draft-ietf-sidr-origin-ops-01.txt   draft-ietf-sidr-origin-ops-02.txt 
Network Working Group R. Bush Network Working Group R. Bush
Internet-Draft IIJ Internet-Draft IIJ
Intended status: BCP January 9, 2011 Intended status: BCP January 19, 2011
Expires: July 13, 2011 Expires: July 23, 2011
RPKI-Based Origin Validation Operations RPKI-Based Origin Validation Operation
draft-ietf-sidr-origin-ops-01 draft-ietf-sidr-origin-ops-02
Abstract Abstract
Deployment of the RPKI-based BGP origin validation has many Deployment of the RPKI-based BGP origin validation has many
operational considerations. This document attempts to collect and operational considerations. This document attempts to collect and
present them. It is expected to evolve as RPKI-based origin present them. It is expected to evolve as RPKI-based origin
validation is deployed and the dynamics are better understood. validation is deployed and the dynamics are better understood.
Requirements Language Requirements Language
skipping to change at page 1, line 39 skipping to change at page 1, line 39
Internet-Drafts are working documents of the Internet Engineering Internet-Drafts are working documents of the Internet Engineering
Task Force (IETF). Note that other groups may also distribute Task Force (IETF). Note that other groups may also distribute
working documents as Internet-Drafts. The list of current Internet- working documents as Internet-Drafts. The list of current Internet-
Drafts is at http://datatracker.ietf.org/drafts/current/. Drafts is at http://datatracker.ietf.org/drafts/current/.
Internet-Drafts are draft documents valid for a maximum of six months Internet-Drafts are draft documents valid for a maximum of six months
and may be updated, replaced, or obsoleted by other documents at any and may be updated, replaced, or obsoleted by other documents at any
time. It is inappropriate to use Internet-Drafts as reference time. It is inappropriate to use Internet-Drafts as reference
material or to cite them other than as "work in progress." material or to cite them other than as "work in progress."
This Internet-Draft will expire on July 13, 2011. This Internet-Draft will expire on July 23, 2011.
Copyright Notice Copyright Notice
Copyright (c) 2011 IETF Trust and the persons identified as the Copyright (c) 2011 IETF Trust and the persons identified as the
document authors. All rights reserved. document authors. All rights reserved.
This document is subject to BCP 78 and the IETF Trust's Legal This document is subject to BCP 78 and the IETF Trust's Legal
Provisions Relating to IETF Documents Provisions Relating to IETF Documents
(http://trustee.ietf.org/license-info) in effect on the date of (http://trustee.ietf.org/license-info) in effect on the date of
publication of this document. Please review these documents publication of this document. Please review these documents
skipping to change at page 3, line 28 skipping to change at page 3, line 28
Origin validation only need be done by an AS's border routers and is Origin validation only need be done by an AS's border routers and is
designed so that it can be used to protect announcements which are designed so that it can be used to protect announcements which are
originated by large providers, upstreams and downstreams, and by originated by large providers, upstreams and downstreams, and by
small stub/entetprise/edge routers. small stub/entetprise/edge routers.
Origin validation has been designed to be deployed on current routers Origin validation has been designed to be deployed on current routers
without hardware upgrade. It should be used by everyone from large without hardware upgrade. It should be used by everyone from large
backbones to small stub/entetprise/edge routers. backbones to small stub/entetprise/edge routers.
RPKI-based origin validation has been designed so that, with prudent RPKI-based origin validation has been designed so that, with prudent
local routing policies, there is no liability that normal Internet local routing policies, there is little risk that normal Internet
routing is threatened by unprudent deployment of the global RPKI, see routing is threatened by unprudent deployment of the global RPKI, see
Section 5. Section 5.
2. Suggested Reading 2. Suggested Reading
It is assumed that the reader understands BGP, [RFC4271], the RPKI, It is assumed that the reader understands BGP, [RFC4271], the RPKI,
see [I-D.ietf-sidr-arch], the RPKI Repository Structure, see see [I-D.ietf-sidr-arch], the RPKI Repository Structure, see
[I-D.ietf-sidr-repos-struct], ROAs, see [I-D.ietf-sidr-roa-format], [I-D.ietf-sidr-repos-struct], ROAs, see [I-D.ietf-sidr-roa-format],
the RPKI to Router Protocol, see [I-D.ietf-sidr-rpki-rtr], and RPKI- the RPKI to Router Protocol, see [I-D.ietf-sidr-rpki-rtr], and RPKI-
based Prefix Validation, see [I-D.ietf-sidr-pfx-validate]. based Prefix Validation, see [I-D.ietf-sidr-pfx-validate].
skipping to change at page 4, line 18 skipping to change at page 4, line 18
As RPKI-based origin validation relies on the availability of RPKI As RPKI-based origin validation relies on the availability of RPKI
data, operators will likely want border routers to have one or more data, operators will likely want border routers to have one or more
nearby caches. nearby caches.
For redundancy, a router may peer with more than one cache at the For redundancy, a router may peer with more than one cache at the
same time. Peering with two or more, one local and others remote, is same time. Peering with two or more, one local and others remote, is
recommended. recommended.
If an operator or site trusts upstreams to carry their traffic, they If an operator or site trusts upstreams to carry their traffic, they
might as well trust the RPKI data those upstreams cache and feed off might as well trust the RPKI data those upstreams cache and peer with
of those caches. Note that this places an obligation on those of those caches. Note that this places an obligation on those
upstreams to maintain fresh and reliable caches. upstreams to maintain fresh and reliable caches.
A transit provider or a network with peers will want to validate A transit provider or a network with peers will want to validate
origins in announcements made by downstreams and peers. They still origins in announcements made by downstreams and peers. They still
may choose to trust the caches provided by their upstreams. may choose to trust the caches provided by their upstreams.
4. Within a Network 4. Within a Network
Origin validation need only be done by edge routers in a network, Origin validation need only be done by edge routers in a network,
skipping to change at page 6, line 44 skipping to change at page 6, line 44
November 2010. November 2010.
[I-D.ietf-sidr-roa-format] [I-D.ietf-sidr-roa-format]
Lepinski, M., Kent, S., and D. Kong, "A Profile for Route Lepinski, M., Kent, S., and D. Kong, "A Profile for Route
Origin Authorizations (ROAs)", Origin Authorizations (ROAs)",
draft-ietf-sidr-roa-format-09 (work in progress), draft-ietf-sidr-roa-format-09 (work in progress),
November 2010. November 2010.
[I-D.ietf-sidr-rpki-rtr] [I-D.ietf-sidr-rpki-rtr]
Bush, R. and R. Austein, "The RPKI/Router Protocol", Bush, R. and R. Austein, "The RPKI/Router Protocol",
draft-ietf-sidr-rpki-rtr-06 (work in progress), draft-ietf-sidr-rpki-rtr-07 (work in progress),
January 2011. January 2011.
[I-D.ietf-sidr-pfx-validate] [I-D.ietf-sidr-pfx-validate]
Mohapatra, P., Scudder, J., Ward, D., Bush, R., and R. Mohapatra, P., Scudder, J., Ward, D., Bush, R., and R.
Austein, "BGP Prefix Origin Validation", Austein, "BGP Prefix Origin Validation",
draft-ietf-sidr-pfx-validate-00 (work in progress), draft-ietf-sidr-pfx-validate-00 (work in progress),
July 2010. July 2010.
[I-D.wkumari-deprecate-as-sets]
Kumari, W., "Deprecation of BGP AS_SET, AS_CONFED_SET.",
draft-wkumari-deprecate-as-sets-01 (work in progress),
September 2010.
10.2. Informative References 10.2. Informative References
[RFC4271] Rekhter, Y., Li, T., and S. Hares, "A Border Gateway [RFC4271] Rekhter, Y., Li, T., and S. Hares, "A Border Gateway
Protocol 4 (BGP-4)", RFC 4271, January 2006. Protocol 4 (BGP-4)", RFC 4271, January 2006.
[I-D.wkumari-deprecate-as-sets]
Kumari, W., "Deprecation of BGP AS_SET, AS_CONFED_SET.",
draft-wkumari-deprecate-as-sets-01 (work in progress),
September 2010.
Author's Address Author's Address
Randy Bush Randy Bush
Internet Initiative Japan, Inc. Internet Initiative Japan, Inc.
5147 Crystal Springs 5147 Crystal Springs
Bainbridge Island, Washington 98110 Bainbridge Island, Washington 98110
US US
Phone: +1 206 780 0431 x1 Phone: +1 206 780 0431 x1
Email: randy@psg.com Email: randy@psg.com
 End of changes. 8 change blocks. 
13 lines changed or deleted 13 lines changed or added

This html diff was produced by rfcdiff 1.40. The latest version is available from http://tools.ietf.org/tools/rfcdiff/