RPKI – Suboptimal Path Selection

What is RPKI?

Resource Public Key Infrastructure, abbreviated as RPKI is security layer that provides security for Internet’s BGP routing infrastructure. It is also known as Resource Certification and is based on public key infrastructure (PKI) framework. It provides additional security and reliability to BGP.

In this article, we will discuss a special case in which:

Advertisements

“Customer is receiving full internet routing table from both the ISP 1 and 2 and running ibgp between the routers R1 and R2.” 

Problem Statement: When rpki on the router most of the routes status is not found as per rpki server and rpki status is not found for external route but iBGP route status for rpki is valid which should not happen.

 

Before enabling RPKI:

R1 #sh bgp ipv4 uni 192.168.0.0/24

BGP routing table entry for 192.168.0.0/24, version 800

Paths: (2 available, best #2, table default)

Advertised to update-groups:  4

Refresh Epoch 8

65001 65002 65003

172.16.1.1 (metric 130816) from 172.16.1.1 (172.16.1.1)

Origin incomplete, metric 2021, localpref 100, valid, internal

Community: 11421164 11466274

rx pathid: 0, tx pathid: 0

Refresh Epoch 1

65101 65102 65103

80.255.245.162 from 80.255.245.162 (217.21.244.112)

Origin incomplete, metric 100, localpref 100, valid, external,

best (eBGP neighbor is the best preferred BGP path)

Community: 1892548908 1892553008

rx pathid: 0, tx pathid: 0x0

After enabling RPKI:

R1#sh bgp ipv4 uni 192.168.0.0/24

BGP routing table entry for 192.168.0.0/24, version 8864984

Paths: (2 available, best #1, table default)

Not advertised to any peer

Refresh Epoch 8

65001 65002 65003

172.16.1.1 (metric 130816) from 172.16.1.1 (172.16.1.1)

Origin incomplete, metric 2021, localpref 100, valid, internal,

best (iBGP neighbor is the best preferred BGP path)

Community: 11424364 11425274

path 56702994 RPKI State valid (This should not be found)

rx pathid: 0, tx pathid: 0x0

Refresh Epoch 1

65101 65102 65103

80.255.245.162 from 80.255.245.162 (217.21.244.112)

Origin incomplete, metric 100, localpref 100, valid, external

Community: 1892548908 1892553008

path 5FDC6970 RPKI State not found 

rx pathid: 0, tx pathid: 0

Due to this, the customer device starts to prefer iBGP routes instead of eBGP routes causing sub optimal routing in the network.

Internally and locally sourced paths aren’t subject to validation.  The assumption is that you trust your own equipment. You can use the ‘neighbor x.x.x.x announce rpki state’ config to ensure that your routers communicate validation status to each other.

 

Continue Reading:

iBGP vs eBGP – Know the difference between iBGP & eBGP

Sample configuration for eBGP and iBGP

Advertisements

Related Posts

About The Author

Add Comment

Social Media Auto Publish Powered By : XYZScripts.com
Select your currency
USD United States (US) dollar