APNIC, profile picture
Uploaded byAPNIC
PPTX, PDF1,766 views

Internet Routing Registry and RPKI Tutorial, by Nurul Islam Roman [APNIC 38]

The document provides an introduction to Internet routing registries (IRRs) and the APNIC Routing Registry. It explains key concepts such as autonomous systems (AS), routing policies, and the Routing Policy Specification Language (RPSL) used to define routing objects and policies in IRRs. The document also outlines the benefits of using the APNIC Routing Registry to define routing policies and filtering requirements between networks and autonomous systems.

Embed presentation

Downloaded 52 times
Internet Routing Registry & RPKI Tutorial Nurul Islam Roman, APNIC
Objectives • To provide an introduction to the APNIC Routing Registry – Explain concepts of the global RR – Outline the benefits of the APNIC Routing Registry – Discuss Routing Policy Specification Language (RPSL) • New Initiative RPKI
Overview • What is IRR? • Whois DB Recap • APNIC database and the IRR • Using the Routing Registry • Using RPSL in practice • Benefit of using IRR
What is IRR?
Prefix Advertise to Internet • Ingress prefix from downstream: – Option 1: Customer single home and non portable prefix • Customer is not APNIC member prefix received from upstream ISP – Option 2: Customer single home and portable prefix • Customer is APNIC member receive allocation as service provider but no AS number yet – Option 3: Customer multihome and non portable prefix • Customer is not APNIC member both prefix and ASN received from upstream ISP – Option 4: Customer multihome and portable prefix • Customer is APNIC member both prefix and ASN received from APNIC
Prefix Filtering BCP [Single home] • Option 1: Customer single home and non portable prefix Internet AS17821 Static 3fff:ffff:dcdc::/48 to customer WAN Interface No LoA Check of Cust prefix upstream downstream ISP Prefix 3fff:ffff::/32 Customer Prefix 3fff:ffff:dcdc::/48 NO BGP Static Default to ISP WAN Interface
Prefix Filtering BCP [Single home] • Option 2: : Customer single home and portable prefix Internet AS17821 Static 2001:0DB8::/32 to customer WAN Interface BGP network 2001:0DB8::/32 AS17821 i Check LoA of Cust prefix upstream downstream ISP Prefix 3fff:ffff::/32 Customer Prefix 2001:0DB8::/32 NO BGP Static Default to ISP WAN Interface Static 2001:0DB8::/32 null0
Prefix Filtering [Multihome] • Option 3: Customer multihome and non portable prefix Internet ISP Prefix 3fff:ffff::/32 AS17821 eBGP peering with customer WAN interface No LoA Check of Cust prefix upstream can not change Customer Prefix 3fff:ffff:dcdc::/48 AS131107 Check LoA of Cust prefix Manual process e-mail to tech-c Automated process route object or RPKI Nearly same filter requirement as other ISP AS64500 eBGP peering with both ISP WAN Interface upstream can change BGP network 3fff:ffff:dcdc::/48 AS64500 i or aggregate address from gateway router
Prefix Filtering [Multihome] • Option 4: Customer multihome and portable prefix Internet ISP Prefix 3fff:ffff::/32 AS17821 Check LoA of Cust prefix Manual process e-mail to tech-c Automated process route object or RPKI upstream can change Customer Prefix 2001:0DB8::/32 AS131107 Check LoA of Cust prefix Manual process e-mail to tech-c Automated process route object or RPKI Nearly same filter requirement as other ISP AS64500 eBGP peering with both ISP WAN Interface upstream can change BGP network 2001:0DB8::/32 AS64500 i or aggregate address from gateway router
What is a Routing Registry? • A repository (database) of Internet routing policy information • Autonomous Systems exchanges routing information via BGP • Exterior routing decisions are based on policy based rules • However BGP does not provides a mechanism to publish/communicate the policies themselves • RR provides this functionality • Routing policy information is expressed in a series of objects • Stability and consistency of routing • Network operators share information
What is a Routing Registry? RIPE RADB CW APNIC Connect ARIN, ArcStar, FGC, Verio, Bconnex, Optus, Telstra, ... IRR = APNIC RR + RIPE DB + RADB + C&W + ARIN + …
What is Routing Policy? • Description of the routing relationship between autonomous systems – Who are my BGP peers? • Customer, peers, upstream – What routes are: • Originated by each neighbour? • Imported from each neighbour? • Exported to each neighbour? • Preferred when multiple routes exist? – What to do if no route exists? – What routes to aggregate?
Representation of Routing Policy AS1 AS2 NET1 NET2 In order for traffic to flow from NET2 to NET1 between AS1 and AS2: AS1 has to announce NET1 to AS2 via BGP And AS2 has to accept this information and use it Resulting in packet flow from NET2 to NET1
Representation of Routing Policy AS1 AS2 NET1 NET2 In order for traffic to flow towards from NET1 to NET2: AS2 must announce NET2 to AS1 And AS1 has to accept this information and use it Resulting in packet flow from NET 1 to NET2
RPSL • Routing Policy Specification Language – Object oriented language • Based on RIPE-181 – Structured whois objects • Higher level of abstraction than access lists • Describes things interesting to routing policy: – Routes, AS Numbers … – Relationships between BGP peers – Management responsibility RFC 2622 RFC 2725 RFC 2650
Routing Policy - Examples Basic concept AS 1 AS 2 aut-num: AS1 … import: from AS2 action pref= 100; accept AS2 export: to AS2 announce AS1 “action pref” - the lower the value, the preferred the route aut-num: AS2 … import: from AS1 action pref=100; accept AS1 export: to AS1 announce AS2
Routing Policy - Examples AS 123 AS4 AASS55 More complex example • AS4 gives transit to AS5, AS10 • AS4 gives local routes to AS123 AS10
Routing Policy - Examples AS 123 AS4 AASS55 aut-num: AS4 import: from AS123 action pref=100; accept AS123 import: from AS5 action pref=100; accept AS5 import: from AS10 action pref=100; accept AS10 export: to AS123 announce AS4 export: to AS5 announce AS4 AS10 export: to AS10 announce AS4 AS5 Not a path AS10
Routing Policy - Examples transit traffic over link2 AS123 AS4 More complex example AS6 private link1 link3 • AS4 and AS6 private link1 • AS4 and AS123 main transit link2 • backup all traffic over link1 and link3 in event of link2 failure
Routing Policy - Examples AS123 AS4 AS6 private link1 link3 AS representation transit traffic over link2 aut-num: AS4 import: from AS123 action pref=100; accept ANY import: from AS6 action pref=50; accept AS6 import: from AS6 action pref=200; accept ANY export: to AS6 announce AS4 export: to AS123 announce AS4 full routing received higher cost for backup route
Whois Database Recap
APNIC Database • Public network management database – APNIC whois database contains: • Internet resource information and contact details – APNIC Routing Registry (RR) contains: • routing information • APNIC RR is part of IRR – Distributed databases that mirror each other
Database Object • An object is a set of attributes and values • Each attribute of an object... • Has a value • Has a specific syntax • Is mandatory or optional • Is single- or multi-valued • Some attributes ... • Are primary (unique) keys • Are lookup keys for queries • Are inverse keys for queries – Object “templates” illustrate this structure
Person Object Example – Person objects contain contact information Attributes Values person: address: address: address: country: phone: fax-no: e-mail: nic-hdl: mnt-by: changed: source: Test Person ExampleNet Service Provider 2 Pandora St Boxville Wallis and Futuna Islands TC +680-368-0844 +680-367-1797 tperson@example.com TP17-AP MAINT-ENET-TC tperson@example.com 20090731 APNIC
Database Queries – Flags used for inetnum queries None find exact match - l find one level less specific matches - L find all less specific matches - m find first level more specific matches - M find all More specific matches - x find exact match (if no match, nothing) - d enables use of flags for reverse domains - r turn off recursive lookups
Database Protection • Authorisation – “mnt-by” references a mntner object • Can be found in all database objects • “mnt-by” should be used with every object! • Authentication – Updates to an object must pass authentication rule specified by its maintainer object
Prerequisite for Updating Objects • Create person objects for contacts • To provide contact info in other objects • Create a mntner object • To provide protection of objects • Protect your person object
APNIC Database and the IRR
APNIC Database & the IRR • APNIC whois Database – Two databases in one • Public Network Management Database – “whois” info about networks & contact persons • IP addresses, AS numbers etc • Routing Registry – contains routing information • routing policy, routes, filters, peers etc. – APNIC RR is part of the global IRR
Integration of Whois and IRR • Integrated APNIC Whois Database & Internet Routing Registry APNIC Whois IRR IP, ASNs, reverse domains, contacts, maintainers etc routes, routing policy, filters, peers etc inetnum, aut-num, domain, person, role, maintainer route, aut-num, as-set, inet-rtr, peering-set etc. Internet resources & routing information
Inter-related IRR Objects inetnum: 202.0.16.0 - 202.0.16.255 … tech-c: KX17-AP mnt-by: MAINT-EX aut-num: AS1 … tech-c: KX17-AP mnt-by: MAINT-EX … route: origin: … mnt-by: MAINT-EX person: … nic-hdl: KX17-AP … mntner: MAINT-EX … 202.0.16/24 AS1
Inter-related IRR Objects inetnum: 202.0.16.0-202.0.31.255 … aut-num: AS2 … aut-num: AS10 … route: 202.0.16/20 … origin: AS2 … as-set: AS1:AS-customers members: AS10, AS11 route-set: AS2:RS-routes members: 218.2/20, 202.0.16/20 route: 218.2/20 … origin: AS2 … inetnum: 218.2.0.0 - 218.2.15.255 … aut-num: AS2 … aut-num: AS11 … , AS2
Hierarchical Authorisation • mnt-routes – authenticates creation of route objects • creation of route objects must pass authentication of mntner referenced in the mnt-routes attribute – Format: • mnt-routes: <mntner> In: inetnum aut-num route
Authorisation Mechanism inetnum: 202.137.181.0 – 202.137.196.255 netname: SPARKYNET-TC descr: SparkyNet Service Provider … mnt-by: APNIC-HM mnt-lower: MAINT-SPARKYNET1-TC mnt-routes: MAINT-SPARKYNET2-TC This object can only be modified by APNIC Creation of more specific objects within this range has to pass the authentication of MAINT-SPARKYNET1-TC Creation of route objects matching/within this range has to pass the authentication of MAINT-SPARKYNET2-TC
Creating Route Objects • Multiple authentication checks: – Originating ASN • mntner in the mnt-routes is checked • If no mnt-routes, mnt-lower is checked • If no mnt-lower, mnt-by is checked – AND the address space • Exact match & less specific route – mnt-routes etc – AND the route object mntner itself • The mntner in the mnt-by attribute aut-num inetnum route route
Creating Route Objects IP address range 4 inetnum: 202.137.240.0 – 202.137.255.255 mnt-routes: MAINT-WF-EXNET 1 route aut-num: AS1 mnt-routes: MAINT-WF-EXNET maintainer 5 3 mntner: MAINT-WF-EXNET auth: CRYPT-PW klsdfji9234 AS number route: 202.137.240/20 origin: AS1 1. Create route object and submit to APNIC RR database 2. DB checks aut-num obj corresponding to the ASN in route obj 2 3. Route obj creation must pass auth of mntner specified in aut-num mnt-routes attribute. 4. DB checks inetnum obj matching/encompassing IP range in route obj 5. Route obj creation must pass auth of mntner specified in inetnum mnt-routes attribute.
Using RPSL in practice
Overview • Review examples of routing policies expression – Peering policies – Filtering policies – Backup connection – Multihoming policies
RPSL - review • Purpose of RPSL – Allows specification of your routing configuration in the public IRR • Allows you to check “Consistency” of policies and announcements – Gives opportunities to consider the policies and configuration of others
Address Prefix Range Operator Operator Meanings ^- Exclusive more specifics of the address prefix: E.g. 128.9.0.0/16^- contains all more specifics of 128.9.0.0/16 excluding 128.9.0.0/16 ^+ Inclusive more specific of the address prefix: E.g. 5.0.0.0/8^+ contains all more specifics of 5.0.0.0/8 including 5.0.0.0/8
Address Prefix Operator (cont.) Operator Meanings ^n n = integer, stands for all the length “n” specifics of the address prefix: E.g. 30.0.0.0/8^16 contains all the more specifics of 30.0.0.0/8 which are length of 16 such as 30.9.0.0/16 ^n-m m = integer, stands for all the length “n” to length “m” specifics of the address prefix: E.g. 30.0.0.0/8^24-32 contains all the more specifics of 30.0.0.0/8 which are length of 24 to 32 such as 30.9.9.96/28
AS-path regular expressions • Regular expressions – A context-independent syntax that can represent a wide variety of character sets and character set orderings – These character sets are interpreted according to the current The Open Group Base Specifications (IEEE) • Can be used as a policy filter by enclosing the expression in “<“ and “>”.
Filter List- Regular Expression • Like Unix regular expressions . Match one character * Match any number of preceding expression + Match at least one of preceding expression ^ Beginning of line $ End of line Escape a regular expression character _ Beginning, end, white-space, brace | Or () Brackets to contain expression [ ] Brackets to contain number ranges Source: www.cisco.com
AS-path Regular Expression Operator Meanings <AS3> Route whose AS-path contains AS3 <^AS1> Routes whose AS-path starts with AS1 <AS2$> Routes whose AS-path end with AS2 <^AS1 AS2 AS3$> Routes whose AS-path is exactly “1 2 3” <^AS1 . * AS2$> AS-path starts with AS1 and ends in AS2 with any number ASN in between <^AS3+$> AS-path starts with AS3 and ends in AS3 and AS3 is the first member of the path and AS3 occurs one or more times in the path and no other AS can be present in the path after AS3
AS-path Regular Expression (cont.) Operator Meanings <AS3|AS4> Routes whose AS-path is with AS3 or AS4 <AS3 AS4> Routes whose AS-path with AS3 followed by AS4
Common Peering Policies Internet AS 1 AS 2 AS 3 • Peering policies of an AS – Registered in an aut-num object ISP (Transit provider) Customer AS 4 AS 5
Common Peering Policies • Policy for AS3 in the AS2 aut-num object aut-num: AS2 as-name: SAMPLE-NET dsescr: Sample AS import: from AS1 accept ANY import: from AS3 accept <^AS3+$> export: to AS3 announce AS2 export: to AS1 announce AS2 AS3 admin-c: TP1-AP tech-c: TP2-AP mtn-by: MAINT-SAMPLE-AP changed: sample@sample.net
Transit Provider Policies Internet AS 1 AS 2 AS 3 • Peering policies of an AS – Registered in an aut-num object ISP (Transit provider) Customer AS 4 AS 5
ISP Customer – Transit Provider Policies • Policy for AS3 and AS4 in the AS2 aut-num object aut-num: AS2 import: from AS1 accept ANY import: from AS3 accept <^AS3+$> import: from AS4 accept <^AS4+$> export: to AS3 announce ANY export: to AS4 announce ANY export: to AS1 announce AS2 AS3 AS4
AS-set Object • Describe the customers of AS2 as-set: AS2:AS-CUSTOMERS members: AS3 AS4 changed: sample@sample.net source: APNIC
Aut-num Object referring as-set Object aut-num: AS2 import: from AS1 accept ANY import: from AS2:AS-CUSTOMERS accept <^AS2:AS-CUSTOMERS+$> export: to AS2:AS-CUSTOMERS announce ANY export: to AS1 announce AS2 AS2:AS-CUSTOMERS aut-num: AS1 import: from AS2 accept <^AS2+AS2:AS-CUSTOMERS+$> export: ………
Express Filtering Policy • To limit the routes one accepts from a peer – To prevent the improper use of unassigned address space – To prevent malicious use of another organisation’s address space
Filtering Policy 7.7.0.0/20 allocated by RIR AS 2 AS 3 Internet AS3 wants to announce part or all of 7.7.0.0/20 on the global Internet. AS2 wants to be certain that it only accepts announcements from AS3 for address space that has been properly allocated to AS3.
Aut-num Object with Filtering Policy aut-num: AS2 import: from AS3 accept { 7.7.0.0/20^20-24 } ……. For an ISP with a growing or changing customer base, this mechanism will not scale well. Route-set object can be used.
IRRToolSet • Set of tools developed for using the Internet Routing Registry (IRR) • Work with Internet routing policies – These policies are stored in IRR in the Routing Policy Specification Language (RPSL) • The goal of the IRRToolSet is to make routing information more convenient and useful for network engineers – Tools for automated router configuration, – Routing policy analysis – On-going maintenance etc.
IRRToolSet • Download: ftp://ftp.isc.org/isc/IRRToolSet/ • Installation needs: lex, yacc and C++ compiler root@bofh:~ #wget ftp://ftp.isc.org/isc/IRRToolSet/IRRToolSet- 5.0.1/irrtoolset-5.0.1.tar.gz root@bofh:~ # tar –zxvf irrtoolset-5.0.1.tar.gz root@bofh:~ # cd irrtoolset-5.0.1 root@bofh:~irrtoolset-5.0.1# ./configure root@bofh:~irrtoolset-5.0.1# make root@bofh:~irrtoolset-5.0.1# make install
IRRToolSet root@bofh:~ whois –h whois.apnic.net AS17821 #####snipped###### mp-import: afi any.unicast { from AS-ANY accept ANY AND NOT RS-MARTIANS; } refine { from AS-ANY action pref = 50; accept community.contains(17821:50); from AS-ANY action pref = 30; accept community.contains(17821:70); from AS-ANY action pref = 10; accept community.contains(17821:90); from AS-ANY action pref = 0; accept ANY; } refine afi ipv4.unicast {
IRR Toolset, RPSL: rtconfig(Contd) Cisco Specific @rtconfig set cisco_map_name = <map-name> @rtconfig set cisco_map_first_no = <no> @rtconfig set cisco_map_increment_by = <no> @rtconfig set cisco_prefix_acl_no = <no> @rtconfig set cisco_aspath_acl_no = <no> @rtconfig set cisco_pktfilter_acl_no = <no> @rtconfig set cisco_community_acl_no = <no> @rtconfig set cisco_access_list_no = <no> @rtconfig set cisco_max_preference = <no> @rtconfig networks <ASN-1> @rtconfig inbound_pkt_filter <if-name> <ASN-1> <rtr-1> <ASN- 2> <rtr-2>
IRR Toolset, RPSL: rtconfig(Contd) Junos Specific @rtconfig set junos_policy_name = <policy-name> @rtconfig networks <ASN-1>
IRR Toolset, RPSL: rtconfig Input File(Provision) router bgp 17821 neighbor 103.4.108.54 remote-as 131107 neighbor 103.4.108.54 version 4 ! # X Communication Ltd @RtConfig set cisco_access_list_no = 500 @RtConfig set cisco_map_name = "AS58715-IN" @RtConfig import AS131208 103.4.108.62 AS58715 103.4.108.61 @RtConfig set cisco_access_list_no = 599 @RtConfig set cisco_map_name = "ANY" @RtConfig export AS131208 103.4.108.62 AS58715 103.4.108.61 ! # xyz Ltd @RtConfig set cisco_access_list_no = 501 @RtConfig set cisco_map_name = "AS58656-IN" @RtConfig import AS131208 103.4.108.94 AS58656 103.4.108.93 @RtConfig set cisco_access_list_no = 599 @RtConfig set cisco_map_name = "ANY" @RtConfig export AS131208 103.4.108.94 AS58656 103.4.108.93 ! end
Use of RPSL - RtConfig • RtConfig • part of IRRToolSet • Reads policy from IRR (aut-num, route & -set objects) and generates router configuration – vendor specific: • Cisco, Bay's BCC, Juniper's Junos and Gated/RSd – Creates route-map and AS path filters – Can also create ingress / egress filters
IRR Toolset, RPSL: Uploading Configuration Various ways to upload configuration: – SNMP Write – NETCONF XML Based – Automated Script using expect
Why use IRR and RtConfig? • Benefits of RtConfig – Avoid filter errors (typos) – Expertise encoded in the tools that generate the policy rather than engineer configuring peering session – Filters consistent with documented policy • (need to get policy correct though)
New Initiative RPKI
What is RPKI? • Resource Public Key Infrastructure (RPKI) • A robust security framework for verifying the association between resource holder and their Internet resources • Created to address the issues in RFC 4593 “Generic Threats to Routing Protocols” • Helps to secure Internet routing by validating routes – Proof that prefix announcements are coming from the legitimate holder of the resource 65
Benefits of RPKI - Routing • Similar objective as IRR but in a robust and scalable way • Prevents route hijacking – A prefix originated by an AS without authorization – Reason: malicious intent • Prevents mis-origination – A prefix that is mistakenly originated by an AS which does not own it – Also route leakage – Reason: configuration mistake / fat finger 66
BGP Security (BGPsec) • Extension to BGP that provides improved security for BGP routing • Currently an IETF Internet draft • Implemented via a new optional non-transitive BGP path attribute that contains a digital signature • Two things: – BGP Prefix Origin Validation (using RPKI) – BGP Path Validation • Similar efforts in the early days – IDR working group, S-BGP 67
RPKI Infrastructure • A system to manage the creation and storage of digital certificates and the associated Route Origin Authorization documents • Main Components – Certificate Authority (CA) – Relying Party (RP) – Routers with RPKI support 68
Issuing Party • Internet Registries (RIR, NIR, Large LIRs) • Acts as a Certificate Authority and issues certificates for customers • Provides a web interface to issue ROAs for customer prefixes • Publishes the ROA records 69 APNIC RPKI Engine publication MyAPNIC GUI Repository rpki.apnic.net
Route Origin Authorization (ROA) • A digital object that contains a list of address prefixes and one AS number • It is an authority created by a prefix holder to authorize an AS Number to originate one or more specific route advertisements • Publish an ROA using MyAPNIC 70
X.509 Certificate with 3779 Extension 71 • Resource certificates are based on the X.509 v3 certificate format (RFC 5280) • Extended by RFC 3779 – binds a list of resources (IP, ASN) to the subject of the certificate • SIA – Subject Information Access; contains a URI that references the directory X.509 Certificate RFC 3779 Extension SIA Owner's Public Key
Relying Party (RP) 72
RPKI Components 73
Router Origin Validation • Router must support RPKI • Checks an RP cache / validator • Validation returns 3 states: – Valid = when authorization is found for prefix X – Invalid = when authorization is found for prefix X but not from ASN Y – Unknown = when no authorization data is found • Vendor support: – Cisco IOS – solid in 15.2 – Cisco IOS/XR – shipped in 4.3.2 – Juniper – shipped in 12.2 – Alcatel Lucent – in development 74
How to start? • Create ROA records in MyAPNIC • Build an RP cache • Configure your router to use the cache (or a public one) • Create BGP policies 75
How to build RP Cache • Download and install from rpki.net • Instructions here: https://trac.rpki.net/wiki/doc/RPKI/Installation/UbuntuPacka ges 76
Configure Router to Use Cache router bgp 17821 … bgp rpki server tcp 10.0.0.3 port 43779 refresh 60 Bgp rpki server tcp 147.28.0.84 port 93920 refresh 60 77
How does it look in BGP Table 78 Network Next Hop Metric LocPrf Weight Path * i I198.180.150.0 144.232.9.61 100 0 1239 3927 i *> * *> * *> * I I V198.180.152.0 V N198.180.155.0 N 199.238.113.9 129.250.11.41 199.238.113.9 129.250.11.41 199.238.113.9 129.250.11.41 0 2914 3927 i 0 2914 3927 i 0 2914 4128 i 0 2914 4128 i 0 2914 22773 i 0 2914 22773 i 199.238.113.9 129.250.11.41 *> N198.180.160.0 5752 i * N 5752 i 0 2914 23308 13408 0 2914 23308 13408 RPKI Lab – Randy Bush 24 r0.sea#sh ip bgp
Member Services Helpdesk -One point of contact for all member enquiries -Online chat services Helpdesk hours 9:00 am - 9:00 pm (AU EST, UTC + 10 hrs) ph: +61 7 3858 3188 fax: 61 7 3858 3199 • More personalised service – Range of languages: Bahasa Indonesia, Bengali, Cantonese, English, Hindi, Mandarin, Thai, etc. • Faster response and resolution of queries – IP resource applications, status of requests, obtaining help in completing application forms, membership enquiries, billing issues & database enquiries
80
Thank You 

More Related Content

PPTX
Internet Routing Registry Tutorial, by Nurul Islam Roman [APRICOT 2015]
byAPNIC
 
PDF
IRR Toolset, RPSL
byBangladesh Network Operators Group
 
PPTX
IRR Tutorial and RPKI Demo
byAPNIC
 
PPT
IPv6 introduction
byGuider Lee
 
PPTX
Brkrst 3123 previdi-final
byStefano Previdi
 
PPTX
IPV6 Introduction
byHeba_a
 
PPTX
IPv6 address
byPina Parmar
 
PDF
IPv6 Address Planning
byAPNIC
 
Internet Routing Registry Tutorial, by Nurul Islam Roman [APRICOT 2015]
byAPNIC
 
IRR Toolset, RPSL
byBangladesh Network Operators Group
 
IRR Tutorial and RPKI Demo
byAPNIC
 
IPv6 introduction
byGuider Lee
 
Brkrst 3123 previdi-final
byStefano Previdi
 
IPV6 Introduction
byHeba_a
 
IPv6 address
byPina Parmar
 
IPv6 Address Planning
byAPNIC
 

What's hot

PDF
About IPv6
byMarco Antonio
 
PDF
1 bonica tutorial_segment_routing
byhptoga
 
PPTX
I pv6(internet protocol version 6)
bySubrata Kumer Paul
 
PDF
Ipv6 packet fomat
byDeena Siva
 
PDF
IPv6 .pdf
byniran10
 
PPTX
DCHP,NAT,forwarding of ip packets
byrajshreemuthiah
 
PDF
IPv6 Deployment Planning Tutorial, by Philip Smith [APNIC 38]
byAPNIC
 
PPTX
Internet Protocol version 6
byRekha Yadav
 
PPT
Ipv6up
byasimnawaz54
 
PDF
Unit v
byAPARNA P
 
PPTX
Leveraging IPv6 extension header for traffic engineering, by Eric Vyncke [APN...
byAPNIC
 
PPTX
A very good introduction to IPv6
bySyed Arshad
 
PPTX
IPV6 ADDRESS
byJothi Lakshmi
 
PPTX
I pv6
byVarsha Kumar
 
PPT
INTERNET PROTOCOL VERSION 6
byChaitanya Ram
 
PPTX
Ipv6 presentation
byAlee Hassan
 
PPTX
IPv6 Entreprise Multihoming
byOlivier Bonaventure
 
PPTX
IPv4 vs IPv6
byNetProtocol Xpert
 
PPTX
Introduction to ipv6 v1.3
byKarunakant Rai
 
PPTX
Why we need ipv6...
byAdii Shah
 
About IPv6
byMarco Antonio
 
1 bonica tutorial_segment_routing
byhptoga
 
I pv6(internet protocol version 6)
bySubrata Kumer Paul
 
Ipv6 packet fomat
byDeena Siva
 
IPv6 .pdf
byniran10
 
DCHP,NAT,forwarding of ip packets
byrajshreemuthiah
 
IPv6 Deployment Planning Tutorial, by Philip Smith [APNIC 38]
byAPNIC
 
Internet Protocol version 6
byRekha Yadav
 
Ipv6up
byasimnawaz54
 
Unit v
byAPARNA P
 
Leveraging IPv6 extension header for traffic engineering, by Eric Vyncke [APN...
byAPNIC
 
A very good introduction to IPv6
bySyed Arshad
 
IPV6 ADDRESS
byJothi Lakshmi
 
I pv6
byVarsha Kumar
 
INTERNET PROTOCOL VERSION 6
byChaitanya Ram
 
Ipv6 presentation
byAlee Hassan
 
IPv6 Entreprise Multihoming
byOlivier Bonaventure
 
IPv4 vs IPv6
byNetProtocol Xpert
 
Introduction to ipv6 v1.3
byKarunakant Rai
 
Why we need ipv6...
byAdii Shah
 

Similar to Internet Routing Registry and RPKI Tutorial, by Nurul Islam Roman [APNIC 38]

PDF
Routing Security Workshop
byRIPE NCC
 
PDF
IRR toolset with rpsl
byMuhammad Moinur Rahman
 
PPTX
23rd PITA AGM and Conference: Internet number registry services - the next ge...
byAPNIC
 
PDF
APNIC's role in stability and security - 4th APT Cybersecurity Forum
byAPNIC
 
PDF
SANOG 33: APNIC Routing Registry and ROAs
byAPNIC
 
PPT
16 bgp
byTCT
 
PDF
HKNOG 6.1: Maintaining your APNIC Routing Registry Data
byAPNIC
 
PDF
Routing Registry Function Automation using RPKI & RPSL
byAPNIC
 
PDF
Regional Internet Registry and Whois
byAPNIC
 
PDF
Wrou01
bytanawan44
 
PPTX
Maintaining your APNIC Routing Registry (RR) data
byAPNIC
 
PDF
Routing Security in 2017 – We can do better!
byAPNIC
 
PDF
PCTA e-Tech Show 2021: Securing Internet Routing
byAPNIC
 
PDF
E rou01 routing_basics
bytanawan44
 
PDF
ThaiNOG Day 2019: Internet Number Registry Services, the Next Generation
byAPNIC
 
PPTX
Maintaining your APNIC Routing Registry (RR) data
byAPNIC
 
PDF
MANRS for Network Operators
byBangladesh Network Operators Group
 
PPTX
Week14 lec2
bysyedhaiderraza
 
PDF
01 (IDNOG02) ASN distribution and interconnection in Indonesia by Sanjaya
byIndonesia Network Operators Group
 
PPTX
Implementing Internet and MPLS BGP
byPrivate
 
Routing Security Workshop
byRIPE NCC
 
IRR toolset with rpsl
byMuhammad Moinur Rahman
 
23rd PITA AGM and Conference: Internet number registry services - the next ge...
byAPNIC
 
APNIC's role in stability and security - 4th APT Cybersecurity Forum
byAPNIC
 
SANOG 33: APNIC Routing Registry and ROAs
byAPNIC
 
16 bgp
byTCT
 
HKNOG 6.1: Maintaining your APNIC Routing Registry Data
byAPNIC
 
Routing Registry Function Automation using RPKI & RPSL
byAPNIC
 
Regional Internet Registry and Whois
byAPNIC
 
Wrou01
bytanawan44
 
Maintaining your APNIC Routing Registry (RR) data
byAPNIC
 
Routing Security in 2017 – We can do better!
byAPNIC
 
PCTA e-Tech Show 2021: Securing Internet Routing
byAPNIC
 
E rou01 routing_basics
bytanawan44
 
ThaiNOG Day 2019: Internet Number Registry Services, the Next Generation
byAPNIC
 
Maintaining your APNIC Routing Registry (RR) data
byAPNIC
 
MANRS for Network Operators
byBangladesh Network Operators Group
 
Week14 lec2
bysyedhaiderraza
 
01 (IDNOG02) ASN distribution and interconnection in Indonesia by Sanjaya
byIndonesia Network Operators Group
 
Implementing Internet and MPLS BGP
byPrivate
 

More from APNIC

PPTX
APNIC Report, presented at APAN 60 by Thy Boskovic
byAPNIC
 
PDF
APNIC Update, presented at PHNOG 2025 by Shane Hermoso
byAPNIC
 
PDF
RPKI Status Update, presented by Makito Lay at IDNOG 10
byAPNIC
 
PDF
The Internet -By the Numbers, Sri Lanka Edition
byAPNIC
 
PDF
Triggering QUIC, presented by Geoff Huston at IETF 123
byAPNIC
 
PDF
DNSSEC Made Easy, presented at PHNOG 2025
byAPNIC
 
PDF
BGP Security Best Practices that Matter, presented at PHNOG 2025
byAPNIC
 
PDF
APNIC's Role in the Pacific Islands, presented at Pacific IGF 2205
byAPNIC
 
PDF
IPv6 Deployment and Best Practices, presented by Makito Lay
byAPNIC
 
PDF
Cleaning up your RPKI invalids, presented at PacNOG 35
byAPNIC
 
PDF
The Internet - By the numbers, presented at npNOG 11
byAPNIC
 
PDF
Transmission Control Protocol (TCP) and Starlink
byAPNIC
 
PDF
DDoS in India, presented at INNOG 8 by Dave Phelan
byAPNIC
 
PDF
Global Networking Trends, presented at the India ISP Conclave 2025
byAPNIC
 
PDF
Make DDoS expensive for the threat actors
byAPNIC
 
PDF
Fast Reroute in SR-MPLS, presented at bdNOG 19
byAPNIC
 
PDF
DDos Mitigation Strategie, presented at bdNOG 19
byAPNIC
 
PDF
ICP -2 Review – What It Is, and How to Participate and Provide Your Feedback
byAPNIC
 
PDF
APNIC Update - Global Synergy among the RIRs: Connecting the Regions
byAPNIC
 
PDF
Measuring Starlink Protocol Performance, presented at LACNIC 43
byAPNIC
 
APNIC Report, presented at APAN 60 by Thy Boskovic
byAPNIC
 
APNIC Update, presented at PHNOG 2025 by Shane Hermoso
byAPNIC
 
RPKI Status Update, presented by Makito Lay at IDNOG 10
byAPNIC
 
The Internet -By the Numbers, Sri Lanka Edition
byAPNIC
 
Triggering QUIC, presented by Geoff Huston at IETF 123
byAPNIC
 
DNSSEC Made Easy, presented at PHNOG 2025
byAPNIC
 
BGP Security Best Practices that Matter, presented at PHNOG 2025
byAPNIC
 
APNIC's Role in the Pacific Islands, presented at Pacific IGF 2205
byAPNIC
 
IPv6 Deployment and Best Practices, presented by Makito Lay
byAPNIC
 
Cleaning up your RPKI invalids, presented at PacNOG 35
byAPNIC
 
The Internet - By the numbers, presented at npNOG 11
byAPNIC
 
Transmission Control Protocol (TCP) and Starlink
byAPNIC
 
DDoS in India, presented at INNOG 8 by Dave Phelan
byAPNIC
 
Global Networking Trends, presented at the India ISP Conclave 2025
byAPNIC
 
Make DDoS expensive for the threat actors
byAPNIC
 
Fast Reroute in SR-MPLS, presented at bdNOG 19
byAPNIC
 
DDos Mitigation Strategie, presented at bdNOG 19
byAPNIC
 
ICP -2 Review – What It Is, and How to Participate and Provide Your Feedback
byAPNIC
 
APNIC Update - Global Synergy among the RIRs: Connecting the Regions
byAPNIC
 
Measuring Starlink Protocol Performance, presented at LACNIC 43
byAPNIC
 

Recently uploaded

PDF
Beacon Kit paper date: 11 February 2026 pdf
bySteven McGee
 
PDF
The Girl Who Left a Mark - Deep Impact of Kindness to a person
byAnoop Singh Nagi
 
PPTX
Your Complete Brand Protection Guide with Fieldwatch.ai!
byFieldwatch ai
 
PDF
Top 3 Snapchat Monitoring Apps of 2026 for Activity Tracking
byMichael Carter
 
PPTX
AWS Architecture Design Icons Template.pptx
bybiqtor1
 
PDF
Weaponizing the Neutral Web: Analyzing Adversary Botnets for Offensive Cyber ...
byJoe Slowik
 
PPTX
Living in IT Era Module 5 - (DIGITAL TECHNOLOGY AND SOCIAL CHANGES).pptx
bycjregua03
 
Beacon Kit paper date: 11 February 2026 pdf
bySteven McGee
 
The Girl Who Left a Mark - Deep Impact of Kindness to a person
byAnoop Singh Nagi
 
Your Complete Brand Protection Guide with Fieldwatch.ai!
byFieldwatch ai
 
Top 3 Snapchat Monitoring Apps of 2026 for Activity Tracking
byMichael Carter
 
AWS Architecture Design Icons Template.pptx
bybiqtor1
 
Weaponizing the Neutral Web: Analyzing Adversary Botnets for Offensive Cyber ...
byJoe Slowik
 
Living in IT Era Module 5 - (DIGITAL TECHNOLOGY AND SOCIAL CHANGES).pptx
bycjregua03
 

Internet Routing Registry and RPKI Tutorial, by Nurul Islam Roman [APNIC 38]

  • 1.
    Internet Routing Registry& RPKI Tutorial Nurul Islam Roman, APNIC
  • 2.
    Objectives • Toprovide an introduction to the APNIC Routing Registry – Explain concepts of the global RR – Outline the benefits of the APNIC Routing Registry – Discuss Routing Policy Specification Language (RPSL) • New Initiative RPKI
  • 3.
    Overview • Whatis IRR? • Whois DB Recap • APNIC database and the IRR • Using the Routing Registry • Using RPSL in practice • Benefit of using IRR
  • 4.
  • 5.
    Prefix Advertise toInternet • Ingress prefix from downstream: – Option 1: Customer single home and non portable prefix • Customer is not APNIC member prefix received from upstream ISP – Option 2: Customer single home and portable prefix • Customer is APNIC member receive allocation as service provider but no AS number yet – Option 3: Customer multihome and non portable prefix • Customer is not APNIC member both prefix and ASN received from upstream ISP – Option 4: Customer multihome and portable prefix • Customer is APNIC member both prefix and ASN received from APNIC
  • 6.
    Prefix Filtering BCP[Single home] • Option 1: Customer single home and non portable prefix Internet AS17821 Static 3fff:ffff:dcdc::/48 to customer WAN Interface No LoA Check of Cust prefix upstream downstream ISP Prefix 3fff:ffff::/32 Customer Prefix 3fff:ffff:dcdc::/48 NO BGP Static Default to ISP WAN Interface
  • 7.
    Prefix Filtering BCP[Single home] • Option 2: : Customer single home and portable prefix Internet AS17821 Static 2001:0DB8::/32 to customer WAN Interface BGP network 2001:0DB8::/32 AS17821 i Check LoA of Cust prefix upstream downstream ISP Prefix 3fff:ffff::/32 Customer Prefix 2001:0DB8::/32 NO BGP Static Default to ISP WAN Interface Static 2001:0DB8::/32 null0
  • 8.
    Prefix Filtering [Multihome] • Option 3: Customer multihome and non portable prefix Internet ISP Prefix 3fff:ffff::/32 AS17821 eBGP peering with customer WAN interface No LoA Check of Cust prefix upstream can not change Customer Prefix 3fff:ffff:dcdc::/48 AS131107 Check LoA of Cust prefix Manual process e-mail to tech-c Automated process route object or RPKI Nearly same filter requirement as other ISP AS64500 eBGP peering with both ISP WAN Interface upstream can change BGP network 3fff:ffff:dcdc::/48 AS64500 i or aggregate address from gateway router
  • 9.
    Prefix Filtering [Multihome] • Option 4: Customer multihome and portable prefix Internet ISP Prefix 3fff:ffff::/32 AS17821 Check LoA of Cust prefix Manual process e-mail to tech-c Automated process route object or RPKI upstream can change Customer Prefix 2001:0DB8::/32 AS131107 Check LoA of Cust prefix Manual process e-mail to tech-c Automated process route object or RPKI Nearly same filter requirement as other ISP AS64500 eBGP peering with both ISP WAN Interface upstream can change BGP network 2001:0DB8::/32 AS64500 i or aggregate address from gateway router
  • 10.
    What is aRouting Registry? • A repository (database) of Internet routing policy information • Autonomous Systems exchanges routing information via BGP • Exterior routing decisions are based on policy based rules • However BGP does not provides a mechanism to publish/communicate the policies themselves • RR provides this functionality • Routing policy information is expressed in a series of objects • Stability and consistency of routing • Network operators share information
  • 11.
    What is aRouting Registry? RIPE RADB CW APNIC Connect ARIN, ArcStar, FGC, Verio, Bconnex, Optus, Telstra, ... IRR = APNIC RR + RIPE DB + RADB + C&W + ARIN + …
  • 12.
    What is RoutingPolicy? • Description of the routing relationship between autonomous systems – Who are my BGP peers? • Customer, peers, upstream – What routes are: • Originated by each neighbour? • Imported from each neighbour? • Exported to each neighbour? • Preferred when multiple routes exist? – What to do if no route exists? – What routes to aggregate?
  • 13.
    Representation of Routing Policy AS1 AS2 NET1 NET2 In order for traffic to flow from NET2 to NET1 between AS1 and AS2: AS1 has to announce NET1 to AS2 via BGP And AS2 has to accept this information and use it Resulting in packet flow from NET2 to NET1
  • 14.
    Representation of RoutingPolicy AS1 AS2 NET1 NET2 In order for traffic to flow towards from NET1 to NET2: AS2 must announce NET2 to AS1 And AS1 has to accept this information and use it Resulting in packet flow from NET 1 to NET2
  • 15.
    RPSL • RoutingPolicy Specification Language – Object oriented language • Based on RIPE-181 – Structured whois objects • Higher level of abstraction than access lists • Describes things interesting to routing policy: – Routes, AS Numbers … – Relationships between BGP peers – Management responsibility RFC 2622 RFC 2725 RFC 2650
  • 16.
    Routing Policy -Examples Basic concept AS 1 AS 2 aut-num: AS1 … import: from AS2 action pref= 100; accept AS2 export: to AS2 announce AS1 “action pref” - the lower the value, the preferred the route aut-num: AS2 … import: from AS1 action pref=100; accept AS1 export: to AS1 announce AS2
  • 17.
    Routing Policy -Examples AS 123 AS4 AASS55 More complex example • AS4 gives transit to AS5, AS10 • AS4 gives local routes to AS123 AS10
  • 18.
    Routing Policy -Examples AS 123 AS4 AASS55 aut-num: AS4 import: from AS123 action pref=100; accept AS123 import: from AS5 action pref=100; accept AS5 import: from AS10 action pref=100; accept AS10 export: to AS123 announce AS4 export: to AS5 announce AS4 AS10 export: to AS10 announce AS4 AS5 Not a path AS10
  • 19.
    Routing Policy -Examples transit traffic over link2 AS123 AS4 More complex example AS6 private link1 link3 • AS4 and AS6 private link1 • AS4 and AS123 main transit link2 • backup all traffic over link1 and link3 in event of link2 failure
  • 20.
    Routing Policy -Examples AS123 AS4 AS6 private link1 link3 AS representation transit traffic over link2 aut-num: AS4 import: from AS123 action pref=100; accept ANY import: from AS6 action pref=50; accept AS6 import: from AS6 action pref=200; accept ANY export: to AS6 announce AS4 export: to AS123 announce AS4 full routing received higher cost for backup route
  • 21.
  • 22.
    APNIC Database •Public network management database – APNIC whois database contains: • Internet resource information and contact details – APNIC Routing Registry (RR) contains: • routing information • APNIC RR is part of IRR – Distributed databases that mirror each other
  • 23.
    Database Object •An object is a set of attributes and values • Each attribute of an object... • Has a value • Has a specific syntax • Is mandatory or optional • Is single- or multi-valued • Some attributes ... • Are primary (unique) keys • Are lookup keys for queries • Are inverse keys for queries – Object “templates” illustrate this structure
  • 24.
    Person Object Example – Person objects contain contact information Attributes Values person: address: address: address: country: phone: fax-no: e-mail: nic-hdl: mnt-by: changed: source: Test Person ExampleNet Service Provider 2 Pandora St Boxville Wallis and Futuna Islands TC +680-368-0844 +680-367-1797 tperson@example.com TP17-AP MAINT-ENET-TC tperson@example.com 20090731 APNIC
  • 25.
    Database Queries –Flags used for inetnum queries None find exact match - l find one level less specific matches - L find all less specific matches - m find first level more specific matches - M find all More specific matches - x find exact match (if no match, nothing) - d enables use of flags for reverse domains - r turn off recursive lookups
  • 26.
    Database Protection •Authorisation – “mnt-by” references a mntner object • Can be found in all database objects • “mnt-by” should be used with every object! • Authentication – Updates to an object must pass authentication rule specified by its maintainer object
  • 27.
    Prerequisite for UpdatingObjects • Create person objects for contacts • To provide contact info in other objects • Create a mntner object • To provide protection of objects • Protect your person object
  • 28.
  • 29.
    APNIC Database &the IRR • APNIC whois Database – Two databases in one • Public Network Management Database – “whois” info about networks & contact persons • IP addresses, AS numbers etc • Routing Registry – contains routing information • routing policy, routes, filters, peers etc. – APNIC RR is part of the global IRR
  • 30.
    Integration of Whoisand IRR • Integrated APNIC Whois Database & Internet Routing Registry APNIC Whois IRR IP, ASNs, reverse domains, contacts, maintainers etc routes, routing policy, filters, peers etc inetnum, aut-num, domain, person, role, maintainer route, aut-num, as-set, inet-rtr, peering-set etc. Internet resources & routing information
  • 31.
    Inter-related IRR Objects inetnum: 202.0.16.0 - 202.0.16.255 … tech-c: KX17-AP mnt-by: MAINT-EX aut-num: AS1 … tech-c: KX17-AP mnt-by: MAINT-EX … route: origin: … mnt-by: MAINT-EX person: … nic-hdl: KX17-AP … mntner: MAINT-EX … 202.0.16/24 AS1
  • 32.
    Inter-related IRR Objects inetnum: 202.0.16.0-202.0.31.255 … aut-num: AS2 … aut-num: AS10 … route: 202.0.16/20 … origin: AS2 … as-set: AS1:AS-customers members: AS10, AS11 route-set: AS2:RS-routes members: 218.2/20, 202.0.16/20 route: 218.2/20 … origin: AS2 … inetnum: 218.2.0.0 - 218.2.15.255 … aut-num: AS2 … aut-num: AS11 … , AS2
  • 33.
    Hierarchical Authorisation •mnt-routes – authenticates creation of route objects • creation of route objects must pass authentication of mntner referenced in the mnt-routes attribute – Format: • mnt-routes: <mntner> In: inetnum aut-num route
  • 34.
    Authorisation Mechanism inetnum:202.137.181.0 – 202.137.196.255 netname: SPARKYNET-TC descr: SparkyNet Service Provider … mnt-by: APNIC-HM mnt-lower: MAINT-SPARKYNET1-TC mnt-routes: MAINT-SPARKYNET2-TC This object can only be modified by APNIC Creation of more specific objects within this range has to pass the authentication of MAINT-SPARKYNET1-TC Creation of route objects matching/within this range has to pass the authentication of MAINT-SPARKYNET2-TC
  • 35.
    Creating Route Objects • Multiple authentication checks: – Originating ASN • mntner in the mnt-routes is checked • If no mnt-routes, mnt-lower is checked • If no mnt-lower, mnt-by is checked – AND the address space • Exact match & less specific route – mnt-routes etc – AND the route object mntner itself • The mntner in the mnt-by attribute aut-num inetnum route route
  • 36.
    Creating Route Objects IP address range 4 inetnum: 202.137.240.0 – 202.137.255.255 mnt-routes: MAINT-WF-EXNET 1 route aut-num: AS1 mnt-routes: MAINT-WF-EXNET maintainer 5 3 mntner: MAINT-WF-EXNET auth: CRYPT-PW klsdfji9234 AS number route: 202.137.240/20 origin: AS1 1. Create route object and submit to APNIC RR database 2. DB checks aut-num obj corresponding to the ASN in route obj 2 3. Route obj creation must pass auth of mntner specified in aut-num mnt-routes attribute. 4. DB checks inetnum obj matching/encompassing IP range in route obj 5. Route obj creation must pass auth of mntner specified in inetnum mnt-routes attribute.
  • 37.
    Using RPSL inpractice
  • 38.
    Overview • Reviewexamples of routing policies expression – Peering policies – Filtering policies – Backup connection – Multihoming policies
  • 39.
    RPSL - review • Purpose of RPSL – Allows specification of your routing configuration in the public IRR • Allows you to check “Consistency” of policies and announcements – Gives opportunities to consider the policies and configuration of others
  • 40.
    Address Prefix RangeOperator Operator Meanings ^- Exclusive more specifics of the address prefix: E.g. 128.9.0.0/16^- contains all more specifics of 128.9.0.0/16 excluding 128.9.0.0/16 ^+ Inclusive more specific of the address prefix: E.g. 5.0.0.0/8^+ contains all more specifics of 5.0.0.0/8 including 5.0.0.0/8
  • 41.
    Address Prefix Operator(cont.) Operator Meanings ^n n = integer, stands for all the length “n” specifics of the address prefix: E.g. 30.0.0.0/8^16 contains all the more specifics of 30.0.0.0/8 which are length of 16 such as 30.9.0.0/16 ^n-m m = integer, stands for all the length “n” to length “m” specifics of the address prefix: E.g. 30.0.0.0/8^24-32 contains all the more specifics of 30.0.0.0/8 which are length of 24 to 32 such as 30.9.9.96/28
  • 42.
    AS-path regular expressions • Regular expressions – A context-independent syntax that can represent a wide variety of character sets and character set orderings – These character sets are interpreted according to the current The Open Group Base Specifications (IEEE) • Can be used as a policy filter by enclosing the expression in “<“ and “>”.
  • 43.
    Filter List- RegularExpression • Like Unix regular expressions . Match one character * Match any number of preceding expression + Match at least one of preceding expression ^ Beginning of line $ End of line Escape a regular expression character _ Beginning, end, white-space, brace | Or () Brackets to contain expression [ ] Brackets to contain number ranges Source: www.cisco.com
  • 44.
    AS-path Regular Expression Operator Meanings <AS3> Route whose AS-path contains AS3 <^AS1> Routes whose AS-path starts with AS1 <AS2$> Routes whose AS-path end with AS2 <^AS1 AS2 AS3$> Routes whose AS-path is exactly “1 2 3” <^AS1 . * AS2$> AS-path starts with AS1 and ends in AS2 with any number ASN in between <^AS3+$> AS-path starts with AS3 and ends in AS3 and AS3 is the first member of the path and AS3 occurs one or more times in the path and no other AS can be present in the path after AS3
  • 45.
    AS-path Regular Expression (cont.) Operator Meanings <AS3|AS4> Routes whose AS-path is with AS3 or AS4 <AS3 AS4> Routes whose AS-path with AS3 followed by AS4
  • 46.
    Common Peering Policies Internet AS 1 AS 2 AS 3 • Peering policies of an AS – Registered in an aut-num object ISP (Transit provider) Customer AS 4 AS 5
  • 47.
    Common Peering Policies • Policy for AS3 in the AS2 aut-num object aut-num: AS2 as-name: SAMPLE-NET dsescr: Sample AS import: from AS1 accept ANY import: from AS3 accept <^AS3+$> export: to AS3 announce AS2 export: to AS1 announce AS2 AS3 admin-c: TP1-AP tech-c: TP2-AP mtn-by: MAINT-SAMPLE-AP changed: sample@sample.net
  • 48.
    Transit Provider Policies Internet AS 1 AS 2 AS 3 • Peering policies of an AS – Registered in an aut-num object ISP (Transit provider) Customer AS 4 AS 5
  • 49.
    ISP Customer –Transit Provider Policies • Policy for AS3 and AS4 in the AS2 aut-num object aut-num: AS2 import: from AS1 accept ANY import: from AS3 accept <^AS3+$> import: from AS4 accept <^AS4+$> export: to AS3 announce ANY export: to AS4 announce ANY export: to AS1 announce AS2 AS3 AS4
  • 50.
    AS-set Object •Describe the customers of AS2 as-set: AS2:AS-CUSTOMERS members: AS3 AS4 changed: sample@sample.net source: APNIC
  • 51.
    Aut-num Object referringas-set Object aut-num: AS2 import: from AS1 accept ANY import: from AS2:AS-CUSTOMERS accept <^AS2:AS-CUSTOMERS+$> export: to AS2:AS-CUSTOMERS announce ANY export: to AS1 announce AS2 AS2:AS-CUSTOMERS aut-num: AS1 import: from AS2 accept <^AS2+AS2:AS-CUSTOMERS+$> export: ………
  • 52.
    Express Filtering Policy • To limit the routes one accepts from a peer – To prevent the improper use of unassigned address space – To prevent malicious use of another organisation’s address space
  • 53.
    Filtering Policy 7.7.0.0/20allocated by RIR AS 2 AS 3 Internet AS3 wants to announce part or all of 7.7.0.0/20 on the global Internet. AS2 wants to be certain that it only accepts announcements from AS3 for address space that has been properly allocated to AS3.
  • 54.
    Aut-num Object withFiltering Policy aut-num: AS2 import: from AS3 accept { 7.7.0.0/20^20-24 } ……. For an ISP with a growing or changing customer base, this mechanism will not scale well. Route-set object can be used.
  • 55.
    IRRToolSet • Setof tools developed for using the Internet Routing Registry (IRR) • Work with Internet routing policies – These policies are stored in IRR in the Routing Policy Specification Language (RPSL) • The goal of the IRRToolSet is to make routing information more convenient and useful for network engineers – Tools for automated router configuration, – Routing policy analysis – On-going maintenance etc.
  • 56.
    IRRToolSet • Download:ftp://ftp.isc.org/isc/IRRToolSet/ • Installation needs: lex, yacc and C++ compiler root@bofh:~ #wget ftp://ftp.isc.org/isc/IRRToolSet/IRRToolSet- 5.0.1/irrtoolset-5.0.1.tar.gz root@bofh:~ # tar –zxvf irrtoolset-5.0.1.tar.gz root@bofh:~ # cd irrtoolset-5.0.1 root@bofh:~irrtoolset-5.0.1# ./configure root@bofh:~irrtoolset-5.0.1# make root@bofh:~irrtoolset-5.0.1# make install
  • 57.
    IRRToolSet root@bofh:~ whois–h whois.apnic.net AS17821 #####snipped###### mp-import: afi any.unicast { from AS-ANY accept ANY AND NOT RS-MARTIANS; } refine { from AS-ANY action pref = 50; accept community.contains(17821:50); from AS-ANY action pref = 30; accept community.contains(17821:70); from AS-ANY action pref = 10; accept community.contains(17821:90); from AS-ANY action pref = 0; accept ANY; } refine afi ipv4.unicast {
  • 58.
    IRR Toolset, RPSL:rtconfig(Contd) Cisco Specific @rtconfig set cisco_map_name = <map-name> @rtconfig set cisco_map_first_no = <no> @rtconfig set cisco_map_increment_by = <no> @rtconfig set cisco_prefix_acl_no = <no> @rtconfig set cisco_aspath_acl_no = <no> @rtconfig set cisco_pktfilter_acl_no = <no> @rtconfig set cisco_community_acl_no = <no> @rtconfig set cisco_access_list_no = <no> @rtconfig set cisco_max_preference = <no> @rtconfig networks <ASN-1> @rtconfig inbound_pkt_filter <if-name> <ASN-1> <rtr-1> <ASN- 2> <rtr-2>
  • 59.
    IRR Toolset, RPSL:rtconfig(Contd) Junos Specific @rtconfig set junos_policy_name = <policy-name> @rtconfig networks <ASN-1>
  • 60.
    IRR Toolset, RPSL:rtconfig Input File(Provision) router bgp 17821 neighbor 103.4.108.54 remote-as 131107 neighbor 103.4.108.54 version 4 ! # X Communication Ltd @RtConfig set cisco_access_list_no = 500 @RtConfig set cisco_map_name = "AS58715-IN" @RtConfig import AS131208 103.4.108.62 AS58715 103.4.108.61 @RtConfig set cisco_access_list_no = 599 @RtConfig set cisco_map_name = "ANY" @RtConfig export AS131208 103.4.108.62 AS58715 103.4.108.61 ! # xyz Ltd @RtConfig set cisco_access_list_no = 501 @RtConfig set cisco_map_name = "AS58656-IN" @RtConfig import AS131208 103.4.108.94 AS58656 103.4.108.93 @RtConfig set cisco_access_list_no = 599 @RtConfig set cisco_map_name = "ANY" @RtConfig export AS131208 103.4.108.94 AS58656 103.4.108.93 ! end
  • 61.
    Use of RPSL- RtConfig • RtConfig • part of IRRToolSet • Reads policy from IRR (aut-num, route & -set objects) and generates router configuration – vendor specific: • Cisco, Bay's BCC, Juniper's Junos and Gated/RSd – Creates route-map and AS path filters – Can also create ingress / egress filters
  • 62.
    IRR Toolset, RPSL:Uploading Configuration Various ways to upload configuration: – SNMP Write – NETCONF XML Based – Automated Script using expect
  • 63.
    Why use IRRand RtConfig? • Benefits of RtConfig – Avoid filter errors (typos) – Expertise encoded in the tools that generate the policy rather than engineer configuring peering session – Filters consistent with documented policy • (need to get policy correct though)
  • 64.
  • 65.
    What is RPKI? • Resource Public Key Infrastructure (RPKI) • A robust security framework for verifying the association between resource holder and their Internet resources • Created to address the issues in RFC 4593 “Generic Threats to Routing Protocols” • Helps to secure Internet routing by validating routes – Proof that prefix announcements are coming from the legitimate holder of the resource 65
  • 66.
    Benefits of RPKI- Routing • Similar objective as IRR but in a robust and scalable way • Prevents route hijacking – A prefix originated by an AS without authorization – Reason: malicious intent • Prevents mis-origination – A prefix that is mistakenly originated by an AS which does not own it – Also route leakage – Reason: configuration mistake / fat finger 66
  • 67.
    BGP Security (BGPsec) • Extension to BGP that provides improved security for BGP routing • Currently an IETF Internet draft • Implemented via a new optional non-transitive BGP path attribute that contains a digital signature • Two things: – BGP Prefix Origin Validation (using RPKI) – BGP Path Validation • Similar efforts in the early days – IDR working group, S-BGP 67
  • 68.
    RPKI Infrastructure •A system to manage the creation and storage of digital certificates and the associated Route Origin Authorization documents • Main Components – Certificate Authority (CA) – Relying Party (RP) – Routers with RPKI support 68
  • 69.
    Issuing Party •Internet Registries (RIR, NIR, Large LIRs) • Acts as a Certificate Authority and issues certificates for customers • Provides a web interface to issue ROAs for customer prefixes • Publishes the ROA records 69 APNIC RPKI Engine publication MyAPNIC GUI Repository rpki.apnic.net
  • 70.
    Route Origin Authorization(ROA) • A digital object that contains a list of address prefixes and one AS number • It is an authority created by a prefix holder to authorize an AS Number to originate one or more specific route advertisements • Publish an ROA using MyAPNIC 70
  • 71.
    X.509 Certificate with3779 Extension 71 • Resource certificates are based on the X.509 v3 certificate format (RFC 5280) • Extended by RFC 3779 – binds a list of resources (IP, ASN) to the subject of the certificate • SIA – Subject Information Access; contains a URI that references the directory X.509 Certificate RFC 3779 Extension SIA Owner's Public Key
  • 72.
  • 73.
  • 74.
    Router Origin Validation • Router must support RPKI • Checks an RP cache / validator • Validation returns 3 states: – Valid = when authorization is found for prefix X – Invalid = when authorization is found for prefix X but not from ASN Y – Unknown = when no authorization data is found • Vendor support: – Cisco IOS – solid in 15.2 – Cisco IOS/XR – shipped in 4.3.2 – Juniper – shipped in 12.2 – Alcatel Lucent – in development 74
  • 75.
    How to start? • Create ROA records in MyAPNIC • Build an RP cache • Configure your router to use the cache (or a public one) • Create BGP policies 75
  • 76.
    How to buildRP Cache • Download and install from rpki.net • Instructions here: https://trac.rpki.net/wiki/doc/RPKI/Installation/UbuntuPacka ges 76
  • 77.
    Configure Router toUse Cache router bgp 17821 … bgp rpki server tcp 10.0.0.3 port 43779 refresh 60 Bgp rpki server tcp 147.28.0.84 port 93920 refresh 60 77
  • 78.
    How does itlook in BGP Table 78 Network Next Hop Metric LocPrf Weight Path * i I198.180.150.0 144.232.9.61 100 0 1239 3927 i *> * *> * *> * I I V198.180.152.0 V N198.180.155.0 N 199.238.113.9 129.250.11.41 199.238.113.9 129.250.11.41 199.238.113.9 129.250.11.41 0 2914 3927 i 0 2914 3927 i 0 2914 4128 i 0 2914 4128 i 0 2914 22773 i 0 2914 22773 i 199.238.113.9 129.250.11.41 *> N198.180.160.0 5752 i * N 5752 i 0 2914 23308 13408 0 2914 23308 13408 RPKI Lab – Randy Bush 24 r0.sea#sh ip bgp
  • 79.
    Member Services Helpdesk -One point of contact for all member enquiries -Online chat services Helpdesk hours 9:00 am - 9:00 pm (AU EST, UTC + 10 hrs) ph: +61 7 3858 3188 fax: 61 7 3858 3199 • More personalised service – Range of languages: Bahasa Indonesia, Bengali, Cantonese, English, Hindi, Mandarin, Thai, etc. • Faster response and resolution of queries – IP resource applications, status of requests, obtaining help in completing application forms, membership enquiries, billing issues & database enquiries
  • 80.
  • 81.