Projet

Général

Profil

BGP » Historique » Version 48

Laurent GUERBY, 30/12/2012 21:36

1 20 Laurent GUERBY
{{>toc}}
2 20 Laurent GUERBY
3 1 Laurent GUERBY
h1. BGP
4 1 Laurent GUERBY
5 1 Laurent GUERBY
Nous utilisons BIRD sous Linux comme routeur BGP
6 1 Laurent GUERBY
7 1 Laurent GUERBY
http://bird.network.cz/
8 1 Laurent GUERBY
9 14 Laurent GUERBY
blog bgp http://www.renesys.com/blog/
10 15 Laurent GUERBY
flowspec http://www.slideshare.net/sfouant/an-introduction-to-bgp-flow-spec
11 16 Laurent GUERBY
DFZ = Default Free Zone archive http://archive.routeviews.org/
12 17 Laurent GUERBY
http://www.ripe.net/data-tools/stats/ris/routing-information-service
13 17 Laurent GUERBY
http://pch.net/resources/data/routing-tables/archive/
14 17 Laurent GUERBY
http://pch.net/resources/data/routing-tables/mrt-bgp-updates/
15 18 Laurent GUERBY
http://www.nanog.org/meetings/archive/
16 14 Laurent GUERBY
17 43 Laurent GUERBY
http://inside.godaddy.com/inside-story-happened-godaddy-com-sept-10-2012/
18 43 Laurent GUERBY
19 29 Laurent GUERBY
http://www.ipbcop.org/
20 29 Laurent GUERBY
IP Best Current Operational Practices Documented best practices for Engineers by Engineers
21 29 Laurent GUERBY
22 30 Laurent GUERBY
BGP best practices ANSSI
23 30 Laurent GUERBY
https://www.sstic.org/media/SSTIC2012/SSTIC-actes/influence_des_bonnes_pratiques_sur_les_incidents_b/SSTIC2012-Article-influence_des_bonnes_pratiques_sur_les_incidents_bgp-contat_valadon_nataf_2.pdf
24 30 Laurent GUERBY
25 37 Laurent GUERBY
https://www.ams-ix.net/technical/specifications-descriptions/ams-ix-route-servers
26 37 Laurent GUERBY
27 39 Laurent GUERBY
these LAAS BGP http://www.laas.fr/1-31360-Detail-Soutenance-de-these.php?id=600
28 41 Laurent GUERBY
http://www.laas.fr/1-31706-Publications.php?author=7738
29 1 Laurent GUERBY
http://www.net.t-labs.tu-berlin.de/papers/OMUPMO-OOSICP-11.pdf
30 42 Laurent GUERBY
http://hal.archives-ouvertes.fr/docs/00/60/53/83/PDF/dVirt-virtual_platform.pdf
31 42 Laurent GUERBY
http://hal.archives-ouvertes.fr/docs/00/48/70/74/PDF/Poster_SIGCOMM2010_philippe.pdf
32 40 Laurent GUERBY
33 44 Laurent GUERBY
Le monde sur BGP http://reseaux.blog.lemonde.fr/2012/11/04/routage-enjeu-cyberstrategie/
34 44 Laurent GUERBY
35 45 Laurent GUERBY
coupure free wanadoo http://www.journaldunet.com/solutions/0301/030122_freeft.shtml
36 45 Laurent GUERBY
37 46 Laurent GUERBY
tsunami Japon 2011 et BGP : http://archive.psg.com/111206.conext-quake.pdf
38 46 Laurent GUERBY
39 47 Laurent GUERBY
Session is up on telnet:route-views.routeviews.org username rviews
40 47 Laurent GUERBY
41 48 Laurent GUERBY
BGP book http://www.bortzmeyer.org/files/bgp.html
42 48 Laurent GUERBY
43 38 Laurent GUERBY
h1. TouIX et GIX
44 38 Laurent GUERBY
45 38 Laurent GUERBY
http://touix.net
46 38 Laurent GUERBY
http://wikilulu.net/doku.php?id=articles:gix-howto
47 38 Laurent GUERBY
48 3 Laurent GUERBY
h1. Evolutions de la conf BGP
49 3 Laurent GUERBY
50 3 Laurent GUERBY
* http://lists.tetaneutral.net/pipermail/technique/2011-December/000118.html
51 3 Laurent GUERBY
52 5 Laurent GUERBY
TODO: 
53 6 Laurent GUERBY
* mise en place d'un gestionaire de version style git au moins pour documentation
54 5 Laurent GUERBY
* Comment gerer les password MD5 du fichier de conf (les garder secrets tout en publiant le reste)
55 5 Laurent GUERBY
* Atelier ?
56 7 Laurent GUERBY
** Laurent GUERBY
57 9 Raphaël Durand
** Solarus
58 10 Raphaël Durand
** Ajouter son nom...
59 4 Laurent GUERBY
60 13 Laurent GUERBY
Alternative a MP BGP
61 13 Laurent GUERBY
http://tools.ietf.org/html/draft-ietf-idr-bgp-multisession-06
62 13 Laurent GUERBY
63 31 Laurent GUERBY
Add Path
64 31 Laurent GUERBY
http://tools.ietf.org/html/draft-ietf-idr-add-paths-07
65 31 Laurent GUERBY
support in bird ? http://marc.info/?l=bird-users&m=134409996129466&w=2
66 31 Laurent GUERBY
67 2 Laurent GUERBY
h1. Liens
68 2 Laurent GUERBY
69 2 Laurent GUERBY
* http://www.cl.cam.ac.uk/~tgg22/talks/BGP_TUTORIAL_ICNP_2002.ppt
70 11 Laurent GUERBY
* http://www.menog.net/menog-meetings/menog5/presentations/smith-32bit-asn-update.pdf
71 12 Laurent GUERBY
* AS4 http://www.rfc-editor.org/rfc/rfc4893.txt
72 19 Laurent GUERBY
* bonnes pratiques incidents BGP
73 19 Laurent GUERBY
** https://www.sstic.org/media/SSTIC2012/SSTIC-actes/influence_des_bonnes_pratiques_sur_les_incidents_b/SSTIC2012-Slides-influence_des_bonnes_pratiques_sur_les_incidents_bgp-contat_valadon_nataf.pdf
74 35 Laurent GUERBY
* test ping plus UDP http://www.broadband-forum.org/technical/download/TR-143.pdf
75 2 Laurent GUERBY
76 1 Laurent GUERBY
h1. Configuration Toulouse
77 1 Laurent GUERBY
78 1 Laurent GUERBY
<pre>
79 1 Laurent GUERBY
router id 91.224.148.2;
80 1 Laurent GUERBY
define myas = 197422;
81 1 Laurent GUERBY
82 1 Laurent GUERBY
83 1 Laurent GUERBY
protocol device {
84 1 Laurent GUERBY
	scan time 10;
85 1 Laurent GUERBY
        primary "eth0" 91.224.148.3;
86 1 Laurent GUERBY
}
87 1 Laurent GUERBY
88 1 Laurent GUERBY
protocol static static_bgp {
89 1 Laurent GUERBY
	import all;
90 1 Laurent GUERBY
	route 91.224.148.0/23 reject;
91 1 Laurent GUERBY
}
92 1 Laurent GUERBY
93 1 Laurent GUERBY
94 1 Laurent GUERBY
protocol kernel{
95 1 Laurent GUERBY
	import all;
96 1 Laurent GUERBY
	export all;
97 1 Laurent GUERBY
}
98 1 Laurent GUERBY
99 1 Laurent GUERBY
100 1 Laurent GUERBY
function avoid_martians()
101 1 Laurent GUERBY
prefix set martians;
102 1 Laurent GUERBY
{
103 1 Laurent GUERBY
  martians = [ 169.254.0.0/16+, 172.16.0.0/12+, 192.168.0.0/16+, 10.0.0.0/8+, 224.0.0.0/4+, 240.0.0.0/4+ ];
104 1 Laurent GUERBY
105 1 Laurent GUERBY
  # Avoid 0.0.0.0/X
106 1 Laurent GUERBY
  if net.ip = 0.0.0.0 then return false;
107 1 Laurent GUERBY
108 1 Laurent GUERBY
  # Avoid too short and too long prefixes
109 1 Laurent GUERBY
  if (net.len < 8) || (net.len > 24) then return false;
110 1 Laurent GUERBY
111 1 Laurent GUERBY
  # Avoid RFC1918 networks
112 1 Laurent GUERBY
  if net ~ martians then return false;
113 1 Laurent GUERBY
  return true;
114 1 Laurent GUERBY
}
115 1 Laurent GUERBY
116 1 Laurent GUERBY
filter bgp_OUT {
117 1 Laurent GUERBY
	if (net ~ [91.224.148.0/23]) then accept;
118 1 Laurent GUERBY
	else reject;
119 1 Laurent GUERBY
}
120 1 Laurent GUERBY
121 1 Laurent GUERBY
122 1 Laurent GUERBY
protocol bgp TOUIX {
123 1 Laurent GUERBY
        local as myas;
124 1 Laurent GUERBY
        neighbor 91.213.236.1 as 47184;
125 1 Laurent GUERBY
        preference 200;
126 1 Laurent GUERBY
        import where avoid_martians();
127 1 Laurent GUERBY
        export filter bgp_OUT;
128 1 Laurent GUERBY
}
129 1 Laurent GUERBY
130 1 Laurent GUERBY
protocol bgp JAGUAR {
131 1 Laurent GUERBY
	 local as myas;
132 1 Laurent GUERBY
	 neighbor 31.172.233.1 as 30781;
133 1 Laurent GUERBY
	 preference 50;
134 1 Laurent GUERBY
         import where avoid_martians();
135 1 Laurent GUERBY
         export filter bgp_OUT;
136 1 Laurent GUERBY
}
137 1 Laurent GUERBY
138 1 Laurent GUERBY
protocol bgp TETANEUTRAL {
139 1 Laurent GUERBY
	local as myas;
140 1 Laurent GUERBY
	neighbor 91.224.148.2 as myas;
141 1 Laurent GUERBY
	preference 100;
142 1 Laurent GUERBY
	import where avoid_martians();
143 1 Laurent GUERBY
	export all;
144 1 Laurent GUERBY
}
145 1 Laurent GUERBY
</pre>
146 20 Laurent GUERBY
147 33 Laurent GUERBY
h1. IRR
148 33 Laurent GUERBY
149 33 Laurent GUERBY
* From nanog:
150 33 Laurent GUERBY
http://www.clarksys.com/blog/2009/09/02/using-irr-with-level3/
151 33 Laurent GUERBY
whois -h filtergen.level3.net "RIPE::YOUR-AS-SET  -searchpath=RIPE;ARIN;RADB -recurseok -warnonly"
152 33 Laurent GUERBY
153 20 Laurent GUERBY
h1. Blackholing
154 20 Laurent GUERBY
155 24 Laurent GUERBY
h2. Attaques
156 24 Laurent GUERBY
157 24 Laurent GUERBY
* 20120629 http://lists.tetaneutral.net/pipermail/technique/2012-July/000406.html
158 36 Laurent GUERBY
* http://blog.cloudflare.com/65gbps-ddos-no-problem
159 24 Laurent GUERBY
160 34 Laurent GUERBY
h2. URPF
161 34 Laurent GUERBY
162 34 Laurent GUERBY
blacklister une/plusieures sources est relativement complexe à mettre en place sur une petite infrastructure car nécessite la mise en place de l'URPF (Unicast Reverse Path Forwarding).
163 34 Laurent GUERBY
164 34 Laurent GUERBY
http://www.cisco.com/web/about/security/intelligence/ipv6_rtbh.html
165 34 Laurent GUERBY
166 20 Laurent GUERBY
h2. RFC3882 
167 1 Laurent GUERBY
168 22 Laurent GUERBY
* http://www.ietf.org/rfc/rfc3882.txt
169 1 Laurent GUERBY
community AS:666 sur annonce /32 pour balckhole par AS upstream
170 1 Laurent GUERBY
171 22 Laurent GUERBY
* doc CISCO
172 22 Laurent GUERBY
http://www.cisco.com/web/about/security/intelligence/blackhole.pdf
173 22 Laurent GUERBY
174 28 Laurent GUERBY
h2. RFC1997
175 28 Laurent GUERBY
176 28 Laurent GUERBY
* http://www.ietf.org/rfc/rfc1997.txt
177 28 Laurent GUERBY
BGP Communities Attribute
178 28 Laurent GUERBY
179 28 Laurent GUERBY
* doc CISCO
180 28 Laurent GUERBY
http://www.cisco.com/web/about/ac123/ac147/archived_issues/ipj_6-2/bgp_communities.html
181 28 Laurent GUERBY
182 22 Laurent GUERBY
h2. BIRD
183 22 Laurent GUERBY
184 22 Laurent GUERBY
* http://www.mail-archive.com/bird-users@atrey.karlin.mff.cuni.cz/msg01998.html
185 22 Laurent GUERBY
186 24 Laurent GUERBY
h2. Absolight
187 24 Laurent GUERBY
188 24 Laurent GUERBY
* communauté 29608:65001 sur /24..32 IPv4 et /41..128 IPv6 => blackhole
189 24 Laurent GUERBY
* test 20120703 IPv4 et IPv6, ça marche et convergence très rapide
190 24 Laurent GUERBY
191 22 Laurent GUERBY
h2. GIXE
192 22 Laurent GUERBY
193 1 Laurent GUERBY
* communauté 31576:666 sur /32 => blackhole
194 24 Laurent GUERBY
* test 20120703 => marche pas encore, signalé et dev a faire coté GIXE pour autoriser les /32
195 1 Laurent GUERBY
196 1 Laurent GUERBY
h2. Jaguar 
197 22 Laurent GUERBY
198 24 Laurent GUERBY
* https://extranet.jaguar-network.com/app/public/index.php?cmd=bgp-policy
199 22 Laurent GUERBY
* demande 20120702 : pas de communauté blackhole actuellement, en reflexion
200 22 Laurent GUERBY
* déploiement de matériel arbor networks, reglage a affiner (pas de detection d'attaque)
201 22 Laurent GUERBY
202 27 Laurent GUERBY
h2. Gitoyen
203 27 Laurent GUERBY
204 1 Laurent GUERBY
* demande 20120704 sur la liste, réponse 20120717
205 28 Laurent GUERBY
* Tata http://noc.easycolocate.nl/Teleglobe_bgp_comm.pdf
206 27 Laurent GUERBY
*** => black-hole route (host route or shorter prefix within customer’s RIR registred assignment) 64999:0
207 28 Laurent GUERBY
* Ielo  whois AS29075 => 29075:0 Null-route/Blackhole
208 32 Laurent GUERBY
* https://pad.ilico.org/p/cleanup-bgp-gitoyen
209 22 Laurent GUERBY
210 22 Laurent GUERBY
h2. France-IX
211 22 Laurent GUERBY
212 25 Laurent GUERBY
* community plan : https://apps.db.ripe.net/whois/lookup/ripe/aut-num/AS51706.html
213 26 Laurent GUERBY
* TODO tester
214 22 Laurent GUERBY
215 22 Laurent GUERBY
h2. Equinix-IX
216 1 Laurent GUERBY
217 26 Laurent GUERBY
* community plan : https://ix.equinix.com/ixp/mlpeCommunityInfo
218 26 Laurent GUERBY
* TODO tester
219 22 Laurent GUERBY
220 1 Laurent GUERBY
h2. TouIX
221 22 Laurent GUERBY
222 26 Laurent GUERBY
* demande acces switch et route server 20120702
223 22 Laurent GUERBY
* TODO
224 1 Laurent GUERBY
225 1 Laurent GUERBY
h2. Hurricane Electric
226 1 Laurent GUERBY
227 26 Laurent GUERBY
* http://www.he.net/adm/
228 1 Laurent GUERBY
* http://www.he.net/adm/blackhole.html
229 1 Laurent GUERBY
* TODO tester
230 28 Laurent GUERBY
231 28 Laurent GUERBY
h2. Sfinx
232 28 Laurent GUERBY
233 28 Laurent GUERBY
* http://www.renater.fr/route-servers-bgp?lang=fr
234 28 Laurent GUERBY
* whois  AS1304 =>
235 28 Laurent GUERBY
remarks:        1304:65281 = Apply NO-EXPORT community
236 28 Laurent GUERBY
remarks:        1304:65282 = Apply NO-ADVERTISE community