Routing Security
RPKI and ROA Checks: A Practical BGP Route Security Guide for Network Teams
Learn how RPKI, ROAs, and route origin validation help network teams reduce BGP route hijack and misannouncement risk.
Short answer
RPKI helps validate whether an ASN is authorized to originate a prefix through ROAs; network teams should check valid, invalid, and unknown route states before outages or provider changes.
Key Takeaways
- RPKI ROAs authorize which ASN can originate a prefix and optional maximum prefix length.
- Invalid route origin states should be treated as urgent routing evidence.
- Provider changes, new advertisements, and prefix deaggregation should trigger an RPKI check.
What RPKI Actually Proves
RPKI lets resource holders publish ROAs that identify which Autonomous System is authorized to originate a prefix. Route origin validation then classifies observed BGP routes as valid, invalid, or unknown.
Where Teams Get Into Trouble
BGP changes often happen during migrations, provider onboarding, DDoS mitigation setup, cloud interconnect work, or emergency route changes. If ROAs are missing or too narrow, legitimate announcements can look invalid. If they are too broad, they may reduce control.
- Provider ASN changed but ROA was not updated.
- Prefix is announced more specifically than the ROA maxLength allows.
- A backup provider is added without authorization.
- Unknown routes are ignored even when the prefix is business-critical.
How to Use RPKI as an Operations Check
Before a BGP change, check the prefix, origin ASN, maxLength, and current route visibility. After the change, confirm the observed route state and keep screenshots or command output with the change record.
Practical Checklist
List owned prefixes and intended origin ASNs.
Check ROA maxLength before deaggregation.
Validate primary and backup provider ASNs.
Check current route state from at least two public validators.
Record invalid or unknown routes with owner and next action.
Add RPKI review to provider migration and incident runbooks.
Questions Teams Ask
Does RPKI stop every BGP hijack?
No. RPKI improves route origin validation; it does not fully validate the entire AS path.
What does an invalid RPKI state mean?
It means there is a ROA, but the observed origin ASN or prefix length does not match the authorization.
When should RPKI be checked?
Check it before provider changes, prefix deaggregation, DDoS routing changes, cloud interconnect work, and public outage investigation.