Presentation that Shane Hermoso delivered at HKNOG 11.0 on State of RPKI in HK and East Asia on 14 October.

1. 1
State of RPKI in HK and East Asia
HKNOG 11.0
Sheryl (Shane) Hermoso
APNIC

2. 2
2
Agenda
• RPKI in a nutshell
• RPKI deployment status in East Asia
• RPKI deployment status in HK
• Common issues

3. 3
RPKI in a nutshell
RPKI
robust security framework for verifying the
association between resource holders and
their Internet number resources
ROA
digitally signed, cryptographic
object that contains IP prefixes
mapped to an ASN
Image source: Cloudflare
Image source: Internet

4. 4
Route Origin Authorization
What is contained in a ROA?
For example:
“ISP 4 permits AS65551 to originate a route for the prefix198.51.100.0/24”
The AS number you have authorized
The prefix that is being originated from it
The most specific prefix (maximum length) that the AS may announce

5. 5
5
Route Origin Validation
Valid
The prefix (prefix length) and AS pair found in the database
Invalid
Prefix is found, but origin-AS is wrong, OR
The prefix length is longer than the maximum length
Not Found / Unknown
Neither valid nor invalid (perhaps not created)

6. 6
6
ROA Coverage - Asia-Pacific
https://stats.labs.apnic.net/roa/XD

7. 7
ROA Coverage - Asia-Pacific
Compared to SEA & South Asia (in the region), Eastern Asia
is a bit behind

8. 8
8
ROA Coverage – East Asia
https://stats.labs.apnic.net/roa/XS

9. 9
ROA Coverage – East Asia
Compared to other economies in EA, Hong Kong is doing
well at 50.3% (IPv4) and 46.6% (IPv6) ROA coverage.

10. 10
10
ROA Coverage – CN
CNNIC launched its RPKI service in 2017*
Low adoption could be related to BGP not
being common for many networks
* https://blog.apnic.net/2019/02/14/rpki-in-china/

11. 11
11
ROA Coverage – KR
KISA is not providing RPKI service yet

12. 12
12
ROA Coverage – JP
JPNIC RPKI service since 2015*
Steady increase since then
*https://blog.apnic.net/2019/07/10/long-chopsticks-in-heaven-the-importance-of-cooperating-when-it-comes-to-roas/

13. 13
13
ROA Coverage – TW
Has reached 98% ROA coverage in 2018*
Taiwan RPKI Day held in 2020
Moves into automatic filtering
*https://blog.apnic.net/2020/10/16/98-of-taiwans-ip-address-holders-have-signed-rpki-roas/

14. 14
14
ROA Coverage – MN
*https://blog.apnic.net/2021/01/21/mongolia-hits-100-roa-coverage/
Has reached 100% ROA coverage in 2021*
Community effort as part of mnNOG

15. 15
15
ROA Coverage – Hong Kong
https://stats.labs.apnic.net/roa/HK

16. 16
16
ROA Coverage – Hong Kong

17. 17
17
ROA Coverage – Hong Kong

18. 18
18
ROA Coverage – HK
https://www.hkix.net/hkix/route-policy.htm
HKIX deployed RPKI validation in 2020*

19. 19
19
Top ASNs in the list …

20. 20
20
… and those with no ROAs yet

21. 21
21
ROA Coverage – Hong Kong
% invalid

22. 22
RPKI Invalids

23. 23
Routing Incidents in HK?
https://bgpstream.crosswork.cisco.com/event/298247 https://bgpstream.crosswork.cisco.com/event/298253

24. 24
Routing Incidents in HK?
https://bgpstream.crosswork.cisco.com/event/297988
https://bgpstream.crosswork.cisco.com/event/298222

25. 25
25
RPKI/ROV Sessions @ APNIC
Facilitated by APNIC Retained Community Trainers (RCTs)
and target their local economies to conduct RPKI tutorial and
assist in creating ROAs and fixing invalids.

26. 26
26
Common Issue – Invalid AS
Usually due to sub-delegation, where delegated /24 blocks to
customers are not updated.
https://bgp.he.net/AS140733#_prefixes
https://bgp.he.net/AS140951#_prefixes

27. 27
27
Common Issue – MaxLength
Prefix announced is not covered by ROA
https://rpki.cloudflare.com/?view=bgp&prefix=114.134.81.0%2F24&asn=9304
https://bgp.he.net/net/114.134.81.0/24

28. 28
28
Other Challenges
• Fixing Invalids
– Especially for large providers, when they change size of prefix
announcements it needs to be updated in MyAPNIC
– Concerns about causing outage
• Leased IP address blocks
– Mostly from another region
– Process to update the ROA
• Account-related issues
– Who can create ROA in the organization?

29. 29
Create ROAs
Hosted Model is where APNIC performs
the CA functions
Provisioning model is where
members operate a full RPKI system
and syncs with APNIC via RRDP
protocol.
If you have any IP address block, create your ROAs now

30. 30
Implement ROV – RTR Protocol
router bgp 131107
bgp rpki server tcp <validator-IP> port <323/8282/3323> refresh 120
Example Cisco configuration:
bgp bestpath prefix-validate allow-invalid
* Cisco IOS by default does not include invalid routes for best path selection!
Check router support for RPKI

31. 31
Drop Invalids
Many providers are already
dropping invalid routes
Are network operators in HK
already doing this?
This example is from my home ISP J
https://isbgpsafeyet.com/

32. 32
32
Conclusion
• Good progress with RPKI adaption so far, but more to do
• Working as a community for a collective goal to reach 100%
ROA coverage
• How can APNIC help?

33. 33
Thanks! Questions?
Feedback: https://bit.ly/3T2nnYX