skills.rest
xalgord
xalgordCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

implementing-bgp-security-with-rpki

Implement BGP route origin validation with RPKI ROAs, validators, and ROV policies on Cisco and Juniper routers.

954|172|Updated Mar 13, 2026
Search Tags:#network security#roa#BGP#routinator#cisco juniper#route origin validation#rpki
One-click install
npx skills add https://github.com/xalgord/xalgorix --skill implementing-bgp-security-with-rpki
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: implementing-bgp-security-with-rpki
Source: https://github.com/xalgord/xalgorix/tree/main/internal/tools/skills/data/network-security/implementing-bgp-security-with-rpki
Command: npx skills add https://github.com/xalgord/xalgorix --skill implementing-bgp-security-with-rpki

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

BGP route hijacking and accidental route leaks occur because routers traditionally accept any prefix announcement without verifying the origin AS is authorized. This Skill guides you through deploying RPKI-based Route Origin Validation so your routers cryptographically verify announcements and reject invalid routes.

Core Features & Use Cases

  • ROA Creation: Step-by-step instructions for creating Route Origin Authorizations through RIR portals (ARIN, RIPE NCC) with correct max-length settings to prevent sub-prefix hijacking.
  • Validator Deployment: Install and run Routinator as an RPKI validator/cache serving VRPs over the RTR protocol, with systemd service configuration.
  • Router ROV Configuration: Ready-to-use route-map and policy configurations for Cisco IOS-XE and Juniper Junos that accept Valid, depreference NotFound, and reject Invalid routes.
  • Use Case: A network operator wants to protect their AS from prefix hijacking. They create ROAs for their prefixes, deploy two Routinator validators, apply RPKI filtering policies to all eBGP neighbors, and monitor validation state with the included Python monitoring script.

Quick Start

Ask the AI to walk you through creating a ROA for your prefix at your RIR and configuring RPKI route origin validation on your Cisco or Juniper BGP routers.

Frequently Asked Questions about implementing-bgp-security-with-rpki

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I configure RPKI route origin validation on Cisco routers?▼

On Cisco IOS-XE, configure an RPKI cache server connection under router bgp with 'bgp rpki server tcp <ip> port 8323', then create a route-map matching rpki valid, not-found, and invalid states. Apply the route-map inbound on each eBGP neighbor and verify with 'show bgp rpki table'.

How do I create a ROA to prevent BGP prefix hijacking?▼

Log into your RIR portal (ARIN or RIPE NCC), navigate to the RPKI/ROA section, and create a ROA specifying your prefix, origin AS, and max-length. Set max-length equal to the announced prefix length so attackers cannot validate more-specific announcements.

What is the difference between RPKI Valid, Invalid, and NotFound states?▼

Valid means a ROA exists and the origin AS and prefix match; Invalid means a ROA exists but the origin AS or prefix length mismatches; NotFound means no ROA covers the prefix. Recommended policy accepts Valid, rejects Invalid, and accepts NotFound with lower preference.

Does Juniper Junos support RPKI route origin validation?▼

Yes, Junos 12.2 and later supports RPKI validation. Configure a validation group under routing-options with the cache session details, build a policy-statement matching validation-database states, and apply it as an import policy on BGP groups.

Why is my router accepting RPKI invalid routes?▼

Common causes include the route-map not being applied inbound on every eBGP neighbor, missing 'clear bgp soft in' after policy changes, or the RTR session to the validator being down so all routes appear NotFound. Verify with 'show bgp rpki table' and per-neighbor RPKI state.

Should I run one or multiple RPKI validators?▼

Run at least two independent RPKI validator caches for redundancy. If the RTR session to a single validator drops, the router treats all routes as NotFound and accepts them, effectively disabling validation.

Related Skills

Explore More Software Engineering Skills→
appliedailearnerappliedailearner

azure-internet-peering

Validate Azure Internet Peering prefixes and verify routing reachability.

Community
Intermediate
kanishkaswaminathankanishkaswaminathan

clinic-inventory

Track clinic consumables and drugs with API-driven inventory operations and daily alerts.

Community
Intermediate
pascallammerspascallammers
1

security-patterns

Implement OWASP Top 10 security patterns with bcrypt, JWT, and helmet.

Community
Advanced
ShiienShiien
7

theory-generalize

Analyze proven theorems to propose feasible generalizations across axes.

Community
Advanced