Community discussions

MikroTik App
 
peterborough
just joined
Topic Author
Posts: 7
Joined: Tue Jul 25, 2023 2:27 pm

RPKI

Tue Jan 23, 2024 1:16 pm

We have RPKI setup to filter BGP routes received from providers, however they do not seem to be getting filtered.

We have inbound filters setup
rpki-verify RPKI
if (rpki invalid) { reject } else { accept }
under the same chain name as other working inbound filters and are on the latest OS.

to check to see if the router is working and able to connect to the Validator
/routing/rpki> /routing/rpki/ rpki-check group=RPKI prefix=70.132.18.0/24 origin-as=16509
valid

/routing/rpki> /routing/rpki/ rpki-check group=RPKI prefix=2a05:dfc7:1000::/48 origin-as=205531
invalid

Last edited by peterborough on Wed Jan 24, 2024 3:19 pm, edited 1 time in total.
 
User avatar
mrz
MikroTik Support
MikroTik Support
Posts: 7056
Joined: Wed Feb 07, 2007 12:45 pm
Location: Latvia
Contact:

Re: RPKI

Tue Jan 23, 2024 2:46 pm

rpki-verify just adds the RPKI status to the prefix, you can see whether status have been addd by looking at parameters in /routing/route/print detail

To actually reject or accept prefix you have to match the rpki status and add apropriate action, see example here:
https://help.mikrotik.com/docs/display/ROS/RPKI
 
peterborough
just joined
Topic Author
Posts: 7
Joined: Tue Jul 25, 2023 2:27 pm

Re: RPKI

Tue Jan 23, 2024 2:56 pm

the issue is, none of the routes are getting marked
You do not have the required permissions to view the files attached to this post.
 
peterborough
just joined
Topic Author
Posts: 7
Joined: Tue Jul 25, 2023 2:27 pm

Re: RPKI

Wed Jan 24, 2024 3:21 pm

rpki-verify RPKI is not working and must be a bug in the firmware. Can someone please check?
 
erlinden
Forum Guru
Forum Guru
Posts: 1975
Joined: Wed Jun 12, 2013 1:59 pm
Location: Netherlands

Re: RPKI

Wed Jan 24, 2024 3:32 pm

rpki-verify RPKI is not working and must be a bug in the firmware. Can someone please check?
https://mikrotik.com/support
 
peterborough
just joined
Topic Author
Posts: 7
Joined: Tue Jul 25, 2023 2:27 pm

Re: RPKI

Wed Jan 24, 2024 4:29 pm

I already done this but no response
 
Network5
newbie
Posts: 28
Joined: Sat Mar 22, 2014 11:42 pm

Re: RPKI

Thu Jan 25, 2024 11:37 pm

I'm using RPKI since ROS 7.xx. Never had a problem with that. One session is pointing to Routinator and the second one to Fort validator.
add chain=bgp_rpki disabled=no rule="rpki-verify groupFIRT"
add chain=bgp_rpki disabled=no rule="if (rpki invalid) { reject }"
Pay attention to the filtering order: for example you should filter first rfc5735 then RPKI with reject only, then all other filters with accept rules. Avoid using "if else accept" unless in the last filter rule.

In your example you are using "else" in the RPKI validation. This means that all the filter that follows are useless. If you have another "if else accept" before the RPKI validation the RPKI filtering is useless, because the routes are being accepted before the validation.

Who is online

Users browsing this forum: No registered users and 6 guests