Resource Public Key Infrastructure presentation, Mynog5
Transcript of Resource Public Key Infrastructure presentation, Mynog5
Issue Date:
Revision:
Resource Public Key Infrastructure (RPKI)
Anna Mulingbayan
MYNOG 5
20 August 2015
31/12/2014
1
2
Why use RPKI?
• Prevent route hijacking
– Only the rightful custodian can originate the prefix announcement – ISPs filter prefixes they propagate
• Minimize common routing errors
– Limits human errors– Prioritize routes with certificates
3
Real life routing incidents
• June 2015 - Telecom Malaysia causes large-scale routing issues due to route leak
• April 2014 - Indosat leaked 32,000 routes • April 2010 - China Telecom advertisement causes 15% of
Internet traffic to passed through Chinese servers
• February 2008 - Pakistan Telecom announces 208.65.153.0/24 (YouTube prefix)
4
What is RPKI?
Resource Public Key Infrastructure(RPKI)
• A robust security framework for verifying the association between resource holders and their Internet resources
• Uses x.509 certificates with RFC3779 extensions
• Collaborative effort by all RIRs to help secure Internet routing by validating routes
5
How to use RPKI?• Create Route Origin Authorization (ROA) objects
• What’s contained in a ROA– The AS number you have authorized– The prefix that is being originated from it– The most specific prefix (maximum length) that the AS may
announce
For example: “AS64496 originates a route for the prefix 2001:DB8::/32 with a maximum prefix length of /40)”
6
Creating ROA in MyAPNIC• What you need to have before creating a ROA
– Must be an APNIC Member– Have access to MyAPNIC with 2 factor authentication
• Takes only 5 minutes to create, and 10 minutes to be visible to the public
7
Activate RPKI Engine
8
Creating your ROA (Using suggestions)
9
Creating your ROA (Manual)
10
Created your ROA, what’s next?
• Maintain your ROAs - Changed BGP announcement - New delegation - Transferred resources
• RPKI validator - https://trac.rpki.net/wiki/doc/RPKI - Valid - Invalid - Unknown
11
Success Story
• May 2015: APNIC Outreach in Bangladesh– 13 organizations visited– Onsite support to create ROA objects
561 valid prefixes (24%)
http://rpki.surfnet.nl/bd.html
12
World Leaderboard (economy)
http://rpki.surfnet.nl/country.html
As of June 10, 2015
13
ROA in South East Asia
Economy
Roa
IPv4 total IPv4 Roa IPv4 % IPv6 total IPv6 roa IPv6 pctcount
ID 1 17666560 65536 0.37096073 3204484864 0 0
MY 2 6490880 35840 0.5521593371476404224 0 0
PH 18 5352704 185088 3.457841121872419840 256 0.000029344
SG 14 5165568 78080 1.51154723 2315278848 67109376 2.898543994
*As at 5 Aug 2015
Issue Date:
Revision:
IPv4 Transfers
15
Who can do the transfer?
• Transfer of IPv4 between you and– Other APNIC Members– Members from other RIR’s eg. ARIN
• Transfer between APNIC Members- So far MY has a total of 11 transfers- Transfer logs http://ftp.apnic.net/transfers/apnic/
• Transfer between APNIC and RIR– Transfer from RIR Member to APNIC Member, or vice versa– Source account to initiate transfer request– Registry of the recipient account to evaluate transfer request– More information on: www.apnic.net/transfer
16
How many transfers are we doing?
2010 2011 2012 2013 2014 20150
20
40
60
80
100
120
140
160
180
17
How to do the transfer in MyAPNIC? (source account)
18
MyAPNIC (source account)
19
MyAPNIC(recipient account)
20
Tips• Pre-approval
– allows you to demonstrate your need for the IPv4 block in advance– process is faster as the evaluation is done beforehand– complete the “Transfer pre-approval” form via MyAPNIC– more information at http://www.apnic.net/pre-approval
• IPv4 Transfer listing service– list Members who have received pre-approval on APNIC website to
allow others with excess IPv4 to contact you– More information at http://www.apnic.net/pre-approval-listing
• APNIC Transfers Mailing List– facilitate discussion on topics related to IPv4 transfer– to subscribe please go to www.apnic.net/mailing-lists
21
You’re Invited!• APNIC 40: Jakarta, Indonesia from 3 - 10 Sept 2015
22
THANK YOU