hints:rpki
Differences
This shows you the differences between two versions of the page.
| Both sides previous revisionPrevious revisionNext revision | Previous revision | ||
| hints:rpki [2024/03/20 11:22] – [RPKI Hints, Top Tips, and FAQs] philip | hints:rpki [2025/07/05 23:34] (current) – [Installing Go] philip | ||
|---|---|---|---|
| Line 14: | Line 14: | ||
| * [[rpki# | * [[rpki# | ||
| * [[rpki# | * [[rpki# | ||
| + | * [[rpki# | ||
| * [[rpki# | * [[rpki# | ||
| * [[rpki# | * [[rpki# | ||
| * [[rpki# | * [[rpki# | ||
| - | The tips and tricks for the validator builds discussed below all are for Ubuntu | + | The tips and tricks for the validator builds discussed below all are for Ubuntu |
| ===== AS0 TALs ===== | ===== AS0 TALs ===== | ||
| Line 31: | Line 32: | ||
| ===== NLnetLabs Routinator ===== | ===== NLnetLabs Routinator ===== | ||
| - | Nothing to say here, the instructions just work, the validator installs sweetly, and just runs. As long as the instructions are followed. The current version of Routinator is 0.13.2, at time of writing. | + | Nothing to say here, the instructions just work, the validator installs sweetly, and just runs. As long as the instructions are followed. The current version of Routinator is 0.14.2, at time of writing. |
| If using Debian/ | If using Debian/ | ||
| Line 40: | Line 41: | ||
| deb [arch=amd64] https:// | deb [arch=amd64] https:// | ||
| </ | </ | ||
| + | |||
| + | (Note: if you are trying this on Ubuntu 24.04, there is no package for '' | ||
| Then run: | Then run: | ||
| Line 83: | Line 86: | ||
| ===== FORT ===== | ===== FORT ===== | ||
| - | FORT is the validator developed by NIC Mexico. More about it is on the [[https:// | + | FORT is the validator developed by NIC Mexico. More about it is on the [[https:// |
| - | FORT is available as part of Ubuntu 22.04 packaging, but it is an older version (1.5.3-1), so for this reason we use the latest NIC Mexico produced package. | + | FORT is available as part of Ubuntu 22.04 packaging, but it is an older version (1.5.3-1). Likewise |
| FORT is not quite so easy to install, but still relatively simple as long as you follow the instructions on their [[https:// | FORT is not quite so easy to install, but still relatively simple as long as you follow the instructions on their [[https:// | ||
| Line 92: | Line 95: | ||
| < | < | ||
| - | wget https:// | + | wget https:// |
| </ | </ | ||
| and then install it: | and then install it: | ||
| < | < | ||
| - | sudo apt install ./fort_1.6.1-1_amd64.deb | + | sudo apt install ./fort_1.6.6-1_amd64.deb |
| </ | </ | ||
| Line 148: | Line 151: | ||
| and it should run successfully. You should see something like this when you run **systemctl status fort**: | and it should run successfully. You should see something like this when you run **systemctl status fort**: | ||
| < | < | ||
| - | * fort.service - FORT RPKI validator | + | ● fort.service - FORT RPKI validator |
| - | | + | |
| - | Drop-In: / | + | |
| - | | + | |
| - | | + | |
| Docs: man:fort(8) | Docs: man:fort(8) | ||
| | | ||
| - | Main PID: 3100 (fort) | + | Main PID: 148150 |
| - | Tasks: | + | Tasks: |
| - | | + | |
| + | CPU: 27.801s | ||
| | | ||
| - | | + | |
| + | |||
| + | Oct 07 22:58:03 fort systemd[1]: Started fort.service - FORT RPKI validator. | ||
| </ | </ | ||
| You can check by using **ps ax** to get: | You can check by using **ps ax** to get: | ||
| Line 184: | Line 188: | ||
| ===== RPKI-client ===== | ===== RPKI-client ===== | ||
| - | **rpki-client** is just a validator - it does not have the functionality to accept connections from a router. We'll come to that later on (we'll need to use [[rpki# | + | **rpki-client** is just a validator - it does not have the functionality to accept connections from a router. We'll come to that later on (we'll need to use [[rpki# |
| **rpki-client** has now been packaged and is available as part of the Ubuntu 22.04 distribution. However, the packaged version is old (version 7.6). At the time of writing, the current release of **rpki-client** is version 8.7. | **rpki-client** has now been packaged and is available as part of the Ubuntu 22.04 distribution. However, the packaged version is old (version 7.6). At the time of writing, the current release of **rpki-client** is version 8.7. | ||
| Line 198: | Line 202: | ||
| The other required package noted in the instructions is **tls** from LibreSSL. LibreSSL is a branch of OpenSSL and is used on OpenBSD - not found on Linux, but seems to be appearing in the latest Debian/ | The other required package noted in the instructions is **tls** from LibreSSL. LibreSSL is a branch of OpenSSL and is used on OpenBSD - not found on Linux, but seems to be appearing in the latest Debian/ | ||
| - | First we go to [[https:// | + | First we go to [[https:// |
| < | < | ||
| - | wget https:// | + | wget https:// |
| </ | </ | ||
| We then unpack it: | We then unpack it: | ||
| < | < | ||
| - | tar zxf libressl-3.8.3.tar.gz | + | tar zxf libressl-3.9.2.tar.gz |
| </ | </ | ||
| and then build it: | and then build it: | ||
| < | < | ||
| - | cd libressl-3.8.3 | + | cd libressl-3.9.2 |
| ./configure --enable-libtls-only | ./configure --enable-libtls-only | ||
| make | make | ||
| Line 215: | Line 219: | ||
| Note the option to only build **libtls** - we don't need the rest of LibreSSL and it could well interfere with OpenSSL which will already be on the system. Now that **libtls** is built, the **install** action will put the libraries in **/ | Note the option to only build **libtls** - we don't need the rest of LibreSSL and it could well interfere with OpenSSL which will already be on the system. Now that **libtls** is built, the **install** action will put the libraries in **/ | ||
| < | < | ||
| - | -rw-r--r-- | + | -rw-r--r-- |
| - | lrwxrwxrwx | + | -rw-r--r-- |
| - | lrwxrwxrwx | + | lrwxrwxrwx 1 root root |
| - | -rw-r--r-- | + | lrwxrwxrwx 1 root root |
| + | -rw-r--r-- 1 root root | ||
| </ | </ | ||
| Run **sudo ldconfig** so that the system knows about the new libraries. | Run **sudo ldconfig** so that the system knows about the new libraries. | ||
| Line 255: | Line 260: | ||
| sudo make install | sudo make install | ||
| </ | </ | ||
| - | which will install the client in **/ | + | which will install the client in **/ |
| - | < | + | |
| - | wget https://www.arin.net/resources/ | + | |
| - | sudo mv arin.tal /etc/rpki | + | |
| - | </ | + | |
| Now the client can be run. There is no daemon option, it simply runs at the command line, and when it has finished downloading all the VRPs (around 10-15 minutes depending on bandwidth) it exits. But that's okay. Try running the client: | Now the client can be run. There is no daemon option, it simply runs at the command line, and when it has finished downloading all the VRPs (around 10-15 minutes depending on bandwidth) it exits. But that's okay. Try running the client: | ||
| < | < | ||
| Line 277: | Line 279: | ||
| </ | </ | ||
| and that's it. Every hour, cron will run **rpki-client** which will produce JSON output of all the VRPs it has collected. As noted above, JSON output is what is used by StayRTR and GoRTR as their input sources. Make sure that the **/ | and that's it. Every hour, cron will run **rpki-client** which will produce JSON output of all the VRPs it has collected. As noted above, JSON output is what is used by StayRTR and GoRTR as their input sources. Make sure that the **/ | ||
| + | |||
| + | If you would like to include the [[https:// | ||
| + | < | ||
| + | / | ||
| + | </ | ||
| It's a good idea to check the log file in case **rpki-client** reports issues trying to write local files etc. But mostly what you'll see there are all the transactions with the various CAs, and the problems encountered (there will be lots, unfortunately). | It's a good idea to check the log file in case **rpki-client** reports issues trying to write local files etc. But mostly what you'll see there are all the transactions with the various CAs, and the problems encountered (there will be lots, unfortunately). | ||
| Line 283: | Line 290: | ||
| ===== StayRTR ===== | ===== StayRTR ===== | ||
| - | StayRTR is a hard fork of [[rpki# | + | StayRTR is a hard fork of GoRTR (which is no longer maintained by Cloudflare |
| - | StayRTR has now been packaged and is available as part of the Ubuntu 22.04 distribution. However, the packaged version is old (version | + | StayRTR has now been packaged and is available as part of the Ubuntu 22.04 distribution |
| So for this reason, and to stay up to date, at least on Ubuntu, we have to build it ourselves. A pity that the **StayRTR** maintainers don't build their own deb package, or pre-build packages like NLnetLabs do with Routinator. | So for this reason, and to stay up to date, at least on Ubuntu, we have to build it ourselves. A pity that the **StayRTR** maintainers don't build their own deb package, or pre-build packages like NLnetLabs do with Routinator. | ||
| Line 293: | Line 300: | ||
| First you will need a working Go environment. Full instructions are at [[https:// | First you will need a working Go environment. Full instructions are at [[https:// | ||
| - | First off, download the latest Go package (1.22.1 at time of writing): | + | First off, download the latest Go package (1.24.4 at time of writing): |
| < | < | ||
| - | wget https:// | + | wget https:// |
| </ | </ | ||
| If you have an existing Go environment, | If you have an existing Go environment, | ||
| Line 305: | Line 312: | ||
| cd /usr/local | cd /usr/local | ||
| sudo chmod 777 . | sudo chmod 777 . | ||
| - | tar xzf ~/go1.22.1.linux-amd64.tar.gz | + | tar xzf ~/go1.24.4.linux-amd64.tar.gz |
| sudo chmod 755 . | sudo chmod 755 . | ||
| </ | </ | ||
| Line 335: | Line 342: | ||
| < | < | ||
| cd dist | cd dist | ||
| - | sudo cp -p stayrtr-v0.5.1-47-gfebec67-linux-x86_64 / | + | sudo cp -p stayrtr-v0.6.2-linux-x86_64 / |
| - | sudo cp -p rtrdump-v0.5.1-47-gfebec67-linux-x86_64 / | + | sudo cp -p rtrdump-v0.6.2-linux-x86_64 / |
| - | sudo cp -p rtrmon-v0.5.1-47-gfebec67-linux-x86_64 / | + | sudo cp -p rtrmon-v0.6.2-linux-x86_64 / |
| </ | </ | ||
| Line 419: | Line 426: | ||
| and you should see something like this: | and you should see something like this: | ||
| < | < | ||
| - | * stayrtr.service - StayRTR RPKI to Router Server | + | ● stayrtr.service - StayRTR RPKI to Router Server |
| - | | + | |
| - | | + | |
| - | Docs: https:// | + | Docs: https:// |
| - | Tasks: | + | Main PID: 44045 (stayrtr) |
| + | Tasks: | ||
| + | Memory: | ||
| + | CPU: 3.805s | ||
| | | ||
| - | | + | |
| - | Jan 28 15:50:27 stayrtr | + | |
| - | Jan 28 15:50:27 stayrtr | + | Aug 15 16:57:06 rpki systemd[1]: Starting |
| - | Jan 28 15:50:27 stayrtr | + | Aug 15 16:57:07 rpki systemd[1]: Started |
| - | Jan 28 15:50:28 stayrtr | + | Aug 15 16:57:10 rpki stayrtr[44045]: time="2024-08-15T16:57:10+06:00" level=info |
| - | Jan 28 15:50:29 stayrtr | + | Aug 15 16:57:11 rpki stayrtr[44045]: time="2024-08-15T16:57:11+06:00" level=info |
| - | Jan 28 15:50:29 stayrtr stayrtr[17390]: | + | Aug 15 16:57:11 rpki stayrtr[44045]: time="2024-08-15T16:57:11+06:00" level=info |
| </ | </ | ||
| and you can also run the more traditional **ps ax** to see something like: | and you can also run the more traditional **ps ax** to see something like: | ||
| < | < | ||
| - | 17390 ? Ssl 0:04 / | + | 44045 ? Ssl 0:03 / |
| </ | </ | ||
| And that's it. Enjoy your new StayRTR installation. | And that's it. Enjoy your new StayRTR installation. | ||
| - | ===== GoRTR ===== | ||
| - | I've included GoRTR here though it is no longer maintained by Cloudflare as the maintainer has moved on to pastures new. All development work is now being carried out on [[rpki# | + | ===== Cisco IOS-XE Hints ===== |
| - | I'll be very clear - **please don't use GoRTR**. I still run it for interest sake. For production, [[rpki# | + | This section shows the basic configuration needed to get route origin validation up and running on Cisco IOS-XE platforms. |
| - | As with StayRTR, you need a working Go environment. Please consult | + | Most commentary is for IOS-XE 16.x. Older versions will also likely work with the following examples, but their RPKI implementation is somewhat old and buggy. |
| + | ==== IOS-XE Configuration with Validator ==== | ||
| - | ==== Installing GoRTR ==== | + | Setting up a Cisco IOS-XE router |
| - | + | ||
| - | Easiest way to do this is to build from the [[https:// | + | |
| - | + | ||
| - | **Note1**: You could download and use the provided [[https:// | + | |
| - | + | ||
| - | **Note2**: You could even download the [[https:// | + | |
| - | + | ||
| - | But we will focus on building from the source. | + | |
| < | < | ||
| - | git clone https:// | + | router bgp <ASN> |
| - | cd gortr | + | bgp rpki server tcp <ip address> port < |
| - | make build-gortr build-rtrmon build-rtrdump | + | |
| </ | </ | ||
| - | which builds **gortr** as well as **rtrmon** | + | where <ip address> is the IP address (IPv4 or IPv6) of the validator, < |
| - | Copy the resulting binaries to **/ | + | Doing this will download |
| - | < | + | |
| - | cd dist | + | |
| - | sudo cp -p gortr-v0.14.8-5-g9f01dca-linux-x86_64 / | + | |
| - | sudo cp -p rtrdump-v0.14.8-5-g9f01dca-linux-x86_64 / | + | |
| - | sudo cp -p rtrmon-v0.14.8-5-g9f01dca-linux-x86_64 / | + | |
| - | </ | + | |
| - | GoRTR has lots of options, but the ones we need are these: | + | To find out what is in the validation database (IPv4 and IPv6 commands shown): |
| < | < | ||
| - | -bind string | + | show ip bgp rpki table |
| - | Bind address (default ": | + | show bgp ipv6 rpki table |
| - | | + | |
| - | URL of the cached JSON data (default " | + | |
| - | | + | |
| - | Check if file is still valid (default true) | + | |
| - | | + | |
| - | Check signature using provided public key (disable by passing -verify=false) | + | |
| </ | </ | ||
| - | We don't need to use the Cloudflare JSON source, given we have our own from the newly created RPKI-client. RPKI-client doesn' | + | and to find out the status of the connection |
| - | + | ||
| - | We run GoRTR like this: | + | |
| < | < | ||
| - | / | + | show ip bgp rpki servers |
| </ | </ | ||
| - | which will at least let us test that it works. Run it and see what happens - you should see output at the command line looking like this: | ||
| - | < | ||
| - | INFO[0001] New update (304138 uniques, 304138 total prefixes). 0 bytes. Updating sha256 hash -> 0592ddc6e9a82666f8ddc5eda8cad76cb61f22640f17199b1bff06b5928b9718 | ||
| - | INFO[0002] Updated added, new serial 0 | ||
| - | INFO[0002] GoRTR Server started (sessionID: | ||
| - | </ | ||
| - | And if you check the ports that are listening (**ss -an**) you will see: | ||
| - | < | ||
| - | tcp LISTEN | ||
| - | tcp LISTEN | ||
| - | </ | ||
| - | Port 3323 is the listening port for Router connections. And Port 8080 is the metrics port, for monitoring systems to connect to. | ||
| - | But perhaps this isn't good for long term operations as you'd prefer to have this start running automatically when the system starts. And for that we'd need to set up a suitable | + | ==== Cisco IOS-XE Caveats ==== |
| + | |||
| + | Cisco IOS-XE has many defaults which are non-standard and will be potentially frustrating | ||
| + | * Cannot specify a source-interface | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | * If validator disappears, router validation database is flushed within a few minutes - fixed in most recent IOS-XE 16.6 releases | ||
| - | First off, let's create a user for GoRTR (it does not have to run as root): | + | To turn off the checking of the RPKI validation database |
| < | < | ||
| - | sudo groupadd _gortr | + | router bgp <ASN> |
| - | sudo useradd –g _gortr –s / | + | address-family ipv4 |
| + | bgp bestpath prefix-validate disable | ||
| + | | ||
| + | bgp bestpath prefix-validate disable | ||
| </ | </ | ||
| - | Next we create a file **/ | + | The ROAs are still listed in the RPKI table but the router will not use them. (This should be the default, as per RFC.) |
| - | < | + | |
| - | # Settings for GoRTR. Consult https:// | + | |
| - | # more discussion and other available options | + | |
| - | GORTR_ARGS=-bind :3323 -verify=false -cache / | + | To turn off the automatic dropping of invalids: |
| - | # | + | |
| - | </ | + | |
| - | Then we go to the **/ | + | |
| < | < | ||
| - | [Unit] | + | router bgp <ASN> |
| - | Description=GoRTR RPKI to Router Server | + | address-family ipv4 |
| - | Documentation=https:// | + | bgp bestpath prefix-validate allow-invalid |
| - | After=network.target | + | address-family ipv6 |
| - | + | bgp bestpath prefix-validate allow-invalid | |
| - | [Service] | + | |
| - | EnvironmentFile=/ | + | |
| - | ExecStart=/ | + | |
| - | Type=exec | + | |
| - | User=_gortr | + | |
| - | Group=_gortr | + | |
| - | AmbientCapabilities=CAP_NET_BIND_SERVICE | + | |
| - | CapabilityBoundingSet=CAP_NET_BIND_SERVICE | + | |
| - | + | ||
| - | [Install] | + | |
| - | WantedBy=multi-user.target | + | |
| </ | </ | ||
| - | We then need to enable it: | + | A new set up of RPKI in a Cisco IOS-XE network should start with " |
| < | < | ||
| - | sudo systemctl enable gortr | + | router bgp < |
| + | | ||
| + | bgp bestpath prefix-validate disable | ||
| + | bgp bestpath prefix-validate allow-invalid | ||
| + | | ||
| + | bgp bestpath prefix-validate disable | ||
| + | bgp bestpath prefix-validate allow-invalid | ||
| </ | </ | ||
| - | which then displays: | ||
| - | < | ||
| - | Created symlink / | ||
| - | </ | ||
| - | and then we can run GoRTR, like this: | ||
| - | < | ||
| - | sudo systemctl start gortr | ||
| - | </ | ||
| - | Once it is running, check that it is working by running: | ||
| - | < | ||
| - | sudo systemctl status gortr | ||
| - | </ | ||
| - | and you should see something like this: | ||
| - | < | ||
| - | * gortr.service - GoRTR RPKI to Router Server | ||
| - | | ||
| - | Drop-In: / | ||
| - | | ||
| - | | ||
| - | Docs: https:// | ||
| - | Main PID: 170962 (gortr) | ||
| - | Tasks: 14 (limit: 38463) | ||
| - | | ||
| - | | ||
| - | | ||
| - | Dec 27 13:14:43 gortr gortr[170962]: | + | Once they are ready to implement RPKI, first remove the '' |
| - | Dec 27 13:24:46 gortr gortr[170962]: | + | |
| - | Dec 27 13:24:50 gortr gortr[170962]: | + | The major show-stopper for an IOS-XE based network is the insertion of validation check in the BGP path selection process, over-riding '' |
| - | </ | + | |
| - | and you can also run the more traditional **ps ax** to see something like: | + | To propagate |
| < | < | ||
| - | | + | neighbor x.x.x.x announce |
| </ | </ | ||
| + | Please do **NOT** do this, as there are operational consequences, | ||
| - | And that' | + | **Summary: |
| - | ===== Cisco IOS-XE Hints ===== | + | ===== Cisco IOS-XR Hints ===== |
| - | This section shows the basic configuration needed to get route origin validation up and running on a Cisco IOS-XE platform. (Cisco IOS-XR | + | This section shows the basic configuration needed to get route origin validation up and running on Cisco IOS-XR |
| - | Most commentary is for IOS-XE 16.x onwards. | + | Most commentary is for IOS-XR 7.5 onwards. |
| - | ==== Configuration with Validator ==== | + | ==== IOS-XR |
| - | Setting up a Cisco router to talk with a validator is simple: | + | Setting up a Cisco IOS-XR |
| < | < | ||
| router bgp <ASN> | router bgp <ASN> | ||
| - | bgp rpki server | + | rpki server <ip address> |
| + | bind-source interface Loopback0 | ||
| + | transport tcp port < | ||
| + | | ||
| + | response-time 600 | ||
| </ | </ | ||
| - | where <ip address> is the IP address (IPv4 or IPv6) of the validator, < | + | where <ip address> is the IP address (IPv4 or IPv6) of the validator, < |
| To find out what is in the validation database (IPv4 and IPv6 commands shown): | To find out what is in the validation database (IPv4 and IPv6 commands shown): | ||
| Line 600: | Line 555: | ||
| and to find out the status of the connection to the validator: | and to find out the status of the connection to the validator: | ||
| < | < | ||
| - | show ip bgp rpki servers | + | show ip bgp rpki server summary |
| </ | </ | ||
| - | ==== Caveats ==== | + | To turn on validation |
| - | + | ||
| - | Cisco IOS-XE has many defaults which are non-standard and will be potentially frustrating | + | |
| - | * Automatically activates route origin validation (cannot be turned off!) | + | |
| - | * Automatically drops invalids (can be turned off!) | + | |
| - | * Locally originated | + | |
| - | * Automatically prefers Valid path over Invalid/ | + | |
| - | * If validator disappears, router validation database is flushed within a few minutes - fixed in most recent IOS-XE 16.x releases | + | |
| - | + | ||
| - | To turn off the automatic dropping of invalids: | + | |
| < | < | ||
| router bgp <ASN> | router bgp <ASN> | ||
| - | bgp bestpath | + | |
| + | bgp origin-as validation enable | ||
| + | bgp bestpath | ||
| + | bgp bestpath origin-as | ||
| + | ! | ||
| + | | ||
| + | bgp origin-as validation enable | ||
| + | bgp bestpath origin-as use validity | ||
| + | bgp bestpath origin-as allow invalid | ||
| </ | </ | ||
| - | To propagate the validation | + | The above enables origin |
| + | |||
| + | Once you are ready to drop invalids, as per recommended best practices: | ||
| < | < | ||
| - | neighbor x.x.x.x announce rpki state | + | router bgp < |
| + | address-family ipv4 unicast | ||
| + | no bgp bestpath origin-as allow invalid | ||
| + | address-family ipv6 unicast | ||
| + | no bgp bestpath origin-as allow invalid | ||
| </ | </ | ||
| - | Please do **NOT** do this, as there are operational consequences, | ||
| - | **Summary: | + | To display the validation state of prefixes, you can use the following command: |
| - | + | ||
| - | ==== Implementing Route Origin Validation ==== | + | |
| - | + | ||
| - | The final step in Cisco IOS-XE is to implement Route Origin Validation. This is achieved simply by turning off the knob we noted above that automatically drops //invalid// prefixes. | + | |
| < | < | ||
| - | router | + | RP/ |
| - | no bgp bestpath prefix-validate allow-invalid | + | |
| + | not-found filter routes with unknown (not found) origin-as | ||
| + | standby | ||
| + | valid filter routes with valid origin-as | ||
| + | | Output Modifiers | ||
| + | <cr> | ||
| </ | </ | ||
| + | The sub-options will display all the prefixes fitting into each category. | ||
| ===== Juniper Hints ===== | ===== Juniper Hints ===== | ||
hints/rpki.1710933761.txt.gz · Last modified: by philip