[ad_1]
I produced a netlab topology you can use to exercise BGP security tools I explained in the Internet Routing Protection webinar:
- The lab topology mirrors the sample topology I described in the Classification of BGP Route Leaks (RFC 7908) web site put up with a single router for every autonomous technique
- BGP is configured on all devices, and EBGP periods are set up concerning all directly-connected products.
Lab topology (sadly turned around)
Autonomous techniques advertise prefixes from three handle ranges:
| AS sort | Tackle selection |
|---|---|
| Transit vendors | 172.16../16 |
| Regional ISPs | 172.17../16 |
| Customers | 172.18../16 |
I also created a customized configuration template that demonstrates a typical ISP setup:
- Client routes have BGP area desire 200. It is usually ideal to deliver site visitors more than back links somebody else is shelling out for.
- Peer routes have BGP neighborhood choice 150. It’s far better to send out website traffic about zero-settlement hyperlinks than above backlinks where by we have to spend for transit.
- Routes received from transit vendors have default regional preference. They are utilised only when we have no purchaser- or peer routes to a place.
Whilst you can use the lab with any supported gadget, I produced the customized configuration template for FRR containers, Cumulus Linux, and Arista EOS.
I did not configure any BGP route filters, so you are going to get tons of “simple” route leaks from clients and peers, giving you plenty of chance to figure out how to end them. On top rated of that:
- Just one of the clients announces way far too lots of prefixes (a client shall not market far more than two prefixes)
- A further consumer is promoting an internal prefix from the 10…/8 block
- The 3rd clients is promotion a prefix that belongs to an ISP (you are going to notice the same prefix is marketed as belonging to two diverse autonomous systems).
- An ISP is marketing a /25 prefix that should really not be propagated in the world wide World wide web
Repair the lab routing with BGP filters, do not improve the route adverts.
Operating the Lab
The optimal way to run the lab is with Linux containers:
[ad_2]
Resource link