From 8bbe97f8d909eb0996661b1e9195e0691be9cf93 Mon Sep 17 00:00:00 2001 From: Christian Poessinger Date: Sun, 15 Dec 2019 19:20:16 +0100 Subject: bgp: rpki: move rpki content to dedicated file --- docs/routing/rpki.rst | 46 ++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 46 insertions(+) create mode 100644 docs/routing/rpki.rst (limited to 'docs/routing/rpki.rst') diff --git a/docs/routing/rpki.rst b/docs/routing/rpki.rst new file mode 100644 index 00000000..0c41c875 --- /dev/null +++ b/docs/routing/rpki.rst @@ -0,0 +1,46 @@ +.. _rpki: + +#### +RPKI +#### + +:abbr:`RPKI (Resource Public Key Infrastructure)` is a framework :abbr:`PKI +(Public Key Infastucrure)` designed to secure the Internet routing +infrastructure. It associate a BGP route announcement with the correct +originating :abbr:`ASN (Autonomus System Number)` and check its validity. + +RPKI is described in :rfc:`6480`. This is a separate server. You can find more +details at RIPE-NNC_. + +Imported prefixes during the validation may have values: valid, invalid and +not found. + +* The valid state means that prefix and ASN that originated it match the + :abbr:`ROA (Route Origination Authorizations)` base. +* Invalid means that prefix/prefix length and ASN that originated it doesn't + match with ROA. +* Notfound means that prefix not found in ROA. + +We can build route-maps for import, based on these states. Simple RPKI +configuration, where 'routinator' - RPKI cache server with ip '10.11.11.1'. + +.. code-block:: none + + set protocols rpki cache routinator address '10.11.11.1' + set protocols rpki cache routinator port '3323' + +Example route-map for import. We can set local-preference logic based on states. +Also we may not import prefixes with the state 'invalid'. + +.. code-block:: none + + set policy route-map ROUTES-IN rule 10 action 'permit' + set policy route-map ROUTES-IN rule 10 match rpki 'valid' + set policy route-map ROUTES-IN rule 10 set local-preference '300' + set policy route-map ROUTES-IN rule 20 action 'permit' + set policy route-map ROUTES-IN rule 20 match rpki 'notfound' + set policy route-map ROUTES-IN rule 20 set local-preference '125' + set policy route-map ROUTES-IN rule 30 action 'deny' + set policy route-map ROUTES-IN rule 30 match rpki 'invalid' + +.. _RIPE-NNC: https://github.com/RIPE-NCC/rpki-validator-3/wiki -- cgit v1.2.3