<html><head>
<style id="pgp_css" type="text/css"><!----></style><style id="css_styles" type="text/css"><!--blockquote.cite { margin-left: 5px; margin-right: 0px; padding-left: 10px; padding-right:0px; border-left: 1px solid #cccccc }
blockquote.cite2 {margin-left: 5px; margin-right: 0px; padding-left: 10px; padding-right:0px; border-left: 1px solid #cccccc; margin-top: 3px; padding-top: 0px; }
a img { border: 0px; }
li[style='text-align: center;'], li[style='text-align: center; '], li[style='text-align: right;'], li[style='text-align: right; '] { list-style-position: inside;}
body { font-family: Segoe UI; font-size: 12pt; }
.quote { margin-left: 1em; margin-right: 1em; border-left: 5px #ebebeb solid; padding-left: 0.3em; }--></style><style type="text/css"><!--#xe107592fa74b495 #xc4054b001f3144f blockquote.cite2, #xe107592fa74b495 blockquote.cite2
{margin-left: 5px; margin-right: 0px; padding-left: 10px; padding-right: 0px; border-left: 1px solid rgb(204, 204, 204); margin-top: 3px; padding-top: 0px;}
#xe107592fa74b495 #xc4054b001f3144f, #xe107592fa74b495
{font-family: "Segoe UI"; font-size: 12pt;}
--></style>
</head>
<body><div><img src="cid:emfd6a4729-a758-4047-8d0a-4ef641041800@joe-pc" border="0" /></div>
<div><br /></div><div>Thank you again to all for the advice :)</div><div><br /></div><div><br /></div>
<div>------ Original Message ------</div>
<div>From: "Joseph Goldman" <<a href="mailto:joseph@goldman.id.au">joseph@goldman.id.au</a>></div>
<div>To: "<a href="mailto:ausnog@lists.ausnog.net">ausnog@lists.ausnog.net</a>" <<a href="mailto:ausnog@lists.ausnog.net">ausnog@lists.ausnog.net</a>></div>
<div>Sent: 23/05/2024 4:50:44 PM</div>
<div>Subject: Re: [AusNOG] Experiences with RPKI</div><div><br /></div>
<div id="xe107592fa74b495"><blockquote cite="em45712be0-a048-41a4-a194-b44a97285eb9@joe-pc" type="cite" class="cite2">
<div>Thank you to everyone who reached out on and off list!</div><div><br />I have curbed the fears of what APNIC Helpdesk told me and am confident to continue with my original assumptions :)</div><div><br /></div>
<div><br /></div>
<div>------ Original Message ------</div>
<div>From: "Joseph Goldman" <<a href="mailto:joseph@goldman.id.au">joseph@goldman.id.au</a>></div>
<div>To: "<a href="mailto:ausnog@lists.ausnog.net">ausnog@lists.ausnog.net</a>" <<a href="mailto:ausnog@lists.ausnog.net">ausnog@lists.ausnog.net</a>></div>
<div>Sent: 23/05/2024 3:46:53 PM</div>
<div>Subject: [AusNOG] Experiences with RPKI</div><div><br /></div>
<div id="xc4054b001f3144f"><blockquote cite="em68959721-6001-401b-b7b0-5164728b3f41@joe-pc" type="cite" class="cite2">
G'day list,<div><br /></div><div> In the process of rolling out RPKI - and while I thought I had a good grasp on everything, there is one niggling piece of information that I've come against and can't verify. Was hoping people can share their experiences.</div><div><br /></div><div> We are only doing our ROA's to begin with and not implementing validation until later, the initial thought was to create an ROA for all our 'supernets' and use maxLength to 24 to help cover any prefix we may want to advertise. We are a much simpler setup, single AS only and we do advertise many of our ranges down to /24 but not all of them. I do know of the best practices of not using maxLength based on a draft rfc doc, but I am personally not super concerned for our relatively small use-case to the issues brought up in that doc.</div><div><br /></div><div> Where I have come into trouble is a source (APNIC helpdesk) indicating that if we have any ROAs that exist for prefixes we are not directly advertising - it may lend some validators to mark <b>all </b>our routes as invalid?</div><div><br /></div><div>i.e. say we had /22 ROA, 2x /23 ROAs and 4x /24 ROAs - are currently advertising the /22 and 2x /24's, so 2x /23's and 2x /24 ROAs are 'unused' in that we are not advertising those specific resources - would that cause issues with strict validators out in the wild?</div><div><br /></div><div> My understanding reading through the RFC's is this should not be the case. If any ROA that matches the prefix for the origin AS exists it should be valid, regardless of other ROAs signed by the same resource holder etc.</div><div><br /></div><div> Matching ROAs to exact advertisements is great, but it seems to lend itself to much less flexibility in traffic engineering and failover scenarios - a good scenario is having dormant /24 ROAs for say a DDoS mitigation service to use when needed, so you dont have to wait for RPKI propagation before scrubbing kicks in.</div><div><br /></div><div> Based on your experience, is having all-encompassing (using maxLength), or unused ROAs an acceptable way to use RPKI or will we run into issues?</div><div><br /></div><div>All help appreciated :)</div><div><br /></div><div>Thanks,</div><div>Joe</div></blockquote></div>
</blockquote></div>
</body></html>