Help us improve your experience.

Let us know what you think.

Do you have time for a two-minute survey?

TechLibrary
Navigation

Examples: Configuring TCP and BGP Security

Understanding Security Options for BGP with TCP

Among routing protocols, BGP is unique in using TCP as its transport protocol. BGP peers are established by manual configuration between routing devices to create a TCP session on port 179. A BGP-enabled device periodically sends keepalive messages to maintain the connection.

Over time, BGP has become the dominant interdomain routing protocol on the Internet. However, it has limited guarantees of stability and security. Configuring security options for BGP must balance suitable security measures with acceptable costs. No one method has emerged as superior to other methods. Each network administrator must configure security measures that meet the needs of the network being used.

For detailed information about the security issues associated with BGP’s use of TCP as a transport protocol, see RFC 4272, BGP Security Vulnerabilities Analysis.

Example: Configuring a Filter to Block TCP Access to a Port Except from Specified BGP Peers

This example shows how to configure a standard stateless firewall filter that blocks all TCP connection attempts to port 179 from all requesters except from specified BGP peers.

Requirements

No special configuration beyond device initialization is required before you configure this example.

Overview

In this example, you create a stateless firewall filter that blocks all TCP connection attempts to port 179 from all requesters except the specified BGP peers.

The stateless firewall filter filter_bgp179 matches all packets from the directly connected interfaces on Device A and Device B to the destination port number 179.

Figure 1 shows the topology used in this example. Device C attempts to make a TCP connection to Device E. Device E blocks the connection attempt. This example shows the configuration on Device E.

Figure 1: Typical Network with BGP Peer Sessions

Typical Network with BGP Peer Sessions

Configuration

CLI Quick Configuration

To quickly configure this example, copy the following commands, paste them into a text file, remove any line breaks, change any details necessary to match your network configuration, and then copy and paste the commands into the CLI at the [edit] hierarchy level.

Device C

set interfaces ge-1/2/0 unit 10 description to-E set interfaces ge-1/2/0 unit 10 family inet address 10.10.10.10/30 set protocols bgp group external-peers type external set protocols bgp group external-peers peer-as 17 set protocols bgp group external-peers neighbor 10.10.10.9 set routing-options autonomous-system 22

Device E

set interfaces ge-1/2/0 unit 0 description to-A set interfaces ge-1/2/0 unit 0 family inet address 10.10.10.1/30 set interfaces ge-1/2/1 unit 5 description to-B set interfaces ge-1/2/1 unit 5 family inet address 10.10.10.5/30 set interfaces ge-1/0/0 unit 9 description to-C set interfaces ge-1/0/0 unit 9 family inet address 10.10.10.9/30 set interfaces lo0 unit 2 family inet filter input filter_bgp179 set interfaces lo0 unit 2 family inet address 192.168.0.1/32 set protocols bgp group external-peers type external set protocols bgp group external-peers peer-as 22 set protocols bgp group external-peers neighbor 10.10.10.2 set protocols bgp group external-peers neighbor 10.10.10.6 set protocols bgp group external-peers neighbor 10.10.10.10 set routing-options autonomous-system 17set firewall family inet filter filter_bgp179 term 1 from source-address 10.10.10.2/32 set firewall family inet filter filter_bgp179 term 1 from source-address 10.10.10.6/32 set firewall family inet filter filter_bgp179 term 1 from destination-port bgp set firewall family inet filter filter_bgp179 term 1 then accept set firewall family inet filter filter_bgp179 term 2 then reject

Configuring Device E

Step-by-Step Procedure

The following example requires that you navigate various levels in the configuration hierarchy. For information about navigating the CLI, see Using the CLI Editor in Configuration Mode in the CLI User Guide.

To configure Device E with a stateless firewall filter that blocks all TCP connection attempts to port 179 from all requestors except specified BGP peers:

  1. Configure the interfaces.
    user@E# set interfaces ge-1/2/0 unit 0 description to-A user@E# set interfaces ge-1/2/0 unit 0 family inet address 10.10.10.1/30
    user@E# set interfaces ge-1/2/1 unit 5 description to-B user@E# set interfaces ge-1/2/1 unit 5 family inet address 10.10.10.5/30
    user@E# set interfaces ge-1/0/0 unit 9 description to-C user@E# set interfaces ge-1/0/0 unit 9 family inet address 10.10.10.9/30
  2. Configure BGP.
    [edit protocols bgp group external-peers]user@E# set type external user@E# set peer-as 22 user@E# set neighbor 10.10.10.2 user@E# set neighbor 10.10.10.6 user@E# set neighbor 10.10.10.10
  3. Configure the autonomous system number.
    [edit routing-options]user@E# set autonomous-system 17

  4. Define the filter term that accepts TCP connection attempts to port 179 from the specified BGP peers.

    [edit firewall family inet filter filter_bgp179]user@E# set term 1 from source-address 10.10.10.2/32 user@E# set term 1 from source-address 10.10.10.6/32 user@E# set term 1 from destination-port bgp user@E# set term 1 then accept

  5. Define the other filter term to reject packets from other sources.

    [edit firewall family inet filter filter_bgp179]user@E# set term 2 then reject

  6. Apply the firewall filter to the loopback interface.

    [edit interfaces lo0 unit 2 family inet]user@E# set filter input filter_bgp179user@E# set address 192.168.0.1/32

Results

From configuration mode, confirm your configuration by entering the show firewall, show interfaces, show protocols, and show routing-options commands. If the output does not display the intended configuration, repeat the instructions in this example to correct the configuration.

user@E# show firewall
family inet {filter filter_bgp179 {term 1 {from {source-address {10.10.10.2/32;10.10.10.6/32;}destination-port bgp;}then accept;}term 2 {then {reject;}}}}
user@E# show interfaces
lo0 {unit 2 {family inet {filter {input filter_bgp179; }address 192.168.0.1/32;}}}
ge-1/2/0 {unit 0 {description to-A;family inet {address 10.10.10.1/30;}}}
ge-1/2/1 {unit 5 {description to-B;family inet {address 10.10.10.5/30;}}}
ge-1/0/0 {unit 9 {description to-C;family inet {address 10.10.10.9/30;}}}
user@E# show protocols
bgp {group external-peers {type external;peer-as 22;neighbor 10.10.10.2;neighbor 10.10.10.6;neighbor 10.10.10.10;}}
user@E# show routing-optionsautonomous-system 17;

If you are done configuring the device, enter commit from configuration mode.

Verification

Confirm that the configuration is working properly.

Verifying That the Filter Is Configured

Purpose

Make sure that the filter is listed in output of the show firewall filter command.

Action

user@E> show firewall filter filter_bgp179
Filter: filter_bgp179

Verifying the TCP Connections

Purpose

Verify the TCP connections.

Action

From operational mode, run the show system connections extensive command on Device C and Device E.

The output on Device C shows the attempt to establish a TCP connection. The output on Device E shows that connections are established with Device A and Device B only.

user@C> show system connections extensive | match 10.10.10
tcp4       0      0  10.10.10.9.51872     10.10.10.10.179       SYN_SENT
user@E> show system connections extensive | match 10.10.10
tcp4       0      0  10.10.10.5.179        10.10.10.6.62096     ESTABLISHED
tcp4       0      0  10.10.10.6.62096      10.10.10.5.179       ESTABLISHED
tcp4       0      0  10.10.10.1.179        10.10.10.2.61506     ESTABLISHED
tcp4       0      0  10.10.10.2.61506      10.10.10.1.179       ESTABLISHED

Monitoring Traffic on the Interfaces

Purpose

Use the monitor traffic command to compare the traffic on an interface that establishes a TCP connection with the traffic on an interface that does not establish a TCP connection.

Action

From operational mode, run the monitor traffic command on the Device E interface to Device B and on the Device E interface to Device C. The following sample output verifies that in the first example, acknowledgment (ack) messages are received. In the second example, ack messages are not received.

user@E> monitor traffic size 1500 interface ge-1/2/1.5
19:02:49.700912 Out IP 10.10.10.5.bgp > 10.10.10.6.62096: P 3330573561:3330573580(19) ack 915601686 win 16384 <nop,nop,timestamp 1869518816 1869504850>: BGP, length: 19
19:02:49.801244  In IP 10.10.10.6.62096 > 10.10.10.5.bgp: . ack 19 win 16384 <nop,nop,timestamp 1869518916 1869518816>
19:03:03.323018  In IP 10.10.10.6.62096 > 10.10.10.5.bgp: P 1:20(19) ack 19 win 16384 <nop,nop,timestamp 1869532439 1869518816>: BGP, length: 19
19:03:03.422418 Out IP 10.10.10.5.bgp > 10.10.10.6.62096: . ack 20 win 16384 <nop,nop,timestamp 1869532539 1869532439>
19:03:17.220162 Out IP 10.10.10.5.bgp > 10.10.10.6.62096: P 19:38(19) ack 20 win 16384 <nop,nop,timestamp 1869546338 1869532439>: BGP, length: 19
19:03:17.320501  In IP 10.10.10.6.62096 > 10.10.10.5.bgp: . ack 38 win 16384 <nop,nop,timestamp 1869546438 1869546338>
user@E> monitor traffic size 1500 interface ge-1/0/0.9
18:54:20.175471 Out IP 10.10.10.9.61335 > 10.10.10.10.bgp: S 573929123:573929123(0) win 16384 <mss 1460,nop,wscale 0,nop,nop,timestamp 1869009240 0,sackOK,eol>
18:54:23.174422 Out IP 10.10.10.9.61335 > 10.10.10.10.bgp: S 573929123:573929123(0) win 16384 <mss 1460,nop,wscale 0,nop,nop,timestamp 1869012240 0,sackOK,eol>
18:54:26.374118 Out IP 10.10.10.9.61335 > 10.10.10.10.bgp: S 573929123:573929123(0) win 16384 <mss 1460,nop,wscale 0,nop,nop,timestamp 1869015440 0,sackOK,eol>
18:54:29.573799 Out IP 10.10.10.9.61335 > 10.10.10.10.bgp: S 573929123:573929123(0) win 16384 <mss 1460,sackOK,eol>
18:54:32.773493 Out IP 10.10.10.9.61335 > 10.10.10.10.bgp: S 573929123:573929123(0) win 16384 <mss 1460,sackOK,eol>
18:54:35.973185 Out IP 10.10.10.9.61335 > 10.10.10.10.bgp: S 573929123:573929123(0) win 16384 <mss 1460,sackOK,eol>

Example: Configuring a Filter to Limit TCP Access to a Port Based On a Prefix List

This example shows how to configure a standard stateless firewall filter that limits certain TCP and Internet Control Message Protocol (ICMP) traffic destined for the Routing Engine by specifying a list of prefix sources that contain allowed BGP peers.

Requirements

No special configuration beyond device initialization is required before configuring this example.

Overview

In this example, you create a stateless firewall filter that blocks all TCP connection attempts to port 179 from all requesters except BGP peers that have a specified prefix.

A source prefix list, plist_bgp179, is created that specifies the list of source prefixes that contain allowed BGP peers.

The stateless firewall filter filter_bgp179 matches all packets from the source prefix list plist_bgp179 to the destination port number 179.

Configuration

The following example requires you to navigate various levels in the configuration hierarchy. For information about navigating the CLI, see Using the CLI Editor in Configuration Mode.

CLI Quick Configuration

To quickly configure this example, copy the following commands, paste them into a text file, remove any line breaks, change any details necessary to match your network configuration, and then copy and paste the commands into the CLI at the [edit] hierarchy level.

set policy-options prefix-list plist_bgp179 apply-path "protocols bgp group <*> neighbor <*>"set firewall family inet filter filter_bgp179 term 1 from source-address 0.0.0.0/0set firewall family inet filter filter_bgp179 term 1 from source-prefix-list plist_bgp179 exceptset firewall family inet filter filter_bgp179 term 1 from destination-port bgpset firewall family inet filter filter_bgp179 term 1 then rejectset firewall family inet filter filter_bgp179 term 2 then acceptset interfaces lo0 unit 0 family inet filter input filter_bgp179set interfaces lo0 unit 0 family inet address 127.0.0.1/32

Configure the Filter

Step-by-Step Procedure

The following example requires that you navigate various levels in the configuration hierarchy. For information about navigating the CLI, see Using the CLI Editor in Configuration Mode in the CLI User Guide.

To configure the filter:

  1. Expand the prefix list bgp179 to include all prefixes pointed to by the BGP peer group defined by protocols bgp group <*> neighbor <*>.

    [edit policy-options prefix-list plist_bgp179]user@host# set apply-path "protocols bgp group <*> neighbor <*>"

  2. Define the filter term that rejects TCP connection attempts to port 179 from all requesters except the specified BGP peers.

    [edit firewall family inet filter filter_bgp179]user@host# set term term1 from source-address 0.0.0.0/0user@host# set term term1 from source-prefix-list bgp179 exceptuser@host# set term term1 from destination-port bgpuser@host# set term term1 then reject

  3. Define the other filter term to accept all packets.

    [edit firewall family inet filter filter_bgp179]user@host# set term term2 then accept

  4. Apply the firewall filter to the loopback interface.

    [edit interfaces lo0 unit 0 family inet]user@host# set filter input filter_bgp179user@host# set address 127.0.0.1/32

Results

From configuration mode, confirm your configuration by entering the show firewall, show interfaces, and show policy-options commands. If the output does not display the intended configuration, repeat the instructions in this example to correct the configuration.

user@host# show firewall
family inet {filter filter_bgp179 {term 1 {from {source-address {0.0.0.0/0;}source-prefix-list {plist_bgp179 except;}destination-port bgp;}then {reject;}}term 2 {then {accept;}}}}
user@host# show interfaces
lo0 {unit 0 {family inet {filter {input filter_bgp179; }address 127.0.0.1/32;}}}
user@host# show policy-options
prefix-list plist_bgp179 {apply-path "protocols bgp group <*> neighbor <*>";}

If you are done configuring the device, enter commit from configuration mode.

Repeat the procedure, where appropriate, for every BGP-enabled device in the network, using the appropriate interface names and addresses for each BGP-enabled device.

Verification

Confirm that the configuration is working properly.

Displaying the Firewall Filter Applied to the Loopback Interface

Purpose

Verify that the firewall filter filter_bgp179 is applied to the IPv4 input traffic at logical interface lo0.0.

Action

Use the show interfaces statistics operational mode command for logical interface lo0.0, and include the detail option. Under the Protocol inet section of the command output section, the Input Filters field displays the name of the stateless firewall filter applied to the logical interface in the input direction:

[edit]
user@host> show interfaces statistics lo0.0 detail
  Logical interface lo0.0 (Index 321) (SNMP ifIndex 16) (Generation 130)
    Flags: SNMP-Traps Encapsulation: Unspecified
    Traffic statistics:
     Input  bytes  :                    0
     Output bytes  :                    0
     Input  packets:                    0
     Output packets:                    0
    Local statistics:
     Input  bytes  :                    0
     Output bytes  :                    0
     Input  packets:                    0
     Output packets:                    0
    Transit statistics:
     Input  bytes  :                    0                    0 bps
     Output bytes  :                    0                    0 bps
     Input  packets:                    0                    0 pps
     Output packets:                    0                    0 pps
    Protocol inet, MTU: Unlimited, Generation: 145, Route table: 0
      Flags: Sendbcast-pkt-to-re
      Input Filters: filter_bgp179
      Addresses, Flags: Primary
        Destination: Unspecified, Local: 127.0.0.1, Broadcast: Unspecified, Generation: 138

Example: Limiting TCP Segment Size for BGP

This example shows how to avoid Internet Control Message Protocol (ICMP) vulnerability issues by limiting TCP segment size when you are using maximum transmission unit (MTU) discovery. Using MTU discovery on TCP paths is one method of avoiding BGP packet fragmentation.

Requirements

No special configuration beyond device initialization is required before you configure this example.

Overview

TCP negotiates a maximum segment size (MSS) value during session connection establishment between two peers. The MSS value negotiated is primarily based on the maximum transmission unit (MTU) of the interfaces to which the communicating peers are directly connected. However, due to variations in link MTU on the path taken by the TCP packets, some packets in the network that are well within the MSS value might be fragmented when the packet size exceeds the link's MTU.

To configure the TCP MSS value, include the tcp-mss statement with a segment size from 1 through 4096.

If the router receives a TCP packet with the SYN bit and the MSS option set, and the MSS option specified in the packet is larger than the MSS value specified by the tcp-mss statement, the router replaces the MSS value in the packet with the lower value specified by the tcp-mss statement.

The configured MSS value is used as the maximum segment size for the sender. The assumption is that the TCP MSS value used by the sender to communicate with the BGP neighbor is the same as the TCP MSS value that the sender can accept from the BGP neighbor. If the MSS value from the BGP neighbor is less than the MSS value configured, the MSS value from the BGP neighbor is used as the maximum segment size for the sender.

This feature is supported with TCP over IPv4 and TCP over IPv6.

Topology Diagram

Figure 2 shows the topology used in this example.

Figure 2: TCP Maximum Segment Size for BGP

TCP Maximum Segment Size for BGP

Configuration

CLI Quick Configuration

To quickly configure this example, copy the following commands, paste them into a text file, remove any line breaks, change any details necessary to match your network configuration, and then copy and paste the commands into the CLI at the [edit] hierarchy level.

R0

set interfaces fe-1/2/0 unit 1 family inet address 1.1.0.1/30set interfaces lo0 unit 1 family inet address 10.255.14.179/32set protocols bgp group-int tcp-mss 2020set protocols bgp group int type internalset protocols bgp group int local-address 10.255.14.179set protocols bgp group int mtu-discoveryset protocols bgp group int neighbor 10.255.71.24 tcp-mss 2000set protocols bgp group int neighbor 10.255.14.177set protocols bgp group int neighbor 10.0.14.4 tcp-mss 4000set protocols ospf area 0.0.0.0 interface fe-1/2/0.1set protocols ospf area 0.0.0.0 interface 10.255.14.179set routing-options autonomous-system 65000

Step-by-Step Procedure

The following example requires that you navigate various levels in the configuration hierarchy. For information about navigating the CLI, see Using the CLI Editor in Configuration Mode in the CLI User Guide.

To configure Router R0:

  1. Configure the interfaces.
    [edit interfaces]user@R0# set fe-1/2/0 unit 1 family inet address 1.1.0.1/30user@R0# set lo0 unit 1 family inet address 10.255.14.179/32
  2. Configure an interior gateway protocol (IGP), OSPF in this example.
    [edit protocols ospf area 0.0.0.0]user@R0# set interface fe-1/2/0.1user@R0# set interface 10.255.14.179
  3. Configure one or more BGP groups.
    [edit protocols bgp group int]user@R0# set type internaluser@R0# set local-address 10.255.14.179
  4. Configure MTU discovery to prevent packet fragmentation.
    [edit protocols bgp group int]user@R0# set mtu-discovery
  5. Configure the BGP neighbors, with the TCP MSS set globally for the group or specifically for the various neighbors.
    [edit protocols bgo group int]user@R0# set tcp-mss 2020user@R0# set neighbor 10.255.14.177user@R0# set neighbor 10.255.71.24 tcp-mss 2000user@R0# set neighbor 10.0.14.4 tcp-mss 4000

    Note: The TCP MSS neighbor setting overrides the group setting.

  6. Configure the local autonomous system.
    [edit routing-options]user@R0# set autonomous-system 65000

Results

From configuration mode, confirm your configuration by entering the show interfaces, show protocols, and show routing-options commands. If the output does not display the intended configuration, repeat the instructions in this example to correct the configuration.

user@R0# show interfaces
fe-1/2/0 {unit 1 {family inet {address 1.1.0.1/30;}}}
lo0 {unit 1 {family inet {address 10.255.14.179/32;}}}
user@R0# show protocols
bgp {group int {type internal;local-address 10.255.14.179;mtu-discovery;tcp-mss 2020;neighbor 10.255.71.24 {tcp-mss 2000;}neighbor 10.255.14.177;neighbor 10.0.14.4 {tcp-mss 4000;}}}
ospf {area 0.0.0.0 {interface fe-1/2/0.1;interface 10.255.14.179;}}
user@R0# show routing-optionsautonomous-system 65000;

If you are done configuring the device, enter commit from configuration mode.

Verification

To confirm that the configuration is working properly, run the following commands:

  • show system connections extensive | find <neighbor-address>, to check the negotiated TCP MSS value.
  • monitor traffic interface, to monitor BGP traffic and to make sure that the configured TCP MSS value is used as the MSS option in the TCP SYN packet.
 

Related Documentation

 

Published: 2013-01-22

Previous Page Next Page