1. http://www.grnet.gr Firewall on Demand A multidomain approach Leonidas Poulopoulos, Yannis Mitsos – GRNET NOC Firewall on Demand workshop TF-MSP meeting 27-28 November 2014

2. Network threats GRNET Cloud IaaS

3. DDoS illustrated

4. GRNET - Rapid Anomaly Detection Python tool - rady VolumetricPackets (WP-pingback)

5. Consequences Performance degradation – GÉANT Backbone – NRENs Outages Services malfunction Resources – Human – Equipment

6. Mitigation Techniques though time acls, firewall filtersRTBHBGP flowspec

7. The acl way Detect attack Profile it Apply local ACL Notify upstream Apply NREN ACLs Notify upstream Apply upstream ACLs Phone calls Emails TIME TIME TIME

8. The BGP way Well established model of trust Stable and robust – Powers the internet Remote triggered black-hole routing BGP flow specification – “My name is Wall, Fire Wall”

9. Who are you BGP Flowspec? BGP Flowspec defined in RFC 5575 Layer 4 (TCP and UDP) firewall filters to be distributed in BGP on both a intra- domain and inter-domain basis Match – source/dest prefix – source/dest port – ICMP type/code – packet size – DSCP – TCP flag – fragment type – Etc Actions – accept – discard – rate-limit – sample – redirect – etc

10. A firewall filter over BGP??? Propagates wherever BGP flow spec is enabled – Currently supported by Juniper To the very ends of the network To peering networks – Downstream – Upstream Ideas! Apply to a single point and let it propagate to my borders Sounds like attacks are now mitigated closer to source!!! – YES!!!! Seems that it is more granular than RTBH – YES!!!! Can we automate this?? Can we go from RFC to tool? – Have already done this!!!

11. Can you remind me why we need BGP flowspec? Distributed across the network Closer to the source Fine-grained even on core/backbone networks Multidomain easy propagation towards the upstream via BGP Easy automation & integration ACL S Flowspec: enhancement of RTBH Does not affect all traffic to victim Less coarse More actions Separate NLRI BGP RTHB

12. Firewall on Demand – from RFC to tool D EVELOPED BY : GRNET G RANULARITY : Per-flow level A CTION : Drop, rate-limit, redirect S PEED : 1-2 orders of magnitude quicker E FFICIENCY : closer to the source, multi-domain A UTOMATION : integration with other systems M ANAGEABILITY : status track, web interface N EED FOR BETTER TOOLS TO MITIGATE TRANSIENT ATTACKS

13. GRNET setup

14. How does it work? Customer’s NOC logs in web tool & describes flows and actions Destination validated against customer’s IP space A dedicated router is configured to advertise the route via BGP flowspec Dynamic firewall filters are implemented on all routers Attack is mitigated upon entrance End of attack: Removal via the tool, or auto-expire Web NETCONF eBGP iBGP

15. Have you tried it in production? GRNET network in production since 2011 3 years 21Tbytes 100rules 40 users 20 peers

16. Is there a chance that I shoot my leg???? BGP Flowspec is a “sharp knife” Protocol/Tool level protection – Flowspec filters – BGP filters – Authorization Users can only act for their networks – Application level protection Protected networks Alerts for violation Everything according to procedures

17. Time to go multidomain fod.geant.net

18. FoD recipe 1 central FoD instance BGP flowspec enabled in GÉANT routers 3 flavors – NREN without BGP flowspec supporting equipment – NREN with BGP flowspec equipment that uses local FoD – NREN with BGP flowspec equipment that uses GEANT’s FoD

19. All together

20. Phase 1 tests Click Apply 6 seconds later…

21. FoD Application Architecture https://code.grnet.gr/projects/flowspy http://flowspy.readthedocs.org O PEN S OURCE

22. Under the hood Django application – 1.4 – Debian Wheezy system packages Application server – Gunicorn HTTP server – Apache Proxy module Database – MySQL Caching – Memcached Job scheduler – Celeryd Que – Beanstalkd Network client – Ncclient - NETCONF

23. Installation and monitoring Extensively tested on Debian Wheezy – Using system packages Done in ~ 30 mins Monitored components – Host checks – Service checks Apache (check_http) Gunicorn (check_mk) Celeryd (check_mk)

24. Joining FoD Shibboleth attributes: – email (maps to HTTP_EMAIL) – persistent-nameid or persistent-id or targeted-id (all map to HTTP_REMOTE_USER) A valid institution/peer with active subnets

25. Support GRNET will actively support FoD Same codebase Small changes in single and multidomain – Shibboleth vs. eduGAIN Full installation documentation of multidomain flavor will be provided by the end of Nov 2014

26. To Do’s Full documentation for multidomain setup Multidomain repository Harden security – Limit access ACL – Introduce Shibboleth attributes (?) Test on production network with manual entry Invite 2-3 NRENs to join

27. http://www.grnet.gr Thank you