BGP Flowspec merupakan salah satu solusi yang digunakan untuk mitigasi serangan berjenis DDoS (DDoS mitigation solution) yang dispesifikasi pada RFC 5575. Ide dibalik RFC tersebut adalah menggunakan BGP route untuk meng-advertise detail informasi mengenai serangan yang dilancarkan attacker. Informasi Flow Specification di encoding ke dalam Multi-Protocol BGP NLRI.
Ada beberapa matching rules yang bisa dipakai sebagai Flow Specification seperti :
Ketika ada trafik yang identik dengan flowspec NLRI, tahap selanjutnya yaitu memberi action terahadap traffic tersebut, beberapa actioan yang dapat dieksekusi antara lain :
Untuk mendemonstrasikan kegunaan BGP flowspec, kita akan melakukan test LAB dengan menggunakan topologi seperti berikut:
Topologi diatas terdiri dari 2 AS Number yaitu AS 64000(attacker ) dan AS 65000(victim). Alur dari topologi diatas yaitu attacker melakukan serangan kepada Victim, ketika paket DDoS sampai di router edge 2 paket akan di examine based on matching creteria yang sudah didefinisakan, jika paket match maka traffic akan di redirect ke dirty VPRN 100 menuju Scrubbing Center, dan akan diforward keluar dari scrubbing center menuju router Edge 2 GRT (Global Routing Table), oleh edge 2 paket diteruskan ke victim/customer. Posting ini berfokus pada jenis serangan Network attacker ya bukan pada Application attacker.
Software yang digunakan pada LAB ini antara lain:
- GNS3 v2.1.8
- GoBGP v1.3.3
- Nokia vSR TiMOS-B-15.0.R5
- Scrubbing center disimulasikan dengan vSR router dengan tujuan hanya untuk memforward packet.
Basic configuration setiap router bisa bisa dilihat pada listing berikut :
Edge1
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 160 161 162 163 164 |
A:edge1# admin display-config # TiMOS-B-15.0.R5 both/x86_64 Nokia 7750 SR Copyright (c) 2000-2017 Nokia. # All rights reserved. All use subject to applicable license agreements. # Built on Wed Sep 27 14:53:19 PDT 2017 by builder in /builds/150B/R5/panos/main # Generated TUE JAN 30 01:41:28 2018 UTC exit all configure #-------------------------------------------------- echo "System Configuration" #-------------------------------------------------- system name "edge1" time sntp shutdown exit zone UTC exit exit #-------------------------------------------------- echo "System Security Configuration" #-------------------------------------------------- system security per-peer-queuing dist-cpu-protection policy "_default-access-policy" create exit policy "_default-network-policy" create exit exit exit exit #-------------------------------------------------- echo "Log Configuration" #-------------------------------------------------- log exit #-------------------------------------------------- echo "Card Configuration" #-------------------------------------------------- card 1 card-type iom-xp mda 1 mda-type c5-1gb-xp-sfp no shutdown exit no shutdown exit #-------------------------------------------------- echo "Port Configuration" #-------------------------------------------------- port 1/1/1 shutdown ethernet exit exit port 1/1/2 ethernet exit no shutdown exit port 1/1/3 ethernet exit no shutdown exit port 1/1/4 shutdown ethernet exit exit port 1/1/5 ethernet exit no shutdown exit #-------------------------------------------------- echo "System Sync-If-Timing Configuration" #-------------------------------------------------- system sync-if-timing begin commit exit exit #-------------------------------------------------- echo "Management Router Configuration" #-------------------------------------------------- router management exit #-------------------------------------------------- echo "Router (Network Side) Configuration" #-------------------------------------------------- router Base interface "system" address 1.1.1.1/32 no shutdown exit interface "to-edge2" address 114.0.1.1/30 port 1/1/2 no shutdown exit autonomous-system 64000 exit #-------------------------------------------------- echo "Service Configuration" #-------------------------------------------------- service customer 1 create description "Default customer" exit exit #-------------------------------------------------- echo "Router (Service Side) Configuration" #-------------------------------------------------- router Base #-------------------------------------------------- echo "Policy Configuration" #-------------------------------------------------- policy-options begin prefix-list "advertise_ip" prefix 1.1.1.1/32 exact prefix 172.16.10.0/30 exact exit policy-statement "adv_ip" entry 10 from prefix-list "advertise_ip" exit action accept exit exit exit commit exit #-------------------------------------------------- echo "BGP Configuration" #-------------------------------------------------- bgp group "ebgp" family ipv4 export "adv_ip" peer-as 65000 split-horizon neighbor 114.0.1.2 local-address 114.0.1.1 exit exit no shutdown exit exit exit all # Finished TUE JAN 30 01:41:30 2018 UTC A:edge1# |
Edge2
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 160 161 162 163 164 165 166 167 168 169 170 171 172 173 174 175 176 177 178 179 180 181 182 183 184 185 186 187 188 189 190 191 192 193 194 195 196 197 198 199 200 201 202 203 204 205 206 207 208 209 210 211 212 213 214 215 216 217 218 219 220 221 222 223 224 225 226 227 228 229 230 231 232 233 234 235 236 237 238 239 240 241 |
A:edge2# This terminal has been idle for 15 minutes It will be logged out if it remains idle for another 15 minutes A:edge2# admin display-config # TiMOS-B-15.0.R5 both/x86_64 Nokia 7750 SR Copyright (c) 2000-2017 Nokia. # All rights reserved. All use subject to applicable license agreements. # Built on Wed Sep 27 14:53:19 PDT 2017 by builder in /builds/150B/R5/panos/main # Generated TUE JAN 30 01:34:02 2018 UTC exit all configure #-------------------------------------------------- echo "System Configuration" #-------------------------------------------------- system name "edge2" time sntp shutdown exit zone UTC exit exit #-------------------------------------------------- echo "System Security Configuration" #-------------------------------------------------- system security per-peer-queuing dist-cpu-protection policy "_default-access-policy" create exit policy "_default-network-policy" create exit exit exit exit #-------------------------------------------------- echo "Log Configuration" #-------------------------------------------------- log exit #-------------------------------------------------- echo "Card Configuration" #-------------------------------------------------- card 1 card-type iom-xp mda 1 mda-type c5-1gb-xp-sfp no shutdown exit no shutdown exit #-------------------------------------------------- echo "Port Configuration" #-------------------------------------------------- port 1/1/1 ethernet exit no shutdown exit port 1/1/2 ethernet mode access exit no shutdown exit port 1/1/3 ethernet exit no shutdown exit port 1/1/4 ethernet mode access exit no shutdown exit port 1/1/5 ethernet exit no shutdown exit #-------------------------------------------------- echo "System Sync-If-Timing Configuration" #-------------------------------------------------- system sync-if-timing begin commit exit exit #-------------------------------------------------- echo "Management Router Configuration" #-------------------------------------------------- router management exit #-------------------------------------------------- echo "Router (Network Side) Configuration" #-------------------------------------------------- router Base interface "system" address 2.2.2.2/32 no shutdown exit interface "to-clean-interface" address 114.0.2.1/30 port 1/1/5 no shutdown exit interface "to-gobgp" address 114.0.6.1/30 port 1/1/3 no shutdown exit interface "to-pe" address 114.0.4.1/30 port 1/1/1 no shutdown exit autonomous-system 65000 #-------------------------------------------------- echo "OSPFv2 Configuration" #-------------------------------------------------- ospf 0 area 0.0.0.0 interface "system" no shutdown exit interface "to-pe" interface-type point-to-point no shutdown exit exit no shutdown exit exit #-------------------------------------------------- echo "Service Configuration" #-------------------------------------------------- service customer 1 create description "Default customer" exit ies 1 customer 1 create interface "to-edge1" create exit exit vprn 100 customer 1 create interface "dirty" create exit exit ies 1 customer 1 create interface "to-edge1" create address 114.0.1.2/30 sap 1/1/2 create exit exit no shutdown exit vprn 100 customer 1 create route-distinguisher 2.2.2.2:100 vrf-target target:65000:100 interface "dirty" create address 192.168.10.1/30 sap 1/1/4 create exit exit static-route-entry 0.0.0.0/0 next-hop 192.168.10.2 no shutdown exit exit no shutdown exit exit #-------------------------------------------------- echo "Router (Service Side) Configuration" #-------------------------------------------------- router Base #-------------------------------------------------- echo "OSPFv2 Configuration" #-------------------------------------------------- ospf 0 no shutdown exit #-------------------------------------------------- echo "Policy Configuration" #-------------------------------------------------- policy-options begin prefix-list "advertise-ip" prefix 2.2.2.2/32 exact exit policy-statement "adv-ip" entry 10 from prefix-list "advertise-ip" exit action accept exit exit exit commit exit #-------------------------------------------------- echo "BGP Configuration" #-------------------------------------------------- bgp group "ebgp" family ipv4 peer-as 64000 split-horizon neighbor 114.0.1.1 local-address 114.0.1.2 exit exit group "ibgp" family ipv4 vpn-ipv4 type internal neighbor 5.5.5.5 next-hop-self exit exit group "flowspec" family flow-ipv4 type internal neighbor 114.0.6.2 exit exit no shutdown exit exit exit all # Finished TUE JAN 30 01:34:06 2018 UTC A:edge2# |
PE
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 160 161 162 163 164 165 166 167 168 169 170 171 172 173 174 175 176 177 178 179 180 181 182 183 184 185 186 187 188 189 190 |
A:pe# This terminal has been idle for 15 minutes It will be logged out if it remains idle for another 15 minutes A:pe# A:pe# admin display-config # TiMOS-B-15.0.R5 both/x86_64 Nokia 7750 SR Copyright (c) 2000-2017 Nokia. # All rights reserved. All use subject to applicable license agreements. # Built on Wed Sep 27 14:53:19 PDT 2017 by builder in /builds/150B/R5/panos/main # Generated TUE JAN 30 01:36:34 2018 UTC exit all configure #-------------------------------------------------- echo "System Configuration" #-------------------------------------------------- system name "pe" time sntp shutdown exit zone UTC exit exit #-------------------------------------------------- echo "System Security Configuration" #-------------------------------------------------- system security per-peer-queuing dist-cpu-protection policy "_default-access-policy" create exit policy "_default-network-policy" create exit exit exit exit #-------------------------------------------------- echo "Log Configuration" #-------------------------------------------------- log exit #-------------------------------------------------- echo "Card Configuration" #-------------------------------------------------- card 1 card-type iom-xp mda 1 mda-type c5-1gb-xp-sfp no shutdown exit no shutdown exit #-------------------------------------------------- echo "Port Configuration" #-------------------------------------------------- port 1/1/1 ethernet exit no shutdown exit port 1/1/2 ethernet exit no shutdown exit port 1/1/3 ethernet exit no shutdown exit port 1/1/4 shutdown ethernet exit exit port 1/1/5 ethernet exit no shutdown exit #-------------------------------------------------- echo "System Sync-If-Timing Configuration" #-------------------------------------------------- system sync-if-timing begin commit exit exit #-------------------------------------------------- echo "Management Router Configuration" #-------------------------------------------------- router management exit #-------------------------------------------------- echo "Router (Network Side) Configuration" #-------------------------------------------------- router Base interface "system" address 5.5.5.5/32 no shutdown exit interface "to-client" address 192.168.70.1/30 port 1/1/5 no shutdown exit interface "to-edge2" address 114.0.4.2/30 port 1/1/1 no shutdown exit autonomous-system 65000 #-------------------------------------------------- echo "OSPFv2 Configuration" #-------------------------------------------------- ospf 0 area 0.0.0.0 interface "system" no shutdown exit interface "to-edge2" interface-type point-to-point no shutdown exit exit no shutdown exit exit #-------------------------------------------------- echo "Service Configuration" #-------------------------------------------------- service customer 1 create description "Default customer" exit exit #-------------------------------------------------- echo "Router (Service Side) Configuration" #-------------------------------------------------- router Base #-------------------------------------------------- echo "OSPFv2 Configuration" #-------------------------------------------------- ospf 0 no shutdown exit #-------------------------------------------------- echo "Policy Configuration" #-------------------------------------------------- policy-options begin prefix-list "advertise_ip" prefix 5.5.5.5/32 exact prefix 192.168.70.0/30 exact exit policy-statement "adv-ip" entry 10 from prefix-list "advertise_ip" exit action accept exit exit exit commit exit #-------------------------------------------------- echo "BGP Configuration" #-------------------------------------------------- bgp group "iBGP" family ipv4 vpn-ipv4 type internal export "adv-ip" neighbor 2.2.2.2 exit exit no shutdown exit exit exit all # Finished TUE JAN 30 01:36:36 2018 UTC |
Konfigurasi GoBGP
GoBGP adalah aplikasi open source yang dapat digunakan untuk mengerate macam-macam route bgp seperti Flowspec, EVPN, BMP, dll. GoBGP berjalan diatas linux OS dan dapat diinstall dengan mengunduh paket binary release dari Github. Ketika paket sudah di extract, terdapat dua file didalamnya yaitu gobgpd dan gobgp. Selanjutnya buat file konfigurasi dasar yang berisi informasi neighbor, AS number, tipe route, dan router-id dengan perintah vi nama_file_konfigurasi.conf.
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 |
[root@gobgp ~]# cat flowspec.conf [global.config] as = 65000 router-id = "114.0.6.2" [[neighbors]] [neighbors.config] neighbor-address = "114.0.6.1" peer-as = 65000 [[neighbors.afi-safis]] [neighbors.afi-safis.config] afi-safi-name = "ipv4-flowspec" [root@gobgp ~]# |
Selanjutnya eksekusi file konfigurasi dengan perintah:
|
1 2 3 4 5 |
[root@gobgp ~]# ./gobgpd -f flowspec.conf {"level":"info","msg":"gobgpd started","time":"2018-07-30T02:36:45-04:00"} {"Topic":"Config","level":"info","msg":"Finished reading the config file","time":"2018-07-30T02:36:45-04:00"} {"level":"info","msg":"Peer 114.0.6.1 is added","time":"2018-07-30T02:36:45-04:00"} {"Topic":"Peer","level":"info","msg":"Add a peer configuration for:114.0.6.1","time":"2018-07-30T02:36:45-04:00"} |
Hasilnya router edge 2 dan gobgp akan membuat session bgp family flowspec-ipv4 seperti berikut :
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 |
A:edge2# ---<output-omitted>--- =============================================================================== BGP Summary =============================================================================== Legend : D - Dynamic Neighbor =============================================================================== Neighbor Description AS PktRcvd InQ Up/Down State|Rcv/Act/Sent (Addr Family) PktSent OutQ ------------------------------------------------------------------------------- 5.5.5.5 65000 385 0 03h10m58s 2/1/3 (IPv4) 387 0 0/0/2 (VpnIPv4) 114.0.1.1 64000 388 0 03h11m56s 3/3/1 (IPv4) 389 0 114.0.6.2 65000 5 0 00h00m01s 0/0/0 (FlowIPv4) 6 0 ------------------------------------------------------------------------------- A:edge2# |
Adding Flowspec Route
Route criteria yang akan dibuat disini adalah matching destination ip victim (192.168.70.2/30) dengan action Redirect ke dirty VPRN dan akan diteruskan ke scrubbing center.
Perintah yang akan digunakan untuk add route pada GoBGP adalah sebagai berikut :
|
1 |
[root@gobgp ~]#./gobgp global rib -a ipv4-flowspec add match destination 192.168.70.2/32 then redirect 65000:100 |
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 |
A:edge2>config>service>vprn# show router bgp routes flow-ipv4 =============================================================================== BGP Router ID:2.2.2.2 AS:65000 Local AS:65000 =============================================================================== Legend - Status codes : u - used, s - suppressed, h - history, d - decayed, * - valid l - leaked, x - stale, > - best, b - backup, p - purge Origin codes : i - IGP, e - EGP, ? - incomplete =============================================================================== BGP FLOW IPV4 Routes =============================================================================== Flag Network Nexthop LocalPref MED As-Path ------------------------------------------------------------------------------- u*>? -- 0.0.0.0 100 None No As-Path Community Action: redirect-to-vrf:65000:100 NLRI Subcomponents: Dest Pref : 192.168.70.2/32 ------------------------------------------------------------------------------- Routes : 1 =============================================================================== A:edge2> |
Flow specification tersebut akan diimplementasikan di interface IES yang terkoneksi dengan edge1, pada router nokia implementasi flowspec dilakukan pada ip-filter, disini akan dibuat ip-filter dengan id 100 seperti dibawah ini :
|
1 2 3 4 5 6 7 |
A:edge2# configure filter ip-filter 100 create A:edge2>config>filter>ip-filter# info ---------------------------------------------- default-action forward embed-filter flowspec router "Base" ---------------------------------------------- A:edge2>config>filter>ip-filter# |
default-action yang digunakan adalah forward, artinya jika ada traffic yang tidak matching dengan flow-spec maka akan diallow, command embed-filter flowspec router “Base” artinya menerapkan flow specification pada router Base (Global Routing Table).
Network Telco Engineer – SDN/NFV Enthusiast
Komentar