4

I'm planning to run BGP with my upstream provider and advertise our global IPv6 prefixes. I'd like to use only link-local addresses between the ISP's router and my border router to make the border router "invisible" to the Internet and thereby reduce the attack surface.

Has anyone else tried this? Are there pitfalls I should be aware of?

  • Based on experience, it is unlikely that the ISP will agree to this. Also, the safest thing would be to use a /127 to eliminate the risk of a ping-pong attack. All the ISPs that I have dealt with require a /126, claiming ignorance of the RFC for /127 point-to-point links. – Ron Maupin Mar 23 '15 at 21:47
  • What did you end up with? Do you have an answer to your question? – Ron Maupin Aug 6 '17 at 2:22
  • You were right that the ISP didn't want to/couldn't do it. – Ron Trunk Aug 6 '17 at 21:58
  • OK. I have been on a mission to get questions with unaccepted answers to accept an answer so that they don't keep popping up. I have noticed that this has some effect, and answers are being accepted, but it is a lot of work. – Ron Maupin Aug 6 '17 at 22:01
2

I discussed this with some peers, and the consensus is that it won't work with BGP since BGP is not an interface-oriented routing protocol like the IGPs. The IGPs are enabled on an interface so they know which interface has the peer's link-local address. In fact, IGPs they use the link-local address to connect to a peer.

BGP, on the other hand, is not enabled by interface; it is given a neighbor address. BGP cannot tell which interface has the link-local neighbor address since all the IPv6 interfaces have the same link-local subnet (fe80::/10). BGP connects via TCP (Layer-4) so it needs a distinct address with which to peer.

Without trying it, I can't tell, but it may be possible to set a static route to the peer's link-local address, but I seriously doubt an ISP would go to that effort for a non-standard configuration on a POP router that may have multiple WAN terminations from multiple customers.

  • I found this document which certainly indicates it's possible: cisco.com/c/en/us/td/docs/ios-xml/ios/iproute_bgp/configuration/…. It also works in my lab. – Ron Trunk Mar 24 '15 at 3:20
  • It certainly seems possible, but, as I said, it is going to be up to your ISP, and I have serious doubts that an ISP is going to go to the trouble of doing this for you. My company is huge with a big stick to threaten ISPs, but we have not had much luck moving them on anything. – Ron Maupin Mar 24 '15 at 3:32
  • Ron is right, the trick is to find a vendor that allows you to specify the Interface, as well as forces you to manually set a (global) next-hop address. Otherwise, there is no way for the local BGP speaker to know which interface the intended neighbor exists in. And to quote from @Ron's document: "Configuring IPv6 multiprotocol BGP between two IPv6 routers (peers) using link-local addresses requires that the interface for the neighbor be identified by using the update-source command and that a route map be configured to set an IPv6 global next hop." – Eddie May 23 '15 at 8:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.