Checking that an AS is allowed to originate a prefix.
Advanced · 20 min read
You'll learn to explain what a ROA is, read the three validation states, and apply a policy based on them.
Who is allowed to originate this prefix?
BGP trusts what neighbours say. If a network announces 198.51.100.0/24 that it does not own, others may accept it. The Resource Public Key Infrastructure (RPKI) adds a check. Address holders publish signed Route Origin Authorizations (ROAs) saying which AS may originate a prefix and how specific it may be.
From ROA to router decision
On small screens, swipe sideways or focus the diagram and use the arrow keys.
Routers do not check signatures themselves.
Route origin validation: three possible results
On small screens, swipe sideways or focus the diagram and use the arrow keys.
Validation compares the origin AS and maximum length in a signed ROA with the route. Many networks drop invalid routes and accept the rest.
Route origin validation with an RPKI validator
On small screens, swipe sideways or focus the diagram and use the arrow keys.
Invalid routes can be dropped or given lower preference by policy. NotFound is common and should usually still be accepted, because many prefixes have no record yet.
How a router learns ROAs
A validator downloads and checks the signed records, then gives the router a list of validated prefixes over the RPKI-to-Router protocol. The router compares each BGP route with that list and marks it valid, invalid or not found.
Validation states
On small screens, swipe sideways or focus the diagram and use the arrow keys.
Policy decides what to do with each state.
router bgp 64500
bgp rpki server tcp 192.0.2.100 port 3323 refresh 600
address-family ipv4 unicast
neighbor 192.0.2.1 route-map RPKI-IN in
route-map RPKI-IN deny 10
match rpki invalid
route-map RPKI-IN permit 20
R1. The validator address is an example. Sequence 10 rejects invalid routes; sequence 20 accepts valid and not-found ones. Check the exact syntax on your release.
Illustrative Cisco IOS XE output written for this lesson, not a router capture
Each line is a validated ROA: the prefix, the longest length allowed, the permitted origin and the validator it came from. A route needs a covering line to be valid.
Two details cause most surprises. A route that is more specific than the ROA allows is invalid even if the origin is right, so set the maximum length deliberately. And a prefix with no ROA at all is not found, not invalid, so it is accepted by the policy above.
Validation is only useful if policy uses it. Many networks reject invalid routes and accept valid and not found. Some prefer valid routes without rejecting the others. Start by marking and logging, then enforce once you understand the impact.
Rolling out ROV
On small screens, swipe sideways or focus the diagram and use the arrow keys.
Dropping invalid routes without testing can remove a customer you meant to keep.
Check your understanding
Predict · scenario 1
A route has no matching ROA at all. Which state is it?
Predict · scenario 2
The ROA allows AS 64501 up to /24. The route is a /25 originated by AS 64501. State?
Predict · scenario 3
Does RPKI origin validation check the whole AS path?
FAQ
What does RPKI protect against?
Mistaken or malicious origination: an AS announcing a prefix it does not own. It does not validate the whole AS path, so it does not stop every kind of hijack.
What is a ROA?
A Route Origin Authorization is a signed record that says an AS may originate a prefix up to a maximum length. Address holders publish them.
Should invalid routes be dropped?
Many networks do. Start by logging or lowering preference, check what would be affected, then reject. Make sure your own prefixes have correct ROAs first.