Konfigurasi BGP Flowspec dengan GoBGP

BGP Flowspec merupakan salah satu solusi yang digunakan untuk mitigasi serangan berjenis DDoS (DDoS mitigation solution) yang dispesifikasi pada RFC 5575. Ide dibalik RFC tersebut adalah menggunakan BGP route untuk meng-advertise detail informasi mengenai serangan yang dilancarkan attacker. Informasi Flow Specification di encoding ke dalam Multi-Protocol BGP NLRI.

Ada beberapa matching rules yang bisa dipakai sebagai  Flow Specification seperti :

Ketika ada trafik yang identik dengan flowspec NLRI, tahap selanjutnya yaitu memberi action terahadap traffic tersebut, beberapa actioan yang dapat dieksekusi antara lain :

Untuk mendemonstrasikan kegunaan BGP flowspec, kita akan melakukan test LAB dengan menggunakan topologi seperti berikut:

Topologi diatas terdiri dari 2 AS Number yaitu AS 64000(attacker ) dan AS 65000(victim). Alur dari topologi diatas yaitu attacker melakukan serangan kepada Victim, ketika paket DDoS  sampai di router edge 2 paket akan di examine based on matching creteria yang sudah didefinisakan, jika paket match maka traffic akan di redirect ke dirty VPRN 100 menuju Scrubbing Center, dan akan diforward keluar dari scrubbing center menuju router Edge 2 GRT (Global Routing Table), oleh edge 2 paket diteruskan ke victim/customer. Posting ini berfokus pada jenis serangan Network attacker ya bukan pada Application attacker.

Software yang digunakan pada LAB ini antara lain:

  • GNS3 v2.1.8
  • GoBGP v1.3.3
  • Nokia vSR TiMOS-B-15.0.R5
  • Scrubbing center disimulasikan dengan vSR router dengan tujuan hanya untuk memforward packet.

Basic configuration setiap router bisa bisa dilihat pada listing berikut :

Edge1

A:edge1# admin display-config  
# TiMOS-B-15.0.R5 both/x86_64 Nokia 7750 SR Copyright (c) 2000-2017 Nokia.
# All rights reserved. All use subject to applicable license agreements.
# Built on Wed Sep 27 14:53:19 PDT 2017 by builder in /builds/150B/R5/panos/main

# Generated TUE JAN 30 01:41:28 2018 UTC

exit all
configure
#--------------------------------------------------
echo "System Configuration"
#--------------------------------------------------
    system
        name "edge1"
        time
            sntp
                shutdown
            exit
            zone UTC 
        exit
    exit
#--------------------------------------------------
echo "System Security Configuration"
#--------------------------------------------------
    system
        security
            per-peer-queuing
            dist-cpu-protection
                policy "_default-access-policy" create
                exit
                policy "_default-network-policy" create
                exit
            exit
        exit
    exit
#--------------------------------------------------
echo "Log Configuration"
#--------------------------------------------------
    log 
    exit 
#--------------------------------------------------
echo "Card Configuration"
#--------------------------------------------------
    card 1
        card-type iom-xp
        mda 1
            mda-type c5-1gb-xp-sfp    
            no shutdown
        exit
        no shutdown
    exit
#--------------------------------------------------
echo "Port Configuration"
#--------------------------------------------------
    port 1/1/1
        shutdown
        ethernet
        exit
    exit
    port 1/1/2
        ethernet
        exit
        no shutdown
    exit
    port 1/1/3
        ethernet
        exit
        no shutdown
    exit
    port 1/1/4                        
        shutdown
        ethernet
        exit
    exit
    port 1/1/5
        ethernet
        exit
        no shutdown
    exit
#--------------------------------------------------
echo "System Sync-If-Timing Configuration"
#--------------------------------------------------
    system
        sync-if-timing
            begin
            commit
        exit
    exit
#--------------------------------------------------
echo "Management Router Configuration"
#--------------------------------------------------
    router management
    exit                              

#--------------------------------------------------
echo "Router (Network Side) Configuration"
#--------------------------------------------------
    router Base
        interface "system"
            address 1.1.1.1/32
            no shutdown
        exit
        interface "to-edge2"
            address 114.0.1.1/30
            port 1/1/2
            no shutdown
        exit
        autonomous-system 64000
    exit

#--------------------------------------------------
echo "Service Configuration"
#--------------------------------------------------
    service
        customer 1 create
            description "Default customer"
        exit
    exit
#--------------------------------------------------
echo "Router (Service Side) Configuration"
#--------------------------------------------------
    router Base
#--------------------------------------------------
echo "Policy Configuration"
#--------------------------------------------------
        policy-options
            begin
            prefix-list "advertise_ip"
                prefix 1.1.1.1/32 exact
                prefix 172.16.10.0/30 exact
            exit
            policy-statement "adv_ip"
                entry 10
                    from              
                        prefix-list "advertise_ip"
                    exit
                    action accept
                    exit
                exit
            exit
            commit
        exit
#--------------------------------------------------
echo "BGP Configuration"
#--------------------------------------------------
        bgp
            group "ebgp"
                family ipv4
                export "adv_ip" 
                peer-as 65000
                split-horizon
                neighbor 114.0.1.2
                    local-address 114.0.1.1
                exit
            exit
            no shutdown
        exit                          
    exit


exit all

# Finished TUE JAN 30 01:41:30 2018 UTC
A:edge1#

Edge2

A:edge2# This terminal has been idle for 15 minutes
It will be logged out if it remains idle for another 15 minutes
A:edge2# admin display-config 
# TiMOS-B-15.0.R5 both/x86_64 Nokia 7750 SR Copyright (c) 2000-2017 Nokia.
# All rights reserved. All use subject to applicable license agreements.
# Built on Wed Sep 27 14:53:19 PDT 2017 by builder in /builds/150B/R5/panos/main

# Generated TUE JAN 30 01:34:02 2018 UTC

exit all
configure
#--------------------------------------------------
echo "System Configuration"
#--------------------------------------------------
    system
        name "edge2"
        time
            sntp
                shutdown
            exit
            zone UTC 
        exit
    exit
#--------------------------------------------------
echo "System Security Configuration"
#--------------------------------------------------
    system
        security
            per-peer-queuing
            dist-cpu-protection
                policy "_default-access-policy" create
                exit
                policy "_default-network-policy" create
                exit
            exit
        exit
    exit
#--------------------------------------------------
echo "Log Configuration"
#--------------------------------------------------
    log 
    exit 
#--------------------------------------------------
echo "Card Configuration"
#--------------------------------------------------
    card 1
        card-type iom-xp
        mda 1
            mda-type c5-1gb-xp-sfp    
            no shutdown
        exit
        no shutdown
    exit
#--------------------------------------------------
echo "Port Configuration"
#--------------------------------------------------
    port 1/1/1
        ethernet
        exit
        no shutdown
    exit
    port 1/1/2
        ethernet
            mode access
        exit
        no shutdown
    exit
    port 1/1/3
        ethernet
        exit
        no shutdown
    exit                              
    port 1/1/4
        ethernet
            mode access
        exit
        no shutdown
    exit
    port 1/1/5
        ethernet
        exit
        no shutdown
    exit
#--------------------------------------------------
echo "System Sync-If-Timing Configuration"
#--------------------------------------------------
    system
        sync-if-timing
            begin
            commit
        exit
    exit
#--------------------------------------------------
echo "Management Router Configuration"
#--------------------------------------------------
    router management
    exit

#--------------------------------------------------
echo "Router (Network Side) Configuration"
#--------------------------------------------------
    router Base
        interface "system"
            address 2.2.2.2/32
            no shutdown
        exit
        interface "to-clean-interface"
            address 114.0.2.1/30      
            port 1/1/5
            no shutdown
        exit
        interface "to-gobgp"
            address 114.0.6.1/30
            port 1/1/3
            no shutdown
        exit
        interface "to-pe"
            address 114.0.4.1/30
            port 1/1/1
            no shutdown
        exit
        autonomous-system 65000
#--------------------------------------------------
echo "OSPFv2 Configuration"
#--------------------------------------------------
        ospf 0
            area 0.0.0.0
                interface "system"
                    no shutdown
                exit
                interface "to-pe"     
                    interface-type point-to-point
                    no shutdown
                exit
            exit
            no shutdown
        exit
    exit

#--------------------------------------------------
echo "Service Configuration"
#--------------------------------------------------
    service
        customer 1 create
            description "Default customer"
        exit
        ies 1 customer 1 create
            interface "to-edge1" create
            exit
        exit
        vprn 100 customer 1 create
            interface "dirty" create
            exit
        exit                          
        ies 1 customer 1 create
            interface "to-edge1" create
                address 114.0.1.2/30
                sap 1/1/2 create
                exit
            exit
            no shutdown
        exit
        vprn 100 customer 1 create
            route-distinguisher 2.2.2.2:100
            vrf-target target:65000:100
            interface "dirty" create
                address 192.168.10.1/30
                sap 1/1/4 create
                exit
            exit
            static-route-entry 0.0.0.0/0
                next-hop 192.168.10.2
                    no shutdown
                exit                  
            exit
            no shutdown
        exit
    exit
#--------------------------------------------------
echo "Router (Service Side) Configuration"
#--------------------------------------------------
    router Base
#--------------------------------------------------
echo "OSPFv2 Configuration"
#--------------------------------------------------
        ospf 0
            no shutdown
        exit
#--------------------------------------------------
echo "Policy Configuration"
#--------------------------------------------------
        policy-options
            begin
            prefix-list "advertise-ip"
                prefix 2.2.2.2/32 exact
            exit
            policy-statement "adv-ip"
                entry 10
                    from
                        prefix-list "advertise-ip"
                    exit
                    action accept
                    exit
                exit
            exit
            commit
        exit
#--------------------------------------------------
echo "BGP Configuration"
#--------------------------------------------------
        bgp
            group "ebgp"              
                family ipv4
                peer-as 64000
                split-horizon
                neighbor 114.0.1.1
                    local-address 114.0.1.2
                exit
            exit
            group "ibgp"
                family ipv4 vpn-ipv4
                type internal
                neighbor 5.5.5.5
                    next-hop-self
                exit
            exit
            group "flowspec"
                family flow-ipv4
                type internal
                neighbor 114.0.6.2
                exit
            exit
            no shutdown
        exit
    exit                              


exit all

# Finished TUE JAN 30 01:34:06 2018 UTC
A:edge2#

PE

A:pe# This terminal has been idle for 15 minutes
It will be logged out if it remains idle for another 15 minutes
A:pe# 
A:pe# admin display-config 
# TiMOS-B-15.0.R5 both/x86_64 Nokia 7750 SR Copyright (c) 2000-2017 Nokia.
# All rights reserved. All use subject to applicable license agreements.
# Built on Wed Sep 27 14:53:19 PDT 2017 by builder in /builds/150B/R5/panos/main

# Generated TUE JAN 30 01:36:34 2018 UTC

exit all
configure
#--------------------------------------------------
echo "System Configuration"
#--------------------------------------------------
    system
        name "pe"
        time
            sntp
                shutdown
            exit
            zone UTC 
        exit
    exit
#--------------------------------------------------
echo "System Security Configuration"
#--------------------------------------------------
    system
        security
            per-peer-queuing
            dist-cpu-protection
                policy "_default-access-policy" create
                exit
                policy "_default-network-policy" create
                exit
            exit
        exit
    exit
#--------------------------------------------------
echo "Log Configuration"
#--------------------------------------------------
    log 
    exit 
#--------------------------------------------------
echo "Card Configuration"
#--------------------------------------------------
    card 1
        card-type iom-xp
        mda 1
            mda-type c5-1gb-xp-sfp    
            no shutdown
        exit
        no shutdown
    exit
#--------------------------------------------------
echo "Port Configuration"
#--------------------------------------------------
    port 1/1/1
        ethernet
        exit
        no shutdown
    exit
    port 1/1/2
        ethernet
        exit
        no shutdown
    exit
    port 1/1/3
        ethernet
        exit
        no shutdown
    exit
    port 1/1/4                        
        shutdown
        ethernet
        exit
    exit
    port 1/1/5
        ethernet
        exit
        no shutdown
    exit
#--------------------------------------------------
echo "System Sync-If-Timing Configuration"
#--------------------------------------------------
    system
        sync-if-timing
            begin
            commit
        exit
    exit
#--------------------------------------------------
echo "Management Router Configuration"
#--------------------------------------------------
    router management
    exit                              

#--------------------------------------------------
echo "Router (Network Side) Configuration"
#--------------------------------------------------
    router Base
        interface "system"
            address 5.5.5.5/32
            no shutdown
        exit
        interface "to-client"
            address 192.168.70.1/30
            port 1/1/5
            no shutdown
        exit
        interface "to-edge2"
            address 114.0.4.2/30
            port 1/1/1
            no shutdown
        exit
        autonomous-system 65000
#--------------------------------------------------
echo "OSPFv2 Configuration"
#--------------------------------------------------
        ospf 0
            area 0.0.0.0
                interface "system"
                    no shutdown
                exit
                interface "to-edge2"
                    interface-type point-to-point
                    no shutdown
                exit
            exit
            no shutdown
        exit
    exit

#--------------------------------------------------
echo "Service Configuration"
#--------------------------------------------------
    service
        customer 1 create
            description "Default customer"
        exit
    exit
#--------------------------------------------------
echo "Router (Service Side) Configuration"
#--------------------------------------------------
    router Base
#--------------------------------------------------
echo "OSPFv2 Configuration"
#--------------------------------------------------
        ospf 0
            no shutdown
        exit
#--------------------------------------------------
echo "Policy Configuration"
#--------------------------------------------------
        policy-options
            begin
            prefix-list "advertise_ip"
                prefix 5.5.5.5/32 exact
                prefix 192.168.70.0/30 exact
            exit
            policy-statement "adv-ip"
                entry 10
                    from
                        prefix-list "advertise_ip"
                    exit              
                    action accept
                    exit
                exit
            exit
            commit
        exit
#--------------------------------------------------
echo "BGP Configuration"
#--------------------------------------------------
        bgp
            group "iBGP"
                family ipv4 vpn-ipv4
                type internal
                export "adv-ip" 
                neighbor 2.2.2.2
                exit
            exit
            no shutdown
        exit
    exit


exit all                              

# Finished TUE JAN 30 01:36:36 2018 UTC

Konfigurasi GoBGP

GoBGP adalah aplikasi open source yang dapat digunakan untuk mengerate macam-macam route bgp seperti Flowspec, EVPN, BMP, dll. GoBGP berjalan diatas linux OS dan dapat diinstall dengan mengunduh paket binary release dari Github. Ketika paket sudah di extract, terdapat dua file didalamnya yaitu gobgpd dan gobgp. Selanjutnya buat file konfigurasi dasar yang berisi informasi neighbor, AS number, tipe route, dan router-id dengan perintah vi nama_file_konfigurasi.conf.

 

[root@gobgp ~]# cat flowspec.conf
[global.config]
  as = 65000
  router-id = "114.0.6.2"

[[neighbors]]
[neighbors.config]
  neighbor-address = "114.0.6.1"
  peer-as = 65000
[[neighbors.afi-safis]]
  [neighbors.afi-safis.config]
  afi-safi-name = "ipv4-flowspec"

[root@gobgp ~]#

Selanjutnya eksekusi file konfigurasi dengan perintah:

[root@gobgp ~]# ./gobgpd -f flowspec.conf 
{"level":"info","msg":"gobgpd started","time":"2018-07-30T02:36:45-04:00"}
{"Topic":"Config","level":"info","msg":"Finished reading the config file","time":"2018-07-30T02:36:45-04:00"}
{"level":"info","msg":"Peer 114.0.6.1 is added","time":"2018-07-30T02:36:45-04:00"}
{"Topic":"Peer","level":"info","msg":"Add a peer configuration for:114.0.6.1","time":"2018-07-30T02:36:45-04:00"}

Hasilnya router edge 2 dan gobgp akan membuat session bgp family flowspec-ipv4 seperti berikut :

A:edge2#
---<output-omitted>---
===============================================================================
BGP Summary
===============================================================================
Legend : D - Dynamic Neighbor
===============================================================================
Neighbor
Description                           
                   AS PktRcvd InQ  Up/Down   State|Rcv/Act/Sent (Addr Family)
                      PktSent OutQ
-------------------------------------------------------------------------------
5.5.5.5
               65000      385    0 03h10m58s 2/1/3 (IPv4)
                          387    0           0/0/2 (VpnIPv4)
114.0.1.1
               64000      388    0 03h11m56s 3/3/1 (IPv4)
                          389    0           
114.0.6.2
               65000        5    0 00h00m01s 0/0/0 (FlowIPv4)
                            6    0           
-------------------------------------------------------------------------------
A:edge2#

Adding Flowspec Route

Route criteria yang akan dibuat disini adalah matching destination ip victim (192.168.70.2/30) dengan action Redirect ke dirty VPRN dan akan diteruskan ke scrubbing center.

Perintah yang akan digunakan untuk add route pada GoBGP adalah sebagai berikut :

[root@gobgp ~]#./gobgp global rib -a ipv4-flowspec add match destination 192.168.70.2/32 then redirect 65000:100
A:edge2>config>service>vprn# show router bgp routes flow-ipv4 
===============================================================================
 BGP Router ID:2.2.2.2          AS:65000       Local AS:65000      
===============================================================================
 Legend -
 Status codes  : u - used, s - suppressed, h - history, d - decayed, * - valid
                 l - leaked, x - stale, > - best, b - backup, p - purge
 Origin codes  : i - IGP, e - EGP, ? - incomplete

===============================================================================
BGP FLOW IPV4 Routes
===============================================================================
Flag  Network             Nexthop                 LocalPref       MED
      As-Path                                                     
-------------------------------------------------------------------------------
u*>?  --                  0.0.0.0                 100             None
      No As-Path
                                                                  
      Community Action:  redirect-to-vrf:65000:100
      NLRI Subcomponents:                                         
      Dest Pref : 192.168.70.2/32
-------------------------------------------------------------------------------
Routes : 1
===============================================================================
A:edge2>

Flow specification tersebut akan diimplementasikan di interface IES yang terkoneksi dengan edge1, pada router nokia implementasi flowspec dilakukan pada ip-filter, disini akan dibuat ip-filter dengan id 100 seperti dibawah ini :

A:edge2# configure filter ip-filter 100 create 
A:edge2>config>filter>ip-filter# info 
----------------------------------------------
            default-action forward
            embed-filter flowspec router "Base"
----------------------------------------------
A:edge2>config>filter>ip-filter#

default-action yang digunakan adalah forward, artinya jika ada traffic yang tidak matching dengan flow-spec maka akan diallow, command embed-filter flowspec router “Base” artinya menerapkan flow specification pada router Base (Global Routing Table).

 

About the author
Khoirul Firdaus

Khoirul Firdaus

Network Telco Engineer - SDN/NFV Enthusiast

Routecloud Networks

Information about Server, Linux and Computer Network.

Great! You’ve successfully signed up.

Welcome back! You've successfully signed in.

You've successfully subscribed to Routecloud Networks.

Success! Check your email for magic link to sign-in.

Success! Your billing info has been updated.

Your billing was not updated.