Scribd Logo
Upload

Welcome to Scribd!

  • 28 views

    RPKI Workshop Routing Lab: NANOG / Denver

    Uploaded by

    Trần Hoàng Thông
    This document provides an overview of an RPKI router lab being conducted at NANOG in Denver in June 2011. It describes the network topology used in the lab including BGP feeds and IP address allocations. It also provides instructions for lab participants on accessing router and GUI accounts and configuring the routers to validate BGP routes using RPKI.

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd

    RPKI Workshop Routing Lab: NANOG / Denver

    Uploaded by

    Trần Hoàng Thông
    28 views26 pages
    This document provides an overview of an RPKI router lab being conducted at NANOG in Denver in June 2011. It describes the network topology used in the lab including BGP feeds and IP address allocations. It also provides instructions for lab participants on accessing router and GUI accounts and configuring the routers to validate BGP routes using RPKI.

    Original Title

    110612.nanog-jlab.pdf

    Copyright

    © © All Rights Reserved

    Available Formats

    PDF, TXT or read online from Scribd

    Did you find this document useful?

    Is this content inappropriate?

    This document provides an overview of an RPKI router lab being conducted at NANOG in Denver in June 2011. It describes the network topology used in the lab including BGP feeds and IP address allocations. It also provides instructions for lab participants on accessing router and GUI accounts and configuring the routers to validate BGP routes using RPKI.

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd
    Download as pdf or txt
    28 views26 pages

    RPKI Workshop Routing Lab: NANOG / Denver

    Uploaded by

    Trần Hoàng Thông
    This document provides an overview of an RPKI router lab being conducted at NANOG in Denver in June 2011. It describes the network topology used in the lab including BGP feeds and IP address allocations. It also provides instructions for lab participants on accessing router and GUI accounts and configuring the routers to validate BGP routes using RPKI.

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd
    Download as pdf or txt
    of 26

    RPKI Workshop

    Routing Lab
    NANOG / Denver
    2011.06.12

    Randy Bush <[email protected]>


    Michael Elkins <[email protected]>
    Rob Austein <[email protected]>
    Serpil Bayraktar <[email protected]>

    2011.06.12 RPKI Router Lab 1


    Lab Overview

    RCynic RPKI BGP


    django
    Gatherer Cache to Rtr Decision
    Protocol
    Process
    RPKI
    Engine
    Publication
    Protocol
    Repository Mgt RPKI
    Repo

    2011.06.12 RPKI Router Lab 2


    BGP Feeds into Lab
    AS65000 AS65001

    Global
    Internet

    98.128.0.0/16! 98.128.0.0/16!
    98.128.0.0/24! AS3130 AS4128 98.128.0.0/24!
    98.128.1.0/24! 98.128.1.0/24!
    …! …!
    98.128.31.0/24! 98.128.31.0/24!

    Seattle Dallas

    2011.06.12 RPKI Router Lab 3


    Junosphere Server
    10.0.0.0/8

    RPKI-Rtr AS65000 AS65001


    Protocol
    147.28.240.0/19

    Global
    RPKI Internet
    Cache
    98.128.0.0/16! 98.128.0.0/16!
    98.128.0.0/24! AS3130 AS4128 98.128.0.0/24!
    98.128.1.0/24! 98.128.1.0/24!
    …! …!
    98.128.31.0/24! 98.128.31.0/24!
    Seattle Dallas
    2011.06.12 RPKI Router Lab 4
    IP Address Allocation
    98.128.0.0/16 ARIN Experimental Alloc

    98.128.0.0/24 instructors play


    98.128.1.0/24 labuser01
    98.128.2.0/24 labuser02
    …
    98.128.32.0/24 labuser32
    2011.06.12 RPKI Router Lab 5
    GUI Accounts
    https://demo.rpki.net/

    UserID Password
    labuser01 fnord
    labuser02 fnord
    labuser03 fnord
    …
    labuser32 fnord
    2011.06.12 RPKI Router Lab 6
    2011.06.12 RPKI Router Lab 7
    One Prefix

    2011.06.12 RPKI Router Lab 8


    Issue a ROA

    2011.06.12 RPKI Router Lab 9


    Looks Good

    2011.06.12 RPKI Router Lab 10


    Router Accounts
    % ssh [email protected]
    (where xx is your UserID)

    [email protected]'s password: Juniper


    --- JUNOS 10.3I built 2011-06-04 02:59:04 UTC
    juniper@R1>

    2011.06.12 RPKI Router Lab 11


    Router Configuration
    •  BGP peerings etc. should be up
    •  AS 65000 – connected to b0 to Seattle
    •  AS 65001 – connected to b1 to Dallas

    •  Please confirm
    juniper@R1> show bgp summary | match ^10
    10.0.0.253 65000 … 1d 1:13:07 15/42/42/0 0/0/0/0
    10.0.0.254 65001 … 1d 1:12:38 27/41/41/0 0/0/0/0

    2011.06.12 RPKI Router Lab 12


    http://rpki.net/junos/jlab-routing.txt
    juniper@R1> show configuration routing-options | find validation
    validation {
    traceoptions {
    file rpki.log;
    flag all detail;
    flag error detail; }
    group test {
    session 198.180.150.1 {
    traceoptions {
    file r.log size 10m;
    flag error;
    flag state;
    flag packets; }
    refresh-time 120;
    hold-time 180;
    port 42420;
    local-address <ip-address of em0>;
    2011.06.12 RPKI Router Lab
    connect-retry 10; } } } 13
    Lab Cheat Sheets
    &
    JunOSphere Literature

    http://rpki.net/junos/

    2011.06.12 RPKI Router Lab 14


    http://rpki.net/junos/jlab-policy.txt
    juniper@R1> show configuration policy-options | find validation
    policy-statement route-validation {
    term valid {
    from {
    protocol bgp;
    validation-state valid; }
    then {
    local-preference 110;
    validation-state valid;
    accept;}}
    term invalid {
    from {
    protocol bgp;
    validation-state invalid; }
    then {
    local-preference 90;
    validation-state invalid;
    accept; } }
    term unknown {
    from {
    protocol bgp;
    validation-state unknown; }
    then {validation-state unknown;
    accept; } } }

    2011.06.12 RPKI Router Lab 15


    Apply the Policy
    juniper@r00> show configuration protocols
    bgp {
    import route-validation;
    group as65000 {
    local-address 10.0.0.102;
    export none;
    peer-as 65000;
    neighbor 10.0.0.253;
    }
    group as65001 {
    local-address 10.0.0.102;
    export none;
    peer-as 65001;
    neighbor 10.0.0.254;
    }
    }

    2011.06.12 RPKI Router Lab 16


    Check Server
    juniper@R1> show validation session brief
    Session 198.180.150.1, State: up
    Group: test, Preference: 100
    Port: 42420
    Refresh time: 120s
    Hold time: 180s
    Record Life time: 3600s
    Serial (Full Update): 1307272205
    Serial (Incremental Update): 1307272205
    IPv4 prefix count: 81
    IPv6 prefix count: 29

    2011.06.12 RPKI Router Lab 17


    Look at Table
    juniper@R1> show validation database brief
    RV database for instance master
    Total IPv4 records: 81
    Total IPv6 records: 29

    Prefix Origin Session State


    67.21.36.0/24-24 3970 198.180.150.1 valid
    98.128.0.0/16-16 3130 198.180.150.1 valid
    98.128.0.0/24-24 4128 198.180.150.1 valid
    98.128.1.0/24-24 3130 198.180.150.1 valid
    98.128.2.0/24-24 3130 198.180.150.1 valid
    98.128.3.0/24-24 4128 198.180.150.1 valid
    98.128.4.0/24-24 3130 198.180.150.1 valid
    98.128.5.0/24-24 3130 198.180.150.1 valid
    98.128.6.0/24-24 4128 198.180.150.1 valid
    98.128.7.0/24-24 3130 198.180.150.1 valid
    98.128.8.0/24-24 4128 198.180.150.1 valid
    2011.06.12 RPKI Router Lab 18
    Look at a Prefix
    juniper@R1> show route 98.128.1.0 detail

    98.128.1.0/24 (2 entries, 1 announced)


    *BGP Preference: 170/-111
    Source: 10.0.0.253
    ... Validation State: valid
    ... AS path: 65000 3130 I
    ... BGP Preference: 170/-101
    ... Source: 10.0.0.254
    ... Validation State: invalid
    ... AS path: 65001 4128 I

    2011.06.12 RPKI Router Lab 19


    Go Play
    With Policy

    2011.06.12 RPKI Router Lab 20


    Fat-Finger Detected
    show route 98.128.0.0/16 detail

    ROA
    98.128.0.0/16

    AS65000 AS65001

    AS 3130

    Global
    Internet

    AS3130 AS4128

    98.128.0.0/16! 98.128.0.0/16!

    Seattle Dallas
    2011.06.12 RPKI Router Lab 21
    Find [In]Valid Routes
    juniper@R1> show route validation-state invalid terse

    A V Destination ... AS path


    I 98.128.0.0/16 ... 65001 4128 I
    I 98.128.0.0/24 ... 65000 3130 I
    I 98.128.1.0/24 ... 65001 4128 I

    juniper@R1> show route validation-state valid terse

    A V Destination ... AS path


    * V 98.128.0.0/16 ... 65000 3130 I
    * V 98.128.0.0/24 ... 65001 4128 I
    * V 98.128.1.0/24 ... 65000 3130 I

    2011.06.12 RPKI Router Lab 22


    Clearing Sessions
    clear validation session <ip-address> \
    soft-inbound

    clear validation session <ip-address>

    Due to a bug, we have to soft clear sessions to


    get database changes

    2011.06.12 RPKI Router Lab 23


    ROA Controls Validity
    show route 98.128.0.0/16 detail

    ROA
    98.128.0.0/16

    AS65000 AS65001

    AS 4128

    Global
    Internet

    AS3130 AS4128

    98.128.0.0/16! 98.128.0.0/16!

    Seattle Dallas
    2011.06.12 RPKI Router Lab 24
    Try Your Own /24
    ROA show route 98.128.0.0/16 detail
    show route 98.128.x.0/24 detail
    98.128.0.0/16

    AS 4128

    ROA AS65000 AS65001

    98.128.X.0/24

    Global
    AS 3130 Internet

    AS3130 AS4128

    98.128.X.0/24! 98.128.X.0/24!

    2011.06.12 RPKI Router Lab 25


    LocalPref is Set
    juniper@R1> show route 98.128.0.0/24 detail

    98.128.0.0/24 (2 entries, 1 announced)


    *BGP Preference: 170/-111
    ... Source: 10.0.0.254
    ... Validation State: valid
    ... AS path: 65001 4128 I
    ... Localpref: 110
    ... BGP Preference: 170/-101
    ... Source: 10.0.0.253
    ... Validation State: invalid
    ... AS path: 65000 3130 I
    ... Localpref: 100
    2011.06.12 RPKI Router Lab 26

    You might also like