The network administrator must set up a Resource Public Key Infrastructure (RPKI) server, using third-party software. The
RPKI server handles the actual authentication of public key certificates. The server is set up so that certain prefixes or
prefix ranges are allowed to originate from certain autonomous systems.
The administrator then configures the router to establish a TCP connection to the RPKI server. This is done by configuring
the bgp rpki server command. Upon such configuration or booting the router, the router opens a TCP connection to the indicated IP address and
port number. The router downloads a list of prefixes and permitted origin AS numbers from one or more router/RPKI servers
using the RPKI-Router protocol (RTR). Thus, the router obtains information from the server about which autonomous systems
are permitted to advertise which routes, that is, from which AS a route may originate.
If the TCP connection attempt fails, the router retries the connection once per minute. In the meantime, BGP will behave
without performing origin validation.
After the TCP session between the router and the server is established, the server will normally send to the router incremental
updates with new prefixes that have been added to the RPKI database. The router might also query the server every refresh
interval. The router will not send a serial query message or reset query message during the interval between when it sends
a serial query or reset query and when it receives an End of Data (EOD) message. Serial queries in this interval are stripped,
and reset queries in this interval are sent upon receipt of the EOD message.
A prefix or prefix range and the origin-AS corresponding to it are considered an SOVC record. Overlapping prefix ranges are
allowed. An SOVC table containing three records might look like this:
10.0.1.0/20-25 AS 3
10.0.1.0/19-24 AS 4
10.0.1.0/23-27 AS 5
When a prefix (network) is received from an external BGP (eBGP) peer, the prefix is initially placed in the Not Found state.
It is then examined and marked as Valid, Invalid, or Not Found:
Valid—Indicates the prefix and AS pair are found in the SOVC table.
Invalid—Indicates the prefix meets either of the following two conditions: 1. It matches one or more Route Origin Authorizations
(ROAs), but there is no matching ROA where the origin AS matches the origin AS on the AS-PATH. 2. It matches the one or more
ROAs at the minimum-length specified in the ROA, but for all ROAs where it matches the minimum length, it is longer than the
specified maximum length. Origin AS does not matter for condition #2.
Not Found—Indicates the prefix is not among the valid or invalid prefixes.
By default, a prefix that is marked Invalid is not advertised to any peer, will be withdrawn from the BGP routing table if
it was already advertised, and will not be flagged as a bestpath or considered as a candidate for multipath (unless a BGP
bestpath command indicates otherwise). Unless a BGP bestpath command is configured indicating otherwise, the bestpath computation
prefers Valid prefixes over Not Found prefixes, and both types of prefixes are advertised.
A prefix marked as Valid is installed in the BGP routing table.
By default, a prefix marked as Not Found is installed in the BGP routing table and will only be flagged as a bestpath or
considered as a candidate for multipath if there is no Valid alternative (independently of other BGP attributes such as Local
Preference or ASPATH).
If more than one RPKI server is configured, the router will connect to all configured servers and download prefix information
from all of them. The SOVC table will be made of the union of all the records received from the different servers.
bgp rpki server command (or the
neighbor announce rpki state command) is configured for an address family, the router starts doing RPKI validation for every path in that address family.