vyos/vyos-documentation
1
0
Fork 0
mirror of https://github.com/vyos/vyos-documentation.git synced 2025-10-26 08:41:46 +01:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #156 from sever-sever/add-bgp-rpki

Browse Source 
bgp: add section RPKI
This commit is contained in:
Daniil Baturin 2019-11-30 20:36:50 +07:00 committed by GitHub
commit 008d9d8a88
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 38 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

38
docs/routing/bgp.rst
View File

@ -147,3 +147,41 @@ Route filter can be applied using a route-map:
We could expand on this and also deny link local and multicast in the rule 20
action deny.
RPKI
^^^^
:abbr:`RPKI (Resource Public Key Infrastructure)` is a framework :abbr:`PKI (Public Key Infastucrure)`
designed to secure the Internet routing insfratructure.
It associate a BGP route announcement with the correct originating :abbr:`ASN (Autonomus System Number)` and check it validation.
RPKI described in :rfc:`6480`. This is a separate server. You can find more details at RIPE-NNC_.
Imported prefixes during the validation may have values: valid, invalid and notfound.
* The valid state means that prefix and ASN that originated it match the :abbr:`ROA (Route Origination Authorizations)` base.
* Invalid means that prefix/prefix length and ASN that originated it doesn't match with ROA.
* Notfound means that prefix not found in ROA.
We can build route-maps for import, based on these states.
Simple RPKI configuration, where 'routinator' - RPKI cache server with ip '10.11.11.1'.
.. code-block:: none
set protocols rpki cache routinator address '10.11.11.1'
set protocols rpki cache routinator port '3323'
Example route-map for import. We can set local-preference logic based on states.
Also we may not import prefixes with the state 'invalid'.
.. code-block:: none
set policy route-map ROUTES-IN rule 10 action 'permit'
set policy route-map ROUTES-IN rule 10 match rpki 'valid'
set policy route-map ROUTES-IN rule 10 set local-preference '300'
set policy route-map ROUTES-IN rule 20 action 'permit'
set policy route-map ROUTES-IN rule 20 match rpki 'notfound'
set policy route-map ROUTES-IN rule 20 set local-preference '125'
set policy route-map ROUTES-IN rule 30 action 'deny'
set policy route-map ROUTES-IN rule 30 match rpki 'invalid'
.. _RIPE-NNC: https://github.com/RIPE-NCC/rpki-validator-3/wiki