• 1

ASO Support in AFRINIC RPKI

If you are an IXP - this might be of interest to you. Usually, it is considered bad practice to allow your Peering LAN prefixes to be announced/re-distributed by your peers. One way to prevent this to happen is to create an AS0 ROA (see figure 1) with your Peering LAN prefix. AFRINIC highly recommends that African IXPs create this “special” ROA through the MyAFRINIC RPKI interface. Hint: It is important to keep the max-length equal to your prefix length to allow for more specifics. 

Screen Shot 2019 07 23 at 12.55.54

Figure 1. Create an AS0 ROA on MyAFRINIC

 

On the other hand, if you are an operator, you should not be announcing Peering LAN prefixes of any IXP that you are connected to and you should reject those prefixes both on your ingress and egress EBGP policies, especially it these prefixes are tagged with a “no-export” attribute. Peering LAN should be considered as a link-local address range and should not be redistributed externally. 

Screen Shot 2019 07 23 at 13.07.25

Figure 2. Example of Invalid announcement by the RIPE Validator

 

We encourage IXPs and operators to build filters based on both IRRdb and RPKI (origin validation). BGP announcements are validated by the RPKI Validators, prefixes with ROA status “INVALID” should be filtered out (see figure 2). AFRINIC also operates an Internet Routing Registry (IRR) and members are encouraged to document their routing policies on the routing registry.

 

More details about the use of AS0 in ROAs can be found here:

https://www.internetsociety.org/blog/2019/02/apnic-enhances-support-for-routing-security/

© 2017 AFRINIC. All Rights Reserved. Designed By AFRINIC