BGP

Internet Routing Registries (IRRs) are databases that store information about how internet traffic should be routed between different networks and autonomous systems. They play a crucial role in enhancing the accuracy and efficiency of internet routing. IRRs contain records that describe the IP address prefixes and Autonomous System Numbers (ASNs) that a network owns or controls.

These records are typically created and maintained by network administrators and Internet Service Providers (ISPs). Deft and other network operators use IRR data to create and update routing policies. By consulting IRRs, network administrators can ensure that routing decisions are based on accurate and up-to-date information, which helps prevent traffic misdirection, hijacking, and other routing anomalies. This is especially important for maintaining the stability and security of the global internet.

Customers who have public BGP peerings with Deft are required to maintain accurate IRR information for their ASN. They will need to provide either an AUT-NUM or an AS-SET. If a customer would like to update the source (AUT-NUM or AS-SET) Deft uses to update routing policies, they can contact support@deft.com.

Deft updates the prefix filters using automated tools twice a day at 8AM CT and 8PM CT.

Resource Public Key Infrastructure (RPKI) is a security framework designed to enhance the trustworthiness of internet routing by tying cryptographic keys to IP address prefixes.

With RPKI, organizations can create digitally signed Route Origin Authorizations (ROAs) that assert their authority over specific IP address blocks. These ROAs are then distributed through a hierarchical system of Certificate Authorities (CAs), enabling network operators to verify the legitimacy of route announcements made over the Border Gateway Protocol (BGP). RPKI helps prevent route hijacking and IP address spoofing, two common security vulnerabilities in internet routing, by allowing routers to validate that the announced routes match the cryptographic ROAs, thus increasing the overall security and reliability of the global internet routing system.

Deft currently accepts valid route announcements. For customers who have deployed RPKI, this allows for routes to be accepted immediately by both Deft and its upstream providers without having to wait for a prefix filter update to happen. IRR information is still required to be kept up to date.

Deft does not reject invalid or unknown routes at this time. Deft will start rejecting invalid routes in early 2024 and currently has no plans to reject unknown routes before then.

BCP38, short for “Best Current Practice 38,” is a network security recommendation that encourages network operators to implement source address validation in their networks.

Specifically, BCP38 advocates for the filtering of outgoing traffic so that it only contains source IP addresses that are legitimately assigned to the network. By doing so, BCP38 helps prevent the use of spoofed or forged source IP addresses, which are commonly exploited in various types of cyberattacks, including Distributed Denial of Service (DDoS) and IP address spoofing. This practice aids in maintaining the integrity and security of the global internet by ensuring that traffic leaving a network carries accurate source information, making it harder for malicious actors to manipulate or misuse IP addresses in their network traffic.

Deft will be applying filters to customer interfaces which will allow traffic with source addresses from either a prefix which has been accepted by the BGP policy or by a prefix within each customer’s IRR AUT-NUM or AS-SET. Traffic sourced from accepted valid RPKI routes will be accepted even though the IRR information hasn’t been updated on the router.