diff options
Diffstat (limited to 'docs')
| -rw-r--r-- | docs/routing/rpki.rst | 85 |
1 files changed, 67 insertions, 18 deletions
diff --git a/docs/routing/rpki.rst b/docs/routing/rpki.rst index 0c41c875..47ca63f1 100644 --- a/docs/routing/rpki.rst +++ b/docs/routing/rpki.rst @@ -5,32 +5,70 @@ RPKI #### :abbr:`RPKI (Resource Public Key Infrastructure)` is a framework :abbr:`PKI -(Public Key Infastucrure)` designed to secure the Internet routing -infrastructure. It associate a BGP route announcement with the correct -originating :abbr:`ASN (Autonomus System Number)` and check its validity. +(Public Key Infrastructure)` designed to secure the Internet routing +infrastructure. It associates BGP route announcements with the correct +originating :abbr:`ASN (Autonomus System Number)` which BGP routers can then +use to check each route against the corresponding :abbr:`ROA (Route Origin +Authorisation)` for validity. RPKI is described in :rfc:`6480`. -RPKI is described in :rfc:`6480`. This is a separate server. You can find more -details at RIPE-NNC_. +A BGP-speaking router like VyOS can retrieve ROA information from RPKI +"Relying Party software" (often just called an "RPKI server" or "RPKI +validator") by using :abbr:`RTR (RPKI to Router)` protocol. There are several +open source implementations to choose from, such as NLNetLabs' Routinator_ +(written in Rust), Cloudflare's GoRTR_ and OctoRPKI_ (written in Go), and +RIPE NCC's RPKI Validator_ (written in Java). The RTR protocol is described +in :rfc:`8210`. -Imported prefixes during the validation may have values: valid, invalid and -not found. +First you will need to deploy an RPKI validator for your routers to use. The +RIPE NCC helpfully provide `some instructions`_ to get you started with +several different options. Once your server is running you can start +validating announcements. -* The valid state means that prefix and ASN that originated it match the - :abbr:`ROA (Route Origination Authorizations)` base. -* Invalid means that prefix/prefix length and ASN that originated it doesn't - match with ROA. -* Notfound means that prefix not found in ROA. +Imported prefixes during the validation may have values: -We can build route-maps for import, based on these states. Simple RPKI -configuration, where 'routinator' - RPKI cache server with ip '10.11.11.1'. + valid + The prefix and ASN that originated it match a signed ROA. These are + probably trustworthy route announcements. + + invalid + The prefix or prefix length and ASN that originated it doesn't + match any existing ROA. This could be the result of a prefix hijack, or + merely a misconfiguration, but should probably be treated as + untrustworthy route announcements. + + notfound + No ROA exists which covers that prefix. Unfortunately this is the case + for about 80% of the IPv4 prefixes which were announced to the :abbr:`DFZ + (default-free zone)` at the start of 2020 (see more detail in + NLnet Labs' `RPKI analytics`_). + +.. note:: + If you are responsible for the global addresses assigned to your + network, please make sure that your prefixes have ROAs associated with them + to avoid being `notfound` by RPKI. For most ASNs this will involve + publishing ROAs via your :abbr:`RIR (Regional Internet Registry)` (RIPE + NCC, APNIC, ARIN, LACNIC or AFRINIC), and is something you are encouraged + to do whenever you plan to announce addresses into the DFZ. + + Particularly large networks may wish to run their own RPKI certificate + authority and publication server instead of publishing ROAs via their RIR. + This is a subject far beyond the scope of VyOS' documentation. Consider + reading about Krill_ if this is a rabbit hole you need or especially want + to dive down. + +We can build route-maps for import based on these states. Here is a simple +RPKI configuration, where `routinator` is the RPKI-validating "cache" +server with ip `192.0.2.1`: .. code-block:: none - set protocols rpki cache routinator address '10.11.11.1' + set protocols rpki cache routinator address '192.0.2.1' set protocols rpki cache routinator port '3323' -Example route-map for import. We can set local-preference logic based on states. -Also we may not import prefixes with the state 'invalid'. +Here is an example route-map to apply to routes learned at import. In this +filter we reject prefixes with the state `invalid`, and set a higher +`local-preference` if the prefix is RPKI `valid` rather than merely +`notfound`. .. code-block:: none @@ -43,4 +81,15 @@ Also we may not import prefixes with the state 'invalid'. set policy route-map ROUTES-IN rule 30 action 'deny' set policy route-map ROUTES-IN rule 30 match rpki 'invalid' -.. _RIPE-NNC: https://github.com/RIPE-NCC/rpki-validator-3/wiki +Once your routers are configured to reject RPKI-invalid prefixes, test +whether the configuration is working correctly using the `RIPE Labs RPKI +Test`_ experimental tool. + +.. _Routinator: https://www.nlnetlabs.nl/projects/rpki/routinator/ +.. _GoRTR: https://github.com/cloudflare/gortr +.. _OctoRPKI: https://github.com/cloudflare/cfrpki#octorpki +.. _Validator: https://www.ripe.net/manage-ips-and-asns/resource-management/certification/tools-and-resources +.. _some instructions: https://labs.ripe.net/Members/tashi_phuntsho_3/how-to-install-an-rpki-validator +.. _Krill: https://www.nlnetlabs.nl/projects/rpki/krill/ +.. _RPKI analytics: https://www.nlnetlabs.nl/projects/rpki/rpki-analytics/ +.. _RIPE Labs RPKI Test: https://sg-pub.ripe.net/jasper/rpki-web-test/ |