RPKI and route origin validation
RPKI is the system that lets a network check whether the AS announcing a prefix is allowed to. Enough of the internet now enforces it that ignoring it has consequences.
The problem it solves
BGP has no built-in way to tell a legitimate announcement from a false one. For decades, a network that announced someone else's prefix — by mistake or deliberately — could pull their traffic towards itself. Several famous outages and more than one theft worked exactly that way.
RPKI adds cryptographic proof: the address holder publishes a Route Origin Authorisation saying which AS number may originate the prefix, and up to what length. Networks validate announcements against those records and drop the ones that fail.
What happens without a ROA
Your prefix is NotFound rather than Invalid, so it is usually still accepted. But you lose the protection: anyone announcing your space is as credible as you are. And an increasing number of large networks treat unsigned space with less preference.
What is genuinely dangerous is a wrong ROA, because Invalid is dropped outright by every validating network. A ROA with the wrong maximum length is the most common way people make part of the internet unable to reach them, and it is a confusing outage because most of the internet still works fine.
Creating one
In our region, through the RIPE NCC portal: open the RPKI section, create a ROA for your prefix with your AS number as origin, and set the maximum length carefully.
- Max length equals your prefix length if you announce the whole
block as one. A
/22announced as a/22gets max length 22. - Larger max length only if you really deannounce more specifics. Setting max length 24 on a /22 you never split lets an attacker announce a /24 inside it and be valid.
- One ROA per origin AS. If two of your AS numbers announce the same space, both need authorising.
Publication takes effect within hours, not minutes. Create the ROA before you change an announcement, never after.
Checking your work
Validate from outside before you trust it. The RIPE NCC's validator and several public looking glasses will tell you whether your prefix reads as Valid, Invalid or NotFound from a validating network's point of view.
If you suddenly become unreachable from parts of the internet after a routing change, this is the first thing to check. The symptom — fine from most places, completely unreachable from some — is characteristic.
What we do
We validate. Announcements that fail origin validation are rejected, including yours, which is the point of the system. When you run a BGP session with us, valid ROAs for everything you intend to announce are part of what we need before the session comes up, alongside route objects in a recognised registry.
If you hold space that we announce on your behalf — see bring your own IP space — tell us the AS number to put in the ROA. Usually that is ours, and we will tell you exactly what to create.
What RPKI does not do
It validates the origin of an announcement, not the path it took. A network in the middle can still do things it should not. Path validation is a separate and much less deployed problem. RPKI is a floor, not a ceiling — but it is a floor worth standing on, and creating a ROA is twenty minutes of work once.
Still stuck? Mail support@novogara.com — an engineer answers, at any hour. Back to the knowledge base