Projet

Général

Profil

BGP » Historique » Version 27

Laurent GUERBY, 17/07/2012 15:21

1 20 Laurent GUERBY
{{>toc}}
2 20 Laurent GUERBY
3 1 Laurent GUERBY
h1. BGP
4 1 Laurent GUERBY
5 1 Laurent GUERBY
Nous utilisons BIRD sous Linux comme routeur BGP
6 1 Laurent GUERBY
7 1 Laurent GUERBY
http://bird.network.cz/
8 1 Laurent GUERBY
9 14 Laurent GUERBY
blog bgp http://www.renesys.com/blog/
10 15 Laurent GUERBY
flowspec http://www.slideshare.net/sfouant/an-introduction-to-bgp-flow-spec
11 16 Laurent GUERBY
DFZ = Default Free Zone archive http://archive.routeviews.org/
12 17 Laurent GUERBY
http://www.ripe.net/data-tools/stats/ris/routing-information-service
13 17 Laurent GUERBY
http://pch.net/resources/data/routing-tables/archive/
14 17 Laurent GUERBY
http://pch.net/resources/data/routing-tables/mrt-bgp-updates/
15 18 Laurent GUERBY
http://www.nanog.org/meetings/archive/
16 14 Laurent GUERBY
17 3 Laurent GUERBY
h1. Evolutions de la conf BGP
18 3 Laurent GUERBY
19 3 Laurent GUERBY
* http://lists.tetaneutral.net/pipermail/technique/2011-December/000118.html
20 3 Laurent GUERBY
21 5 Laurent GUERBY
TODO: 
22 6 Laurent GUERBY
* mise en place d'un gestionaire de version style git au moins pour documentation
23 5 Laurent GUERBY
* Comment gerer les password MD5 du fichier de conf (les garder secrets tout en publiant le reste)
24 5 Laurent GUERBY
* Atelier ?
25 7 Laurent GUERBY
** Laurent GUERBY
26 9 Raphaël Durand
** Solarus
27 10 Raphaël Durand
** Ajouter son nom...
28 4 Laurent GUERBY
29 13 Laurent GUERBY
Alternative a MP BGP
30 13 Laurent GUERBY
http://tools.ietf.org/html/draft-ietf-idr-bgp-multisession-06
31 13 Laurent GUERBY
32 2 Laurent GUERBY
h1. Liens
33 2 Laurent GUERBY
34 2 Laurent GUERBY
* http://www.cl.cam.ac.uk/~tgg22/talks/BGP_TUTORIAL_ICNP_2002.ppt
35 11 Laurent GUERBY
* http://www.menog.net/menog-meetings/menog5/presentations/smith-32bit-asn-update.pdf
36 12 Laurent GUERBY
* AS4 http://www.rfc-editor.org/rfc/rfc4893.txt
37 19 Laurent GUERBY
* bonnes pratiques incidents BGP
38 19 Laurent GUERBY
** https://www.sstic.org/media/SSTIC2012/SSTIC-actes/influence_des_bonnes_pratiques_sur_les_incidents_b/SSTIC2012-Slides-influence_des_bonnes_pratiques_sur_les_incidents_bgp-contat_valadon_nataf.pdf
39 2 Laurent GUERBY
40 1 Laurent GUERBY
h1. Configuration Toulouse
41 1 Laurent GUERBY
42 1 Laurent GUERBY
<pre>
43 1 Laurent GUERBY
router id 91.224.148.2;
44 1 Laurent GUERBY
define myas = 197422;
45 1 Laurent GUERBY
46 1 Laurent GUERBY
47 1 Laurent GUERBY
protocol device {
48 1 Laurent GUERBY
	scan time 10;
49 1 Laurent GUERBY
        primary "eth0" 91.224.148.3;
50 1 Laurent GUERBY
}
51 1 Laurent GUERBY
52 1 Laurent GUERBY
protocol static static_bgp {
53 1 Laurent GUERBY
	import all;
54 1 Laurent GUERBY
	route 91.224.148.0/23 reject;
55 1 Laurent GUERBY
}
56 1 Laurent GUERBY
57 1 Laurent GUERBY
58 1 Laurent GUERBY
protocol kernel{
59 1 Laurent GUERBY
	import all;
60 1 Laurent GUERBY
	export all;
61 1 Laurent GUERBY
}
62 1 Laurent GUERBY
63 1 Laurent GUERBY
64 1 Laurent GUERBY
function avoid_martians()
65 1 Laurent GUERBY
prefix set martians;
66 1 Laurent GUERBY
{
67 1 Laurent GUERBY
  martians = [ 169.254.0.0/16+, 172.16.0.0/12+, 192.168.0.0/16+, 10.0.0.0/8+, 224.0.0.0/4+, 240.0.0.0/4+ ];
68 1 Laurent GUERBY
69 1 Laurent GUERBY
  # Avoid 0.0.0.0/X
70 1 Laurent GUERBY
  if net.ip = 0.0.0.0 then return false;
71 1 Laurent GUERBY
72 1 Laurent GUERBY
  # Avoid too short and too long prefixes
73 1 Laurent GUERBY
  if (net.len < 8) || (net.len > 24) then return false;
74 1 Laurent GUERBY
75 1 Laurent GUERBY
  # Avoid RFC1918 networks
76 1 Laurent GUERBY
  if net ~ martians then return false;
77 1 Laurent GUERBY
  return true;
78 1 Laurent GUERBY
}
79 1 Laurent GUERBY
80 1 Laurent GUERBY
filter bgp_OUT {
81 1 Laurent GUERBY
	if (net ~ [91.224.148.0/23]) then accept;
82 1 Laurent GUERBY
	else reject;
83 1 Laurent GUERBY
}
84 1 Laurent GUERBY
85 1 Laurent GUERBY
86 1 Laurent GUERBY
protocol bgp TOUIX {
87 1 Laurent GUERBY
        local as myas;
88 1 Laurent GUERBY
        neighbor 91.213.236.1 as 47184;
89 1 Laurent GUERBY
        preference 200;
90 1 Laurent GUERBY
        import where avoid_martians();
91 1 Laurent GUERBY
        export filter bgp_OUT;
92 1 Laurent GUERBY
}
93 1 Laurent GUERBY
94 1 Laurent GUERBY
protocol bgp JAGUAR {
95 1 Laurent GUERBY
	 local as myas;
96 1 Laurent GUERBY
	 neighbor 31.172.233.1 as 30781;
97 1 Laurent GUERBY
	 preference 50;
98 1 Laurent GUERBY
         import where avoid_martians();
99 1 Laurent GUERBY
         export filter bgp_OUT;
100 1 Laurent GUERBY
}
101 1 Laurent GUERBY
102 1 Laurent GUERBY
protocol bgp TETANEUTRAL {
103 1 Laurent GUERBY
	local as myas;
104 1 Laurent GUERBY
	neighbor 91.224.148.2 as myas;
105 1 Laurent GUERBY
	preference 100;
106 1 Laurent GUERBY
	import where avoid_martians();
107 1 Laurent GUERBY
	export all;
108 1 Laurent GUERBY
}
109 1 Laurent GUERBY
</pre>
110 20 Laurent GUERBY
111 20 Laurent GUERBY
h1. Blackholing
112 20 Laurent GUERBY
113 24 Laurent GUERBY
h2. Attaques
114 24 Laurent GUERBY
115 24 Laurent GUERBY
* 20120629 http://lists.tetaneutral.net/pipermail/technique/2012-July/000406.html
116 24 Laurent GUERBY
117 20 Laurent GUERBY
h2. RFC3882 
118 1 Laurent GUERBY
119 22 Laurent GUERBY
* http://www.ietf.org/rfc/rfc3882.txt
120 1 Laurent GUERBY
community AS:666 sur annonce /32 pour balckhole par AS upstream
121 1 Laurent GUERBY
122 22 Laurent GUERBY
* doc CISCO
123 22 Laurent GUERBY
http://www.cisco.com/web/about/security/intelligence/blackhole.pdf
124 22 Laurent GUERBY
125 22 Laurent GUERBY
h2. BIRD
126 22 Laurent GUERBY
127 22 Laurent GUERBY
* http://www.mail-archive.com/bird-users@atrey.karlin.mff.cuni.cz/msg01998.html
128 22 Laurent GUERBY
129 24 Laurent GUERBY
h2. Absolight
130 24 Laurent GUERBY
131 24 Laurent GUERBY
* communauté 29608:65001 sur /24..32 IPv4 et /41..128 IPv6 => blackhole
132 24 Laurent GUERBY
* test 20120703 IPv4 et IPv6, ça marche et convergence très rapide
133 24 Laurent GUERBY
134 22 Laurent GUERBY
h2. GIXE
135 22 Laurent GUERBY
136 1 Laurent GUERBY
* communauté 31576:666 sur /32 => blackhole
137 24 Laurent GUERBY
* test 20120703 => marche pas encore, signalé et dev a faire coté GIXE pour autoriser les /32
138 1 Laurent GUERBY
139 1 Laurent GUERBY
h2. Jaguar 
140 1 Laurent GUERBY
141 22 Laurent GUERBY
* https://extranet.jaguar-network.com/app/public/index.php?cmd=bgp-policy
142 24 Laurent GUERBY
* demande 20120702 : pas de communauté blackhole actuellement, en reflexion
143 24 Laurent GUERBY
* déploiement de matériel arbor networks, reglage a affiner (pas de detection d'attaque)
144 22 Laurent GUERBY
145 22 Laurent GUERBY
h2. Gitoyen
146 22 Laurent GUERBY
147 27 Laurent GUERBY
* demande 20120704 sur la liste, réponse 20120717
148 27 Laurent GUERBY
** Tata http://noc.easycolocate.nl/Teleglobe_bgp_comm.pdf
149 27 Laurent GUERBY
*** => black-hole route (host route or shorter prefix within customer’s RIR registred assignment) 64999:0
150 27 Laurent GUERBY
** Ielo  whois AS29075 => 29075:0 Null-route/Blackhole
151 22 Laurent GUERBY
152 22 Laurent GUERBY
h2. France-IX
153 22 Laurent GUERBY
154 25 Laurent GUERBY
* community plan : https://apps.db.ripe.net/whois/lookup/ripe/aut-num/AS51706.html
155 26 Laurent GUERBY
* TODO tester
156 22 Laurent GUERBY
157 22 Laurent GUERBY
h2. Equinix-IX
158 1 Laurent GUERBY
159 26 Laurent GUERBY
* community plan : https://ix.equinix.com/ixp/mlpeCommunityInfo
160 26 Laurent GUERBY
* TODO tester
161 22 Laurent GUERBY
162 1 Laurent GUERBY
h2. TouIX
163 22 Laurent GUERBY
164 26 Laurent GUERBY
* demande acces switch et route server 20120702
165 22 Laurent GUERBY
* TODO
166 1 Laurent GUERBY
167 1 Laurent GUERBY
h2. Hurricane Electric
168 1 Laurent GUERBY
169 26 Laurent GUERBY
* http://www.he.net/adm/
170 26 Laurent GUERBY
* http://www.he.net/adm/blackhole.html
171 26 Laurent GUERBY
* TODO tester