Subject: [OPSEC] Comments on draft-jdurand-bgp-security-02

From: David Freedman <[email-masked]>
Date: Thu, 27 Sep 2012 12:29:21 +0000

Sec 9.  Next-Hop Filtering

>In direct peerings between ISPs, this is undesirable,
>peers could trick the other one to send packets into
>a black hole

Trick? I think I would want to do this in particular
circumstances, when there is a DoS ongoing.
(yes, I'm aware there are community approaches, these
aren't widely adopted, this technique works for many
networks now and is quite invaluable to preserve).

What I wouldn't want however is for a peer to set a
next-hop as something internal to my network (I.e an
internal endpoint) which could enable them to manipulate
internal traffic (say, to steal a service by causing me to
route it internally).

>Therefore, the authors recommend to, by default, apply an inbound
>route policy to IXP peerings which sets the next-hop for accepted
>prefixes to the BGP peer that sent the prefix (which is what "next-
>hop-self" would enforce on the sending side, but you can not rely on
>the other party to always send correct information).

I'm not aware of any implementations which can achieve
this in a scalable way, are the authors? at present I
would have to statically configure a next hop for each peer,
not fun.

Also, are you aware that some networks inject the IXP
LAN into their IGP for the purposes of TE? (I.e leaving
the IXP LAN next hop present in their iBGP and then
doing MPLS TE on this LAN as opposed to next-hop-self
on the border where all peering networks are collapsed
into a single loopback)

Dave.

---

From: Gert Doering <[email-masked]>
Date: Thu, 27 Sep 2012 14:56:10 +0200

Hi,

> would have to statically configure a next hop for each peer,

Both Cisco and Juniper can do

route-map foo permit 10
  set ip(v6) next-hop peer-address

(dunno the exact Juniper syntax, but have been told it can be done)

DFN(680) stated on the DECIX list that the have been doing this on
Cisco "since ever" and it works.

> on the border where all peering networks are collapsed

Yeah, I did.  At some point.

Maybe we need to add a bit more language to the point of "if you
need to deviate from these recommendations, understand why you are
doing this, and then feel free to do so" (= "SHOULD" normative
language).

Gert Doering
        -- NetMaster
-- 
have you enabled IPv6 on something today...?

SpaceNet AG                        Vorstand: Sebastian v. Bomhard
Joseph-Dollinger-Bogen 14          Aufsichtsratsvors.: A. Grundner-Culemann
D-80807 Muenchen                   HRB: 136055 (AG Muenchen)
Tel: +49 (89) 32356-444            USt-IdNr.: DE813185279

---

From: "Ivan Pepelnjak" <[email-masked]>
Date: Sat, 29 Sep 2012 16:22:04 +0200

David,

On the IXP LAN prefix front, there's nothing in the draft saying you shouldn't propagate it (maybe even in deaggregated form) in your IGP. What it says is (or maybe I'm just reading it wrong):

* You MUST NOT accept more specific prefixes (for obvious reasons);
* If you do accept it, take care that the EBGP route doesn't become better than an IGP route (leading to recursive routing problems) or use next-hop-self;
* It MUST only be accepted from ASes authorized to announce it (OK, this one MAY use a rewording).
* Exact IXP LAN prefix (accepted from proper AS) SHOULD be propagated to downstreams for uRPF checks on pMTUd ICMP replies.

On the next-hop filtering (section 9), I agree we MUST mention use of EBGP next hops for RTBH, including a reference to RFC 6666.

Thanks again for the comments,
Ivan

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] On Behalf Of
> Gert Doering
> Sent: Thursday, September 27, 2012 2:56 PM
> To: David Freedman
> Cc: [email-masked]
> Subject: Re: [OPSEC] Comments on draft-jdurand-bgp-security-02
> 
> Hi,
> 
> > I'm not aware of any implementations which can achieve this in a
> > scalable way, are the authors? at present I would have to statically
> > configure a next hop for each peer, not fun.
> 
> DFN(680) stated on the DECIX list that the have been doing this on Cisco
> "since ever" and it works.
> 
> > Also, are you aware that some networks inject the IXP LAN into their
> > IGP for the purposes of TE? (I.e leaving the IXP LAN next hop present
> > in their iBGP and then doing MPLS TE on this LAN as opposed to
> > next-hop-self on the border where all peering networks are collapsed
> > into a single loopback)
> 
> Maybe we need to add a bit more language to the point of "if you need to
> deviate from these recommendations, understand why you are doing this, and
> then feel free to do so" (= "SHOULD" normative language).
> 
> Gert Doering
>         -- NetMaster
> --
> _______________________________________________
> OPSEC mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/opsec