btNOG 6: Securing Internet Routing

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

1 v1.01
Securing Internet
Routing
Tashi Phuntsho (tashi@apnic.net)
Senior Network Janitor/Technical Trainer

2 v1.02
Why should we bother?
• As a Manager
q I don’t want to be front page news of a IT paper, or an actual
newspaper fo...

3 v1.03
Headlines
https://blog.thousandeyes.com/internet-vulnerability-takes-down-google/

4 v1.04
Headlines
https://blog.cloudflare.com/bgp-leaks-and-crypto-currencies

5 v1.05
Headlines
After leak (JP->JP)
After leak (EU->EU)
https://dyn.com/blog/large-bgp-leak-by-google-disrupts-internet-...

6 v1.06
Headlines

7 v1.07
Why do we keep seeing these?
• Because NO ONE is in charge?
q No single authority model for the Internet
q No refe...

8 v1.08
Why do we keep seeing these?
• Routing works by RUMOUR
q Tell what you know to your neighbors, and Learn what your...

9 v1.09
Why do we keep seeing these?
• Routing is VARIABLE
q The view of the network depends on where you are
§ Different ...

10 v1.010
Why do we keep seeing these?
• Routing works in REVERSE
q Outbound advertisement affects inbound traffic
q Inbou...

11 v1.011
Why do we keep seeing these?
• And as always, there is no E-bit
q A bad routing update does not identify itself ...

12 v1.012
Why should we worry?
• Because it’s just so easy to do bad in routing!
By Source (WP:NFCC#4), Fair use,
https://...

13 v1.013
Why should we bother?
• As a Engineer
q I don’t want to be told at 3AM my routing is broken
q Or while on a holi...

14 v1.014
Current practice
Peering/Transit
Request
LOA Check
Filters (in/out)

15 v1.015
Tools & Techniques
LOA Check
Whois
(manual)
Letter of
Authority
IRR (RPSL)

16 v1.016
Tools & Techniques
• Look up whois
q verify holder of
a resource

17 v1.017
Tools & Techniques
• Ask for a Letter of Authority
q Absolve from any liabilities

18 v1.018
Tools & Techniques
• Look up/ask to enter details
in internet routing registries
(IRR)
q describes route origina...

19 v1.019
Tools & Techniques
• IRR
q Helps auto generate network
(prefix/as-path) filters using RPSL
tools
§ Filter out ro...

20 v1.020
Tools & Techniques
• Problem(s) with IRR
q No single authority model
§ How do I know if a RR entry is genuine an...

21 v1.021
Back to basics – identifying GOOD
• Using digital signatures to convey the “authority to use”?
q A private key t...

22 v1.022
How about trust in this framework?
• Follows the resource allocation/delegation hierarchy
IANA à RIRs à NIRs/LIR...

23 v1.023
RPKI Chain of Trust
IANA
RIPE-NCCLACNICARIN APNICAFRINIC
NIR
ISP ISP ISP ISP
Allocation
Hierarchy
Trust Anchor
C...

24 v1.024
Resource Certificates
• When an address holder A (*IRs) allocates resources (IP
address/ASN) to B (end holders)
...

25 v1.025
Route Origin Authorization (ROA)
• B can now sign authorities using its private key, which can
be validated by a...

26 v1.026
Route Origin Validation (ROV)
RPKI-to-Router
(RtR)
rsync/RRDP
RPKI Validator/
RPKI Cache server
2406:6400::/32-4...

27 v1.027
Are ROAs enough?
• What if I forge the origin AS in the AS path?
q Would be accepted as “good” – pass origin val...

28 v1.028
AS path validation - BGPsec
AS1 AS2
AS3
AS4
AS1 -> AS2
(Signed AS1)
AS1 -> AS2
(Signed AS1)
AS2->AS3
(signed AS2...

29 v1.029
AS path validation issues…
• More resources
q CPU - high crypto overhead to validate signatures, and
q Memory
§ ...

30 v1.030
What can we do?
• Basic BGP OpSec hygiene – RFC7454/RFC8212
q RFC 8212 – BGP default reject or something similar...

31 v1.031
ROV – Industry trends
dropping Invalids!

32 v1.032
Acknowledgement
5280
• Geoff Huston, APNIC
• Randy Bush, IIJ Labs/Arrcus

33 v1.033
Any questions?

Share Slideshare

LinkedIn
Facebook
Twitter

Embed

Size (px)

Show related Slideshows at end

WordPress Shortcode

Link

Share
Email

2024 Trend Updates: What Really Wor... by Search Engine Jou... 1063677 views
Storytelling For The Web: Integrate... by Chiara Aliotta 982505 views
Artificial Intelligence, Data and C... by OECD Directorate ... 924689 views
How to Leverage AI to Boost Employe... by SocialHRCamp 392956 views
2024 State of Marketing Report – by... by Marius Sescu 222263 views
Everything You Need To Know About C... by Expeed Software 237949 views

View on Slideshare

1 of 33 Ad

View on Slideshare

1 of 33 Ad