Examination. ANSWERS IP routning på Internet och andra sammansatta nät, DD2491 IP routing in the Internet and other complex networks, DD2491

Transcription

1 Examination ANSWERS IP routning på Internet och andra sammansatta nät, DD2491 IP routing in the Internet and other complex networks, DD2491 Date: October 21st :00 13:00 a) No help material is allowed - You are not allowed to use dictionaries, books, or calculators! b) You may answer questions in English or Swedish. c) Questions are not sorted according to level of difficulty d) Max is 44 points. 22 points is required to pass. e) Course responsible is Olof Hagsand, phone

2 1. Peering relations (3p) Peering relations between autonoumous systems in an Internet often falls into the following three roles: 1. Transit 2. Peer 3. Customer Describe each role from the perspective of an ISP (Internet Service Provider): How do they differ with respect to routing protocols and policies? A peering relation describes how an autonomous system relates to another AS. The question is not about how transit or customer networks are built since this misses the point: a network may have many roles and have many different kinds of relations. For example, a single network may both have role of a customer as well as provide transit. The peering relations are basically driven by economical factors and depends on where the ISP is situated in the network and business hierarchy. The answers below are described from the perspective of an ISP, as if a single ISP have all the peering relations but to different AS's. It assumes also that the ISP has some own (eg core) prefixes, some customer prefixes received from customers, peering prefixes received from peering partners, and all other prefixes received from transit providers. The following are typical peering relations: 1. Transit relation. Announce own and customer prefixes. Accept all prefixes. Pay for traffic. 2. Peer relation. Announce own and customer rpefixes. Accept peer prefixes and its customers. Prefer these routes over routes received from transit. Traffic is free. 3. Customer relation. Announce peer and transit. Accept customer prefixes. Charge for traffic. Also important to filter traffic in various ways. 2. BGP: Terminology (3p) Give brief descriptions of each: 1. What is next-hop self? Instead of using the next-hop given in an ebgp announcement which is often an external address of a physical interface, set the next-hop to an address on a loopback interface on the local router when re-announcing the route internally via ibgp. You should ensure that the address of the loopback interface is announced internally (but not via BGP). 2. What is BGP multi-path?

3 BGP multi-path is an extension that allows several equal routes to be active in the local-rib, and thus enables load-balancing. Equal routes are defined as having equal AS-path length, equal med and local-pref, but differ in router-ids and IP addresses. 3. What is BGP multi-hop? BGP multi-hop is an ebgp peering where the TCP session between the two peers span over more than one IP sub-network. That is, there is at least one IP hop between the two BGP peers. 3. BGP: Inside a router (5p) The routing model for BGP is based on several RIBs (Routing Information Bases): Adj-In Rib, Local-RIB, Adj-Out Rib. This model is central for the decision process and for policy decisions in BGP. It is also central for how routes are announced and withdrawn. Describe the BGP routing process model: What are the roles of the different RIBs? Where are policies applied? Where is the decision process applied? How are routes announced and withdrawn? Draw a picture and explain using the picture. Also, in what way does the route refresh capability change this model? The routing model describing the different RIBs is an implementation model of the internal mechanism in a router running BGP. It is not necessary to implement a router in this way, but the semantics of the protocol and its attributes are based on this model. All routes received from other peers are stored in separate Adj-In Ribs, one from each router. Changes from peers are incremental and are not resent, so the router must save every change from the start of the peering session. Updates are either additions of a new route, changes of an existing route or removal of a route (withdraw). Each of these changes are reflected in the Adj-In RIB. Import policies are applied to the routes of the Adj-In RIB and are then compared using the BGP decision process to find one single route which is installed in the Local-RIB. Thus, the Local-RIB contains only a single variant of each route. The Local-RIB is then compared with other RIBs of other routing protocols and installed as active (if best preference) in the FIBs of the router to forward traffic. The routes in the Local-RIB (only active routes in the Juniper case) are then subject to export policies and placed in the Adj-Out RIBs, one for each peer, and announced to that peer. Routes that are added or changed are announced to the other peers and withdrawn if deleted. If the route refresh capability is enabled, the Adj-In RIB may drop routes it is not using. If they need to be used, a refresh message is sent to the other peer which will then resend those routes (from its Adj-Out RIB). 4. Attributes (3p) Describe how MED (Multi-Exit Discriminator) can be used to control traffic. In which situations can it be used? What are its limitations (when can it not be used)?

4 MED is an optional non-transitive attribute which is used to control how traffic flows into an autonomous system from one other adjacent network. It is used over ebgp. By setting lower MED on a route over one peering than over another, an AS can signal to the neighbouring AS where it prefers to receive the traffic destined to a specific prefix. It is often used in (1) load-balancing scenarios where traffic to different prefixes are distributed on different peering or (2) redundancy scenarios where all traffic goes over one peering with the other peerings as fallback options. It can not be used to compare routes from more than one AS or for AS's that are not adjacent. It is usually possible to loosen this restriction by allowing to compare MEDs even for routes that are announced by different AS's (always-compare-med).

5 5. BGP and IGP (6p) X / A / /30.1 B.2 C / / /30 D Y E Regard the network in the figure consisting of routers, links and IP subnetworks. There are four routers A-D within an AS and two external routers X and Y. E is a network reachable via Y. IBGP full mesh is configured between routers A-D and OSPF is chosen as internal protocol without areas. Further, transit data traffic to E flows from X to Y via B-A- C. 1) Via which peering relations is E announced from Y to X internally in the AS? (1p) E is announced by Y to C via ebgp, by C to B via ibgp and by B to X via ebgp. 2)Write down an example routing table in A with all information necessary to reach E (e.g. Not only to E, but also routes necessary to make recursive lookup). Routes should include (at least) prefix, nexthop and protocol. (2p) Prefix Next-hop Protocol E ibgp / OSPF /30 - Direct Using next-hop-self: E C ibgp C OSPF /30 - Direct Suppose now that the link between A and C goes down. 3) Draw the new routing table in A after the routing tables have converged after the break. Again, the routing table should include all information necessary to reach E.(1p) Prefix Next-hop Protocol E ibgp / OSPF (this is the important change) /30 - Direct Using next-hop-self:

6 E C ibgp C OSPF /30 - Direct 4)What happens with the BGP peering between A and C when the link goes down? (1p) The peering remains since it is based on TCP between loopback interfaces. When the link goes down, the direct route is removed and OSPF floods new link-state and eventually converges with a new state. If the link failure is not immediately detected, the OSPF HELLO protocol eventually notices the failure. When OSPF has re-converged the IP packets of the TCP session takes the new route. During an interval packets may have been lost but this is taken care of TCP resending mechanism. 5)Is the way the announcement of E from Y to X changed when the link goes down, and if so how? (1p) It is not changed. The C-B peering is unchanged, but the IP packets (including the BGP signaling traffic) may travel between B and C via A and B (instead of only via A). 6. IBGP (5p) There is a basic announcement rule in BGP saying that routes received over an IBGP peering shall not be re-announced over another IBGP peering. Why is there such a rule? What would happen if the rule was not there? What are the primary consequences of this rule? Which methods exist to counter the negative consequences of this rule? The rule is there primary for loop-avoidance. The primary mechanism in BGP to avoid loop is the AS-PATH. If an AS detects it's ASN in an AS- PATH, it can deduce that there is a loop and drops the route. But in IBGP no new ASN is prepended to AS-PATHs so there is no way to know if the announcement has passed through this router before. Therefore, if there was no such rule, the same announcement can be made repeatedly within an AS triggering looping BGP updates. The consequence of the rule is that IBGP connections must be made in full mesh so that all BGP information can reach all peers without internal BGP announcement forwarding. This leads to a large number of BGP sessions (n(n-1)/2)where each session uses resources in the form of (1) memory hosting the Adj-in/out RIBs (most serious); (2) TCP connections; (3) signaling traffic; (4) processing resources. Since the scaling of full mesh is n(n-1)/2 which may result in considerable resource use in large internal networks and large routing tables. A positive side is that convergence is probably faster although more traffic is sent in the network. All peerings must also be configured which increase the management burden and is error-prone.

7 The two best known methods to avoid this problem are (1) route reflectors where a tree hierarchy of peerings are introduced; and (2) asconfederations where the as is split into sub-as's, each using full mesh. 7. Route reflection (5p) A X B C Y D Regard the internal network in the figure consisting of the four routers A- D. X and Y are external peers. The lines represent physical links. Assume you setup BGP on all routers with external peering between X-B and C-Y. You also design a route reflector cluster consisting of routers A, C and D, where A is a route reflector and C and D are clients. Assume also routers A and D have external peering (not shown in the picture). 1. Which BGP peerings do C have? (1p) C-Y (ebgp), C-A(iBGP). 2. Describe how announcements from X are announced internally in the network (to all routers A-D). Do the same for announcements from Y (1p) From X: X->B, B->A, A->D, A->C. From Y: Y->C, C->A, A->D, A->B. 3. Are there any sub-optimal routing decisions that may be made with this configuration? If so, describe one. (1p) Sub-optimal routing decisions are usually made where route reflector peering does not follow physical topology. This appears in the links B-D and C-D which have physical links but no peering. One example would be an external network announced by both D and C. A would make the choice and can choose the route from C as best and reanounce it to B. B would then choose C although D would have been a better choice. 4. Now change the cluster so that both A and D are route reflectors and C is a client of both. How does this change the distribution of announcements within the AS? (1p) Using announcements from X and Y to illustrate the difference: From X: X->B, B->A, B->D, A->C, D->C. From Y: Y->C, C->A, C->D, A->D, D->A, A->B, D->B.

8 5. Route reflectors A and D may either have the same or different cluster id:s. What is the difference between the two methods? (1p) The difference is when they communicate between each other. If they have different cluster ID:s they will build an IBGP session and announce and receive routes and store them in the Adj-in RIB and use them in the decision process as any other ibgp peering. If they have the same cluster ID:s they will drop the received routes since they have the same cluster ID. This will save some memory in the case that the routes are received anyway from C.

9 8. Security and BGP (8p) You have the AS topology as shown in the figure and are announcing /20. Of this network /24 and /24 are assigned to your customers AS4 and AS5. The nearby topology looks like the following picture, where a an arrow points towards an AS providing transit for another. For example, AS50 provides transit for AS2, AS 100 and AS 2 provides transit for each other and AS1 and AS2 are peering. Transit providers accept announcements for customer AS (including underlying AS). Customers are expected to announce their AS and all their customers upwards. Peers are expected only to peer their own

10 networks and their customer networks. Updates from a peer are not reannounced. 1. Explain how you would setup prefix filters and packet filters in AS1 in this configuration? You can assume you know the prefixes owned by each AS in the map from RIPE or a similar database. (2p) Prefix filters: Filter incoming prefixes from AS 5, 4, 3, and 2 to make sure they only contain addresses owned by these AS. Accept all prefixes from as 100 and AS 40. Packet filters: Filter incoming traffic from AS 5,4,3 and 2 to make sure the origin adress of all packets is set the origin AS. Allow all origin addresses on traffic from AS 40 and AS 100. Filter incoming traffic from AS 40, 2, 100 and 3 to make sure the destination address is in AS 1, 4 or 5. Allow any destination adress in traffic received from AS 4 or 5. An attacker has taken control of all the BGP routers in another AS and is targeting your AS. 2. (Blackholing) The attacker is in AS3. Explain how he can redirect as much of your traffic as possible to AS3 and drop it. Also explain which AS will be impacted by this attack and which AS are safe. (1p) Deaggregate the /20 and announce it towards AS 4 and AS 100. All traffic from all AS and Internet, except for AS 5 (Route filters in AS 1) will be blackholed. 3. (Redirection) The attacker is in AS2. Explain how he can redirect all your internet traffic to come over AS60, 70, 80, 90, 100 instead of the shortest path (AS10, 20, 30, 40). (1p) Deaggregate the /20 and announce it towards AS 50. Make sure AS 70 and AS 10 are both in the AS-Path. These prefixes will win in AS 20 but not be announced into AS 70 or AS 10, preventing traffic from transiting AS 20. Therefore the traffic will take the longer path instead. 4. (Subversion) The attacker is in AS2. Explain how he can force your traffic to transit AS2 and then enter your AS from one of your Transit providers. Also explain which methods he can use to make it harder to detect this attack using tools such as traceroute. (1p) The attacker can use any method to attract traffic to AS 2 (for example deaggregation again and announcing towards AS 50). Then the attacker

11 resets the TTL to make it harder to detect the attack, depending on the path he expects the traffic to have taken. Finally he sets AS 100 as the next hop, letting this AS deliver the traffic to AS (Instability) The attacker is in AS90. Explain how he can disturb your routing and cause outages for you. Also explain which AS you think his attack will impact. (1p) The attacker can simply use remote flapping by announcing and withdrawing your prefix regularly, either causing route dampening or simply causing route churn. The attack can impact the whole network. 6. Explain how SBGP or SoBGP (choose one) can prevent each of these attacks. You may assume that the security framework is completely implemented and that all AS are using it. (2p) Blackholing: Both SBGP and SoBGP prevents the deaggregation and similar attacks attracting traffic to the wrong AS by using cryptography to bind the origin AS and prefix togeather. Redirection: Deaggregation and modifications to the AS Path to add AS 70 and 10 are not possible due to the protection for the origin and the signed AS path. Subversion: SBGP and SoBGP prevents the traffic from being attracted to the wrong AS. However, they do not offer any protection for the actual traffic, so modifying the TTL is still possible. Instability: SBGP and SoBGP offers no protection against the instability attack; actually they might make it worse by the much larger overhead for the route calculations.

12 9. 4-byte AS numbers (3p) Establishing new independent AS:s have grown rapidly in recent years. This has resulted in a shortage of AS numbers. Therefore longer, 4-byte, AS-numbers have been standardized and added as a new capability in BGP. This new capability is currently being deployed in the Internet. An issue with this deployment is how to handle old implementations that do not handle 4-byte AS. Explain how this has been solved in the case of the AS-PATH attribute. That is, how can old AS_PATHs with only 2-byte AS numbers co-exist with new AS_PATHs which allow 4-byte AS numbers? My introducing a new AS4_PATH attribute (optional transitive). A new speaker (one that understands 4-byte ASNs) uses this attribute to tunnel the AS-PATH including true 4-byte ASN's over old speakers that do not have this feature. At the same time, the regular AS_PATH attribute is rewritten so that all 4-byte ASNs are replaced with the ASN When an old speaker speaks to a new speaker, the new speaker merges AS4_PATH and AS_PATH by replacing all occurences of in AS_PATH with the true 4-byte ASNs in AS4_PATH. The AS4_PATH is not used between new speakers (or internally in new speakers). 10.VPNs (3p) A VPN (Virtual Private Network) comes in many variants. In this course we have studied provider-based VPNs, and we have labbed both L2VPNs (actually the correct term is VPWS for Virtual Private Wire Service) and L3VPNs. 1. In L3VPN, a border router (PE-router) exchange routes with a customer router (CE-router)? Which routing protocol(s) is used for CE-PE routing? (1p) Virtually any routing protocol can be used for CE-PE routing as long as it can convey IP routes between PE and CE. Popular routing protocols for this purpose are BGP (EBGP not IBGP) and RIP. Linkstate protocols are less suitable since they transfer the whole customer topology to the PE. 2. What mechanism in the routers are used to isolate the customer routing tables from global and other customer routing tables? (1p) Routing instances or VRFs are used to host separate routing tables used by customer routes and global routes. 3. When customer routes are exported into the main L3VPN routing table, how are the customer routes made unique? (1p) They are made unique by prepending the route distinguisher for that VRF to the IPv4 prefix and by using an extended VPN address family. The route distinguisher is chosen to be unique for that VRF either by ASN:NUMBER or Ipv4addr:NUMBER.