The RIPE NCC launched a Resource Certification platform on 1.1.2011, where
members can choose to set up a certificate listing their address blocks. They
can run RPKI software themselves, or use a hosted platform in our web portal.
So far 715 out of our ~7500 members have done this. Out of the top 100 largest
LIRs in our region, 28 have a certificate set up. About half of the enabled
members have the certificate solely to get validatable proof of holdership of
the address space they hold (for now?), the rest use it for BGP origin
validation.
By the latter group, 416 Route Origin Authorization (ROA) objects have been
created, covering the equivalent of 230,000 /24 prefixes and 8,600 /32 IPv6
prefixes. MaxLength in ROAs is sorely misunderstood, lots of education is
needed there. Most leave the field blank, causing more specific announcements
to be invalid.
Lately though, there lots of activity with regards to tooling and testbeds.
EuroTransit have set up a testbed with Randy/Rob's tools, as well as the NCC's:
http://rpki01.fra2.de.euro-transit.net/documentation.html
They also made two public RPKI capable Juniper routers available. You can log
into them using telnet with these details:
IPs: 193.34.50.25 and 193.34.50.26
user: rpki
password: testbed
You can run commands such as "show validation database" , "show validation
statistics", "show validation session", "show bgp neighbor", "show bgp summary"
and lastly "show route protocol bgp validation-state", followed by the state
(valid, invalid, unknown or unverified)
I'm curious to hear what you think.
Cheers,
Alex Band
RIPE NCC
P.S. Here you can grab a pre-release of the NCC Validation tool that they run
there (requires *NIX w/ Java, rsync):
https://certification.ripe.net/content/public-repo/releases/net/ripe/rpki-validator/rpki-validator-app/1.0.14/rpki-validator-app-1.0.14-bin.zip
_______________________________________________
sidr mailing list
[email protected]
https://www.ietf.org/mailman/listinfo/sidr
