RPKI on IOS-XR (Validation)

Load ios-xr.rpki.enable.init.cfg

#IOS-XE (R6)
config replace flash:ios-xr.rpki.enable.init.cfg

#IOS-XR (XR1, XR2)
configure
load bootflash:ios-xr.rpki.enable.init.cfg
commit replace
y

BGP is already setup between XR5-R6 and XR5-XR2.

Configure RPKI on XR5 for both IPv4 and IPv6. Reject invalid paths for IPv4/unicast, but allow invalid paths for IPv6/unicast.

The RPKI server is reachable at 10.100.100.1 on port 22. Use SSH as the transport. Use rpki/rpki as the credentials.

Answer

#XR1
router bgp 1245
 rpki server 10.100.100.1
  transport ssh port 22
  username rpki
  password rpki
 !
 add ipv4 unicast
  bgp origin-as validation enable
  bgp bestpath origin-as use validity
 add ipv6 unicast
  bgp origin-as validation enable
  bgp bestpath origin-as use validity
  bgp bestpath origin-as allow invalid

Explanation

There are essentially three main AFI commands for BGP RPKI origin validation. Luckily they are each fairly self-explanatory.

• bgp origin-as validation enable

  • This enables the validation of the origin AS using an RPKI server. On IOS-XE, this is on by default. On IOS-XR, you must explicitly enable this per AFI.

• bgp bestpath origin-as use validity

  • This enables the filtering of invalid prefixes, and preference of valid prefixes over not-found prefixes. This is also on by default on IOS-XE when you connect to an RPKI server. On IOS-XR, this allows you to separately enable validation and the “action” of filtering/prefering based on validation.

  • On IOS-XE, you can disable bestpath decisions based on the validation using bgp bestpath prefix-validate disable

• bgp bestpath origin-as allow invalid

  • This allows invalid prefixes. This might be used if you want to slowly introduce RPKI path origination validation into your network. You can still prefer valid paths over invalid/not-found paths, but you won’t break any paths that are specifically invalid.

  • However, in general, it should be completely safe to filter out invalid prefixes. This means there is an ROA for this prefix, and the originating AS is not the listed AS. If someone just hasn’t generated an ROA for their prefix, it will be “not-found” instead of “invalid.”

  • On IOS-XE, you use the command bgp bestpath prefix-validate allow-invalid

Verification

Examine the IPv4/unicast table and notice that 1.0.0.0/24 no longer has a bestpath.

If we use origin-as validity we can more clearly see which paths are valid/invalid/not-found. Invalid prefixes are not available for bestpath consideration. Not-found prefixes are available.

Examine the IPv6/unicast table. Invalid prefixes have been allowed, but valid prefixes are preferred over invalid prefixes.

We can explicitly see that valid prefixes are preferred over invalid prefixes using show bgp … bestpath-compare

Further Reading

https://beufa.net/blog/rpki-use-routinator-rtr-cache-validator-cisco-ios-xr/