RPKI validation for BGP
Accept only BGP routes whose origin is verified.
With RPKI, network operators record with their registry (in Europe, the RIPE NCC) which autonomous system may announce a prefix (Route Origin Authorizations). A validator such as Routinator or rpki-client checks the signatures and passes the result to the routers via RTR. The routers discard invalid routes. This prevents many misconfigurations and announcements of other parties' prefixes with a false origin.
We recommend both: create your own ROAs and validate incoming routes. The effort is low once it is clear who maintains the ROAs. RPKI does not detect manipulation further along the path or route leaks. ASPA is meant for that. The procedure is not yet standardised, but ASPA objects can already be created at the RIPE NCC.
- you operate your own autonomous system and your own IP prefixes
- BGP runs with several upstreams or peers
- security requirements apply to the internet connection
- you have neither your own BGP routing nor your own IP prefixes
- the provider handles routing entirely; in that case, ask about its RPKI validation
Which tools suit your operations?
In an initial call we review your tool landscape and show where a change pays off and where it does not.