1. 1
Cleaning up your RPKI invalids
Elly Tawhai
PacNOG 31
elly@apnic.net

2. 2
2
What is RPKI?
A robust security framework for verifying the association
between resource holders and their Internet number
resources.
2

3. 3
3
Route Origin Authorization
What is contained in a ROA?
– The AS number you have authorized
– The prefix that is being originated from it
– The most specific prefix (maximum length) that the AS may
announce
For example: “ISP 4 permits AS65551
to originate a route for the prefix
198.51.100.0/24"
3

4. 4
4
Route Origin Validation
• Valid
– The prefix (prefix length) and AS pair found in the database
• Invalid
– Prefix is found, but origin-AS is wrong, OR
– The prefix length is longer than the maximum length
4

5. 5
5
Route Origin Validation
5
https://isbgpsafeyet.com/

6. 6
6
RPKI invalids
6

7. 7
7
RPKI invalids
7
Validation result IPv4 count
Invalid origin ASN 305
Invalid origin ASN and Max Length 138
Invalid Max Length 1333
Routeviews collector SG and Routunator

8. 8
8
RPKI invalids in Vanuatu
8
Validation result IPv4 count
Invalid origin ASN -
Invalid origin ASN and Max Length -
Invalid Max Length 1

9. 9
9
RPKI invalids
9
Origin ASN AS Name Economy No. of invalid routes
AS9249 VUTELECOM-
AS01-VU-APC
VU 1

10. 10
10
ROA Prevalidation
10

11. 11
11
ROA Prevalidation
11
• Validate changes submitted via MyAPNIC to ensure
that they won’t cause problems in BGP
• Allows Members to override if necessary

12. 12
12
Routing status alerts in DASH
12
https://dash.apnic.net/

13. 13
13
Routing status alerts in DASH
13

14. 14
14
ROA alert filters in DASH
14

15. 15
15
ROA coverage – Vanuatu

16. 16
16
Access to RPKI
16
Request a
Digital
Certificate
(2FA)
Corporate
Contact
approves
request
Install Digital
Certificate
Corporate
Contact gives
RPKI update
permission
Enable RPKI in
MyAPNIC
Create ROA
Simplified …
Get access to
MyAPNIC
Set up TOTP
(2FA)
Enable RPKI
in MyAPNIC Create ROA

17. 17
Questions?