Routing

hi guys.

in our company we have a MPLS backbone with 70 nodes ( MX 204, MX 10003 and 10008) router.

We are currently usin 4 MX 10003 routers as a root reflector cluster.

No, we want so secure the ruster to make it 

Now we want to secure the cluster with encryption.

Now my question.

Can i do it this way so that the old an the new both work an exchange the routes each other?

Thanks fo your helb...

Doesn't anyone here have an idea, or doesn't anyone want to answer?

hi guys.

in our company we have a MPLS backbone with 70 nodes ( MX 204, MX 10003 and 10008) router.

We are currently usin 4 MX 10003 routers as a root reflector cluster.

No, we want so secure the ruster to make it 

Now we want to secure the cluster with encryption.

Now my question.

Can i do it this way so that the old an the new both work an exchange the routes each other?

Thanks fo your helb...

Hi Thomas,

Just read your message but I'm trying to understand what you are trying to achieve here. Typically a route reflector is inside your own network, so I'm not entirely sure what purpose the encryption would serve. If traffic were to flow across external connectivity it makes sense I suppose, as you might not want others to read your data, but the BGP route information typically isn't all that big of a concern, but I do not know your network or customers, so I don't mean this as passing judgement on the choice.

There are of course ways to secure your sessions with authentication options to ensure that the neighbors are only established with verified neighbors and you can't get a MITM for these, such as BGP-MD5 (authentication-key (Protocols BGP and BMP) | Junos OS | Juniper Networks), which is the more legacy approach, or the newer version of using BGP with TCP-AO (TCP Authentication Option (TCP-AO) | Junos OS | Juniper Networks) for a better security level.

If you do want to further enhance it with encryption then I suppose you'll need to utilize IPsec for your BGP traffic, this is elaborated on this page:

IP Security for BGP | Junos OS | Juniper Networks

As encryption is inherently a 2-way street though it will not be such that it can support both the old and new way unless you set up an entirely new session in parallel with the existing one (you'd need a separate loopback IP on your route reflectors as well as all your other routers, as you can't configure 2 BGP sessions with the same neighbor IP)

Note that I do not have personal experience with this setup though, we do not utilize BGP encryption inside our network since we operate our own backbone and have full control over the end-to-end path, and quite frankly I do not see a realistic scenario where someone could intercept that traffic in-flight without that being noticable (nor do I see a likely scenario where they could do anything useful with that data if they did). This is not discrediting your usecase of course, as I do not know how your network looks or what kind of traffic is on there, merely relaying our own considerations for this choice for reflection :)

Doesn't anyone here have an idea, or doesn't anyone want to answer?

hi guys.

in our company we have a MPLS backbone with 70 nodes ( MX 204, MX 10003 and 10008) router.

We are currently usin 4 MX 10003 routers as a root reflector cluster.

No, we want so secure the ruster to make it 

Now we want to secure the cluster with encryption.

Now my question.

Can i do it this way so that the old an the new both work an exchange the routes each other?

Thanks fo your helb...

Thanks for your answer of my question.

I will shortly explain, why we wan to secure our bgb roote reflector.

Wer operate like you our own backbone and we have like youl full controll over the end-to-ens paths between the mpls router.

The idea, to secure the root reflector comes from a service engeneer from Juniper Networks.

His idea was, that no stranger router can manipulate our root table.

And i understand , that when we want to secure, we should use ipvsec.

THX for all.

Thomas

Hi Thomas,

Just read your message but I'm trying to understand what you are trying to achieve here. Typically a route reflector is inside your own network, so I'm not entirely sure what purpose the encryption would serve. If traffic were to flow across external connectivity it makes sense I suppose, as you might not want others to read your data, but the BGP route information typically isn't all that big of a concern, but I do not know your network or customers, so I don't mean this as passing judgement on the choice.

There are of course ways to secure your sessions with authentication options to ensure that the neighbors are only established with verified neighbors and you can't get a MITM for these, such as BGP-MD5 (authentication-key (Protocols BGP and BMP) | Junos OS | Juniper Networks), which is the more legacy approach, or the newer version of using BGP with TCP-AO (TCP Authentication Option (TCP-AO) | Junos OS | Juniper Networks) for a better security level.

If you do want to further enhance it with encryption then I suppose you'll need to utilize IPsec for your BGP traffic, this is elaborated on this page:

IP Security for BGP | Junos OS | Juniper Networks

As encryption is inherently a 2-way street though it will not be such that it can support both the old and new way unless you set up an entirely new session in parallel with the existing one (you'd need a separate loopback IP on your route reflectors as well as all your other routers, as you can't configure 2 BGP sessions with the same neighbor IP)

Note that I do not have personal experience with this setup though, we do not utilize BGP encryption inside our network since we operate our own backbone and have full control over the end-to-end path, and quite frankly I do not see a realistic scenario where someone could intercept that traffic in-flight without that being noticable (nor do I see a likely scenario where they could do anything useful with that data if they did). This is not discrediting your usecase of course, as I do not know how your network looks or what kind of traffic is on there, merely relaying our own considerations for this choice for reflection :)

Doesn't anyone here have an idea, or doesn't anyone want to answer?

hi guys.

in our company we have a MPLS backbone with 70 nodes ( MX 204, MX 10003 and 10008) router.

We are currently usin 4 MX 10003 routers as a root reflector cluster.

No, we want so secure the ruster to make it 

Now we want to secure the cluster with encryption.

Now my question.

Can i do it this way so that the old an the new both work an exchange the routes each other?

Thanks fo your helb...