Skip to Content.
Sympa Menu

netsec-sig - Re: [Security-WG] Is BGP safe for your ISP?

Subject: Internet2 Network Security SIG

List archive

Re: [Security-WG] Is BGP safe for your ISP?


Chronological Thread 
  • From: Larry Blunk <>
  • To:
  • Subject: Re: [Security-WG] Is BGP safe for your ISP?
  • Date: Mon, 20 Apr 2020 12:16:48 -0400


  It should probably be clarified that "implementing RPKI" here actually means performing RPK-based BGP filtering (and not simply registering ROA's).  Your workplace actually uses AT&T as it's primary transit provider and thus already receives substantial benefit from AT&T's RPKI filtering.   There's some additional benefit for performing RPKI filtering on peers that don't already do it, but in many cases the benefit is probably limited (the chances of a Google or Microsoft or Amazon announcing or leaking bogus routes is likely low).  While Merit is not yet performing RPKI filtering (as noted, we get the benefit from AT&T doing it), we have registered ROA's for all prefixes that we have authority over in ARIN.  This includes the Net 35 blocks we have reassigned to Umich.  Umich has been discussing registering ROA's for their directly assigned blocks from ARIN.

-Larry Blunk
 Merit


On Mon, Apr 20, 2020 at 11:45 AM Bob Harold <> wrote:
My ISP (AT&T) says success.  My work says fail.  There was talk about implementing RPKI here recently.  Having a test page is useful.  Thanks.

--
Bob Harold



-- 



Archive powered by MHonArc 2.6.19.

Top of Page