1
00:00:00,000 --> 00:00:00,978

2
00:00:00,978 --> 00:00:04,401
[AUDIO LOGO]

3
00:00:04,401 --> 00:00:08,029

4
00:00:08,029 --> 00:00:12,930
So as we jump in to start
talking about BGP security

5
00:00:12,930 --> 00:00:16,260
and securing it in the
service provider space,

6
00:00:16,260 --> 00:00:18,240
I want to keep in
mind a few things

7
00:00:18,240 --> 00:00:20,130
as we go through this skill.

8
00:00:20,130 --> 00:00:25,330
First, this is not a
comprehensive security course.

9
00:00:25,330 --> 00:00:29,160
So this is just an overview of
some of the most common things

10
00:00:29,160 --> 00:00:32,100
that we need to secure
in regards to BGP.

11
00:00:32,100 --> 00:00:35,760
This is certainly
not a complete course

12
00:00:35,760 --> 00:00:39,550
on how to secure a service
provider environment.

13
00:00:39,550 --> 00:00:41,840
That said, we are
going to jump in here

14
00:00:41,840 --> 00:00:43,590
and look at some of
the most common things

15
00:00:43,590 --> 00:00:45,330
that we do need to protect.

16
00:00:45,330 --> 00:00:51,060
And keep in mind that BGP is a
very commonly attacked protocol

17
00:00:51,060 --> 00:00:54,370
since it is the protocol
that runs the internet.

18
00:00:54,370 --> 00:00:57,150
So we do need to take
certain precautions.

19
00:00:57,150 --> 00:00:59,580
We need to, as a
service provider,

20
00:00:59,580 --> 00:01:03,780
protect ourselves not only
from other service providers,

21
00:01:03,780 --> 00:01:06,510
but also possibly
from our customers.

22
00:01:06,510 --> 00:01:11,390
And for that matter, if we can
into the extent that we can,

23
00:01:11,390 --> 00:01:14,050
we want to help
protect our customers

24
00:01:14,050 --> 00:01:16,310
from the rest of the internet.

25
00:01:16,310 --> 00:01:18,760
Now, ultimately, of
course, customers

26
00:01:18,760 --> 00:01:21,820
are going to be responsible
for their own security,

27
00:01:21,820 --> 00:01:24,880
but we can certainly
provide some tools that

28
00:01:24,880 --> 00:01:28,810
will see throughout this
skill that can help them

29
00:01:28,810 --> 00:01:32,900
in protecting their own networks
if they choose to use them.

30
00:01:32,900 --> 00:01:36,190
So that said, let's jump
in here and take a look

31
00:01:36,190 --> 00:01:38,500
at some of the
most common things

32
00:01:38,500 --> 00:01:42,280
that we need to secure BGP
against in the service provider

33
00:01:42,280 --> 00:01:44,370
space.

34
00:01:44,370 --> 00:01:46,710
So as we said during
the introduction,

35
00:01:46,710 --> 00:01:53,040
keep in mind that BGP is the
most attacked routing protocol

36
00:01:53,040 --> 00:01:56,890
just because it's what
runs the entire internet.

37
00:01:56,890 --> 00:01:59,100
Now, of course,
if an attacker is

38
00:01:59,100 --> 00:02:02,008
trying to come after
a particular company,

39
00:02:02,008 --> 00:02:04,050
well, then they might
attack the routing protocol

40
00:02:04,050 --> 00:02:06,600
that company is using
in their environment.

41
00:02:06,600 --> 00:02:10,060
But BGP, since it's so
global, is, of course,

42
00:02:10,060 --> 00:02:12,210
going to be the most attacked.

43
00:02:12,210 --> 00:02:15,360
Now, keep in mind
also that as we

44
00:02:15,360 --> 00:02:17,580
go through this
entire skill, we're

45
00:02:17,580 --> 00:02:20,460
going to be referring
to things as attacks

46
00:02:20,460 --> 00:02:23,650
just because it's an
easy way to say things.

47
00:02:23,650 --> 00:02:26,970
However, not all of
them are malicious.

48
00:02:26,970 --> 00:02:29,850
Sometimes it's just a mistake.

49
00:02:29,850 --> 00:02:32,520
Maybe a junior
admin misconfigures

50
00:02:32,520 --> 00:02:37,120
a router, or maybe even a senior
admin misconfigures a router.

51
00:02:37,120 --> 00:02:41,670
So we can see things like
just common mistakes, BGP not

52
00:02:41,670 --> 00:02:43,920
being filtered properly.

53
00:02:43,920 --> 00:02:48,370
I actually had a situation one
time, where one of my customers

54
00:02:48,370 --> 00:02:55,120
was just flat out redistributing
their entire IGP into BGP.

55
00:02:55,120 --> 00:02:57,010
The problem, of
course, with that

56
00:02:57,010 --> 00:03:02,440
is, they were using all RFC
1918 address space because it

57
00:03:02,440 --> 00:03:05,410
was inside of their
NAT environment,

58
00:03:05,410 --> 00:03:07,690
and they just took
all those addresses

59
00:03:07,690 --> 00:03:10,460
and started advertising
them into BGP.

60
00:03:10,460 --> 00:03:13,060
Now, of course, the
service provider

61
00:03:13,060 --> 00:03:15,520
stopped that, but
as the customer,

62
00:03:15,520 --> 00:03:17,890
that's definitely
a misconfiguration.

63
00:03:17,890 --> 00:03:20,080
Were they trying to
attack the internet

64
00:03:20,080 --> 00:03:24,220
or inject these evil
RFC 1918 addresses?

65
00:03:24,220 --> 00:03:25,370
Of course, not.

66
00:03:25,370 --> 00:03:27,970
They just didn't
understand that that's not

67
00:03:27,970 --> 00:03:29,470
something you should do.

68
00:03:29,470 --> 00:03:31,990
So again, a lot of
times, these things

69
00:03:31,990 --> 00:03:34,300
are just common
mistakes, either because

70
00:03:34,300 --> 00:03:36,675
somebody misconfigured
something, or maybe

71
00:03:36,675 --> 00:03:38,050
they just didn't
know any better,

72
00:03:38,050 --> 00:03:39,508
and they thought
that that's how it

73
00:03:39,508 --> 00:03:40,985
was supposed to be configured.

74
00:03:40,985 --> 00:03:42,610
So these are the kind
of things that we

75
00:03:42,610 --> 00:03:46,520
want to protect the service
provider environment from.

76
00:03:46,520 --> 00:03:48,700
So as we move
through this skill,

77
00:03:48,700 --> 00:03:53,390
just keep in mind that the
service providers, of course,

78
00:03:53,390 --> 00:03:56,260
need to be concerned
about their safety

79
00:03:56,260 --> 00:04:00,430
as well as trying to
protect the customers.

80
00:04:00,430 --> 00:04:05,050
Again, we ultimately can't
completely protect customers,

81
00:04:05,050 --> 00:04:07,850
but we can give them tools.

82
00:04:07,850 --> 00:04:11,650
So some of the different types
of attacks, or like we said,

83
00:04:11,650 --> 00:04:16,870
mistakes that BGP can be
vulnerable or susceptible to

84
00:04:16,870 --> 00:04:20,740
would be things like
TCP synchronization.

85
00:04:20,740 --> 00:04:24,320
This is also known
as SYN flooding.

86
00:04:24,320 --> 00:04:28,450
This is essentially sending
a lot of TCP SYN requests

87
00:04:28,450 --> 00:04:31,720
to the device, knowing that
they're probably not going

88
00:04:31,720 --> 00:04:34,450
to complete, but
trying to overwhelm

89
00:04:34,450 --> 00:04:38,230
either the device itself
or the link that these SYN

90
00:04:38,230 --> 00:04:41,590
requests are going
over, and that plays

91
00:04:41,590 --> 00:04:43,930
in as well to traffic flooding.

92
00:04:43,930 --> 00:04:46,940
Oftentimes, the SYN
flooding is what's

93
00:04:46,940 --> 00:04:48,660
causing the traffic flooding.

94
00:04:48,660 --> 00:04:52,700
However, we could also try to
overwhelm a device possibly

95
00:04:52,700 --> 00:04:56,910
even just by pinging it from
100,000 different computers.

96
00:04:56,910 --> 00:05:00,590
So it doesn't have to be
the SYN flooding, but that

97
00:05:00,590 --> 00:05:02,720
is a common way that it's done.

98
00:05:02,720 --> 00:05:07,010
And then, of course, there's
BGP specific attacks.

99
00:05:07,010 --> 00:05:12,500
These are attacks not on TCP
itself but actually on BGP.

100
00:05:12,500 --> 00:05:16,730
These would include things like
unwanted neighborships, people

101
00:05:16,730 --> 00:05:18,590
trying to form
neighborships that aren't

102
00:05:18,590 --> 00:05:20,630
supposed to be our neighbors.

103
00:05:20,630 --> 00:05:23,270
How about just a
neighbor flapping?

104
00:05:23,270 --> 00:05:26,150
Every time a neighbor
goes up or down,

105
00:05:26,150 --> 00:05:28,310
it's a new TCP connection.

106
00:05:28,310 --> 00:05:30,290
We have to exchange
open messages.

107
00:05:30,290 --> 00:05:33,660
We have to resynchronize
the entire BGP table.

108
00:05:33,660 --> 00:05:36,810
So again, this can
really cause an issue.

109
00:05:36,810 --> 00:05:40,110
Also, improper route injection.

110
00:05:40,110 --> 00:05:43,380
Now, this is pretty much the
one I was just talking about,

111
00:05:43,380 --> 00:05:47,850
where we had a customer
injecting all those RFC 1918

112
00:05:47,850 --> 00:05:51,240
addresses that they, of course,
shouldn't have been doing,

113
00:05:51,240 --> 00:05:53,820
but it can also be other things.

114
00:05:53,820 --> 00:05:56,730
People could be doing
this maliciously,

115
00:05:56,730 --> 00:05:58,950
trying to inject,
say, a customer's

116
00:05:58,950 --> 00:06:02,040
prefix from somewhere
else in the world,

117
00:06:02,040 --> 00:06:04,860
trying to get the
internet to go to them

118
00:06:04,860 --> 00:06:08,950
to reach a customer's prefix
rather than to the customer.

119
00:06:08,950 --> 00:06:12,570
So from that perspective,
as a service provider,

120
00:06:12,570 --> 00:06:17,670
it would fall on us to, again,
attempt customer security here

121
00:06:17,670 --> 00:06:22,770
by allowing our customers
to advertise their prefixes,

122
00:06:22,770 --> 00:06:24,870
but nobody else's.

123
00:06:24,870 --> 00:06:28,770
That way, our customers
can't try to attack somebody

124
00:06:28,770 --> 00:06:31,080
else because again,
we never know

125
00:06:31,080 --> 00:06:33,660
where those malicious
parties are going to be.

126
00:06:33,660 --> 00:06:36,800
They very well could be
one of our own customers.

127
00:06:36,800 --> 00:06:40,670
So to protect the rest of the
internet from our customers,

128
00:06:40,670 --> 00:06:43,420
we should also be
monitoring and well,

129
00:06:43,420 --> 00:06:46,150
protecting the internet
from what our customers are

130
00:06:46,150 --> 00:06:47,632
attempting to advertise.

131
00:06:47,632 --> 00:06:49,090
So these are all
things that we can

132
00:06:49,090 --> 00:06:51,070
control with the
tools we're going

133
00:06:51,070 --> 00:06:54,040
to see throughout the
rest of this skill.

134
00:06:54,040 --> 00:06:55,900
And of course,
last but not least,

135
00:06:55,900 --> 00:06:59,710
would just be improper
configuration, which could be,

136
00:06:59,710 --> 00:07:02,090
of course, all sorts
of different things.

137
00:07:02,090 --> 00:07:04,300
Again, the redistribution
of your IGP

138
00:07:04,300 --> 00:07:08,440
would fall into that, having
timers set way too high.

139
00:07:08,440 --> 00:07:10,510
There's other things
that can fall into this,

140
00:07:10,510 --> 00:07:13,880
and we'll get into this
in more detail as we go.

141
00:07:13,880 --> 00:07:15,910
Now, we've spent quite
a bit of time here

142
00:07:15,910 --> 00:07:18,640
talking a little bit
about BGP, but let's not

143
00:07:18,640 --> 00:07:21,550
forget that the
routers themselves also

144
00:07:21,550 --> 00:07:24,370
need to be protected, and some
of the things we've mentioned

145
00:07:24,370 --> 00:07:28,100
would fall into the category
of an attack on the router.

146
00:07:28,100 --> 00:07:30,730
So again, these are sort
of one and the same.

147
00:07:30,730 --> 00:07:33,100
But keep in mind, the
routers are split up

148
00:07:33,100 --> 00:07:34,640
into three sections.

149
00:07:34,640 --> 00:07:37,960
The first of which is
the management plane.

150
00:07:37,960 --> 00:07:40,210
And I've just listed
a few examples here

151
00:07:40,210 --> 00:07:43,250
because it's not really our
main focus in this section,

152
00:07:43,250 --> 00:07:46,780
but things like SSH, Telnet.

153
00:07:46,780 --> 00:07:49,300
Hopefully, nobody's
actually using Telnet.

154
00:07:49,300 --> 00:07:50,650
That's how we secure that one.

155
00:07:50,650 --> 00:07:51,920
We just don't use it.

156
00:07:51,920 --> 00:07:56,080
But again, I just put it in as
an example, things like SNMP.

157
00:07:56,080 --> 00:07:59,020
An example here would be make
sure you're at least using

158
00:07:59,020 --> 00:08:02,620
version 3 if you're
using SNMP because it has

159
00:08:02,620 --> 00:08:04,390
a lot more security features.

160
00:08:04,390 --> 00:08:07,120
But again, this isn't
really our focus here.

161
00:08:07,120 --> 00:08:10,750
Our focus is mostly going
to be on the control

162
00:08:10,750 --> 00:08:13,850
plane and a little
bit of the data plane.

163
00:08:13,850 --> 00:08:16,190
So the control
plane is, of course,

164
00:08:16,190 --> 00:08:19,900
the second thing we would have
to secure, and lots of things

165
00:08:19,900 --> 00:08:21,290
can be affected here.

166
00:08:21,290 --> 00:08:25,780
One of them is an
overly large BGP table.

167
00:08:25,780 --> 00:08:26,800
Why?

168
00:08:26,800 --> 00:08:31,000
Well, it's going to take a
lot of RAM to store the table,

169
00:08:31,000 --> 00:08:35,799
and it's going to take a lot
of CPU to run the BGP scanner

170
00:08:35,799 --> 00:08:37,539
and select the best paths.

171
00:08:37,539 --> 00:08:40,490
All the calculations that
need to happen are, of course,

172
00:08:40,490 --> 00:08:44,150
going to be more complicated
the bigger the table.

173
00:08:44,150 --> 00:08:47,720
And then of course, there's
the data plane itself.

174
00:08:47,720 --> 00:08:51,460
And this is a direct
result of a lot

175
00:08:51,460 --> 00:08:54,610
of what's going to happen
up here, particularly

176
00:08:54,610 --> 00:08:59,080
the last point here,
the overloaded TCAM.

177
00:08:59,080 --> 00:09:04,300
Now, keep in mind, not all
Cisco devices have a TCAM.

178
00:09:04,300 --> 00:09:08,080
These are the hardware tables
stored in the line cards.

179
00:09:08,080 --> 00:09:12,580
But the ones that do, this
is a finite amount of space.

180
00:09:12,580 --> 00:09:15,670
Each different platform
has the maximum amount

181
00:09:15,670 --> 00:09:18,850
of routes that it can
store in its TCAM tables,

182
00:09:18,850 --> 00:09:22,580
and we need to make sure
that we don't overwhelm that.

183
00:09:22,580 --> 00:09:26,590
So all of the routes get
stored into the TCAMs

184
00:09:26,590 --> 00:09:28,150
as long as there's room.

185
00:09:28,150 --> 00:09:30,520
And if there's not
room, well, that's

186
00:09:30,520 --> 00:09:32,390
where this problem comes in.

187
00:09:32,390 --> 00:09:35,230
And of course, we already
mentioned this first point

188
00:09:35,230 --> 00:09:38,320
here, which is the
saturated links

189
00:09:38,320 --> 00:09:40,480
or the denial-of-service
attacks,

190
00:09:40,480 --> 00:09:41,860
where basically,
somebody is just

191
00:09:41,860 --> 00:09:43,960
trying to saturate
our connection,

192
00:09:43,960 --> 00:09:46,690
just take up all the
bandwidth, and that would be

193
00:09:46,690 --> 00:09:49,600
very detrimental to the router.

194
00:09:49,600 --> 00:09:51,220
And keep in mind,
when we're talking

195
00:09:51,220 --> 00:09:54,800
about these potential threats,
customers are, of course,

196
00:09:54,800 --> 00:09:58,150
going to be open to the
exact same vulnerabilities

197
00:09:58,150 --> 00:10:00,370
as the service provider.

198
00:10:00,370 --> 00:10:03,790
If they're running
BGP, bad actors

199
00:10:03,790 --> 00:10:07,510
can attack them just as easily
as they can attack the service

200
00:10:07,510 --> 00:10:08,540
provider.

201
00:10:08,540 --> 00:10:12,580
And as I've already mentioned,
we cannot fully protect

202
00:10:12,580 --> 00:10:20,050
the customer, but what we can
do is implement policies that do

203
00:10:20,050 --> 00:10:22,630
our best to protect
the customer.

204
00:10:22,630 --> 00:10:25,390
And I have given a
few examples of those,

205
00:10:25,390 --> 00:10:28,840
such as only allowing
them to advertise

206
00:10:28,840 --> 00:10:31,040
the prefixes that they own.

207
00:10:31,040 --> 00:10:34,270
We can also implement
policies to prevent them

208
00:10:34,270 --> 00:10:37,900
from becoming a transit
area or a transit AS.

209
00:10:37,900 --> 00:10:40,990
So these are some things that
we can do is a service provider

210
00:10:40,990 --> 00:10:42,740
to protect the customers.

211
00:10:42,740 --> 00:10:47,410
And then we can also
provide customers with tools

212
00:10:47,410 --> 00:10:50,610
to help them protect themselves.

213
00:10:50,610 --> 00:10:54,590
One example of this is, we could
do remote triggered black hole

214
00:10:54,590 --> 00:10:55,400
filtering.

215
00:10:55,400 --> 00:10:58,770
We'll talk about that
in an upcoming video.

216
00:10:58,770 --> 00:11:02,300
And also do things such
as support communities

217
00:11:02,300 --> 00:11:04,590
and outbound route filtering.

218
00:11:04,590 --> 00:11:07,280
So there are things
that we can do

219
00:11:07,280 --> 00:11:10,010
to give these customers
tools that they can

220
00:11:10,010 --> 00:11:13,420
use to help protect themselves.

221
00:11:13,420 --> 00:11:16,150
In this video, we
talked about some

222
00:11:16,150 --> 00:11:20,470
of the most common attacks
on BGP and to an extent

223
00:11:20,470 --> 00:11:25,030
the router itself, and we just
got an introduction to things

224
00:11:25,030 --> 00:11:29,230
that we might be able to do to
help circumvent those problems

225
00:11:29,230 --> 00:11:31,000
in our environment.

226
00:11:31,000 --> 00:11:33,850
Over the upcoming videos,
we'll be exploring

227
00:11:33,850 --> 00:11:36,710
a lot of this in great detail.

228
00:11:36,710 --> 00:11:38,960
So we'll see you there.

229
00:11:38,960 --> 00:11:41,020
I hope this has been
informative for you,

230
00:11:41,020 --> 00:11:44,160
and I'd like to thank
you for viewing.

231
00:11:44,160 --> 00:11:48,000