Learning IOS and JUNOS

Junos Script Automation is a powerful and flexible on-box toolset which provides customization of network behavior, adaption to what your application expects to configure, manage and diagnose if and when needed. It sits right above the Junos OS, with a northbound interface to Junos Space applications, and southbound access to Junos SDK applications and native management plane instrumentation. This customized programmable solution makes your application smarter and better in real-time. In Juniper official website provides many script samples to match part of common requests. In my company, we deployed many inter-connections EBGP/IBGP between router or layer 3 switch. So I picked one op script from the JUNOS Script Library - show bgp policy : display all routing-policies in sequential order for a selected BGP peer.

As Juniper FIREFLY-PERIMETER is an ideal candidate of virtual router solution for RTBH router, because its just need control plane and memory(it will not be limited by hardware) for BGP exchange route with community. No much data forwarding plane packet process was needed. So I rebuild the lab with Juniper firefly to see the difference with physical routers as below topology. In my vmware workstation lab, I assigned two interface to each firefly, ge-0/0/0 was used for BGP connections and ge-0/0/1 was used for SSH purpose only(to be more easier for config copy/paste. The most obviously advantage of firefly is the response time of commit action, it was almost done immediately after you press Enter key when I initialized the configuration clean-up, its great! ...But after I copy & paste all my configurations to it then the response time still became longer. [edit] lab@FIREFLY-PERIMETER-1# run show chassis hardware Hardware inventory: Item     ...

Since our company current RTBH router was EOL(Cisco 1800), and our security team would like to expand the RTBH scope to all office SSL VPN all over the world(more than 100s), so we are trying to survey a good candidate for this position. We have a spare Juniper M10i and I believe it can meet the requirement for sure, but its too big so our operation team tried to leverage the lab device - Juniper SRX100H for this purpose. That's why I did this POC to prove the BGP scalability of SRX100H. As below is the Juniper SRX100H hardware features , as a such small device but has 1GB RAM so it can do much more than my expectation in its control plane: DDR Memory: 1 GB Power supply adapter: 30 watts AC input voltage: 100 to240 VAC FastEthernetports: 8 Consoleport: 1 USB port: 1 LEDs: 4 NAND flash: 1 GB  My POC topology as below is very simple and straight, I used a single cable connect between two SRX100H, then setup a trunk w/ 120 VLANs between them, each VLAN will have a dire...

When a router that is capable of BGP Graceful Restart loses connectivity, the following happens to the restarting router: 1. The router establishes BGP sessions with other routers and relearns the BGP routes from other routers that are also capable of Graceful Restart. The restarting router waits to receive updates from the neighboring routers. When the neighboring routers send end-of-Routing Information Base (RIB) markers to indicate that they are done sending updates, the restarting router starts sending its own updates. 2. The restarting router accesses the checkpoint database to find the label that was assigned for each prefix. If it finds the label, it advertises it to the neighboring router. If it does not find the label, it allocates a new label and advertises it. 3. The restarting router removes any stale prefixes after a timer for stale entries expires. When a peer router that is capable of BGP Graceful Restart encounters a restarting router, it does the following:...

Sinkhole Routers/Networks •Sinkholes are a topological security feature—somewhat analogous to a honeypot •Router or workstation built to suck in traffic and assist in analyzing attacks (original use) •Used to redirect attacks away from the customer—working the attack on a router built to withstand the attack •Used to monitor attack noise, scans, data from misconfiguration and other activity (via the advertisement of default or unused IP space) •Traffic is typically diverted via BGP route advertisements and policies •Leverage instrumentation in a controlled environment—Pull the traffic past analyzers/analysis tools Why Sinkholes? •They work! Providers, enterprise operators and researchers use them in their network for data collection and analysis •More uses are being found through experience and individual innovation •Deploying sinkholes correctly takes preparation BGP Trigger •Leverage the same BGP technique used for RTBH •Dedicated trigger router redistributes mor...

Remotely Triggered Blackhole Filtering We will use BGP to trigger a network wide response to an attack  A simple static route and BGP will enable a network-wide destination address blackhole as fast as iBGP can update the network  This provides a tool that can be used to respond to security related events and forms a foundation for other remote triggered uses  Often referred to as RTBH Step 1: Prepare All the Routers with Trigger Select a small block that will not be used for anything other than blackhole filtering; test Net (192.0.2.0/24) is optimal since it should not be in use Put a static route with a /32 from Test-Net—192.0.2.0/24 to Null 0 on every edge router on the network ip route 192.0.2.1 255.255.255.255 Null0  Step 2: Prepare the Trigger Router The Trigger Router Is the Device That Will Inject the iBGP Announcement into the ISP’s Network Should be part of the iBGP mesh—but does not have to accept routes Can be a separate...

今天在review公司core router時，發現有些BGP export policy有設match protocol，有些沒設，心中突然浮現一個問號? 「沒有設定match protocol可以進行static or connect redistribute to BGP的動作嗎?」 然後開始請教資深的同事們討論，結果大家有不同的認知，有的人認為只要export policy就可以將inet.0中的best route直接宣告給BGP neighbor，有的人認為應該要轉成BGP active route才能宣告給BGP neighbor… 其實這種情況常常發生在JUNOS設定中，因為網路的sample config都是很經典的大同小異，沒有太多的例外狀況可以參考，所以最後二話不說，直接實機演練來確認比較快，這也是我很頭痛的地方，只要沒有測試過Lab的JUNOS指令，我真的不能確定結果為何?(尤其是在不同platform及不同hardware combination的情況下) 先把SRX設定成Packet Mode(很特別的指令 如果我沒上過JSEC的課程，打死也不知道設定packet mode會在這樣的階層下…family mpls你的存在跟packet mode到底有什麼關聯??? 真的很難理解啊!)： security {     forwarding-options {         family {             mpls {                 mode packet-based;             }         }     } } 再來設定兩個準備被轉成BGP的static & connected route (恕小弟偷懶，其他基本的interface設定就不在此列出) interfaces { ...

Updated from Cisco 360 Workshop 1 Vol.1 1. Highest weight(default=0) 2. Highest local preference(default=100) 3. Locally originated(Next hop:0.0.0.0, weight=32768) 4. Shortest AS path length 5. Lowest origin code(IGP 6. Lowest MED(default=0) 7. EBGP over IBGP 8. If internal, prefer path with lowest IGP metric to next hop 9. If external, consider multipath (NEW!) 10. If external, prefer old one 11. Lowest router ID or originator ID 12. Minimum cluster list length (NEW!) 13. Lowest neighbor address

Understanding BGP TTL Security - Packet Life By default, IOS sends BGP messages to EBGP neighbors with an IP time-to-live (TTL) of 1. (This can be adjusted with ebgp-multihop attached to the desired neighbor or peer group under BGP configuration.) Sending BGP messages with a TTL of one requires that the peer be directly connected, or the packets will expire in transit. Likewise, a BGP router will only accept incoming BGP messages with a TTL of 1 (or whatever value is specified by ebgp-multihop ), which can help mitigate spoofing attacks. However, there is an inherent vulnerability to this approach: it is trivial for a remote attacker to adjust the TTL of sent packets so that they appear to originating from a directly-connected peer. By spoofing legitimate-looking packets toward a BGP router at high volume, a denial of service (DoS) attack may be accomplished. A very simple solution to this, as discussed in RFC 3682 , is to invert the direction in which the TTL is counted. The maximum ...

Remotely-Triggered Black Hole (RTBH) routing is an interesting application of BGP as a security tool within service provider networks. One common use is mitigation of distributed denial of service (DDoS) attacks, as this article will explore. Pictured below is a (very) simplified service provider architecture. Routers 1 through 4 compose the network core, and router 9 functions as a standalone "management" router for route injection. OSPF is running across the core to exchange internal routes. Each router in this core square also maintains an iBGP adjacency with the other core routers, and with router 9. The server at 172.16.10.100 represents the target of a DDoS attack. Assume a DDoS attack is launched from the public Internet toward the customer server at 172.16.10.100. The throughput consumed is so excessive that the attack is impacting the entire internal infrastructure and must be blocked at the edge. Due to the distributed nature of the attack, we must bl...

在Internet上每一個AS(Autonomous System自治系統，如：一家ISP/固網業者/網路組織)都是組成Internet的一部份，只要一個AS BGP出錯就有可能造成Internet無法正常運作，2009/02/16就發生了一個很經典的錯誤 - 因為某ISP宣告的BGP AS-Path Prepend過長，導致全世界的網路只要有使用Cisco Router的AS都出現網路中斷的情況，因為Cisco IOS無法處理直接Reset BGP neighbor…所以明智的老闆們請不要吝惜於員工培養的教育訓練，小小的教育訓練成本有可能可以挽救全世界~ Cisco IOS causes Internet disruption Author: Fabio Semperboni Feb.24, 2009 in Stories On February 16th, SuproNet , a local Czech provider, single-handedly caused a global Internet meltdown for upwards of an hour today. SuproNet accomplished this feat by sending out a rather unusual routing update, one which a lot of routers did not handle very well. The result was Internet bedlam. “What we think happened next is the Internet equivalent of a massive buffer overflow . While most of the core routers run by major ISPs fared just fine, processing the ridiculous path and sending it on, others choked. Perhaps they weren’t as well maintained or were running buggy software. These routers viewed the up...

一般BGP網管大都知道BGP AS號碼範圍從0~65535，Public AS Range: 0~64511，Priavte AS Range: 64512~65535，所以很多人會誤解以為AS Number的位元只有16 bits。 事實上AS Number總共有32 bits(4 bytes)，前面16 bits以往都是用0，所以會造成這樣的錯覺。根據Jeff Doyle blog上面提到的內容，在不久的將來所有新申請的AS Number format將會是0.XX。以下是完整4-bytes ASN的介紹請參考! Understanding 4-Byte Autonomous System Numbers By jdoyle on Fri, 11/28/2008 - 4:40pm. For all the harping I do on this blog about IPv4 address depletion and the need to prepare yourselves for IPv6, there is another number resource that is also being quickly depleted, and that I haven’t written about before: the 2-byte autonomous system numbers (ASNs). A 16-bit number space gives you 65,536 possible numbers (AS numbers 0 – 65535). Out of these, the IANA reserves 1,026 of them: 64512 – 65534 for private, reusable ASNs (similar to private RFC1918 IPv4 addresses) and a few others such as 0 and 65535 and one that is important to this article, 23456. Presently 49,150 ASNs have been allocated out of the public pool, so there are 15,360...

假設現在我們的BGP Table中有許多192.168.X.0/24的小網段，不過我們只想要送出192.168.0.0/16這個Supernet給特定的neighbor 3.3.3.3，但是不能使用aggregate-address指令，我們可以設定如下，利用neighbor後面加上route-map參數進行小網段的過濾： Router(config)#interface loopback 0 Router(config-if)# ip address 192.168.0.254 255.255.255.0 ! Router(config)#interface loopback 1 Router(config-if)# ip address 192.168.1.254 255.255.255.0 ! Router(config)#interface loopback 2 Router(config-if)# ip address 192.168.2.254 255.255.255.0 ! Router(config)#interface loopback 3 Router(config-if)# ip address 192.168.3.254 255.255.255.0 ! Router(config)#router bgp 100 Router(config-router)#network 192.168.0.0 mask 255.255.255.0 Router(config-router)#network 192.168.1.0 mask 255.255.255.0 Router(config-router)#network 192.168.2.0 mask 255.255.255.0 Router(config-router)#network 192.168.3.0 mask 255.255.255.0 Router(config-router)#network 192.168.0.0 mask 255.255.0.0 Router(config-router)#neighbor 3.3.3.3 route-map AGGREGATE out ! Router(config)#ip route 192.168.0.0 255.255.0.0 null0 !...

如果我們今天在Service Provider中同時要代管許多不同客戶的CE Router BGP configuration時，有時會覺得麻煩的事就是要在每一個CE Router設置相同outbound filter的話要重複許多次同樣的工作。這時就可以使用BGP的一種feature - Outbound Route Filter(ORF)，這個功能不但可以減少routine的作業進行集中控管，更可以節省不必要的BGP update所導致的頻寬浪費。 假設現在有兩個Router，分別為PE(AS100), CE(AS18000)，我們希望設置一個ACL，讓CE Router送出BGP update時，先過濾掉不必要的traffic(如不小心從IGP redistribute到BGP的private network or default)，但是這個動作可以直接在PE Router上進行設置而不需要到每一台的CE Router上去分別設置： PE PE(config)#ip prefix-list ORF_NORFC1918 seq 5 deny 10.0.0.0/8 le 32 PE(config)#ip prefix-list ORF_NORFC1918 seq 10 deny 172.16.0.0/12 le 32 PE(config)#ip prefix-list ORF_NORFC1918 seq 15 deny 192.168.0.0/16 le 32 PE(config)#ip prefix-list ORF_NORFC1918 seq 20 deny 0.0.0.0/0 PE(config)#ip prefix-list ORF_NORFC1918 seq 25 permit 0.0.0.0/0 le 32 ! PE(config)#router bgp 100 PE(config-router)#neighbor 18.18.18.18 remote-as 18000 PE(config-router)#neighbor 18.18.18.18 capability orf prefix-list send PE(config-router)#neighbor 18.18.18.18 prefix-list ORF_NORFC1918 in CE C...

BGP RR Group - 用於BGP RR(Route Reflector)上設定inbound route-targer filter，透過"bgp rr-group"這個指令來設置。這個指令執行跟route-map相同的功能。不過，這個指令是設置於BGP Process之下而且會影響所有的BGP neighbors。同時。另外一個重要的運作細節是在RR上設置的extended community access-list會被當成是outbound filter透過ORF功能傳遞給PE Router。Route-map的input filter無法透過ORF功能來下載。 Route-Partitioning設置步驟如下： 1. 假設CE1-PE1-P1-P2-PE2-CE2這樣的網路架構，我們使用P1, P2當RR，先在P1, P2上設置extended-community access-list P1(config)#ip extcommunity-list standard VPNA  P1(config-extcomm-list)#permit rt 1:100  P2(config)ip extcommunity-list standard VPNB  P2(config-extcomm-list)#permit rt 1:200  2.設置route-target inbound filter，在RRs上BGP process之下設定"bgp rr-group"指令 P1(config)#router bgp 1  P1(config-router)#address-family vpnv4  P1(config-router-af)#bgp rr-group VPNA  P2(config)#router bgp 1  P2(config-router)#address-family vpnv4  P2(config-router-af)#bgp rr-group VPNB  以上是所謂的Route Partitioning的設置範例，不過這比較適用於大型ISP為了讓RR的loading減輕所使用的方式，個人不建議在...

1.0 Overview Cisco Nonstop Forwarding with Stateful Switchover (NSF with SSO) is a Cisco innovation for routers with dual route processors. Cisco NSF with SSO allows a router that has experienced hardware or software failure of an active route processor to maintain data link layer connections and continue forwarding packets during the switchover to the standby route processor. This forwarding can continue despite lost routing protocol peering arrangements with other routers. Routing information is recovered dynamically, in the background, while packet forwarding proceeds uninterrupted. Cisco NSF for BGP is a combination of internal system modifications to the various NSF-capable hardware platforms, and external enhancements to the BGP-4 protocol. The modifications to the BGP protocol (BGP Graceful Restart) have been submitted to the Internet Engineering Task Force (IETF): http://www.ietf.org/internet-drafts/draft-ietf-idr-restart-06.txt1 This document will detail specific changes to th...