3 ms·

I just have to ask, not knowing how to setup BGP but having a lot of experience with PF and ipfw; is it not possible to create a sort of default deny filter so

I just have to ask, not knowing how to setup BGP but having a lot of experience with PF and ipfw; is it not possible to create a sort of default deny filter so you only exclude the routes you have? The way your post read it sounded like you had to create a filter for all routes in the world but I assume that's not the case in the practical sense.

gtrubetskoy 9y ago
You only need to create filters for the routes you know, e.g. if you are an ISP providing internet connectivity for company X, then you know that the only advertisement from the link to X can be for X and if the link to company X advertises routes from Google, Facebook or Apple AS's, then that's bogus. It's just tedious to do this, and a lot of providers, especially smaller ones don't bother with it.
fosco 9y ago
creating a list of 'expected' receive routes and expected 'send' routes is fairly easy to create. aka outbound and inbound prefix lists, I quickly googled and found the following config [0] that shows them 'advertising' their owned networks to prevent advertising networks they should not be and also accepting other networks they expect. this prevents and would have mitigated this sort of situation if implemented everywhere. no I do not believe this to be difficult and anyone configuring BGP should have some awareness of most of its tools. you can live your whole life without having to use a fire extinguisher or understanding the differences between a,b,c,d etc types but if you are a fire (man/woman) I expect you to understand which is used in what circumstance. if you do not you have the chance to spread a fire and make it worse then prevent it the same with someone who calls themself a network engineer. [0] https://supportforums.cisco.com/legacyfs/online/legacy/0/5/4/19450-bgp_config.txt https://supportforums.cisco.com/legacyfs/online/legacy/0/5/4...

gtrubetskoy 9y ago

You only need to create filters for the routes you know, e.g. if you are an ISP providing internet connectivity for company X, then you know that the only advertisement from the link to X can be for X and if the link to company X advertises routes from Google, Facebook or Apple AS's, then that's bogus. It's just tedious to do this, and a lot of providers, especially smaller ones don't bother with it.

fosco 9y ago

creating a list of 'expected' receive routes and expected 'send' routes is fairly easy to create. aka outbound and inbound prefix lists, I quickly googled and found the following config [0] that shows them 'advertising' their owned networks to prevent advertising networks they should not be and also accepting other networks they expect. this prevents and would have mitigated this sort of situation if implemented everywhere. no I do not believe this to be difficult and anyone configuring BGP should have some awareness of most of its tools. you can live your whole life without having to use a fire extinguisher or understanding the differences between a,b,c,d etc types but if you are a fire (man/woman) I expect you to understand which is used in what circumstance. if you do not you have the chance to spread a fire and make it worse then prevent it the same with someone who calls themself a network engineer. [0] https://supportforums.cisco.com/legacyfs/online/legacy/0/5/4/19450-bgp_config.txt https://supportforums.cisco.com/legacyfs/online/legacy/0/5/4...