Internet2 Network Security SIG

[Michael Hare <>]

Specifically because I don't want an error in RTBH/flowspec land to tear down forwarding, I've chosen something like #2 in AS3128, for untrusted sessions (ie, not iBGP) rtbh/flowspec uses a separate multihop peering session to a local loopback IP on the router closest to the connector (for CoS reasons).

 

My rtbh/flowspec peering session uses import policy and flowspec validation; seems to be working fine for me.  I don't think I'm doing anything unusual and would be happy to share config snippets (JunOS) if desired.

 

To be transparent the number of connectors using this feature for us is exactly one and that connector is using exaBGP/fastnetmon fwiw, but I did test (at least once!) to make sure flowspec validation was working as expected.

 

-Michael

 

From: [mailto:] On Behalf Of Brad Fleming
Sent: Wednesday, May 23, 2018 12:04 PM
To:
Subject: Re: [Security-WG] BGP Flowspec guidance

 

I believe in some versions of Junos adding the flowspec family causes GRES and nonstop routing to fail for the session. So you take a hard reset on all address families in the event of a RE switchover. That might have been resolved in newer versions of Junos so might be a moot issue in your case.

 

An approach (not necessarily a good one) is stand up OoB BGP sessions that carry unicast and flowspec routes. it can do triage on received routes and perform validation. Then it can peer with your core but only exchange flowspec details. Again, not the prettiest solution but I think would check all the boxes.

--
Brad Fleming
Assistant Director for Technology
Kansas Research and Education Network
Office:            785-856-9805
Mobile:           785-865-7231
NOC:  785-856-9820

 

On May 23, 2018, at 11:13 AM, Karl Newell <> wrote:

 

As we make progress on our BGP flowspec testing and pilot, we’ll periodically ask this group for some guidance.  Our first question is related to BGP session/family establishment. 

 

Our preference is to add the flow family to our existing BGP sessions, so we can rely on flowspec validation (requires flowspec routes to align with best unicast routes).  We would like to set a peer max-prefix limit on the flow family; there is a maximum number of flowspec routes supported on the Juniper MX960.  If we use the existing BGP session, exceeding the flow max-prefix will tear down the session which tears down the unicast family as well.

 

One alternative is to use a separate session for flowspec.  We’ll need to disable flowspec validation and rely on peer prefix lists.

 

Options:

1. Use the existing BGP session, enable the flow family

1. Use a max-prefix limit such that normal behavior shouldn’t trip the threshold (caveat: we don’t know what normal behavior is) – maybe 100 flowspec routes?

                                                               i.      Clearly communicate max-prefix limit and its implications (possible unicast teardown)

                                                             ii.      Configure a limit without a teardown but a peer could send an excessive amount of flowspec routes

2. Set up a new BGP session and disable flowspec validation

1. Use existing peer prefix lists for validation

Thoughts, comments, questions?

Cheers,

Karl

 

--

Karl Newell

Cyberinfrastructure Security Engineer

Internet2

520-344-0459