5

I'm planning to run BGP with my upstream provider and advertise our global IPv6 prefixes. I'd like to use only link-local addresses between the ISP's router and my border router to make the border router "invisible" to the Internet and thereby reduce the attack surface.

Has anyone else tried this? Are there pitfalls I should be aware of?

Improve this question
3
  • Based on experience, it is unlikely that the ISP will agree to this. Also, the safest thing would be to use a /127 to eliminate the risk of a ping-pong attack. All the ISPs that I have dealt with require a /126, claiming ignorance of the RFC for /127 point-to-point links.
    – Ron Maupin ♦
    Commented Mar 23, 2015 at 21:47
  • What did you end up with? Do you have an answer to your question?
    – Ron Maupin ♦
    Commented Aug 6, 2017 at 2:22
  • You were right that the ISP didn't want to/couldn't do it.
    – Ron Trunk
    Commented Aug 6, 2017 at 21:58

2 Answers 2

Reset to default
3

I discussed this with some peers, and the consensus is that it won't work with BGP since BGP is not an interface-oriented routing protocol like the IGPs. The IGPs are enabled on an interface so they know which interface has the peer's link-local address. In fact, IGPs they use the link-local address to connect to a peer.

BGP, on the other hand, is not enabled by interface; it is given a neighbor address. BGP cannot tell which interface has the link-local neighbor address since all the IPv6 interfaces have the same link-local subnet (fe80::/10). BGP connects via TCP (Layer-4) so it needs a distinct address with which to peer.

Without trying it, I can't tell, but it may be possible to set a static route to the peer's link-local address, but I seriously doubt an ISP would go to that effort for a non-standard configuration on a POP router that may have multiple WAN terminations from multiple customers.

Improve this answer
3
  • I found this document which certainly indicates it's possible: cisco.com/c/en/us/td/docs/ios-xml/ios/iproute_bgp/configuration/…. It also works in my lab.
    – Ron Trunk
    Commented Mar 24, 2015 at 3:20
  • It certainly seems possible, but, as I said, it is going to be up to your ISP, and I have serious doubts that an ISP is going to go to the trouble of doing this for you. My company is huge with a big stick to threaten ISPs, but we have not had much luck moving them on anything.
    – Ron Maupin ♦
    Commented Mar 24, 2015 at 3:32
  • Ron is right, the trick is to find a vendor that allows you to specify the Interface, as well as forces you to manually set a (global) next-hop address. Otherwise, there is no way for the local BGP speaker to know which interface the intended neighbor exists in. And to quote from @Ron's document: "Configuring IPv6 multiprotocol BGP between two IPv6 routers (peers) using link-local addresses requires that the interface for the neighbor be identified by using the update-source command and that a route map be configured to set an IPv6 global next hop."
    – Eddie
    Commented May 23, 2015 at 8:02
1

This does work, example configuration below. The statement after the link-local address and the "%" was the critical bit for me.

Tested on Cisco 15.2(4)M11 - Advanced Enterprise

R1#sh run | sec bgp
router bgp 65001
 bgp log-neighbor-changes
 neighbor FE80::2%FastEthernet0/0 remote-as 65002
 !
 address-family ipv4
  no neighbor FE80::2%FastEthernet0/0 activate
 exit-address-family
 !
 address-family ipv6
  neighbor FE80::2%FastEthernet0/0 activate
  neighbor FE80::2%FastEthernet0/0 soft-reconfiguration inbound
 exit-address-family

!

R2#sh run | sec bgp
router bgp 65002
 bgp log-neighbor-changes
 neighbor FE80::1%FastEthernet0/0 remote-as 65001
 !
 address-family ipv4
  no neighbor FE80::1%FastEthernet0/0 activate
 exit-address-family
 !
 address-family ipv6
  neighbor FE80::1%FastEthernet0/0 activate
  neighbor FE80::1%FastEthernet0/0 next-hop-self
  neighbor FE80::1%FastEthernet0/0 soft-reconfiguration inbound
 exit-address-family
!

This link was helpful: https://community.cisco.com/t5/networking-blogs/lab-mp-bgp-attributes-manipulation-and-route-redistribution/ba-p/4628153

Improve this answer
3
  • That may work on the CE side, but the question is also about the ISP only using the link-local address, and I seriously doubt the ISP will do something like that.
    – Ron Maupin ♦
    Commented Mar 8, 2023 at 22:51
  • Your mileage may vary, but my ISP is willing to work with us and support this architecture.
    – Peter
    Commented Mar 9, 2023 at 12:23
  • As the OP explained in a comment, "You were right that the ISP didn't want to/couldn't do it."
    – Ron Maupin ♦
    Commented Mar 13, 2023 at 17:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.