Routing Security Workshop Internet Routing Registries

Size: px

Start display at page:

Download "Routing Security Workshop Internet Routing Registries"

Rodger Austin
5 years ago
Views:

1 Routing Security Workshop Internet Routing Registries Jeff Bartig Senior Interconnection Architect, Internet2

2 IRR Presentation Overview NANOG 74 Updates IRR Overview IRR Tools Internet2 Participant IRR Stats [ 2 ]

3 NANOG 74 UPDATES [ 3 ]

4 NANOG 74 BGP Route Security Track Recent BGP Incidents, Andree Toonk/BGPmon State of BGP Security, Alexander Azimov/QRator Legal Barriers to Securing the Routing Architecture, Christopher Yoo, David Wishnick/UPenn Routing Security Roadmap, Job Snijders/NTT also given at NLNOG: So I need to Start Route Filtering Peers, Chris Morrow/Google Google tentatively plans to have reject data available for peers by January 1, 2019 Tentative plans to drop routes not matching IRR data by March 1, 2019 Track wasn t recorded, but slides available [ 4 ]

5 IRR OVERVIEW [ 5 ]

6 IRR Overview What Is An Internet Routing Registry Why Register IRR Objects Important IRR Record Types Querying RADB Whois IRRExplorer Checking Your Work [ 6 ]

7 What Is An Internet Routing Registry (IRR) An IRR is a Public registry (database) of network routing information Many registry options (RADB, ARIN, RIPE, AltDB, LEVEL3,.) Often an IRR will mirror the other IRRs to create a more complete database Registry objects are specified using the Routing Policy Specification Language (RPSL, RFC2622) Registries can be used to document a network s prefixes, ASNs, groups of prefixes, groups of ASN, routing policy, and peers [ 7 ]

8 Why Register IRR Objects Automation! Standard method for communicating the list of prefixes your network plans to advertise Standard method for documenting the origin ASN for prefixes Statement of ownership more difficult to hijack Some services require IRR objects Transit providers Peering exchange route servers DDoS services (Zenedge) Peers [ 8 ]

9 Why Register IRR Objects But what if I don t peer, use peering exchanges, use a DDoS mitigation provider, or buy transit from someone that requires proper IRR objects? Your upstream providers may interact with other networks and services that do require IRR objects. [ 9 ]

10 Why Register IRR Objects If you don t document in an IRR, your routes may be blocked by peers of your transit providers or by your direct peers Routes with missing or incorrect IRR objects may be blocked temporarily or permanently when they are announced Routes may be preferenced lower if there are missing IRR objects Difficult to troubleshoot the path packets take to reach you. You may not realize you have issues. Better to maintain your own data, rather than have an upstream provider proxy register objects for your network [ 10 ]

11 Why Register IRR Objects - PeeringDB.com

12 Important IRR Object Types A minimal deployment of IRR objects doesn t require a lot of effort or object detail It is not necessary to document peers and route policy in your objects Important object types mntner: Maintainer - owner of the objects that you maintain route / route6: prefixes you plan to announce and their origin ASN aut-num: ASNs that originate your prefixes as-set: a grouping of aut-num objects and possibly other as-set objects [ 12 ]

13 Important IRR Object Types - mntner

14 Important IRR Object Types - mntner

15 Important IRR Object Types - route/route6

16 Important IRR Object Types - aut-num

17 Important IRR Object Types - as-set

18 Important IRR Object Types - as-set

19 RADB Whois - all routes with specific origin -!g A### : start of response and number of characters in response C : end of response

20 !i : expand as-set!ias-set,1 : recursively expand as-set, expanding any as-sets contained in RADB Whois - expand as-set -!i Not expanded

21 IRRExplorer Checking Your Work

22 IRRExplorer Checking Your Work

23 IRRExplorer Checking Your Work

24 IRRExplorer Checking Your Work

25 IRRExplorer Checking Your Work Old cruft to clean up

26 IRRExplorer Checking Your Work

27 Useful IRR Links IRR Explorer: PeeringDB: List of IRR: List of IRR/RPSL RFCs: RADB Whois Help/Examples: ARIN IRR: Mutually Agreed Norms for Routing Security

28 IRR TOOLS [ 28 ]

29 Tools bgpq3 - IRRExplorer - IRRToolSet - IRR Power Tools - [ 29 ]

30 bgpq3 $ bgpq3 -J -l AS-ONENET-MEMBERS AS-ONENET-MEMBERS policy-options { replace: prefix-list AS-ONENET-MEMBERS { /20; /20; /16; /17;... } [ 30 ]

31 INTERNET2 PARTICIPANT IRR STATS [ 31 ]

32 TR-CPS Participant routes vs IRR Total Customer routes in Internet2 trcps VRF: 5,594 Routes with matching IRR record: 3,376 (60%) Route with no matching IRR record: 2,218 (40%) [ 32 ]

33 TR-CPS Participants With 100% Accurately Registered IPv4 Prefixes (19 Out of 64 Participant ASNs) [ 33 ]

An introduction to BGP security

An introduction to BGP security Marco d Itri @rfc1036 Seeweb s.r.l. Albanian Network Operators Group meeting - 14 November 2018 Internet: independent networks exchanging traffic The Internet