BGP sits quietly in the background until something goes wrong. Then everyone notices. The Border Gateway Protocol decides how traffic moves between autonomous systems, so a bad route announcement can send traffic somewhere it shouldn’t go. Securing BGP means making those route decisions harder to abuse and easier to spot when something looks wrong.<\/p>\n
A good first step is controlling who can even establish a BGP session with your router. Don’t leave that door open wider than it needs to be.<\/p>\n
Use authentication between BGP peers, especially with external peers. TCP MD5 has been widely used for this purpose, while TCP Authentication Option, or TCP-AO, provides a newer approach where supported. The exact option depends on your network equipment and software.<\/p>\n
Access control matters too. Your edge router should only accept BGP connections from known peer addresses. If a random system can reach the BGP service, you’re already making life easier for an attacker.<\/p>\n
\u2022 An explicit prefix filter is boring, which is exactly why I like it. Boring security controls tend to stay useful.<\/p>\n
\u2022 RPKI validation adds another check by verifying whether a network is authorised to originate a prefix, although it doesn’t solve every BGP security problem.<\/p>\n
\u2022 Maximum-prefix limits put a ceiling on what a peer can announce, so one bad session doesn’t suddenly fill your routing table.<\/p>\n
A route leak happens when routing information travels somewhere it shouldn’t. The result can be traffic taking an unexpected path, sometimes across networks that were never meant to carry it.<\/p>\n
Strong import and export policies reduce this risk. Don’t treat a provider, customer, and peer as if they all have the same routing relationship. They don’t.<\/p>\n
AS path filters are useful here because they let you check the autonomous systems appearing in a route’s path. Community-based policies can add another layer of control, provided they’re designed carefully.<\/p>\n
RPKI is one of the better tools available for dealing with route origin problems. A network operator creates a Route Origin Authorisation that says which autonomous system is permitted to originate a prefix. Routers that perform RPKI validation can then classify received routes based on that information.<\/p>\n
It isn’t magic. A valid RPKI result doesn’t prove that the entire path is trustworthy. Still, ignoring it when your equipment supports it feels like leaving a useful lock sitting on the table.<\/p>\n
Security doesn’t end after the filters are configured. Watch the routing table and look for changes that don’t fit normal behaviour.<\/p>\n
\u2022 Unexpected origin changes should get a second look, especially for important prefixes.<\/p>\n
\u2022 Route count suddenly jumps? That’s worth investigating before users start reporting strange connectivity.<\/p>\n
Finally, protect the routers themselves. Limit management access and keep network operating systems updated. Remove old peer configurations instead of letting them sit around forever.<\/p>\n
Also review filters after network changes. A policy that made perfect sense two years ago can become a hole after one provider changes its setup.<\/p>","protected":false},"excerpt":{"rendered":"
BGP sits quietly in the background until something goes wrong. Then everyone notices. The Border Gateway Protocol decides how traffic…<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[31],"tags":[],"class_list":["post-4510","post","type-post","status-publish","format-standard","hentry","category-learn"],"_links":{"self":[{"href":"https:\/\/cybx.in\/blog\/wp-json\/wp\/v2\/posts\/4510","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/cybx.in\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cybx.in\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/cybx.in\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/cybx.in\/blog\/wp-json\/wp\/v2\/comments?post=4510"}],"version-history":[{"count":1,"href":"https:\/\/cybx.in\/blog\/wp-json\/wp\/v2\/posts\/4510\/revisions"}],"predecessor-version":[{"id":4560,"href":"https:\/\/cybx.in\/blog\/wp-json\/wp\/v2\/posts\/4510\/revisions\/4560"}],"wp:attachment":[{"href":"https:\/\/cybx.in\/blog\/wp-json\/wp\/v2\/media?parent=4510"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cybx.in\/blog\/wp-json\/wp\/v2\/categories?post=4510"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cybx.in\/blog\/wp-json\/wp\/v2\/tags?post=4510"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}