Email Us
+1-614-407-7755

Blog

  1. Home
  2. Blog
May 4, 2018
by

3 Free BGP Tools

Here are three free BGP tools I use on a daily basis to keep my clients networking running smoothly.

 

Hurricane Electric Free BGP Tools

http://bgp.he.net/

This site has a hand full of free tools to help see the way your network is seen by others. It allows you to search based on IPv4/IPv6 blocks, ASN or by name. Very useful to see what providers have what transit and who they peer with. Also allows you to see what public exchanges that are in. Uses data from public sources and other free sources so it may not see all private peers and exchanges.

Radar by Qrator

https://radar.qrator.net/

Here is another free site very similar to Hurricane’s site. Also allows you to search based on IPv4/IPv6 blocks, ASN or by name. They will rate your ASN and let you know if there are route leaks or Bogon’s coming from your network. You can also setup a BGP feed to them to allow them to monitor your inbound routes for your peers.

University of Oregon Route Views Project

http://routeviews.org/

 

This site has a collection of tools to help you monitor your BGP network. The most useful tool is they give your access to their routeview routers “Collectors” to perform queries on their Cisco/Zebra or Quagga platforms. This is very useful to see how providers are seeing your network including AS-Path.

February 14, 2018
by

Filtering Bogon prefixes IPv4 & IPv6

What are Bogon prefixes and why are they bad?

Bogon prefixes are unassigned prefixes and reserved prefixes for private use only.
The primary reason to filter out these advertisements is security.

What to filter?

IPv4

0.0.0.0/8
10.0.0.0/8
100.64.0.0/10
127.0.0.0/8
169.254.0.0/16
172.16.0.0/12
192.0.0.0/24
192.0.2.0/24
192.168.0.0/16
198.18.0.0/15
198.51.100.0/24
203.0.113.0/24
224.0.0.0/3

IPv6

3ffe::/16
2001:db8::/32
2001::/32
2002::/16
0000::/8
fe00::/9
ff00::/8
0::/0

Configuration examples

Cisco IPv4

ip prefix-list BOGONSIPv4 seq 10 deny 0.0.0.0/8 le 32
ip prefix-list BOGONSIPv4 seq 20 deny 10.0.0.0/8 le 32
ip prefix-list BOGONSIPv4 seq 30 deny 100.64.0.0/10 le 32
ip prefix-list BOGONSIPv4 seq 40 deny 127.0.0.0/8 le 32
ip prefix-list BOGONSIPv4 seq 50 deny 169.254.0.0/16 le 32
ip prefix-list BOGONSIPv4 seq 60 deny 172.16.0.0/12 le 32
ip prefix-list BOGONSIPv4 seq 70 deny 192.0.0.0/24 le 32
ip prefix-list BOGONSIPv4 seq 80 deny 192.0.2.0/24 le 32
ip prefix-list BOGONSIPv4 seq 90 deny 192.168.0.0/16 le 32
ip prefix-list BOGONSIPv4 seq 100 deny 198.18.0.0/15 le 32
ip prefix-list BOGONSIPv4 seq 110 deny 198.51.100.0/24 le 32
ip prefix-list BOGONSIPv4 seq 120 deny 203.0.113.0/24 le 32
ip prefix-list BOGONSIPv4 seq 130 deny 224.0.0.0/3 le 32
ip prefix-list BOGONSIPv4 seq 9999 permit 0.0.0.0/0 le 32

Cisco IPv6

ipv6 prefix-list ipv6-bogons deny 3ffe::/16 le 128
ipv6 prefix-list ipv6-bogons deny 2001:db8::/32 le 128
ipv6 prefix-list ipv6-bogons permit 2001::/32
ipv6 prefix-list ipv6-bogons deny 2001::/32 le 128
ipv6 prefix-list ipv6-bogons permit 2002::/16
ipv6 prefix-list ipv6-bogons deny 2002::/16 le 128
ipv6 prefix-list ipv6-bogons deny 0000::/8 le 128
ipv6 prefix-list ipv6-bogons deny fe00::/9 le 128
ipv6 prefix-list ipv6-bogons deny ff00::/8 le 128
ipv6 prefix-list ipv6-bogons permit 2000::/3 le 48
ipv6 prefix-list ipv6-bogons deny 0::/0 le 128

Mikrotik IPv4

/routing filter
add action=discard chain=ipv4-bogons prefix=127.0.0.0/8 prefix-length=8-32 protocol=bgp
add action=discard chain=ipv4-bogons prefix=10.0.0.0/8 prefix-length=8-32 protocol=bgp
add action=discard chain=ipv4-bogons prefix=169.254.0.0/16 prefix-length=16-32 protocol=bgp
add action=discard chain=ipv4-bogons prefix=172.16.0.0/12 prefix-length=12-32 protocol=bgp
add action=discard chain=ipv4-bogons prefix=192.168.0.0/16 prefix-length=16-32 protocol=bgp
add action=discard chain=ipv4-bogons prefix=100.64.0.0/10 prefix-length=10-32 protocol=bgp
add action=discard chain=ipv4-bogons prefix=192.0.0.0/24 prefix-length=24-32 protocol=bgp
add action=discard chain=ipv4-bogons prefix=192.0.2.0/24 prefix-length=24-32 protocol=bgp
add action=discard chain=ipv4-bogons prefix=198.51.100.0/24 prefix-length=24-32 protocol=bgp
add action=discard chain=ipv4-bogons prefix=198.18.0.0/15 prefix-length=15-32 protocol=bgp
add action=discard chain=ipv4-bogons prefix=198.51.100.0/24 prefix-length=24-32 protocol=bgp
add action=discard chain=ipv4-bogons prefix=203.0.113.0/24 prefix-length=24-32 protocol=bgp
add action=discard chain=ipv4-bogons prefix=224.0.0.0/4 prefix-length=4-32 protocol=bgp
add action=discard chain=ipv4-bogons prefix=240.0.0.0/4 prefix-length=4-32 protocol=bgp
add action=discard chain=ipv4-bogons prefix=255.255.255.255 prefix-length=4-32 protocol=bgp
add action=discard chain=ipv4-bogons prefix-length=25-32 protocol=bgp
add action=discard chain=ipv4-bogons prefix=0.0.0.0/0 protocol=bgp
add action=accept chain=ipv4-bogons prefix-length=0-24 protocol=bgp set-bgp-communities=””

Mikrotik IPv6

/routing filter
add action=discard protocol=bgp chain=ipv6-bogons prefix=3ffe::/16 prefix-length=0-128
add action=discard protocol=bgp chain=ipv6-bogons prefix=2001:db8::/32 prefix-length=0-128
add action=accept protocol=bgp chain=ipv6-bogons prefix=2001::/32
add action=discard protocol=bgp chain=ipv6-bogons prefix=2001::/32 prefix-length=0-128
add action=accept protocol=bgp chain=ipv6-bogons prefix=2002::/16
add action=discard protocol=bgp chain=ipv6-bogons prefix=2002::/16 prefix-length=0-128
add action=discard protocol=bgp chain=ipv6-bogons prefix=::/8 prefix-length=0-128
add action=discard protocol=bgp chain=ipv6-bogons prefix=fe00::/9 prefix-length=0-128
add action=discard protocol=bgp chain=ipv6-bogons prefix=ff00::/8 prefix-length=0-128
add action=accept protocol=bgp chain=ipv6-bogons prefix=2000::/3 prefix-length=0-48
add action=discard protocol=bgp chain=ipv6-bogons prefix=::/0 prefix-length=0-128
add action=discard protocol=bgp chain=ipv6-bogons

JunOS IPv4

policy-options {
prefix-list BOGONSIPv4 {
0.0.0.0/8;
10.0.0.0/8;
100.64.0.0/10;
127.0.0.0/8;
169.254.0.0/16;
172.16.0.0/12;
192.0.2.0/24;
192.168.0.0/16;
198.18.0.0/15;
198.51.100.0/24;
203.0.113.0/24;
224.0.0.0/4;
240.0.0.0/4;
}
policy-statement BGP_FILTER_IN {
term IPv4 {
from {
prefix-list BOGONSIPv4;
}
then reject;
}
}
}

JunOS IPv6

policy-statement ipv6-bogons {
from {
family inet6;
route-filter 3ffe::/16 orlonger;
route-filter 0000::/8 orlonger;
route-filter 2001:db8::/32 orlonger;
route-filter 2001::/32 exact next policy;
route-filter 2001::/32 longer;
route-filter 2002::/16 exact next policy;
route-filter 2002::/16 longer;
route-filter fe00::/9 orlonger;
route-filter ff00::/8 orlonger;
route-filter 2000::/3 prefix-length-range /49-/128;
route-filter 0::/0 orlonger;
}
then {
trace;
reject;
}
}

February 7, 2018
by

Filtering Bogon and Bogus ASNs

What are ASN Bogon’s and why are they bad?

Bogon’s ASNs are private and reserved ASNs that should not be publicly routed to or from your peers. Filtering these ASNs will prevent routeleaks and other network anomalies.

What to filter?

AS 23456                                   # AS_TRANS
AS 64496 – 64511                      # Reserved for use in docs and code RFC5398
AS 64512 – 65534                      # Reserved for Private Use RFC6996
AS 65535                                   # Reserved RFC7300
AS 65536 – 65551                     # Reserved for use in docs and code RFC5398
AS 65552 – 131071                   # Reserved
AS 4200000000 – 4294967294 # Reserved for Private Use RFC6996
AS 4294967295                        # Reserved RFC7300

Configuration examples

Cisco IOS

ip as-path access-list 90 permit _0_
ip as-path access-list 90 permit _23456_
ip as-path access-list 90 permit _(6449[6-9])_|_(6450[0-9])_|_(6451[0-1])_|_(6553[6-9])_|_(6554[0-9])_|_(6555[0-1])_
ip as-path access-list 90 permit _6(4(5(1[2-9]|[2-9][0-9])|[6-9][0-9][0-9])|5([0-4][0-9][0-9]|5([0-2][0-9]|3[0-5])))_
ip as-path access-list 90 permit _6555[2-9]_|_655[6-9][0-9]_|_65[6-9][0-9][0-9]_|_6[6-9][0-9][0-9][0-9]_
ip as-path access-list 90 permit _[7-9][0-9][0-9][0-9][0-9]_|_1[0-2][0-9][0-9][0-9][0-9]_|_130[0-9][0-9][0-9]_
ip as-path access-list 90 permit _1310[0-6][0-9]_|_13107[0-1]_
ip as-path access-list 90 permit _42[0-8][0-9][0-9][0-9][0-9][0-9][0-9][0-9]_
ip as-path access-list 90 permit _(429[0-3][0-9][0-9][0-9][0-9][0-9][0-9])_|_(4294[0-8][0-9][0-9][0-9][0-9][0-9])_
ip as-path access-list 90 permit _(42949[0-5][0-9][0-9][0-9][0-9])_|_(429496[0-6][0-9][0-9][0-9])_
ip as-path access-list 90 permit _(4294967[0-1][0-9][0-9])_|_(42949672[0-8][0-9])_|_(429496729[0-4])_

Mikrotik

/routing filter
add action=discard protocol=bgp chain=bogon-asns bgp-as-path=”_0_”
add action=discard protocol=bgp chain=bogon-asns bgp-as-path=”_23456_”
add action=discard protocol=bgp chain=bogon-asns bgp-as-path=”_(6449[6-9])_|_(6450[0-9])_|_(6451[0-1])_|_(6553[6-9])_|_(6554[0-9])_|_(6555[0-1])_”
add action=discard protocol=bgp chain=bogon-asns bgp-as-path=”_6(4(5(1[2-9]|[2-9][0-9])|[6-9][0-9][0-9])|5([0-4][0-9][0-9]|5([0-2][0-9]|3[0-5])))_”
add action=discard protocol=bgp chain=bogon-asns bgp-as-path=”_6555[2-9]_|_655[6-9][0-9]_|_65[6-9][0-9][0-9]_|_6[6-9][0-9][0-9][0-9]_”
add action=discard protocol=bgp chain=bogon-asns bgp-as-path=”_[7-9][0-9][0-9][0-9][0-9]_|_1[0-2][0-9][0-9][0-9][0-9]_|_130[0-9][0-9][0-9]_”
add action=discard protocol=bgp chain=bogon-asns bgp-as-path=”_1310[0-6][0-9]_|_13107[0-1]_”
add action=discard protocol=bgp chain=bogon-asns bgp-as-path=”_42[0-8][0-9][0-9][0-9][0-9][0-9][0-9][0-9]_”
add action=discard protocol=bgp chain=bogon-asns bgp-as-path=”_(429[0-3][0-9][0-9][0-9][0-9][0-9][0-9])_|_(4294[0-8][0-9][0-9][0-9][0-9][0-9])_”
add action=discard protocol=bgp chain=bogon-asns bgp-as-path=”_(42949[0-5][0-9][0-9][0-9][0-9])_|_(429496[0-6][0-9][0-9][0-9])_”
add action=discard protocol=bgp chain=bogon-asns bgp-as-path=”_(4294967[0-1][0-9][0-9])_|_(42949672[0-8][0-9])_|_(429496729[0-4])_”

 

JunOS
policy-options {
as-path-group bogon-asns {
/* RFC7607 */
as-path zero “.* 0 .*”;
/* RFC 4893 AS_TRANS */
as-path as_trans “.* 23456 .*”;
/* RFC 5398 and documentation/example ASNs */
as-path examples1 “.* [64496-64511] .*”;
as-path examples2 “.* [65536-65551] .*”;
/* RFC 6996 Private ASNs*/
as-path reserved1 “.* [64512-65534] .*”;
as-path reserved2 “.* [4200000000-4294967294] .*”;
/* RFC 6996 Last 16 and 32 bit ASNs */
as-path last16 “.* 65535 .*”;
as-path last32 “.* 4294967295 .*”;
/* RFC IANA reserved ASNs*/
as-path iana-reserved “.* [65552-131071] .*”;
}
policy-statement import_from_ebgp {
term bogon-asns {
from as-path-group bogon-asns;
then reject;
}
term …..
}
}

Stay Updated

    ADDRESS

    6352 Thorncrest Dr, Galloway OH, 43119

    PHONE

    +1-614-407-7755

    EMAIL

    sales@setsonllc.com
    support@setsonllc.com