Re: Securing EBGP while getting rid of big IRR-based prefix-list-filters (Was: How long AS-PATH policies have you used)

[Saku Ytti via NANOG <nanog () lists nanog org>]

On Thu, 8 Oct 2026 at 11:50, Martin Tonusoo via NANOG
<nanog () lists nanog org> wrote:

> Perhaps other vendors [6] would also like to implement the support for
> multiple/named RTR databases feature? Support for so-called default
> RTR database is nowadays anyway ubiquitous.

I like this approach, you get rid of prefix-list, but you actually
improve routing security a little bit, because you only honor IRR
objects that are rpki unknown, and even in that case, you still
validate that ASN origin is right (I assume usually people doing
prefix-list filtering do not do that, at least none my employer has
done that).

We've asked Nokia for two features
  1) multiple database RTR
  2) scalable non-regexp ASN origin check

However, functionally it doesn't actually matter to me, if there are
two databases or one database, if I e.g. slurm the 'synthetic'
prefixes to the main RPKI database, I get the same outcome.

The reason, for me, for two databases relates to feeding blackholable
prefixes as /32 permissible. But here also routing-policy language
change would work, something like 'rpki-valid-or-longer' or somesuch,
and I'm not entirely sure if I want one, or another or both.

-- 
  ++ytti
_______________________________________________
NANOG mailing list 
https://lists.nanog.org/archives/list/nanog () lists nanog org/message/G2J52UQHUYHPYL3BNGLI3EWDJOIH7GQC/