<div dir="auto"><div>Glad that helped, Alex.<div dir="auto"><br></div><div dir="auto">The recent thread today about Telstra announcing /24s out of someone else's IP space is a perfect example of this in action (if Telstra was making those announcements outside their own network). </div><div dir="auto"><br></div><div dir="auto">If the provider originating those blocks had created ROA records (I checked, and they had not), it would have reduced the damage. </div><div dir="auto"><br></div><div dir="auto">Randy</div><div dir="auto"><br></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Tue, Sep 29, 2020, 6:15 PM Alex Samad <<a href="mailto:alex@samad.com.au">alex@samad.com.au</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr">Hi Randy<div><br></div><div>awesome, that's what i wanted to know/confirm. I'm the originator.</div><div><br></div><div>Thanks</div><div><br></div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Wed, 30 Sep 2020 at 01:18, Randy Cassidy <<a href="mailto:randy.cassidy@iracing.com" target="_blank" rel="noreferrer">randy.cassidy@iracing.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div dir="ltr"><div dir="ltr">Hi Alex,<div><br></div><div>The ROA is something you create/sign via your regional registry (APNIC in your case, ARIN for me). There's nothing you configure on your own routers as far as announcing your (signed or unsigned) prefixes to your Transit providers. The ROA basically says "it is valid for the following AS number to <b>originate </b>the announcement of the following (IP/prefix_length/max_prefix_length) list. Networks that implement RPKI use "out of band" mechanisms to perform the validation of the routes they receive via BGP.</div><div><br></div><div>For example, if you owned <a href="http://10.11.0.0/16" target="_blank" rel="noreferrer">10.11.0.0/16</a>, and your AS number was 65432, your ROA might say "65432 is allowed to announce <a href="http://10.11.0.0/16" target="_blank" rel="noreferrer">10.11.0.0/16</a>". You must also specify the "max prefix length". I'm fuzzy on this, but I believe the reason is to prevent other networks from accidentally leaking internally dis-aggregated blocks of your routes to the outside world. Since "longer prefix wins", they could accidentally (or intentionally) force all your inbound traffic to flow through them. So if you know that you'll never announce blocks of your /16 IP space with a prefix length greater than /20, you'd specify 20 as the max prefix length in your ROA. If some other network has internally split you down into /24's, and then leaked those, any other networks that have implemented route origin validation would reject them, as they're more specific than you allow.</div><div><br></div><div><div>This is for ARIN, but the fields in each ROA should be the same for APNIC.</div><div><a href="https://www.arin.net/resources/manage/rpki/roa_request/" target="_blank" rel="noreferrer">https://www.arin.net/resources/manage/rpki/roa_request/</a><br></div><div><br></div><div>I hope that explanation helps!</div><div><br></div><div>Randy</div></div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Tue, Sep 29, 2020 at 10:16 AM Alex Samad <<a href="mailto:alex@samad.com.au" target="_blank" rel="noreferrer">alex@samad.com.au</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div dir="ltr">Hi<div><br></div><div>I'll answer the last.</div><div><br></div><div>So if I am the origin and I use multiple transit providers. Don't I have to sign mine. So I get i have to go to myapnic and setup a ROA. but don't i have to sign my prefix (sorry, i'm new to this), before send this up stream. Isn't the verification done by checking the signatures of all of the AS.</div><div><br></div><div><br></div><div>ROS 7 - yes buggy a ... been waiting for multhread bgp for ...... I like the platform, but i have given up on them..</div><div><br></div><div>Thanks for all of the replies</div><div><br></div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Tue, 29 Sep 2020 at 19:28, Aftab Siddiqui <<a href="mailto:aftab.siddiqui@gmail.com" target="_blank" rel="noreferrer">aftab.siddiqui@gmail.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div dir="ltr">Hi Alex,<div>If you are not doing ROV (Route Origin Validation) then you don't have to do anything on your end. Great to hear that Exetel is planning to do validation but that means you have to create ROAs (Route Origin Authorization) on myapnic portal, if you don't have them already.</div><div><br></div><div><div><div dir="ltr">Regards,<br><br>Aftab A. Siddiqui</div></div><br></div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Tue, 29 Sep 2020 at 18:46, Alex Samad <<a href="mailto:alex@samad.com.au" target="_blank" rel="noreferrer">alex@samad.com.au</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div dir="ltr">Hi<div><br></div><div>Wondering how prevalent is RPKI in transit providers in Oz. Just got an email from exetel to say they are starting a rollout of it.</div><div><br></div><div>Seems like my ROS routers don't have it, seems like they have been talking about back in 2014, still waiting on that feature to be added.</div><div><br></div><div>Curious if all of my transit providers are going to come knocking and asking for me to turn this on ?</div><div><br></div><div>Plus some quick googling seems to suggest its currently flawed..</div><div><br></div><div>Thanks</div><div>Alex</div></div>
_______________________________________________<br>
AusNOG mailing list<br>
<a href="mailto:AusNOG@lists.ausnog.net" target="_blank" rel="noreferrer">AusNOG@lists.ausnog.net</a><br>
<a href="http://lists.ausnog.net/mailman/listinfo/ausnog" rel="noreferrer noreferrer" target="_blank">http://lists.ausnog.net/mailman/listinfo/ausnog</a><br>
</blockquote></div>
</blockquote></div>
_______________________________________________<br>
AusNOG mailing list<br>
<a href="mailto:AusNOG@lists.ausnog.net" target="_blank" rel="noreferrer">AusNOG@lists.ausnog.net</a><br>
<a href="http://lists.ausnog.net/mailman/listinfo/ausnog" rel="noreferrer noreferrer" target="_blank">http://lists.ausnog.net/mailman/listinfo/ausnog</a><br>
</blockquote></div></div>
</blockquote></div>
</blockquote></div></div></div>