BGP filtering study resources (Was: CloudFlare issues?)
Dear Stephen, On Tue, Jun 25, 2019 at 07:04:12AM -0700, Stephen Satchell wrote:
On 6/25/19 2:25 AM, Katie Holly wrote:
Disclaimer: As much as I dislike Cloudflare (I used to complain about them a lot on Twitter), this is something I am absolutely agreeing with them. Verizon failed to do the most basic of network security, and it will happen again, and again, and again...
I used to be a quality control engineer in my career, so I have a question to ask from the perspective of a QC guy: what is the Best Practice for minimizing, if not totally preventing, this sort of problem? Is there a "cookbook" answer to this?
(I only run edge networks now, and don't have BGP to worry about. If my current $dayjob goes away -- they all do -- I might have to get back into the BGP game, so this is not an idle query.)
Somehow "just be careful and clueful" isn't the right answer.
Here are some resources which maybe can serve as a starting point for anyone interested in the problem space: presentation: Architecting robust routing policies pdf: https://ripe77.ripe.net/presentations/59-RIPE77_Snijders_Routing_Policy_Arch... video: https://ripe77.ripe.net/archive/video/Job_Snijders-B._BGP_Policy_Update-2018... presentation: Practical Everyday BGP filtering "Peerlocking" pdf: http://instituut.net/~job/NANOG67_NTT_peerlocking_JobSnijders.pdf video: https://www.youtube.com/watch?v=CSLpWBrHy10 RFC 8212 ("EBGP default deny") and why we should ask our vendors like Cisco IOS, IOS XE, NX-OS, Juniper, Arista, Brocade, etc... to be compliant with this RFC: slides 2-14: http://largebgpcommunities.net/presentations/ITNOG3-Job_Snijders_Recent_BGP_... skip to the rfc8212 part: https://youtu.be/V6Wsq66-f40?t=854 compliance tracker: http://github.com/bgp/RFC8212 The NLNOG Day in Fall 2018 has a wealth of RPKI related presentations and testimonies: https://nlnog.net/nlnog-day-2018/ Finally, there is the NLNOG BGP Filter Guide: http://bgpfilterguide.nlnog.net/ If you spot errors or have suggestions, please submit them via github https://github.com/nlnog/bgpfilterguide Please let me or the group know should you require further information, I love talking about this topic ;-) Kind regards, Job
Job also enjoys having his ID checked. Can we get a best practices link added to the list for that? On Tue, Jun 25, 2019 at 10:27 AM Job Snijders <job@ntt.net> wrote:
Dear Stephen,
On Tue, Jun 25, 2019 at 07:04:12AM -0700, Stephen Satchell wrote:
On 6/25/19 2:25 AM, Katie Holly wrote:
Disclaimer: As much as I dislike Cloudflare (I used to complain about them a lot on Twitter), this is something I am absolutely agreeing with them. Verizon failed to do the most basic of network security, and it will happen again, and again, and again...
I used to be a quality control engineer in my career, so I have a question to ask from the perspective of a QC guy: what is the Best Practice for minimizing, if not totally preventing, this sort of problem? Is there a "cookbook" answer to this?
(I only run edge networks now, and don't have BGP to worry about. If my current $dayjob goes away -- they all do -- I might have to get back into the BGP game, so this is not an idle query.)
Somehow "just be careful and clueful" isn't the right answer.
Here are some resources which maybe can serve as a starting point for anyone interested in the problem space:
presentation: Architecting robust routing policies pdf: https://ripe77.ripe.net/presentations/59-RIPE77_Snijders_Routing_Policy_Arch... video: https://ripe77.ripe.net/archive/video/Job_Snijders-B._BGP_Policy_Update-2018...
presentation: Practical Everyday BGP filtering "Peerlocking" pdf: http://instituut.net/~job/NANOG67_NTT_peerlocking_JobSnijders.pdf video: https://www.youtube.com/watch?v=CSLpWBrHy10
RFC 8212 ("EBGP default deny") and why we should ask our vendors like Cisco IOS, IOS XE, NX-OS, Juniper, Arista, Brocade, etc... to be compliant with this RFC: slides 2-14: http://largebgpcommunities.net/presentations/ITNOG3-Job_Snijders_Recent_BGP_... skip to the rfc8212 part: https://youtu.be/V6Wsq66-f40?t=854 compliance tracker: http://github.com/bgp/RFC8212
The NLNOG Day in Fall 2018 has a wealth of RPKI related presentations and testimonies: https://nlnog.net/nlnog-day-2018/
Finally, there is the NLNOG BGP Filter Guide: http://bgpfilterguide.nlnog.net/ If you spot errors or have suggestions, please submit them via github https://github.com/nlnog/bgpfilterguide
Please let me or the group know should you require further information, I love talking about this topic ;-)
Kind regards,
Job
https://www.nccoe.nist.gov/projects/building-blocks/secure-inter-domain-rout... Timothy A Battles Chief Security Office 314-280-4578 tb2848@att.com<mailto:tb2848@att.com> 12976 Hollenberg Dr Bridgeton, MO 63044 The information contained in this e-mail, including any attachment(s), is intended solely for use by the named addressee(s). If you are not the intended recipient, or a person designated as responsible for delivering such messages to the intended recipient, you are not authorized to disclose, copy, distribute or retain this message, in whole or in part, without written authorization from the sender. This e-mail may contain proprietary, confidential or privileged information. If you have received this message in error, please notify the sender immediately. From: NANOG <nanog-bounces@nanog.org> On Behalf Of Tom Beecher Sent: Tuesday, June 25, 2019 9:42 AM To: Job Snijders <job@ntt.net> Cc: NANOG <nanog@nanog.org> Subject: Re: BGP filtering study resources (Was: CloudFlare issues?) Job also enjoys having his ID checked. Can we get a best practices link added to the list for that? On Tue, Jun 25, 2019 at 10:27 AM Job Snijders <job@ntt.net<mailto:job@ntt.net>> wrote: Dear Stephen, On Tue, Jun 25, 2019 at 07:04:12AM -0700, Stephen Satchell wrote:
On 6/25/19 2:25 AM, Katie Holly wrote:
Disclaimer: As much as I dislike Cloudflare (I used to complain about them a lot on Twitter), this is something I am absolutely agreeing with them. Verizon failed to do the most basic of network security, and it will happen again, and again, and again...
I used to be a quality control engineer in my career, so I have a question to ask from the perspective of a QC guy: what is the Best Practice for minimizing, if not totally preventing, this sort of problem? Is there a "cookbook" answer to this?
(I only run edge networks now, and don't have BGP to worry about. If my current $dayjob goes away -- they all do -- I might have to get back into the BGP game, so this is not an idle query.)
Somehow "just be careful and clueful" isn't the right answer.
Here are some resources which maybe can serve as a starting point for anyone interested in the problem space: presentation: Architecting robust routing policies pdf: https://ripe77.ripe.net/presentations/59-RIPE77_Snijders_Routing_Policy_Architecture.pdf<https://urldefense.proofpoint.com/v2/url?u=https-3A__ripe77.ripe.net_presentations_59-2DRIPE77-5FSnijders-5FRouting-5FPolicy-5FArchitecture.pdf&d=DwMFaQ&c=LFYZ-o9_HUMeMTSQicvjIg&r=B3FumFykkOB2Dwz5qxjHsw&m=7spUlDmAq8LEqZ2qtr0yGE_POLHSLNqM_kfbfRguxqs&s=ODEpNYQM3Oxc67pj6eCdvHWgPf1En0HiyjOkMG_Yfeg&e=> video: https://ripe77.ripe.net/archive/video/Job_Snijders-B._BGP_Policy_Update-20181017-140440.mp4<https://urldefense.proofpoint.com/v2/url?u=https-3A__ripe77.ripe.net_archive_video_Job-5FSnijders-2DB.-5FBGP-5FPolicy-5FUpdate-2D20181017-2D140440.mp4&d=DwMFaQ&c=LFYZ-o9_HUMeMTSQicvjIg&r=B3FumFykkOB2Dwz5qxjHsw&m=7spUlDmAq8LEqZ2qtr0yGE_POLHSLNqM_kfbfRguxqs&s=SOfM7pQuVvA0h-tSkmBwJwQ0t36KgX-SwZnXRZqZvfc&e=> presentation: Practical Everyday BGP filtering "Peerlocking" pdf: http://instituut.net/~job/NANOG67_NTT_peerlocking_JobSnijders.pdf<https://urldefense.proofpoint.com/v2/url?u=http-3A__instituut.net_-7Ejob_NANOG67-5FNTT-5Fpeerlocking-5FJobSnijders.pdf&d=DwMFaQ&c=LFYZ-o9_HUMeMTSQicvjIg&r=B3FumFykkOB2Dwz5qxjHsw&m=7spUlDmAq8LEqZ2qtr0yGE_POLHSLNqM_kfbfRguxqs&s=IPGjlZCNVY3OwZaPbNPfKH4oYVbujIe2B274fgZ3Y08&e=> video: https://www.youtube.com/watch?v=CSLpWBrHy10<https://urldefense.proofpoint.com/v2/url?u=https-3A__www.youtube.com_watch-3Fv-3DCSLpWBrHy10&d=DwMFaQ&c=LFYZ-o9_HUMeMTSQicvjIg&r=B3FumFykkOB2Dwz5qxjHsw&m=7spUlDmAq8LEqZ2qtr0yGE_POLHSLNqM_kfbfRguxqs&s=AxMa0NAWJUjT1xn73vv5I7E5SwECQF6RV9_kKFiOdZ4&e=> RFC 8212 ("EBGP default deny") and why we should ask our vendors like Cisco IOS, IOS XE, NX-OS, Juniper, Arista, Brocade, etc... to be compliant with this RFC: slides 2-14: http://largebgpcommunities.net/presentations/ITNOG3-Job_Snijders_Recent_BGP_Innovations.pdf<https://urldefense.proofpoint.com/v2/url?u=http-3A__largebgpcommunities.net_presentations_ITNOG3-2DJob-5FSnijders-5FRecent-5FBGP-5FInnovations.pdf&d=DwMFaQ&c=LFYZ-o9_HUMeMTSQicvjIg&r=B3FumFykkOB2Dwz5qxjHsw&m=7spUlDmAq8LEqZ2qtr0yGE_POLHSLNqM_kfbfRguxqs&s=ah2RTfckZ-s51fkzT7gk9L3_aN44yhGl3clLE2CXI7w&e=> skip to the rfc8212 part: https://youtu.be/V6Wsq66-f40?t=854<https://urldefense.proofpoint.com/v2/url?u=https-3A__youtu.be_V6Wsq66-2Df40-3Ft-3D854&d=DwMFaQ&c=LFYZ-o9_HUMeMTSQicvjIg&r=B3FumFykkOB2Dwz5qxjHsw&m=7spUlDmAq8LEqZ2qtr0yGE_POLHSLNqM_kfbfRguxqs&s=_Hs_rZFkuPNN3sy6QRMeqhxsIcV2lxVKlkBbzNKNSx4&e=> compliance tracker: http://github.com/bgp/RFC8212<https://urldefense.proofpoint.com/v2/url?u=http-3A__github.com_bgp_RFC8212&d=DwMFaQ&c=LFYZ-o9_HUMeMTSQicvjIg&r=B3FumFykkOB2Dwz5qxjHsw&m=7spUlDmAq8LEqZ2qtr0yGE_POLHSLNqM_kfbfRguxqs&s=mhk4WCxGewj26dk7ZG5tTg0EoNDieX0MTQuR0tJp-uk&e=> The NLNOG Day in Fall 2018 has a wealth of RPKI related presentations and testimonies: https://nlnog.net/nlnog-day-2018/<https://urldefense.proofpoint.com/v2/url?u=https-3A__nlnog.net_nlnog-2Dday-2D2018_&d=DwMFaQ&c=LFYZ-o9_HUMeMTSQicvjIg&r=B3FumFykkOB2Dwz5qxjHsw&m=7spUlDmAq8LEqZ2qtr0yGE_POLHSLNqM_kfbfRguxqs&s=Uk93fuwAFjJ2Ocj73of67i8Wx9nDeKqItDyruxiGD7A&e=> Finally, there is the NLNOG BGP Filter Guide: http://bgpfilterguide.nlnog.net/<https://urldefense.proofpoint.com/v2/url?u=http-3A__bgpfilterguide.nlnog.net_&d=DwMFaQ&c=LFYZ-o9_HUMeMTSQicvjIg&r=B3FumFykkOB2Dwz5qxjHsw&m=7spUlDmAq8LEqZ2qtr0yGE_POLHSLNqM_kfbfRguxqs&s=trF2hXsOk-udqpBeDzEohsEbiqlhQnWvE7MTc6YW8IE&e=> If you spot errors or have suggestions, please submit them via github https://github.com/nlnog/bgpfilterguide<https://urldefense.proofpoint.com/v2/url?u=https-3A__github.com_nlnog_bgpfilterguide&d=DwMFaQ&c=LFYZ-o9_HUMeMTSQicvjIg&r=B3FumFykkOB2Dwz5qxjHsw&m=7spUlDmAq8LEqZ2qtr0yGE_POLHSLNqM_kfbfRguxqs&s=UCVkxMzvBtcw1tft2JQp9Oxpg5W0shcYB3CIznr69zo&e=> Please let me or the group know should you require further information, I love talking about this topic ;-) Kind regards, Job
For further community-driven RPKI information there is: https://rpki.readthedocs.io/ Along with an FAQ: https://rpki.readthedocs.io/en/latest/about/faq.html Cheers, -Alex
On 25 Jun 2019, at 17:55, BATTLES, TIM <tb2848@att.com> wrote:
https://www.nccoe.nist.gov/projects/building-blocks/secure-inter-domain-rout...
Timothy A Battles Chief Security Office 314-280-4578 tb2848@att.com 12976 Hollenberg Dr Bridgeton, MO 63044
The information contained in this e-mail, including any attachment(s), is intended solely for use by the named addressee(s). If you are not the intended recipient, or a person designated as responsible for delivering such messages to the intended recipient, you are not authorized to disclose, copy, distribute or retain this message, in whole or in part, without written authorization from the sender. This e-mail may contain proprietary, confidential or privileged information. If you have received this message in error, please notify the sender immediately.
From: NANOG <nanog-bounces@nanog.org> On Behalf Of Tom Beecher Sent: Tuesday, June 25, 2019 9:42 AM To: Job Snijders <job@ntt.net> Cc: NANOG <nanog@nanog.org> Subject: Re: BGP filtering study resources (Was: CloudFlare issues?)
Job also enjoys having his ID checked. Can we get a best practices link added to the list for that?
On Tue, Jun 25, 2019 at 10:27 AM Job Snijders <job@ntt.net> wrote: Dear Stephen,
On Tue, Jun 25, 2019 at 07:04:12AM -0700, Stephen Satchell wrote:
On 6/25/19 2:25 AM, Katie Holly wrote:
Disclaimer: As much as I dislike Cloudflare (I used to complain about them a lot on Twitter), this is something I am absolutely agreeing with them. Verizon failed to do the most basic of network security, and it will happen again, and again, and again...
I used to be a quality control engineer in my career, so I have a question to ask from the perspective of a QC guy: what is the Best Practice for minimizing, if not totally preventing, this sort of problem? Is there a "cookbook" answer to this?
(I only run edge networks now, and don't have BGP to worry about. If my current $dayjob goes away -- they all do -- I might have to get back into the BGP game, so this is not an idle query.)
Somehow "just be careful and clueful" isn't the right answer.
Here are some resources which maybe can serve as a starting point for anyone interested in the problem space:
presentation: Architecting robust routing policies pdf: https://ripe77.ripe.net/presentations/59-RIPE77_Snijders_Routing_Policy_Arch... video: https://ripe77.ripe.net/archive/video/Job_Snijders-B._BGP_Policy_Update-2018...
presentation: Practical Everyday BGP filtering "Peerlocking" pdf: http://instituut.net/~job/NANOG67_NTT_peerlocking_JobSnijders.pdf video: https://www.youtube.com/watch?v=CSLpWBrHy10
RFC 8212 ("EBGP default deny") and why we should ask our vendors like Cisco IOS, IOS XE, NX-OS, Juniper, Arista, Brocade, etc... to be compliant with this RFC: slides 2-14: http://largebgpcommunities.net/presentations/ITNOG3-Job_Snijders_Recent_BGP_... skip to the rfc8212 part: https://youtu.be/V6Wsq66-f40?t=854 compliance tracker: http://github.com/bgp/RFC8212
The NLNOG Day in Fall 2018 has a wealth of RPKI related presentations and testimonies: https://nlnog.net/nlnog-day-2018/
Finally, there is the NLNOG BGP Filter Guide: http://bgpfilterguide.nlnog.net/ If you spot errors or have suggestions, please submit them via github https://github.com/nlnog/bgpfilterguide
Please let me or the group know should you require further information, I love talking about this topic ;-)
Kind regards,
Job
participants (4)
-
Alex Band -
BATTLES, TIM -
Job Snijders -
Tom Beecher