CloudLabBox
Try the free demo

BGP in depth lab 10 of 14

Edge hygiene with filters and RTBH

Kestrel Fibre's edge accepts anything and passes everything on. Filter bogons and over-long prefixes, reject private AS numbers and absurd paths, stop a customer's hijack, stop being a free transit between providers, then stop a DDoS with remotely triggered black holes, at your own edge and at your provider's.

Run this lab

It needs Lite: its 6 nodes are set to 6 vCPU and 3,072 MB in total. That fits the free demo too.

In your workspace: Shared, then BGP in depth guided labs, then 10 - Edge hygiene with filters and RTBH

Try it free for 30 minutesRun it on Lite from £3 a day

The free demo needs no card and no email. Every lab plan includes every guided lab.

Level
Advanced
Time
About 110 minutes
Nodes need
6 vCPU, 3,072 MB
Smallest plan
Lite

The scenario

An audit of Kestrel Fibre's edge found no route filters anywhere. TRANSIT sends junk, a customer has announced a prefix it doesn't own, and Kestrel is passing the peer's routes to its transit provider for free. On top of that, the audit's author would like to know what you'd do about a DDoS. You've got one change window for all of it.

PrefixHeard fromProblem
198.51.100.0/24TRANSITGood
198.18.0.0/24TRANSITGood route, but CUST also claims it
10.66.0.0/16TRANSITPrivate space
198.18.2.128/25TRANSITLonger than /24
198.18.3.0/24TRANSITPrivate AS 65001 in the path
198.18.4.0/24TRANSITEight AS hops
192.0.2.0/24PEERGood, but must not reach TRANSIT
203.0.113.0/24CUSTGood

The AS numbers 64496 to 64511 are reserved for documentation, so this lab's filters don't catch them. In production, your bogon list also has the documentation prefixes that this lab uses as its Internet.

DeviceInterfaceAddressConnects to
EDGE1Loopback010.255.0.1/32
EDGE1Gi0/010.0.12.1/30EDGE2 Gi0/0
EDGE1Gi0/110.0.13.1/30TRIG Gi0/0
EDGE1Gi0/2172.16.1.1/30TRANSIT Gi0/0
EDGE2Loopback010.255.0.2/32
EDGE2Gi0/010.0.12.2/30EDGE1 Gi0/0
EDGE2Gi0/110.0.23.1/30TRIG Gi0/1
EDGE2Gi0/2172.16.2.1/30PEER Gi0/0
EDGE2Gi0/3172.16.3.1/30CUST Gi0/0
TRIGLoopback010.255.0.3/32
TRIGLoopback1198.18.100.1/24
TRIGGi0/010.0.13.2/30EDGE1 Gi0/1
TRIGGi0/110.0.23.2/30EDGE2 Gi0/1
TRANSITLoopback010.255.0.8/32
TRANSITLoopback1198.51.100.1/24
TRANSITLoopback2198.18.0.1/24
TRANSITGi0/0172.16.1.2/30EDGE1 Gi0/2
PEERLoopback010.255.0.7/32
PEERLoopback1192.0.2.1/24
PEERGi0/0172.16.2.2/30EDGE2 Gi0/2
CUSTLoopback010.255.0.9/32
CUSTLoopback1203.0.113.1/26
CUSTLoopback2203.0.113.66/26
CUSTGi0/0172.16.3.2/30EDGE2 Gi0/3

What you’ll practise

  • Build a bogon and prefix-length filter for routes from the Internet
  • Filter on the AS path with regular expressions, including private AS numbers
  • Limit a customer to what it owns, by prefix and by path
  • Stop your network from becoming a transit between two providers
  • Trigger a black hole across your own edge with one static route
  • Signal a black hole to a provider with a community

The tasks

  1. See the problem
  2. Filter what comes from the Internet
  3. Filter on the AS path
  4. Limit the customer
  5. Don't be a transit
  6. Remotely triggered black hole
  7. Black hole at the provider

The Lab Tasks pane has the scenario, these tasks, the checks to run, hints and the full solution.

Topology and devices

The network as it opens in EVE-NG, drawn from the lab’s own canvas, and the image each node runs.

Topology of Edge hygiene with filters and RTBH6 nodes, 6 links. Every link is listed as text below the diagram.EDGE1EDGE2TRIGTRANSITPEERCUSTGi0/2Gi0/0Gi0/2Gi0/0Gi0/3Gi0/0Gi0/1Gi0/0Gi0/1Gi0/1Gi0/0Gi0/0
6 nodes, with the interface names each link uses. On a narrow screen, scroll the diagram sideways.
Every link, as text
  • EDGE1 Gi0/0 to EDGE2 Gi0/0
  • EDGE1 Gi0/1 to TRIG Gi0/0
  • EDGE2 Gi0/1 to TRIG Gi0/1
  • EDGE1 Gi0/2 to TRANSIT Gi0/0
  • EDGE2 Gi0/2 to PEER Gi0/0
  • EDGE2 Gi0/3 to CUST Gi0/0
Nodes in Edge hygiene with filters and RTBH, with the image each runs and the vCPU and RAM it’s set to
NodeDeviceImage in Add NodeSet to
EDGE1Cisco IOSvvios-adventerprisek9-m.spa.159-3.m91 vCPU, 512 MB
EDGE2Cisco IOSvvios-adventerprisek9-m.spa.159-3.m91 vCPU, 512 MB
TRIGCisco IOSvvios-adventerprisek9-m.spa.159-3.m91 vCPU, 512 MB
TRANSITCisco IOSvvios-adventerprisek9-m.spa.159-3.m91 vCPU, 512 MB
PEERCisco IOSvvios-adventerprisek9-m.spa.159-3.m91 vCPU, 512 MB
CUSTCisco IOSvvios-adventerprisek9-m.spa.159-3.m91 vCPU, 512 MB

How to open this lab

  1. Sign in to your workspace at lab.cloudlabbox.com.

  2. In File Manager, open Shared, then the folder BGP in depth guided labs.

  3. Open 10 - Edge hygiene with filters and RTBH and start its nodes, then open Lab Tasks for the scenario and the steps.

The lab is read-only. You can start the nodes and configure the devices, but changes to the topology can’t be saved. To change it, rebuild it in your own folder.

More BGP in depth labs

All BGP in depth labs

Related labs in other courses

CloudLabBox is independent of Arista Networks, Cisco, Juniper Networks and MikroTik. The lab follows exam topics and isn’t vendor training material; vendor names identify the exams and the images in the workspace.