Peering Exchange Router Configuration

Hi ]\/[arco,

Thanks for your comment. What your saying makes sense I guess. Presumably you could also run multiple peering exchanges (or multiple connections to the same exchange) on the same router so its not wasted as such :-)

I'll read into urpf now - hard finding exact examples for alot of these topics as they are generally probably implemented in large organisations with big budgets :-)

If you or anyone else could check over my config I'd be greatful. Specifically I guess If I'm going to run a dedicated router for this task all I need to do is setup iBGP so my routes are exported but filter ALL incoming routes (inc default) to ensure there is no way a packet destined for another network could ever get forwarded?

Thanks.
Mike

Hi Mike,

you configs looks good to start! If you want more security, a couple of suggestions:

- You're now setting maximum prefix on each peering. This is good but won't protect you from i.e. a small number of leaking routes. This would also prevent a peering to announce you a big block, and making YOU use it as a transit! Most IXs force their peering partners to update a central database with all the prefixes they should announce, so that you can build proper filters to enforce correct operations. Others like to build filters based on ripe/radb/peeringdb but not all providers maintain correct data in there. In that case IRRToolset (https://www.isc.org/node/154) is a great tool to automatically build acl/route-maps/distribution lists out of thes databases.

- Choose a communities infrastructure and stick with it. This is a great resource on that: http://www.nanog.org/meetings/nanog40/presentations/BGPcommunities.pdf.

Cheers,
]\/[arco

hI ]\/[arco,

I forgot to say - thanks for your input. The tool and also the link to the communities pdf are very helpful - I'll be adopting them in our network.

Thanks,

Mike

You're welcome Mike, glad to help and thanks for the points!

Cheers,
]\/[arco

]\/[arco,

If your still following this question - can you give me an indication of the configuration necessary for URPF to prevent other peers on the IX pointing default? I'm not sure I see how it could prevent that.

From my reading today, my understand is that it would simply prevent spoofed packets from entering the interface by checking the source address exists in the routing table (which presumably will perform better than a number of ACL lines...).

Presume full routes are required for this?

Thanks,

Mike

Hi Mike,

still here! ;)
urpf does just that, denies everything coming in an interface which does not have a path back the same interface. Loose urpf instead denis everything incoming in an interface which does not have a patch back via any other real interface or the default route.
Here's a farily comprehensive overview: http://www.cisco.com/web/about/security/intelligence/urpf.pdf
Think of it on an IXP facing interface. urpf will drop every packet coming in which have not a way back to the same interface. So if they want to point default at you, they must advertise all the internet to you, and will so blocked by your prefix list or your maximum prefix limit, otherwise the route won't be in the FIB! Since you're single homed to the IXP you can use strict urpf on the interface facing the IXP and forget about the slow acls! ;)

Cheers,
]\/[arco