RPKI Workshop Routing Lab

Size: px

Start display at page:

Download "RPKI Workshop Routing Lab"

Terence Byrd
6 years ago
Views:

1 RPKI Workshop Routing Lab NANOG / Denver Randy Bush <randy@psg.com> Michael Elkins <me@sigpipe.org> Rob Austein <sra@isc.org> Serpil Bayraktar <serpil@juniper.net> RPKI Router Lab 1

2 Lab Overview django RPKI Engine RCynic Gatherer Cache RPKI to Rtr Protocol BGP Decision Process Publication Protocol Repository Mgt RPKI Repo RPKI Router Lab 2

3 BGP Feeds into Lab AS65000 AS65001 Global Internet /16! /24! /24!! /24! AS3130 Seattle Dallas AS /16! /24! /24!! /24! RPKI Router Lab 3

4 Junosphere Server /8 RPKI Cache RPKI-Rtr Protocol AS /19 Global Internet AS RPKI Router Lab /16! /24! /24!! /24! AS3130 Seattle Dallas AS /16! /24! /24!! /24! 4

5 IP Address Allocation /16 ARIN Experimental Alloc /24 instructors play /24 labuser /24 labuser /24 labuser RPKI Router Lab 5

6 GUI Accounts UserID labuser01 labuser02 labuser03 labuser32 Password fnord fnord fnord fnord RPKI Router Lab 6

7 RPKI Router Lab 7

8 One Prefix RPKI Router Lab 8

9 Issue a ROA RPKI Router Lab 9

10 Looks Good RPKI Router Lab 10

11 Router Accounts % ssh juniper@rxx.jlab.rpki.net (where xx is your UserID) juniper@r1.jlab.rpki.net's password: Juniper --- JUNOS 10.3I built :59:04 UTC juniper@r1> RPKI Router Lab 11

12 Router Configuration BGP peerings etc. should be up AS connected to b0 to Seattle AS connected to b1 to Dallas Please confirm show bgp summary match ^ d 1:13:07 15/42/42/0 0/0/0/ d 1:12:38 27/41/41/0 0/0/0/ RPKI Router Lab 12

13 show configuration routing-options find validation validation { traceoptions { file rpki.log; flag all detail; flag error detail; } group test { session { traceoptions { file r.log size 10m; flag error; flag state; flag packets; } refresh-time 120; hold-time 180; port 42420; local-address <ip-address of em0>; connect-retry 10; } } } RPKI Router Lab 13

14 Lab Cheat Sheets & JunOSphere Literature RPKI Router Lab 14

15 show configuration policy-options find validation policy-statement route-validation { term valid { from { protocol bgp; validation-state valid; } then { local-preference 110; validation-state valid; accept;}} term invalid { from { protocol bgp; validation-state invalid; } then { local-preference 90; validation-state invalid; accept; } } term unknown { from { protocol bgp; validation-state unknown; } then {validation-state unknown; accept; } } } RPKI Router Lab 15

16 Apply the Policy show configuration protocols bgp { import route-validation; group as65000 { local-address ; export none; peer-as 65000; neighbor ; } group as65001 { local-address ; export none; peer-as 65001; neighbor ; } } RPKI Router Lab 16

17 Check Server show validation session brief Session , State: up Group: test, Preference: 100 Port: Refresh time: 120s Hold time: 180s Record Life time: 3600s Serial (Full Update): Serial (Incremental Update): IPv4 prefix count: 81 IPv6 prefix count: RPKI Router Lab 17

18 Look at Table show validation database brief RV database for instance master Total IPv4 records: 81 Total IPv6 records: 29 Prefix Origin Session State / valid / valid / valid / valid / valid / valid / valid / valid / valid / valid / valid RPKI Router Lab 18

19 Look at a Prefix juniper@r1> show route detail /24 (2 entries, 1 announced) *BGP Preference: 170/-111 Source: Validation State: valid... AS path: I... BGP Preference: 170/ Source: Validation State: invalid... AS path: I RPKI Router Lab 19

20 Go Play With Policy RPKI Router Lab 20

Fat-Finger Detected show route 98.128.0.

21 Fat-Finger Detected show route /16 detail ROA /16 AS65000 AS65001 AS 3130 Global Internet AS3130 AS /16! /16! Seattle Dallas RPKI Router Lab 21

22 Find [In]Valid Routes show route validation-state invalid terse A V Destination... AS path I / I I / I I / I juniper@r1> show route validation-state valid terse A V Destination... AS path * V / I * V / I * V / I RPKI Router Lab 22

23 Clearing Sessions clear validation session <ip-address> \ soft-inbound clear validation session <ip-address> Due to a bug, we have to soft clear sessions to get database changes RPKI Router Lab 23

24 ROA Controls Validity show route /16 detail ROA /16 AS65000 AS65001 AS 4128 Global Internet AS3130 AS /16! /16! Seattle Dallas RPKI Router Lab 24

25 Try Your Own /24 ROA /16 show route /16 detail show route x.0/24 detail AS 4128 ROA AS65000 AS X.0/24 AS 3130 Global Internet X.0/24! AS3130 AS X.0/24! RPKI Router Lab 25

26 LocalPref is Set show route /24 detail /24 (2 entries, 1 announced) *BGP Preference: 170/ Source: Validation State: valid... AS path: I... Localpref: BGP Preference: 170/ Source: Validation State: invalid... AS path: I... Localpref: RPKI Router Lab 26

RPKI-Based Origin Validation Lab RPKI Lab Creative Commons: Attribution & Share Alike

RPKI-Based Origin Validation Lab 1 Issuing Parties Relying Parties GUI altca Publication Protocol Trust Anchor Resource PKI RCynic Gatherer Pseudo IRR route: 147.28.0.0/16! descr: 147.28.0.0/16-16! origin: