Internet2 Network Security SIG

["Montgomery, Douglas C. (Fed)" <>]

Bad, or sad, news?

 

Maybe we all should originate one purposefully RPKI-ROV invalid prefix with a web target on it, and provide the URL to cloudflare to include in their test.

 

Eventually the burden of manual configuration will greater than the effort to deploy RPKI?

dougm

--

Doug Montgomery, Manager Internet & Scalable Systems Research @ NIST

 

 

From: <> on behalf of Andrew Gallo <>
Reply-To: Andrew Gallo <>
Date: Monday, April 20, 2020 at 2:39 PM
To: Bob Harold <>
Cc: " List:" <>
Subject: Re: [Security-WG] Is BGP safe for your ISP?

 

This issue is bad news:

 

https://github.com/cloudflare/isbgpsafeyet.com/issues/105

 

"ISPs manually blocking routes to https://invalid.rpki.cloudflare.com instead of implementing RPKI #105"

 

 

 

On Mon, Apr 20, 2020 at 2:31 PM Bob Harold <> wrote:

Thanks, I see I am late to the party!

--
Bob Harold

 

 

On Mon, Apr 20, 2020 at 2:25 PM Andrew Gallo <> wrote:

There's an issue open on the projects Github page concerning this:

https://github.com/cloudflare/isbgpsafeyet.com/issues/37

 

 

 

On Mon, Apr 20, 2020 at 2:15 PM Bob Harold <> wrote:

Please test with IPv4 and IPv6 separately!   My campus says "Success" if I run from an IPv4-only host, but if I have IPv6 available, it says "Fail".

--
Bob Harold

DNS and DHCP Hostmaster - UMNet
Information and Technology Services (ITS)
   734-512-7038

 

 

On Mon, Apr 20, 2020 at 12:17 PM Larry Blunk <> wrote:

 

  It should probably be clarified that "implementing RPKI" here actually means performing RPK-based BGP filtering (and not simply registering ROA's).  Your workplace actually uses AT&T as it's primary transit provider and thus already receives substantial benefit from AT&T's RPKI filtering.   There's some additional benefit for performing RPKI filtering on peers that don't already do it, but in many cases the benefit is probably limited (the chances of a Google or Microsoft or Amazon announcing or leaking bogus routes is likely low).  While Merit is not yet performing RPKI filtering (as noted, we get the benefit from AT&T doing it), we have registered ROA's for all prefixes that we have authority over in ARIN.  This includes the Net 35 blocks we have reassigned to Umich.  Umich has been discussing registering ROA's for their directly assigned blocks from ARIN.

 

-Larry Blunk

 Merit

 

 

On Mon, Apr 20, 2020 at 11:45 AM Bob Harold <> wrote:

My ISP (AT&T) says success.  My work says fail.  There was talk about implementing RPKI here recently.  Having a test page is useful.  Thanks.

--
Bob Harold

 

 

 

--