RPKI Deployment Status in Bangladesh
-
Upload
bangladesh-network-operators-group -
Category
Internet
-
view
184 -
download
3
Transcript of RPKI Deployment Status in Bangladesh
![Page 1: RPKI Deployment Status in Bangladesh](https://reader034.fdocuments.us/reader034/viewer/2022042906/58a1a8a41a28abe6468b5c9d/html5/thumbnails/1.jpg)
https://twitter.com/rapappuhttp://bd.linkedin.com/in/[email protected] Alam
RPKI Deployment Status in Bangladesh
![Page 2: RPKI Deployment Status in Bangladesh](https://reader034.fdocuments.us/reader034/viewer/2022042906/58a1a8a41a28abe6468b5c9d/html5/thumbnails/2.jpg)
Agenda
• Little background on BGP & RPKI
• Creating ROA
• RPKI Status in Bangladesh
![Page 3: RPKI Deployment Status in Bangladesh](https://reader034.fdocuments.us/reader034/viewer/2022042906/58a1a8a41a28abe6468b5c9d/html5/thumbnails/3.jpg)
BGP
![Page 4: RPKI Deployment Status in Bangladesh](https://reader034.fdocuments.us/reader034/viewer/2022042906/58a1a8a41a28abe6468b5c9d/html5/thumbnails/4.jpg)
BGP (AS)
Send a packet to 2001:DB8::1
I have 2001:DB8::/32
![Page 5: RPKI Deployment Status in Bangladesh](https://reader034.fdocuments.us/reader034/viewer/2022042906/58a1a8a41a28abe6468b5c9d/html5/thumbnails/5.jpg)
AS Path
AS 100 AS 300AS 200
Send a packet to 2001:DB8::1
I have 2001:DB8::/32
2001:DB8::/32 100 200 300 i
![Page 6: RPKI Deployment Status in Bangladesh](https://reader034.fdocuments.us/reader034/viewer/2022042906/58a1a8a41a28abe6468b5c9d/html5/thumbnails/6.jpg)
AS Path
AS 100 AS 300
Send a packet to 2001:DB8::1
I have 2001:DB8::/32
I have 2001:DB8::/48
AS 420
AS 200
2001:DB8::/32 100 200 300 i2001:DB8::/48 100 200 400 i
![Page 7: RPKI Deployment Status in Bangladesh](https://reader034.fdocuments.us/reader034/viewer/2022042906/58a1a8a41a28abe6468b5c9d/html5/thumbnails/7.jpg)
Current Trend
• Filtering limited to the edges facing the customer
• Filters on peering and transit sessions are often too complex or take too many resources
• Check prefix before announcing it
![Page 8: RPKI Deployment Status in Bangladesh](https://reader034.fdocuments.us/reader034/viewer/2022042906/58a1a8a41a28abe6468b5c9d/html5/thumbnails/8.jpg)
Filter Where?• Secure BGP Templates
• http://www.cymru.com/gillsr/documents/junos-bgp-template.htm
• https://www.team-cymru.org/ReadingRoom/Templates/secure-bgp-template.html
![Page 9: RPKI Deployment Status in Bangladesh](https://reader034.fdocuments.us/reader034/viewer/2022042906/58a1a8a41a28abe6468b5c9d/html5/thumbnails/9.jpg)
Internet Registry (IR)
• Maintains Internet Resources such as IP addresses and ASNs, and publish the registration information
• Allocations for Local Internet Registries
• Assignments for end-users
• APNIC is the Regional Internet Registry(RIR) in the Asia Pacific region
• National Internet Registry(NIR) exists in several economies
![Page 10: RPKI Deployment Status in Bangladesh](https://reader034.fdocuments.us/reader034/viewer/2022042906/58a1a8a41a28abe6468b5c9d/html5/thumbnails/10.jpg)
The Eco-System
National IR (NIR)
Internet Service Provider
End User
Regional IR (RIR)
![Page 11: RPKI Deployment Status in Bangladesh](https://reader034.fdocuments.us/reader034/viewer/2022042906/58a1a8a41a28abe6468b5c9d/html5/thumbnails/11.jpg)
Still not enough IRR is useful, but it’s not perfect
![Page 12: RPKI Deployment Status in Bangladesh](https://reader034.fdocuments.us/reader034/viewer/2022042906/58a1a8a41a28abe6468b5c9d/html5/thumbnails/12.jpg)
RPKI Resource Pubic Key Infrastructure
IP Address & AS Numbers Digital Certificate
![Page 13: RPKI Deployment Status in Bangladesh](https://reader034.fdocuments.us/reader034/viewer/2022042906/58a1a8a41a28abe6468b5c9d/html5/thumbnails/13.jpg)
RPKI Deployment
AS 100 AS 300AS 200
Phase 2Path ValidationSend a packet to
2001:DB8::1
I have 2001:DB8::/32
Phase 1Origin Validation
![Page 14: RPKI Deployment Status in Bangladesh](https://reader034.fdocuments.us/reader034/viewer/2022042906/58a1a8a41a28abe6468b5c9d/html5/thumbnails/14.jpg)
Goals of RPKI
• Able to authoritatively prove who owns an IP Prefix and what AS(s) may Announce It
• Reducing routing leaks
• Attaching digital certificates to network resources (AS Number & IP Address)
• Prefix Ownership Follows the Allocation Hierarchy IANA, RIRs, ISPs, …
![Page 15: RPKI Deployment Status in Bangladesh](https://reader034.fdocuments.us/reader034/viewer/2022042906/58a1a8a41a28abe6468b5c9d/html5/thumbnails/15.jpg)
Create Your ROA
![Page 16: RPKI Deployment Status in Bangladesh](https://reader034.fdocuments.us/reader034/viewer/2022042906/58a1a8a41a28abe6468b5c9d/html5/thumbnails/16.jpg)
Phase I - Publishing ROA
• Login to your MyAPNIC portal
• Required valid certificate
• Go to Resources > Certification Tab
12
*
![Page 17: RPKI Deployment Status in Bangladesh](https://reader034.fdocuments.us/reader034/viewer/2022042906/58a1a8a41a28abe6468b5c9d/html5/thumbnails/17.jpg)
Phase I - Publishing ROA1
2
3
![Page 18: RPKI Deployment Status in Bangladesh](https://reader034.fdocuments.us/reader034/viewer/2022042906/58a1a8a41a28abe6468b5c9d/html5/thumbnails/18.jpg)
Phase I - Publishing ROA
• Show available prefix for which you can create ROA
![Page 19: RPKI Deployment Status in Bangladesh](https://reader034.fdocuments.us/reader034/viewer/2022042906/58a1a8a41a28abe6468b5c9d/html5/thumbnails/19.jpg)
Phase I - Publishing ROA - IPv4
1. Write your ASN 2. Your IP Block 3. Subnet 4. Click Add
• Create ROA for smaller block.
![Page 20: RPKI Deployment Status in Bangladesh](https://reader034.fdocuments.us/reader034/viewer/2022042906/58a1a8a41a28abe6468b5c9d/html5/thumbnails/20.jpg)
Phase I - Publishing ROA - IPv6
• ROA for your IPv6 prefix
1. Write your ASN 2. Your IP Block 3. Subnet 4. Click Add
![Page 21: RPKI Deployment Status in Bangladesh](https://reader034.fdocuments.us/reader034/viewer/2022042906/58a1a8a41a28abe6468b5c9d/html5/thumbnails/21.jpg)
Phase I - Check your ROA# whois -h whois.bgpmon.net 202.4.96.0/24
Prefix: 202.4.96.0/24
Prefix description: APT (Dhakacom)
Country code: BD
Origin AS: 23956
Origin AS Name: DHAKACOM-BD-AS dhakaCom Limited,BD
RPKI status: ROA validation successful
First seen: 2013-12-23
Last seen: 2014-07-20
Seen by #peers: 203
![Page 22: RPKI Deployment Status in Bangladesh](https://reader034.fdocuments.us/reader034/viewer/2022042906/58a1a8a41a28abe6468b5c9d/html5/thumbnails/22.jpg)
# whois -h whois.bgpmon.net " --roa 23956 202.4.96.0/24"
0 - Valid
------------------------
ROA Details
------------------------
Origin ASN: AS23956
Not valid Before: 2014-07-20 15:20:10
Not valid After: 2014-12-30 00:00:00 Expires in 161d12h52m42s
Trust Anchor: rpki.apnic.net
Prefixes: 202.4.96.0/19 (max length /24)
2405:7600::/32 (max length /32)
Phase I - Check your ROA
![Page 23: RPKI Deployment Status in Bangladesh](https://reader034.fdocuments.us/reader034/viewer/2022042906/58a1a8a41a28abe6468b5c9d/html5/thumbnails/23.jpg)
Check your prefix
Cisco (hosted by the RIPE NCC)
Public Cisco router: rpki-rtr.ripe.net
Telnet username: ripe / No password
Juniper (hosted by Kaia Global Networks)
Public Juniper routers: 193.34.50.25, 193.34.50.26
Telnet username: rpki / Password: testbed
source : http://www.ripe.net/lir-services/resource-management/certification/tools-and-resources
![Page 24: RPKI Deployment Status in Bangladesh](https://reader034.fdocuments.us/reader034/viewer/2022042906/58a1a8a41a28abe6468b5c9d/html5/thumbnails/24.jpg)
Configuration - Reference Link
Cisco
http://www.cisco.com/c/en/us/td/docs/ios-xml/ios/iproute_bgp/command/irg-cr-book/bgp-m1.html#wp3677719851
Juniper
http://www.juniper.net/techpubs/en_US/junos12.2/topics/topic-map/bgp-origin-as-validation.html
![Page 25: RPKI Deployment Status in Bangladesh](https://reader034.fdocuments.us/reader034/viewer/2022042906/58a1a8a41a28abe6468b5c9d/html5/thumbnails/25.jpg)
RPKI Status in Bangladesh
![Page 26: RPKI Deployment Status in Bangladesh](https://reader034.fdocuments.us/reader034/viewer/2022042906/58a1a8a41a28abe6468b5c9d/html5/thumbnails/26.jpg)
Is some one really announcing my prefix!!!
![Page 27: RPKI Deployment Status in Bangladesh](https://reader034.fdocuments.us/reader034/viewer/2022042906/58a1a8a41a28abe6468b5c9d/html5/thumbnails/27.jpg)
source : https://www.internetsociety.org/rrs/
ISOC Routing Resiliency Survey
![Page 28: RPKI Deployment Status in Bangladesh](https://reader034.fdocuments.us/reader034/viewer/2022042906/58a1a8a41a28abe6468b5c9d/html5/thumbnails/28.jpg)
RPKI Breakdown
Total Prefix Valid Invalid Unknown AccuracyRPKI
Adoption Rate
APNIC 135876 (100%) 581 (0.43%) 684 (0.5%) 134611
(99.07%) 45.93% 0.93%
BD 2079 (100%) 71 (3.42%) 26 (1.25%) 1982 (95.33%) 73.2% 4.67%
source : http://rpki.surfnet.nl/perrir.html & http://rpki.surfnet.nl/country.php
![Page 29: RPKI Deployment Status in Bangladesh](https://reader034.fdocuments.us/reader034/viewer/2022042906/58a1a8a41a28abe6468b5c9d/html5/thumbnails/29.jpg)
Adoption Rate RPKI vs IPv6
RPKI Adoption 4.67%
source : https://www.google.com/intl/en/ipv6/statistics.html#tab=per-country-ipv6-adoption
![Page 30: RPKI Deployment Status in Bangladesh](https://reader034.fdocuments.us/reader034/viewer/2022042906/58a1a8a41a28abe6468b5c9d/html5/thumbnails/30.jpg)
Invalid Prefix
source : http://rpki.surfnet.nl/bd.html
![Page 31: RPKI Deployment Status in Bangladesh](https://reader034.fdocuments.us/reader034/viewer/2022042906/58a1a8a41a28abe6468b5c9d/html5/thumbnails/31.jpg)
All Invalid prefixes from BD
source : http://rpki.surfnet.nl/bd.html
![Page 32: RPKI Deployment Status in Bangladesh](https://reader034.fdocuments.us/reader034/viewer/2022042906/58a1a8a41a28abe6468b5c9d/html5/thumbnails/32.jpg)
All Invalid prefixes from BD
source : http://rpki.surfnet.nl/bd.html
![Page 33: RPKI Deployment Status in Bangladesh](https://reader034.fdocuments.us/reader034/viewer/2022042906/58a1a8a41a28abe6468b5c9d/html5/thumbnails/33.jpg)
Something more serious
source : https://stat.ripe.net/widget/announced-prefixes#w.resource=58717
source : http://www.cidr-report.org/cgi-bin/as-report?as=as58717&view=2.0
![Page 34: RPKI Deployment Status in Bangladesh](https://reader034.fdocuments.us/reader034/viewer/2022042906/58a1a8a41a28abe6468b5c9d/html5/thumbnails/34.jpg)
Special thanks to Jac Kloots SURFnet
http://rpki.surfnet.nl/index.html
![Page 35: RPKI Deployment Status in Bangladesh](https://reader034.fdocuments.us/reader034/viewer/2022042906/58a1a8a41a28abe6468b5c9d/html5/thumbnails/35.jpg)
Thank You