uRPF - Unicast Reverse Path Forwarding

Cisco Docs: Cisco Docs: Secure DATA PLANE>Security Configuration Guide: Unicast Reverse Path Forwarding
http://www.cisco.com/en/US/docs/ios-xml/ios/sec_data_urpf/configuration/12-4t/sec-data-urpf-12-4t-book.html

The Unicast RPF feature helps to mitigate problems that are caused by the introduction of malformed or forged (spoofed) IP source addresses into a network by discarding IP packets that lack a verifiable IP source address

Configure the receiving interface, which allows Unicast RPF to verify the best return path before forwarding the packet on to the next destination. For example, verify if the SOURCE IP is reachable via that exact interface:
(config-subif)#ip verify unicast source reachable-via ?
  any  Source is reachable via any interface
  rx   Source is reachable via interface on which packet was received <-EXACT INTERFACE

#sh ip int s1/0.21 | b verify
  IP verify source reachable-via RX
   0 verification drops
   0 suppressed verification drops
   0 verification drop-rate

!!!If the check fails, and this is NOT the best interface to reach the IP from which the incoming packed was sourced the packed it DROPPED.

Zone Based Firewall

Cisco Docs: Secure DATA PLANE>Security Configuration Guide:Zone-Based Policy Firewall
http://www.cisco.com/en/US/docs/ios-xml/ios/sec_data_zbf/configuration/12-4t/sec-data-zbf-12-4t-book.html

To configure the Zone Based FW, the approach is somewhat similar to the MQC method in the QoS configuration.

STEP 1> Start by creating a class map of INSPECT TYPE, and match HTTP, and DROP everything else:
(config)#class-map type inspect match-any OUTSIDE
(config-cmap)#match protocol http
(config-pmap)#class type inspect OUTSIDE 
(config-pmap-c)#drop

STEP 2> Create a inspect type POLICY-MAP that matches the defined CLASS-MAP, and INSPECTS:
(config)#policy-map type inspect OUTSIDE_POLICY
(config-pmap)#class OUTSIDE
(config-pmap-c)#inspect ?
  WORD  Parameter-map (inspect) name <PARAMETER MAP CAN BE DEFINED to tune the inspection
  <cr>
(config-pmap-c)#inspect

STEP 3> Define the SECURITY ZONES for the interfaces you need, and assign them to the interfaces:
(config)#zone security DMZ
(config-if)#zone-member security DMZ

(config)#zone security OUTSIDE
(config-if)#zone-member security OUTSIDE

STEP 4> Set the POLICIES between each ZONE PAIR:
(config)#zone-pair security OUT-to-DMZ source OUTSIDE destination DMZ
(config-sec-zone-pair)#service-policy type inspect OUTSIDE_POLICY

#show policy-map type inspect zone-pair session
policy exists on zp OUT-to-DMZ
 Zone-pair: OUT-to-DMZ
  Service-policy inspect : OUTSIDE_POLICY
    Class-map: INSIDE (match-any)
      Match: protocol tcp
        0 packets, 0 bytes
        30 second rate 0 bps
      Match: protocol udp
        0 packets, 0 bytes
        30 second rate 0 bps
      Match: protocol icmp
        0 packets, 0 bytes
        30 second rate 0 bps
   Inspect
    Class-map: class-default (match-any)
      Match: any
      Drop
        0 packets, 0 bytes

PARAMETER MAP can be created to tune to drop logs, handle alarms, max&min session numbers and much more, for example:
(config)# parameter-map type inspect eng-network-profile
(config-profile)# tcp synwait-time 3 <-HOW LONG TO WAIT FOR SYN FOR THE TCP SESSION

BGP Regular Expressions - explained with the examples

REMINDER of the META Characters

^ - START of Line
$ - END of Line
| - Logical OR
_ - ANY DELIMETER
? - ZERO instances of the PRECEDING character
* - ZERO OR MODE instances of the PRECEDING character
+ - ONE OR MORE instances of the PRECEDING character
(x) - Combine the enclosed String as a single entity
[x] - Wildcard where any position can match the position in AS-Path
. - Any Character


EXAMPLES

_65505$ - Prefixes that END with the AS 65505, meaning - they were originated by that AS

_65505_ - Prefixes that traversed the AS 65505

^$ - Locally Originated Prefixes (START and END of the line)

.* - ANY prefix (zero or more instances of ANY character)

^[0-9]+$ - All the prefixes from DIRECTLY CONNECTED ASs (meaning - they have only 1 AS in the AS PAth)


BEFORE CREATING THE AS-PATH ACL

If you want to STOP using the recursive algorithm in order to be able to control more complex  regular expressions

(config-router)#bgp regexp deterministic

Now you can actually DISPLAY the prefixes that match your condition in the AS-PATH before defining the AS-PATH ACL

#show ip bgp regexp REGULAR_EXPRESSION

*There is a TRICK here, you need to add a MEMORY location you want to temporarily place thhe results, so instead of the expression ^300$ you would have to type:

#show ip bgp regexp (^300$)(_\1)*$

You can also display the Filter List before applying it to the neighbor:

#show ip bgp filter-list 1

BGP Filters: Distribution and Prefix lists

The main difference between applying the DISTRIBUTE list and the PREFIX list to the BGP neighbor is:

- DISTRIBUTE LIST: You need to define the ACL, and apply it in the form of a Distribution List:

(config)#access-list 1 deny 172.12.25.0 0.0.0.255
(config-router)#neighbor 5.5.5.5 distribute-list 1 in

- PREFIX LIST: You define the PREFIX list, and apply the same prefix list to the BGP neighbor

(config-router)#neighbor 5.5.5.5 prefix-list PREF_LIST in

BGP: Advanced Tuning using the known Attributes

BGP is all about tuning. The non-tuned BGP is basically a RIP, but once you adjust it to your needs - no other routing protocol can come even close.

The basic and well-known BGP Tuning Attributes are:


1. AS-Path (The less ASs in the path - the Better)

Used to influence another AS by adding or PREPENDING the AS's to the prefix using the Route Map.

You can do a pretty granular control here using the AS-PATCH Access Lists. You do need a basic knowledge of TCL for this, so basically if you need to match all the prefixes that pass threw the AS 65505 you do this:

(config)#ip as-path access-list 10 permit ^65505$ <--- you can go wild with the filters
*in this case we are filtering the prefixes origineted and advertised directly by AS 200


The AS-PATH ACL can also be applied to a neighbor as a FILTER-LIST

(config-router)#neighbor 172.25.185.45 filter-list 10 in



REMINDER of the META Characters:

^ - START of Line
$ - END of Line
| - Logical OR
_ - ANY DELIMETER
? - ZERO instances of the PRECEDING character
* - ZERO OR MODE instances of the PRECEDING character
+ - ONE OR MORE instances of the PRECEDING character
(x) - Combine the enclosed String as a single entity
[x] - Wildcard where any position can match the position in AS-Path
. - Any Character

After this you just match this condition in the route-map in order to set some parameter later:

(config-route-map)#match as-path 10


2. Weight (the Higher - the Better)

It's a CISCO Proprietary Attribute, Used ONLY LOCALY to influence the LOCAL AS by assigning the WEIGHT attribute to prefixes announced from a BGP Neighbor

First you need to set up the route-map. You can use the MATCH condition, but you dont have to. In this case we will apply the weight to all the prefixes announced by a neighbor.

route-map SET_WEIGHT permit 10
 match ...
 set weight 500

And now apply the route-map to a neighbor in the INBOUND direction (prefixes coming IN, meaning - are announced by that neighbor):

router bgp 65535
 neighbor 172.21.12.2 remote-as 64500
 neighbor 172.21.12.2 route-map SET_WEIGHT in

Or you can simply apply the WEIGHT attribute to the neighbor directly:

router bgp 65535
 neighbor 172.21.12.2 remote-as 64500
 neighbor 172.21.12.2 weight 500

3. MED (Multi Exit Discriminator) Attribute; RFC 1771 - Optional and Non-Transitive; The Smaller the Better

This is the most similar Attribute to the OSPF Metric that there is in BGP. The nature of this attribute is similar to the AS-Path, because they are both used to influence the other AS by tuning the attributes of the Locally Originated&Advertised Prefixes
You can simply set it (set metric X) within the route-map configuration, and apply it to the BGP Neighbor in the OUTBOUND direction

If you wish to RE-ARRANGE the Attribute Comparison order, and for example wish to compare the MED value before the AS-Path (meaning - prefer the lower MED, regardless of the AS-Path), you can use this command under the BGP configuration:

(config-router)#bgp always-compare-med <--- to compare MED value even if there is higher ranked attribute that decides
(config-router)#bgp bestpath as-path ignore <--- to IGNORE the AS-Path attribute, HIDDEN COMMAND on IOS!!!
*BE CAREFULL with the second command, the TAB key will not work and the "?" will not show you the "as-path" option

By default the MISSING MED value is considered the BEST one because on most IOS-s it picks up the value 0. To change this use:

(config-router)#bgp bestpath med missing-as-worst <--- Treat the non-defined MED as the WORST

BGP Community Attribute

Community attribute is one of those non-standard BGP attributes that you really need to know well if you wish to use it. The big advantage is that from time to time you will just swoop in and solve a big architecture problem your colleague Network Engineers are having. The down side is that it's a bit tacky. For example, these are the communities you can set within the route-map configuration>

Cisqueros_R1(config-route-map)#set community ?
  <1-4294967295>  community number
  aa:nn           community number in aa:nn format
  additive        Add to the existing community
  internet        Internet (well-known community) <--- ADVERTISE these networks
  local-AS        Do not send outside local AS (well-known community) <--- ONLY advertise within the AS
  no-advertise    Do not advertise to any peer (well-known community) <--- The neighbor will not advertise what was matched to neither eBGP nor iBGP neighbors
  no-export       Do not export to next AS (well-known community) <--- Like previous, but ONLY for eBGP
  none            No community attribute
  <cr>


*IMPORTANT: Do not forget to actually SEND the community to the neighbor, otherwise your configuration will not work!!!

 (config-router)#neighbor x.x.x.x send-community

You can of course apply the BGP community attributes on the INBOUND and OUTBOUND direction, where you automatically override the existing value.

Besides these well-known community values, you can also assign a random community number and use them later as BGP TAGS.

BGP Conditional Advertisements - Advertise Maps

This is a pretty complex BGP issue because you really need to know the BGP philosophy and maybe even have some basic experience in programming. The trick is to change the behavior of the BGP advertisements depending on the routes that are being learned.

router bgp 65545
 neighbor 172.25.13.3 advertise-map ADV_ROUTE_MAP non-exist-map CONDITION_ROUTE_MAP

Intuitively we can see that the ADV_ROUTE_MAP is the route map that defines the routes that will be broadcast, in this case if the conditions defined in the route-map CONDITION_ROUTE_MAP is NOT satisfied, meaning - if the prefixes are NOT in the table.