[routing-wg] RPKI Route Origin Validation and AS3333

Hello Nathalie,

I am a bit puzzled. Isn't that bebavior exactly what we wanted?

RIPE NCC depends on other networks/providers that implemted RPKI as
desired, and it works!

So what's the problem? Helping people that are on the "invalid" side of
the network? No. please don't.

They should raise their connectivity issue locally with their network
provider that should fix the problem.

I believe there is no action to RIPE NCC here.

Regards, Kurt


Am 18.03.21 um 16:03 schrieb Nathalie Trenaman:
> Dear Colleagues, Working Group,
>
> As discussed previously in this mailing list, some community members
> expressed that they would like to see the RIPE NCC perform Route
> Origin Validation on AS3333. We decided to ask the community for
> advice and guidance on how we should proceed. 
>
> What is Route Origin Validation?
> Route Origin Validation is a mechanism by which route advertisements
> can be authenticated as originating from an expected autonomous system
> (AS). 
> The best current practice is to drop RPKI invalid BGP announcements.
> These are announcements that conflict with the statement as described
> in a Route Origin Authorization (ROA).
>
> What is AS3333?
> This is the AS Number for the RIPE NCC’s main service network. It
> includes most of our *.ripe.net <http://ripe.net/>websites, including
> the LIR Portal (my.ripe.net <http://my.ripe.net/>) and the RIPE Database. 
>
> What is the Problem?
> Currently, some of our upstream providers already perform ROV. This
> means that some of our members that potentially misconfigured their
> ROA or members who have lost control of creation and modification of
> their ROAs cannot reach our services via those peers. 
>
> On the other hand, some of our upstream providers do not perform ROV,
> and if a member’s prefix is being announced by a hijacker, they cannot
> access our services. We already received a report about this.This is
> also not an ideal situation. 
>
> From the network operations perspective, there are no obstacles to
> enable  ROV on AS3333, however, we have to consider that members or
> End Users who announce something different in BGP than their ROA
> claims, will be dropped and lose access to our services from their
> network. This includes the RPKI Dashboard where they can make changes
> to their ROAs. This is specially relevant when members operate
> certificate generation in hosted mode which is the current operation
> mode for almost all for our members. 
> From an analysis we made on 10 February, there were 511 of such
> announcements from our members and End Users.
>
> Our current RPKI Terms and Conditions do not mention that a Member or
> End User ROA should match their routing intentions, or any
> implications it may have if the ROA does not match their BGP
> announcement. If the community decides it is important that AS3333
> performs ROV, our legal team needs to update the RPKI Terms and
> Conditions to reflect the potential impact. 
>
> I welcome a respectful discussion and look forward to your advice and
> guidance.
>
> Kind regards,
>
> Nathalie Trenaman
> Routing Security Programme Manager
> RIPE NCC
-------------- next part --------------
An HTML attachment was scrubbed...
URL: </ripe/mail/archives/routing-wg/attachments/20210318/af03d4ea/attachment.html>