RPKI ROA for IP resources in the IX segment

Resource Public Key Infrastructure (RPKI) has become a popular infrastructure for the certification of assigned and allocated IP address and Autonomous System Number (ASN) resources. If you are a resource delegate, or network operator and actively configuring Border Gateway Protocol (BGP) in the ISP and content delivery spaces, you might have already registered Route Origin Authorizations (ROAs) and deployed BGP route filters based on RPKI-based checks called RPKI Route Origin Validation (ROV).

Internet Exchange Points (IXPs) operate their own assigned and allocated networks; we call this the ‘IX segment’. The IX segment is an important network as a peering platform. Every participant in the IX is assigned IP addresses on this IX segment and uses them to connect to each other over the IX fabric (the switching layers, be they on copper or fibre). Because there are many eBGP sessions between ASes used for exchanging their traffic, it’s important that this segment is protected from mis-origination of BGP from the peerings operated in this IX (Figure 1).

I surveyed the status of RPKI ROA registration for IXPs operating in the Asia Pacific region and several IXPs in the European region on 17 February 2023. My first impression is that both regions lack a sense of unity, with RPKI ROA registration being inconsistent.

The survey revealed that there are clearly two types of IXPs — one has registered ROAs, and the other hasn’t (yet). Perhaps this divide is because issuing ROAs for IP resources in the IX segment is a relatively new thing. But among IXPs that have already registered ROAs, there are also some notable differences in the status of registration. As Tables 1 and 2 show, one point of difference is the registered prefix size inside the ROA (exact match and longest prefix match), and another difference is the ASN used for ROA registration.

Table 1 — RPKI ROA Survey (IPv4).

Table 2 — RPKI ROA Survey (IPv6).

Both IPv6 and IPv4 share similar results within IXPs.

Types of ROA registration

The types of ROA registration can be classified into three groups.

1. ROA prefix size: There are two types — exactly matching size and larger size. A larger size means that an IXP operates a /24 IX network but has a /23 prefix assigned or allocated, and registered in their RPKI ROA.
2. ROA maximum prefix length: This also has two types — one of these has equal length, and the other has a maximum prefix size longer than the prefix size.
3. ASN used for ROA registration: Again there are two types — one type is using AS 0, and another is using your own ASN.

The use of AS 0 in RPKI is described in RFC 6483 which defines the semantics, in general, of ROAs. An important point to note is that prefixes registered with AS 0 in an RPKI ROA should not be used in a routing context without a more specific ROA which denotes the origin-as other than AS0. In other words, you should use AS 0 as the ASN for a prefix that isn’t to be seen on the global routing table when registering ROAs. So, If an IXP has created an RPKI ROA for the IX segment, the RPKI ROA of the IX segment can be checked by ISPs using RPKI ROV, thereby preventing trouble due to mis-origination advertisement because mis-originated routes will be seen as invalid and not received on ISP border routers as there will be no other ROA with another origin-as apart from AS0.

It is most important to issue ROAs with the correct prefix size, maximum prefix length, and ASN. If you have registered ROAs without these, the ROA will not prevent mis-origination if they specify prefix lengths that are not blocked by the ROA. Equally, manual route filter configuration is still necessary; don’t forget to keep your PeeringDB and Internet Routing Registry (IRR) entries up to date.

As this survey has shown, a wide variety of RPKI ROAs have been issued in the IXP segment but we can suggest two best practices — properly issue ROAs with AS 0 and the correct maximum length (for both IPv4 and IPv6), and if your IXP has already issued ROAs, please check whether it has AS 0 and the correct maximum length.

Correctly issuing ROAs help to secure global Internet routing. It’s time for the IX segment to do it properly.

Masataka presented this during the APRICOT 2023 Peering Forum 3. Watch the session now:

Masataka Mawatari is an engineer at JPIX in charge of IX network operations, route servers, and IPv6 deployment. He contributes to JANOG and the other network engineer communities.

Rate this article

---

The views expressed by the authors of this blog are their own and do not necessarily reflect the views of APNIC. Please note a Code of Conduct applies to this blog.