TTR Networks

Intermediate · RPKI and Route Origin Validation · section 3 of 8

Creating ROAs safely

✓ Lab-tested 17 October 2026 on FRR 10.2.1, StayRTR 0.6.4

A ROA states (prefix, maxLength, origin AS). Create one per prefix-and-origin combination you actually announce.

Rules of thumb

  • Cover everything you announce, IPv4 and IPv6. A ROA for a /22 does not authorise the /24s inside it unless maxLength allows them.
  • Keep maxLength equal to the prefix length unless you really announce every more-specific in that range. A loose maxLength lets an attacker announce a more-specific with a forged origin that validates (RFC 9319, BCP 185).
  • One ROA per origin AS. If the same prefix is legitimately originated by two ASes (a second site, a DDoS-scrubbing service, a cloud provider announcing your space), create a ROA for each.
  • AS0 means "never". A ROA with origin AS0 says the space must not be routed. Some RIRs also publish AS0 ROAs for space they haven't allocated, under separate trust anchors that validators don't use by default.
  • Create ROAs before you change announcements. If you move a prefix to a new origin AS without a ROA for it, the new announcement is Invalid and dropped by much of the internet.
  • Watch for customers. If a customer originates a prefix from your space with their own AS, they need a ROA for that combination, which you sign as the holder.
Example ROA set
# Prefix            maxLength  Origin   Meaning
203.0.113.0/24      24         AS64501  Exactly the /24, from AS64501. The safe default.
2001:db8:500::/48   48         AS64500  Same for IPv6: one ROA per announced prefix.
198.51.100.0/24     24         AS64500  Normally from AS64500…
198.51.100.0/24     24         AS64499  …and also from a DDoS-scrubbing provider during attacks.
192.0.2.0/24        25         AS64502  The /24 and both /25s. Only if all three are announced.
2001:db8:ff00::/40  128        AS0      Unused space: nobody may originate any of it.
  • Lines 2–3: The standard pattern: one ROA per announced prefix, maxLength equal to its length, IPv4 and IPv6.
  • Lines 4–5: Two ROAs for one prefix: a route is Valid if any ROA matches, so the scrubbing provider can originate it during an attack without making your normal announcement Invalid.
  • Line 6: A loose maxLength. Only do this if you really announce the /25s, or a forged-origin /25 becomes possible.
  • Line 7: AS0: any announcement inside this range is Invalid. Useful for space you hold but don't route.

Check your understanding

You announce 203.0.113.0/24 only, and create a ROA with maxLength 26 "for flexibility". What risk have you created?

  • None — a looser ROA just accepts more
  • An attacker can announce a /25 or /26 with your AS as the forged origin, and it will be Valid and more specific than your /24
  • Your /24 becomes Invalid
  • Validators reject ROAs with maxLength above 24