Documentation
VyOS Documentation
Routing in VyOS
RPKI - Resource Public Key Infrastructure

RPKI - Resource Public Key Infrastructure

RPKI - Resource Public Key Infrastructure

Overview

RPKI (Resource Public Key Infrastructure) is a public key infrastructure for securing internet routing. RPKI lets the owners of IP address blocks create cryptographically signed Route Origin Authorization (ROA) records that define which autonomous systems (AS) are allowed to announce specific prefixes.

Key characteristics

  • RFC standards: RFC 6480 (architecture), RFC 6482 (ROA), RFC 8210 (RTR protocol)
  • BGP hijacking prevention: protection against unauthorized prefix announcements
  • Cryptographic validation: use of digital signatures to verify ROAs
  • Global infrastructure: managed by Regional Internet Registries (RIR)
  • Real-time validation: routes are checked at the moment they are received

Why RPKI is needed

BGP has no built-in mechanisms for verifying the legitimacy of route announcements. Any AS can announce any prefix, which leads to:

  1. BGP Hijacking: malicious or accidental announcement of someone else’s prefixes
  2. Route Leaks: accidental route leaks caused by misconfiguration
  3. Man-in-the-Middle attacks: traffic interception through forged routes
  4. DDoS attacks: diverting traffic for DoS purposes

RPKI solves these problems through cryptographic validation of the origin AS for prefixes.

How RPKI works

  1. RIR issues certificates: Regional Internet Registries (RIPE, ARIN, APNIC, etc.) issue certificates to the owners of IP blocks
  2. ROA creation: the owner creates a Route Origin Authorization specifying which AS may announce the prefix
  3. Publication in a repository: the ROA is published in an RPKI repository
  4. RPKI Validator: a dedicated server downloads and verifies all ROAs
  5. RTR protocol: routers receive validated data over RTR (RPKI-to-Router)
  6. BGP Origin Validation: when a BGP update is received, the origin AS and prefix are checked for a match against the ROA

RPKI components

Regional Internet Registries (RIR)

Organizations that manage IP address allocation:

  • RIPE NCC - Europe, Middle East, part of Asia
  • ARIN - North America
  • APNIC - Asia-Pacific region
  • LACNIC - Latin America and the Caribbean
  • AFRINIC - Africa

For Russia, the primary RIR is RIPE NCC.

Route Origin Authorization (ROA)

A ROA is a cryptographically signed object that contains:

  • Prefix: an IP block (for example, 203.0.113.0/24)
  • Max Length: the maximum prefix length for more-specific announcements
  • Origin AS: the AS number allowed to announce the prefix
  • Digital signature: the signature of the resource owner

Example ROA:

Prefix: 203.0.113.0/24
Max Length: 24
Origin AS: AS65001

This means that only AS65001 may announce 203.0.113.0/24 and any prefixes up to /24.

RPKI Validator (Cache Server)

An RPKI Validator is a server that:

  1. Downloads ROAs from the repositories of all RIRs
  2. Verifies the cryptographic signatures
  3. Builds a database of validated prefixes
  4. Provides the data to routers over the RTR protocol

Popular RPKI validators:

  • RIPE NCC RPKI Validator
  • Routinator (from NLnet Labs)
  • FORT Validator
  • OctoRPKI (from Cloudflare)

RTR (RPKI-to-Router) Protocol

RTR (RFC 8210) is the protocol for transferring validated RPKI data from a cache server to routers.

Characteristics:

  • Runs over TCP (port 323 by default, often 8282 or 8323 are used)
  • A lightweight protocol for efficient transfer
  • Supports incremental updates
  • The router maintains a persistent connection to the validator

RTR messages:

  • Serial Notify: notification about new data
  • Serial Query: request for the current data
  • Cache Response: transfer of ROA data
  • End of Data: end of the transfer

Installing RPKI in VyOS

Requirements

  • VyOS 1.3.x or newer (RPKI support is included in FRRouting)
  • Access to an RPKI cache server (public or local)
  • A configured BGP

Checking RPKI support

# Проверка версии FRRouting (должна быть 7.5+)
show version

# Проверка доступности RPKI команд
show rpki ?

Basic RPKI configuration

Connecting to a public RPKI Cache Server

VyOS can connect to public RPKI validators to receive ROA data.

Cloudflare RPKI Validator

Cloudflare provides a free public RPKI validator:

# Добавление Cloudflare RPKI cache server
set protocols rpki cache cloudflare address rtr.rpki.cloudflare.com
set protocols rpki cache cloudflare port 8282
set protocols rpki cache cloudflare preference 1

commit
save

Cloudflare validator addresses:

  • IPv4: rtr.rpki.cloudflare.com (104.26.0.0/15)
  • IPv6: rtr.rpki.cloudflare.com (2606:4700::/32)
  • Port: 8282

NTT RPKI Validator

NTT also provides public validators:

# Добавление NTT RPKI cache server
set protocols rpki cache ntt address rpki.gin.ntt.net
set protocols rpki cache ntt port 323
set protocols rpki cache ntt preference 2

commit
save

NTT validator addresses:

  • IPv4: rpki.gin.ntt.net
  • IPv6: 2001:218:2001:8000::116
  • Port: 323

RIPE NCC RPKI Validator

RIPE provides a public validator for Europe:

# Добавление RIPE RPKI cache server
set protocols rpki cache ripe address rpki-validator.ripe.net
set protocols rpki cache ripe port 8282
set protocols rpki cache ripe preference 3

commit
save

RIPE validator addresses:

  • IPv4: rpki-validator.ripe.net
  • Port: 8282

Configuring multiple cache servers

It is recommended to configure several cache servers for redundancy:

# Cloudflare (primary)
set protocols rpki cache cloudflare address rtr.rpki.cloudflare.com
set protocols rpki cache cloudflare port 8282
set protocols rpki cache cloudflare preference 1

# NTT (secondary)
set protocols rpki cache ntt address rpki.gin.ntt.net
set protocols rpki cache ntt port 323
set protocols rpki cache ntt preference 2

# RIPE (tertiary)
set protocols rpki cache ripe address rpki-validator.ripe.net
set protocols rpki cache ripe port 8282
set protocols rpki cache ripe preference 3

commit
save

Preference: a lower value means higher priority. VyOS uses the cache with the lowest preference.

Polling intervals

Configuring the polling intervals for cache servers:

# Интервал опроса (по умолчанию 3600 секунд)
set protocols rpki cache cloudflare polling-period 3600

# Retry интервал при отключении (по умолчанию 600 секунд)
set protocols rpki cache cloudflare retry-interval 600

# Expire интервал (по умолчанию 7200 секунд)
set protocols rpki cache cloudflare expire-interval 7200

commit
save

Parameters:

  • polling-period: how often to refresh data from the cache (seconds)
  • retry-interval: the retry interval when the cache is unavailable
  • expire-interval: the time before cached data expires

SSH authentication for RTR

Some RPKI validators support SSH for a secure RTR connection:

# Настройка SSH для RTR (если поддерживается cache server)
set protocols rpki cache secure-cache address validator.example.com
set protocols rpki cache secure-cache port 22
set protocols rpki cache secure-cache ssh username rpki-client
set protocols rpki cache secure-cache ssh public-key-file /config/auth/rpki-key.pub
set protocols rpki cache secure-cache ssh private-key-file /config/auth/rpki-key
set protocols rpki cache secure-cache ssh known-hosts-file /config/auth/rpki-known-hosts
set protocols rpki cache secure-cache preference 1

commit
save

Generating SSH keys:

# На VyOS
ssh-keygen -t rsa -b 4096 -f /config/auth/rpki-key -N ""

# Копирование public key на validator server
# (процедура зависит от validator)

Integrating RPKI with BGP

Enabling Origin Validation

After configuring the RPKI cache, enable origin validation for BGP:

# Базовая BGP конфигурация
set protocols bgp system-as 65001
set protocols bgp parameters router-id 10.0.0.1

# Включение RPKI origin validation
set protocols bgp address-family ipv4-unicast rpki

commit
save

Validation States

RPKI origin validation assigns each route one of three states:

1. Valid

A route is considered valid if:

  • A ROA exists for the prefix
  • The origin AS in the BGP update matches the AS in the ROA
  • The prefix length does not exceed the max-length in the ROA

Example:

ROA: 203.0.113.0/24, Max Length: 24, Origin AS: 65001
BGP Route: 203.0.113.0/24 from AS65001 -> VALID

2. Invalid

A route is considered invalid if:

  • A ROA exists but the origin AS does not match
  • The prefix length exceeds the max-length in the ROA

Example:

ROA: 203.0.113.0/24, Max Length: 24, Origin AS: 65001
BGP Route: 203.0.113.0/24 from AS65002 -> INVALID (неправильная AS)
BGP Route: 203.0.113.0/25 from AS65001 -> INVALID (превышен max-length)

3. Not Found

A route is considered not-found if:

  • No ROA exists for the prefix
  • The prefix is not covered by any ROA

Example:

No ROA for 198.51.100.0/24
BGP Route: 198.51.100.0/24 from AS65003 -> NOT FOUND

RPKI-based filtering

Setting a BGP community based on the validation state

# Community для valid routes
set policy route-map RPKI-IN rule 10 action permit
set policy route-map RPKI-IN rule 10 match rpki valid
set policy route-map RPKI-IN rule 10 set community '65001:100' additive

# Community для invalid routes
set policy route-map RPKI-IN rule 20 action permit
set policy route-map RPKI-IN rule 20 match rpki invalid
set policy route-map RPKI-IN rule 20 set community '65001:666' additive

# Community для not-found routes
set policy route-map RPKI-IN rule 30 action permit
set policy route-map RPKI-IN rule 30 match rpki notfound
set policy route-map RPKI-IN rule 30 set community '65001:999' additive

# Применение к BGP neighbor
set protocols bgp neighbor 203.0.113.1 address-family ipv4-unicast route-map import RPKI-IN

commit
save

Changing the Local Preference

Prefer valid routes:

# Valid routes - высокий local preference
set policy route-map RPKI-PREF rule 10 action permit
set policy route-map RPKI-PREF rule 10 match rpki valid
set policy route-map RPKI-PREF rule 10 set local-preference 200

# Not-found routes - средний local preference
set policy route-map RPKI-PREF rule 20 action permit
set policy route-map RPKI-PREF rule 20 match rpki notfound
set policy route-map RPKI-PREF rule 20 set local-preference 100

# Invalid routes - низкий local preference
set policy route-map RPKI-PREF rule 30 action permit
set policy route-map RPKI-PREF rule 30 match rpki invalid
set policy route-map RPKI-PREF rule 30 set local-preference 50

# Применение
set protocols bgp neighbor 203.0.113.1 address-family ipv4-unicast route-map import RPKI-PREF

commit
save

Blocking invalid routes

Strict policy - drop invalid routes:

# Блокировка invalid routes
set policy route-map RPKI-STRICT rule 10 action deny
set policy route-map RPKI-STRICT rule 10 match rpki invalid

# Принимать valid routes
set policy route-map RPKI-STRICT rule 20 action permit
set policy route-map RPKI-STRICT rule 20 match rpki valid

# Принимать not-found routes (но с меньшим preference)
set policy route-map RPKI-STRICT rule 30 action permit
set policy route-map RPKI-STRICT rule 30 match rpki notfound
set policy route-map RPKI-STRICT rule 30 set local-preference 80

# Применение
set protocols bgp neighbor 203.0.113.1 address-family ipv4-unicast route-map import RPKI-STRICT

commit
save

Warning: Blocking invalid routes can break connectivity if ROAs are configured incorrectly or are outdated. It is recommended to start by lowering the preference.

RPKI for IPv6

RPKI also works for IPv6 prefixes:

# Включение RPKI для IPv6
set protocols bgp address-family ipv6-unicast rpki

# Route-map для IPv6
set policy route-map RPKI-IN-V6 rule 10 action permit
set policy route-map RPKI-IN-V6 rule 10 match rpki valid
set policy route-map RPKI-IN-V6 rule 10 set local-preference 200

set policy route-map RPKI-IN-V6 rule 20 action permit
set policy route-map RPKI-IN-V6 rule 20 match rpki notfound
set policy route-map RPKI-IN-V6 rule 20 set local-preference 100

set policy route-map RPKI-IN-V6 rule 30 action deny
set policy route-map RPKI-IN-V6 rule 30 match rpki invalid

# Применение к IPv6 neighbor
set protocols bgp neighbor 2001:db8::1 address-family ipv6-unicast route-map import RPKI-IN-V6

commit
save

Examples for cloud platforms

Example 1: RPKI for ISP BGP in Yandex Cloud

Scenario: an ISP with its own AS in Yandex Cloud using RPKI to protect against route hijacking.

Topology

[Internet] ---- [VyOS BGP Router] ---- [Yandex Cloud Networks]
                AS65001
                203.0.113.0/24

Preparation

  1. Creating a ROA in RIPE:

    • Log in to the RIPE NCC Portal
    • Create a ROA for 203.0.113.0/24
    • Specify Origin AS: 65001
    • Max Length: 24

  2. Wait for the ROA to propagate (usually a few minutes)

VyOS configuration

# Настройка RPKI cache servers (multiple for redundancy)
set protocols rpki cache cloudflare address rtr.rpki.cloudflare.com
set protocols rpki cache cloudflare port 8282
set protocols rpki cache cloudflare preference 1
set protocols rpki cache cloudflare polling-period 3600

set protocols rpki cache ripe address rpki-validator.ripe.net
set protocols rpki cache ripe port 8282
set protocols rpki cache ripe preference 2
set protocols rpki cache ripe polling-period 3600

# BGP конфигурация
set protocols bgp system-as 65001
set protocols bgp parameters router-id 10.0.0.1

# Upstream provider (ISP)
set protocols bgp neighbor 203.0.113.254 remote-as 174
set protocols bgp neighbor 203.0.113.254 description 'Cogent ISP'
set protocols bgp neighbor 203.0.113.254 address-family ipv4-unicast

# Включение RPKI validation
set protocols bgp address-family ipv4-unicast rpki

# RPKI-based filtering для входящих маршрутов
set policy route-map ISP-IN rule 10 action deny
set policy route-map ISP-IN rule 10 match rpki invalid
set policy route-map ISP-IN rule 10 description 'Drop RPKI invalid routes'

set policy route-map ISP-IN rule 20 action permit
set policy route-map ISP-IN rule 20 match rpki valid
set policy route-map ISP-IN rule 20 set local-preference 200
set policy route-map ISP-IN rule 20 description 'Prefer RPKI valid routes'

set policy route-map ISP-IN rule 30 action permit
set policy route-map ISP-IN rule 30 match rpki notfound
set policy route-map ISP-IN rule 30 set local-preference 100
set policy route-map ISP-IN rule 30 description 'Accept not-found with lower preference'

# Применение route-map
set protocols bgp neighbor 203.0.113.254 address-family ipv4-unicast route-map import ISP-IN

# Анонсирование собственных сетей
set protocols bgp address-family ipv4-unicast network 203.0.113.0/24

# Logging RPKI events
set system syslog file rpki.log facility protocols level info

commit
save

Verification

# Проверка RPKI cache servers
show rpki cache-server

# Ожидаемый вывод:
# Cache Server         Preference  State  Records
# rtr.rpki.cloudflare.com:8282  1   Connected  180234
# rpki-validator.ripe.net:8282  2   Connected  180235

# Проверка prefix table
show rpki prefix-table

# Поиск конкретного префикса
show rpki prefix-table | match 203.0.113.0

# Проверка BGP маршрутов с RPKI статусом
show bgp ipv4 unicast

# Детальная информация о маршруте
show bgp ipv4 unicast 1.1.1.0/24

Example 2: RPKI for Enterprise BGP in VK Cloud

Scenario: an enterprise with a dual-homed connection to two ISPs, using RPKI to validate incoming routes.

Topology

        [ISP1 - AS174]
             |
        [VyOS Router]
        AS65002
             |
        [ISP2 - AS1299]

VyOS configuration

# RPKI cache servers
set protocols rpki cache cloudflare address rtr.rpki.cloudflare.com
set protocols rpki cache cloudflare port 8282
set protocols rpki cache cloudflare preference 1

set protocols rpki cache ntt address rpki.gin.ntt.net
set protocols rpki cache ntt port 323
set protocols rpki cache ntt preference 2

# BGP base configuration
set protocols bgp system-as 65002
set protocols bgp parameters router-id 10.0.0.1

# ISP1 (Cogent)
set protocols bgp neighbor 203.0.113.1 remote-as 174
set protocols bgp neighbor 203.0.113.1 description 'ISP1 Cogent'
set protocols bgp neighbor 203.0.113.1 address-family ipv4-unicast

# ISP2 (Telia)
set protocols bgp neighbor 198.51.100.1 remote-as 1299
set protocols bgp neighbor 198.51.100.1 description 'ISP2 Telia'
set protocols bgp neighbor 198.51.100.1 address-family ipv4-unicast

# Включение RPKI
set protocols bgp address-family ipv4-unicast rpki

# RPKI filtering с community tagging
set policy community-list RPKI-VALID rule 10 action permit
set policy community-list RPKI-VALID rule 10 regex '65002:100'

set policy community-list RPKI-INVALID rule 10 action permit
set policy community-list RPKI-INVALID rule 10 regex '65002:666'

set policy community-list RPKI-NOTFOUND rule 10 action permit
set policy community-list RPKI-NOTFOUND rule 10 regex '65002:999'

# Route-map для ISP1
set policy route-map ISP1-IN rule 10 action deny
set policy route-map ISP1-IN rule 10 match rpki invalid
set policy route-map ISP1-IN rule 10 description 'Block RPKI invalid'

set policy route-map ISP1-IN rule 20 action permit
set policy route-map ISP1-IN rule 20 match rpki valid
set policy route-map ISP1-IN rule 20 set local-preference 200
set policy route-map ISP1-IN rule 20 set community '65002:100' additive

set policy route-map ISP1-IN rule 30 action permit
set policy route-map ISP1-IN rule 30 match rpki notfound
set policy route-map ISP1-IN rule 30 set local-preference 100
set policy route-map ISP1-IN rule 30 set community '65002:999' additive

# Route-map для ISP2 (аналогичный)
set policy route-map ISP2-IN rule 10 action deny
set policy route-map ISP2-IN rule 10 match rpki invalid

set policy route-map ISP2-IN rule 20 action permit
set policy route-map ISP2-IN rule 20 match rpki valid
set policy route-map ISP2-IN rule 20 set local-preference 150
set policy route-map ISP2-IN rule 20 set community '65002:100' additive

set policy route-map ISP2-IN rule 30 action permit
set policy route-map ISP2-IN rule 30 match rpki notfound
set policy route-map ISP2-IN rule 30 set local-preference 90
set policy route-map ISP2-IN rule 30 set community '65002:999' additive

# Применение route-maps
set protocols bgp neighbor 203.0.113.1 address-family ipv4-unicast route-map import ISP1-IN
set protocols bgp neighbor 198.51.100.1 address-family ipv4-unicast route-map import ISP2-IN

# Анонсирование собственной сети
set protocols bgp address-family ipv4-unicast network 192.0.2.0/24

commit
save

Monitoring and alerting

# Скрипт для мониторинга invalid routes
cat > /config/scripts/rpki-monitor.sh << 'EOF'
#!/bin/bash

INVALID_COUNT=$(vtysh -c "show bgp ipv4 unicast" | grep -c "i")

if [ "$INVALID_COUNT" -gt 0 ]; then
    logger -t RPKI "WARNING: $INVALID_COUNT RPKI invalid routes detected"
    echo "$INVALID_COUNT RPKI invalid routes detected" | mail -s "RPKI Alert" admin@example.com
fi
EOF

chmod +x /config/scripts/rpki-monitor.sh

# Добавление в cron
set system task-scheduler task rpki-check executable path /config/scripts/rpki-monitor.sh
set system task-scheduler task rpki-check interval 1h

commit
save

Example 3: RPKI for an IXP (Internet Exchange Point)

Scenario: a route server at an IXP using RPKI to filter routes from members.

# RPKI cache servers (multiple для HA)
set protocols rpki cache cf1 address rtr.rpki.cloudflare.com
set protocols rpki cache cf1 port 8282
set protocols rpki cache cf1 preference 1

set protocols rpki cache cf2 address rtr.rpki.cloudflare.com
set protocols rpki cache cf2 port 8282
set protocols rpki cache cf2 preference 2

set protocols rpki cache ntt address rpki.gin.ntt.net
set protocols rpki cache ntt port 323
set protocols rpki cache ntt preference 3

# Route Server BGP
set protocols bgp system-as 65000
set protocols bgp parameters router-id 192.0.2.254

# Включение RPKI
set protocols bgp address-family ipv4-unicast rpki

# Строгая RPKI политика для IXP
set policy route-map IXP-MEMBER-IN rule 10 action deny
set policy route-map IXP-MEMBER-IN rule 10 match rpki invalid
set policy route-map IXP-MEMBER-IN rule 10 description 'Block RPKI invalid routes'

set policy route-map IXP-MEMBER-IN rule 20 action permit
set policy route-map IXP-MEMBER-IN rule 20 match rpki valid

set policy route-map IXP-MEMBER-IN rule 30 action permit
set policy route-map IXP-MEMBER-IN rule 30 match rpki notfound
set policy route-map IXP-MEMBER-IN rule 30 description 'Allow not-found but tag'
set policy route-map IXP-MEMBER-IN rule 30 set community '65000:999'

# Peer group для IXP members
set protocols bgp peer-group IXP-MEMBERS address-family ipv4-unicast route-map import IXP-MEMBER-IN

# Члены IXP
set protocols bgp neighbor 192.0.2.1 peer-group IXP-MEMBERS
set protocols bgp neighbor 192.0.2.1 remote-as 65001
set protocols bgp neighbor 192.0.2.1 description 'Member AS65001'

set protocols bgp neighbor 192.0.2.2 peer-group IXP-MEMBERS
set protocols bgp neighbor 192.0.2.2 remote-as 65002
set protocols bgp neighbor 192.0.2.2 description 'Member AS65002'

commit
save

Monitoring and diagnostic commands

Viewing RPKI cache servers

# Статус всех cache servers
show rpki cache-server

Example output:

Cache Server                      Preference  State      Records  Serial
rtr.rpki.cloudflare.com:8282      1           Connected  180234   12345
rpki.gin.ntt.net:323              2           Connected  180235   12346
rpki-validator.ripe.net:8282      3           Error      0        0

States:

  • Connected: connected successfully and receiving data
  • Connecting: attempting to connect
  • Error: connection error
  • Stopped: the cache is stopped

Viewing the RPKI prefix table

# Вся таблица префиксов (может быть очень большой)
show rpki prefix-table

# Фильтрация по префиксу
show rpki prefix-table | match "203.0.113"

# Поиск по AS
show rpki prefix-table | match "AS65001"

Example output:

Prefix              Prefix Length  Max Length  Origin AS
203.0.113.0/24      24             24          65001
198.51.100.0/24     24             24          65002
192.0.2.0/24        24             25          65003

Fields:

  • Prefix: the IP prefix from the ROA
  • Prefix Length: the actual prefix length
  • Max Length: the maximum length from the ROA
  • Origin AS: the AS allowed to announce it

Viewing BGP routes with RPKI validation

# BGP таблица с RPKI статусом
show bgp ipv4 unicast

Example output:

   Network          Next Hop            Metric LocPrf Weight Path  RPKI
*> 1.1.1.0/24       203.0.113.1              0             0 174 13335 V
*  8.8.8.0/24       203.0.113.1              0             0 174 15169 ?
*  185.230.63.0/24  198.51.100.1             0             0 1299 64512 I

RPKI states:

  • V (Valid): the prefix is valid
  • I (Invalid): the prefix is invalid
  • ? (Not Found): no ROA was found

Detailed information about a prefix

# Детали BGP маршрута с RPKI
show bgp ipv4 unicast 1.1.1.0/24

Example output:

BGP routing table entry for 1.1.1.0/24
Paths: (2 available, best #1, table default)
  Advertised to non peer-group peers:
  203.0.113.1
  174 13335
    203.0.113.1 from 203.0.113.1 (203.0.113.1)
      Origin IGP, metric 0, localpref 100, valid, external, best
      Community: 174:21000 174:22013
      RPKI validation state: Valid
      Last update: Mon Oct 15 10:30:45 2025

Checking a specific prefix in RPKI

# Проверка есть ли ROA для префикса
show rpki prefix 203.0.113.0/24 65001

Example output:

Prefix: 203.0.113.0/24
Origin AS: 65001
Prefix Length: 24
Max Length: 24
RPKI Status: Valid

RPKI statistics

# Общая статистика RPKI
show rpki cache-connection

Example output:

Cache Servers: 3
Connected: 2
Disconnected: 1
Total Prefixes: 180234
IPv4 Prefixes: 150234
IPv6 Prefixes: 30000

Troubleshooting

Problem 1: Cache server unavailable

Symptoms:

show rpki cache-server
# State: Error

Solutions:

  1. Check network connectivity:
# Ping cache server
ping rtr.rpki.cloudflare.com

# Telnet к RTR порту
telnet rtr.rpki.cloudflare.com 8282
  1. Check the firewall:
# Разрешение исходящих соединений к RTR портам
set firewall ipv4 output filter rule 100 action accept
set firewall ipv4 output filter rule 100 destination port 323,8282,8323
set firewall ipv4 output filter rule 100 protocol tcp
commit
  1. Switch to another cache:
# Изменение preference
set protocols rpki cache ntt preference 1
set protocols rpki cache cloudflare preference 2
commit
  1. Check DNS:
# Убедитесь, что DNS работает
nslookup rtr.rpki.cloudflare.com

# Можно использовать IP адрес напрямую
set protocols rpki cache cloudflare address 104.26.2.23
commit

Problem 2: Empty prefix table

Symptoms:

show rpki prefix-table
# Empty output или очень мало записей

Solutions:

  1. Check the cache server connection:
show rpki cache-server
# Должен быть State: Connected и Records > 0
  1. Manual synchronization:
# Сброс и повторное подключение
configure
delete protocols rpki cache cloudflare
commit

set protocols rpki cache cloudflare address rtr.rpki.cloudflare.com
set protocols rpki cache cloudflare port 8282
set protocols rpki cache cloudflare preference 1
commit
  1. Check the logs:
show log | match rpki
show log | match RPKI

Problem 3: Valid routes shown as Invalid

Symptoms:

show bgp ipv4 unicast 203.0.113.0/24
# RPKI validation state: Invalid

Possible causes:

  1. The ROA is configured incorrectly:
# Проверка ROA в RPKI prefix table
show rpki prefix-table | match 203.0.113

# Если ROA показывает другую AS или max-length слишком мал
# Необходимо исправить ROA в RIR портале
  1. The BGP announcement comes from the wrong AS:
# Проверка origin AS в BGP
show bgp ipv4 unicast 203.0.113.0/24

# Убедитесь, что origin AS совпадает с ROA
  1. The prefix is too specific:
# Проверка max-length
show rpki prefix-table | match 203.0.113

# Если ROA: 203.0.113.0/24 max-length 24
# А BGP анонс: 203.0.113.0/25
# Это будет Invalid - нужно увеличить max-length в ROA

Problem 4: The route-map is not applied

Symptoms:

# Invalid routes все еще принимаются
show bgp ipv4 unicast | match " I"
# Показывает invalid маршруты в таблице

Solutions:

  1. Check that the route-map is applied:
show configuration protocols bgp neighbor 203.0.113.1
# Должно быть: route-map import RPKI-IN
  1. Check the route-map configuration:
show policy route-map RPKI-IN

# Убедитесь, что:
# - match rpki invalid действие deny
# - или set local-preference низкий
  1. Soft reset of the BGP session:
# После изменения route-map
clear bgp ipv4 unicast 203.0.113.1 soft in
  1. Check the order of the rules:
# Убедитесь, что deny invalid идет ПЕРЕД permit all
# Пример неправильно:
# rule 10 action permit (примет все)
# rule 20 action deny match rpki invalid (никогда не достигнется)

# Правильно:
# rule 10 action deny match rpki invalid
# rule 20 action permit match rpki valid

Problem 5: High CPU usage from RPKI

Symptoms:

show system cpu
# High CPU usage from frr процессов

Solutions:

  1. Increase the polling interval:
set protocols rpki cache cloudflare polling-period 7200
commit
  1. Reduce the number of cache servers:
# Используйте только 1-2 cache servers вместо 3+
delete protocols rpki cache ripe
commit
  1. Optimize the route-map:
# Используйте более простые route-maps
# Избегайте сложных community operations на каждом префиксе

Best practices

1. Use multiple cache servers

# Минимум 2 cache servers для redundancy
set protocols rpki cache primary address rtr.rpki.cloudflare.com
set protocols rpki cache primary port 8282
set protocols rpki cache primary preference 1

set protocols rpki cache secondary address rpki.gin.ntt.net
set protocols rpki cache secondary port 323
set protocols rpki cache secondary preference 2

Reasons:

  • Protection against the failure of a single validator
  • Different validators may have data of different freshness
  • Geographic distribution

2. Start with a soft policy

# Первый этап: только мониторинг, не блокировать
set policy route-map RPKI-MONITOR rule 10 action permit
set policy route-map RPKI-MONITOR rule 10 match rpki invalid
set policy route-map RPKI-MONITOR rule 10 set local-preference 50
set policy route-map RPKI-MONITOR rule 10 set community '65001:666' additive

# Второй этап (после недели мониторинга): блокировка
set policy route-map RPKI-STRICT rule 10 action deny
set policy route-map RPKI-STRICT rule 10 match rpki invalid

Reasons:

  • ROAs may be configured incorrectly
  • You can break legitimate connectivity
  • Time is needed to identify false positives

3. Logging and monitoring

# Логирование RPKI событий
set system syslog file rpki.log facility protocols level info

# Мониторинг invalid routes
# Создать скрипт для алертинга при обнаружении invalid routes

4. Document your ROAs

Keep documentation of your ROAs:

Prefix: 203.0.113.0/24
Max Length: 24
Origin AS: 65001
Created: 2025-10-15
Purpose: Main network block
Contact: netops@example.com

5. Review your ROAs regularly

# Еженедельная проверка
show rpki prefix-table | match "AS65001"

# Сверка с документацией
# Убедитесь, что все ROA актуальны

6. Coordinate with peers

Inform your BGP peers about your RPKI policy:

Subject: RPKI Validation Policy

We are implementing RPKI validation on our BGP routers.
Invalid routes will be rejected starting [DATE].

Please ensure your ROAs are configured correctly:
- Check at https://rpki-validator.ripe.net/
- Validate at https://www.ripe.net/manage-ips-and-asns/resource-management/rpki/tools-and-resources

Contact: noc@example.com

7. Using RPKI for outbound announcements

Make sure your own ROAs are configured correctly:

# Проверка собственных префиксов
show rpki prefix 203.0.113.0/24 65001

# Должно быть Valid

Online verification:

8. Max Length in a ROA

Recommendations:

  • For /24: max-length 24 (you do not announce more-specifics)
  • For larger blocks: be careful with max-length
Пример:
Prefix: 203.0.113.0/22
Max Length: 24

Позволяет анонсировать:
- 203.0.113.0/22 (aggregate)
- 203.0.113.0/23, 203.0.112.0/23 (subdivision)
- 203.0.113.0/24 (more specific)

Не позволяет:
- 203.0.113.0/25 (too specific)

Warning: Do not set max-length too large (for example, /32); this weakens the protection.

9. Policy for not-found routes

# Вариант 1: Принимать, но с меньшим preference
set policy route-map RPKI-IN rule 30 action permit
set policy route-map RPKI-IN rule 30 match rpki notfound
set policy route-map RPKI-IN rule 30 set local-preference 100

# Вариант 2: Принимать нормально (многие префиксы еще не имеют ROA)
set policy route-map RPKI-IN rule 30 action permit
set policy route-map RPKI-IN rule 30 match rpki notfound

Recommendation: As of 2025, about 40% of the internet is covered by ROAs. Blocking not-found routes would break a large part of the internet.

10. Testing RPKI

# Создание тестового BGP peer для проверки
set protocols bgp neighbor 192.0.2.99 remote-as 65099
set protocols bgp neighbor 192.0.2.99 description 'RPKI Test Peer'
set protocols bgp neighbor 192.0.2.99 address-family ipv4-unicast route-map import RPKI-TEST

# Проверка с известными invalid префиксами
# Например, специально создать тестовый ROA и проверить

RPKI security

Protecting the RTR connection

# Использование SSH для RTR (если validator поддерживает)
set protocols rpki cache secure address validator.example.com
set protocols rpki cache secure port 22
set protocols rpki cache secure ssh username rpki-user
set protocols rpki cache secure ssh private-key-file /config/auth/rpki.key

Firewall for RTR

# Разрешение только к известным validators
set firewall group address-group RPKI-VALIDATORS address 104.26.2.23
set firewall group address-group RPKI-VALIDATORS address 104.26.3.23

set firewall ipv4 output filter rule 100 action accept
set firewall ipv4 output filter rule 100 destination group address-group RPKI-VALIDATORS
set firewall ipv4 output filter rule 100 destination port 8282
set firewall ipv4 output filter rule 100 protocol tcp

Data integrity verification

RPKI validators verify the cryptographic signatures of ROAs, ensuring:

  • Authenticity of the ROA from the resource owner
  • Data integrity (the data has not been altered)
  • Non-repudiation (the ROA has not been revoked)

VyOS trusts the validator to perform these checks.

RPKI adoption statistics

Global coverage (2025)

  • IPv4 ROA coverage: ~45% of announced prefixes
  • IPv6 ROA coverage: ~50% of announced prefixes
  • Top AS with ROAs: Google, Cloudflare, Amazon, Microsoft, Akamai

Regional differences

  • Europe: ~55% (thanks to RIPE NCC initiatives)
  • North America: ~40%
  • Asia-Pacific region: ~35%
  • Latin America: ~30%
  • Africa: ~25%

Useful resources for monitoring

Conclusion

RPKI is a critical security component of the modern internet. A correct RPKI implementation on VyOS lets you:

  1. Protect against BGP hijacking - prevent unauthorized announcements of your prefixes
  2. Validate incoming routes - reduce the risk of route hijacking from other AS
  3. Improve global routing security - contribute to the security of the internet
  4. Comply with best practices - many large networks require RPKI from their peers

Key recommendations

  • Create ROAs for all of your prefixes at your RIR
  • Connect to several public RPKI validators
  • Start with a soft policy (lowering preference), then move to a strict one (deny)
  • Monitor RPKI validation states
  • Coordinate with BGP peers on RPKI policies
  • Regularly review and update your ROAs

Future developments

RPKI continues to evolve:

  • ASPA (Autonomous System Provider Authorization) - protection against route leaks
  • BGPsec - full cryptographic protection of the BGP path
  • ROV (Route Origin Validation) improvements

Additional resources

Change history

DateVersionChanges
2025-10-151.0Initial version of the documentation

Note: This documentation is current for VyOS versions 1.3.x, 1.4.x, and 1.5.x. Always check the official VyOS documentation for your specific version. RPKI support is based on FRRouting 7.5+.

Reviewed by OpenNix LLC · Last updated on
RIP - Routing Information ProtocolBGP (Border Gateway Protocol)