CloudLabBox
Try the free demo

CCNP Service Provider lab 6 of 23

BGP security and DDoS tools

Harden an eBGP edge on IOS XR with TTL security, a password and prefix limits. Suppress specifics, block spoofed sources with uRPF, protect the infrastructure with an ACL, and drop an attack with RTBH.

Run this lab

It needs Lite: its 4 nodes are set to 4 vCPU and 6,144 MB in total. That fits the free demo too.

In your workspace: Shared, then CCNP Service Provider guided labs, then 06 - BGP security and DDoS tools

Try it free for 30 minutesRun it on Lite from £3 a day

The free demo needs no card and no email. Every lab plan includes every guided lab.

Level
Advanced
Time
About 90 minutes
Nodes need
4 vCPU, 6,144 MB
Smallest plan
Lite

The scenario

Fellgate Carrier's edge R1 takes traffic from a peer, PEER (AS 65010). Behind R2 is a hosting customer, CUST (AS 65020), whose web server 198.19.1.1 keeps being attacked. Last week PEER also leaked a batch of routes by mistake and nearly filled a router. Your job is to harden the BGP sessions, keep the customer's table tidy, and be ready to drop attack traffic at the edge.

IS-IS, iBGP and both eBGP sessions are up, with a PASS policy on the eBGP sessions and no protection at all.

DeviceInterfaceAddressConnects to
PEERLoopback1192.168.10.1/24
PEERLoopback9100.64.9.1/24
PEERGi0/0172.16.1.2/30R1 Gi0/0/0/2
R1Loopback010.255.0.1/32
R1Gi0/0/0/010.0.12.1/30R2 Gi0/0/0/0
R1Gi0/0/0/2172.16.1.1/30PEER Gi0/0
R2Loopback010.255.0.2/32
R2Gi0/0/0/010.0.12.2/30R1 Gi0/0/0/0
R2Gi0/0/0/2172.16.2.1/30CUST Gi0/0
CUSTLoopback1198.19.0.1/26
CUSTLoopback2198.19.0.65/26
CUSTLoopback3198.19.1.1/24
CUSTGi0/0172.16.2.2/30R2 Gi0/0/0/2

What you’ll practise

  • Protect an eBGP session with TTL security and TCP MD5
  • Apply a prefix limit and recover from it
  • Suppress specifics with an aggregate
  • Apply strict uRPF and read its drops
  • Use an infrastructure ACL
  • Build and trigger remotely triggered black hole

The tasks

  1. Protect the BGP session
  2. Limit how many prefixes a neighbour can send
  3. Suppress the customer's specifics
  4. Check source addresses with uRPF
  5. Keep outsiders off the infrastructure
  6. Blackhole the attack with RTBH
  7. Flowspec, in concept

The Lab Tasks pane has the scenario, these tasks, the checks to run, hints and the full solution.

Topology and devices

The network as it opens in EVE-NG, drawn from the lab’s own canvas, and the image each node runs.

Topology of BGP security and DDoS tools4 nodes, 3 links. Every link is listed as text below the diagram.PEERR1R2CUSTGi0/0Gi0/0/0/2Gi0/0/0/0Gi0/0/0/0Gi0/0/0/2Gi0/0
4 nodes, with the interface names each link uses. On a narrow screen, scroll the diagram sideways.
Every link, as text
  • PEER Gi0/0 to R1 Gi0/0/0/2
  • R1 Gi0/0/0/0 to R2 Gi0/0/0/0
  • R2 Gi0/0/0/2 to CUST Gi0/0
Nodes in BGP security and DDoS tools, with the image each runs and the vCPU and RAM it’s set to
NodeDeviceImage in Add NodeSet to
PEERCisco IOSvvios-adventerprisek9-m.spa.159-3.m91 vCPU, 512 MB
R1Cisco IOS XRvxrv-k9-demo-6.3.11 vCPU, 2,560 MB
R2Cisco IOS XRvxrv-k9-demo-6.3.11 vCPU, 2,560 MB
CUSTCisco IOSvvios-adventerprisek9-m.spa.159-3.m91 vCPU, 512 MB

How to open this lab

  1. Sign in to your workspace at lab.cloudlabbox.com.

  2. In File Manager, open Shared, then the folder CCNP Service Provider guided labs.

  3. Open 06 - BGP security and DDoS tools and start its nodes, then open Lab Tasks for the scenario and the steps.

The lab is read-only. You can start the nodes and configure the devices, but changes to the topology can’t be saved. To change it, rebuild it in your own folder.

More CCNP Service Provider labs

All CCNP Service Provider labs

Related labs in other courses

CloudLabBox is independent of Cisco. The lab follows exam topics and isn’t vendor training material; vendor names identify the exams and the images in the workspace.