[as112-ops] ROA for AS112 prefixes

Akira Kato kato at wide.ad.jp
Fri Jul 2 05:18:37 UTC 2021


Folks,

Some ISPs have been started filter the BGP announced prefixes when ROA
check is negative. We got a report from Hurricane Electric that the
prefixes from AS112 have been rejected due to multiple weak reasons,
as far as I understand. Hurricane is just an example, and it is not
their fault at all:

   192.175.48.0/24,rejected,origin 112 RPKI status UNKNOWN. ASN 7500 and prefix RIR handles do not match. Prefix missing from IRR policy.
   192.31.196.0/24,rejected,origin 112 RPKI status UNKNOWN. ASN 7500 and prefix RIR handles do not match. Prefix missing from IRR policy.

   2001:4:112::/48,rejected,origin 112 RPKI status UNKNOWN. ASN 7500 and prefix RIR handles do not match. Prefix missing from IRR policy.
   2620:4f:8000::/48,rejected,origin 112 RPKI status UNKNOWN. ASN 7500 and prefix RIR handles do not match. Prefix missing from IRR policy.

The association of these prefixes and origin AS112 binding have been
established since AS112 project started in many many years ago. It may
be a time to consider to create ROA for these prefixes as valid routes
from AS112. Starting ROAs for IPv6 prefixes first may be a good start.
Valid ROA's can remove above entries from a report we got monthly
basis from Hurricane.

If you take a look of IRR (such as whois.radb.net), there are lot of
unnecessary entries, some of them are wrong. It may better to clean
out such wrong or unnecessary entries.

Regards,

Akira Kato, WIDE Project
P.S.
I apologize for sending email if conclusion has been made already to do
or not to do...


More information about the as112-ops mailing list