diff options
| author | Christian Poessinger <christian@poessinger.com> | 2019-12-15 19:20:16 +0100 |
|---|---|---|
| committer | Christian Poessinger <christian@poessinger.com> | 2019-12-15 19:20:16 +0100 |
| commit | 8bbe97f8d909eb0996661b1e9195e0691be9cf93 (patch) | |
| tree | b52bd3d12477856fb6c57391ae5d20b6ae55ff35 /docs/routing/bgp.rst | |
| parent | 8617a305f8f15a829e22e56de4ffe03c2c9fd44e (diff) | |
| download | vyos-documentation-8bbe97f8d909eb0996661b1e9195e0691be9cf93.tar.gz vyos-documentation-8bbe97f8d909eb0996661b1e9195e0691be9cf93.zip | |
bgp: rpki: move rpki content to dedicated file
Diffstat (limited to 'docs/routing/bgp.rst')
| -rw-r--r-- | docs/routing/bgp.rst | 38 |
1 files changed, 0 insertions, 38 deletions
diff --git a/docs/routing/bgp.rst b/docs/routing/bgp.rst index 1bb33aee..4fac4889 100644 --- a/docs/routing/bgp.rst +++ b/docs/routing/bgp.rst @@ -147,41 +147,3 @@ Route filter can be applied using a route-map: We could expand on this and also deny link local and multicast in the rule 20 action deny. - -RPKI -^^^^ - -:abbr:`RPKI (Resource Public Key Infrastructure)` is a framework :abbr:`PKI (Public Key Infastucrure)` -designed to secure the Internet routing insfratructure. -It associate a BGP route announcement with the correct originating :abbr:`ASN (Autonomus System Number)` and check it validation. -RPKI described in :rfc:`6480`. This is a separate server. You can find more details at RIPE-NNC_. - -Imported prefixes during the validation may have values: valid, invalid and notfound. - -* The valid state means that prefix and ASN that originated it match the :abbr:`ROA (Route Origination Authorizations)` base. -* Invalid means that prefix/prefix length and ASN that originated it doesn't match with ROA. -* Notfound means that prefix not found in ROA. - -We can build route-maps for import, based on these states. -Simple RPKI configuration, where 'routinator' - RPKI cache server with ip '10.11.11.1'. - -.. code-block:: none - - set protocols rpki cache routinator address '10.11.11.1' - set protocols rpki cache routinator port '3323' - -Example route-map for import. We can set local-preference logic based on states. -Also we may not import prefixes with the state 'invalid'. - -.. code-block:: none - - set policy route-map ROUTES-IN rule 10 action 'permit' - set policy route-map ROUTES-IN rule 10 match rpki 'valid' - set policy route-map ROUTES-IN rule 10 set local-preference '300' - set policy route-map ROUTES-IN rule 20 action 'permit' - set policy route-map ROUTES-IN rule 20 match rpki 'notfound' - set policy route-map ROUTES-IN rule 20 set local-preference '125' - set policy route-map ROUTES-IN rule 30 action 'deny' - set policy route-map ROUTES-IN rule 30 match rpki 'invalid' - -.. _RIPE-NNC: https://github.com/RIPE-NCC/rpki-validator-3/wiki |