Introduction to RPKI-Webinar-Slides · 2021. 2. 15. · RPKI Webinar 10 Internet Routing Registry...

Introduction to RPKI

RIPE NCC Learning & Development

Webinar

2

This webinar is being recorded

3

Agenda

Is BGP safe?

ROAs

Validation Tools

Validation

Is BGP safe?

RPKI Webinar 5

Routing on the Internet

A 193.x.x.x

B 194.x.x.x

RPKI Webinar 5


Routing table 194.x.x.x = B

A 193.x.x.x

B 194.x.x.x

B: “I have 194.x.x.x”

RPKI Webinar 5


“BGP protocol”


Routing table 193.x.x.x = A

A 193.x.x.x

B 194.x.x.x


A: “I have 193.x.x.x”

RPKI Webinar 5


“BGP protocol”Can I

trust B?



Is A correct?

A 193.x.x.x

B 194.x.x.x



RPKI Webinar 5


Can I trust B?



Is A correct?

A 193.x.x.x

B 194.x.x.x



RPKI Webinar 6


Can I trust B?



Is A correct?

A 193.x.x.x

B 194.x.x.x



RPKI Webinar 6


Can I trust B?



Is A correct?

A 193.x.x.x

B 194.x.x.x



RIPE Database

“Internet Routing Registry”

RPKI Webinar 6




Is A correct?

A 193.x.x.x

B 194.x.x.x



RIPE Database


RPKI Webinar 6




A 193.x.x.x

B 194.x.x.x



RIPE Database


RPKI Webinar 7

Accidents Happen

• Fat Fingers - 2 and 3 are really close on our keyboards….

• Policy Violations (leaks) - Oops, we did not want this to go on the public Internet

- Infamous incident with Pakistan Telecom and YouTube

RPKI Webinar 8

Or Worse….

• April 2018 - BGP and DNS Hijack

- Targeting MyEtherWallet

- Unnoticed for two hours

RPKI Webinar 9

Incidents Are Common

• 2019 Routing Security Review - 12,600 incidents

- 4,4% of all ASNs affected

- 3,000 ASNs are victims of at least one incident

- 1,300 ASNs caused at least one incident

Source: https://bgpstream.com

https://bgpstream.com

RPKI Webinar 10

Internet Routing Registry

• Many exist, most widely used - RIPE Database

- RADB

• Verification of holdership over resources - RIPE Database for RIPE Region resources only

- RADB allows paying customers to create any object

- Lots of the other IRRs do not formally verify holdership

RPKI Webinar 11

Problem Statement

• Some IRR data cannot be fully trusted - Accuracy

- Incomplete data

- Lack of maintenance

• Not every RIR has an IRR - Third party databases need to be used (RADB, Operators)

- No verification of who holds IPs/ASNs

RPKI Webinar 12

Resource Public Key Infrastructure

• Ties IP addresses and ASNs to public keys

• Follows the hierarchy of the registries

• Authorised statements from resource holders - “ASN X is authorised to announce my Prefix Y”

- Signed, holder of Y

RPKI Webinar 13

RPKI Chain of Trust

RIPE NCC Root Certificate

Self-signed

ALL Resources

Root’s private key

signature

public key

RPKI Webinar 14

RPKI Chain of Trust

LIR Certificate

Signed by the Root private key

LIR’s Resources

Root’s private key

signature

public key

RPKI Webinar 16

ROA (Route Origin Authorisation)

• A ROA is…

• LIRs can create a ROA for each one of their resources (IP address ranges)

• Multiple ROAs can be created for an IP range

• ROAs can overlap

RPKI Webinar 17

What is in a ROA ?

Prefix The network for which you are creating the ROA

RPKI Webinar 17

What is in a ROA ?


The ASN that’s supposed to be originating the BGP Announcement

Origin ASN

RPKI Webinar 17

What is in a ROA ?


The ASN that’s supposed to be originating the BGP Announcement

Origin ASN

Max Length

The Maximum prefix length accepted for this ROA

RPKI Webinar 18

RPKI Chain of Trust

ALL Resources

LIR’s Resources

Root’s private key signature

signature

public key

public key

RPKI Webinar 19

Route Origin Authorisation

Prefix

is authorised to be announced by

AS Number

LIR’s private key

ROA

signature

RPKI Webinar 20

RPKI Chain of Trust

ROA

signature

LIR’s Resources

signature

public key

ALL Resources

signature

public key

RPKI Webinar 21

Hosted RPKI• Automatic signing and key roll overs

- One click setup of resource certificate

- User has a valid and published certificate for as long as they are the holder of the resources

- All the complexity is handled by the hosted system

• Lets you focus on creating and publishing ROAs - Match your intended BGP configuration

RPKI Webinar 22

Delegated RPKI

• Run your own Certificate Authority - Dragon Research Labs, RPKI Toolkit

- NLnet Labs, Krill

• Setup connection with RIPE NCC CA

• Generate your LIR certificate and get it signed by parent CA

23

First login to the dashboard

RPKI Webinar 24

Creating ROAs

RPKI Webinar 25

Reviewing changes

RPKI Webinar 26

Checking the effects

RPKI Webinar 27

193.0.24.0/21 AS2121 Max Length: /21

ROA

RPKI Webinar 27

193.0.24.0/21 AS2121 Max Length: /21

ROA

193.0.24.0/21 !

RPKI Webinar

/23

27

193.0.24.0/21 AS2121 Max Length: /21

ROA

193.0.24.0/21

193.0.24.0/22 193.0.28.0/22 ✖✖

!

/23 /23 /23

/24 /24 /24 /24 /24 /24 /24 /24

RPKI Webinar

/23

27

193.0.24.0/21 AS2121 Max Length: /21

ROA

193.0.24.0/21

193.0.24.0/22 193.0.28.0/22

193.0.24.0/23 AS2121 Max Length: /24

ROA

✖✖

!

/23 /23 /23

/24 /24 /24 /24 /24 /24 /24 /24

RPKI Webinar

/23

27

193.0.24.0/21 AS2121 Max Length: /21

ROA

193.0.24.0/21

193.0.24.0/22 193.0.28.0/22

193.0.24.0/23 AS2121 Max Length: /24

ROA

✖✖

!

/23 /23 /23 /23

/24 /24 /24 /24 /24 /24 /24 /24/24 /24!

!

!

✖

✖ ✖

RPKI Webinar

/23

27

193.0.24.0/21 AS2121 Max Length: /21

ROA

193.0.24.0/21

193.0.24.0/22 193.0.28.0/22

193.0.24.0/23 AS2121 Max Length: /24

ROA193.0.30.0/23 AS2121 Max Length: /23

ROA

✖✖

!

/23 /23 /23 /23

/24 /24 /24 /24 /24 /24 /24 /24/24 /24!

!

!

✖

✖ ✖

RPKI Webinar

/23

27

193.0.24.0/21 AS2121 Max Length: /21

ROA

193.0.24.0/21

193.0.24.0/22 193.0.28.0/22

193.0.24.0/23 AS2121 Max Length: /24

ROA193.0.30.0/23 AS2121 Max Length: /23

ROA

✖✖

!

/23 /23 /23 /23/23

/24 /24 /24 /24 /24 /24 /24 /24/24 /24✖!

!

!

!✖

✖ ✖

✖

✖✖✖

RPKI Webinar 28

Take the poll! You have a ROA for 193.0.24.0/23 with max-length /24.

Which announcements will be “Valid”?

Validation Tools

RPKI Webinar 30


A 192.0.2.0/24

B 193.0.24.0/21

RPKI Webinar 30


Is A correct?

A 192.0.2.0/24

B 193.0.24.0/21

A: “I have 192.0.2.0/24”

BGP

RPKI Webinar 30


Is A correct?

A 192.0.2.0/24

B 193.0.24.0/21

A: “I have 192.0.2.0/24”

1. Create route authorisation record

(ROA)

RPKI RepositoryA is authorised to announce 192.0.2.0/24

BGP

RPKI Webinar 30


Is A correct?

A 192.0.2.0/24

B 193.0.24.0/21

A: “I have 192.0.2.0/24”


(ROA)

2. Validate route


BGP

RPKI Webinar 30


A 192.0.2.0/24

B 193.0.24.0/21

A: “I have 192.0.2.0/24”


(ROA)

2. Validate route


BGP

RPKI Webinar 31

RPKI Validators

• Software that creates a local “validated cache” with all the valid ROAs - Downloads the RPKI repository from the RIRs

- Validates the chain of trust of all the ROAs and associated CAs

- Talks to your routers using the RPKI-RTR Protocol

RPKI Webinar 32

Relying Party

RIPE NCC ARIN APNIC AFRINICLACNIC

Validator

RPKI Webinar 33

Relying Party

ROAAS111 10.0.7.30/22AS222 10.0.6.10/24AS333 10.4.17.5/20AS111 10.0.7.30/22AS111 10.0.7.30/22AS111 10.0.7.30/22

BGP Announcements

BETTER ROUTING DECISIONS

34

RPKI Validator Options

• RIPE NCC Validator 3.2

- Java based

• Routinator

- Built with Rust, built by NLNetlabs

• OctoRPKI

- Cloudflare’s Relying Party software, written in the Go

• Dragon Research Labs Validating Cache

- Written in Python

January 1, 2021 no new features!

July 1, 2021 end of support!

RPKI Webinar 35

RPKI-RTRROAs

ROAs

VALIDATOR SOFTWARE

Verification

Validated Cache

RPKI-RTR

ROUTERS

RIR REPOSITORIES

Validation

37

Validation

37

Validation

VALIDATOR

Rsync/RRDP

ROA ValidationRIR Repository

ROAs

Certificates

37

Validation

VALIDATOR

Rsync/RRDP


ROAs

Certificates

RPKI-RTR Validated Cache

AS 200AS 100

BGP Origin Validation

37

Validation

VALIDATOR

Rsync/RRDP


ROAs

Certificates

RPKI-RTR Validated Cache

38

ROA Validation

LIR’s Resources

signature

public key

ALL Resources

signature

public key

ROA

signature

39

BGP Prefix Origin Validation-RFC6811

AS 100

AS 200

VALIDATOR

RPKI-RTRROA

AS100 10.0.0.0/22

ROAs

39


AS 100

AS 200

VALIDATOR

RPKI-RTRROA

AS100 10.0.0.0/22

ROAs

10.0.0.0/22

39


AS 100

AS 200

VALIDATOR

RPKI-RTRROA

AS100 10.0.0.0/22

ROAs10.0.0.0/24

10.0.0.0/22

39


AS 100

AS 200

VALIDATOR

RPKI-RTRROA

AS100 10.0.0.0/22

ROAs

10.0.0.0/22

10.0.0.0/24

10.0.0.0/22

RPKI Webinar 40

• Routers receive data from the validated cache via RPKI-RTR

• Based on this and on BGP announcements, you have to make decisions - Accept or discard the BGP Announcement

- As temporary measure, you could influence other attributes, such as Local Preference

RPKI Webinar 41

ROAs

ROAs

ROA Validation

BGP Validation

VALID INVALID

VALID INVALID UNKNOWN

NOT FOUND

RPKI Webinar 42

Invalids

• Invalid ROA - The ROA in the repository cannot be validated by the client

(ISP) so it is not included in the validated cache

• Invalid BGP announcement - There is a ROA in validated cache for that prefix but for a

different AS.

- Or the max length doesn’t match.

• If no ROA in the cache then announcement is “unknown”

RPKI Webinar 43

Whitelisting

• If there is an invalid ROA for a network that’s important for you or your customers, you can whitelist it

• This is done on your local validator software - It creates a “fake” ROA for the resources you want

• It allows you to contact the operator to fix their ROA - Think of e-mail, contact forms, etc…

RPKI Webinar 44

How to whitelist

RPKI Webinar 45

Adding a whitelist entry

RPKI Webinar 46

Check your entries

RPKI Webinar 47

Take the poll!

RPKI Webinar 48

Where do we go from here ?

• RPKI is only one of the steps towards full BGP Validation - Paths are not validated

• We need more building blocks - BGPSec (RFC)

- ASPA (draft)

- AS-Cones (draft)

Questions

[email protected]

[email protected]

mailto:[email protected]

mailto:[email protected]

What did you think about this session? Take our survey at: https://www.ripe.net/support/training/feedback/rpki/view

50

We Want your Feedback!

51

Learn something new today!

academy.ripe.net

RIPE NCC Academy

RIPE NCC Learning & Development

Presentation Subtitle

Presentation Title

Type Of Session

https://www.ripe.net/certifiedprofessionals

LAUNCHING SOON

Fin

Ende

KpajKonec

Son

Fine

Pabaiga

Einde

Fim

Finis

Koniec

Lõpp

Kрай

SfârşitКонeц

KrajVége

Kiнець

Slutt

Loppu

Τέλος

Y Diwedd

Amaia Tmiem

Соңы

Endir

Slut

Liðugt

An Críoch

Fund

הסוף

Fí

ËnnFinvezh

The End!

Beigas

Introduction to RPKI-Webinar-Slides · 2021. 2. 15. · RPKI Webinar 10 Internet Routing Registry...

Documents

Transcript of Introduction to RPKI-Webinar-Slides · 2021. 2. 15. · RPKI Webinar 10 Internet Routing Registry...