JANOG35_RouteReflector構成でのRPKI動作検証 20150120
Preview:
Citation preview
- 1. Copyright GREE, Inc. All Rights Reserved.Copyright GREE,
Inc. All Rights Reserved. Route Reector RPKI
- 2. Copyright GREE, Inc. All Rights Reserved. Router/SwitchRPKI
RPKIRouter Route Reector iBGPRPKI ValidationJuniper Router
ReectorJuniper JUNOSeBGPiBGP iBGPValidation
- 3. Copyright GREE, Inc. All Rights Reserved.
- 4. Copyright GREE, Inc. All Rights Reserved. AS65513(Origin AS)
AS65511 AS65514(Origin AS) RouteReecter01(Juniper M7i)
192.168.128.50/24 ROA Server 192.168.128.1/24 Validation
10.14.0.0/1610.13.0.0/16 Router03192.168.128.13/24
Router04192.168.128.14/24 Router02192.168.128.12/24
Router01192.168.128.11/24 RouteReecter01(RR01)RR-ClientCommunity
Valid 65535:3 Not-found 65535:2 Invalid 65535:1
Router01,02RR01CommunityLP Valid 150 Not-found 100 Invalid 50
AS65515(Origin AS) 10.15.0.0/24 Router05192.168.128.15/24
- 5. Copyright GREE, Inc. All Rights Reserved. VMware ESXi
RouterReecter2 (CSR1000v) Router02 (CSR1000v) Router05 (CSR1000v)
Router03 (CSR1000v) RouteReecter1(Juniper M7i) ROA Server Router04
(CSR1000v) 192.168.128.0/24 Router01 (CSR1000v) JPNIC OSJuniper M7i
: JUNOS 12.3R8.7CSR1000v : IOS-XE 15.4
- 6. Copyright GREE, Inc. All Rights Reserved. Prefix MaxLengeth
AS-Number 10.12.0.0/16 24 AS65512 10.13.0.0/16 24 AS65513
10.14.0.0/16 24 AS65514 10.15.0.0/16 24 AS65515 ROA
IP2AS-Number
- 7. Copyright GREE, Inc. All Rights Reserved.
- 8. Copyright GREE, Inc. All Rights Reserved. 1(Invalid)
AS65512(Mis Originated AS) AS65511 AS65514(Origin AS) Validation
10.14.0.0/16 10.13.0.0/16 MisOriginPrex Router03192.168.128.13/24
Router04192.168.128.14/24 Router02192.168.128.12/24
Router01192.168.128.11/24 AS65512RRValidation
RouteReecter01192.168.128.50/24 ROA Server192.168.128.1/24
- 9. Copyright GREE, Inc. All Rights Reserved.
RouteReflector01Validation Client(Router01,02)LPBestPath
- 10. Copyright GREE, Inc. All Rights Reserved. 2(InvalidBest
Path Selection) AS65512(Mis Originated AS) AS65511 10.14.0.0/16
10.14.0.0/16 MisOriginPrex Router03192.168.128.13/24
Router04192.168.128.14/24 Router02192.168.128.12/24
Router01192.168.128.11/24 Validation AS65512AS65514RRValidation
Router0110.14.0.0/16Best PathAS65514 AS65514(Origin AS)
RouteReecter01192.168.128.50/24 ROA Server192.168.128.1/24
- 11. Copyright GREE, Inc. All Rights Reserved.
RouteReflector01Validation Client(Router01,02)LPBestPath
10.14.0.0/16Nexthop192.168.128.14@AS65514
- 12. Copyright GREE, Inc. All Rights Reserved. 3(Longest Match)
AS65512(Origin AS) AS65511 AS65514(Origin AS)
10.14.0.0/1610.12.0.0/16 Router03192.168.128.13/24
Router04192.168.128.14/24 Router02192.168.128.12/24
Router01192.168.128.11/24 AS65515(Mis Originated AS) 10.14.0.0/24
MisOriginPrex Router05192.168.128.15/24
RouteReecter01192.168.128.50/24 ROA Server192.168.128.1/24
Validation AS65515AS65514
RR01ValidationRouter01AS65514BestPath
- 13. Copyright GREE, Inc. All Rights Reserved.
10.14.0.0/16@AS65514RouteReflector01 Router02BestPath
RouteReflector01 Router02LongestMatch 10.14.0.0/24
- 14. Copyright GREE, Inc. All Rights Reserved. 4(RR2)
AS65512(Mis Originated AS) AS65511 AS65514(Origin AS)
RouteReecter01 192.168.128.50/24 ROA Server 192.168.128.1/24
Validation 10.14.0.0/16 10.13.0.0/16 MisOriginPrex
Router03192.168.128.13/24 Router04192.168.128.14/24
Router02192.168.128.12/24 Router01192.168.128.11/24 Router
ReectorRPKI RouteReecter02 192.168.128.16/24
- 15. Copyright GREE, Inc. All Rights Reserved. Router01,02Route
Reflector01 ValidationCommunityRoute Reflector02 ASRouteReflector2
Policy
- 16. Copyright GREE, Inc. All Rights Reserved.
- 17. Copyright GREE, Inc. All Rights Reserved. Route
ReectoriBGPValidation iBGPValidationJuniper BGPAS BestPathRouter
PathValidRouter Reector ADD-PathBGP-Confederation
- 18. Copyright GREE, Inc. All Rights Reserved.
- 19. Copyright GREE, Inc. All Rights Reserved.
ASBR(eBGP)Validation iBGP RPKI Route Reector
- 20. Copyright GREE, Inc. All Rights Reserved. EndASASBR
Validation TransitIX ValidationAS IXRoute Server Peering Validation
BGP-Community InternetValidation
- 21. Copyright GREE, Inc. All Rights Reserved. Route
ReectorValidation 1. ASBRRoute Reector ext) 1Router1Transit
ASBRBest Path Selection 2. Route ReectoriBGPValidation Juniper
Junos iBGPValidation Route ReectorValidation
- 22. Copyright GREE, Inc. All Rights Reserved.
- 23. Copyright GREE, Inc. All Rights Reserved.
- 24. Copyright GREE, Inc. All Rights Reserved.