vyos/vyos-documentation
1
0
Fork 0
mirror of https://github.com/vyos/vyos-documentation.git synced 2025-10-26 08:41:46 +01:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #156 from sever-sever/add-bgp-rpki

Browse Source 
bgp: add section RPKI
This commit is contained in:
Daniil Baturin 2019-11-30 20:36:50 +07:00 committed by GitHub
commit 008d9d8a88
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 38 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

38
docs/routing/bgp.rst
View File

@ -147,3 +147,41 @@ Route filter can be applied using a route-map:
We could expand on this and also deny link local and multicast in the rule 20 We could expand on this and also deny link local and multicast in the rule 20
action deny. action deny.
RPKI
^^^^
:abbr:`RPKI (Resource Public Key Infrastructure)` is a framework :abbr:`PKI (Public Key Infastucrure)`
designed to secure the Internet routing insfratructure.
It associate a BGP route announcement with the correct originating :abbr:`ASN (Autonomus System Number)` and check it validation.
RPKI described in :rfc:`6480`. This is a separate server. You can find more details at RIPE-NNC_.
Imported prefixes during the validation may have values: valid, invalid and notfound.
* The valid state means that prefix and ASN that originated it match the :abbr:`ROA (Route Origination Authorizations)` base.
* Invalid means that prefix/prefix length and ASN that originated it doesn't match with ROA.
* Notfound means that prefix not found in ROA.
We can build route-maps for import, based on these states.
Simple RPKI configuration, where 'routinator' - RPKI cache server with ip '10.11.11.1'.
.. code-block:: none
set protocols rpki cache routinator address '10.11.11.1'
set protocols rpki cache routinator port '3323'
Example route-map for import. We can set local-preference logic based on states.
Also we may not import prefixes with the state 'invalid'.
.. code-block:: none
set policy route-map ROUTES-IN rule 10 action 'permit'
set policy route-map ROUTES-IN rule 10 match rpki 'valid'
set policy route-map ROUTES-IN rule 10 set local-preference '300'
set policy route-map ROUTES-IN rule 20 action 'permit'
set policy route-map ROUTES-IN rule 20 match rpki 'notfound'
set policy route-map ROUTES-IN rule 20 set local-preference '125'
set policy route-map ROUTES-IN rule 30 action 'deny'
set policy route-map ROUTES-IN rule 30 match rpki 'invalid'
.. _RIPE-NNC: https://github.com/RIPE-NCC/rpki-validator-3/wiki