<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<meta name="Generator" content="Microsoft Exchange Server">
<!-- converted from text --><style><!-- .EmailQuote { margin-left: 1pt; padding-left: 4pt; border-left: #800000 2px solid; } --></style>
</head>
<body>
<div>
<div dir="auto" style="direction:ltr; margin:0; padding:0; font-family:sans-serif; font-size:11pt; color:black">
Welcome to the club! <br>
<br>
</div>
<div dir="auto" style="direction:ltr; margin:0; padding:0; font-family:sans-serif; font-size:11pt; color:black">
<span id="x_OutlookSignature">
<div dir="auto" style="direction:ltr; margin:0; padding:0; font-family:sans-serif; font-size:11pt; color:black">
Get <a href="https://aka.ms/ghei36">Outlook for Android</a></div>
</span><br>
</div>
<hr tabindex="-1" style="display:inline-block; width:98%">
<div id="x_divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" color="#000000" style="font-size:11pt"><b>From:</b> Francois Lecavalier <Francois.Lecavalier@mindgeek.com><br>
<b>Sent:</b> Thursday, July 4, 2019 8:46:46 PM<br>
<b>To:</b> Ben Maddison; job@ntt.net<br>
<b>Cc:</b> nanog@nanog.org<br>
<b>Subject:</b> RE: CloudFlare issues?</font>
<div> </div>
</div>
</div>
<font size="2"><span style="font-size:11pt;">
<div class="PlainText">>> At this point in time I think the ideal deployment model is to perform<br>
>> the validation within your administrative domain and run your own<br>
>> validators.<br>
<br>
>+1<br>
<br>
We'll definitely look into this shortly. I definitely don't want to leave a security measure in the end of a third party but with my team being so busy it was a quick temp fix.<br>
<br>
> The larger challenge has been related to vendor implementation choices and bugs, particularly on ios-xe. Happy to go into more detail if anyone is interested.<br>
<br>
We are on Juniper MX204's at the edge and they have been solid for the last 60 weeks - we ran into a long list of bugs on other platforms but not on these.<br>
<br>
So I had about 4200 routes marked as invalid. After looking at a sample of them it looks like most of them have a valid ROA with an improper mask length - so there is ultimately a route to these prefixes and at worse would result in "suboptimal" routing -
or should I say: the remote network can't control its route propagation anymore. In most case they are a stub networks with a single /24 reassigned from the upstream provider. I have no traffic going directly to these networks and I don't expect any to go
there anytime soon.<br>
<br>
It's been close to 3 hours now since I dropped them - radio silence.<br>
<br>
Whoever fears implementing RPKI/ROA/ROV, simply don't. It's very easy to implement, validate and troubleshoot.<br>
<br>
-----Original Message-----<br>
From: Ben Maddison <benm@workonline.africa><br>
Sent: Thursday, July 4, 2019 11:51 AM<br>
To: job@ntt.net; Francois Lecavalier <Francois.Lecavalier@mindgeek.com><br>
Cc: nanog@nanog.org<br>
Subject: [External] Re: CloudFlare issues?<br>
<br>
Hi Francois,<br>
<br>
On Thu, 2019-07-04 at 17:33 +0200, Job Snijders wrote:<br>
> Dear Francois,<br>
><br>
> On Thu, Jul 04, 2019 at 03:22:23PM +0000, Francois Lecavalier wrote:<br>
> ><br>
> At this point in time I think the ideal deployment model is to perform<br>
> the validation within your administrative domain and run your own<br>
> validators.<br>
<br>
+1<br>
<br>
><br>
> > But I also have a question for all the ROA folks out there. So far<br>
> > we are not taking any action other than lowering the local-pref - we<br>
> > want to make sure this is stable before we start denying prefixes.<br>
> > So the question, is it safe as of this date to : 1.Accept valid, 2.<br>
> > Accept unknown, 3. Reject invalid? Have any large network who<br>
> > implemented it dealt with unreachable destinations? I'm wondering<br>
> > as I haven't found any blog mentioning anything in this regard and<br>
> > ClouFlare docs only shows example for valid and invalid, but nothing<br>
> > for unknown.<br>
><br>
We have been dropping Invalids since April, and have had only a<br>
(single-digit) handful of support requests related to those becoming unreachable.<br>
<br>
The larger challenge has been related to vendor implementation choices and bugs, particularly on ios-xe. Happy to go into more detail if anyone is interested.<br>
<br>
I would recommend *not* taking any policy action that distinguishes Valid from Unknown. If you find that you have routes for the same prefix/len with both statuses, then that is a bug and/or misconfiguration which you could turn into a loop by taking policy
action on that difference.<br>
<br>
Cheers,<br>
<br>
Ben<br>
This e-mail may be privileged and/or confidential, and the sender does not waive any related rights and obligations. Any distribution, use or copying of this e-mail or the information it contains by other than an intended recipient is unauthorized. If you received
this e-mail in error, please advise me (by return e-mail or otherwise) immediately. Ce courrier �lectronique est confidentiel et prot�g�. L'exp�diteur ne renonce pas aux droits et obligations qui s'y rapportent. Toute diffusion, utilisation ou copie de ce
message ou des renseignements qu'il contient par une personne autre que le (les) destinataire(s) d�sign�(s) est interdite. Si vous recevez ce courrier �lectronique par erreur, veuillez m'en aviser imm�diatement, par retour de courrier �lectronique ou par un
autre moyen.<br>
</div>
</span></font>
</body>
</html>