Implementing Bgp Security With Rpki

Implementing BGP Security with RPKI

Overview

Resource Public Key Infrastructure (RPKI) provides cryptographic validation of BGP route origins to prevent route hijacking and accidental route leaks. RPKI enables network operators to create Route Origin Authorizations (ROAs) that declare which Autonomous Systems (ASes) are authorized to originate specific IP prefixes. BGP routers validate received route announcements against RPKI data through Route Origin Validation (ROV), rejecting routes with invalid origins. This skill covers creating ROAs through Regional Internet Registries (RIRs), deploying RPKI validator software, configuring ROV on Cisco IOS-XE and Juniper Junos routers, and implementing BGP filtering policies based on RPKI validation state.

When to Use

• When deploying or configuring implementing bgp security with rpki capabilities in your environment
• When establishing security controls aligned to compliance requirements
• When building or improving security architecture for this domain
• When conducting security assessments that require this implementation

Prerequisites

• IP address space allocated from an RIR (ARIN, RIPE, APNIC, AFRINIC, LACNIC)
• RIR member portal access for ROA creation
• BGP routers (Cisco IOS-XE 16.x+, Juniper Junos 12.2+, or similar)
• Linux server for RPKI validator/cache (Routinator, FORT, or OctoRPKI)
• Understanding of BGP routing and AS path concepts

Core Concepts

RPKI Architecture

┌──────────────────────────────────────────────┐
│           Regional Internet Registries        │
│    (ARIN, RIPE, APNIC, AFRINIC, LACNIC)      │
│                                               │
│  ┌─────────────────────────────────────────┐  │
│  │  Trust Anchor (Root CA Certificate)      │  │
│  │  ├── CA Certificate (ISP/Organization)   │  │
│  │  │   ├── ROA: AS64512 → 198.51.100.0/24 │  │
│  │  │   └── ROA: AS64512 → 2001:db8::/32   │  │
│  │  └── CA Certificate (Another Org)        │  │
│  │      └── ROA: AS64513 → 203.0.113.0/24  │  │
│  └─────────────────────────────────────────┘  │
└──────────────────────────────────────────────┘
                     │ rsync/RRDP
                     ▼
         ┌──────────────────────┐
         │  RPKI Validator/Cache │  (Routinator, FORT, OctoRPKI)
         │  Validates ROAs       │
         │  Serves VRPs to RTR   │
         └──────────────────────┘
                     │ RTR Protocol (TCP 8323)
                     ▼
         ┌──────────────────────┐
         │  BGP Router           │
         │  Performs ROV          │
         │  Applies policy:      │
         │   Valid → Accept      │
         │   Invalid → Reject    │
         │   NotFound → Accept   │
         └──────────────────────┘

RPKI Validation States

| State | Meaning | Recommended Action | |-------|---------|-------------------| | Valid | ROA exists, origin AS and prefix match | Accept route (prefer) | | Invalid | ROA exists, but origin AS or prefix length mismatch | Reject route | | NotFound | No ROA covers this prefix | Accept (but lower preference) |

Route Origin Authorization (ROA)

A ROA is a signed object that states:

• Prefix: The IP address range (e.g., 198.51.100.0/24)
• Origin AS: The AS authorized to originate this prefix (e.g., AS64512)
• Max Length: Maximum prefix length that can be announced (e.g., /24)

Workflow

Step 1: Create ROAs at Your RIR

ARIN (North America):

1. Log into ARIN Online portal
2. Navigate to Routing Security > Route Origin Authorizations
3. Create ROA:

• Prefix: 198.51.100.0/24
• Origin AS: AS64512
• Max Length: /24 (set equal to prefix length to prevent sub-prefix hijacking)

1. Sign and submit

RIPE NCC (Europe):

1. Log into RIPE NCC LIR Portal
2. Navigate to Certification (RPKI) > ROAs
3. Create ROA with prefix, origin AS, and max prefix length

Step 2: Deploy RPKI Validator (Routinator)

# Install Routinator on Ubuntu
sudo apt install -y routinator

# Or install via Cargo (Rust)
curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh
cargo install routinator

# Initialize Routinator (accept TALs)
routinator init --accept-arin-rpa

# Start Routinator in RTR server mode
routinator server \
  --rtr 0.0.0.0:8323 \
  --http 0.0.0.0:8080 \
  --refresh 600 \
  --retry 60 \
  --expire 7200

# Run as systemd service
cat > /etc/systemd/system/routinator.service  dict:
        """Get Routinator server status."""
        url = f"{self.routinator_url}/api/v1/status"
        try:
            with urllib.request.urlopen(url) as resp:
                return json.loads(resp.read())
        except Exception as e:
            print(f"Error connecting to Routinator: {e}")
            return {}

    def check_validity(self, asn: int, prefix: str) -> dict:
        """Check RPKI validity of a prefix/origin pair."""
        url = f"{self.routinator_url}/api/v1/validity/AS{asn}/{prefix}"
        try:
            with urllib.request.urlopen(url) as resp:
                return json.loads(resp.read())
        except Exception as e:
            return {"error": str(e)}

    def get_vrp_count(self) -> int:
        """Get total number of Validated ROA Payloads."""
        status = self.get_status()
        return status.get("vrpsCount", 0)

    def report(self, prefixes_to_check: list):
        """Generate RPKI monitoring report."""
        status = self.get_status()

        print(f"\n{'='*60}")
        print("RPKI MONITORING REPORT")
        print(f"{'='*60}")
        print(f"\nRoutinator Status:")
        print(f"  Version: {status.get('version', 'Unknown')}")
        print(f"  VRPs Total: {status.get('vrpsCount', 'N/A')}")
        print(f"  Last Update: {status.get('lastUpdateDone', 'N/A')}")

        if prefixes_to_check:
            print(f"\nPrefix Validity Checks:")
            for asn, prefix in prefixes_to_check:
                result = self.check_validity(asn, prefix)
                validity = result.get("validated_route", {}).get(
                    "validity", {}).get("state", "error")
                print(f"  AS{asn} -> {prefix}: {validity.upper()}")

if __name__ == "__main__":
    monitor = RPKIMonitor()

    # Check own prefixes
    own_prefixes = [
        (64512, "198.51.100.0/24"),
    ]

    monitor.report(own_prefixes)

Best Practices

• Create ROAs for All Prefixes - Sign ROAs for every prefix your organization announces
• Max Length = Prefix Length - Set max-length equal to announced prefix length to prevent sub-prefix hijacking
• Dual Validator - Run two independent RPKI validators for redundancy
• Soft Policy First - Start with logging RPKI-invalid routes before dropping them
• Monitor ROA Expiry - Set alerts for ROA certificates approaching expiration
• Coordinate with Upstreams - Notify transit providers about your RPKI deployment
• Test with Looking Glass - Verify your ROAs are visible using public RPKI validators

References

• RPKI Documentation
• Cloudflare RPKI Blog
• NLnet Labs Routinator
• RIPE NCC RPKI Dashboard
• RFC 6480 - RPKI Architecture
• RFC 6811 - BGP Origin AS Validation

Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

• Author: pinkpixel-dev
• Source: pinkpixel-dev/skills-collection-2
• License: MIT

Install and usage instructions live in the source repository linked above.