642-661 - Configuring BGP

** Path Attributes **


Mandatory well-known attributes (next-hop, as-path and origin)
Discretionary well-known attributes (local preference, atomic aggregate)
Optional attributes (transitive and non-transitive)


** Neighbour Discovery **


TCP Port 179


#show ip bgp summary


#debug ip tcp transactions
#debug ip bgp events


"idle" state for a BGP peer means that the peer is not reachable.


idle --> active --> OpenSent --> OpenConfirm --> Established


BGP Open Message contains:
- BGP version number
- AS number of local router
- Holdtime
- BGP router identifier
- Optional parameters


TCP keepalives are sent every 60 seconds


Triggered updates batched and rate limited:


Internal peer = every 5 seconds
External peer = every 30 seconds


Authentication can be performed with shared MD5 password.


** Process BGP Routes **


#debug ip bgp update
#debug ip routing


BGP Route Selection Criteria


- Exclude routes with inaccessible next hop
- Prefer highest weight (local to router)
- Prefer highest local preference (global within AS)
- Prefer routes that the router originated
- Prefer shortest AS path (only length is compared)
- Prefer lowest origin code (IGP < EGP < Incomplete)
- Prefer lowest MED
- Prefer external (EBGP) paths over internal (IBGP)
- For IBGP paths, prefer oldest (most stable) path
- Prefer paths from router with the lowest BGP router-ID


Automatic summarization is enabled by default


** Configure Basic BGP **


Private AS numbers = 64512 - 65535


router bgp 1
neigbour 1.1.1.2 remote-as 2
neighbor 1.1.1.2 description neighbor "External BGP Peer"
neigbour 1.1.1.2 password MyPassword
timers bgp <keepalive> <holdtime>
no auto-summary
network 192.168.1.0 mask 255.255.255.0 route-map MyRouteMap
...or
redistribute eigrp 100
distribute-list 101 out eigrp 100


Summarization is called Aggregation in BGP


#router bgp 1
#aggregate-address 192.168.0.0 255.255.0.0 [summary-only]


The "summary-only" keyword means that only the summary address will be advertised. If this is not included then all less specific subnets will be advertised.


** Monitor and Troubleshoot BGP **


#sh ip bgp summary
#sh ip bgp neigh <ip-address>
#sh ip bgp <ip-prefix> <mask subnet-mask>


#debug ip tcp transactions
#debug ip bgp events
#debug ip bgp keepalives
#debug ip bgp <ip-address> updates <acl>


** Transit Autonomous Systems **


IBGP and EBGP peers must be directly connected but IBGP peers do not.


BGP maximum paths is set to 1 by default. If multiple paths exist then the router with the highest router ID will be used.


#neighbor <ip-address> next-hop-self
(change next hop processing at edge routers - the alternative to this is to redistribute connected into the IGP used within the IBGP cloud)


Transit IBGP Configuration


#router bgp 1
#neighbor 1.1.1.2 remote-as 2
#neighbor 1.1.1.2. update-source loopback0
#no synchronization


** AS Path Filters **
[1234] = any number from 1 to 4
[1-4] = any number from 1 to 4
. = any character
^ = match beginning of string
$ = match end of string
_ = match any delimiter
( ) = delimiter for grouping
\ = remove special meaning of character
* = match 0 or more characters
? = matches zero or more characters
+ matches one or more characters


Some Examples:


_100_ = going through AS 100
^100$ = directly connected to AS 100
_100$ = originated in AS 100
^100_.  = networks behind AS 100
^[0-9]+$ = AS paths one AS long
^([0-9]+0(_\1)*$ = prepending performed in neighbouring originating AS
^$ = networks originated in local AS
.* = match everything


** Prefix Lists **


#ip prefix-list <list-name> [seq <seq>] {permit | deny} network/len [ge <value>] [le <value>]


le = less than or equal to
ge = greater than or equal to


e.g.
ip prefix-list MyList permit 192.168.0.0/16
(this matches only 192.168.0.0/16)




ip prefix-list MyList permit 192.168.0.0/16 le 20
(this matches only 192.168.0.0/16 and 192.168.17.0/24)


#router bgp 1
#neighbor 1.1.1.1 prefix-list MyList in | out
(filter in/out bound for a configured neighbour)


#rotuer bgp 1
#distribute-list prefix-list MyList out eigrp
(filter routes redistributed from specified routing process into BGP)


#show ip prefix-list MyList [detail | summary]


#[no] ip prefix-list seq <seq> <condition>
(insert or erase the specified line from the list)


#show ip bgp prefix-list Mylist


** Outbound Route Filters **


Send an outbound filter to a neighbour which it will use to filter which routes it sends:


(sender)
#router bgp 1
#address-family ipv4 unicast
#neighbor 1.1.1.2 remote-as 2
#neighbor 1.1.1.2 ebgp multihop
#neighbor 1.1.1.2 capability orf prefix-list send
#neighbor 1.1.1.2 prefix-list FILTER  in
!
ip prefix-list FILTER seq 10 permit 192.168.1.0/24


(receiver)


#router bgp 2
#address-family ipv4 unicast
#neighbor 1.1.1.2 remote-as 1
#neighbor 1.1.1.2 ebgp mutihop 255
#neighbor 1.1.1.2 capability orf prefix-list receive


#clear ip bgp 192.168.1.2 in prefix-filter


ORF type 128 is the only kind supported on Cisco IOS.


** Route Maps **


Route-maps can match on:
- Network number and subnet mask matched with an ip prefix-list
- route originator
- BGP next-hop
- BGP origin
- Tag attached to IGP route
- AS-Path
- BGP community attached to BGP route
- IGP route type (internal/external)


Route-maps can set:
- Origin
- BGP next-hop
- Weight
- BGP community
- Local preference
- MED


#ip policy-list MyList {permit | deny}
#match policy-list MyList


#show ip policy-list MyList.


Order of checking inbound is as follows:


1. route-map
2. prefix-list
3. filter-list
4. distribute-list


#show ip bgp route-map MyMap
(run the route-map against the current bgp table)


#clear ip bgp 1.1.1.1 soft in
#clear ip bgp 1.1.1.1 in
(route refresh - must be supported by router)


** Route Selection **


Weight::
#router bgp 1
#neighbor 1.1.1.1 weight <weight>
(default is 0 if not specified)
(locally generated routes have a weight of 32768)


set weight 200 to networks coming from 1.1.1.1 originated in AS 10


#router bgp 1
#neighbor 1.1.1.1 route-map MyMap in
!
#route-map MyMap permit 10
#match as-path 1
#set weight 200
!
#route-map MyMap permit 20
#set weight 100
!
#ip as-path access-list 1 permit _10$


Local Preference:


#router bgp 1
#bgp default local-preference <value>
(default is 100, higher is better)


Local Preference with route-map


#route-map MyMap permit 10
#match <condition>
#set local-preference <value>


#router bgp 1
#neighbor 1.1.1.1 route-map MyMap in | out


** As Path Prepending **


Use your own AS when prepending


#route map MyMap permit 10
#match <condition>
#set as-path prepend <as-number> <as-number> ...


#router bgp 1
#neighbor 1.1.1.1 route-map MyMap out


NB: Cannot be debugged.


Local AS number can be hidden / changed with the command:


#neighbor local-as


** Mutli Exit Discriminator **


MED is preferable when you have two connections to one ISP. As path prepending is preferable when you have two connections to two different ISPs.


Lower MED = more preferable


#router bgp 1
#neighbor 1.1.1.1 route-map MED out
!
#route-map MED
#set metric 100


To compare MEDs from different AS:
#bgp always-compare-med


To make a missing MED infinity instead of the default of 0:
#bgp bestpath med missing-med-worst


To change the BGP route selection procedure:
#bgp deterministic-med


To view the original MED received from a neighbour before route-map processing use:
#show ip bgp neighbors 1.1.1.1 received-routes


** BGP Communities **
Tagging routes to influence path selection


Community is a transitive optional attribute (values from 0 to 4,294,967,200)


- no-advertise (do not advertise to any peer)
- no export (do not advertise to real EBGP peers)
- local-as (do not advertise to any EBGP peers)
- internet (advertise to internet community)


#route-map MyMap
#match <condition>
#set community <value> [additive]
(additive keyword means that the value is just added rather than overwriting existing values)


#router bgp 1
#neighbor 1.1.1.1 route-map MyMap
#neighbor 1.1.1.1 send-community


On the receiving router:
#ip community-list 101 permit | deny regexp


#show ip bgp community


Show community in new format
#ip bgp new-format


By default EBGP neighbours must be directly connected, this can be modified with:
#neighbor 1.1.1.1 ebgp multihop [TTL]


** Service Provider Networks **


Route Reflectors are used when you do not have a full mesh of IBGP peers


#bgp cluster-id <cluster-id>
(defaults to router ID)
#neighbor 1.1.1.1 route-reflector-client


#show ip bgp neighbor
(on the reflector this shows a peer as a RR client)


#show ip bgp <network>
(on client or reflector show routes received / sent as RR)


** Confederations **


Splitting of one AS into multiple composite AS


#router bgp 1
#bgp confederation identifier <external-as-number>
#bgp confederation peers <list-of-intra-confederation-as>


#neighbor 1.1.1.1 maximum-prefix <maximum. [threshold] [warning-only] [restart <interval>]
(limit number of prefixes received from neighbour)
Default warning is at 75%.


** BGP Peer Groups **


Common information for a group of BGP Peers


Peer Group parameters
- Community propagation
- Source interface for TCP session
- EBGP multihop sessions
- MD5 Password
- Neighbour weight
- Filter-list and distribute-list
- Route-maps


#router bgp 1
#neighbor MyGroup peer-group
#neighbor MyGroup <BGP params>
#neighbor 1.1.1.1 peer-group MyGroup
(BGP parameters defined against the neighbour will override peer group settings


#show ip bgp peer-group <group-name> [summary]
#clear ip bgp <group-name> soft in | out


** BGP Route Dampening **


Minimizes amount of BGP updates by suppressing unstable (flapping) routes


#router bgp 1
#bgp dampening [<half-life> <reuse> <suppress> [route-map <map>]


Default values are:


- half life - 15 minutes
- suppress - 2000
- reuse - 750
- max-suppress-time - 60 minutes
- per-flap penalty - 1000


#clear ip bgp 1.1.1.1 flap-statistics
#clear ip bgp dampening


#show ip bgp dampened-paths
#debug ip bgp dampening
#show ip bgp flap-statistics


=================


Calculating number of sessions for BGP full mesh:
(n)(n-1)/2


e.g.


10 = (10)(9)/2 = 45

JNCIS-SEC

** Creating Zones **


set security zones security-zone MyZone
set security zones functional-zone management


show security zones
show interfaces ge-0/0/1.0 extensive
======================================================
** Add Interfaces to a Zone **


edit security zones
set security-zone MyZone interface ge-0/0/1.0


======================================================
** Host-inbound Traffic **


set security-zone MyZone host-inbound-traffic [system-services | protocols]


system-services options
 - all
 - any-service
 - dns
 - finger
 - ftp
 - http
 - https
 - ident-reset
 - ike
 - lsping
 - netconf
 - ntp
 - ping
 - reverse-ssh
 - reverse-telnet
 - rlogin
 - rpm
 - rsh
 - sip
 - snmp
 - snmp-trap
 - ssh
 - telnet
 - tftp
 - traceroute
 - xnm-clear-text
 - xnm-ssl


protocol options


 - all
 - bfd
 - bgp
 - dvmrp
 - igmp
 - ldp
 - msdp
 - ndp
 - nhrp
 - ospf
 - ospf3
 - pgm
 - pim
 - rip
 - ripng
 - router-discovery
 - rsvp
 - sap
 - vrrp


======================================================
** Address Book Entries **


Address Book:


[edit security zones]
security-zone MyZone  {
     address-book  {
          address PC1 192.168.0.1/32;
          address PC2 192.168.0.2/32;
      }
}


Address Set:




[edit security zones]
security-zone MyZone  {
     address-book  {
          address-set all-PCs  {
               address PC1 192.168.0.1/32;
               address PC2 192.168.0.2/32;
          }
      }
}

======================================================
** Custom Applications **


[edit applications]
application MyApp  {
     protocol tcp;
     destination-port 5900;
}


Application Set:


[edit applications]
application-set MySet
     application App1;
     application App2;
}


======================================================
** Policy Match Entries **


[edit security policies]
from-zone MyZone to-zone untrust  {
     policy-name Policy1  {
          match  {
                       source-address PC1;
                       destination-address IntenetServer;
                       application-name junos-http;
           }
           then  {
                    permit
           }
     policy-name Policy2


          match  {
                       source-address PC2;
                       destination-address IntenetServer;
                       application-name junos-ftp;
           }
           then  {
                    permit;
                    log  {
                           session-init;
                           session-close;
                    }
                    count;
           }
}


NB - The "insert" command is used to reorder policies.
======================================================
** Monitoring Traffic **


1. Use the log option on the policy:
     set policy Policy1 then log {session-close | session-init]


2. "show security policies"


3. "show security flow session"


4. Use traceoptions:


[edit security]
policies  {
     traceoptions  {
          file MyTraceFile
          flag all;
      }
flow  {
     traceoptions  {
          file MyFlowFile
          flag basic-datapath;
          flag session;
          packet-filter MyPacketFilter  {
                  source-prefix 10.1.1.1/32
                  destination-prefix 20.1.1.1/32
         }
     }
}


"policy-rematch" is used to force all traffic to be re-evaluated when changes are made to the policy.


======================================================
** Creating a scheduler **


scheduler MyScheduler  {
     daily  {
          start-time 08:30:00 stop-time 18:00:00;
     }
     sunday exclude;
}


(then add scheduler to the relevant policy)


======================================================
** Firewall User Authentication **


Pass Through Authentication:


 - Create Access Profile


[edit access]
profile MyProfile  {
     client Client1  {
         firewall-user {
                password xyz123 ## SECRET DATA
         }
      }
}


- Policy Action with Firewall Authentication


[edit security policies]
from-zone MyZone to-zone Untrust  {
     policy permit-all  {
          match   {
              source-address PC1;
              destination-address InternetServer1;
               application junos-telnet;
          }
          then  {
               permit {
                   firewall-authentication  {
                         pass-through  {
                               client-match Client1;
                          }
                   }
              }
       }
}


** Web Authentication **


set session-options client-idle-timeout <minutes>


[edit interfaces]
ge-0/0/0  {
      unit 0   {
           family inet  {
                address 1.1.1.2/24  {
                     preferred;
                 }
                 address 1.1.1.3/24 {
                      web authentication http;
                 }
             }
       }
}




[edit access]
profile MyProfile  {
     client Client1  {
         firewall-user {
                password xyz123 ## SECRET DATA
         }
      }


      client Client2  {
         firewall-user {
                password xyz123 ## SECRET DATA
         }
      }


}




[edit security policies]
from-zone MyZone to-zone Untrust  {
     policy permit-all  {
          match   {
              source-address any;
              destination-address any;
               application junos-telnet;
          }
          then  {
               permit {
                   firewall-authentication  {
                         web-authentication  {
                               client-match Client1;
                          }
                   }
              }
       }
}


show security firewall-authentication users
show security firewall-authentication history




======================================================
** SCREEN Options **


[edit security screen]
ids-option Option1  {
     alarm-without-drop;
}


(The above option just logs the info without dropping it)


security  {
     screen {
          ids-option Option1
               options;
               options;
           }
      }
}


security  {
      zones  {
          security-zone Untrust  {
                screen Option1
           }
      }
}


** SCREEN Monitoring **


show security screen statistics zone Untrust
show security screen ids-option Option1


[edit security screen]
traceoptions  {
       file {
            SCREENTraceFile;
            files 10;
            size 10000;
            match attack;
        }
        flag configuration all
}




======================================================
** Network Address Translation **


Source NAT:


[edit security nat source]
rule-set 1  {
     from interface ge-0/0/2.0
         to-zone untrust;
               rule 1.1  {
                     match {
                         source-address 0.0.0.0/0;
                     }
                     then  {
                           source-nat interface;
                      }
        }
}


(Traffic with any address sourced from ge-0/0/2.0 interface will be natted to a source address of the egress interface)


Pool Based Source NAT: (with PAT)


[edit security nat source]
pool A
     address  {
         200.0.0.1/32;
     }
rule-set 1.1
     from-zone trust;
     to-zone untrust;
     rule 1  {
          match  {
                 source-address 10.0.0.0/8;
          }
          then  {
                source -nat pool A;
           }
     }
}


         
Pool Based Source NAT (without PAT)




[edit security nat source]
pool A
     address  {
         200.0.0.1/32 to 200.0.0.10/32;
     }
     port no-translation;
     overflow-pool interface;
rule-set 1.1
     from-zone trust;
     to-zone untrust;
     rule 1  {
          match  {
                 source-address 10.0.0.0/8;
          }
          then  {
                source -nat pool A;
           }
     }
}




Source NAT with Address Shifting




[edit security nat source]
pool A
     address  {
         200.0.0.1/32 to 200.0.0.10/32;
     }
     host-address-base 10.0.0.25/32;
   
rule-set 1.1
     from-zone trust;
     to-zone untrust;
     rule 1  {
          match  {
                 source-address 10.0.0.0/8;
          }
          then  {
                source -nat pool A;
           }
     }
}






"NAT off" is used where you do not want traffic for a particular destination to be NAT translated.


Pool Based Destination NAT:




[edit security nat destination]
pool A
     address  {
         10.0.0.1/32;
     }
      
rule-set 1.1
     from-zone untrust;
     rule 1  {
          match  {
                 destination-address 200.0.0.1/32;
          }
          then  {
                destination-nat pool A;


show security flow session
show security nat destination pool all
show security nat destination rule all


           }
     }
}


Static NAT:


[edit security nat static]
rule-set r1
     from zone untrust;
            rule1a  {
                  match  {
                        destination-address 200.0.0.1/32;
                  }
                  then  {
                         static-nat prefix 10.0.0.1/32;
                  }
            }
}


NAT Proxy Arp:


[edit security nat]
proxy-arp  {
      interface ge-0/0/2  {
            address  {
                  200.0.0.1/32 to 200.0.0.5/32;
            }
       }
}




======================================================
** IPSEC VPNs **


set st0 unit 0 family inet address 192.168.32.1
set security zones security-zone untrust interfaces st0.0


[edit security ike]
proposal phase1  {


    authentication-method pre-shared-keys;
    dh-group group2;
    authentication-algorithm md5;
    encryption-algorithm 3des-cbc;
    lifetime-seconds 3600;

    }

}

policy phase1-policy

     mode main;

     proposal phase1;

     pre-shared-key ascii-text xyz123;  ## SECRET DATA

gateway phase1-gateway

     ike-policy phase1-policy;

     address 172.32.1.1;

     dead-peer detection  {

           interval 20;

           threshold 5;

}

external-interface ge-0/0/3.0

[edit security ipsec]
proposal phase2
     protocol esp;
     authentication-algorithm hmac-md5-96;
     encryption-algorithm 3des-cbc;
     lifetime-seconds 1000;


policy phase2-policy
     perfect-forward-secrecy  {
           keys-group2;
      }
     proposals phase2;


vpn MyVPN
     bind-interface st0.0
     ike  {
         gateway phase1-gateway;
         ipsec-policy phase2-policy;
      }
establish-tunnels immediately;


set static route 10.1.0.0/24 next-hop st0.0


[edit security policies]
policy ipsec  {
      match  {
          source-address PC1;
          destination-address any;
          application any;
      }
      then  {
            permit;
      }
}


show interfaces st0 terse
show security ike security-associations
show security ipsec security-associations <index number>
show | clear security ipsec statistics


NB:
route based VPN = one tunnel created (created by binding the tunnel to interface st0.0)
policy based VPN = new tunnel created for every flow




======================================================
** Intrusion Detection and Prevention **


request security idp security-package install (status)
set system scripts commit file templates.xsl
show security idp security-package-version


set security idp active-policy


[edit security policies from-zone untrust to-zone MyZone]
policy ServerHost
      match  {
           source-address InternetHosts;
           destination-address PC1;
           application junos-http;
       }
       then  {
             permit  {
                       application-services  {
                               idp;
                       }
              }
}


show security policies policy-name ServerHost detail




======================================================
** High Availability Clustering **




======================================================
** Web Filtering **


- Surfcontrol (externally hosted - SRX license needed)
- Websense (internally hosted - SRX license not needed)


Surfcontrol Example




security {
    policies {
        from-zone trust to-zone untrust {
            policy utm {
                match {
                    source-address any;
                    destination-address any;
                    application any;
                }
                then {
                    permit {
                        application-services {
                            utm-policy wf-block-specific-categories;
                        }
                    }
                }
            }
        }
    }
    utm {
        feature-profle {
            web-fltering {
                type surf-control-integrated;
                surf-control-integrated {
                    profle block-selected-sites {
                        category {
                            Criminal_Skills {


                                action block;
                            }
                            Remote_Proxies {
                                action block;
                            }
                            Violence {
                                action block;
                            }
                            Weapons {
                                action block;
                            }
                        }
                        default permit;
                    }
                }
            }
        }
        utm-policy wf-block-specific-categories {
            web-fltering {
                http-profle block-selected-sites;
            }
        }
    }
}


Custom Block List




custom-objects {
    url-pattern {
        badsite {
            value www.badsite.com;
        }
        addictivesite {
            value www.addictivesite.com;
        }
    }
    custom-url-category {
        bad-sites {
            value [ addictivesite badsite ];
        }
    }
}


This is then added as follows:




utm {
    feature-profle {
        web-fltering {
            url-blacklist bad-sites;






Adding Custom Block Messages:




policies {        
    from-zone trust to-zone untrust {
        policy utm {
            match {
                source-address any;
                destination-address any;
                application any;
            }
            then {
                permit {
                    application-services {
                        utm-policy wf-block-specific-categories;
                    }
                }
            }
        }
    }
}


utm {
    feature-profle {
        web-fltering {
            url-blacklist bad-sites;
            type surf-control-integrated;
            surf-control-integrated {
                profle block-selected-sites {
                    category {
                        Criminal_Skills {
                            action block;
                        }
                        Remote_Proxies {
                            action block;
                        }
                        Violence {
                            action block;
                        }
                        Weapons {
                            action block;
                        }
                    }
                    default permit;
                    custom-block-message “The site requested is not a work-
related site! Go back to work!”;
                }
            }
        }
    }
    utm-policy wf-block-specfc-categories {
        web-fltering {
            http-profle block-selected-sites;
        }
    }
}


Websense Redirect




policies {        
    from-zone trust to-zone management {
        policy webflter-websense {
            match {
                source-address any;
                destination-address any;
                application any;
            }
            then {
                permit {
                    application-services {
                        utm-policy wf-redirect;
                    }
                }
            }
        }
    }
}
utm {
    feature-profle {
        web-fltering {
            type websense-redirect;
            websense-redirect {
                profle server1-redirect {
                    server {
                        host 10.1.1.100;
                        port 15868;
                    }
                    custom-block-message “Websense says... you are not allowed!”;


                    fallback-settings {
                        default block;
                        too-many-requests log-and-permit;


                    sockets 3;
                }
            }    
        }


    }
    utm-policy wf-redirect {
        web-fltering {
            http-profle server1-redirect;
        }
    }
}


Monitoring UTM:


show security utm web-fltering statistics




======================================================
** Antivirus for SRX **




security {
  utm {
    feature-profle {
       anti-virus {
             type juniper-express-engine | kaspersky-lab-engine;
         mime-whitelist {
           exception <MIME exception list>;
           list <MIME list>;
             }
         url-whitelist <url whitelist>;
             juniper-express-engine {
               pattern-update {
                 email-notify {…}
                 interval <update check interval in minutes>;
                 no-autoupdate;
                 url <database server url>;


   url <database server url>;
               }
      profle <profle name> {
                  fallback-options  {…}
                  notifcation-options  {…}
                  scan-options {…}
               
    trickling [<trickling timeout>];
               }
              }
              kaspersky-lab-engine {
                pattern-update {
                   email-notify {…}
                   interval <update check interval in minutes>;
                   no-autoupdate;
                   url <database server url>;


             }
             profle <profle name> {
               fallback-options  {…}
               notifcation-options  {…}
               scan-options {…}
               trickling [<trickling timeout>];
             }
            }








Updating the database:


>request security utm anti-virus [kaspersky-lab-engine|juniper-express-engine] pattern-update


Show database:


>show security utm anti-virus status | statistics