Presentation - Cisco Knowledge Network

More documents

Recommendations

Info

Centralization of AuthorityFuture• If the RIRs have the only valid certificate database....- What if you get into a billing dispute with the RIR?- Can they shut down your business while it’s resolved?- What if two governments go to war, or sanctions are imposed bysomeone on someone else?- Will the RIRs be able to “pick sides?”- Do the RIRs really want to be in the middle of these sorts ofpolitical situations?- Do the Service Providers?- What if someone’s origination is successfully stolen?- Who gets sued? For how much? By whom?• Lots of questions for which there are no clear answersyet....© 2012 <strong>Cisco</strong> and/or its affiliates. All rights reserved. 60
Future• Start Here• AS65000 advertises 10.1.1.0/24• AS65020 receives the advertisement for10.1.1.0/24 with the AS Path {65000,65001}• There are at least two meanings• Showing a specific advertisement of specificreachability information has actually passedthrough a specific set of AS’• AS65020 can prove the advertisement for10.1.1.0/24 actually passed through AS65001• Showing a specific AS Path exists within thenetwork• AS65020 can show AS65000 is actually connectedto AS65001• AS65020 can show AS65001 is actually connectedto AS65020AS65020AS65001AS65000© 2012 <strong>Cisco</strong> and/or its affiliates. All rights reserved. 61
Page 1 and 2:
Routing SecurityAn Holistic Overvie
Page 3 and 4:
• Objectives of this talk:• Pre
Page 5 and 6:
© 2012 Cisco and/or its affiliates
Page 7 and 8:
Biggest Bandwidth• Largest monito
Page 9 and 10: ThreatsAttack on device control pla
Page 11 and 12: © 2012 Cisco and/or its affiliates
Page 13 and 14: Utilizing routing technology in the
Page 15 and 16: • Implementing blackholing requir
Page 17 and 18: Active/Active FirewallPre-2010 Oper
Page 19 and 20: Sink Hole RoutingIPS/IDS Enhancemen
Page 21 and 22: Hardening the infrastructureOlder S
Page 23 and 24: CoPP Enhancements for Routing• At
Page 25 and 26: • Main function is to forwards fo
Page 27 and 28: • LPTS has HW policers on line ca
Page 29 and 30: Enhanced Router Authentication / Co
Page 31 and 32: Securing Inter-AS VPN Confidentiali
Page 33 and 34: Distribution Automation of Security
Page 37 and 38: Malformed BGP UpdatesInvalidAttribu
Page 39 and 40: • Comes into play after attribute
Page 43 and 44: 20Source: NANOG 46: Tom Daly et al.
Page 45 and 46: BeforeAfter© 2012 Cisco and/or its
Page 47 and 48: • http://www.networkworld.com/new
Page 49 and 50: • The goal of the RPKI is to cryp
Page 51 and 52: • Each AS publishes a cryptograph
Page 53 and 54: CA ToolsetPublicationpoint (can beh
Page 55 and 56: EBGP updateRouterCheck and markorig
Page 57 and 58: The “One Behind” Attack• AS65
Page 59: The “Shorter Prefix” Problem•
Page 63 and 64: Advertisement vs. Path Validation
Page 65 and 66: • What are Bogons?A bogon is a bo
Page 67 and 68: • Multi-Instance / Multi-AS BGP
show all

Presentation - Cisco Knowledge Network

Create successful ePaper yourself

Delete template?

Save as template?