Skip to Content.
Sympa Menu

netsec-sig - Re: [Security-WG] Is BGP safe for your ISP?

Subject: Internet2 Network Security SIG

List archive

Re: [Security-WG] Is BGP safe for your ISP?


Chronological Thread 
  • From: Andrew Gallo <>
  • To: Bob Harold <>
  • Cc:
  • Subject: Re: [Security-WG] Is BGP safe for your ISP?
  • Date: Mon, 20 Apr 2020 14:38:48 -0400

This issue is bad news:


"ISPs manually blocking routes to https://invalid.rpki.cloudflare.com instead of implementing RPKI #105"



On Mon, Apr 20, 2020 at 2:31 PM Bob Harold <> wrote:
Thanks, I see I am late to the party!

--
Bob Harold


On Mon, Apr 20, 2020 at 2:25 PM Andrew Gallo <> wrote:
There's an issue open on the projects Github page concerning this:



On Mon, Apr 20, 2020 at 2:15 PM Bob Harold <> wrote:
Please test with IPv4 and IPv6 separately!   My campus says "Success" if I run from an IPv4-only host, but if I have IPv6 available, it says "Fail".

--
Bob Harold
DNS and DHCP Hostmaster - UMNet
Information and Technology Services (ITS)
   734-512-7038


On Mon, Apr 20, 2020 at 12:17 PM Larry Blunk <> wrote:

  It should probably be clarified that "implementing RPKI" here actually means performing RPK-based BGP filtering (and not simply registering ROA's).  Your workplace actually uses AT&T as it's primary transit provider and thus already receives substantial benefit from AT&T's RPKI filtering.   There's some additional benefit for performing RPKI filtering on peers that don't already do it, but in many cases the benefit is probably limited (the chances of a Google or Microsoft or Amazon announcing or leaking bogus routes is likely low).  While Merit is not yet performing RPKI filtering (as noted, we get the benefit from AT&T doing it), we have registered ROA's for all prefixes that we have authority over in ARIN.  This includes the Net 35 blocks we have reassigned to Umich.  Umich has been discussing registering ROA's for their directly assigned blocks from ARIN.

-Larry Blunk
 Merit


On Mon, Apr 20, 2020 at 11:45 AM Bob Harold <> wrote:
My ISP (AT&T) says success.  My work says fail.  There was talk about implementing RPKI here recently.  Having a test page is useful.  Thanks.

--
Bob Harold



-- 



Archive powered by MHonArc 2.6.19.

Top of Page