Internet2 Network Security SIG

[Andrew Gallo <>]

We have two linux machines running the RIPE Validator.  Our regional router (a Juniper MX480) and our campus routers (MX240s) have a connection to each validator.

This validation session just gets the results of the validation process into the router.  As the document you sent  shows, for Juniper routers, you need to take the initial step of applying a BGP import policy to tell the router do compare incoming routes to the database.

Our regional router has that policy implement, our campus router do not yet have that configuration (waiting for a change window to implement the policy)

The policy on the regional router does *nothing* except set the validation state of the router; one term looks like:
term valid {
    from {
        protocol bgp;
        validation-database valid;
    }
    then {
        validation-state valid;
        next-policy;
    }
}
       

We are not making any other changes to the route (eg, localpref).  I would suggest paying attention to the 'then' action.  The sample config in the doc uses 'accept' which is a terminating action.  Depending on how you are combining this with other import policies, it may change expected behavior.  For reference, we have a separate policy specifically for RPKI validation, and all actions are 'next-polilcy'

Because all the routes are being accepted AND no changes are being made, I would describe it as a relatively low risk activity.  The validators can be stopped and restarted without impact on the routers (aside from noting the state of the connection to the validator.

Make sense?

On Mon, Nov 6, 2017 at 4:51 PM, John Kristoff <> wrote:

On Wed, 1 Nov 2017 14:12:00 +0000
Andrew Gallo <> wrote:

> There were a couple of questions either in our WG meeting, in the RPKI
> session, or from other conversations that I can provide at least some
> updates on.

Thanks Andrew, this is useful.

Can you explain a bit more about how you do validation?  I'd be
hesitant to put any of this on any production routing that is forwarding
traffic today.  Do you have a Unix server plus a one-armed router that
just does validation for monitoring purposes, or something else?

I'm looking at this, which I assume is something similar to what you do?

  <https://www.juniper.net/documentation/en_US/release-independent/solutions/information-products/pathway-pages/bgp-rpki-tn.pdf>

John