachability information into the routing system for a common IP address prefix from multiple locations. These anycasted prefixes and services have traditionally used a common origin autonomous system number (ASN) to preserve the historically scarce 16-bit AS number space that BGP uses for routing domain identifiers in the global routing system. A common origin AS number also eased the management overhead of acquiring and maintaining multiple discrete AS numbers, and it helped avoid triggering operations-oriented reporting functions that look for "inconsistent origin AS announcements" in the routing system. As a result, the routing system path attributes for those service instances, and the anycasted prefix itself, typically bear no per-instance discriminators in the routing system (i.e., within the network control plane itself). 🙈

Service-level query capabilities may or may not offer a way to tell which anycast node answered a particular query, and this is likely both service (e.g., DNS or NTP) and implementation dependent. For example, Name Server Daemon (NSD), Unbound, and BIND all support the hostname.bind or hostname.id [RFC4892] [RFC5001] query, which enables service-level identification of a given server. Tools like traceroute are also used to figure out which location a query is being routed to. However, they may not reveal local-scope anycast instances, or, if there are multiple servers within a given anycast node, which of those servers responded to a given query. This is especially true when multiple servers within an anycast node are connected to a single IP router. When you use these service-level capabilities, query responses are typically both deterministic and inherently topology dependent. Still, these service-level identifiers at the data plane provide no control plane (routing system) uniqueness. 💅

As more services are globally anycasted, and existing anycasted services deploy more anycast nodes for a given service address to handle growing system loads, it gets harder to protect and control those resources. Intuitively, the more widely distributed a given anycasted service address is, the harder it becomes for network operators to detect operational and security issues that affect that service. Some examples include BGP route leaks affecting the anycasted service, rogue anycast nodes appearing for the service, or other aberrant behavior in the routing system, the forward query datapath, or the query response datapath. Diagnosing routing system issues is complicated because no unique discriminators exist in the routing system to identify a given local or global anycast node. On top of that, both datapath and routing system problem identification get compounded, since these incident types can be topologically dependent and only observable between a given client-server set. 😭

Additionally, while it goes without saying that many anycasted services strive for exact synchronization across all instances of an anycasted service address, look at it this way: if local policies or data plane response manipulation techniques "influence" responses within a given region so that they're no longer authentic or diverge from what other nodes within an anycasted service were providing, then it should be an absolute necessity that those modified resources only be utilized by service consumers within that region or the influencer's jurisdiction. ⚠️

Mechanisms should exist at both the network- and service-layer to make it abundantly apparent to operators and users alike whether any of the query responses are not authentic. For DNS, DNSSEC [RFC4033] provides this capability at the service layer with object-level integrity, assuming validation is being performed by recursive name servers. DNSSEC deployment at the root and top-level domain (TLD) levels is well underway [DNSSEC-DEPLOY]. Furthermore, control plane discriminators should exist so operators can know toward which of a given set of instances a query is being directed, and so detection and alerting capabilities can kick in when this changes. Such discriminators may also be employed to enable anycast node preference or filtering keys, should local operational policy require it. 🔥

2. Terminology 📖

This document employs much of the following terminology, which was taken in full from Section 2 of [RFC4786].

Service Address: an IP address associated with a particular service (e.g., the destination address used by DNS resolvers to reach a particular authority server).
Anycast: the practice of making a particular Service Address available in multiple, discrete, autonomous locations, such that datagrams sent are routed to one of several available locations.
Anycast Node: an internally-connected collection of hosts and routers that together provide service for an anycast Service Address. An Anycast Node might be as simple as a single host participating in a routing system with adjacent routers, or it might include a number of hosts connected in some more elaborate fashion. In either case, to the routing system across which the service is being anycast, each Anycast Node presents a unique path to the Service Address. The entire anycast system for the service consists of two or more separate Anycast Nodes.
Catchment: in physical geography, an area drained by a river, also known as a drainage basin. By analogy, as used in this document, the topological region of a network within which packets directed at an Anycast Address are routed to one particular node. 🌊
Local-Scope Anycast: reachability information for the anycast Service Address is propagated through a routing system in such a way that a particular anycast node is only visible to a subset of the whole routing system.
Local Node: an Anycast Node providing service using a Local-Scope Anycast Address.
Global Node: an Anycast Node providing service using a Global-Scope Anycast Address.
Global-Scope Anycast: reachability information for the anycast Service Address is propagated through a routing system in such a way that a particular anycast node is potentially visible to the whole routing system.

The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in [RFC2119]. 🫶

3. Recommendation for Unique Origin ASNs ✨

okay bestie, so the goal here is to catch changes to routing info for critical anycasted resources way faster 🕵️‍♀️ Globally anycasted services with partitioned origin ASNs SHOULD utilize a unique origin ASN per node where possible, if appropriate in their operating environment and service model. 💖

Discrete origin ASNs per node give the routing system a discriminator 🦋 That makes it easier to spot leaked or hijacked instances quicker. It also lets operators who want to be proactive write routing policies with preferences, or avoidance, for a specific node or group of nodes in an anycasted service. This is especially useful when local policy or known issues affect the performance or authenticity of responses from one anycast node 🚩 It's also super handy when policies meant for one region are reaching users outside that region, because the anycast catchment grew past its intended scope 😭

Also, inconsistent origin AS announcements for anycasted services that support critical infrastructure SHOULD NOT be deemed undesirable by routing system reporting functions. Instead, they should be embraced 🫶 They help you figure out how connected and how big a given anycasted service actually is 🌈

Namespace conservation and reasonable use of AS number resources should always be a goal, obviously 💅 But the arrival of 32-bit ASNs really takes the pressure off this area ✨ Globally anycasted resources, especially ones tied to critical infrastructure services like root and TLD name servers, SHOULD warrant special consideration when it comes to AS number allocation practices. That consideration happens during policy development by the constituents of those responsible organizations (for example, the Regional Internet Registries) 👑 Exactly what counts as "critical infrastructure services" or "special consideration" is left to those constituents to decide. For example, they might set aside some small range of 32-bit AS numbers 🧚 Also, critical infrastructure using 32-bit ASNs for new nodes might help speed up how fast network operators adopt native 32-bit ASN support. Main character energy, honestly 🎀

Here's another perk of unique origin AS numbers per anycast node 💜 The Resource Public Key Infrastructure (RPKI) Secure Inter-domain Routing [SIDR] machinery, especially Route Origin Authorizations (ROAs), and any routing policies derived from those ROAs, can work at per-anycast-node resolution. That beats relying on one ROA and one common origin AS to cover every instance of an anycasted prefix, which could mean hundreds of them across the global routing system 🤯 Picture this: a partitioned ASN anycast model with one ASN tied to all nodes, but those nodes cross organizational or political boundaries. Then nobody might be deemed appropriate to hold the key for the ROA 💀 Another scary one: a globally anycasted service in an IP prefix that shares a common ASN could be taken totally offline if the ROA for that origin ASN gets revoked. Today's RPKI model already handles issuing multiple ROAs with unique origins for a given prefix, so it's ready for this 💅

4. Additional Recommendations for Globally Anycasted Services 🌸

Two more recommendations for globally anycasted critical infrastructure services are lowkey important 👀 One is about publishing info on a given node's physical location. The other is about which adjacent upstream ASNs an origin AS interconnects with. The location info would let operators better define and optimize preferences for a node, so they line up with local policy and service optimizations 🎯

The upstream info is where it gets really cool. It could be expressed through policy using the Routing Policy Specification Language [RFC4012] in Internet Routing Registries (IRRs). It would show a discrete set of upstream ASNs for each anycast node, instead of the current model, where all upstream ASNs tied to a common origin AS may or may not be expressed 🙈 This info could add another layer of static routing policy, or support monitoring and detection models for network operators. It might even make explicit network-layer source address validation in the datapath possible 🧠✨

5. Security Considerations 💀

Real talk, this section is serious, so let's get into it 😤 The recommendations in this memo are meant to give network operators more flexibility when they're trying to monitor and prevent problems with globally anycasted critical infrastructure resources. Anycast already gives a lot of protection against certain attacks 🛡️ But here's the catch: if one instance of a service can show up at many points in the routing system, and legitimate instances are hard to tell apart from malicious ones, then anycast actually widens the service's attack surface instead of shrinking it 😱

The recommendations here are meant to help with visibility and policy specification, all so critical Internet resources stay available 🌍 Use cases where these recommendations might have helped detect a particular incident more easily, or scope its impact, are illustrated in [RENESYS-BLOG] 📖

Now, application-layer protections like DNS security extensions (DNSSEC) give object-level integrity and authentication. But they often come with the cost of more failure conditions 😬 For example, say a recursive name server is doing DNSSEC validator functions and gets a bogus response to a query. That could happen through a man-in-the-middle (MITM) attack, or an injected spoofed response packet like a cache-poisoning attempt. The response packet might then be processed by the server and cause some temporary or persistent DoS condition on the recursive name server and its client set 🥺 The unique origin AS mechanism in this document helps here. It lets network operators expressly avoid anycast node catchments that are known to regularly produce bogus responses, while the anycasted service address stays available otherwise 🫶

6. Deployment Considerations 🧚

Keeping unique ASNs for each node in an anycasted service might be challenging for some critical infrastructure service operators at first 😅 But for globally anycasted resources, there needs to be some kind of per-node discriminator in the control plane. That helps with detection, remediation, and ideally preventative controls for routing system anomalies that get worse because of IP anycasting ✨ This technique also sets the stage for RPKI-enabled machinery and more secure, explicit routing policies, which all network operators should be considering 💅

How much detail gets published about anycast node location is up to each services operator, and how valuable that is in their unique environment. Still, each critical services operator should provide some reasonable level of detail. That way operators and service consumers can make informed decisions that line up with their security and operational objectives as outlined here 🌷

Adjacent AS info for a given origin AS can already be found through careful routing system analysis, when prefixes are advertised over a given set of AS adjacencies. So it should present no new threat 🤷‍♀️ That said, network interconnection and peering policies may really create some challenges here. For example, if a technique like unique origin AS per node is used, a single organization might not have one AS for interconnection at each location anymore. Interconnection policies should expressly consider this 🧩 Still, interconnection with networks that provide critical infrastructure services should definitely get due consideration from network operators when they evaluate interconnection strategies 💜

Today, some root and TLD operators spot erroneous anycast prefix announcements by catching prefix announcements with an origin AS other than the common origin AS shared across all nodes 👀 This detection model would need to expand to account for unique origin ASNs per node, if a given service operator decides to use that model 🔍 Here's the tea: AS paths are trivial to manipulate in the current system. So the technique above would only help with unintentional configuration errors that reoriginate the route. It does not detect leaks that preserve the initial path elements 🙃 For that situation, the work underway on routing security origin and path validation in the SIDR working group and beyond should be consulted 📚

Local policy based on any BGP attributes, including AS path information, can influence policy within a local administrative domain and possibly downstream 🌐 But there's a possibility that upstream nodes keep using a route the local administrator deemed undesirable, once data packets reach that network. Network operators must understand the implications of this property in their operating environment, since it is inherent in all Internet routing 😤

Last but not least, anycast node presence at exchange points that use route servers may make it challenging to enumerate the adjacent ASNs for a given node 🫠 This is understood. Even so, service operators should make every effort to enumerate the set of adjacent ASNs associated with a given anycast node's origin AS. Without express understanding of legitimate AS interconnection and authorized origin AS information, more secure routing is difficult to achieve 🔐

7. Acknowledgements 💖

Thanks to David Conrad, Steve Kent, Mark Kosters, Andrei Robachevsky, Paul Vixie, Brad Verd, Andrew Herrmann, Gaurab Raj Upadhaya, Joe Abley, Benson Schliesser, Shane Amante, Hugo Salgado, and Randy Bush for review and comments on this concept 🎀 You all are iconic 👑

8. IANA Considerations 🧾

This document doesn't require any direct IANA actions 🙌 It does, though, give general guidance to number resource allocation and policy development organizations. That includes, in particular, the Regional Internet Registries, for allocating AS numbers for globally anycasted services 🌸

9. References 📚

9.1. Normative References

[RFC2119]  Bradner, S., "Key words for use in RFCs to Indicate
           Requirement Levels", BCP 14, RFC 2119, March 1997.

[RFC4786]  Abley, J. and K. Lindqvist, "Operation of Anycast
           Services", BCP 126, RFC 4786, December 2006.

9.2. Informative References ✨

okay bestie, these are the informative refs 🧚 not required reading, but they're lowkey where the receipts live 💅

[DNSSEC-DEPLOY] "Root DNSSEC", http://www.root-dnssec.org/ 🌈

[RENESYS-BLOG] Zmijewski, E., "Accidentally Importing Censorship", Renesys Blog, March 30, 2010. http://www.renesys.com/blog/2010/03/fouling-the-global-nest.shtml 💀

[RFC4012] Blunk, L., Damas, J., Parent, F., and A. Robachevsky, "Routing Policy Specification Language next generation (RPSLng)", RFC 4012, March 2005. 📜

[RFC4033] Arends, R., Austein, R., Larson, M., Massey, D., and S. Rose, "DNS Security Introduction and Requirements", RFC 4033, March 2005. 🔐

[RFC4892] Woolf, S. and D. Conrad, "Requirements for a Mechanism Identifying a Name Server Instance", RFC 4892, June 2007. 🍓

[RFC5001] Austein, R., "DNS Name Server Identifier (NSID) Option", RFC 5001, August 2007. 🦋

[SIDR] Lepinski, M. and S. Kent, "An Infrastructure to Support Secure Internet Routing", Work in Progress, May 2011. 🎀

Authors' Addresses 💜

meet the squad who wrote it 🫶

Danny McPherson
Verisign, Inc.
21345 Ridgetop Circle
Dulles, VA USA 20166
Phone: +1 703.948.3200

EMail: dmcpherson@verisign.com

Ryan Donnelly
Verisign, Inc.
21345 Ridgetop Circle
Dulles, VA USA 20166
Phone: +1 703.948.3200

EMail: rdonnelly@verisign.com

Frank Scalzo
Verisign, Inc.
21345 Ridgetop Circle
Dulles, VA USA 20166
Phone: +1 703.948.3200

EMail: fscalzo@verisign.com

and that's the whole RFC, periodt! 👑✨

📦 where this page comes from

ietf: rfc6382 2011-10
💖 girlified by claude-haiku-5-5 on 2026-10-17: a language model's rewrite of the original, under its terms