Securing the global routing system and the approach of operators

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Securing the global routing system
and the approach of operators
Sheryl Hermoso
Network Operations, APNIC
1

Incidents

Motivations!

Current practice
Receive request LOA check
Create associate
prefix / AS filter

Tools and techniques
LOA check
Manual Automated
RPKI

LoA check
• The system is sometimes overly
complicated, and lacks sufficient
examples
• End users cannot figure it out, wh...

LoA check and RPSL
A publicly accessible description of
every import and export policy to
every transit, peer, and custome...

RPKI implementation
Origin validation
Hosted CA Delegated CA
*upgrade at least ASBRs to RPKI capable code

Technology and learning curve
RPSL
June 1999
RPSLng
March 2005
RPKI
January 2013

But how are operators adopting and
implementing it?

Total prefixes: 856654
/21 February 2017
Prefixes distribution

Violations: 107520 (22.64%)
Consistent: 367354 (77.36%)
Prefixes with IRR data

IRR data violations example

Prefixes with RPKI

RPKI data violation example
• Most of the cases involve an invalid prefix (fixed length
mismatch)
– Create ROA for a /22 b...

RPKI data violation example

RPKI data violation example
17
49.144.64.0/22 AS9299
103.36.16.0/24 AS133623

RPKI data violation example
18

How about South-east Asia?

ROAs in South-east Asia
20
https://lirportal.ripe.net/certification/content/static/statistics/world-roas.html

ROAs in South-east Asia
Country IPv4 prefixes covered IPv4 prefixes valid
Philippines 44.62% 29.02%
Malaysia 20.62% 20.07%...

Philippines
22
Total ASNs delegated by RIR: 372; Visible IPv4 routes: 484; Visible IPv6 routes: 87
28%
15%
57%
Valid Inval...

Singapore
23
Total ASNs delegated by RIR: 440; Visible IPv4 routes: 5,489; Visible IPv6 routes: 747
14%
1%
85%
Valid Inval...

Malaysia
24
Total ASNs delegated by RIR: 220; Visible IPv4 routes: 2,513; Visible IPv6 routes: 179
17%
1%
82%
Valid Invali...

Laos
25
Total ASNs delegated by RIR: 21; Visible IPv4 routes: 225; Visible IPv6 routes: 49
21%
46%
33%
Valid Invalid NotFo...

Indonesia
26
Total ASNs delegated by RIR: 194; Visible IPv4 routes: 7,329; Visible IPv6 routes: 271
5%
95%
Valid Invalid N...

Myanmar
27
Total ASNs delegated by RIR: 45; Visible IPv4 routes: 145; Visible IPv6 routes: 3
44%
2%
54%
Valid Invalid NotF...

Thailand
28
Total ASNs delegated by RIR: 439; Visible IPv4 routes: 6,409; Visible IPv6 routes: 732
5%0%
95%
Valid Invalid ...

Cambodia
29
Total ASNs delegated by RIR: 67; Visible IPv4 routes: 1,037; Visible IPv6 routes: 62
9%
5%
86%
Valid Invalid N...

Summary
• RPKI adoption is growing
– In most cases, operators create ROAs for min length and advertise
the longest prefix
...

Data collection
• OpenBMP
– https://github.com/OpenBMP/openbmp
• RPKI Dashboard
– https://github.com/remydb/RPKI-Dashboard...

3333

Share Slideshare

LinkedIn
Facebook
Twitter

Embed

Size (px)

Show related Slideshows at end

WordPress Shortcode

Link

Share
Email

Perfil de egreso del estudiante I.... by trinidad mogollon... 397 views
Higiene oral by Monalisa Ferreira 573 views
Lavandaria by Monalisa Ferreira 1184 views
Cabelas compensation plan by kcboggs 167 views
Aspectos essenciais da higiene em g... by Monalisa Ferreira 517 views
Barba by Monalisa Ferreira 293 views

View on Slideshare

1 of 33 Ad

View on Slideshare

1 of 33 Ad