1
00:00:00,000 --> 00:00:00,972

2
00:00:00,972 --> 00:00:04,374
[AUDIO LOGO]

3
00:00:04,374 --> 00:00:07,980

4
00:00:07,980 --> 00:00:12,710
So next, let's take a look at
BGP neighbor authentication.

5
00:00:12,710 --> 00:00:15,820
Now, of course, the
primary reason for this

6
00:00:15,820 --> 00:00:19,540
is to try to prevent
unauthorized neighborships.

7
00:00:19,540 --> 00:00:21,730
If somebody else doesn't
know the password,

8
00:00:21,730 --> 00:00:24,160
then they can't form a
neighborship with us.

9
00:00:24,160 --> 00:00:27,790
So this is a relatively
common thing to do.

10
00:00:27,790 --> 00:00:31,690
Now, in the case
of IOS XE, it only

11
00:00:31,690 --> 00:00:34,210
supports MD5 authentication.

12
00:00:34,210 --> 00:00:36,640
And honestly, we
just put a password

13
00:00:36,640 --> 00:00:38,150
on a neighbor statement.

14
00:00:38,150 --> 00:00:41,140
So it's a fairly
straightforward process.

15
00:00:41,140 --> 00:00:44,470
IOS XR gets a little
bit more interesting

16
00:00:44,470 --> 00:00:47,510
because it supports
MD5, of course,

17
00:00:47,510 --> 00:00:50,950
but it also supports
SHA-1 authentication

18
00:00:50,950 --> 00:00:53,920
and the opportunity
to use a keychain.

19
00:00:53,920 --> 00:00:56,710
So we'll take a look at
both of these options,

20
00:00:56,710 --> 00:00:59,680
and we'll take a look
at configuring these

21
00:00:59,680 --> 00:01:03,070
between IOS XE and IOS XR.

22
00:01:03,070 --> 00:01:05,080
So let's jump in and
take a quick look

23
00:01:05,080 --> 00:01:07,210
at some details
on authentication.

24
00:01:07,210 --> 00:01:09,200
And then we'll jump
into the command line

25
00:01:09,200 --> 00:01:13,240
and get this set up
on both platforms.

26
00:01:13,240 --> 00:01:16,830
So again, the main purpose
of BGP authentication

27
00:01:16,830 --> 00:01:22,560
is to protect those BGP
neighborships, making sure

28
00:01:22,560 --> 00:01:24,780
that we don't get
neighbors that we don't

29
00:01:24,780 --> 00:01:27,120
want that aren't authorized.

30
00:01:27,120 --> 00:01:30,150
Now, there are
two major features

31
00:01:30,150 --> 00:01:33,570
that focus around protecting
these neighborships.

32
00:01:33,570 --> 00:01:36,630
Of course, one of them is
neighbor authentication.

33
00:01:36,630 --> 00:01:40,180
That is, of course, our
topic in this video.

34
00:01:40,180 --> 00:01:43,170
There's also TTL
security, and we

35
00:01:43,170 --> 00:01:47,200
will be talking about this
one in the next video.

36
00:01:47,200 --> 00:01:50,710
So this topic is
coming up very shortly.

37
00:01:50,710 --> 00:01:53,520
But as far as
authentication itself,

38
00:01:53,520 --> 00:01:55,780
as we said during
the introduction,

39
00:01:55,780 --> 00:02:01,920
IOS XE supports
HMAC-MD5 authentication,

40
00:02:01,920 --> 00:02:05,910
and this is put on a
neighbor statement.

41
00:02:05,910 --> 00:02:13,420
IOS XR supports both
HMAC-MD5 and HMAC-SHA-1,

42
00:02:13,420 --> 00:02:15,550
specifically SHA1-12.

43
00:02:15,550 --> 00:02:18,130
Now, here's the
interesting thing.

44
00:02:18,130 --> 00:02:21,250
MD5 authentication
can be configured here

45
00:02:21,250 --> 00:02:26,980
under neighbor configuration
or in a keychain.

46
00:02:26,980 --> 00:02:32,360
SHA-1 authentication has to be
done in the keychain option.

47
00:02:32,360 --> 00:02:35,110
Now, a very important
thing to understand here

48
00:02:35,110 --> 00:02:38,980
and we'll see why as
we get into Wireshark,

49
00:02:38,980 --> 00:02:43,180
but these authentications are
compatible with each other.

50
00:02:43,180 --> 00:02:47,980
These authentications
are not, and the reason

51
00:02:47,980 --> 00:02:54,100
has to do with how this MD5
authentication is actually

52
00:02:54,100 --> 00:02:57,190
carried in the TCP header.

53
00:02:57,190 --> 00:03:01,180
IOS XR carries it
differently, whether you're

54
00:03:01,180 --> 00:03:04,300
using the neighbor
or the keychain,

55
00:03:04,300 --> 00:03:06,190
and the neighbor
is the one that's

56
00:03:06,190 --> 00:03:10,960
compatible with MD5
authentication on IOS XE,

57
00:03:10,960 --> 00:03:13,390
or you could say,
per the standard.

58
00:03:13,390 --> 00:03:15,225
What exactly does that mean?

59
00:03:15,225 --> 00:03:17,350
Well, if we go down here
just a little bit further,

60
00:03:17,350 --> 00:03:20,980
when we're talking
about HMAC-MD5 here,

61
00:03:20,980 --> 00:03:25,720
it uses the IP address, and
the most important thing here

62
00:03:25,720 --> 00:03:29,980
is TCP option 19.

63
00:03:29,980 --> 00:03:35,710
IOS XE and the neighbor
configuration on IOS XR

64
00:03:35,710 --> 00:03:38,830
both use TCP option 19.

65
00:03:38,830 --> 00:03:42,460
We'll see when we look at
the SHA-1 authentication

66
00:03:42,460 --> 00:03:45,970
that that's carried actually
in an experimental field

67
00:03:45,970 --> 00:03:47,710
in the TCP header.

68
00:03:47,710 --> 00:03:51,040
It is not carried in option 19.

69
00:03:51,040 --> 00:03:53,860
But just to wrap up
the MD5 part here,

70
00:03:53,860 --> 00:03:57,730
since it does use the IP
address and TCP option 19,

71
00:03:57,730 --> 00:03:59,470
there are a few caveats.

72
00:03:59,470 --> 00:04:03,610
This means, it cannot
traverse NAT or PAT.

73
00:04:03,610 --> 00:04:09,010
It cannot traverse any firewalls
that randomizes TCP sequence

74
00:04:09,010 --> 00:04:13,570
numbers, and it cannot traverse
any firewalls that actually

75
00:04:13,570 --> 00:04:17,660
remove option 19
since it's using that.

76
00:04:17,660 --> 00:04:19,540
So other than that,
authentication

77
00:04:19,540 --> 00:04:21,130
is really not that difficult.

78
00:04:21,130 --> 00:04:23,200
Let's go ahead and jump
into the command-line

79
00:04:23,200 --> 00:04:24,370
and configure this.

80
00:04:24,370 --> 00:04:28,190
As always, we'll start by taking
a quick look at our diagram.

81
00:04:28,190 --> 00:04:30,280
And what we're
going to be doing is

82
00:04:30,280 --> 00:04:34,810
we're going to authenticate with
MD5 the connection between R6

83
00:04:34,810 --> 00:04:36,520
and R1.

84
00:04:36,520 --> 00:04:40,810
And then we'll authenticate
with SHA-1 the connection

85
00:04:40,810 --> 00:04:43,540
between R1 and R2.

86
00:04:43,540 --> 00:04:45,820
So let's just go ahead and
jump into the command-line

87
00:04:45,820 --> 00:04:48,170
and get started.

88
00:04:48,170 --> 00:04:50,770
So we'll just start
here on router 1.

89
00:04:50,770 --> 00:04:53,740
We'll simply go
into router BGP 100.

90
00:04:53,740 --> 00:04:56,140
Again, under the neighbor
configuration because this

91
00:04:56,140 --> 00:04:58,730
is the one that uses option 19.

92
00:04:58,730 --> 00:05:01,060
And we'll simply set a password.

93
00:05:01,060 --> 00:05:04,030
We'll make it secret pass with
some special characters there.

94
00:05:04,030 --> 00:05:05,530
Super secret password.

95
00:05:05,530 --> 00:05:07,750
Let's commit our changes.

96
00:05:07,750 --> 00:05:09,470
Exit configuration.

97
00:05:09,470 --> 00:05:12,550
Now, what we should see is the
neighborship actually go down

98
00:05:12,550 --> 00:05:15,160
between router 1 and router 6.

99
00:05:15,160 --> 00:05:18,080
Now, this is going
to take 3 minutes.

100
00:05:18,080 --> 00:05:21,280
So we could actually get
router 6 configured and up

101
00:05:21,280 --> 00:05:24,130
and running without it
ever even going down.

102
00:05:24,130 --> 00:05:26,890
However, since we want to see
that the password is actually

103
00:05:26,890 --> 00:05:29,920
working, we'll just go
ahead and fast-forward

104
00:05:29,920 --> 00:05:32,630
until that neighborship
actually goes down.

105
00:05:32,630 --> 00:05:35,140
And we can see that we're
already getting messages

106
00:05:35,140 --> 00:05:40,000
that it's getting invalid or bad
MD5 authentication from router

107
00:05:40,000 --> 00:05:40,720
6.

108
00:05:40,720 --> 00:05:44,440
So it's just a matter of time
until that neighbor fails.

109
00:05:44,440 --> 00:05:48,000
So here, we see that the
neighbor has finally gone down.

110
00:05:48,000 --> 00:05:50,540
We're, of course, still getting
those bad authentication

111
00:05:50,540 --> 00:05:51,500
messages.

112
00:05:51,500 --> 00:05:54,750
That will continue until we
actually fix the problem.

113
00:05:54,750 --> 00:05:57,080
So let's go over to router 6.

114
00:05:57,080 --> 00:05:59,690
Router 6, of course, also
sees that the neighborship

115
00:05:59,690 --> 00:06:00,660
has gone down.

116
00:06:00,660 --> 00:06:03,020
So let's go ahead and fix it.

117
00:06:03,020 --> 00:06:07,550
This, of course, is going to
be for neighbor 50.0.167.1,

118
00:06:07,550 --> 00:06:10,190
and we're simply going
to set the password

119
00:06:10,190 --> 00:06:13,730
to the same password,
and our configuration,

120
00:06:13,730 --> 00:06:15,620
and we should see
that neighborship

121
00:06:15,620 --> 00:06:18,150
come back up very shortly.

122
00:06:18,150 --> 00:06:20,570
So here, we can see the
neighborship came back up.

123
00:06:20,570 --> 00:06:24,110
Let's jump into Wireshark and
just take a real quick look

124
00:06:24,110 --> 00:06:26,600
at that option 19
on the packet, so we

125
00:06:26,600 --> 00:06:28,260
can see what this looks like.

126
00:06:28,260 --> 00:06:32,090
So here, we have a keepalive
message just being sent

127
00:06:32,090 --> 00:06:34,400
between router 1 and router 6.

128
00:06:34,400 --> 00:06:38,330
And here, under TCP,
if we open this header,

129
00:06:38,330 --> 00:06:40,340
we can scroll down.

130
00:06:40,340 --> 00:06:42,680
Here, we see options.

131
00:06:42,680 --> 00:06:47,240
We can see that one of those
options is TCP MD5 signature.

132
00:06:47,240 --> 00:06:49,920
But if we open it
up even further,

133
00:06:49,920 --> 00:06:54,770
we see that it's MD5 Signature
Option 19, and that's

134
00:06:54,770 --> 00:06:58,950
the TCP header option that we're
using for this authentication.

135
00:06:58,950 --> 00:07:02,720
So now, let's go back and
configure SHA-1 authentication

136
00:07:02,720 --> 00:07:05,060
between routers 1 and 2.

137
00:07:05,060 --> 00:07:07,400
So for this we need a keychain.

138
00:07:07,400 --> 00:07:08,660
So we'll just do a keychain.

139
00:07:08,660 --> 00:07:11,000
We'll just call it BGP_KEY.

140
00:07:11,000 --> 00:07:13,310
We'll make a key 1.

141
00:07:13,310 --> 00:07:18,110
First thing we want to do is
set the cryptographic algorithm.

142
00:07:18,110 --> 00:07:24,170
Now, if we look at the options
here, we support SHA-1 and MD5,

143
00:07:24,170 --> 00:07:26,570
but remember that
specifically, it supports

144
00:07:26,570 --> 00:07:32,390
HMAC-SHA1-12 or HMAC-MD5.

145
00:07:32,390 --> 00:07:36,800
Now, again, we can't
actually do the HMAC-MD5 here

146
00:07:36,800 --> 00:07:40,970
to go towards IOS XE, and
we'll see why in just a moment.

147
00:07:40,970 --> 00:07:44,100
We already saw that
that uses option 19.

148
00:07:44,100 --> 00:07:49,310
But if we turn on SHA-1 here,
we set up our key string,

149
00:07:49,310 --> 00:07:51,840
we'll just make it
the same password,

150
00:07:51,840 --> 00:07:54,290
we also have to set
up a send-lifetime,

151
00:07:54,290 --> 00:07:56,013
so it knows when to send it.

152
00:07:56,013 --> 00:07:58,430
We're just going to tell it
to start sending it, basically

153
00:07:58,430 --> 00:08:06,720
forever, starting, say, January
1 of 2000, and send it forever.

154
00:08:06,720 --> 00:08:09,020
We're not too concerned
about send-lifetimes

155
00:08:09,020 --> 00:08:11,240
and receive-lifetimes right now.

156
00:08:11,240 --> 00:08:15,410
Then we'll go into router BGP
100 and towards our neighbor

157
00:08:15,410 --> 00:08:17,150
10.2.2.2.

158
00:08:17,150 --> 00:08:21,420
We'll use our keychain BGP_KEY.

159
00:08:21,420 --> 00:08:23,760
Now, of course, as
soon as we commit this,

160
00:08:23,760 --> 00:08:26,150
we should start
getting error messages,

161
00:08:26,150 --> 00:08:28,560
and we can see that
almost right away,

162
00:08:28,560 --> 00:08:32,299
we start getting these TCP
bad authentication messages

163
00:08:32,299 --> 00:08:34,039
coming from router 2.

164
00:08:34,039 --> 00:08:37,789
So now, let's go ahead and put
our configuration on router 2.

165
00:08:37,789 --> 00:08:40,400
It's the exact same
configuration as router 1.

166
00:08:40,400 --> 00:08:41,840
So we'll just paste it in.

167
00:08:41,840 --> 00:08:45,050
The only difference, of
course, is its neighbor 1.

168
00:08:45,050 --> 00:08:50,040
Let's go ahead and commit those
changes and exit configuration.

169
00:08:50,040 --> 00:08:52,430
Now, we could have, again,
waited for the neighborship

170
00:08:52,430 --> 00:08:55,070
to go down, but I think
we're all fairly confident

171
00:08:55,070 --> 00:08:56,360
that it would have.

172
00:08:56,360 --> 00:08:58,920
We were already
getting error messages.

173
00:08:58,920 --> 00:09:00,950
So now, let's jump
over to Wireshark

174
00:09:00,950 --> 00:09:03,230
and take a look at what
the packet actually

175
00:09:03,230 --> 00:09:06,120
looks like in the TCP header.

176
00:09:06,120 --> 00:09:10,610
So here, we have a keepalive
between router 1 and router 2.

177
00:09:10,610 --> 00:09:14,000
And if we come down here
and look at our TCP header,

178
00:09:14,000 --> 00:09:19,160
notice that now, under
Options, it says, experimental.

179
00:09:19,160 --> 00:09:22,430
If we open this up, we
see that it actually

180
00:09:22,430 --> 00:09:26,510
lists it as RFC3692.

181
00:09:26,510 --> 00:09:29,480
Style is Experiment 2.

182
00:09:29,480 --> 00:09:31,700
This is quite simply
a header that's

183
00:09:31,700 --> 00:09:35,870
available for people who want
to expand on the protocol, which

184
00:09:35,870 --> 00:09:38,000
is essentially what
we're doing here

185
00:09:38,000 --> 00:09:41,000
by using SHA-1 authentication.

186
00:09:41,000 --> 00:09:43,430
Just to contrast this
to a connection that's

187
00:09:43,430 --> 00:09:46,460
not doing any authentication,
let's take a look

188
00:09:46,460 --> 00:09:50,100
at this keepalive between
router 2 and router 3.

189
00:09:50,100 --> 00:09:52,740
So if we highlight
this packet and we

190
00:09:52,740 --> 00:09:55,350
look under TCP,
what we actually see

191
00:09:55,350 --> 00:09:57,070
is there's no options at all.

192
00:09:57,070 --> 00:09:59,340
So if we're not
doing authentication,

193
00:09:59,340 --> 00:10:00,960
there are no options.

194
00:10:00,960 --> 00:10:05,940
If we're doing traditional
BGP authentication with MD5,

195
00:10:05,940 --> 00:10:08,010
it's option 19.

196
00:10:08,010 --> 00:10:13,380
And if we're doing SHA-1
authentication or MD5

197
00:10:13,380 --> 00:10:16,890
authentication with a
keychain, then we're

198
00:10:16,890 --> 00:10:21,790
going to be using
the RFC3692-style.

199
00:10:21,790 --> 00:10:26,300
But whatever combination, we can
see that this is now working.

200
00:10:26,300 --> 00:10:31,600
So in this video, we saw BGP
neighbor authentication working

201
00:10:31,600 --> 00:10:38,380
between IOS XE and IOS XR using
traditional MD5 authentication

202
00:10:38,380 --> 00:10:41,680
configured under the
neighbor configuration

203
00:10:41,680 --> 00:10:46,450
using TCP option 19,
and we saw using SHA-1

204
00:10:46,450 --> 00:10:50,320
with a keychain
between two IOS XR

205
00:10:50,320 --> 00:10:55,510
devices using our
experimental headers in TCP.

206
00:10:55,510 --> 00:10:57,670
I hope this has been
informative for you,

207
00:10:57,670 --> 00:11:00,690
and I'd like to thank
you for viewing.

208
00:11:00,690 --> 00:11:04,000