Projet

Général

Profil

BGP » Historique » Version 63

Laurent GUERBY, 13/10/2013 21:53

1 20 Laurent GUERBY
{{>toc}}
2 20 Laurent GUERBY
3 1 Laurent GUERBY
h1. BGP
4 1 Laurent GUERBY
5 1 Laurent GUERBY
Nous utilisons BIRD sous Linux comme routeur BGP
6 1 Laurent GUERBY
7 1 Laurent GUERBY
http://bird.network.cz/
8 1 Laurent GUERBY
9 14 Laurent GUERBY
blog bgp http://www.renesys.com/blog/
10 15 Laurent GUERBY
flowspec http://www.slideshare.net/sfouant/an-introduction-to-bgp-flow-spec
11 16 Laurent GUERBY
DFZ = Default Free Zone archive http://archive.routeviews.org/
12 17 Laurent GUERBY
http://www.ripe.net/data-tools/stats/ris/routing-information-service
13 17 Laurent GUERBY
http://pch.net/resources/data/routing-tables/archive/
14 17 Laurent GUERBY
http://pch.net/resources/data/routing-tables/mrt-bgp-updates/
15 18 Laurent GUERBY
http://www.nanog.org/meetings/archive/
16 52 Laurent GUERBY
http://tools.ietf.org/html/draft-lapukhov-bgp-routing-large-dc-02
17 14 Laurent GUERBY
18 43 Laurent GUERBY
http://inside.godaddy.com/inside-story-happened-godaddy-com-sept-10-2012/
19 43 Laurent GUERBY
20 55 Laurent GUERBY
http://tools.ietf.org/html/rfc4271#section-9.1 BGP route decision process
21 55 Laurent GUERBY
22 29 Laurent GUERBY
http://www.ipbcop.org/
23 29 Laurent GUERBY
IP Best Current Operational Practices Documented best practices for Engineers by Engineers
24 29 Laurent GUERBY
25 30 Laurent GUERBY
BGP best practices ANSSI
26 30 Laurent GUERBY
https://www.sstic.org/media/SSTIC2012/SSTIC-actes/influence_des_bonnes_pratiques_sur_les_incidents_b/SSTIC2012-Article-influence_des_bonnes_pratiques_sur_les_incidents_bgp-contat_valadon_nataf_2.pdf
27 62 Laurent GUERBY
http://www.ssi.gouv.fr/fr/bonnes-pratiques/recommandations-et-guides/securite-des-reseaux/le-guide-des-bonnes-pratiques-de-configuration-de-bgp.html
28 30 Laurent GUERBY
29 37 Laurent GUERBY
https://www.ams-ix.net/technical/specifications-descriptions/ams-ix-route-servers
30 37 Laurent GUERBY
31 39 Laurent GUERBY
these LAAS BGP http://www.laas.fr/1-31360-Detail-Soutenance-de-these.php?id=600
32 41 Laurent GUERBY
http://www.laas.fr/1-31706-Publications.php?author=7738
33 1 Laurent GUERBY
http://www.net.t-labs.tu-berlin.de/papers/OMUPMO-OOSICP-11.pdf
34 42 Laurent GUERBY
http://hal.archives-ouvertes.fr/docs/00/60/53/83/PDF/dVirt-virtual_platform.pdf
35 42 Laurent GUERBY
http://hal.archives-ouvertes.fr/docs/00/48/70/74/PDF/Poster_SIGCOMM2010_philippe.pdf
36 40 Laurent GUERBY
37 44 Laurent GUERBY
Le monde sur BGP http://reseaux.blog.lemonde.fr/2012/11/04/routage-enjeu-cyberstrategie/
38 44 Laurent GUERBY
39 45 Laurent GUERBY
coupure free wanadoo http://www.journaldunet.com/solutions/0301/030122_freeft.shtml
40 45 Laurent GUERBY
41 46 Laurent GUERBY
tsunami Japon 2011 et BGP : http://archive.psg.com/111206.conext-quake.pdf
42 46 Laurent GUERBY
43 47 Laurent GUERBY
Session is up on telnet:route-views.routeviews.org username rviews
44 47 Laurent GUERBY
45 48 Laurent GUERBY
BGP book http://www.bortzmeyer.org/files/bgp.html
46 48 Laurent GUERBY
47 49 Laurent GUERBY
Cyclops is able to detect several forms of route hijack attacks http://cyclops.cs.ucla.edu/
48 50 Laurent GUERBY
BGPmon monitors the routing of your prefixes and alerts you in case of an 'interesting' path chang http://www.bgpmon.net/
49 49 Laurent GUERBY
50 53 Laurent GUERBY
http://jointtransit.nl/prices.html
51 53 Laurent GUERBY
52 54 Laurent GUERBY
http://blog.cloudflare.com/the-ddos-that-knocked-spamhaus-offline-and-ho
53 54 Laurent GUERBY
54 51 Laurent GUERBY
* taille table de routage http://bgp.potaroo.net/
55 51 Laurent GUERBY
56 56 Laurent GUERBY
* BGP	in	2011	 Geoff	Huston	 APNIC http://iepg.org/2011-11-ietf82/2011-11-13-bgp2011.pdf
57 56 Laurent GUERBY
58 57 Laurent GUERBY
* http://pages.cs.wisc.edu/~plonka/netgear-sntp/
59 57 Laurent GUERBY
60 58 Laurent GUERBY
* http://www.afnic.fr/fr/l-afnic-en-bref/actualites/actualites-generales/7114/show/l-observatoire-sur-la-resilience-de-l-internet-francais-publie-son-rapport-2012.html
61 58 Laurent GUERBY
62 59 Laurent GUERBY
* http://www.ris.ripe.net/dashboard/2a01:6600:8000::/40
63 59 Laurent GUERBY
64 60 Laurent GUERBY
* http://www.bortzmeyer.org/6996.html
65 60 Laurent GUERBY
** RFC 6996 : Autonomous System (AS) Reservation for Private Use
66 60 Laurent GUERBY
** http://www.iana.org/assignments/as-numbers
67 60 Laurent GUERBY
68 61 Laurent GUERBY
* Look for TRACEROUTE by SRCGUARDIAN in the Play Store.   It needs network access only...  Doesn't do TCP but does ICMP and UDP traceroutes and displays ASN as well ...
69 61 Laurent GUERBY
70 63 Laurent GUERBY
* http://www.team-cymru.org/Services/Bogons/bgp.html
71 63 Laurent GUERBY
** http://www.team-cymru.org/Services/Bogons/bgp-examples.html#bird-full
72 63 Laurent GUERBY
73 38 Laurent GUERBY
h1. TouIX et GIX
74 38 Laurent GUERBY
75 38 Laurent GUERBY
http://touix.net
76 38 Laurent GUERBY
http://wikilulu.net/doku.php?id=articles:gix-howto
77 38 Laurent GUERBY
78 3 Laurent GUERBY
h1. Evolutions de la conf BGP
79 3 Laurent GUERBY
80 3 Laurent GUERBY
* http://lists.tetaneutral.net/pipermail/technique/2011-December/000118.html
81 3 Laurent GUERBY
82 5 Laurent GUERBY
TODO: 
83 6 Laurent GUERBY
* mise en place d'un gestionaire de version style git au moins pour documentation
84 5 Laurent GUERBY
* Comment gerer les password MD5 du fichier de conf (les garder secrets tout en publiant le reste)
85 5 Laurent GUERBY
* Atelier ?
86 7 Laurent GUERBY
** Laurent GUERBY
87 9 Raphaël Durand
** Solarus
88 10 Raphaël Durand
** Ajouter son nom...
89 4 Laurent GUERBY
90 13 Laurent GUERBY
Alternative a MP BGP
91 13 Laurent GUERBY
http://tools.ietf.org/html/draft-ietf-idr-bgp-multisession-06
92 13 Laurent GUERBY
93 31 Laurent GUERBY
Add Path
94 31 Laurent GUERBY
http://tools.ietf.org/html/draft-ietf-idr-add-paths-07
95 31 Laurent GUERBY
support in bird ? http://marc.info/?l=bird-users&m=134409996129466&w=2
96 31 Laurent GUERBY
97 2 Laurent GUERBY
h1. Liens
98 2 Laurent GUERBY
99 2 Laurent GUERBY
* http://www.cl.cam.ac.uk/~tgg22/talks/BGP_TUTORIAL_ICNP_2002.ppt
100 11 Laurent GUERBY
* http://www.menog.net/menog-meetings/menog5/presentations/smith-32bit-asn-update.pdf
101 12 Laurent GUERBY
* AS4 http://www.rfc-editor.org/rfc/rfc4893.txt
102 19 Laurent GUERBY
* bonnes pratiques incidents BGP
103 19 Laurent GUERBY
** https://www.sstic.org/media/SSTIC2012/SSTIC-actes/influence_des_bonnes_pratiques_sur_les_incidents_b/SSTIC2012-Slides-influence_des_bonnes_pratiques_sur_les_incidents_bgp-contat_valadon_nataf.pdf
104 35 Laurent GUERBY
* test ping plus UDP http://www.broadband-forum.org/technical/download/TR-143.pdf
105 2 Laurent GUERBY
106 1 Laurent GUERBY
h1. Configuration Toulouse
107 1 Laurent GUERBY
108 1 Laurent GUERBY
<pre>
109 1 Laurent GUERBY
router id 91.224.148.2;
110 1 Laurent GUERBY
define myas = 197422;
111 1 Laurent GUERBY
112 1 Laurent GUERBY
113 1 Laurent GUERBY
protocol device {
114 1 Laurent GUERBY
	scan time 10;
115 1 Laurent GUERBY
        primary "eth0" 91.224.148.3;
116 1 Laurent GUERBY
}
117 1 Laurent GUERBY
118 1 Laurent GUERBY
protocol static static_bgp {
119 1 Laurent GUERBY
	import all;
120 1 Laurent GUERBY
	route 91.224.148.0/23 reject;
121 1 Laurent GUERBY
}
122 1 Laurent GUERBY
123 1 Laurent GUERBY
124 1 Laurent GUERBY
protocol kernel{
125 1 Laurent GUERBY
	import all;
126 1 Laurent GUERBY
	export all;
127 1 Laurent GUERBY
}
128 1 Laurent GUERBY
129 1 Laurent GUERBY
130 1 Laurent GUERBY
function avoid_martians()
131 1 Laurent GUERBY
prefix set martians;
132 1 Laurent GUERBY
{
133 1 Laurent GUERBY
  martians = [ 169.254.0.0/16+, 172.16.0.0/12+, 192.168.0.0/16+, 10.0.0.0/8+, 224.0.0.0/4+, 240.0.0.0/4+ ];
134 1 Laurent GUERBY
135 1 Laurent GUERBY
  # Avoid 0.0.0.0/X
136 1 Laurent GUERBY
  if net.ip = 0.0.0.0 then return false;
137 1 Laurent GUERBY
138 1 Laurent GUERBY
  # Avoid too short and too long prefixes
139 1 Laurent GUERBY
  if (net.len < 8) || (net.len > 24) then return false;
140 1 Laurent GUERBY
141 1 Laurent GUERBY
  # Avoid RFC1918 networks
142 1 Laurent GUERBY
  if net ~ martians then return false;
143 1 Laurent GUERBY
  return true;
144 1 Laurent GUERBY
}
145 1 Laurent GUERBY
146 1 Laurent GUERBY
filter bgp_OUT {
147 1 Laurent GUERBY
	if (net ~ [91.224.148.0/23]) then accept;
148 1 Laurent GUERBY
	else reject;
149 1 Laurent GUERBY
}
150 1 Laurent GUERBY
151 1 Laurent GUERBY
152 1 Laurent GUERBY
protocol bgp TOUIX {
153 1 Laurent GUERBY
        local as myas;
154 1 Laurent GUERBY
        neighbor 91.213.236.1 as 47184;
155 1 Laurent GUERBY
        preference 200;
156 1 Laurent GUERBY
        import where avoid_martians();
157 1 Laurent GUERBY
        export filter bgp_OUT;
158 1 Laurent GUERBY
}
159 1 Laurent GUERBY
160 1 Laurent GUERBY
protocol bgp JAGUAR {
161 1 Laurent GUERBY
	 local as myas;
162 1 Laurent GUERBY
	 neighbor 31.172.233.1 as 30781;
163 1 Laurent GUERBY
	 preference 50;
164 1 Laurent GUERBY
         import where avoid_martians();
165 1 Laurent GUERBY
         export filter bgp_OUT;
166 1 Laurent GUERBY
}
167 1 Laurent GUERBY
168 1 Laurent GUERBY
protocol bgp TETANEUTRAL {
169 1 Laurent GUERBY
	local as myas;
170 1 Laurent GUERBY
	neighbor 91.224.148.2 as myas;
171 1 Laurent GUERBY
	preference 100;
172 1 Laurent GUERBY
	import where avoid_martians();
173 1 Laurent GUERBY
	export all;
174 1 Laurent GUERBY
}
175 1 Laurent GUERBY
</pre>
176 20 Laurent GUERBY
177 33 Laurent GUERBY
h1. IRR
178 33 Laurent GUERBY
179 33 Laurent GUERBY
* From nanog:
180 33 Laurent GUERBY
http://www.clarksys.com/blog/2009/09/02/using-irr-with-level3/
181 33 Laurent GUERBY
whois -h filtergen.level3.net "RIPE::YOUR-AS-SET  -searchpath=RIPE;ARIN;RADB -recurseok -warnonly"
182 33 Laurent GUERBY
183 20 Laurent GUERBY
h1. Blackholing
184 20 Laurent GUERBY
185 24 Laurent GUERBY
h2. Attaques
186 24 Laurent GUERBY
187 24 Laurent GUERBY
* 20120629 http://lists.tetaneutral.net/pipermail/technique/2012-July/000406.html
188 36 Laurent GUERBY
* http://blog.cloudflare.com/65gbps-ddos-no-problem
189 24 Laurent GUERBY
190 34 Laurent GUERBY
h2. URPF
191 34 Laurent GUERBY
192 34 Laurent GUERBY
blacklister une/plusieures sources est relativement complexe à mettre en place sur une petite infrastructure car nécessite la mise en place de l'URPF (Unicast Reverse Path Forwarding).
193 34 Laurent GUERBY
194 34 Laurent GUERBY
http://www.cisco.com/web/about/security/intelligence/ipv6_rtbh.html
195 34 Laurent GUERBY
196 20 Laurent GUERBY
h2. RFC3882 
197 1 Laurent GUERBY
198 22 Laurent GUERBY
* http://www.ietf.org/rfc/rfc3882.txt
199 1 Laurent GUERBY
community AS:666 sur annonce /32 pour balckhole par AS upstream
200 1 Laurent GUERBY
201 22 Laurent GUERBY
* doc CISCO
202 22 Laurent GUERBY
http://www.cisco.com/web/about/security/intelligence/blackhole.pdf
203 22 Laurent GUERBY
204 28 Laurent GUERBY
h2. RFC1997
205 28 Laurent GUERBY
206 28 Laurent GUERBY
* http://www.ietf.org/rfc/rfc1997.txt
207 28 Laurent GUERBY
BGP Communities Attribute
208 28 Laurent GUERBY
209 28 Laurent GUERBY
* doc CISCO
210 28 Laurent GUERBY
http://www.cisco.com/web/about/ac123/ac147/archived_issues/ipj_6-2/bgp_communities.html
211 28 Laurent GUERBY
212 22 Laurent GUERBY
h2. BIRD
213 22 Laurent GUERBY
214 22 Laurent GUERBY
* http://www.mail-archive.com/bird-users@atrey.karlin.mff.cuni.cz/msg01998.html
215 22 Laurent GUERBY
216 24 Laurent GUERBY
h2. Absolight
217 24 Laurent GUERBY
218 24 Laurent GUERBY
* communauté 29608:65001 sur /24..32 IPv4 et /41..128 IPv6 => blackhole
219 24 Laurent GUERBY
* test 20120703 IPv4 et IPv6, ça marche et convergence très rapide
220 24 Laurent GUERBY
221 22 Laurent GUERBY
h2. GIXE
222 22 Laurent GUERBY
223 1 Laurent GUERBY
* communauté 31576:666 sur /32 => blackhole
224 24 Laurent GUERBY
* test 20120703 => marche pas encore, signalé et dev a faire coté GIXE pour autoriser les /32
225 1 Laurent GUERBY
226 1 Laurent GUERBY
h2. Jaguar 
227 22 Laurent GUERBY
228 24 Laurent GUERBY
* https://extranet.jaguar-network.com/app/public/index.php?cmd=bgp-policy
229 22 Laurent GUERBY
* demande 20120702 : pas de communauté blackhole actuellement, en reflexion
230 22 Laurent GUERBY
* déploiement de matériel arbor networks, reglage a affiner (pas de detection d'attaque)
231 22 Laurent GUERBY
232 27 Laurent GUERBY
h2. Gitoyen
233 27 Laurent GUERBY
234 1 Laurent GUERBY
* demande 20120704 sur la liste, réponse 20120717
235 28 Laurent GUERBY
* Tata http://noc.easycolocate.nl/Teleglobe_bgp_comm.pdf
236 27 Laurent GUERBY
*** => black-hole route (host route or shorter prefix within customer’s RIR registred assignment) 64999:0
237 28 Laurent GUERBY
* Ielo  whois AS29075 => 29075:0 Null-route/Blackhole
238 32 Laurent GUERBY
* https://pad.ilico.org/p/cleanup-bgp-gitoyen
239 22 Laurent GUERBY
240 22 Laurent GUERBY
h2. France-IX
241 22 Laurent GUERBY
242 25 Laurent GUERBY
* community plan : https://apps.db.ripe.net/whois/lookup/ripe/aut-num/AS51706.html
243 26 Laurent GUERBY
* TODO tester
244 22 Laurent GUERBY
245 22 Laurent GUERBY
h2. Equinix-IX
246 1 Laurent GUERBY
247 26 Laurent GUERBY
* community plan : https://ix.equinix.com/ixp/mlpeCommunityInfo
248 26 Laurent GUERBY
* TODO tester
249 22 Laurent GUERBY
250 1 Laurent GUERBY
h2. TouIX
251 22 Laurent GUERBY
252 26 Laurent GUERBY
* demande acces switch et route server 20120702
253 22 Laurent GUERBY
* TODO
254 1 Laurent GUERBY
255 1 Laurent GUERBY
h2. Hurricane Electric
256 1 Laurent GUERBY
257 26 Laurent GUERBY
* http://www.he.net/adm/
258 1 Laurent GUERBY
* http://www.he.net/adm/blackhole.html
259 1 Laurent GUERBY
* TODO tester
260 28 Laurent GUERBY
261 28 Laurent GUERBY
h2. Sfinx
262 28 Laurent GUERBY
263 28 Laurent GUERBY
* http://www.renater.fr/route-servers-bgp?lang=fr
264 28 Laurent GUERBY
* whois  AS1304 =>
265 28 Laurent GUERBY
remarks:        1304:65281 = Apply NO-EXPORT community
266 28 Laurent GUERBY
remarks:        1304:65282 = Apply NO-ADVERTISE community