Internet2 Network Security SIG

[Larry Blunk <>]

  It should probably be clarified that "implementing RPKI" here actually means performing RPK-based BGP filtering (and not simply registering ROA's).  Your workplace actually uses AT&T as it's primary transit provider and thus already receives substantial benefit from AT&T's RPKI filtering.   There's some additional benefit for performing RPKI filtering on peers that don't already do it, but in many cases the benefit is probably limited (the chances of a Google or Microsoft or Amazon announcing or leaking bogus routes is likely low).  While Merit is not yet performing RPKI filtering (as noted, we get the benefit from AT&T doing it), we have registered ROA's for all prefixes that we have authority over in ARIN.  This includes the Net 35 blocks we have reassigned to Umich.  Umich has been discussing registering ROA's for their directly assigned blocks from ARIN.

-Larry Blunk

 Merit

On Mon, Apr 20, 2020 at 11:45 AM Bob Harold <> wrote:

My ISP (AT&T) says success.  My work says fail.  There was talk about implementing RPKI here recently.  Having a test page is useful.  Thanks.

--
Bob Harold

--