Benefits of Using RIPE Routing Registry and Related RIPE NCC Tools - PowerPoint PPT Presentation

Benefits of Using RIPE Routing Registry and Related RIPE NCC Tools TELFOR, 24 November 2004 Vesna Manojlovic RIPE NCC Training Services TELFOR, November 2004, Belgrade . RIPE Routing Registry . 1 http://www.ripe.net/

Overview • Intro: RIPE and RIPE NCC • Why document routing policy • RPSL • IRRToolset • Day-to-day Usage of the RR • RIS TELFOR, November 2004, Belgrade . RIPE Routing Registry . 2 http://www.ripe.net/

Intro: RIPE and RIPE NCC • Réseaux IP Européens (1989) – Collaborative, open community of Internet operators and administrators – Working groups: DB, Routing; EOF (eqv. to NANOG), etc • RIPE Network Coordination Centre (1992) – Independent not-for-profit membership organisation – One of 4 Regional Internet Registries – Member services: distributing IP addresses, ASN, reverse DNS delegation, training courses – Public services: whois DB, K-root, ENUM, RIPE support etc TELFOR, November 2004, Belgrade . RIPE Routing Registry . 3 http://www.ripe.net/

Intro: RIPE whois Database & the IRR • Public Network Management Database – “whois” info about networks & contact data • Routing Registry - a subset of the RIPE DB – contains routing information, in RPSL • RIPE RR is part of the I nternet R outing R egistry: – http://www.irr.net/ – Distributed databases that mirror each other – IRR = RIPE DB + RADB + Savvis (ex C&W) + ARIN + … TELFOR, November 2004, Belgrade . RIPE Routing Registry . 4 http://www.ripe.net/

Intro: Why Document Routing Policy? • Recreate your policy in case of loss of hardware / administrators – Less downtime • Scaling • Troubleshooting TELFOR, November 2004, Belgrade . RIPE Routing Registry . 5 http://www.ripe.net/

Intro: Why Document in RPSL? • Abstract – Not vendor specific • Global AS view, not router specific • Established standard • Tools available – router configuration – expertise built into tools TELFOR, November 2004, Belgrade . RIPE Routing Registry . 6 http://www.ripe.net/

Intro: Why Document in IRR? • Required by some Transit Providers • Required by some Exchange Points • Allows peers to automatically update filters – For your announcements – Consistent information between neighbours • Good housekeeping TELFOR, November 2004, Belgrade . RIPE Routing Registry . 7 http://www.ripe.net/

Intro: Why Document in RIPE DB? • Convenience – inetnums already there – aut-num already there – maintainer already there – person objects already there • Database most likely used by your peers TELFOR, November 2004, Belgrade . RIPE Routing Registry . 8 http://www.ripe.net/

9 http://www.ripe.net/ . TELFOR, November 2004, Belgrade . RIPE Routing Registry RPSL

Routing Policy Specification Language • Object-oriented language – Structured whois DB objects • Describes things interesting for the routing policy – Routes, AS numbers… – Relations between BGP peers – Management responsibility • Established standard: – Routing Policy Specification Language (RFC-2622) – Routing Policy System Security (RFC-2725) – Using RPSL in Practice (RFC-2650) TELFOR, November 2004, Belgrade . RIPE Routing Registry . 10 http://www.ripe.net/

RPSL: Example aut-num Object aut-num: AS2001 import: from AS3000 action pref=30; accept ANY import: from AS4000 action pref=40; accept ANY export: to AS4000 action aspath.prepend(AS2001,AS2001); announce AS2001 export: to AS3000 announce AS2001 policy as-name: RRTEST-AS2001 descr: Customer of AS3000 & AS4000 supportive admin-c: JS2-RRTEST & contact tech-c: JS2-RRTEST information changed: john.smith@example.net 20040606 source: RIPE mnt-by: john-smith-MNT authentication mnt-routes: third-MNT & notification upd-to: john.smith@example.net mnt-nfy: rr-db-notifications@example.net TELFOR, November 2004, Belgrade . RIPE Routing Registry . 11 http://www.ripe.net/

RPSL: aut-num Attributes Syntax • import: – from <peering> [action <action>] accept <filter> • export: – to <peering> [action <action>] announce <filter> • <peering> = ASN ; as-set ; “ASN IP1 at IP2” • <filter> matches set of routes – ASN, as-sets, route-sets; – {0.0.0.0/0}; {1.2.3.4/19, 193.0.0.0/23} • Range operators: e.g. 192.0.2.0/24^+ – ANY ; PeerAS; AND, OR, NOT • AS-path filters: regular expressions (i.e. <…>) import: from AS4003 accept <^AS4003+AS4003:AS-customers*$> TELFOR, November 2004, Belgrade . RIPE Routing Registry . 12 http://www.ripe.net/

RPSL: Simple Animated Example AS4000 AS2000 aut-num: AS2000 export: to AS4000 aut-num: AS4000 announce AS2000 import: from AS4000 import: from AS2000 accept AS2000 accept AS4000 export: to as2000 announce AS4000 TELFOR, November 2004, Belgrade . RIPE Routing Registry . 13 http://www.ripe.net/

RPSL: 2 nd Animated Example Internet aut-num: AS3000 AS3000 export: to AS2001 announce ANY AS4000 import: from AS2001 accept AS2001 AS2001 aut-num: AS2001 export: to AS4000 action aspath.prepend (AS2001, AS2001); announce AS2001 aut-num: AS4000 import: from AS3000 action pref=30; import: from AS2001 accept AS2001 accept ANY import: from AS4000 action pref=10; accept AS4000 export: to AS2001 announce AS4000 ANY export: to AS3000 announce AS2001 import: from AS4000 action pref=40; accept ANY TELFOR, November 2004, Belgrade . RIPE Routing Registry . 14 http://www.ripe.net/

RPLS: Localpref / prepend • Controlling the traffic flow: – for outbound traffic set the value of local-pref • “action pref=NN” in the “import” lines of aut-num object • the lower the “pref”, the more preferred the route – for inbound traffic, modify as-path length • “action aspath.prepend(ASN)” in the “export” lines • Longer the as-path, less preferred the route – Note: the direction of traffic is reverse from accepting / announcing routes TELFOR, November 2004, Belgrade . RIPE Routing Registry . 15 http://www.ripe.net/

RPSL: Multiple Links / MED • By setting the value of MED on export lines, the preferred entry point into your AS can be controlled export: to AS4044 at 10.3.0.1 action med=2000; announce AS3033 # less preferred, bigger MED export: to AS4044 at 10.3.0.2 action med=1000; announce AS3033 # more preferred, smaller MED • The neighbour must agree to honour your MED values – Instead of MED, it is possible to use as-path prepend on less preferred link • Controlling outbound traffic: import: from AS4 10.4.0.7 at 10.3.0.1 action pref=10; accept AS4 import: from AS4 10.4.0.8 at 10.3.0.1 action pref=20; accept AS4 TELFOR, November 2004, Belgrade . RIPE Routing Registry . 16 http://www.ripe.net/

RPSL: BGP Communities • Elegant solution for implementing policies • RFC-1998: An application of the BGP Community Attribute in Multi-home Routing • ISPs publish values of communities in the RR – E.g. to tell BT to prepend their ASN when announcing your routes to their peers: export: to 5400 action community = {5400:2073}; announce MY_ASN – E.g. to receive KPN NL routes on NL peering: import: from AS268 <ip-NL> action pref=10; accept AS286 AND community.contains (286:3031) TELFOR, November 2004, Belgrade . RIPE Routing Registry . 17 http://www.ripe.net/

RPSL: Security / Bogon Filtering • Problems: – Bogon address space used as source for spamming, DDoS, probes… – Leaking “martians” & bogons due to mis-configuration – Leaking other people’s ranges => black-holing them • Add “AND NOT fltr-bogons” to all your import and export attribute filter rules • Secure BGP Template – www.cymru.com/Documents/secure-bgp-template.html TELFOR, November 2004, Belgrade . RIPE Routing Registry . 18 http://www.ripe.net/

Outdated “bogon” Filters • Inverse problem: – Bogon filters in place, but not kept up-to-date – Consequence: when new /8 block is allocated to RIR / LIR, it is unreachable from networks with stale filters • Solution: – Use fltr-bogons instead your own manually updated list – Or: follow the lists where RIRs announce new /8 blocks • E.g. https://www.ripe.net/ripe/docs/smallest-alloc-sizes.html • E.g. www.ripe.net/ripe/draft-documents/deboganising-draft.html – Or: use bogon route server • (AS65333, community 65333:888)(e.g. cymru.com) => Keep your bogon filters up-to-date! TELFOR, November 2004, Belgrade . RIPE Routing Registry . 19 http://www.ripe.net/

RPSL: as-set Object Syntax • as-set objects for groups of aut-num-s • previously known as AS-MACRO – as-set : name starts with “AS-”; • hierarchical, using “asn:” (e.g. AS4000:AS-CUSTOMERS) – (direct) members : ASNs, or as-set-s – (indirect) mbrs-by-ref : <mntner-name> | ANY • Aut-num should have “member-of” to include itself in the as-set • In your aut-num point to as-set-s – export/import: to/from ASN announce/accept as-set – export/import: to/from as-set announce/accept <filter> • expression PeerAS loops through the list of members TELFOR, November 2004, Belgrade . RIPE Routing Registry . 20 http://www.ripe.net/