BGP · Convergence and Security

Prefix Origin Validation

Connect to a validated cache, inspect origin state and reject Invalid imports explicitly.

Two originators and two validating routers

R4 and R5 advertise the same /24 to R1. R1/R2 use AS65012 internally. R3 provides routed access to an external RTR cache at 192.0.2.18/30 through interface 192.0.2.17/30. The cache host needs a return route/default gateway through R3 and must serve the synthetic VRP from the preceding lesson on TCP port 3323.

Lab topologyPhysical links

Solid lines are physical links. Endpoint labels are the last octets of 192.0.2.x/30, first router then second router in the address table. Loopback0 is 10.255.0.N/32 on RN. Logical BGP peers are listed in the configurations.

Link	First endpoint	Second endpoint
R1–R2	GigabitEthernet1 192.0.2.1/30	GigabitEthernet1 192.0.2.2/30
R1–R3	GigabitEthernet2 192.0.2.5/30	GigabitEthernet1 192.0.2.6/30
R1–R4	GigabitEthernet3 192.0.2.9/30	GigabitEthernet1 192.0.2.10/30
R1–R5	GigabitEthernet4 192.0.2.13/30	GigabitEthernet1 192.0.2.14/30

Complete baseline configurations

R1

hostname R1
ip cef
interface Loopback0
 ip address 10.255.0.1 255.255.255.255
exit
interface GigabitEthernet1
 ip address 192.0.2.1 255.255.255.252
 no shutdown
exit
interface GigabitEthernet2
 ip address 192.0.2.5 255.255.255.252
 no shutdown
exit
interface GigabitEthernet3
 ip address 192.0.2.9 255.255.255.252
 no shutdown
exit
interface GigabitEthernet4
 ip address 192.0.2.13 255.255.255.252
 no shutdown
exit
router ospf 1
 router-id 10.255.0.1
 network 10.255.0.1 0.0.0.0 area 0
 passive-interface Loopback0
 network 192.0.2.1 0.0.0.0 area 0
 network 192.0.2.5 0.0.0.0 area 0
exit
router bgp 65012
 bgp router-id 10.255.0.1
 no bgp default ipv4-unicast
 neighbor 10.255.0.2 remote-as 65012
 neighbor 10.255.0.2 update-source Loopback0
 neighbor 192.0.2.10 remote-as 64496
 neighbor 192.0.2.14 remote-as 64497
 address-family ipv4 unicast
  no auto-summary
  neighbor 10.255.0.2 activate
  neighbor 10.255.0.2 next-hop-self
  neighbor 192.0.2.10 activate
  neighbor 192.0.2.14 activate
 exit-address-family
end

R2

hostname R2
ip cef
interface Loopback0
 ip address 10.255.0.2 255.255.255.255
exit
interface GigabitEthernet1
 ip address 192.0.2.2 255.255.255.252
 no shutdown
exit
router ospf 1
 router-id 10.255.0.2
 network 10.255.0.2 0.0.0.0 area 0
 passive-interface Loopback0
 network 192.0.2.2 0.0.0.0 area 0
exit
router bgp 65012
 bgp router-id 10.255.0.2
 no bgp default ipv4-unicast
 neighbor 10.255.0.1 remote-as 65012
 neighbor 10.255.0.1 update-source Loopback0
 address-family ipv4 unicast
  no auto-summary
  neighbor 10.255.0.1 activate
 exit-address-family
end

R3

hostname R3
ip cef
interface Loopback0
 ip address 10.255.0.3 255.255.255.255
exit
interface GigabitEthernet1
 ip address 192.0.2.6 255.255.255.252
 no shutdown
exit
interface GigabitEthernet2
 ip address 192.0.2.17 255.255.255.252
 no shutdown
exit
router ospf 1
 router-id 10.255.0.3
 network 10.255.0.3 0.0.0.0 area 0
 passive-interface Loopback0
 network 192.0.2.6 0.0.0.0 area 0
 network 192.0.2.17 0.0.0.0 area 0
 passive-interface GigabitEthernet2
end

R4

hostname R4
ip cef
interface Loopback0
 ip address 10.255.0.4 255.255.255.255
exit
interface Loopback10
 ip address 198.51.100.1 255.255.255.0
exit
interface GigabitEthernet1
 ip address 192.0.2.10 255.255.255.252
 no shutdown
exit
router bgp 64496
 bgp router-id 10.255.0.4
 no bgp default ipv4-unicast
 neighbor 192.0.2.9 remote-as 65012
 address-family ipv4 unicast
  no auto-summary
  neighbor 192.0.2.9 activate
  network 198.51.100.0 mask 255.255.255.0
 exit-address-family
end

R5

hostname R5
ip cef
interface Loopback0
 ip address 10.255.0.5 255.255.255.255
exit
interface Loopback10
 ip address 198.51.100.1 255.255.255.0
exit
interface GigabitEthernet1
 ip address 192.0.2.14 255.255.255.252
 no shutdown
exit
router bgp 64497
 bgp router-id 10.255.0.5
 no bgp default ipv4-unicast
 neighbor 192.0.2.13 remote-as 65012
 address-family ipv4 unicast
  no auto-summary
  neighbor 192.0.2.13 activate
  network 198.51.100.0 mask 255.255.255.0
 exit-address-family
end

Open plain-text configurations

Outputs are illustrative, not recorded router results. Each lab starts from its own baseline. Configuration and feature support vary by image and release; platform-specific examples identify their prerequisites.

The router baseline does not install validator software or manufacture signed public authorizations. Supply an isolated lab RTR cache with prefix 198.51.100.0/24, maxLength 25, origin AS64496. With live public data, documentation prefixes will not reproduce these synthetic states.

Connect and verify cache data

router bgp 65012
 bgp rpki server tcp 192.0.2.18 port 3323 refresh 300

Configure on R1 and R2; both have OSPF reachability through R3. Use a protected management path and a supported RTR transport appropriate to the deployment. The plain TCP form here is for the isolated lab.

R1# show ip bgp rpki servers
BGP SOVC neighbor is 192.0.2.18/3323 connected
Refresh time is 300
Prefixes 1

R1# show ip bgp rpki table
Network              Maxlen  Origin-AS
198.51.100.0/24       25      64496

Inspect the two origin states

R1# show ip bgp 198.51.100.0/24
BGP routing table entry for 198.51.100.0/24
Paths: (2 available)
  64496
    192.0.2.10 from 192.0.2.10
      Origin IGP, valid, external, validation-state: Valid
  64497
    192.0.2.14 from 192.0.2.14
      Origin IGP, external, validation-state: Invalid

Validation and default best-path treatment vary by software release. Do not depend on an undocumented default or assume a command that disables validation still leaves usable state for route-map matching. Here the explicit import policy below is the acceptance boundary.

Reject Invalid on external imports

route-map ORIGIN-IN deny 10
 match rpki invalid
exit
route-map ORIGIN-IN permit 20
exit

router bgp 65012
 address-family ipv4 unicast
  neighbor 192.0.2.10 route-map ORIGIN-IN in
  neighbor 192.0.2.14 route-map ORIGIN-IN in
 exit-address-family

R1# clear ip bgp 192.0.2.10 soft in
R1# clear ip bgp 192.0.2.14 soft in

R1# show ip bgp
     Network          Next Hop        Metric LocPrf Weight Path
*>   198.51.100.0/24  192.0.2.10           0             0 64496 i

The final permit retains Valid and NotFound routes unless other policies reject them. It must not replace an existing import policy’s prefix and path checks; merge it as an additional gate. R2 can validate independently from its own cache connection.

Test changes and restore safely

Change the isolated cache authorization to exercise wrong-AS, too-specific and absent-coverage cases, allowing cache serial updates and router revalidation. Inspect the accepted table and IP route after each change. A cache outage is not simply a BGP-session failure; implementations may retain usable cache records until their expiry policy says otherwise.

R1# show ip route 198.51.100.0
Routing entry for 198.51.100.0/24
  Known via "bgp 65012", distance 20, metric 0
  * 192.0.2.10, via GigabitEthernet3

Keep rejection as the final defensive state. To return to the intentionally unrestricted baseline in an isolated exercise, detach ORIGIN-IN and remove the cache configuration using the image’s matching no form. Recheck the actual table rather than assuming every previously Invalid path immediately becomes best.

Key Takeaways

RTR connectivity and validated data are prerequisites.
Synthetic lab VRPs are not claims about public authorization.
Wrong origin and excessive specificity can both be Invalid.
An explicit Invalid reject need not reject NotFound.
Cache health and release-specific defaults must be verified.

Protocol and command references

Origin validation configuration · Origin validation · RTR protocol · Router-symbol attribution.

← Resource Public Key Infrastructure Next-Hop Tracking →