[ncc-services-wg] 2013-04 New Policy Proposal (Resource Certification for non-RIPE NCC Members)

Hi,

off on a tangent(?):

> And from
> http://www.cisco.com/en/US/docs/ios-xml/ios/iproute_bgp/configuration/xe-3s/irg-origin-as.pdf:
> "You can allow an invalid prefix to be used as the BGP best
> path, even if valid prefixes are available. This is the default
> behavior."

I keep seeing/hearing this when RPKI is discussed.  While strictly
true, the way I've understood this, it will also defeat one of the
main purposes of RPKI, namely to be able to defend against certain
route hijacking or route leak events, where more-specific routes are
propagated and accepted.

In order to defend against that type of events, due to the "longest
matching prefix always wins, irrespective of BGP attributes" behaviour
(which isn't a trait of BGP but of how our routers look up forwarding
entries), you cannot have your router configured to install RPKI-
invalid prefixes in your forwarding table.

Regards,

- Håvard