What are the threats at IXPs and how to protect your Internet - PowerPoint PPT Presentation

What are the threats at IXPs and how to protect your Internet architecture? Raphael Maunier raphael@acorus.net @rmaunier

What are the threats at IXPs and how to protect your Internet architecture? Why using IXPs to protect your Internet architecture against events or threats is a good idea? Raphael Maunier raphael@acorus.net @rmaunier

Unexpected event : IXPs instability This will happen again don’t worry !! IXPs may have software issues, this can result in bgp instability and affect your traffic !

Route leak ! Typo : We’ve all been there

How to minimise the impact ? • BGP Timers / filtering / Max pref : Adapt your router configuration : cartman@core99.th2.par# show routing-instances nainternet protocols bgp group ipv4-public-peering-as51706-franceix type external; description "Group ipv4 Public Peering FranceIX AS51706"; hold-time 15; /* Accept prefixes with route tagged for this IXP AS51706 */ import ipv4-public-peering-as51706-in; family inet { unicast { prefix-limit { maximum 50; teardown 90 idle-timeout 300; } } } • Ask All members to change their bgp config in order to reduce the default value of the timer ( RFC suggested value is 90 sec). We now have faster, better, stronger equipment, we can definitively change this ! • https://tools.ietf.org/html/bcp214

Traffic Flows

DDOS Attack https://techcrunch.com/2018/03/02/the-worlds-largest-ddos-attack-took-github-offline-for-less-than-tens-minutes/

How to address DDoS ?

IXPs will have a solution for you ! Upgrade or buy more ports https://www.franceix.net/en/solutions/pricing/ Non Full 10G/100G ports are a good alternative and provide more flexibility !

Blackholing https://www.franceix.net/en/technical/blackholing/

Buy a DDoS Mitigation service J

Another Threat : BGP Hijacking

https://dyn.com/blog/bgp-hijack-of-amazon-dns-to-steal-crypto-currency/

The role of an IXP

Route Servers

Route servers http://peering.exposed/ "A route server is considered Secure if it performs IRR and/or RPKI based filtering on all participants, and BY DEFAULT does not propagate unfiltered routing information to anyone. [RFC 7948 section 4.3 / RFC 7454 section 6] »

Extract from Job Snijders’s presentation during EPF2018 (@ jobsnijders ) • IXPs – start doing RPKI Origin Validation on your route servers now • ISPs / CDNs • if you are pointing default somewhere, do it now • If your market is mostly West-Europe, do it now • If you are transit-free, wait a bit

• It’s possible to fight against threat on an IXP, an it’s easy ! • IXP have to be restrictive and have to implement more and more security by default, if not, don’t go there • All ASN should monitor their space (with Bgpmon for example) • As an industry, we have to/MUST start to secure our routing ! There is no room anymore for approximation : we have to start to deploy RPKI

Useful links • https://en.wikipedia.org/wiki/BGP_hijacking • https://blog.cloudflare.com/rpki-details/ • http://instituut.net/~job/routing_security_roadmap_EPF_2018_Snijd ers.pdf • Tools : • https://bgpmon.net/ • https://github.com/snar/bgpq3

T.HANKS T.Hanks a lot !