Anapaya appliance configuration (scion_tunneling only)

scion_tunneling object

Top-level configuration and state for IP-in-SCION tunneling.

domains object[]

List of domains that define the rules by which IP packets are routed. A domain is a subset of the IP space that shares the same policies.

Array [

defaultboolean

Whether this domain is the default domain. The default domain is assumed to accept the whole IP space that is not covered by other domains. Because of this it may not specify an accept-filter.

descriptionstring

Optional description, or comment, for the domain.

Example: The domain. It matches all packets and allows any path to be used.

disabledboolean

Whether the domain should be disabled.

Default value: false

encryptionstring

The payload encryption mode for the domain.

Possible values: [DISABLED, ENABLED, OPTIONAL]

local_isd_asesstring<isd-as>[]

List of local ISD-AS identifiers that belong to this domain. Traffic towards remote ISD-ASes is guaranteed to only use paths that start at one of these local ISD-ASes.

namestringrequired

The name of the domain.

Example: Default Domain

prefixes object

List of IP prefix matchers to filter the announced and received prefixes.

accept_filter object[]

List of IP prefix matchers to define which prefixes announced by remotes ISD ASes are accepted. Only the matching subset of a prefix announced by a remote ISD-AS is is accepted for routing.

Array [

actionstringrequired

Specify matchers action.

Possible values: [ACCEPT, REJECT]

descriptionstring

Optional description for the prefix matcher.

prefixesstring<ip-prefix>[]

The list of IP prefixes used for matching. The matcher matches all IP prefixes that are contained in the union of the specified IP prefixes, i.e. it matches all listed prefixes as well as their contained more specific prefixes.

Example: ["192.168.1.0/24"]

sequence_idinteger<uint32>required

The sequence ID determines the order in which sequence the prefix matchers are applied. The sequence ID must be unique for each entry. Target devices apply the prefix matchers in order of ascending sequence ID (low to high) accepting all IPs that are in accepted matchers and rejecting the ones that are in rejected matchers.

Example: 1

]

announce_filter object[]

List of IP prefix matchers to filter prefixes announced to remotes. The prefixes to be announced are configured in the static announcements or BGP. Only the subset of the routes that matches the announce filter is advertised to the remotes.

Array [

actionstringrequired

Specify matchers action.

Possible values: [ACCEPT, REJECT]

descriptionstring

Optional description for the prefix matcher.

prefixesstring<ip-prefix>[]

The list of IP prefixes used for matching. The matcher matches all IP prefixes that are contained in the union of the specified IP prefixes, i.e. it matches all listed prefixes as well as their contained more specific prefixes.

Example: ["192.168.1.0/24"]

sequence_idinteger<uint32>required

The sequence ID determines the order in which sequence the prefix matchers are applied. The sequence ID must be unique for each entry. Target devices apply the prefix matchers in order of ascending sequence ID (low to high) accepting all IPs that are in accepted matchers and rejecting the ones that are in rejected matchers.

Example: 1

]

remote_isd_ases object[]

List of remote ISD-AS identifiers that belong to this domain. Prefix announcements will be accepted from these remote ISD-ASes. All IP traffic will be tunneled over paths that end in one of these remote ISD-ASes.

Array [

actionstringrequired

Specify the matchers action.

Possible values: [ACCEPT, REJECT]

descriptionstring

Description for the remote matcher.

isd_asstring<isd-as>required

The ISD-AS identifier. The matcher matches the ISD-AS identifier of a SCION AS. 0 indicates a wildcard (both for ISD and AS).

Example: 0-ff00:0:310

sequence_idinteger<uint32>required

The sequence ID determines the order in which sequence the remote matchers are applied. The sequence ID must be unique for each entry. Target devices apply the remote matchers in order of ascending sequence ID (low to high).

Example: 1

]

traffic_policies object[]

List of traffic policies that configure the types of traffic that are tunneled via this domain and the tunnel properties. A traffic policy defines a matcher on the IP traffic (the traffic matcher). If the IP traffic matches, it is tunneled to the remote SCION AS. Acceptable paths for the tunnel are defined via the path policy

Array [

descriptionstring

The optional description of the traffic policy.

Example: Default traffic policy

failover_sequence object[]

A list of failover sequence entries, each of them associated with a path filter. If there's no live path left after applying the first filter the second one is tried and so on.

Array [

path_filterstringrequired

Name of the path filter associated with the failover sequence entry.

sequence_idinteger<uint32>required

Sequence number of the failover sequence entry. Sequence numbers define the ordering of the items which turn detemines how the failover between different path filters happens.

Example: 1

]

sequence_idinteger<uint32>required

The sequence ID determines the order in which sequence the traffic policies are applied. The sequence ID must be unique for each entry. Target devices try to find the first entry with a matching traffic matcher in ascending order determined by the sequence ID (low to high).

Example: 1

traffic_matcherstringrequired

Reference of the traffic matcher that is utilized by this policy. The traffic matcher is a selector for the IP packets covered by this traffic policy.

]

]

endpoint object

Local IP-in-SCION tunnel endpoint configuration

allowed_interfaces object[]

The SCION interfaces for each local SCION AS that are allowed to be used by this IP-in-SCION tunneling endpoint. This can be used to control incoming traffic, e.g., if a tunnel endpoint should only be reachable via SCION interfaces 1 and 2, allowed-interfaces should list them explicitly. Remote tunnel endpoints will then only choose paths entering the respective local AS via SCION interface 1 or 2. If the IP-in-SCION tunneling endpoint on this appliance should be reachable via a SCION interface of a peer appliance, the allowed-interfaces list must be configured with the respective SCION interface of the peer appliance. By default the list is empty, in this case the appliance will automatically configure the locally configured SCION interfaces as allowed-interfaces. Automatic configuration is disabled if topology synchronization is enabled or if disable_auto_allowed_interfaces is set.

Array [

interfacesinteger<uint16>[]

List of allowed interfaces for this SCION AS

Example: [2,3]

isd_asstring<isd-as>

The SCION AS where the list of allowed interfaces applies. Packets to this IP-in-SCION tunnel endpoint in this SCION AS will only arrive on the listed interfaces.

]

control_portinteger<uint16>

Port number for control traffic. The control address is constructed from the ip address and this control port. The control address is used to exchange IP routing information as part of SGRP. If not set, or zero, the control port will be dynamically allocated.

Example: 40201

data_portinteger<uint16>

Port number for data traffic. The data address is constructed from the ip address and this control port. The data address is used for the IP-in-SCION encapsulated traffic stream. If not set, or zero, the data port will be dynamically allocated.

Example: 40200

descriptionstring

Optional description of the IP-in-SCION tunnel endpoint.

disable_auto_allowed_interfacesboolean

Whether the automatic configuration of allowed interfaces should be disabled. When disabled, the IP-in-SCION tunneling endpoint will be reached by remote endpoints on all SCION interfaces of the locally configured AS. When enabled (default), the local IP-in-SCION tunneling endpoint will only be reached by remote endpoints on the SCION interfaces that are configured on the local appliance.

disable_urpfboolean

Flag to disable uRPF. When enabled (default), the gateway performs strict URPF for all the received IP-in-SCION-tunneled traffic, checking that incoming IP packets have a source address that is within the announced prefixes by a remote gateway, and that the SCION packets are sent from a valid remote ISD-AS and are encrypted as configured in the associated domain.

enable_scion_rssboolean

Flag to activate SCION RSS. If activated, the gateway utilizes UDP source port entropy on the underlay such that EDGE and CORE routers can leverage RSS for SCION traffic. This can greatly improve throughput performance.

Default value: true

enabledboolean

Whether this endpoint is enabled.

encryption object

Payload encryption configuration for the IP-in-SCION tunnel endpoint.

enabledboolean

Whether the payload encryption module is enabled. With payload encryption enabled, the IP packets are encrypted and authenticated before being sent to a remote tunnel endpoint for domains that have the payload encryption enabled. Note that this flag only enables the payload encryption system. Each domain for which payload encryption should be used must still explicitly enable it.

per_remote_sa_limitinteger<uint32>

The maximum number of Security Associations (SAs) that can be established with a single remote AS. If the limit is reached, new SAs from all endpoints in that AS will be rejected.

Default value: 1000

Example: 1000

portinteger<uint16>

Port number for the secure data traffic. The address is constructed from the endpoint IP address and this port. If not set, or zero, the secure data port will be dynamically allocated.

Example: 40203

total_sa_limitinteger<uint32>

The maximum number of Security Associations (SAs) that can be established with remote tunnel endpoints. If the limit is reached, new SAs will be rejected.

Default value: 100000

Example: 100000

ipstring<ip-address>

IP address of the local IP-in-SCION endpoint.

Example: 192.168.1.100

probe_portinteger<uint16>

Port number for probing traffic. The probe address is constructed from the ip address and this probe port. The probe address is used by remote tunnel endpoints in their health probing. If not set, or zero, the probe port will be dynamically allocated.

Example: 40202

path_filters object[]

List of path filters that can be referenced by name from a path policies. A path filter defines a set of paths by applying the filter to all available paths.

Array [

aclstring[]

The ACL that is applied on the path. An ACL consists of a list of ACL entries. Each ACL entry has the form action hop-predicate, where the action can either be accept (+) or deny (-). The hop predicate is optional and has the form isd-as#interface, where isd is the ISD identifier, as is the AS identifier, and interface is the interface identifier of a SCION path hop. The hop predicate can be fully or partially qualified, i.e., all entries of the hop predicate are optional or can include wildcards (0). If no hop predicate is specified the action matches every hop, i.e., a single '+' is the default accept action and a single '-' is the default deny action. The ACL is applied by sequentially applying all ACL entries to paths. If the ACL is empty, it defaults to accepting all paths.

Example: ["+ 64-0"]

descriptionstring

Description, or comment, for the path filter.

Example: Match only paths in the Swiss Isolation Domain (ID 64).

hop_patternstring

The sequence of hop predicates that a path has to match to be accepted. Each hop predicate can optionally be extended with a modifier '' or '+'. The '' modifier means 0 or more occurrences. The '+' means one or more occurrences.

Example: 0* 64+ 0+

namestring

Name of the path filter. This is value is used by the path policy to reference the path filter.

Example: CH ISD only

]

remotes object[]

List of remote ISD-ASes that are connected with the gateway. The remote ISD-ASes can be referenced in the remote matchers of the domains.

Array [

descriptionstring

Description or Comment on the remote.

isd_asstring<isd-as>required

The ISD-AS of the remote.

Example: 1-ff00:0:310

]

static_announcements object[]

List of static routes that are advertised. The routes are only advertised to the domains with matching announce filters.

Array [

descriptionstring

Description, or comment, for the target.

next_hop_tracking object

container for next hop tracking

disabledboolean

Whether or not this next-hop is tracked.

targetstring<ip-address>

The routes are only distributed if the address responds to pings. This can be used to implement dynamically retractable routes without having to resort to a dynamic routing protocol.

Example: 192.168.0.1

prefixesstring<ip-prefix>[]required

The IP prefixes that are statically configured and advertised via SGRP

Possible values: >= 1

Example: ["192.168.1.0/24","172.30.100.0/28"]

sequence_idinteger<uint32>required

The sequence ID defines the order of the static route entries. The sequence ID must be unique for each entry.

Example: 1

]

traffic_matchers object[]

List of traffic matchers that can be referenced by name from a traffic policy. A matcher is used to classify traffic for tunneling. Each packet is classified based on configured traffic matchers and put in a traffic class. A traffic class is used in a traffic policy to map a path policy to a traffic class.

Array [

conditionstringrequired

The condition for traffic to match this traffic matcher.

Example: BOOL=true

descriptionstring

Description, or comment, for the traffic matcher

Example: 'all packets' matches all packets.

namestringrequired

Name that identifies the traffic matcher. This is value is used by the traffic policy to reference the traffic matcher.

Example: all packets

]

Config_ScionTunneling_Wrapped

{
  "scion_tunneling": {
    "domains": [
      {
        "default": true,
        "description": "The domain. It matches all packets and allows any\npath to be used.",
        "disabled": false,
        "encryption": "DISABLED",
        "local_isd_ases": [
          "string"
        ],
        "name": "Default Domain",
        "prefixes": {
          "accept_filter": [
            {
              "action": "ACCEPT",
              "description": "string",
              "prefixes": [
                "192.168.1.0/24"
              ],
              "sequence_id": 1
            }
          ],
          "announce_filter": [
            {
              "action": "ACCEPT",
              "description": "string",
              "prefixes": [
                "192.168.1.0/24"
              ],
              "sequence_id": 1
            }
          ]
        },
        "remote_isd_ases": [
          {
            "action": "ACCEPT",
            "description": "string",
            "isd_as": "0-ff00:0:310",
            "sequence_id": 1
          }
        ],
        "traffic_policies": [
          {
            "description": "Default traffic policy",
            "failover_sequence": [
              {
                "path_filter": "string",
                "sequence_id": 1
              }
            ],
            "sequence_id": 1,
            "traffic_matcher": "string"
          }
        ]
      }
    ],
    "endpoint": {
      "allowed_interfaces": [
        {
          "interfaces": [
            2,
            3
          ],
          "isd_as": "string"
        }
      ],
      "control_port": 40201,
      "data_port": 40200,
      "description": "string",
      "disable_auto_allowed_interfaces": true,
      "disable_urpf": true,
      "enable_scion_rss": true,
      "enabled": true,
      "encryption": {
        "enabled": true,
        "per_remote_sa_limit": 1000,
        "port": 40203,
        "total_sa_limit": 100000
      },
      "ip": "192.168.1.100",
      "probe_port": 40202
    },
    "path_filters": [
      {
        "acl": [
          "+ 64-0"
        ],
        "description": "Match only paths in the Swiss Isolation Domain (ID 64).",
        "hop_pattern": "0* 64+ 0+",
        "name": "CH ISD only"
      }
    ],
    "remotes": [
      {
        "description": "string",
        "isd_as": "1-ff00:0:310"
      }
    ],
    "static_announcements": [
      {
        "description": "string",
        "next_hop_tracking": {
          "disabled": true,
          "target": "192.168.0.1"
        },
        "prefixes": [
          "192.168.1.0/24",
          "172.30.100.0/28"
        ],
        "sequence_id": 1
      }
    ],
    "traffic_matchers": [
      {
        "condition": "BOOL=true",
        "description": "'all packets' matches all packets.",
        "name": "all packets"
      }
    ]
  }
}