Projet

Général

Profil

BGP » Historique » Version 160

Laurent GUERBY, 06/05/2014 14:20

1 20 Laurent GUERBY
{{>toc}}
2 20 Laurent GUERBY
3 1 Laurent GUERBY
h1. BGP
4 1 Laurent GUERBY
5 1 Laurent GUERBY
Nous utilisons BIRD sous Linux comme routeur BGP
6 1 Laurent GUERBY
7 1 Laurent GUERBY
http://bird.network.cz/
8 1 Laurent GUERBY
9 14 Laurent GUERBY
blog bgp http://www.renesys.com/blog/
10 15 Laurent GUERBY
flowspec http://www.slideshare.net/sfouant/an-introduction-to-bgp-flow-spec
11 16 Laurent GUERBY
DFZ = Default Free Zone archive http://archive.routeviews.org/
12 17 Laurent GUERBY
http://www.ripe.net/data-tools/stats/ris/routing-information-service
13 65 Laurent GUERBY
https://stat.ripe.net/widget/announced-prefixes
14 17 Laurent GUERBY
http://pch.net/resources/data/routing-tables/archive/
15 17 Laurent GUERBY
http://pch.net/resources/data/routing-tables/mrt-bgp-updates/
16 18 Laurent GUERBY
http://www.nanog.org/meetings/archive/
17 52 Laurent GUERBY
http://tools.ietf.org/html/draft-lapukhov-bgp-routing-large-dc-02
18 14 Laurent GUERBY
19 43 Laurent GUERBY
http://inside.godaddy.com/inside-story-happened-godaddy-com-sept-10-2012/
20 43 Laurent GUERBY
21 67 Laurent GUERBY
liste des communautés des opérateurs http://onesc.net/communities/ via http://www.bortzmeyer.org/7153.html
22 66 Laurent GUERBY
23 55 Laurent GUERBY
http://tools.ietf.org/html/rfc4271#section-9.1 BGP route decision process
24 55 Laurent GUERBY
25 29 Laurent GUERBY
http://www.ipbcop.org/
26 29 Laurent GUERBY
IP Best Current Operational Practices Documented best practices for Engineers by Engineers
27 29 Laurent GUERBY
28 30 Laurent GUERBY
BGP best practices ANSSI
29 30 Laurent GUERBY
https://www.sstic.org/media/SSTIC2012/SSTIC-actes/influence_des_bonnes_pratiques_sur_les_incidents_b/SSTIC2012-Article-influence_des_bonnes_pratiques_sur_les_incidents_bgp-contat_valadon_nataf_2.pdf
30 62 Laurent GUERBY
http://www.ssi.gouv.fr/fr/bonnes-pratiques/recommandations-et-guides/securite-des-reseaux/le-guide-des-bonnes-pratiques-de-configuration-de-bgp.html
31 64 Laurent GUERBY
http://tools.ietf.org/html/draft-ietf-opsec-bgp-security-01
32 30 Laurent GUERBY
33 37 Laurent GUERBY
https://www.ams-ix.net/technical/specifications-descriptions/ams-ix-route-servers
34 37 Laurent GUERBY
35 39 Laurent GUERBY
these LAAS BGP http://www.laas.fr/1-31360-Detail-Soutenance-de-these.php?id=600
36 41 Laurent GUERBY
http://www.laas.fr/1-31706-Publications.php?author=7738
37 1 Laurent GUERBY
http://www.net.t-labs.tu-berlin.de/papers/OMUPMO-OOSICP-11.pdf
38 42 Laurent GUERBY
http://hal.archives-ouvertes.fr/docs/00/60/53/83/PDF/dVirt-virtual_platform.pdf
39 42 Laurent GUERBY
http://hal.archives-ouvertes.fr/docs/00/48/70/74/PDF/Poster_SIGCOMM2010_philippe.pdf
40 40 Laurent GUERBY
41 44 Laurent GUERBY
Le monde sur BGP http://reseaux.blog.lemonde.fr/2012/11/04/routage-enjeu-cyberstrategie/
42 44 Laurent GUERBY
43 45 Laurent GUERBY
coupure free wanadoo http://www.journaldunet.com/solutions/0301/030122_freeft.shtml
44 45 Laurent GUERBY
45 46 Laurent GUERBY
tsunami Japon 2011 et BGP : http://archive.psg.com/111206.conext-quake.pdf
46 46 Laurent GUERBY
47 47 Laurent GUERBY
Session is up on telnet:route-views.routeviews.org username rviews
48 47 Laurent GUERBY
49 48 Laurent GUERBY
BGP book http://www.bortzmeyer.org/files/bgp.html
50 48 Laurent GUERBY
51 49 Laurent GUERBY
Cyclops is able to detect several forms of route hijack attacks http://cyclops.cs.ucla.edu/
52 50 Laurent GUERBY
BGPmon monitors the routing of your prefixes and alerts you in case of an 'interesting' path chang http://www.bgpmon.net/
53 49 Laurent GUERBY
54 53 Laurent GUERBY
http://jointtransit.nl/prices.html
55 53 Laurent GUERBY
56 54 Laurent GUERBY
http://blog.cloudflare.com/the-ddos-that-knocked-spamhaus-offline-and-ho
57 54 Laurent GUERBY
58 51 Laurent GUERBY
* taille table de routage http://bgp.potaroo.net/
59 1 Laurent GUERBY
60 65 Laurent GUERBY
* BGP	in	2011	 Geoff	Huston	 APNIC http://iepg.org/2011-11-ietf82/2011-11-13-bgp2011.pdf
61 56 Laurent GUERBY
62 57 Laurent GUERBY
* http://pages.cs.wisc.edu/~plonka/netgear-sntp/
63 57 Laurent GUERBY
64 58 Laurent GUERBY
* http://www.afnic.fr/fr/l-afnic-en-bref/actualites/actualites-generales/7114/show/l-observatoire-sur-la-resilience-de-l-internet-francais-publie-son-rapport-2012.html
65 58 Laurent GUERBY
66 59 Laurent GUERBY
* http://www.ris.ripe.net/dashboard/2a01:6600:8000::/40
67 59 Laurent GUERBY
68 60 Laurent GUERBY
* http://www.bortzmeyer.org/6996.html
69 60 Laurent GUERBY
** RFC 6996 : Autonomous System (AS) Reservation for Private Use
70 60 Laurent GUERBY
** http://www.iana.org/assignments/as-numbers
71 60 Laurent GUERBY
72 61 Laurent GUERBY
* Look for TRACEROUTE by SRCGUARDIAN in the Play Store.   It needs network access only...  Doesn't do TCP but does ICMP and UDP traceroutes and displays ASN as well ...
73 61 Laurent GUERBY
74 63 Laurent GUERBY
* http://www.team-cymru.org/Services/Bogons/bgp.html
75 63 Laurent GUERBY
** http://www.team-cymru.org/Services/Bogons/bgp-examples.html#bird-full
76 63 Laurent GUERBY
77 38 Laurent GUERBY
h1. TouIX et GIX
78 38 Laurent GUERBY
79 38 Laurent GUERBY
http://touix.net
80 38 Laurent GUERBY
http://wikilulu.net/doku.php?id=articles:gix-howto
81 38 Laurent GUERBY
82 3 Laurent GUERBY
h1. Evolutions de la conf BGP
83 3 Laurent GUERBY
84 3 Laurent GUERBY
* http://lists.tetaneutral.net/pipermail/technique/2011-December/000118.html
85 3 Laurent GUERBY
86 5 Laurent GUERBY
TODO: 
87 6 Laurent GUERBY
* mise en place d'un gestionaire de version style git au moins pour documentation
88 5 Laurent GUERBY
* Comment gerer les password MD5 du fichier de conf (les garder secrets tout en publiant le reste)
89 5 Laurent GUERBY
* Atelier ?
90 7 Laurent GUERBY
** Laurent GUERBY
91 9 Raphaël Durand
** Solarus
92 10 Raphaël Durand
** Ajouter son nom...
93 4 Laurent GUERBY
94 13 Laurent GUERBY
Alternative a MP BGP
95 13 Laurent GUERBY
http://tools.ietf.org/html/draft-ietf-idr-bgp-multisession-06
96 13 Laurent GUERBY
97 31 Laurent GUERBY
Add Path
98 31 Laurent GUERBY
http://tools.ietf.org/html/draft-ietf-idr-add-paths-07
99 31 Laurent GUERBY
support in bird ? http://marc.info/?l=bird-users&m=134409996129466&w=2
100 31 Laurent GUERBY
101 2 Laurent GUERBY
h1. Liens
102 2 Laurent GUERBY
103 2 Laurent GUERBY
* http://www.cl.cam.ac.uk/~tgg22/talks/BGP_TUTORIAL_ICNP_2002.ppt
104 11 Laurent GUERBY
* http://www.menog.net/menog-meetings/menog5/presentations/smith-32bit-asn-update.pdf
105 12 Laurent GUERBY
* AS4 http://www.rfc-editor.org/rfc/rfc4893.txt
106 19 Laurent GUERBY
* bonnes pratiques incidents BGP
107 19 Laurent GUERBY
** https://www.sstic.org/media/SSTIC2012/SSTIC-actes/influence_des_bonnes_pratiques_sur_les_incidents_b/SSTIC2012-Slides-influence_des_bonnes_pratiques_sur_les_incidents_bgp-contat_valadon_nataf.pdf
108 35 Laurent GUERBY
* test ping plus UDP http://www.broadband-forum.org/technical/download/TR-143.pdf
109 2 Laurent GUERBY
110 1 Laurent GUERBY
h1. Configuration Toulouse
111 1 Laurent GUERBY
112 1 Laurent GUERBY
<pre>
113 1 Laurent GUERBY
router id 91.224.148.2;
114 1 Laurent GUERBY
define myas = 197422;
115 1 Laurent GUERBY
116 1 Laurent GUERBY
117 1 Laurent GUERBY
protocol device {
118 1 Laurent GUERBY
	scan time 10;
119 1 Laurent GUERBY
        primary "eth0" 91.224.148.3;
120 1 Laurent GUERBY
}
121 1 Laurent GUERBY
122 1 Laurent GUERBY
protocol static static_bgp {
123 1 Laurent GUERBY
	import all;
124 1 Laurent GUERBY
	route 91.224.148.0/23 reject;
125 1 Laurent GUERBY
}
126 1 Laurent GUERBY
127 1 Laurent GUERBY
128 1 Laurent GUERBY
protocol kernel{
129 1 Laurent GUERBY
	import all;
130 1 Laurent GUERBY
	export all;
131 1 Laurent GUERBY
}
132 1 Laurent GUERBY
133 1 Laurent GUERBY
134 1 Laurent GUERBY
function avoid_martians()
135 1 Laurent GUERBY
prefix set martians;
136 1 Laurent GUERBY
{
137 1 Laurent GUERBY
  martians = [ 169.254.0.0/16+, 172.16.0.0/12+, 192.168.0.0/16+, 10.0.0.0/8+, 224.0.0.0/4+, 240.0.0.0/4+ ];
138 1 Laurent GUERBY
139 1 Laurent GUERBY
  # Avoid 0.0.0.0/X
140 1 Laurent GUERBY
  if net.ip = 0.0.0.0 then return false;
141 1 Laurent GUERBY
142 1 Laurent GUERBY
  # Avoid too short and too long prefixes
143 1 Laurent GUERBY
  if (net.len < 8) || (net.len > 24) then return false;
144 1 Laurent GUERBY
145 1 Laurent GUERBY
  # Avoid RFC1918 networks
146 1 Laurent GUERBY
  if net ~ martians then return false;
147 1 Laurent GUERBY
  return true;
148 1 Laurent GUERBY
}
149 1 Laurent GUERBY
150 1 Laurent GUERBY
filter bgp_OUT {
151 1 Laurent GUERBY
	if (net ~ [91.224.148.0/23]) then accept;
152 1 Laurent GUERBY
	else reject;
153 1 Laurent GUERBY
}
154 1 Laurent GUERBY
155 1 Laurent GUERBY
156 1 Laurent GUERBY
protocol bgp TOUIX {
157 1 Laurent GUERBY
        local as myas;
158 1 Laurent GUERBY
        neighbor 91.213.236.1 as 47184;
159 1 Laurent GUERBY
        preference 200;
160 1 Laurent GUERBY
        import where avoid_martians();
161 1 Laurent GUERBY
        export filter bgp_OUT;
162 1 Laurent GUERBY
}
163 1 Laurent GUERBY
164 1 Laurent GUERBY
protocol bgp JAGUAR {
165 1 Laurent GUERBY
	 local as myas;
166 1 Laurent GUERBY
	 neighbor 31.172.233.1 as 30781;
167 1 Laurent GUERBY
	 preference 50;
168 1 Laurent GUERBY
         import where avoid_martians();
169 1 Laurent GUERBY
         export filter bgp_OUT;
170 1 Laurent GUERBY
}
171 1 Laurent GUERBY
172 1 Laurent GUERBY
protocol bgp TETANEUTRAL {
173 1 Laurent GUERBY
	local as myas;
174 1 Laurent GUERBY
	neighbor 91.224.148.2 as myas;
175 1 Laurent GUERBY
	preference 100;
176 1 Laurent GUERBY
	import where avoid_martians();
177 1 Laurent GUERBY
	export all;
178 1 Laurent GUERBY
}
179 1 Laurent GUERBY
</pre>
180 20 Laurent GUERBY
181 33 Laurent GUERBY
h1. IRR
182 33 Laurent GUERBY
183 33 Laurent GUERBY
* From nanog:
184 33 Laurent GUERBY
http://www.clarksys.com/blog/2009/09/02/using-irr-with-level3/
185 33 Laurent GUERBY
whois -h filtergen.level3.net "RIPE::YOUR-AS-SET  -searchpath=RIPE;ARIN;RADB -recurseok -warnonly"
186 33 Laurent GUERBY
187 20 Laurent GUERBY
h1. Blackholing
188 20 Laurent GUERBY
189 160 Laurent GUERBY
h2. DECIX
190 160 Laurent GUERBY
191 160 Laurent GUERBY
http://de-cix.net/products-services/de-cix-frankfurt/blackholing/
192 160 Laurent GUERBY
193 24 Laurent GUERBY
h2. Attaques
194 24 Laurent GUERBY
195 24 Laurent GUERBY
* 20120629 http://lists.tetaneutral.net/pipermail/technique/2012-July/000406.html
196 36 Laurent GUERBY
* http://blog.cloudflare.com/65gbps-ddos-no-problem
197 24 Laurent GUERBY
198 1 Laurent GUERBY
h2. URPF
199 34 Laurent GUERBY
200 65 Laurent GUERBY
blacklister une/plusieures sources est relativement complexe à mettre en place sur une petite infrastructure car nécessite la mise en place de l'URPF (Unicast Reverse Path Forwarding).
201 34 Laurent GUERBY
202 34 Laurent GUERBY
http://www.cisco.com/web/about/security/intelligence/ipv6_rtbh.html
203 34 Laurent GUERBY
204 20 Laurent GUERBY
h2. RFC3882 
205 1 Laurent GUERBY
206 22 Laurent GUERBY
* http://www.ietf.org/rfc/rfc3882.txt
207 1 Laurent GUERBY
community AS:666 sur annonce /32 pour balckhole par AS upstream
208 1 Laurent GUERBY
209 22 Laurent GUERBY
* doc CISCO
210 22 Laurent GUERBY
http://www.cisco.com/web/about/security/intelligence/blackhole.pdf
211 22 Laurent GUERBY
212 28 Laurent GUERBY
h2. RFC1997
213 28 Laurent GUERBY
214 28 Laurent GUERBY
* http://www.ietf.org/rfc/rfc1997.txt
215 28 Laurent GUERBY
BGP Communities Attribute
216 28 Laurent GUERBY
217 28 Laurent GUERBY
* doc CISCO
218 28 Laurent GUERBY
http://www.cisco.com/web/about/ac123/ac147/archived_issues/ipj_6-2/bgp_communities.html
219 28 Laurent GUERBY
220 22 Laurent GUERBY
h2. BIRD
221 22 Laurent GUERBY
222 22 Laurent GUERBY
* http://www.mail-archive.com/bird-users@atrey.karlin.mff.cuni.cz/msg01998.html
223 1 Laurent GUERBY
224 24 Laurent GUERBY
h2. Absolight
225 24 Laurent GUERBY
226 65 Laurent GUERBY
* communauté 29608:65001 sur /24..32 IPv4 et /41..128 IPv6 => blackhole
227 65 Laurent GUERBY
* test 20120703 IPv4 et IPv6, ça marche et convergence très rapide
228 24 Laurent GUERBY
229 22 Laurent GUERBY
h2. GIXE
230 1 Laurent GUERBY
231 65 Laurent GUERBY
* communauté 31576:666 sur /32 => blackhole
232 65 Laurent GUERBY
* test 20120703 => marche pas encore, signalé et dev a faire coté GIXE pour autoriser les /32
233 1 Laurent GUERBY
234 1 Laurent GUERBY
h2. Jaguar 
235 22 Laurent GUERBY
236 24 Laurent GUERBY
* https://extranet.jaguar-network.com/app/public/index.php?cmd=bgp-policy
237 65 Laurent GUERBY
* demande 20120702 : pas de communauté blackhole actuellement, en reflexion
238 65 Laurent GUERBY
* déploiement de matériel arbor networks, reglage a affiner (pas de detection d'attaque)
239 22 Laurent GUERBY
240 27 Laurent GUERBY
h2. Gitoyen
241 27 Laurent GUERBY
242 65 Laurent GUERBY
* demande 20120704 sur la liste, réponse 20120717
243 28 Laurent GUERBY
* Tata http://noc.easycolocate.nl/Teleglobe_bgp_comm.pdf
244 65 Laurent GUERBY
*** => black-hole route (host route or shorter prefix within customer’s RIR registred assignment) 64999:0
245 28 Laurent GUERBY
* Ielo  whois AS29075 => 29075:0 Null-route/Blackhole
246 32 Laurent GUERBY
* https://pad.ilico.org/p/cleanup-bgp-gitoyen
247 22 Laurent GUERBY
248 22 Laurent GUERBY
h2. France-IX
249 22 Laurent GUERBY
250 25 Laurent GUERBY
* community plan : https://apps.db.ripe.net/whois/lookup/ripe/aut-num/AS51706.html
251 26 Laurent GUERBY
* TODO tester
252 22 Laurent GUERBY
253 22 Laurent GUERBY
h2. Equinix-IX
254 1 Laurent GUERBY
255 26 Laurent GUERBY
* community plan : https://ix.equinix.com/ixp/mlpeCommunityInfo
256 26 Laurent GUERBY
* TODO tester
257 22 Laurent GUERBY
258 1 Laurent GUERBY
h2. TouIX
259 22 Laurent GUERBY
260 26 Laurent GUERBY
* demande acces switch et route server 20120702
261 22 Laurent GUERBY
* TODO
262 1 Laurent GUERBY
263 1 Laurent GUERBY
h2. Hurricane Electric
264 1 Laurent GUERBY
265 26 Laurent GUERBY
* http://www.he.net/adm/
266 1 Laurent GUERBY
* http://www.he.net/adm/blackhole.html
267 1 Laurent GUERBY
* TODO tester
268 28 Laurent GUERBY
269 28 Laurent GUERBY
h2. Sfinx
270 28 Laurent GUERBY
271 28 Laurent GUERBY
* http://www.renater.fr/route-servers-bgp?lang=fr
272 28 Laurent GUERBY
* whois  AS1304 =>
273 28 Laurent GUERBY
remarks:        1304:65281 = Apply NO-EXPORT community
274 28 Laurent GUERBY
remarks:        1304:65282 = Apply NO-ADVERTISE community