RPKI-Based Origin Validation Lab RPKI Lab Creative Commons: Attribution & Share Alike

Size: px

Start display at page:

Download "RPKI-Based Origin Validation Lab RPKI Lab Creative Commons: Attribution & Share Alike"

Kristian Copeland
5 years ago
Views:

1 RPKI-Based Origin Validation Lab 1

2 Issuing Parties Relying Parties GUI altca Publication Protocol Trust Anchor Resource PKI RCynic Gatherer Pseudo IRR route: /16! descr: /16-16! origin: AS3130! notify: mnt-by: MAINT-RPKI! changed: ! source: RPKI! GUI Up Down JPNIC Publication Protocol SIA Pointers Resource PKI Validated Cache NOC Tools GUI Up Down IIJ Publication Protocol SIA Pointers Resource PKI Our Focus Today BGP Decision Process 2

3 Today Register Our Prefixes in CA Issue ROAs Using CA s Web Portal Configure Routers to get ROAs from Caches RPKI Lab Creative Commons: Attribution & Share Alike

4 Get Copy of This Preso So You Can Copy and Paste 4

5 Lab Overview GUI django RPKI Engine RCynic Gatherer Cache RPKI to Rtr Protocol BGP Decision Process Publication Protocol Repository Mgt RPKI Repo 5

6 Lab Environment ubu01 ubu02 ubu03 ubu04 ubu05 ubu16 Ubuntu/KVM Server in Ashburn GUI RPKI-Rtr Protocol AS65000 AS65001 RP - cache0.vmini CA - ca0.vmini Mac Mini running Ubuntu KVM 6

DynaMIPS on MacMini 10.0.0.0/8 RPKI Cache RPKI-Rtr Protocol AS65000 202.144.137.27 Global Internet AS65001 98.128.0.0/16! 98.128.0.0/24!

7 DynaMIPS on MacMini /8 RPKI Cache RPKI-Rtr Protocol AS Global Internet AS /16! /24! /24!! /24! AS3130 Seattle Dallas AS /16! /24! /24!! /24! 7

8 Student Routers r1 r16 default default vmini kvm host NATted / /24 b0 default IPTables NAT br0 etc ssh Tunnels /24 b1 default because BGP is often blocked by firewalls ca cache

9 Issuing Parties Relying Parties GUI altca Publication Protocol Trust Anchor Resource PKI RCynic Gatherer Pseudo IRR route: /16! descr: /16-16! origin: AS3130! notify: mnt-by: MAINT-RPKI! changed: ! source: RPKI! GUI Up Down JPNIC Publication Protocol SIA Pointers Resource PKI Validated Cache Our NOC Tools GUI Up Down IIJ Publication Protocol SIA Pointers Resource PKI Focus Today BGP Decision Process 9

10 Today Trust Anchor GUI altca Publication Protocol Resource PKI Up Down SIA Pointers GUI workshop Publication Protocol Resource PKI Up Down SIA Pointers GUI not used Publication Protocol Resource PKI 10

11 IP Address Allocation /16 ARIN Experimental Allocation /24 Instructors Play /24 labuser /24 labuser /24 labuser32 11

12 GUI Accounts UserID labuser01 labuser02 labuser03 labuser16 Password fnord fnord fnord fnord 12

13 labusernn fnord 13

14 The Dashboard 14

15 Create a ROA 15

16 What Will Happen? 16

17 Routers Use Your Own! (in production images from C&J) 16 DynaMIPS 7200s in Lab 17

18 Be Careful! Some Caches Have a LOT of ROAs Do Not Configure DynaMIPS to a Server With RIR TALs Because RIPE Data Has Thousands of ROAs dfw0, Has Full BGP Table if you want to crash DynaMIPS 18

19 In-Lab Router Accounts ssh password: fnord user: isplab password: lab-pw # enable password: lab-pw (N is your user number) 19

20 BGP Configuration rn#conf t Enter configuration commands, one per line. End with CNTL/Z. rn(config)#router bgp 651NN rn(config-router)#bgp rpki server tcp port \ refresh 60 rn(config-router)#end That s All 20

21 Cisco Adventure rn#show ip bgp rpki? servers Display RPKI cache server information table Display RPKI table entries 21

22 Check Server rn#show ip bgp rpki servers BGP SOVC neighbor is /43779 connected to port Flags 0, Refresh time is 600, Serial number is InQ has 0 messages, OutQ has 0 messages, formatted msg 345 Session IO flags 3, Session flags 4008 Neighbor Statistics: Nets Processed 624 Connection state is ESTAB, I/O status: 1, unread input bytes: 0 Connection is ECN Disabled Mininum incoming TTL 0, Outgoing TTL 255 Local host: , Local port: Foreign host: , Foreign port: Connection tableid (VRF): 0 22

23 Look at Table rn#show ip bgp rpki table 76 BGP sovc network entries using 6688 bytes of memory 78 BGP sovc record entries using 1560 bytes of memory Network Maxlen Origin-AS Source Neighbor / / / / / / / / / / / / / / / / / / / /

24 Look at BGP Table rn#sh ip bgp Network Next Hop Metric LocPrf Weight Path * i I i *> I i * I i *> V i * V i *> N i * N i *> N i * N i 24

25 Mis-Origination Caught RN#sh ip bgp NN.0/24 BGP routing table entry for /24, version 94 Paths: (2 available, best #2, table default) Advertised to update-groups: 1 Refresh Epoch from ( ) Origin IGP, localpref 100, valid, external path 6802D4DC RPKI State invalid Refresh Epoch from ( ) Origin IGP, localpref 100, valid, external, best path 6802D7C8 RPKI State valid 25

26 Fat-Finger Detected ROA show ip bgp / /16 AS65000 AS65001 AS 3130 Global Internet AS3130 AS /16! /16! Seattle Dallas 26

27 ROA Controls Validity ROA show ip bgp / /16 AS65000 AS65001 AS 4128 Global Internet AS3130 AS /16! /16! Seattle Dallas 27

28 Try Your Own /24 ROA show ip bgp /16 show ip bgp X.0/ /16 AS 4128 ROA AS65000 AS X.0/24 AS 3130 Global Internet AS3130 AS X.0/24! X.0/24! 28

29 Now You Know How to Prevent YouTube Incident-2 And Stay Out of The Newspapers 29

30 Please Do Try This At Home 30

RPKI-Based Origin Validation, Routers, & Caches

RPKI-Based Origin Validation, Routers, & Caches RPKIWS / Berlin 2013.07.26 Randy Bush Rob Austein Michael Elkins Matthias Waehlisch