Projet

Général

Profil

BGP » Historique » Version 61

Laurent GUERBY, 08/09/2013 18:30

1 20 Laurent GUERBY
{{>toc}}
2 20 Laurent GUERBY
3 1 Laurent GUERBY
h1. BGP
4 1 Laurent GUERBY
5 1 Laurent GUERBY
Nous utilisons BIRD sous Linux comme routeur BGP
6 1 Laurent GUERBY
7 1 Laurent GUERBY
http://bird.network.cz/
8 1 Laurent GUERBY
9 14 Laurent GUERBY
blog bgp http://www.renesys.com/blog/
10 15 Laurent GUERBY
flowspec http://www.slideshare.net/sfouant/an-introduction-to-bgp-flow-spec
11 16 Laurent GUERBY
DFZ = Default Free Zone archive http://archive.routeviews.org/
12 17 Laurent GUERBY
http://www.ripe.net/data-tools/stats/ris/routing-information-service
13 17 Laurent GUERBY
http://pch.net/resources/data/routing-tables/archive/
14 17 Laurent GUERBY
http://pch.net/resources/data/routing-tables/mrt-bgp-updates/
15 18 Laurent GUERBY
http://www.nanog.org/meetings/archive/
16 52 Laurent GUERBY
http://tools.ietf.org/html/draft-lapukhov-bgp-routing-large-dc-02
17 14 Laurent GUERBY
18 43 Laurent GUERBY
http://inside.godaddy.com/inside-story-happened-godaddy-com-sept-10-2012/
19 43 Laurent GUERBY
20 55 Laurent GUERBY
http://tools.ietf.org/html/rfc4271#section-9.1 BGP route decision process
21 55 Laurent GUERBY
22 29 Laurent GUERBY
http://www.ipbcop.org/
23 29 Laurent GUERBY
IP Best Current Operational Practices Documented best practices for Engineers by Engineers
24 29 Laurent GUERBY
25 30 Laurent GUERBY
BGP best practices ANSSI
26 30 Laurent GUERBY
https://www.sstic.org/media/SSTIC2012/SSTIC-actes/influence_des_bonnes_pratiques_sur_les_incidents_b/SSTIC2012-Article-influence_des_bonnes_pratiques_sur_les_incidents_bgp-contat_valadon_nataf_2.pdf
27 30 Laurent GUERBY
28 37 Laurent GUERBY
https://www.ams-ix.net/technical/specifications-descriptions/ams-ix-route-servers
29 37 Laurent GUERBY
30 39 Laurent GUERBY
these LAAS BGP http://www.laas.fr/1-31360-Detail-Soutenance-de-these.php?id=600
31 41 Laurent GUERBY
http://www.laas.fr/1-31706-Publications.php?author=7738
32 1 Laurent GUERBY
http://www.net.t-labs.tu-berlin.de/papers/OMUPMO-OOSICP-11.pdf
33 42 Laurent GUERBY
http://hal.archives-ouvertes.fr/docs/00/60/53/83/PDF/dVirt-virtual_platform.pdf
34 42 Laurent GUERBY
http://hal.archives-ouvertes.fr/docs/00/48/70/74/PDF/Poster_SIGCOMM2010_philippe.pdf
35 40 Laurent GUERBY
36 44 Laurent GUERBY
Le monde sur BGP http://reseaux.blog.lemonde.fr/2012/11/04/routage-enjeu-cyberstrategie/
37 44 Laurent GUERBY
38 45 Laurent GUERBY
coupure free wanadoo http://www.journaldunet.com/solutions/0301/030122_freeft.shtml
39 45 Laurent GUERBY
40 46 Laurent GUERBY
tsunami Japon 2011 et BGP : http://archive.psg.com/111206.conext-quake.pdf
41 46 Laurent GUERBY
42 47 Laurent GUERBY
Session is up on telnet:route-views.routeviews.org username rviews
43 47 Laurent GUERBY
44 48 Laurent GUERBY
BGP book http://www.bortzmeyer.org/files/bgp.html
45 48 Laurent GUERBY
46 49 Laurent GUERBY
Cyclops is able to detect several forms of route hijack attacks http://cyclops.cs.ucla.edu/
47 50 Laurent GUERBY
BGPmon monitors the routing of your prefixes and alerts you in case of an 'interesting' path chang http://www.bgpmon.net/
48 49 Laurent GUERBY
49 53 Laurent GUERBY
http://jointtransit.nl/prices.html
50 53 Laurent GUERBY
51 54 Laurent GUERBY
http://blog.cloudflare.com/the-ddos-that-knocked-spamhaus-offline-and-ho
52 54 Laurent GUERBY
53 51 Laurent GUERBY
* taille table de routage http://bgp.potaroo.net/
54 51 Laurent GUERBY
55 56 Laurent GUERBY
* BGP	in	2011	 Geoff	Huston	 APNIC http://iepg.org/2011-11-ietf82/2011-11-13-bgp2011.pdf
56 56 Laurent GUERBY
57 57 Laurent GUERBY
* http://pages.cs.wisc.edu/~plonka/netgear-sntp/
58 57 Laurent GUERBY
59 58 Laurent GUERBY
* http://www.afnic.fr/fr/l-afnic-en-bref/actualites/actualites-generales/7114/show/l-observatoire-sur-la-resilience-de-l-internet-francais-publie-son-rapport-2012.html
60 58 Laurent GUERBY
61 59 Laurent GUERBY
* http://www.ris.ripe.net/dashboard/2a01:6600:8000::/40
62 59 Laurent GUERBY
63 60 Laurent GUERBY
* http://www.bortzmeyer.org/6996.html
64 60 Laurent GUERBY
** RFC 6996 : Autonomous System (AS) Reservation for Private Use
65 60 Laurent GUERBY
** http://www.iana.org/assignments/as-numbers
66 60 Laurent GUERBY
67 61 Laurent GUERBY
* Look for TRACEROUTE by SRCGUARDIAN in the Play Store.   It needs network access only...  Doesn't do TCP but does ICMP and UDP traceroutes and displays ASN as well ...
68 61 Laurent GUERBY
69 38 Laurent GUERBY
h1. TouIX et GIX
70 38 Laurent GUERBY
71 38 Laurent GUERBY
http://touix.net
72 38 Laurent GUERBY
http://wikilulu.net/doku.php?id=articles:gix-howto
73 38 Laurent GUERBY
74 3 Laurent GUERBY
h1. Evolutions de la conf BGP
75 3 Laurent GUERBY
76 3 Laurent GUERBY
* http://lists.tetaneutral.net/pipermail/technique/2011-December/000118.html
77 3 Laurent GUERBY
78 5 Laurent GUERBY
TODO: 
79 6 Laurent GUERBY
* mise en place d'un gestionaire de version style git au moins pour documentation
80 5 Laurent GUERBY
* Comment gerer les password MD5 du fichier de conf (les garder secrets tout en publiant le reste)
81 5 Laurent GUERBY
* Atelier ?
82 7 Laurent GUERBY
** Laurent GUERBY
83 9 Raphaël Durand
** Solarus
84 10 Raphaël Durand
** Ajouter son nom...
85 4 Laurent GUERBY
86 13 Laurent GUERBY
Alternative a MP BGP
87 13 Laurent GUERBY
http://tools.ietf.org/html/draft-ietf-idr-bgp-multisession-06
88 13 Laurent GUERBY
89 31 Laurent GUERBY
Add Path
90 31 Laurent GUERBY
http://tools.ietf.org/html/draft-ietf-idr-add-paths-07
91 31 Laurent GUERBY
support in bird ? http://marc.info/?l=bird-users&m=134409996129466&w=2
92 31 Laurent GUERBY
93 2 Laurent GUERBY
h1. Liens
94 2 Laurent GUERBY
95 2 Laurent GUERBY
* http://www.cl.cam.ac.uk/~tgg22/talks/BGP_TUTORIAL_ICNP_2002.ppt
96 11 Laurent GUERBY
* http://www.menog.net/menog-meetings/menog5/presentations/smith-32bit-asn-update.pdf
97 12 Laurent GUERBY
* AS4 http://www.rfc-editor.org/rfc/rfc4893.txt
98 19 Laurent GUERBY
* bonnes pratiques incidents BGP
99 19 Laurent GUERBY
** https://www.sstic.org/media/SSTIC2012/SSTIC-actes/influence_des_bonnes_pratiques_sur_les_incidents_b/SSTIC2012-Slides-influence_des_bonnes_pratiques_sur_les_incidents_bgp-contat_valadon_nataf.pdf
100 35 Laurent GUERBY
* test ping plus UDP http://www.broadband-forum.org/technical/download/TR-143.pdf
101 2 Laurent GUERBY
102 1 Laurent GUERBY
h1. Configuration Toulouse
103 1 Laurent GUERBY
104 1 Laurent GUERBY
<pre>
105 1 Laurent GUERBY
router id 91.224.148.2;
106 1 Laurent GUERBY
define myas = 197422;
107 1 Laurent GUERBY
108 1 Laurent GUERBY
109 1 Laurent GUERBY
protocol device {
110 1 Laurent GUERBY
	scan time 10;
111 1 Laurent GUERBY
        primary "eth0" 91.224.148.3;
112 1 Laurent GUERBY
}
113 1 Laurent GUERBY
114 1 Laurent GUERBY
protocol static static_bgp {
115 1 Laurent GUERBY
	import all;
116 1 Laurent GUERBY
	route 91.224.148.0/23 reject;
117 1 Laurent GUERBY
}
118 1 Laurent GUERBY
119 1 Laurent GUERBY
120 1 Laurent GUERBY
protocol kernel{
121 1 Laurent GUERBY
	import all;
122 1 Laurent GUERBY
	export all;
123 1 Laurent GUERBY
}
124 1 Laurent GUERBY
125 1 Laurent GUERBY
126 1 Laurent GUERBY
function avoid_martians()
127 1 Laurent GUERBY
prefix set martians;
128 1 Laurent GUERBY
{
129 1 Laurent GUERBY
  martians = [ 169.254.0.0/16+, 172.16.0.0/12+, 192.168.0.0/16+, 10.0.0.0/8+, 224.0.0.0/4+, 240.0.0.0/4+ ];
130 1 Laurent GUERBY
131 1 Laurent GUERBY
  # Avoid 0.0.0.0/X
132 1 Laurent GUERBY
  if net.ip = 0.0.0.0 then return false;
133 1 Laurent GUERBY
134 1 Laurent GUERBY
  # Avoid too short and too long prefixes
135 1 Laurent GUERBY
  if (net.len < 8) || (net.len > 24) then return false;
136 1 Laurent GUERBY
137 1 Laurent GUERBY
  # Avoid RFC1918 networks
138 1 Laurent GUERBY
  if net ~ martians then return false;
139 1 Laurent GUERBY
  return true;
140 1 Laurent GUERBY
}
141 1 Laurent GUERBY
142 1 Laurent GUERBY
filter bgp_OUT {
143 1 Laurent GUERBY
	if (net ~ [91.224.148.0/23]) then accept;
144 1 Laurent GUERBY
	else reject;
145 1 Laurent GUERBY
}
146 1 Laurent GUERBY
147 1 Laurent GUERBY
148 1 Laurent GUERBY
protocol bgp TOUIX {
149 1 Laurent GUERBY
        local as myas;
150 1 Laurent GUERBY
        neighbor 91.213.236.1 as 47184;
151 1 Laurent GUERBY
        preference 200;
152 1 Laurent GUERBY
        import where avoid_martians();
153 1 Laurent GUERBY
        export filter bgp_OUT;
154 1 Laurent GUERBY
}
155 1 Laurent GUERBY
156 1 Laurent GUERBY
protocol bgp JAGUAR {
157 1 Laurent GUERBY
	 local as myas;
158 1 Laurent GUERBY
	 neighbor 31.172.233.1 as 30781;
159 1 Laurent GUERBY
	 preference 50;
160 1 Laurent GUERBY
         import where avoid_martians();
161 1 Laurent GUERBY
         export filter bgp_OUT;
162 1 Laurent GUERBY
}
163 1 Laurent GUERBY
164 1 Laurent GUERBY
protocol bgp TETANEUTRAL {
165 1 Laurent GUERBY
	local as myas;
166 1 Laurent GUERBY
	neighbor 91.224.148.2 as myas;
167 1 Laurent GUERBY
	preference 100;
168 1 Laurent GUERBY
	import where avoid_martians();
169 1 Laurent GUERBY
	export all;
170 1 Laurent GUERBY
}
171 1 Laurent GUERBY
</pre>
172 20 Laurent GUERBY
173 33 Laurent GUERBY
h1. IRR
174 33 Laurent GUERBY
175 33 Laurent GUERBY
* From nanog:
176 33 Laurent GUERBY
http://www.clarksys.com/blog/2009/09/02/using-irr-with-level3/
177 33 Laurent GUERBY
whois -h filtergen.level3.net "RIPE::YOUR-AS-SET  -searchpath=RIPE;ARIN;RADB -recurseok -warnonly"
178 33 Laurent GUERBY
179 20 Laurent GUERBY
h1. Blackholing
180 20 Laurent GUERBY
181 24 Laurent GUERBY
h2. Attaques
182 24 Laurent GUERBY
183 24 Laurent GUERBY
* 20120629 http://lists.tetaneutral.net/pipermail/technique/2012-July/000406.html
184 36 Laurent GUERBY
* http://blog.cloudflare.com/65gbps-ddos-no-problem
185 24 Laurent GUERBY
186 34 Laurent GUERBY
h2. URPF
187 34 Laurent GUERBY
188 34 Laurent GUERBY
blacklister une/plusieures sources est relativement complexe à mettre en place sur une petite infrastructure car nécessite la mise en place de l'URPF (Unicast Reverse Path Forwarding).
189 34 Laurent GUERBY
190 34 Laurent GUERBY
http://www.cisco.com/web/about/security/intelligence/ipv6_rtbh.html
191 34 Laurent GUERBY
192 20 Laurent GUERBY
h2. RFC3882 
193 1 Laurent GUERBY
194 22 Laurent GUERBY
* http://www.ietf.org/rfc/rfc3882.txt
195 1 Laurent GUERBY
community AS:666 sur annonce /32 pour balckhole par AS upstream
196 1 Laurent GUERBY
197 22 Laurent GUERBY
* doc CISCO
198 22 Laurent GUERBY
http://www.cisco.com/web/about/security/intelligence/blackhole.pdf
199 22 Laurent GUERBY
200 28 Laurent GUERBY
h2. RFC1997
201 28 Laurent GUERBY
202 28 Laurent GUERBY
* http://www.ietf.org/rfc/rfc1997.txt
203 28 Laurent GUERBY
BGP Communities Attribute
204 28 Laurent GUERBY
205 28 Laurent GUERBY
* doc CISCO
206 28 Laurent GUERBY
http://www.cisco.com/web/about/ac123/ac147/archived_issues/ipj_6-2/bgp_communities.html
207 28 Laurent GUERBY
208 22 Laurent GUERBY
h2. BIRD
209 22 Laurent GUERBY
210 22 Laurent GUERBY
* http://www.mail-archive.com/bird-users@atrey.karlin.mff.cuni.cz/msg01998.html
211 22 Laurent GUERBY
212 24 Laurent GUERBY
h2. Absolight
213 24 Laurent GUERBY
214 24 Laurent GUERBY
* communauté 29608:65001 sur /24..32 IPv4 et /41..128 IPv6 => blackhole
215 24 Laurent GUERBY
* test 20120703 IPv4 et IPv6, ça marche et convergence très rapide
216 24 Laurent GUERBY
217 22 Laurent GUERBY
h2. GIXE
218 22 Laurent GUERBY
219 1 Laurent GUERBY
* communauté 31576:666 sur /32 => blackhole
220 24 Laurent GUERBY
* test 20120703 => marche pas encore, signalé et dev a faire coté GIXE pour autoriser les /32
221 1 Laurent GUERBY
222 1 Laurent GUERBY
h2. Jaguar 
223 22 Laurent GUERBY
224 24 Laurent GUERBY
* https://extranet.jaguar-network.com/app/public/index.php?cmd=bgp-policy
225 22 Laurent GUERBY
* demande 20120702 : pas de communauté blackhole actuellement, en reflexion
226 22 Laurent GUERBY
* déploiement de matériel arbor networks, reglage a affiner (pas de detection d'attaque)
227 22 Laurent GUERBY
228 27 Laurent GUERBY
h2. Gitoyen
229 27 Laurent GUERBY
230 1 Laurent GUERBY
* demande 20120704 sur la liste, réponse 20120717
231 28 Laurent GUERBY
* Tata http://noc.easycolocate.nl/Teleglobe_bgp_comm.pdf
232 27 Laurent GUERBY
*** => black-hole route (host route or shorter prefix within customer’s RIR registred assignment) 64999:0
233 28 Laurent GUERBY
* Ielo  whois AS29075 => 29075:0 Null-route/Blackhole
234 32 Laurent GUERBY
* https://pad.ilico.org/p/cleanup-bgp-gitoyen
235 22 Laurent GUERBY
236 22 Laurent GUERBY
h2. France-IX
237 22 Laurent GUERBY
238 25 Laurent GUERBY
* community plan : https://apps.db.ripe.net/whois/lookup/ripe/aut-num/AS51706.html
239 26 Laurent GUERBY
* TODO tester
240 22 Laurent GUERBY
241 22 Laurent GUERBY
h2. Equinix-IX
242 1 Laurent GUERBY
243 26 Laurent GUERBY
* community plan : https://ix.equinix.com/ixp/mlpeCommunityInfo
244 26 Laurent GUERBY
* TODO tester
245 22 Laurent GUERBY
246 1 Laurent GUERBY
h2. TouIX
247 22 Laurent GUERBY
248 26 Laurent GUERBY
* demande acces switch et route server 20120702
249 22 Laurent GUERBY
* TODO
250 1 Laurent GUERBY
251 1 Laurent GUERBY
h2. Hurricane Electric
252 1 Laurent GUERBY
253 26 Laurent GUERBY
* http://www.he.net/adm/
254 1 Laurent GUERBY
* http://www.he.net/adm/blackhole.html
255 1 Laurent GUERBY
* TODO tester
256 28 Laurent GUERBY
257 28 Laurent GUERBY
h2. Sfinx
258 28 Laurent GUERBY
259 28 Laurent GUERBY
* http://www.renater.fr/route-servers-bgp?lang=fr
260 28 Laurent GUERBY
* whois  AS1304 =>
261 28 Laurent GUERBY
remarks:        1304:65281 = Apply NO-EXPORT community
262 28 Laurent GUERBY
remarks:        1304:65282 = Apply NO-ADVERTISE community