RPKI

RPKI is a framework PKI designed to secure the Internet routing infrastructure. It associate a BGP route announcement with the correct originating ASN and check its validity.

RPKI is described in RFC 6480. This is a separate server. You can find more details at RIPE-NNC.

Imported prefixes during the validation may have values: valid, invalid and not found.

  • The valid state means that prefix and ASN that originated it match the ROA base.
  • Invalid means that prefix/prefix length and ASN that originated it doesn’t match with ROA.
  • Notfound means that prefix not found in ROA.

We can build route-maps for import, based on these states. Simple RPKI configuration, where ‘routinator’ - RPKI cache server with ip ‘10.11.11.1’.

set protocols rpki cache routinator address '10.11.11.1'
set protocols rpki cache routinator port '3323'

Example route-map for import. We can set local-preference logic based on states. Also we may not import prefixes with the state ‘invalid’.

set policy route-map ROUTES-IN rule 10 action 'permit'
set policy route-map ROUTES-IN rule 10 match rpki 'valid'
set policy route-map ROUTES-IN rule 10 set local-preference '300'
set policy route-map ROUTES-IN rule 20 action 'permit'
set policy route-map ROUTES-IN rule 20 match rpki 'notfound'
set policy route-map ROUTES-IN rule 20 set local-preference '125'
set policy route-map ROUTES-IN rule 30 action 'deny'
set policy route-map ROUTES-IN rule 30 match rpki 'invalid'