NTT/AS2914 enabled RPKI OV 'invalid = reject' EBGP policies

Thu Mar 26 13:56:11 UTC 2020

Job,

Congratulations to NTT, AT&T, and others in our community who have deployed
validation on their network edge.  What is really exciting is all the
activity in this and other operator regions that has come together to
promote securing the routing system by combining multiple strategies.  This
shift to leadership by example is a big shift from just using the mailing
list for public shaming anti-social behavior.  (Public shaming should still
be used strategically :-).

While this is an important step, the big win that I see is the larger
project promoting securing the routing system by combining multiple
strategies.  There is significant power in combining multiple strategies
and engaging other organizations to develop their own multi-pronged
approach.  That evangelizing and investing in "leadership by example" has
really accelerated this project in ways that individual engineers struggled
to do so before and as a community where we remained stuck in the past.  By
raising the industry standard for routing security, implementation of these
measures is no longer optional, and that has been done without government
interference.  NTT has invested in bringing this whole package to the NANOG
region -- developing tools, working with other networks and even
competitors, and evangelization of routing security.

I am speaking on my own behalf, but as NANOG has started using social media
and other online tools to promote the knowledge of the community, I will
talk to the PC and staff about curating routing security materials for an
educational playlist.  If there is any chance you could resend a link to
some of your materials, I think that would be beneficial (IRR tools, rpki
validation and planning tools, peerlock implementation)?  I also encourage
any operator with a few spare minutes to poke around manrs.org/isps .

Thanks,
 Sean

Em qui., 26 de mar. de 2020 às 08:32, Job Snijders <job at ntt.net> escreveu:

> Dear group,
>
> Exciting news! Today NTT's Global IP Network (AS 2914) enabled RPKI
> based BGP Origin Validation on virtually all EBGP sessions, both
> customer and peering edge. This change positively impacts the Internet
> routing system.
>
> The use of RPKI technology is a critical component in our efforts to
> improve Internet routing stability and reduce the negative impact of
> misconfigurations or malicious attacks. RPKI Invalid route announcements
> are now rejected in NTT EBGP ingress policies. A nice side effect:
> peerlock AS_PATH filters are incredibly effective when combined with
> RPKI OV.
>
> For NTT, this is the result of a multiyear project, which included
> outreach, education, collaboration with industry partners, and
> production of open source software shared among colleagues in the
> industry.
>
> Shout out to Louis & team (Cloudflare) for the open source GoRTR
> software and the OpenBSD project for rpki-client(8).
>
> I hope some take this news as encouragement to consider RPKI OV
> "invalid == reject"-policies as safe to deploy in their own BGP
> environments too. :-)
>
> If you have questions, feel free to reach out to me directly or the
> NTT NOC at <noc at ntt.net>.
>
> Kind regards,
>
> Job
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mailman.nanog.org/pipermail/nanog/attachments/20200326/c0803023/attachment.html>