MANRS

Partnering with NSRC on MANRS & Routing Security Training

nsrcadmin — Sun, 08 Nov 2020 14:26:01 +0000

Partnering with NSRC on MANRS & Routing Security Training nsrcadmin Sun, 11/08/2020 - 06:26

Written by Megan Kruse, Director, Partner Engagement and Communications for the Internet Society.

December 21, 2020

(Republished with permission from the Internet Society. The original entry is available here.)

One of the biggest hurdles to routing security is getting the right information to the right people at the right time. We offer implementation guides, tutorials, hands-on workshops, and more, but there are a lot of networks and a lot of operators out there and we cannot reach them all. That’s why we’re proud to partner with the Network Startup Resource Center (NSRC) to bring more education and hands-on learning to the community.

NSRC comprises a distributed team of network engineers and trainers from across the globe. NSRC works directly with indigenous network engineers and operators who develop and maintain the Internet infrastructure in their respective countries and regions. They provide technical information, direct engineering assistance (DEA), training, donations of equipment and networking books, and other resources to improve operational infrastructure, resulting in better and faster networks.

As part of DEA, they go on the ground to provide organizations with technical support to help solve problems they face in the management and growth of their networks. It will typically involve NSRC-sponsored engineers working side-by-side on location with local engineers to identify and implement tailored solutions. The NSRC model is for local hands to develop local expertise for their network environment, which means the responsible staff will implement the recommended changes themselves, working shoulder-to-shoulder with NSRC staff.

The Internet Society and NSRC have a long history of working together on developing Internet exchange points (IXPs), community network initiatives, capacity building, and more. Beginning in the early 1990s, the organizations’ founders collaborated to create a set of TCP/IP training workshops, bringing together engineers from all over the world to the annual INET conferences, which helped facilitate the first Internet connections to several dozen countries. NSRC has also been involved in the MANRS project since its inception in 2014, with work on routing and routing security education pre-dating MANRS.

“There are still thousands of routing incidents each year, often due to accidental misconfigurations or technical mistakes. Our work with NSRC is vital to bringing much needed training and information to network operators on the ground so that they can implement the best practices that help protect us all. Together, we’re making the Internet more globally connected and secure so that everyone can benefit,” said Andrew Sullivan, Internet Society CEO.

NSRC developed a detailed video series focused on Internet routing called BGP for All, partially funded by the Internet Society and the National Science Foundation. There’s a wealth of information in this series, from basic routing and BGP information to specific design and implementation advice. And, of course, there is a whole section on MANRS, including video clips focused on each action.

We have many more plans to deepen our collaboration, including:

Updating the MANRS implementation guidelines for network operators and creating a MANRS implementation guide for IXPs
Producing additional technical education video content about routing security and MANRS best practices
Jointly delivering routing security workshops using NSRC’s lab-based Routing Infrastructure and Security Operations (RISO) course with Network Operator Group (NOG) communities and Research and Education Network (REN) organizations
Improving MANRS Observatory data sources, data collection, and verification with the University of Oregon RouteViews BGP monitoring infrastructure

We hope this is just the start of our collaboration with NSRC. Please go check out the BGP for All materials – you might just learn something new!

Enhancing Routing Security in South Asia

nsrcadmin — Mon, 08 Jun 2020 19:53:46 +0000

Enhancing Routing Security in South Asia

nsrcadmin Mon, 06/08/2020 - 12:53

Contributed by Mohammad Abdul Awal, NSRC Engineer and Trainer and Mozilla Open Internet Engineering Fellow

June 11, 2020

The Internet’s global routing system is often affected by route leaks, prefix hijacking, Internet address spoofing and other incidents which can lead to Distributed Denial-of-Service (DDoS) attacks, traffic inspection, Internet outage, malicious activities, financial and reputational damage. The Mutually Agreed Norms for Routing Security (MANRS) initiative, supported by the Internet Society, recommends prefix filtering, BCP38 and RPKI (Resource Public Key Infrastructure) deployment to fight against those threats but there has been very limited progress in RPKI deployment in the South Asian region.

Since October 2019, I have been working on my project to enhance the routing infrastructure security and RPKI deployment in the South Asian region. The project is supported by the Network Startup Resource Center (NSRC) and Mozilla Open Internet Engineering Fellowship program. I am working under the supervision of Dr. Philip Smith of the NSRC, with additional guidance from others in the NSRC team. The goal of my project is to enhance global routing security by:

Providing hands-on training to the network engineers on routing security best practices at the regional Network Operators Group (NOG) conferences across the Asia Pacific region.
Carrying out awareness campaigns and assist network operators to fix their RPKI ROAs (Route Origin Authorizations) during and after the conference days.
Conducting RPKI Deployathons where the participants get the facilities to practice RPKI Deployment, figure out the issues and challenges of tools and technology, and safely simulate what they need to do in real life to improve routing security.
Research about the routing issues of individual network operators in the region, informing them by email and helping them fix the issues.

In order to accomplish the goals, I needed some good training materials (slides and lab manuals) as well as a workshop kit to run virtual labs for the hands-on workshops. Thanks to the NSRC group for providing me all these resources. With direct supervision of Dr. Philip Smith and other NSRC colleagues, I have conducted a routing security workshop at the APRICOT2020 summit, one of the largest regional Internet conferences in the world. I have been a member of the facilitators team to organize the RPKI Deployathon at APRICOT2020 where 41 network engineers from 20 countries have installed and configured different open source implementations of RPKI Validators.

Moreover, I have conducted sessions on routing security at bdNOG11 in Bangladesh, MMNOG3 in Myanmar and npNOG5 in Nepal; Philip Smith presented at SANOG35 in Pakistan on my behalf. I have provided hands-on training and delivered lectures to more than 500 on-site participants during those events. NSRC also helped me coordinate with several NOGs in the region.

During my fellowship period, I have reached out to more than 3,000 network operators in South Asia and Myanmar to notify their routing issues. I directly helped more than 500 of them to fix RPKI ROAs for their 4600+ IPv4 and IPv6 prefixes.

Working in close cooperation with the NSRC’s experienced trainers helped with my professional development as a network engineer and a facilitator of Internet education in the South Asian region. It also gave me the opportunity to help the local and regional operators in South Asia and create a good human network within the region to help each other in dealing with the Internet’s routing security issues.

Impact of RPKI validation in Bangladesh:

I have helped the National Data Center in Bangladesh to deploy RPKI validator in their network. Before the deployment, I carried out an extensive awareness campaign to make sure that everyone understood the impact of NDC’s RPKI validation and how it affects them.

This included:

Publishing a blog post in the local language (Bengali) explaining the basic information and benefits of RPKI and ROA, why NDC is going to do the validation, who and how it will affect the ISPs and users in Bangladesh, and how ROAs can be created and verified.
Sending emails to the bdNOG Mailing List mentioning the key dates of NDC’s RPKI deployment plan.
Posting similar articles on different social media, including bdNOG’s Facebook page and BGD e-GOV CIRT’s Facebook and Twitter pages.
Providing detailed steps on creating ROAs and several ways to verify them. I also shared my contacts so that anyone can reach out to me if they faced any issues.
Creating a list of all ASNs in Bangladesh that include the number of IPv4 and IPv6 prefixes of each ASN, and the number of valid, invalid and not-found ROAs. I contacted each of the ASN contacts via email, phone, SMS, and online messages and informed them of the ROA status of their prefixes.

I have reached out to more than 800 ASNs (Autonomous System Numbers) and helped them create new ROAs for more than 3,500 unknown BGP (Border Gateway Protocol) prefixes and fix about 100 invalids BGP route advertisements. That was a significant improvement in RPKI deployment in the country. Starting with 29% in Sep 2019, the valid RPKI ROAs in Bangladesh is now 83%. Studying, analyzing and understanding BGP routing dynamics is tremendously important in order to: understand and improve routing infrastructure in research and education environments as well as the commodity Internet; develop solutions to route hijacks and man-in-the-middle attacks; detect and respond to network outages rapidly; avoid routing paths through certain locations; obey privacy laws, and more.

Bhutan is the first country to have 100% valid prefixes

In my project, I have done research on each network operators in the South Asian countries and reached out to those who had issues with their RPKI ROA. I consistently followed up the progress of the deployment and after several months of my efforts in the region, Bhutan became the first country in the world to have a 100% valid ROAs. I am happy that I had the opportunity to work with some of their network operators in fixing couple of ROAs

RPKI adoption in South Asia

The project has a significant impact in adoption of RPKI in the South Asian region. The awareness campaigns and hands-on workshops helped network operators realize the importance of global routing security and RPKI deployment. Each ASN with Invalid and/or Not-found ROAs in the South Asian countries has been contacted explaining the issues so that they can identify it and can create Valid ROAs. All these activities helped to reduce the number of Not-found and Invalid ROAs resulting the significant increase of Valid ROAs over times during the project period. Knowledge and actionable results ultimately help improve routing security in the region.

Figure: Status of RPKI ROA in AF, BD, BT, IN, LK, MM, MV, NP and PK.

Communities need to take a lead to help their economies

The main reason behind missing ROAs seems to have been a lack of awareness. Despite lots of discussions globally about RPKI deployment, almost no effort had been made to reach out to the individual ASNs in the region. While many of them were aware of RPKI and were able to create ROAs using MyAPNIC, they just simply didn’t feel it necessary to enable it. Some admins didn’t know the procedures of creating ROAs and some even didn’t know about RPKI ROA in general.

I think there is a significant knowledge gap and a lack of awareness about RPKI, and other routing security codes of conduct. While the discussion is happening globally, we need to discuss more about RPKI in local NOGs and help each other within our community to be successful in a wider deployment of RPKI. And, that is exactly what I am doing with my project.

I am so happy that my project is actively contributing in minimizing prefix hijacking, route leaks, IP address spoofing and other harmful incidents. Hands-on trainings on RPKI, ROA, BCP38, uRPF, prefix-filtering, IPv6 security and routing protocol security for the South Asian network operators can make a positive impact for the global routing security. This will eventually reduce DDoS attacks and traffic inspection that use the South Asian prefixes. And, the most exciting thing to me is the opportunity to contribute to enhance the security of the Internet’s routing infrastructure.

RPKI Deployathon

nsrcadmin — Mon, 30 Mar 2020 20:11:26 +0000

RPKI Deployathon

nsrcadmin Mon, 03/30/2020 - 13:11

Contributed by Dr. Philip Smith, Senior Network Engineer

April 9, 2020

The APRICOT 2020 Summit hosted an RPKI (Resource Public Key Infrastructure) Deployathon during its Melbourne, Australia event in February 2020. The APRICOT RPKI Deployathon was held as a follow-on to a similar activity held as part of a Routing Security Workshop during the APNIC 48 Conference in Chiang Mai, Thailand in September 2019.

This time around the Deployathon was held separately from any technical training so that facilitators and participants could focus on exploration, rather than trying to mix exploration with tuition. Further, it was assembled by industry partners, led by Philip Smith (NSRC), collaborating with Aftab Siddiqui (ISOC), Tashi Phuntsho (APNIC), Taiji Kimura (JPNIC), and Mark Tinka (SEACOM). This small team designed the programme and procured content and resources for the day long Deployathon, and the following half day technical Plenary. The Deployathon venue facilities were generously sponsored by JPNIC.

The goal of this RPKI Deployathon was to build upon the learning experience from the previous attempt, allowing participants to deploy RPKI and Route Validation in a safe, simulated lab environment. The objective is to help the Internet industry learn from real operational deployment experiences and be better informed to make recommended improvements to existing software, processes and best practice advice that ultimately improves Internet routing security.

The website for the day long practical Deployathon can be found at:

https://www.nsrc.org/workshops/2020/apricot/rpki-deployathon/index.html

The practical session was held on Monday 17th February, and covered the following topics:

Background of RPKI, Route Origin Authorisation, and Route Origin Validation
Installing and configuring validators
Configuring routers to talk to validators and implementing route origin validation
Exploring router vendor implementation features

Physical router hardware was provided by AARNET (four Juniper MX204), APNIC (two Cisco ASR1002), and Nokia, with Warren Finch (APNIC) also providing a Cisco IOS-XE virtual environment for participants as well. Ubuntu 16.04 containers for validator install were also provisioned by Warren allowing participants to install and configure the four most popular validators available today: NLNetLabs Routinator, RIPE NCC Validator, Cloudflare OktoRPKI, and NIC Mexico's FORT.

A detailed summary of the outcomes of the day long practical lab was presented on the following morning's RPKI Plenary sessions and is available on the APRICOT website:

https://2020.apricot.net/program/schedule/#/day/7/rpki-deployment-2

Overall, the conclusion from the day long activity:

Routinator just works, easiest to install and get running. The other validators have larger memory/resource foot prints, are harder to get running, and still need much improved documentation (despite findings and recommendations from the event held at APNIC 48).
Cisco IOS/IOS-XE caused participants great concern with non-standard defaults, including the automatic dropping of Invalids, and the propagation by iBGP of NotFounds as Valids. Juniper’s JunOS and Nokia's SR-OS worked as documented, and conformed to IETF standards as far as could be ascertained.

The RPKI Plenary session also covered deployment experiences from various operators and other stakeholders, in a short talk format. The presentations are on the APRICOT website also:

https://2020.apricot.net/program/schedule/#/day/7/rpki-deployment-1

The Deployathon was also supported by Warrick Mitchell of AARNET and Md Abdul Awal, NSRC / Mozilla OIE Fellow, who both drew from their own experience to help participants during the lab work. Awal also presented on his Mozilla Fellowship project work in Bangladesh and South Asia attempting to improve the Routing Security in that region.

Participation was around 50 for the Monday 17th February technical component, and close to 80 for the wrap-up Plenary on the following Tuesday 18th February morning.

The Deployathon was designed and implemented by partners from across the industry, demonstrating the effectiveness of collaboration amongst the key stakeholders as we all strive to deploy the first steps need to secure the global Internet routing system.

For more information about Internet routing protocols, routing best practices, routing security including the MANRS (Mutually Agreed Norms for Routing Security) initiative, NSRC has produced a large set of instructional videos: https://learn.nsrc.org/.

MANRS

Partnering with NSRC on MANRS & Routing Security Training

Written by Megan Kruse, Director, Partner Engagement and Communications for the Internet Society.

Tags

Category

Enhancing Routing Security in South Asia

Contributed by Mohammad Abdul Awal, NSRC Engineer and Trainer and Mozilla Open Internet Engineering Fellow

Impact of RPKI validation in Bangladesh:

Bhutan is the first country to have 100% valid prefixes

RPKI adoption in South Asia

Communities need to take a lead to help their economies

Tags

Category

RPKI Deployathon

Contributed by Dr. Philip Smith, Senior Network Engineer

Tags

Category