Projet

Général

Profil

BGP » Historique » Version 53

Laurent GUERBY, 19/03/2013 01:04

1 20 Laurent GUERBY
{{>toc}}
2 20 Laurent GUERBY
3 1 Laurent GUERBY
h1. BGP
4 1 Laurent GUERBY
5 1 Laurent GUERBY
Nous utilisons BIRD sous Linux comme routeur BGP
6 1 Laurent GUERBY
7 1 Laurent GUERBY
http://bird.network.cz/
8 1 Laurent GUERBY
9 14 Laurent GUERBY
blog bgp http://www.renesys.com/blog/
10 15 Laurent GUERBY
flowspec http://www.slideshare.net/sfouant/an-introduction-to-bgp-flow-spec
11 16 Laurent GUERBY
DFZ = Default Free Zone archive http://archive.routeviews.org/
12 17 Laurent GUERBY
http://www.ripe.net/data-tools/stats/ris/routing-information-service
13 17 Laurent GUERBY
http://pch.net/resources/data/routing-tables/archive/
14 17 Laurent GUERBY
http://pch.net/resources/data/routing-tables/mrt-bgp-updates/
15 18 Laurent GUERBY
http://www.nanog.org/meetings/archive/
16 52 Laurent GUERBY
http://tools.ietf.org/html/draft-lapukhov-bgp-routing-large-dc-02
17 14 Laurent GUERBY
18 43 Laurent GUERBY
http://inside.godaddy.com/inside-story-happened-godaddy-com-sept-10-2012/
19 43 Laurent GUERBY
20 29 Laurent GUERBY
http://www.ipbcop.org/
21 29 Laurent GUERBY
IP Best Current Operational Practices Documented best practices for Engineers by Engineers
22 29 Laurent GUERBY
23 30 Laurent GUERBY
BGP best practices ANSSI
24 30 Laurent GUERBY
https://www.sstic.org/media/SSTIC2012/SSTIC-actes/influence_des_bonnes_pratiques_sur_les_incidents_b/SSTIC2012-Article-influence_des_bonnes_pratiques_sur_les_incidents_bgp-contat_valadon_nataf_2.pdf
25 30 Laurent GUERBY
26 37 Laurent GUERBY
https://www.ams-ix.net/technical/specifications-descriptions/ams-ix-route-servers
27 37 Laurent GUERBY
28 39 Laurent GUERBY
these LAAS BGP http://www.laas.fr/1-31360-Detail-Soutenance-de-these.php?id=600
29 41 Laurent GUERBY
http://www.laas.fr/1-31706-Publications.php?author=7738
30 1 Laurent GUERBY
http://www.net.t-labs.tu-berlin.de/papers/OMUPMO-OOSICP-11.pdf
31 42 Laurent GUERBY
http://hal.archives-ouvertes.fr/docs/00/60/53/83/PDF/dVirt-virtual_platform.pdf
32 42 Laurent GUERBY
http://hal.archives-ouvertes.fr/docs/00/48/70/74/PDF/Poster_SIGCOMM2010_philippe.pdf
33 40 Laurent GUERBY
34 44 Laurent GUERBY
Le monde sur BGP http://reseaux.blog.lemonde.fr/2012/11/04/routage-enjeu-cyberstrategie/
35 44 Laurent GUERBY
36 45 Laurent GUERBY
coupure free wanadoo http://www.journaldunet.com/solutions/0301/030122_freeft.shtml
37 45 Laurent GUERBY
38 46 Laurent GUERBY
tsunami Japon 2011 et BGP : http://archive.psg.com/111206.conext-quake.pdf
39 46 Laurent GUERBY
40 47 Laurent GUERBY
Session is up on telnet:route-views.routeviews.org username rviews
41 47 Laurent GUERBY
42 48 Laurent GUERBY
BGP book http://www.bortzmeyer.org/files/bgp.html
43 48 Laurent GUERBY
44 49 Laurent GUERBY
Cyclops is able to detect several forms of route hijack attacks http://cyclops.cs.ucla.edu/
45 50 Laurent GUERBY
BGPmon monitors the routing of your prefixes and alerts you in case of an 'interesting' path chang http://www.bgpmon.net/
46 49 Laurent GUERBY
47 53 Laurent GUERBY
http://jointtransit.nl/prices.html
48 53 Laurent GUERBY
49 51 Laurent GUERBY
* taille table de routage http://bgp.potaroo.net/
50 51 Laurent GUERBY
51 38 Laurent GUERBY
h1. TouIX et GIX
52 38 Laurent GUERBY
53 38 Laurent GUERBY
http://touix.net
54 38 Laurent GUERBY
http://wikilulu.net/doku.php?id=articles:gix-howto
55 38 Laurent GUERBY
56 3 Laurent GUERBY
h1. Evolutions de la conf BGP
57 3 Laurent GUERBY
58 3 Laurent GUERBY
* http://lists.tetaneutral.net/pipermail/technique/2011-December/000118.html
59 3 Laurent GUERBY
60 5 Laurent GUERBY
TODO: 
61 6 Laurent GUERBY
* mise en place d'un gestionaire de version style git au moins pour documentation
62 5 Laurent GUERBY
* Comment gerer les password MD5 du fichier de conf (les garder secrets tout en publiant le reste)
63 5 Laurent GUERBY
* Atelier ?
64 7 Laurent GUERBY
** Laurent GUERBY
65 9 Raphaël Durand
** Solarus
66 10 Raphaël Durand
** Ajouter son nom...
67 4 Laurent GUERBY
68 13 Laurent GUERBY
Alternative a MP BGP
69 13 Laurent GUERBY
http://tools.ietf.org/html/draft-ietf-idr-bgp-multisession-06
70 13 Laurent GUERBY
71 31 Laurent GUERBY
Add Path
72 31 Laurent GUERBY
http://tools.ietf.org/html/draft-ietf-idr-add-paths-07
73 31 Laurent GUERBY
support in bird ? http://marc.info/?l=bird-users&m=134409996129466&w=2
74 31 Laurent GUERBY
75 2 Laurent GUERBY
h1. Liens
76 2 Laurent GUERBY
77 2 Laurent GUERBY
* http://www.cl.cam.ac.uk/~tgg22/talks/BGP_TUTORIAL_ICNP_2002.ppt
78 11 Laurent GUERBY
* http://www.menog.net/menog-meetings/menog5/presentations/smith-32bit-asn-update.pdf
79 12 Laurent GUERBY
* AS4 http://www.rfc-editor.org/rfc/rfc4893.txt
80 19 Laurent GUERBY
* bonnes pratiques incidents BGP
81 19 Laurent GUERBY
** https://www.sstic.org/media/SSTIC2012/SSTIC-actes/influence_des_bonnes_pratiques_sur_les_incidents_b/SSTIC2012-Slides-influence_des_bonnes_pratiques_sur_les_incidents_bgp-contat_valadon_nataf.pdf
82 35 Laurent GUERBY
* test ping plus UDP http://www.broadband-forum.org/technical/download/TR-143.pdf
83 2 Laurent GUERBY
84 1 Laurent GUERBY
h1. Configuration Toulouse
85 1 Laurent GUERBY
86 1 Laurent GUERBY
<pre>
87 1 Laurent GUERBY
router id 91.224.148.2;
88 1 Laurent GUERBY
define myas = 197422;
89 1 Laurent GUERBY
90 1 Laurent GUERBY
91 1 Laurent GUERBY
protocol device {
92 1 Laurent GUERBY
	scan time 10;
93 1 Laurent GUERBY
        primary "eth0" 91.224.148.3;
94 1 Laurent GUERBY
}
95 1 Laurent GUERBY
96 1 Laurent GUERBY
protocol static static_bgp {
97 1 Laurent GUERBY
	import all;
98 1 Laurent GUERBY
	route 91.224.148.0/23 reject;
99 1 Laurent GUERBY
}
100 1 Laurent GUERBY
101 1 Laurent GUERBY
102 1 Laurent GUERBY
protocol kernel{
103 1 Laurent GUERBY
	import all;
104 1 Laurent GUERBY
	export all;
105 1 Laurent GUERBY
}
106 1 Laurent GUERBY
107 1 Laurent GUERBY
108 1 Laurent GUERBY
function avoid_martians()
109 1 Laurent GUERBY
prefix set martians;
110 1 Laurent GUERBY
{
111 1 Laurent GUERBY
  martians = [ 169.254.0.0/16+, 172.16.0.0/12+, 192.168.0.0/16+, 10.0.0.0/8+, 224.0.0.0/4+, 240.0.0.0/4+ ];
112 1 Laurent GUERBY
113 1 Laurent GUERBY
  # Avoid 0.0.0.0/X
114 1 Laurent GUERBY
  if net.ip = 0.0.0.0 then return false;
115 1 Laurent GUERBY
116 1 Laurent GUERBY
  # Avoid too short and too long prefixes
117 1 Laurent GUERBY
  if (net.len < 8) || (net.len > 24) then return false;
118 1 Laurent GUERBY
119 1 Laurent GUERBY
  # Avoid RFC1918 networks
120 1 Laurent GUERBY
  if net ~ martians then return false;
121 1 Laurent GUERBY
  return true;
122 1 Laurent GUERBY
}
123 1 Laurent GUERBY
124 1 Laurent GUERBY
filter bgp_OUT {
125 1 Laurent GUERBY
	if (net ~ [91.224.148.0/23]) then accept;
126 1 Laurent GUERBY
	else reject;
127 1 Laurent GUERBY
}
128 1 Laurent GUERBY
129 1 Laurent GUERBY
130 1 Laurent GUERBY
protocol bgp TOUIX {
131 1 Laurent GUERBY
        local as myas;
132 1 Laurent GUERBY
        neighbor 91.213.236.1 as 47184;
133 1 Laurent GUERBY
        preference 200;
134 1 Laurent GUERBY
        import where avoid_martians();
135 1 Laurent GUERBY
        export filter bgp_OUT;
136 1 Laurent GUERBY
}
137 1 Laurent GUERBY
138 1 Laurent GUERBY
protocol bgp JAGUAR {
139 1 Laurent GUERBY
	 local as myas;
140 1 Laurent GUERBY
	 neighbor 31.172.233.1 as 30781;
141 1 Laurent GUERBY
	 preference 50;
142 1 Laurent GUERBY
         import where avoid_martians();
143 1 Laurent GUERBY
         export filter bgp_OUT;
144 1 Laurent GUERBY
}
145 1 Laurent GUERBY
146 1 Laurent GUERBY
protocol bgp TETANEUTRAL {
147 1 Laurent GUERBY
	local as myas;
148 1 Laurent GUERBY
	neighbor 91.224.148.2 as myas;
149 1 Laurent GUERBY
	preference 100;
150 1 Laurent GUERBY
	import where avoid_martians();
151 1 Laurent GUERBY
	export all;
152 1 Laurent GUERBY
}
153 1 Laurent GUERBY
</pre>
154 20 Laurent GUERBY
155 33 Laurent GUERBY
h1. IRR
156 33 Laurent GUERBY
157 33 Laurent GUERBY
* From nanog:
158 33 Laurent GUERBY
http://www.clarksys.com/blog/2009/09/02/using-irr-with-level3/
159 33 Laurent GUERBY
whois -h filtergen.level3.net "RIPE::YOUR-AS-SET  -searchpath=RIPE;ARIN;RADB -recurseok -warnonly"
160 33 Laurent GUERBY
161 20 Laurent GUERBY
h1. Blackholing
162 20 Laurent GUERBY
163 24 Laurent GUERBY
h2. Attaques
164 24 Laurent GUERBY
165 24 Laurent GUERBY
* 20120629 http://lists.tetaneutral.net/pipermail/technique/2012-July/000406.html
166 36 Laurent GUERBY
* http://blog.cloudflare.com/65gbps-ddos-no-problem
167 24 Laurent GUERBY
168 34 Laurent GUERBY
h2. URPF
169 34 Laurent GUERBY
170 34 Laurent GUERBY
blacklister une/plusieures sources est relativement complexe à mettre en place sur une petite infrastructure car nécessite la mise en place de l'URPF (Unicast Reverse Path Forwarding).
171 34 Laurent GUERBY
172 34 Laurent GUERBY
http://www.cisco.com/web/about/security/intelligence/ipv6_rtbh.html
173 34 Laurent GUERBY
174 20 Laurent GUERBY
h2. RFC3882 
175 1 Laurent GUERBY
176 22 Laurent GUERBY
* http://www.ietf.org/rfc/rfc3882.txt
177 1 Laurent GUERBY
community AS:666 sur annonce /32 pour balckhole par AS upstream
178 1 Laurent GUERBY
179 22 Laurent GUERBY
* doc CISCO
180 22 Laurent GUERBY
http://www.cisco.com/web/about/security/intelligence/blackhole.pdf
181 22 Laurent GUERBY
182 28 Laurent GUERBY
h2. RFC1997
183 28 Laurent GUERBY
184 28 Laurent GUERBY
* http://www.ietf.org/rfc/rfc1997.txt
185 28 Laurent GUERBY
BGP Communities Attribute
186 28 Laurent GUERBY
187 28 Laurent GUERBY
* doc CISCO
188 28 Laurent GUERBY
http://www.cisco.com/web/about/ac123/ac147/archived_issues/ipj_6-2/bgp_communities.html
189 28 Laurent GUERBY
190 22 Laurent GUERBY
h2. BIRD
191 22 Laurent GUERBY
192 22 Laurent GUERBY
* http://www.mail-archive.com/bird-users@atrey.karlin.mff.cuni.cz/msg01998.html
193 22 Laurent GUERBY
194 24 Laurent GUERBY
h2. Absolight
195 24 Laurent GUERBY
196 24 Laurent GUERBY
* communauté 29608:65001 sur /24..32 IPv4 et /41..128 IPv6 => blackhole
197 24 Laurent GUERBY
* test 20120703 IPv4 et IPv6, ça marche et convergence très rapide
198 24 Laurent GUERBY
199 22 Laurent GUERBY
h2. GIXE
200 22 Laurent GUERBY
201 1 Laurent GUERBY
* communauté 31576:666 sur /32 => blackhole
202 24 Laurent GUERBY
* test 20120703 => marche pas encore, signalé et dev a faire coté GIXE pour autoriser les /32
203 1 Laurent GUERBY
204 1 Laurent GUERBY
h2. Jaguar 
205 22 Laurent GUERBY
206 24 Laurent GUERBY
* https://extranet.jaguar-network.com/app/public/index.php?cmd=bgp-policy
207 22 Laurent GUERBY
* demande 20120702 : pas de communauté blackhole actuellement, en reflexion
208 22 Laurent GUERBY
* déploiement de matériel arbor networks, reglage a affiner (pas de detection d'attaque)
209 22 Laurent GUERBY
210 27 Laurent GUERBY
h2. Gitoyen
211 27 Laurent GUERBY
212 1 Laurent GUERBY
* demande 20120704 sur la liste, réponse 20120717
213 28 Laurent GUERBY
* Tata http://noc.easycolocate.nl/Teleglobe_bgp_comm.pdf
214 27 Laurent GUERBY
*** => black-hole route (host route or shorter prefix within customer’s RIR registred assignment) 64999:0
215 28 Laurent GUERBY
* Ielo  whois AS29075 => 29075:0 Null-route/Blackhole
216 32 Laurent GUERBY
* https://pad.ilico.org/p/cleanup-bgp-gitoyen
217 22 Laurent GUERBY
218 22 Laurent GUERBY
h2. France-IX
219 22 Laurent GUERBY
220 25 Laurent GUERBY
* community plan : https://apps.db.ripe.net/whois/lookup/ripe/aut-num/AS51706.html
221 26 Laurent GUERBY
* TODO tester
222 22 Laurent GUERBY
223 22 Laurent GUERBY
h2. Equinix-IX
224 1 Laurent GUERBY
225 26 Laurent GUERBY
* community plan : https://ix.equinix.com/ixp/mlpeCommunityInfo
226 26 Laurent GUERBY
* TODO tester
227 22 Laurent GUERBY
228 1 Laurent GUERBY
h2. TouIX
229 22 Laurent GUERBY
230 26 Laurent GUERBY
* demande acces switch et route server 20120702
231 22 Laurent GUERBY
* TODO
232 1 Laurent GUERBY
233 1 Laurent GUERBY
h2. Hurricane Electric
234 1 Laurent GUERBY
235 26 Laurent GUERBY
* http://www.he.net/adm/
236 1 Laurent GUERBY
* http://www.he.net/adm/blackhole.html
237 1 Laurent GUERBY
* TODO tester
238 28 Laurent GUERBY
239 28 Laurent GUERBY
h2. Sfinx
240 28 Laurent GUERBY
241 28 Laurent GUERBY
* http://www.renater.fr/route-servers-bgp?lang=fr
242 28 Laurent GUERBY
* whois  AS1304 =>
243 28 Laurent GUERBY
remarks:        1304:65281 = Apply NO-EXPORT community
244 28 Laurent GUERBY
remarks:        1304:65282 = Apply NO-ADVERTISE community