Projet

Général

Profil

BGP » Historique » Version 31

Laurent GUERBY, 04/08/2012 21:05

1 20 Laurent GUERBY
{{>toc}}
2 20 Laurent GUERBY
3 1 Laurent GUERBY
h1. BGP
4 1 Laurent GUERBY
5 1 Laurent GUERBY
Nous utilisons BIRD sous Linux comme routeur BGP
6 1 Laurent GUERBY
7 1 Laurent GUERBY
http://bird.network.cz/
8 1 Laurent GUERBY
9 14 Laurent GUERBY
blog bgp http://www.renesys.com/blog/
10 15 Laurent GUERBY
flowspec http://www.slideshare.net/sfouant/an-introduction-to-bgp-flow-spec
11 16 Laurent GUERBY
DFZ = Default Free Zone archive http://archive.routeviews.org/
12 17 Laurent GUERBY
http://www.ripe.net/data-tools/stats/ris/routing-information-service
13 17 Laurent GUERBY
http://pch.net/resources/data/routing-tables/archive/
14 17 Laurent GUERBY
http://pch.net/resources/data/routing-tables/mrt-bgp-updates/
15 18 Laurent GUERBY
http://www.nanog.org/meetings/archive/
16 14 Laurent GUERBY
17 29 Laurent GUERBY
http://www.ipbcop.org/
18 29 Laurent GUERBY
IP Best Current Operational Practices Documented best practices for Engineers by Engineers
19 29 Laurent GUERBY
20 30 Laurent GUERBY
BGP best practices ANSSI
21 30 Laurent GUERBY
https://www.sstic.org/media/SSTIC2012/SSTIC-actes/influence_des_bonnes_pratiques_sur_les_incidents_b/SSTIC2012-Article-influence_des_bonnes_pratiques_sur_les_incidents_bgp-contat_valadon_nataf_2.pdf
22 30 Laurent GUERBY
23 3 Laurent GUERBY
h1. Evolutions de la conf BGP
24 3 Laurent GUERBY
25 3 Laurent GUERBY
* http://lists.tetaneutral.net/pipermail/technique/2011-December/000118.html
26 3 Laurent GUERBY
27 5 Laurent GUERBY
TODO: 
28 6 Laurent GUERBY
* mise en place d'un gestionaire de version style git au moins pour documentation
29 5 Laurent GUERBY
* Comment gerer les password MD5 du fichier de conf (les garder secrets tout en publiant le reste)
30 5 Laurent GUERBY
* Atelier ?
31 7 Laurent GUERBY
** Laurent GUERBY
32 9 Raphaël Durand
** Solarus
33 10 Raphaël Durand
** Ajouter son nom...
34 4 Laurent GUERBY
35 13 Laurent GUERBY
Alternative a MP BGP
36 13 Laurent GUERBY
http://tools.ietf.org/html/draft-ietf-idr-bgp-multisession-06
37 13 Laurent GUERBY
38 31 Laurent GUERBY
Add Path
39 31 Laurent GUERBY
http://tools.ietf.org/html/draft-ietf-idr-add-paths-07
40 31 Laurent GUERBY
support in bird ? http://marc.info/?l=bird-users&m=134409996129466&w=2
41 31 Laurent GUERBY
42 2 Laurent GUERBY
h1. Liens
43 2 Laurent GUERBY
44 2 Laurent GUERBY
* http://www.cl.cam.ac.uk/~tgg22/talks/BGP_TUTORIAL_ICNP_2002.ppt
45 11 Laurent GUERBY
* http://www.menog.net/menog-meetings/menog5/presentations/smith-32bit-asn-update.pdf
46 12 Laurent GUERBY
* AS4 http://www.rfc-editor.org/rfc/rfc4893.txt
47 19 Laurent GUERBY
* bonnes pratiques incidents BGP
48 19 Laurent GUERBY
** https://www.sstic.org/media/SSTIC2012/SSTIC-actes/influence_des_bonnes_pratiques_sur_les_incidents_b/SSTIC2012-Slides-influence_des_bonnes_pratiques_sur_les_incidents_bgp-contat_valadon_nataf.pdf
49 2 Laurent GUERBY
50 1 Laurent GUERBY
h1. Configuration Toulouse
51 1 Laurent GUERBY
52 1 Laurent GUERBY
<pre>
53 1 Laurent GUERBY
router id 91.224.148.2;
54 1 Laurent GUERBY
define myas = 197422;
55 1 Laurent GUERBY
56 1 Laurent GUERBY
57 1 Laurent GUERBY
protocol device {
58 1 Laurent GUERBY
	scan time 10;
59 1 Laurent GUERBY
        primary "eth0" 91.224.148.3;
60 1 Laurent GUERBY
}
61 1 Laurent GUERBY
62 1 Laurent GUERBY
protocol static static_bgp {
63 1 Laurent GUERBY
	import all;
64 1 Laurent GUERBY
	route 91.224.148.0/23 reject;
65 1 Laurent GUERBY
}
66 1 Laurent GUERBY
67 1 Laurent GUERBY
68 1 Laurent GUERBY
protocol kernel{
69 1 Laurent GUERBY
	import all;
70 1 Laurent GUERBY
	export all;
71 1 Laurent GUERBY
}
72 1 Laurent GUERBY
73 1 Laurent GUERBY
74 1 Laurent GUERBY
function avoid_martians()
75 1 Laurent GUERBY
prefix set martians;
76 1 Laurent GUERBY
{
77 1 Laurent GUERBY
  martians = [ 169.254.0.0/16+, 172.16.0.0/12+, 192.168.0.0/16+, 10.0.0.0/8+, 224.0.0.0/4+, 240.0.0.0/4+ ];
78 1 Laurent GUERBY
79 1 Laurent GUERBY
  # Avoid 0.0.0.0/X
80 1 Laurent GUERBY
  if net.ip = 0.0.0.0 then return false;
81 1 Laurent GUERBY
82 1 Laurent GUERBY
  # Avoid too short and too long prefixes
83 1 Laurent GUERBY
  if (net.len < 8) || (net.len > 24) then return false;
84 1 Laurent GUERBY
85 1 Laurent GUERBY
  # Avoid RFC1918 networks
86 1 Laurent GUERBY
  if net ~ martians then return false;
87 1 Laurent GUERBY
  return true;
88 1 Laurent GUERBY
}
89 1 Laurent GUERBY
90 1 Laurent GUERBY
filter bgp_OUT {
91 1 Laurent GUERBY
	if (net ~ [91.224.148.0/23]) then accept;
92 1 Laurent GUERBY
	else reject;
93 1 Laurent GUERBY
}
94 1 Laurent GUERBY
95 1 Laurent GUERBY
96 1 Laurent GUERBY
protocol bgp TOUIX {
97 1 Laurent GUERBY
        local as myas;
98 1 Laurent GUERBY
        neighbor 91.213.236.1 as 47184;
99 1 Laurent GUERBY
        preference 200;
100 1 Laurent GUERBY
        import where avoid_martians();
101 1 Laurent GUERBY
        export filter bgp_OUT;
102 1 Laurent GUERBY
}
103 1 Laurent GUERBY
104 1 Laurent GUERBY
protocol bgp JAGUAR {
105 1 Laurent GUERBY
	 local as myas;
106 1 Laurent GUERBY
	 neighbor 31.172.233.1 as 30781;
107 1 Laurent GUERBY
	 preference 50;
108 1 Laurent GUERBY
         import where avoid_martians();
109 1 Laurent GUERBY
         export filter bgp_OUT;
110 1 Laurent GUERBY
}
111 1 Laurent GUERBY
112 1 Laurent GUERBY
protocol bgp TETANEUTRAL {
113 1 Laurent GUERBY
	local as myas;
114 1 Laurent GUERBY
	neighbor 91.224.148.2 as myas;
115 1 Laurent GUERBY
	preference 100;
116 1 Laurent GUERBY
	import where avoid_martians();
117 1 Laurent GUERBY
	export all;
118 1 Laurent GUERBY
}
119 1 Laurent GUERBY
</pre>
120 20 Laurent GUERBY
121 20 Laurent GUERBY
h1. Blackholing
122 20 Laurent GUERBY
123 24 Laurent GUERBY
h2. Attaques
124 24 Laurent GUERBY
125 24 Laurent GUERBY
* 20120629 http://lists.tetaneutral.net/pipermail/technique/2012-July/000406.html
126 24 Laurent GUERBY
127 20 Laurent GUERBY
h2. RFC3882 
128 1 Laurent GUERBY
129 22 Laurent GUERBY
* http://www.ietf.org/rfc/rfc3882.txt
130 1 Laurent GUERBY
community AS:666 sur annonce /32 pour balckhole par AS upstream
131 1 Laurent GUERBY
132 22 Laurent GUERBY
* doc CISCO
133 22 Laurent GUERBY
http://www.cisco.com/web/about/security/intelligence/blackhole.pdf
134 22 Laurent GUERBY
135 28 Laurent GUERBY
h2. RFC1997
136 28 Laurent GUERBY
137 28 Laurent GUERBY
* http://www.ietf.org/rfc/rfc1997.txt
138 28 Laurent GUERBY
BGP Communities Attribute
139 28 Laurent GUERBY
140 28 Laurent GUERBY
* doc CISCO
141 28 Laurent GUERBY
http://www.cisco.com/web/about/ac123/ac147/archived_issues/ipj_6-2/bgp_communities.html
142 28 Laurent GUERBY
143 22 Laurent GUERBY
h2. BIRD
144 22 Laurent GUERBY
145 22 Laurent GUERBY
* http://www.mail-archive.com/bird-users@atrey.karlin.mff.cuni.cz/msg01998.html
146 22 Laurent GUERBY
147 24 Laurent GUERBY
h2. Absolight
148 24 Laurent GUERBY
149 24 Laurent GUERBY
* communauté 29608:65001 sur /24..32 IPv4 et /41..128 IPv6 => blackhole
150 24 Laurent GUERBY
* test 20120703 IPv4 et IPv6, ça marche et convergence très rapide
151 24 Laurent GUERBY
152 22 Laurent GUERBY
h2. GIXE
153 22 Laurent GUERBY
154 1 Laurent GUERBY
* communauté 31576:666 sur /32 => blackhole
155 24 Laurent GUERBY
* test 20120703 => marche pas encore, signalé et dev a faire coté GIXE pour autoriser les /32
156 1 Laurent GUERBY
157 1 Laurent GUERBY
h2. Jaguar 
158 22 Laurent GUERBY
159 24 Laurent GUERBY
* https://extranet.jaguar-network.com/app/public/index.php?cmd=bgp-policy
160 22 Laurent GUERBY
* demande 20120702 : pas de communauté blackhole actuellement, en reflexion
161 22 Laurent GUERBY
* déploiement de matériel arbor networks, reglage a affiner (pas de detection d'attaque)
162 22 Laurent GUERBY
163 27 Laurent GUERBY
h2. Gitoyen
164 27 Laurent GUERBY
165 1 Laurent GUERBY
* demande 20120704 sur la liste, réponse 20120717
166 28 Laurent GUERBY
* Tata http://noc.easycolocate.nl/Teleglobe_bgp_comm.pdf
167 27 Laurent GUERBY
*** => black-hole route (host route or shorter prefix within customer’s RIR registred assignment) 64999:0
168 28 Laurent GUERBY
* Ielo  whois AS29075 => 29075:0 Null-route/Blackhole
169 22 Laurent GUERBY
170 22 Laurent GUERBY
h2. France-IX
171 22 Laurent GUERBY
172 25 Laurent GUERBY
* community plan : https://apps.db.ripe.net/whois/lookup/ripe/aut-num/AS51706.html
173 26 Laurent GUERBY
* TODO tester
174 22 Laurent GUERBY
175 22 Laurent GUERBY
h2. Equinix-IX
176 1 Laurent GUERBY
177 26 Laurent GUERBY
* community plan : https://ix.equinix.com/ixp/mlpeCommunityInfo
178 26 Laurent GUERBY
* TODO tester
179 22 Laurent GUERBY
180 1 Laurent GUERBY
h2. TouIX
181 22 Laurent GUERBY
182 26 Laurent GUERBY
* demande acces switch et route server 20120702
183 22 Laurent GUERBY
* TODO
184 1 Laurent GUERBY
185 1 Laurent GUERBY
h2. Hurricane Electric
186 1 Laurent GUERBY
187 26 Laurent GUERBY
* http://www.he.net/adm/
188 1 Laurent GUERBY
* http://www.he.net/adm/blackhole.html
189 1 Laurent GUERBY
* TODO tester
190 28 Laurent GUERBY
191 28 Laurent GUERBY
h2. Sfinx
192 28 Laurent GUERBY
193 28 Laurent GUERBY
* http://www.renater.fr/route-servers-bgp?lang=fr
194 28 Laurent GUERBY
* whois  AS1304 =>
195 28 Laurent GUERBY
remarks:        1304:65281 = Apply NO-EXPORT community
196 28 Laurent GUERBY
remarks:        1304:65282 = Apply NO-ADVERTISE community