BGPSec Interoperability Test QuaggaSRx and BIRD bgpsec IETF 97 - PowerPoint PPT Presentation

BGPSec Interoperability Test QuaggaSRx and BIRD bgpsec IETF 97 Trustworthy Networking Program Seoul, South Korea Nov. 17, 2016 Oliver Borchert (oliver.borchert@nist.gov) NaNonal InsNtute of Standards and Technology 1

Tested Systems: QuaggaSRx BGPSEC-IO* (hUps://bgpsrx.antd.nist.gov) Trustworthy Networking Program BIRD bgpsec (hUps://bgpsrx.antd.nist.gov) *BGPSEC Traffic Generator 2

Topology Scenario S1 AS10 AS20 AS30 AS40 AS50 QuaggaSRx BIRD bgpsec BIRD bgpsec QuaggaSRx QuaggaSRx 10.10.0.0/16 10.10.1.0/24 Trustworthy Networking Program 10.10.2.0/24 AS100 ROA’s BGPSEC-IO 10.10.0.0/16-24, 10 10.10.0.0/16 10.10.1.0/24 10.10.2.0/24 AS100 aUempts to hijack the traffic of AS10 3

StarNng AS 10, 20, 30, 40, 50 Trustworthy Networking Program 4

StarNng AS 10, 20, 30, 40, 50 Trustworthy Networking Program 5

Trustworthy Networking Program Switching to AS40 6

Trustworthy Networking Program Switching to AS40 7

Adding Traffic using BGPSEC-IO Trustworthy Networking Program 8

Adding Traffic using BGPSEC-IO Trustworthy Networking Program 9

Adding Traffic using BGPSEC-IO RPKI Origin ValidaNon BGPSEC Path ValidaNon Trustworthy Networking Program 10

Result • The Prefix Hijack was unsuccessful: Trustworthy Networking Program – Announced prefixes passed path validaNon – Announcement failed RPKI origin valida-on • Policy is prefer valid – no switch to shorter invalid route 11

Topology Scenario S2 AS10 AS20 AS30 AS40 AS50 QuaggaSRx BIRD bgpsec BIRD bgpsec QuaggaSRx QuaggaSRx 10.10.0.0/16 10.10.1.0/24 Trustworthy Networking Program 10.10.2.0/24 AS10 AS100 ROA’s BGPSEC-IO 10.10.0.0/16-24, 10 10.10.0.0/16 10.10.1.0/24 10.10.2.0/24 AS100 aUempts to hijack the traffic of AS10 by pre-pending AS10 12

RestarNng Traffic using BGPSEC-IO Trustworthy Networking Program 13

RestarNng Traffic using BGPSEC-IO Trustworthy Networking Program 14

RestarNng Traffic using BGPSEC-IO RPKI Origin ValidaNon BGPSEC Path ValidaNon Trustworthy Networking Program 15

Result • The Prefix Hijack was unsuccessful: Trustworthy Networking Program – Announced prefixes failed path valida-on – Announcement passed RPKI origin validaNon • Policy is prefer valid – no switch to shorter invalid route 16

QuesNons ? Trustworthy Networking Program oliver.borchert@nist.gov NaNonal InsNtute of Standards and Technology 17