Deployment checklist
Protect your own space
- Create ROAs for every prefix you announce, IPv4 and IPv6, with maxLength equal to the announced length. Include any extra origins (scrubbing providers, customers originating your space).
- Check them against what you actually announce. bgp.tools, the RIPE NCC's RPKI dashboard and similar tools show whether each of your routes is Valid.
- Add a ROA before any origin change, and remove stale ROAs when you stop announcing.
Validate what you receive
- Run two or more validators, ideally different implementations, close to your routers. Monitor freshness and RTR sessions.
- Connect your routers and start in observe mode: tag routes by state (a community or LOCAL_PREF) without dropping anything, and look at which Invalids you would drop.
- Drop Invalids on all eBGP sessions: customers, peers and transits. Don't deprioritise them, because a lower preference still uses the Invalid route when it's the only one, and the more-specific Invalid wins in forwarding anyway.
- Keep accepting NotFound.
Troubleshooting
| Symptom | Likely cause | Check |
|---|---|---|
| Your new prefix is unreachable from parts of the internet | No ROA, or a ROA with the wrong origin or too short a maxLength, makes it Invalid | Validate your announcement in a public RPKI tool |
| A customer's routes are dropped | Their origin + prefix isn't covered by a ROA you or they signed | show bgp … neighbors X received-routes vs routes, show rpki prefix … |
| Everything shows NotFound | Router not connected to any validator, or VRPs expired | show rpki cache-connection, show rpki prefix-table |
| A route stays dropped after its ROA was fixed | Inbound policy hasn't been re-run since the VRP changed | clear bgp ipv4 unicast <peer> soft in |
Router shows the cache but not (connected) after a validator restart | RTR session state mismatch; waiting for the retry interval | rpki reset |
rpki commands don't exist in FRR | bgpd started without -M rpki | /etc/frr/daemons |
Check your understanding
You're moving 203.0.113.0/24 from AS64501 to a new AS64510. In what order should you work?
- Announce from AS64510, then update the ROA once it's working
- Create a ROA for AS64510 (keeping AS64501's), move the announcement, then remove the old ROA
- Delete all ROAs during the migration so the prefix is NotFound
- Update the IRR route object; RPKI follows automatically
Where next
- IRR, RPSL and AS-SETsPrerequisite · Intermediate · 60 min
How networks publish what they announce and how their neighbours turn it into filters: Internet Routing Registries, whois queries, RPSL objects and attributes, AS-SET expansion, bgpq4, and the pitfalls of unsigned routing data.
- Building a network lab on an Apple Silicon MacAlso on FRR · Beginner · 45 min
Run real network labs on an M-series Mac: native FRR and Linux containers, x86-only images through Rosetta, and full x86 VyOS VMs under QEMU in Docker, with the pitfalls that stop most people and a starter lab that mixes all three.
- OSPF FundamentalsAlso on FRR · Beginner · 70 min
The link-state IGP that runs inside most networks: neighbour adjacencies, LSA flooding, SPF, costs, DR/BDR, areas and LSA types, a hands-on FRR lab, and how OSPF underpins BGP.
- BGP FundamentalsAlso on FRR · Intermediate · 75 min
How the Border Gateway Protocol glues the internet together: autonomous systems, sessions, path attributes, best-path selection, iBGP scaling and a hands-on eBGP lab with real FRR configuration.