What is RPKI?
Resource Public Key Infrastructure
RPKI (Resource Public Key Infrastructure) is a system of signed certificates proving who holds which IP addresses and ASNs, so routers can check BGP origins.
Plain BGP believes whatever it's told: any network can announce any prefix, and mistakes or hijacks spread quickly. RPKI adds cryptographic evidence. The five Regional Internet Registries act as trust anchors and issue resource certificates to their members, listing the address space and AS numbers each one holds. A holder then uses its certificate to sign ROAs (Route Origin Authorizations), each saying "AS 64500 may originate 203.0.113.0/24, up to a maximum length of /24". These objects are published in public repositories. Validator software such as Routinator, rpki-client or FORT downloads them, checks every signature back to the trust anchors, and produces a list of VRPs (validated prefix and origin pairs) that it sends to routers using the RTR protocol.
The router side is Route Origin Validation. For each BGP route it compares the prefix and origin AS against the VRPs and marks the route Valid, Invalid or NotFound; most networks that deploy ROV drop Invalid routes and accept the rest, since plenty of address space still has no ROA. Adoption has grown steadily among large networks, but it isn't universal. RPKI only checks the origin: an attacker who forges your ASN at the end of the path, or a route leak that keeps the right origin, still passes, which is the gap ASPA aims to close. Two classic mistakes are setting a maxLength longer than you actually announce and forgetting to create ROAs for new prefixes before announcing them. The RPKI and Route Origin Validation lesson covers creating ROAs and validating routes in a real FRR lab.
Lessons that use RPKI
- RPKI and Route Origin ValidationTeaches this term · Intermediate · 70 min
Cryptographically signed routing origins: the RPKI trust chain, creating safe ROAs, Valid/Invalid/NotFound, validators and RTR, a real FRR + StayRTR lab, and what ROV can't stop (forged origins, leaks), plus where ASPA comes in.
- IRR, RPSL and AS-SETsIntermediate · 60 min
How networks publish what they announce and how their neighbours turn it into filters: Internet Routing Registries, whois queries, RPSL objects and attributes, AS-SET expansion, bgpq4, and the pitfalls of unsigned routing data.
- Setting up VyOS with basic BGPIntermediate · 50 min
Build a VyOS edge router from scratch: one upstream transit provider, one Internet Exchange route server, and the import and export policy that keeps both safe. Every command and output comes from a real VyOS lab.
- BGP FundamentalsIntermediate · 75 min
How the Border Gateway Protocol glues the internet together: autonomous systems, sessions, path attributes, best-path selection, iBGP scaling and a hands-on eBGP lab with real FRR configuration.