<div dir="ltr"><div>You can look up any entries. So maybe go look at what others do.</div><div><br></div><div>For example, we do use maxlength 24 even on <a href="http://3.0.0.0/10">3.0.0.0/10</a>. <a href="https://rpki-validator.ripe.net/ui/3.0.0.0%2F10/16509">https://rpki-validator.ripe.net/ui/3.0.0.0%2F10/16509</a></div><div>We do have automated things that will announce more specifics if there is a hijack, so we do want that in place. That may not be what everyone does, but is e.g. a counterpoint to how it can be done.<br></div><div><br></div><div dir="ltr"><br></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Thu, May 23, 2024 at 4:09 PM Joseph Goldman <<a href="mailto:joseph@goldman.id.au">joseph@goldman.id.au</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div class="msg2866420278693809412"><div><div>Hi Phil,</div><div><br></div><div> Thanks - I 100% understand the point of best practice of not using maxLength and the potential for hijacking, what im most worried about is the statement i've been told about 'unused' ROAs affecting used ROAs, which just seems counter-intuitive to me, in terms of (as per the example given) having ROAs ready for failover or TE purposes.</div><div><br></div><div> This is the RFC im referring to:<br><br><a href="https://datatracker.ietf.org/doc/html/rfc9319" target="_blank">https://datatracker.ietf.org/doc/html/rfc9319</a></div><div><br></div><div>Specifically 5.1 which indicates having dormant ROAs available for use, but I am being told having any dormant ROAs is grounds for all routes to be marked invalid based on stricter validators, which is the answer im trying to ascertain right now.</div><div><br></div><div>In a failover sense, say for example I am advertising /22 out of my Brisbane POP and some /24's out of my Sydney POP, my Sydney POP goes down and im no longer originating those /24's, by what i've been told my /22 would now become invalid on next check as my /24's are not being advertised, even though I have ROAs for the /22 and /24's.</div><div><br></div><div> I believe i've been given somewhat wrong information but they were basing it off experiences with other APNIC members, I just dont want to end up in a position where our routes are dropped after implementing our ROAs, and maintain flexibility to not wait multiple hours before we can advertise a new prefix if required.</div><div><br></div><div>Thanks,</div><div>Joe</div>
<div><br></div>
<div>------ Original Message ------</div>
<div>From: "Phil Mawson" <<a href="mailto:phil.mawson@gmail.com" target="_blank">phil.mawson@gmail.com</a>></div>
<div>To: "Joseph Goldman" <<a href="mailto:joseph@goldman.id.au" target="_blank">joseph@goldman.id.au</a>></div>
<div>Cc: "<a href="mailto:ausnog@lists.ausnog.net" target="_blank">ausnog@lists.ausnog.net</a>" <<a href="mailto:ausnog@lists.ausnog.net" target="_blank">ausnog@lists.ausnog.net</a>></div>
<div>Sent: 23/05/2024 3:52:54 PM</div>
<div>Subject: Re: [AusNOG] Experiences with RPKI</div><div><br></div>
<div id="m_2866420278693809412x1cbc59d719684ff"><blockquote cite="http://C4B935EE-F962-4364-B8B4-9D92BD8EB489@gmail.com" type="cite" class="m_2866420278693809412cite2">
Hi Joe,<div><br></div><div>First up, well done on working on your RPKI roll out. Signing your own routes is the most important step you can take to protect your own network.</div><div><br></div><div>In regards to using max length, I do advise against that as what it means someone can still hijack one of your un-advertised routes and it would be treated as real.</div><div><br></div><div>IE: If you advertise and sign a /19, but have a ROA created for each route up to a /24. If you are not advertising all of those, a third party could advertise one of our /24s and spoof your ASN and it would be treated as valid on the internet.</div><div><br></div><div>APNIC portal make it very easy to create ROAs for your own routes as it has the route table view so it can see what is already publicly advertise. I recommend looking at that and then signing routes based on that. </div><div><br></div><div>DDoS mitigation providers and ROAs is an interesting topic and not sure the community can agree on what is the best technical solution for that.</div><div><br></div><div>Regards,</div><div>Phil</div><div><br></div><div><div><br><blockquote type="cite" class="m_2866420278693809412cite"><div>On 23 May 2024, at 3:46 PM, Joseph Goldman <<a href="mailto:joseph@goldman.id.au" target="_blank">joseph@goldman.id.au</a>> wrote:</div><br><div>G'day list,<div style="font-family:"Segoe UI";font-size:16px;font-style:normal;font-variant-caps:normal;font-weight:400;letter-spacing:normal;text-align:start;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px;text-decoration:none"><br></div><div style="font-family:"Segoe UI";font-size:16px;font-style:normal;font-variant-caps:normal;font-weight:400;letter-spacing:normal;text-align:start;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px;text-decoration:none"> In the process of rolling out RPKI - and while I thought I had a good grasp on everything, there is one niggling piece of information that I've come against and can't verify. Was hoping people can share their experiences.</div><div style="font-family:"Segoe UI";font-size:16px;font-style:normal;font-variant-caps:normal;font-weight:400;letter-spacing:normal;text-align:start;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px;text-decoration:none"><br></div><div style="font-family:"Segoe UI";font-size:16px;font-style:normal;font-variant-caps:normal;font-weight:400;letter-spacing:normal;text-align:start;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px;text-decoration:none"> We are only doing our ROA's to begin with and not implementing validation until later, the initial thought was to create an ROA for all our 'supernets' and use maxLength to 24 to help cover any prefix we may want to advertise. We are a much simpler setup, single AS only and we do advertise many of our ranges down to /24 but not all of them. I do know of the best practices of not using maxLength based on a draft rfc doc, but I am personally not super concerned for our relatively small use-case to the issues brought up in that doc.</div><div style="font-family:"Segoe UI";font-size:16px;font-style:normal;font-variant-caps:normal;font-weight:400;letter-spacing:normal;text-align:start;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px;text-decoration:none"><br></div><div style="font-family:"Segoe UI";font-size:16px;font-style:normal;font-variant-caps:normal;font-weight:400;letter-spacing:normal;text-align:start;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px;text-decoration:none"> Where I have come into trouble is a source (APNIC helpdesk) indicating that if we have any ROAs that exist for prefixes we are not directly advertising - it may lend some validators to mark<span> </span><b>all<span> </span></b>our routes as invalid?</div><div style="font-family:"Segoe UI";font-size:16px;font-style:normal;font-variant-caps:normal;font-weight:400;letter-spacing:normal;text-align:start;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px;text-decoration:none"><br></div><div style="font-family:"Segoe UI";font-size:16px;font-style:normal;font-variant-caps:normal;font-weight:400;letter-spacing:normal;text-align:start;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px;text-decoration:none">i.e. say we had /22 ROA, 2x /23 ROAs and 4x /24 ROAs - are currently advertising the /22 and 2x /24's, so 2x /23's and 2x /24 ROAs are 'unused' in that we are not advertising those specific resources - would that cause issues with strict validators out in the wild?</div><div style="font-family:"Segoe UI";font-size:16px;font-style:normal;font-variant-caps:normal;font-weight:400;letter-spacing:normal;text-align:start;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px;text-decoration:none"><br></div><div style="font-family:"Segoe UI";font-size:16px;font-style:normal;font-variant-caps:normal;font-weight:400;letter-spacing:normal;text-align:start;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px;text-decoration:none"> My understanding reading through the RFC's is this should not be the case. If any ROA that matches the prefix for the origin AS exists it should be valid, regardless of other ROAs signed by the same resource holder etc.</div><div style="font-family:"Segoe UI";font-size:16px;font-style:normal;font-variant-caps:normal;font-weight:400;letter-spacing:normal;text-align:start;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px;text-decoration:none"><br></div><div style="font-family:"Segoe UI";font-size:16px;font-style:normal;font-variant-caps:normal;font-weight:400;letter-spacing:normal;text-align:start;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px;text-decoration:none"> Matching ROAs to exact advertisements is great, but it seems to lend itself to much less flexibility in traffic engineering and failover scenarios - a good scenario is having dormant /24 ROAs for say a DDoS mitigation service to use when needed, so you dont have to wait for RPKI propagation before scrubbing kicks in.</div><div style="font-family:"Segoe UI";font-size:16px;font-style:normal;font-variant-caps:normal;font-weight:400;letter-spacing:normal;text-align:start;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px;text-decoration:none"><br></div><div style="font-family:"Segoe UI";font-size:16px;font-style:normal;font-variant-caps:normal;font-weight:400;letter-spacing:normal;text-align:start;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px;text-decoration:none"> Based on your experience, is having all-encompassing (using maxLength), or unused ROAs an acceptable way to use RPKI or will we run into issues?</div><div style="font-family:"Segoe UI";font-size:16px;font-style:normal;font-variant-caps:normal;font-weight:400;letter-spacing:normal;text-align:start;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px;text-decoration:none"><br></div><div style="font-family:"Segoe UI";font-size:16px;font-style:normal;font-variant-caps:normal;font-weight:400;letter-spacing:normal;text-align:start;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px;text-decoration:none">All help appreciated :)</div><div style="font-family:"Segoe UI";font-size:16px;font-style:normal;font-variant-caps:normal;font-weight:400;letter-spacing:normal;text-align:start;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px;text-decoration:none"><br></div><div style="font-family:"Segoe UI";font-size:16px;font-style:normal;font-variant-caps:normal;font-weight:400;letter-spacing:normal;text-align:start;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px;text-decoration:none">Thanks,</div><div style="font-family:"Segoe UI";font-size:16px;font-style:normal;font-variant-caps:normal;font-weight:400;letter-spacing:normal;text-align:start;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px;text-decoration:none">Joe</div>_______________________________________________<br style="font-family:"Segoe UI";font-size:16px;font-style:normal;font-variant-caps:normal;font-weight:400;letter-spacing:normal;text-align:start;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px;text-decoration:none">AusNOG mailing list<br style="font-family:"Segoe UI";font-size:16px;font-style:normal;font-variant-caps:normal;font-weight:400;letter-spacing:normal;text-align:start;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px;text-decoration:none"><a href="mailto:AusNOG@lists.ausnog.net" style="font-family:"Segoe UI";font-size:16px;font-style:normal;font-variant-caps:normal;font-weight:400;letter-spacing:normal;text-align:start;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px" target="_blank">AusNOG@lists.ausnog.net</a><br style="font-family:"Segoe UI";font-size:16px;font-style:normal;font-variant-caps:normal;font-weight:400;letter-spacing:normal;text-align:start;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px;text-decoration:none"><a href="https://lists.ausnog.net/mailman/listinfo/ausnog" style="font-family:"Segoe UI";font-size:16px;font-style:normal;font-variant-caps:normal;font-weight:400;letter-spacing:normal;text-align:start;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px" target="_blank">https://lists.ausnog.net/mailman/listinfo/ausnog</a></div></blockquote></div><br></div></blockquote></div>
</div>_______________________________________________<br>
AusNOG mailing list<br>
<a href="mailto:AusNOG@lists.ausnog.net" target="_blank">AusNOG@lists.ausnog.net</a><br>
<a href="https://lists.ausnog.net/mailman/listinfo/ausnog" rel="noreferrer" target="_blank">https://lists.ausnog.net/mailman/listinfo/ausnog</a><br>
</div></blockquote></div></div>