1
00:00:00,000 --> 00:00:02,994
[MUSIC PLAYING]

2
00:00:02,994 --> 00:00:07,990

3
00:00:07,990 --> 00:00:12,670
So now it's time to look
at source-based RTBH.

4
00:00:12,670 --> 00:00:14,290
And what that means
is we're going

5
00:00:14,290 --> 00:00:18,550
to be doing our filtering based
on the source of the attacking

6
00:00:18,550 --> 00:00:21,140
traffic, not the victim.

7
00:00:21,140 --> 00:00:25,000
So this will prevent the victim
from being taken offline.

8
00:00:25,000 --> 00:00:28,720
That makes this more of a
viable long-term solution.

9
00:00:28,720 --> 00:00:32,980
And the cool thing is, it
works pretty much the same way.

10
00:00:32,980 --> 00:00:35,230
There's really only going
to be two major differences.

11
00:00:35,230 --> 00:00:38,390
And of course, we'll take a
look at those in just a moment.

12
00:00:38,390 --> 00:00:41,830
One of them is we're going to
be filtering, of course, based

13
00:00:41,830 --> 00:00:43,370
on a different network.

14
00:00:43,370 --> 00:00:47,710
And the other is we're going to
be using unicast Reverse Path

15
00:00:47,710 --> 00:00:51,490
Forwarding, or uRPF,
in order to verify

16
00:00:51,490 --> 00:00:55,630
the traffic is coming into the
AS, how and where it's supposed

17
00:00:55,630 --> 00:00:56,300
to.

18
00:00:56,300 --> 00:00:59,560
So this will have to be
implemented on the interfaces

19
00:00:59,560 --> 00:01:01,420
on the edge of the AS.

20
00:01:01,420 --> 00:01:05,450
So as usual, let's talk
about some of the details.

21
00:01:05,450 --> 00:01:07,600
And then we'll bring
up the command line,

22
00:01:07,600 --> 00:01:09,100
and configure this.

23
00:01:09,100 --> 00:01:10,780
It's not going to
take much though,

24
00:01:10,780 --> 00:01:13,720
because it builds on
what we've already set up

25
00:01:13,720 --> 00:01:17,110
for our destination-based RTBH.

26
00:01:17,110 --> 00:01:19,375
So let's go ahead and look
at some of those details.

27
00:01:19,375 --> 00:01:22,460

28
00:01:22,460 --> 00:01:25,990
So what are the things here
that make source-based different

29
00:01:25,990 --> 00:01:27,970
from destination-based?

30
00:01:27,970 --> 00:01:31,750
Well, the first, and
arguably the most important,

31
00:01:31,750 --> 00:01:37,150
is that it's the traffic from
the attacker that is discarded,

32
00:01:37,150 --> 00:01:41,095
not traffic going
to the attacked.

33
00:01:41,095 --> 00:01:44,570
So this is a much better
system as far as that goes.

34
00:01:44,570 --> 00:01:47,110
Now, of course, the
tricky part with this

35
00:01:47,110 --> 00:01:52,030
is, we do have to have knowledge
of the attacker's IP address.

36
00:01:52,030 --> 00:01:55,840
And that could, of course,
change, particularly

37
00:01:55,840 --> 00:01:58,570
in our cloud-based
environment these days.

38
00:01:58,570 --> 00:02:01,060
If somebody truly
wants to do an attack,

39
00:02:01,060 --> 00:02:04,420
they could use one of
our cloud-based services,

40
00:02:04,420 --> 00:02:08,020
launch attacks from there,
and change their IP addresses

41
00:02:08,020 --> 00:02:09,530
very easily.

42
00:02:09,530 --> 00:02:13,220
So this is one of the things
that could be a problem.

43
00:02:13,220 --> 00:02:14,710
And that's pretty
much what we're

44
00:02:14,710 --> 00:02:18,400
saying on this next point, that
in these distributed denial

45
00:02:18,400 --> 00:02:22,030
of service attacks,
those IP addresses can

46
00:02:22,030 --> 00:02:24,650
be very difficult to determine.

47
00:02:24,650 --> 00:02:27,880
Again, it could be from
a ton of IP addresses.

48
00:02:27,880 --> 00:02:29,510
That would be a problem.

49
00:02:29,510 --> 00:02:32,350
And it could be
moving or changing,

50
00:02:32,350 --> 00:02:36,770
which, of course, is a different
problem, but still a problem.

51
00:02:36,770 --> 00:02:38,560
The other potential
issue, and sort

52
00:02:38,560 --> 00:02:40,390
of going along with
the point above,

53
00:02:40,390 --> 00:02:44,350
is this could be a very
large number of devices

54
00:02:44,350 --> 00:02:45,940
doing the attack.

55
00:02:45,940 --> 00:02:50,380
That won't actually change
the effectiveness of RTBH.

56
00:02:50,380 --> 00:02:52,360
It's just a little
bit more work that we

57
00:02:52,360 --> 00:02:56,020
may have to do as far as
putting in more routes.

58
00:02:56,020 --> 00:02:59,290
Now again, we're going
to be using BGP here

59
00:02:59,290 --> 00:03:02,660
for our signaling, just like
we did with destination-based.

60
00:03:02,660 --> 00:03:04,870
In other words, to
redistribute the routes

61
00:03:04,870 --> 00:03:07,180
and send them to
the edge routers.

62
00:03:07,180 --> 00:03:10,180
And then we're going to
use that unicast Reverse

63
00:03:10,180 --> 00:03:12,880
Path Forwarding check
to actually drop

64
00:03:12,880 --> 00:03:15,250
the packets from the attacker.

65
00:03:15,250 --> 00:03:17,650
Now, as far as
implementation for this,

66
00:03:17,650 --> 00:03:20,740
there's really only three
steps if we've already

67
00:03:20,740 --> 00:03:24,460
set up destination-based RTBH.

68
00:03:24,460 --> 00:03:28,280
If not, well, we would have
to set up those same things.

69
00:03:28,280 --> 00:03:31,210
So two and three are
really about what changes

70
00:03:31,210 --> 00:03:33,700
here for source-based.

71
00:03:33,700 --> 00:03:37,900
The first is that static
route that we created

72
00:03:37,900 --> 00:03:39,790
on the Signaling Router.

73
00:03:39,790 --> 00:03:42,410
Instead of being
the destination,

74
00:03:42,410 --> 00:03:44,960
this will now be
the source network.

75
00:03:44,960 --> 00:03:48,580
And as we already
mentioned, the edge routers

76
00:03:48,580 --> 00:03:53,120
will be doing uRPF
in strict mode,

77
00:03:53,120 --> 00:03:56,500
meaning it will actually drop
the traffic if it comes in

78
00:03:56,500 --> 00:03:58,670
on the wrong interface.

79
00:03:58,670 --> 00:04:01,910
So let's go ahead and implement
this on the command line.

80
00:04:01,910 --> 00:04:04,310
Let's take a look at where
we're going to do this.

81
00:04:04,310 --> 00:04:06,790
So since we're building
on what we already had,

82
00:04:06,790 --> 00:04:10,810
we will, of course, still
be doing this in AS 100.

83
00:04:10,810 --> 00:04:14,170
Router 1 will still be
our Signaling Router.

84
00:04:14,170 --> 00:04:17,450
And when we turn on
our unicast RPF checks,

85
00:04:17,450 --> 00:04:21,040
we're going to have to turn it
on on all of these interfaces

86
00:04:21,040 --> 00:04:24,460
facing outside of the AS.

87
00:04:24,460 --> 00:04:27,620
So we'll be configuring
this on the routers as well.

88
00:04:27,620 --> 00:04:30,080
So let's go ahead and jump
into the command line.

89
00:04:30,080 --> 00:04:33,360
We'll just go ahead
and start on Router 1.

90
00:04:33,360 --> 00:04:35,850
So just as a quick
reminder of what we already

91
00:04:35,850 --> 00:04:40,500
have configured, let's do a
show rpl here on Router 1.

92
00:04:40,500 --> 00:04:43,650
We can see that we have
this route policy called

93
00:04:43,650 --> 00:04:49,110
RP underscore RTBH, which is
matching on the tag of 999,

94
00:04:49,110 --> 00:04:53,670
setting the next hop to
the 192.0.2.1 address,

95
00:04:53,670 --> 00:04:58,100
and setting our community
and local preference.

96
00:04:58,100 --> 00:05:00,310
If we do a show
route static, we see

97
00:05:00,310 --> 00:05:03,880
that 192.0.2 is
directly connected

98
00:05:03,880 --> 00:05:05,860
to null 0 on this router.

99
00:05:05,860 --> 00:05:09,500
And that's where we're going
to be blackholing the traffic.

100
00:05:09,500 --> 00:05:12,430
So again, this was already
configured for our destination

101
00:05:12,430 --> 00:05:13,300
base.

102
00:05:13,300 --> 00:05:15,382
So what do we have
to do to change it?

103
00:05:15,382 --> 00:05:16,840
Well, the first
thing we have to do

104
00:05:16,840 --> 00:05:20,330
is enable RPF on the
appropriate interfaces.

105
00:05:20,330 --> 00:05:23,090
So we'll simply go into
configuration mode.

106
00:05:23,090 --> 00:05:25,660
We'll go into our
gigabit 2 interface.

107
00:05:25,660 --> 00:05:34,000
And the command to enable this
is IPv4 verify unicast source.

108
00:05:34,000 --> 00:05:37,360
And we say that it's
reachable via the interface it

109
00:05:37,360 --> 00:05:38,590
was received on.

110
00:05:38,590 --> 00:05:41,440
This is strict RPF checks.

111
00:05:41,440 --> 00:05:44,080
That way, if this is not
the appropriate interface,

112
00:05:44,080 --> 00:05:46,120
it will drop the traffic.

113
00:05:46,120 --> 00:05:48,901
We'll do the same
thing for gigabit 3.

114
00:05:48,901 --> 00:05:50,800
Commit our changes.

115
00:05:50,800 --> 00:05:52,930
And exit configuration.

116
00:05:52,930 --> 00:05:56,570
Routers 2 and 3 need this
configuration as well.

117
00:05:56,570 --> 00:05:58,330
We'll just go ahead
and paste it in.

118
00:05:58,330 --> 00:06:02,800
On router 2, it's
4 gigabit 0/0/0/2.

119
00:06:02,800 --> 00:06:07,450
And on router, it goes
on gigabit 0/0/0/3.

120
00:06:07,450 --> 00:06:10,060
So now that that's
configured, we don't really

121
00:06:10,060 --> 00:06:12,100
have to change
anything if we change

122
00:06:12,100 --> 00:06:14,350
the direction of our traffic.

123
00:06:14,350 --> 00:06:17,210
Let's jump back
over to our diagram.

124
00:06:17,210 --> 00:06:23,440
Now, we had used the
network 37.18.12.0/24

125
00:06:23,440 --> 00:06:27,640
as our destination in
our previous video.

126
00:06:27,640 --> 00:06:32,560
That network is actually
over here on Router 8.

127
00:06:32,560 --> 00:06:35,470
So we could actually
test this by having

128
00:06:35,470 --> 00:06:41,560
router 8 generate traffic going
to, for example, Router 9.

129
00:06:41,560 --> 00:06:44,920
And that would have
to traverse AS 100.

130
00:06:44,920 --> 00:06:48,040
This traffic should
be blackholed.

131
00:06:48,040 --> 00:06:51,790
So let's go ahead and check.

132
00:06:51,790 --> 00:06:53,800
So the first thing we'll
do on Router 8 here

133
00:06:53,800 --> 00:06:55,820
is verify that network.

134
00:06:55,820 --> 00:07:00,700
And we can see that that
37.18.12 network is actually

135
00:07:00,700 --> 00:07:03,530
our loopback 1001 interface.

136
00:07:03,530 --> 00:07:05,420
So here's what's interesting.

137
00:07:05,420 --> 00:07:10,090
Let's go ahead and do a
to Router 9's loopback,

138
00:07:10,090 --> 00:07:13,480
but we'll source it
from our loopback 100

139
00:07:13,480 --> 00:07:19,900
interface, which, as we
can see here, is 100.8.8.8.

140
00:07:19,900 --> 00:07:24,040
This traffic should
not be blackholed.

141
00:07:24,040 --> 00:07:29,470
We can see that this works, and
the traffic reaches Router 9.

142
00:07:29,470 --> 00:07:32,620
However, if we try
this again, using

143
00:07:32,620 --> 00:07:36,850
loopback 1001, and
therefore the 37 network

144
00:07:36,850 --> 00:07:40,480
as our source, what we see
here is it gets to Router 7

145
00:07:40,480 --> 00:07:41,570
just fine.

146
00:07:41,570 --> 00:07:45,250
But as soon as it hits
AS 100, the traffic

147
00:07:45,250 --> 00:07:46,690
is now being dropped.

148
00:07:46,690 --> 00:07:49,880
And it's not going to
reach its destination.

149
00:07:49,880 --> 00:07:52,030
So this is a pretty
clear indication

150
00:07:52,030 --> 00:07:54,970
that our blackhole
routing is in fact

151
00:07:54,970 --> 00:07:57,880
working exactly as we designed.

152
00:07:57,880 --> 00:08:01,400
So we'll just go ahead and
break out of our trace.

153
00:08:01,400 --> 00:08:06,530
So in this video, we saw how
to do source-based remote

154
00:08:06,530 --> 00:08:08,540
triggered blackhole filtering.

155
00:08:08,540 --> 00:08:11,480
And as we saw, it's
actually pretty much

156
00:08:11,480 --> 00:08:15,320
the exact same configuration
as destination-based,

157
00:08:15,320 --> 00:08:21,350
except we add the uRPF check
on the outside interfaces

158
00:08:21,350 --> 00:08:22,850
in the AS.

159
00:08:22,850 --> 00:08:26,580
Now, normally, we would also
change the static route.

160
00:08:26,580 --> 00:08:29,150
We just happened to use
the same static route.

161
00:08:29,150 --> 00:08:31,010
And this inverted
the way our traffic

162
00:08:31,010 --> 00:08:34,760
was flowing, just to prove
that it was in fact working.

163
00:08:34,760 --> 00:08:37,250
But as we can see,
this is a good way

164
00:08:37,250 --> 00:08:41,130
to filter traffic on
behalf of our customers.

165
00:08:41,130 --> 00:08:43,640
So that wraps up this skill.

166
00:08:43,640 --> 00:08:48,600
Our next step is to do a
review in the form of a quiz.

167
00:08:48,600 --> 00:08:50,270
So I'll see you there.

168
00:08:50,270 --> 00:08:53,660
Until then, I hope this has
been informative for you,

169
00:08:53,660 --> 00:08:56,800
and I'd like to thank
you for viewing.

170
00:08:56,800 --> 00:09:00,000