Route Origin Validation

Validators reduce the whole RPKI to a list of Validated ROA Payloads (VRPs): tuples of (prefix, maxLength, origin AS). Your routers compare every BGP route against that list. Route Origin Validation (RFC 6811) gives each route one of three states:

State	Condition
Valid	At least one VRP covers the prefix, its ASN equals the route's origin AS, and the route's prefix length ≤ the VRP's maxLength
Invalid	At least one VRP covers the prefix, but none of them match (wrong origin, or too specific)
NotFound	No VRP covers the prefix at all

A VRP covers a route if the route's prefix is equal to or inside the VRP prefix. The origin AS is the last AS in the AS_PATH. If the path ends in an AS_SET (from old-style aggregation), there is no single origin, so it can never match.

The three states are deliberately asymmetric. NotFound means "no information", which is still most of the old internet, and must be accepted. Only Invalid is evidence that something is wrong.

Try the cases from the lab below, then edit the VRPs. Add a second VRP for the same prefix from a different AS, set maxLength to 25, or create an AS0 VRP.