# RPKI on IOS-XE (Validation)

Load **ios-xe.rpki.enable.init.cfg**

```
#IOS-XE (R1, R2, R3)
config replace flash:ios-xe.rpki.enable.init.cfg
```

<figure><img src="https://3072390383-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FkUz2C3GqnZcWhoVL6jfk%2Fuploads%2FCJcBVCqUXcMigZwUymTV%2Fimage.png?alt=media&#x26;token=2d2c5682-68b7-4137-a5bf-99d333be64bb" alt=""><figcaption></figcaption></figure>



BGP is already setup between R1-R2 and R2-R3. Configure RPKI on R2 for both IPv4 and IPv6. Reject invalid IPv4 prefixes, but allow invalid IPv6 prefixes.



The RPKI server is reachable at 10.100.100.1 on port 3323.











































## Answer <a href="#id-858cbd68-d189-4d18-bf87-874c96a898ad" id="id-858cbd68-d189-4d18-bf87-874c96a898ad"></a>

```
#R2
router bgp 1245
 bgp rpki server tcp 10.100.100.1 port 3323 refresh 600
 !
 add ipv6
  bgp bestpath prefix-validate allow-invalid
```



## Explanation/Verification <a href="#id-546edd96-2f3a-459e-8011-94037bf12e6b" id="id-546edd96-2f3a-459e-8011-94037bf12e6b"></a>

In the previous lab, we enabled RPKI and disabled prefix validation using **bgp bestpath prefix-validate disable**. This lab asks us to verfiy prefix validation, but allow IPv6 invalid prefixes as part of the bestpath process. To do this, we use **bgp bestpath prefix-validate allow-invalid** under IPv6/unicast.

```
#R2
router bgp 1245
 add ipv6
  bgp bestpath prefix-validate allow-invalid
```



Examine the BGP ipv6/unicast table first. Notice that we see prefixes as V, I, or N. Invalid prefixes (I) are still eligible for being selected as the best path.

<div align="left"><figure><img src="https://3072390383-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FkUz2C3GqnZcWhoVL6jfk%2Fuploads%2Fw5wNpCyKqB2HD0Lm0jJm%2Fimage.png?alt=media&#x26;token=1dcf24d6-0460-47e1-b802-75ee84164c85" alt=""><figcaption></figcaption></figure></div>



Examine IPv4/unicast and notice that the invalid prefixes are rejected. These are not routable at all now. Notice that the prefixes that did not have any ROAs (1.100.100.0/24) are still accepted.

<div align="left"><figure><img src="https://3072390383-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FkUz2C3GqnZcWhoVL6jfk%2Fuploads%2FP4EISsS2VfMtb2pWFaWX%2Fimage.png?alt=media&#x26;token=92782b37-7024-4aeb-b189-7182e43237ef" alt=""><figcaption></figcaption></figure></div>
