BGP and RPKI: why you should implement route origin validation

The Border Gateway Protocol (BGP) exchanges routing information between the autonomous systems (ASes) that make up the internet. Without it the internet would not work, yet it has almost no security built in: a router accepts the routes its neighbours announce and passes them on. Resource Public Key Infrastructure (RPKI) closes part of that gap. As a simplified analogy, you can think of RPKI as an SSL certificate for BGP. This article explains why you should implement it on your BGP network.

What RPKI is, in a nutshell

RPKI is a public key infrastructure for internet number resources. The regional internet registries (RIPE NCC, ARIN, APNIC, LACNIC and AFRINIC) issue certificates that prove who holds which IP prefixes and AS numbers.

With those certificates, the holder of a prefix signs a Route Origin Authorisation (ROA): a statement that a given AS may originate the prefix, up to a maximum prefix length. Other networks download all published ROAs, validate them, and compare every BGP announcement they receive against them. Each route then gets one of three states:

• Valid: a ROA covers the prefix and the origin AS matches.
• Invalid: a ROA covers the prefix, but the origin AS or the prefix length does not match.
• Not found: no ROA covers the prefix.

Routers that perform this route origin validation (ROV) usually drop invalid routes and keep the others.

How it protects your network

The main threat RPKI addresses is the route hijack, deliberate or accidental: an AS announces prefixes it does not hold, and traffic meant for them is attracted to the wrong network, where it can be dropped, inspected or redirected. Many large incidents were simple misconfigurations, such as a network leaking a more specific prefix it should never have announced.

RPKI helps in two directions:

• Signing ROAs for your own prefixes lets every network that validates reject hijacked announcements of your address space.
• Validating the routes you receive keeps invalid routes out of your own routing table, so your users’ traffic is not sent to a hijacker.

The more networks validate, the less far a hijack spreads. Most large transit providers and many IXP route servers already drop invalid routes.

What it does not do

RPKI is not a cure-all, and it helps to be precise about its limits:

• It validates the origin of a route, not the whole AS path. An attacker who announces your prefix with your AS number appended as the origin still passes origin validation. Path validation, through BGPsec or the newer ASPA, is meant to address this but is not widely deployed yet.
• It does not stop IP address spoofing, DDoS attacks or routing loops, and it does not make routing faster. Those need other measures, such as source address filtering and good BGP hygiene.
• It only protects prefixes that have ROAs, against networks that actually validate.

How to implement it

1. Create ROAs for your prefixes. Use the hosted RPKI service of your regional registry, for example the RPKI dashboard in the RIPE NCC portal. List every AS that legitimately originates each prefix, including DDoS protection or CDN providers that announce your space, and set the maximum length carefully.
2. Run a validator. A relying-party package such as Routinator, rpki-client or FORT downloads and verifies all published ROAs. Run at least two for redundancy.
3. Connect your routers to the validators. Routers receive the validated data from the validators over the RPKI-to-Router (RTR) protocol. Most current platforms support it, including Cisco, Juniper, Nokia, Arista, MikroTik and BIRD.
4. Apply a policy. Start by only tagging or logging invalid routes, check what would be dropped, then reject invalid routes on your external sessions.
5. Monitor. Watch your validators and the validity of your own announcements, and update your ROAs whenever you change how you announce your prefixes.

Conclusion

BGP is critical to the internet and easy to abuse. RPKI does not solve every problem, but signing your prefixes and rejecting invalid routes is a well-supported, low-cost way to protect your network and the rest of the internet from route hijacks. The RIPE NCC has a good introduction: What is RPKI?