HKNOG 9.0: (the trouble with) Securing Internet Routing

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

1
(the trouble with)
Securing the Internet Routing
Tashi Phuntsho (tashi@apnic.net)
Senior Network Analyst/Technical Train...

22
Headlines
https://bgpstream.com/event/245265
• AS10990 (Tulix) hijacks/leaks 200+
more specifics
• Mostly North America...

33
Headlines
https://blog.qrator.net/en/how-you-deal-route-leaks_69/
https://twitter.com/bgpmon/status/1246842916502302723...

44
Headlines
https://twitter.com/atoonk/status/1143143943531454464/photo/1 https://blog.cloudflare.com/how-verizon-and-a-b...

55
Headlines
https://blog.cloudflare.com/bgp-leaks-and-crypto-currencies

66
Headlines
After (JP->JP)
https://dyn.com/blog/large-bgp-leak-by-google-disrupts-internet-in-japan/
Before (JP->JP)

77
Headlines

88
Why do we keep seeing these?
• As always, there is no Evil bit (RFC3514)
– a bad routing update does not identify itsel...

99
Current Practice
Peering/Transit
Request
LOA Check
Filters (in/out)
LOA Check
Whois
(manual)
Letter of
Authority
IRR (R...

1010
Tools & Techniques
• Look up whois
– verify holder of a resource

1111
Tools & Techniques
• Ask for a Letter of Authority
– Absolve from any liabilities

1212
Tools & Techniques
• Look up/ask to enter
details in IRR
– describes route origination
and inter-AS routing policies

1313
Tools & Techniques
• IRR
– Helps generate network (prefix & as-path) filters using RPSL
tools
• Filter out route adve...

14
IRR Issues
• No single authority model
• How do I know an RR entry is
genuine/correct?
• Too many RRs
• If two RRs have...

1515
Enter the RPKI framework
1782165550
2406:6400::/48
65551
2406:6400::/48 65551 65550 17821 i
6555265553
2406:6400::/48...

1616
Implementation
• Sign your route origins (create your ROAs)
Prefix 2406:6400::/32
Max-length /36
Origin ASN AS45192

1717
ROA considerations
• Max length attribute
– Minimal ROA
• ROAs to cover only those prefixes announced in BGP
• https:...

1818
ROA considerations
• Know your network (origin AS)
– Do you have multiple ASes?
• Are they independent ASes? or
• Tra...

1919
Implementation
• Run your own RPKI validator:
– Dragon Research RPKI toolkit - https://github.com/dragonresearch/rpki...

2020
Validator considerations
• Securing the RTR session
– Plain text (TCP)
• run within your routing domain
– Other auth ...

2121
Validator considerations
• When RTR session fails
– Based on the expire interval of ROA cache
• JunOS/SR-OS: 3600s, I...

2222
Validator considerations
• VRP output

2323
Implementation
• Enable RTR on your routers
• eBGP speakers (border/peering/transit)
– Know your platform defaults an...

2424
Implementation
• Acting on the Validation states
– Tag & do nothing~ You have downstream/route server @IXPs
[Valid (A...

2525
Operational Considerations
• Default routes?
– Will match anything ~ Invalids

2626
Other developments
• ROA with AS-0 origin (RFC6483/RFC7607)
– Negative attestation
• No valid ASN has been granted au...

2727
So, what can we all do?
• Basic BGP OpSec hygiene – RFC7454/RFC8212
– RFC8212: BGP default reject or something simila...

2828
HK focus
NOT FOUND
AFRINIC APNIC ARIN RIPE CNNIC IDNIC JPNIC KRNIC TWNIC VNNIC
IPv4 3824 9205 569 435 509 4 3 8 26 1
...

2929
Acknowledgement
• Geoff Huston, APNIC
• Randy Bush, IIJ Labs/Arrcus

30
THANK YOU

Share Slideshare

LinkedIn
Facebook
Twitter

Embed

Size (px)

Show related Slideshows at end

WordPress Shortcode

Link

Share
Email

2024 Trend Updates: What Really Wor... by Search Engine Jou... 1012946 views
Storytelling For The Web: Integrate... by Chiara Aliotta 921259 views
Artificial Intelligence, Data and C... by OECD Directorate ... 824586 views
How to Leverage AI to Boost Employe... by SocialHRCamp 344056 views
2024 State of Marketing Report – by... by Marius Sescu 196216 views
Everything You Need To Know About C... by Expeed Software 219258 views

View on Slideshare

1 of 30 Ad

View on Slideshare

1 of 30 Ad