Subject: [sidr] Violation of RFC 6811 - Route Selection Algorithm Due To RPKI State

From: Mark Tinka <[email-masked]>
Date: Tue, 11 Nov 2014 08:17:29 +0200

Hello all.

In operating RPKI on Cisco IOS and IOS XE devices, we note 
that this vendor is deliberately making BGP best path 
decisions based on RPKI state of a route without the 
explicit input of operator-based routing policy.

So in addition to the normal (i.e., historically known) BGP 
best path decision process, the presence of an RTR session 
causes this vendor to, by default, add RPKI state to the BGP 
best path decision process when there does not exist a 
routing policy initiated by the operator to do so.

This is in violation of RFC 6811, Section 2, which clearly 
states:

	"An implementation MUST NOT exclude a route from the
	 Adj-RIB-In or from consideration in the decision
	 process as a side effect of its validation state,
	 unless explicitly configured to do so."

Official documentation from the vendor confirms this default 
behaviour as well:

	http://tinyurl.com/pqpjmen

While the vendor provides knobs to disable this default 
behaviour, operators could generally miss this information. 
And given that there is no clear reason why a "normally" 
best path would be rejected on grounds of RPKI state not 
initiated by the operator, this is a hard problem to 
troubleshoot, even with prior (working) knowledge of RPKI.

Cheers,

Mark.

---

From: Christopher Morrow <[email-masked]>
Date: Tue, 11 Nov 2014 02:39:04 -0500

> explicit input of operator-based routing policy.

ro-ro-shaggy... that seems like a poor plan.

> routing policy initiated by the operator to do so.

oh.. that's super not cool.

>         http://tinyurl.com/pqpjmen

<sad panda>

> troubleshoot, even with prior (working) knowledge of RPKI.

sorry :(

> Cheers,
>
> Mark.
>
> _______________________________________________
> sidr mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/sidr
>