Building Internet Firewalls

Building Internet FirewallsSearch this book
Previous: C.9 The IP AddressAppendix C
TCP/IP Fundamentals
Next: C.11 The Routing Table
 

C.10 Internet Routing Architecture

In the traditional Internet structure, there was a hierarchy of gateways. This hierarchy reflected the history of the Internet, which was built upon the existing ARPANET. When the Internet was created, the ARPANET was the backbone of the network: a central delivery medium to carry long-distance traffic. This central system was called the core, and the centrally managed gateways that interconnected it were called the core gateways.

When a hierarchical structure is used, routing information about all of the networks in the Internet is passed into the core gateways. The core gateways process this information, and then exchange it among themselves using the Gateway to Gateway Protocol (GGP). The processed routing information is then passed back out to the external gateways. You won't run GGP on your local gateway; it is only used by core gateways.

Outside of the Internet core are groups of independent networks called autonomous systems (AS). The term "autonomous system" has a formal meaning in TCP/IP routing. An autonomous system is not merely an independent network. It is a collection of networks and gateways with its own internal mechanism for collecting routing information and passing it to other independent network systems. The routing information passed to the other network systems is called reachability information. Reachability information simply says which networks can be reached through that autonomous system. The Exterior Gateway Protocol (EGP) is currently the protocol most frequently used to pass reachability between autonomous systems (see Figure 13.18).

Figure 13.18: Gateway hierarchy

Figure 13.18

The Defense Data Network (DDN) portion of the Internet still uses the core model to distribute routing information. But this hierarchical model has a major weakness: every route must be processed by the core. This places a tremendous processing burden on the core, and as the Internet grows larger, the burden increases. In network-speak, we say that this routing model does not scale well and for this reason, a new model is emerging.

The new routing model is based on coequal collections of autonomous systems, called routing domains. Routing domains exchange routing information with other domains using Border Gateway Protocol (BGP) or EGP. Each routing domain processes the information it receives from other domains. Unlike the hierarchical model, this model does not depend on a single core system to choose the "best" routes. Each routing domain does this processing for itself; therefore, this model is more expandable. Figure 13.19 represents this model with three intersecting circles. Each circle is a routing domain. The overlapping areas are border areas, where routing information is shared. The domains share information, but do not rely on any one system to provide all routing information.

Figure 13.19: Routing domains

Figure 13.19

No matter how it is derived, eventually the routing information winds up in your local gateway, where it is used by IP to make routing decisions.


Previous: C.9 The IP AddressBuilding Internet FirewallsNext: C.11 The Routing Table
C.9 The IP AddressBook IndexC.11 The Routing Table