Bgp Prefix Origin Validation Based On Rpki; Configure Rpki Cache-Server - Cisco NCS 5500 Series Configuration Manual

BGP Prefix Origin Validation Based on RPKI

The following is a sample configuration that displays DMZ link bandwidth configuration in the receiving
(R2) router:
RP/0/RP0/CPU0:router)# show bgp ipv4 unicast 10.1.1.1/32 detail
Paths: (1 available, best #1)
Not advertised to any peer
Path #1: Received by speaker 0
Not advertised to any peer
1 3
BGP Prefix Origin Validation Based on RPKI
A BGP route associates an address prefix with a set of autonomous systems (AS) that identify the interdomain
path the prefix has traversed in the form of BGP announcements. This set is represented as the AS_PATH
attribute in BGP and starts with the AS that originated the prefix.
To help reduce well-known threats against BGP including prefix mis-announcing and monkey-in-the-middle
attacks, one of the security requirements is the ability to validate the origination AS of BGP routes. The AS
number claiming to originate an address prefix (as derived from the AS_PATH attribute of the BGP route)
needs to be verified and authorized by the prefix holder. The Resource Public Key Infrastructure (RPKI) is
an approach to build a formally verifiable database of IP addresses and AS numbers as resources. The RPKI
is a globally distributed database containing, among other things, information mapping BGP (internet) prefixes
to their authorized origin-AS numbers. Routers running BGP can connect to the RPKI to validate the origin-AS
of BGP paths.

Configure RPKI Cache-server

Perform this task to configure Resource Public Key Infrastructure (RPKI) cache-server parameters.
Configure the RPKI cache-server parameters in rpki-server configuration mode. Use the rpki server command
in router BGP configuration mode to enter into the rpki-server configuration mode
BGP Configuration Guide for Cisco NCS 5500 Series Routers, IOS XR Release 6.2.x
90
Received Path ID 0, Local Path ID 0, version 21
Extended community: LB:3:192
Origin-AS validity: not-found
20.0.0.2 from 20.0.0.2 (10.0.0.81)
Origin incomplete, localpref 100, valid, external, best, group-best
Received Path ID 0, Local Path ID 0, version 17
Extended community: LB:1:192
Origin-AS validity: not-found
Implementing BGP