Presentation - Cisco Knowledge Network

More documents

Recommendations

Info

• RPKI starts with each RIR (ReginoalInternet Registry) generatingcertificates for each prefix it assigns,and distributes that certificate alongwith the prefix.The certificate says “I’m giving thiscustomer of mine prefix , and you canprove I said this by validating that I signedthis certificate with my public key”Getting the public key is straightforwardusing the usual PKI methods.• Each ISP sub-allocating prefixblocks makes the same statementsBut the ISP can only distribute morespecifics of those they have beenassigned.Signature© 2012 <strong>Cisco</strong> and/or its affiliates. All rights reserved. 50
• Each AS publishes a cryptographically signed “ROA” (RouteOrigin Authorization) that declares association of its prefixeswith an Origin AS.ROA98.128.0.0/16-24AS 3130Signature• The ROA says “I’m authorizing AS to be the origin for prefix ”and you can prove this by verifyingthe signature on this ROA.”• The ROA is verified with the publickey of the organization creating theROA, which will be available to theverifier because it has the certificateof the AS.© 2012 <strong>Cisco</strong> and/or its affiliates. All rights reserved. 51
Page 1 and 2: Routing SecurityAn Holistic Overvie
Page 3 and 4: • Objectives of this talk:• Pre
Page 5 and 6: © 2012 Cisco and/or its affiliates
Page 7 and 8: Biggest Bandwidth• Largest monito
Page 9 and 10: ThreatsAttack on device control pla
Page 13 and 14: Utilizing routing technology in the
Page 15 and 16: • Implementing blackholing requir
Page 17 and 18: Active/Active FirewallPre-2010 Oper
Page 19 and 20: Sink Hole RoutingIPS/IDS Enhancemen
Page 21 and 22: Hardening the infrastructureOlder S
Page 23 and 24: CoPP Enhancements for Routing• At
Page 25 and 26: • Main function is to forwards fo
Page 27 and 28: • LPTS has HW policers on line ca
Page 29 and 30: Enhanced Router Authentication / Co
Page 31 and 32: Securing Inter-AS VPN Confidentiali
Page 33 and 34: Distribution Automation of Security
Page 37 and 38: Malformed BGP UpdatesInvalidAttribu
Page 39 and 40: • Comes into play after attribute
Page 43 and 44: 20Source: NANOG 46: Tom Daly et al.
Page 45 and 46: BeforeAfter© 2012 Cisco and/or its
Page 47 and 48: • http://www.networkworld.com/new
Page 49: • The goal of the RPKI is to cryp
Page 53 and 54: CA ToolsetPublicationpoint (can beh
Page 55 and 56: EBGP updateRouterCheck and markorig
Page 57 and 58: The “One Behind” Attack• AS65
Page 59 and 60: The “Shorter Prefix” Problem•
Page 61 and 62: Future• Start Here• AS65000 adv
Page 63 and 64: Advertisement vs. Path Validation
Page 65 and 66: • What are Bogons?A bogon is a bo
Page 67 and 68: • Multi-Instance / Multi-AS BGP

Presentation - Cisco Knowledge Network

Create successful ePaper yourself

Delete template?

Save as template?