BGP Configuration Guide for Cisco 8000 Series Routers, Cisco IOS XR Releases

PDF

BGP Configuration Guide for Cisco 8000 Series Routers, Cisco IOS XR Releases

BGP RPKI-based origin validation for outbound eBGP prefixes

Updated: June 9, 2026

Want to summarize with AI?

Log in

Describes how BGP RPKI-based origin validations on outbound enforce prefix origin checks for routes exported to external BGP peers.

BGP Resource Public Key Infrastructure (RPKI)-based origin validation for outbound external BGP (eBGP) prefixes is a route validation feature that

  • enhances BGP route security by automatically validating the origin Autonomous System (AS) of prefixes before advertising them to external peers

  • performs validation by checking the prefix origin-AS against the local RPKI Route Origin Authorization (ROA) database, and

  • prevents propagation of prefixes with invalid ROA status to eBGP neighbors, ensuring only trusted prefixes are exported from the network

The key benefits are:

  • Automates origin-AS validation using RPKI.

  • Prevents propagation of prefixes with invalid ROA status to eBGP neighbors.

  • Improves compliance with routing security policies.

  • Reduces manual filtering and configuration errors by automatically dropping invalid prefixes.

Table 1. Feature History Table

Feature Name

Release Information

Feature Description

BGP RPKI-based origin validation for outbound eBGP prefixes

 Release 26.2.1

Introduced in this release on: Fixed Systems (8200 [ASIC: Q200,P100], 8700 [ASIC: P100, K100], 8010 [ASIC: A100]); Centralized Systems (8600 [ASIC:Q200]) ; Modular Systems (8800 [LC ASIC:Q100, Q200, P100])

You can now enhance BGP route security by automatically validating route origins with RPKI before advertisement to external peers. Routes with invalid origin status are dropped, reducing manual filtering and ensuring only trusted prefixes are exported from your network.

Core attributes for outbound origin validations

  • Address families: Supported for IPv4 and IPv6 unicast address families, both in the Global Routing Table (GRT) and within VRF instances.

  • AS-path manipulations: Supports replace-as and remove-private-as operations. These manipulations are processed before the RPKI validation check, ensuring path modifications occur prior to the final permit or drop decision.

BGP RPKI-based origin validation for outbound eBGP prefixes restrictions

The following limitations apply to the BGP RPKI-based origin validation for outbound eBGP prefixes feature:

  • iBGP restriction: This feature is not supported for iBGP sessions; it is strictly limited to eBGP outbound advertisements.

  • Incompatible configurations: This feature cannot be used in conjunction with the as-override configuration.

  • Drop-only action: Only the "drop" action is supported for prefixes with an invalid ROA status.

  • No invalid-triggered modifications: You cannot modify route attributes or communities based on the invalidity determined by the RPKI validation process.

    Note: Modifications to route attributes or communities are permitted only if they occur before the RPKI drop action is applied.

How BGP RPKI-based origin validation for outbound eBGP prefixes works

Summary

The key components involved in the process are:

  • BGP process: Performs ROA validation and applies route policies before advertising routes externally.

  • RPKI ROA database: Provides authoritative records of valid origin ASes for prefixes.

  • Route policies: Outbound policies configured by the administrator specify RPKI validation enforcement with route-policy keywords.

The process ensures BGP exports only prefixes validated by RPKI for use by external peers, filtering out invalid prefixes and reducing the risk of propagating unauthorized routes.

Workflow

These stages describe how BGP evaluates and enforces RPKI-based origin validation on outbound route advertisements.

  1. Stage 1: Configure outbound route policy for RPKI validation The administrator creates or updates an outbound route policy that includes the drop-post-policy-if-RPKI-invalid action. This policy is attached to the outbound direction of eBGP peers within the BGP configuration.
  2. Stage 2: Perform RPKI origin-AS validation before route advertisement When a route is selected for advertisement to an external BGP neighbor, after allowed AS-path modifications (such as replace-as or remove-private-as), the BGP process queries the local RPKI ROA database to classify the origin-AS validity for each prefix.
  3. Stage 3: Enforce policy to accept or drop prefixes based on RPKI result The outbound route policy makes a decision for each prefix: if the ROA status is valid or not-found, the prefix is permitted; if invalid, the prefix is dropped and not advertised.

Configure BGP RPKI-based origin validation for outbound eBGP prefixes

This procedure configures BGP RPKI-based origin validation on outbound eBGP advertisements to ensure that only prefixes with a valid or not-found ROA status are exported, thereby strengthening routing security.

Before you begin

Before you begin, verify the following prerequisites are met:

  • ROA data is synchronized and up-to-date locally.

  • Identify the external BGP neighbors that require outbound origin validation.

Follow these steps to configure the BGP RPKI-based origin validation for outbound eBGP prefixes feature.

Procedure

1.

Define an outbound route-policy with RPKI validation action.

Example:

Router# configure
Router(config)# route-policy DROP-RPKI-EXT
Router(config-rpl)# drop-post-policy-if-RPKI-invalid
Router(config-rpl)# end-policy
Router(config)# commit

The policy must include drop-post-policy-if-RPKI-invalid to enforce outbound origin validation using RPKI.

The outbound route-policy is defined with the RPKI validation keyword for use with external BGP neighbors.
2.

Attach the route-policy to the external neighbor in the outbound direction.

Example:


Router(config)# router bgp 65001
Router(config-bgp)# neighbor 203.0.113.1
Router(config-bgp-nbr)# address-family ipv4 unicast
Router(config-bgp-nbr-af)# route-policy DROP-RPKI-EXT out
Router(config-bgp-nbr-af)# commit

The configured route-policy now enforces RPKI origin validation for prefixes sent to the external BGP neighbor.
3.

Verify the prefixes that were not advertised as a result of outbound RPKI validation using the show bgp <afi> <safi> not-advertised rpki-validation neighbor <address> command.

Example:

Router# show bgp ipv4 unicast not-advertised rpki-validation neighbor 100.1.2.2

Tue Feb 17 03:43:36.389 PST
200.1.1.0/24 is not advertised to 100.1.2.2
  Path info:
    neighbor: 10.1.1.3         neighbor router id: 10.1.1.3
    valid  internal  best
Received Path ID 0, Local Path ID 1, version 4
  Attributes after inbound policy was applied:
    next hop: 100.3.1.2
    ORG AS LOCAL PSID-L3-SID
    origin: EGP  neighbor as: 1  local pref: 100
    aspath: 1
  Attributes after outbound policy was applied:
    next hop: 100.1.2.1
    ORG AS LOCAL PSID-L3-SID
    origin: EGP  neighbor as: 1  local pref: 100
    aspath: 100 1

This command lists prefixes withheld from advertisement due to invalid RPKI validation after outbound policy is applied.

Specifiying the neighbor, in the above example, neighbor 100.1.2.2, is optional.

  • Check the Path info and Attributes after outbound policy fields for diagnosis details.

Prefixes dropped by outbound RPKI validation are displayed. Use this information to investigate filtering actions.
4.

Verify RPKI drop counts by displaying update-group performance statistics using show bgp ipv4 unicast update-group neighbor <address> performance-statistics command.

Example:

Router#  show bgp ipv4 unicast update-group neighbor 100.1.2.2 performance-statistics

Mon Feb 23 05:26:46.591 PST

Update group for IPv4 Unicast, index 0.2:
  Attributes:
    Outbound policy: DROP-RPKI-EXT
    First neighbor AS: 2
    ...
  Messages formatted: 17, replicated: 17
  Updates generated for 0 prefixes in 22 calls
  Not-Advertised Stats:
    Sender Autonomous-System         : 3   Feb 23 04:10:47.203
    Split Horizon Update             : 3   Feb 23 04:10:47.203
   RPKI outbound policy drop        : 6   Feb 23 05:22:56.788

The RPKI outbound policy drop field displays the number and timestamp of prefixes dropped by outbound validation policy.

  • Consistent or increasing drop counts may indicate persistent validation failures.

Statistical counters related to RPKI-based filtering actions appear for operational monitoring.

Prefixes with invalid ROA status are filtered and not advertised to external BGP peers, providing automated route security and compliance with routing policies.