Matching AS paths in gated

An AS path is a list of autonomous systems that routing information has passed through to get to this router and an indicator of the origin of the AS path. This information can be used to prefer one path to a destination network over another. The primary method for doing this with gated is to specify a list of patterns to be applied to AS paths when importing and exporting routes.

Each autonomous system that a route passes through prepends its AS number to the beginning of the AS path.

The origin information details the completeness of AS path information. An origin of igp indicates the route was learned from an interior routing protocol and is most likely complete. An origin of egp indicates the route was learned from an exterior routing protocol that does not support AS paths (EGP, for example) and the path is most likely not complete. When the path information is definitely not complete, an origin of incomplete is used.

AS path regular expressions are defined in RFC 1164, section 4.2.

An AS path is matched using the following syntax:

aspath aspath_regexp origin [ any | igp | egp | incomplete ]

aspath_regexp

Technically, an AS path regular expression is a regular expression with the alphabet being the set of AS numbers. An AS path regular expression is composed of one or more AS path expressions. An AS path expression is composed of AS path terms and AS path operators.

An AS path term is one of the following three objects:

autonomous_system ( aspath_regexp )

autonomous_system

any valid autonomous system number, from one through 65534 inclusive.

matches any autonomous system number.

( aspath_regexp )

parentheses group subexpressions -- an operator, such as ``∗'' or ``?'' works on a single element or on a regular expression enclosed in parentheses.

aspath_term {m,n} aspath_term {m} aspath_term {m,} aspath_term ∗ aspath_term + aspath_term ? aspath_term | aspath_term

aspath_term {m,n}

A regular expression followed by {m,n} (where m and n are both nonnegative integers and m <= n) means at least m and at most n repetitions.

aspath_term {m}

A regular expression followed by {m} (where m is a positive integer) means exactly m repetitions.

aspath_term {m,}

A regular expression followed by {m,} (where m is a positive integer) means m or more repetitions.

aspath_term ∗

An AS path term followed by ∗ means zero or more repetitions. This is shorthand for {0,}.

aspath_term +

A regular expression followed by + means one or more repetitions. This is shorthand for {1,}.

aspath_term ?

A regular expression followed by ? means zero or one repetition. This is shorthand for {0,1}.

aspath_term | aspath_term

Matches the AS term on the left or the AS term on the right.

Network Access Protection Design Guide

Updated: October 6, 2008

Applies To: Windows 7, Windows Server 2008, Windows Server 2008 R2, Windows Vista

Network Access Protection (NAP) is one of the most anticipated features of the Windows Server� 2008 operating system. NAP is a new platform that allows network administrators to define specific levels of network access based on a client�s identity, the groups to which the client belongs, and the degree to which the client complies with corporate governance policy. If a client is not compliant, NAP provides a mechanism for automatically bringing the client into compliance (a process known as remediation) and then dynamically increasing its level of network access. NAP is supported by Windows Server 2008 R2, Windows Server 2008, Windows 7, Windows Vista�, and Windows� XP with Service Pack 3 (SP3). NAP includes an application programming interface that developers and vendors can use to integrate their products and leverage this health state validation, access enforcement, and ongoing compliance evaluation. For more information about the NAP API, see Network Access Protection (http://go.microsoft.com/fwlink/?LinkId=128423).

The following are key NAP concepts:

NAP Agent. A service included with Windows Server 2008, Windows Vista, and Windows XP with SP3 that collects and manages health information for NAP client computers.
NAP client computer. A computer that has the NAP Agent service installed and running, and is providing its health status to NAP server computers.
NAP-capable computer. A computer that has the NAP Agent service installed and running and is capable of providing its health status to NAP server computers. NAP-capable computers include computers running Windows Server 2008, Windows Vista, and Windows XP with SP3.
Non-NAP-capable computer. A computer that cannot provide its health status to NAP server components. A computer that has NAP agent installed but not running is also considered non-NAP-capable.
Compliant computer. A computer that meets the NAP health requirements that you have defined for your network. Only NAP client computers can be compliant.
Noncompliant computer. A computer that does not meet the NAP health requirements that you have defined for your network. Only NAP client computers can be noncompliant.
Health status. Information about a NAP client computer that NAP uses to allow or restrict access to a network. Health is defined by a client computer's configuration state. Some common measurements of health include the operational status of Windows Firewall, the update status of antivirus signatures, and the installation status of security updates. A NAP client computer provides health status by sending a message called a statement of health (SoH).
NAP health policy server. A NAP health policy server is a computer running Windows Server 2008 with the Network Policy Server (NPS) role service installed and configured for NAP. The NAP health policy server uses NPS policies and settings to evaluate the health of NAP client computers when they request access to the network, or when their health state changes. Based on the results of this evaluation, the NAP health policy server instructs whether NAP client computers will be granted full or restricted access to the network.