RPKI Validator Server Configuration

[onibala]

Can IOS, IOS-XE, or IOS-XR support server functioning as RPKI Validator? This is similar of PKI CA server configuration in any IOS platform.

I want to test it in our Lab without connecting to any RPKI servers in the Internet.

Thanks,

Audie

[balaji.bandi]

check below (is that works ?)

https://community.cisco.com/t5/security-knowledge-base/building-an-ios-xe-offline-root-and-subordinate-certificate/ta-p/4538753

[onibala]

Thanks for the quick response Balaji! This config is for VPN certificate. I am looking for securing BGP Prefix and AS exchange. 

Here are examples:

How to Install an RPKI Validator | RIPE Labs

https://rpki.readthedocs.io/en/latest/

[balaji.bandi]

got you, IOS XE and XR support that features as per the document.

setting offline RPKI Server (not that i have done before)

[onibala]

Balaji,

Please provide the link of how to setup RPKI server.

Thanks!

[M02@rt37 · Accepted solution]

@onibala 

Refer here 

xr: https://beufa.net/fr/blog/rpki-use-routinator-rtr-cache-validator-cisco-ios-xr/

xe: https://www.rheintal-ix.net/tech/rpki/

[balaji.bandi]

check below :

https://xrdocs.io/design/blogs/routinator-hosted-on-xr

https://www.cisco.com/c/en/us/support/docs/ip/border-gateway-protocol-bgp/217020-bgp-rpki-with-xr7-cisco8000-whitepaper.html

https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/iproute_bgp/configuration/xe-3s/irg-xe-3s-book/bgp-origin-as-validation.html

[M02@rt37 · Accepted solution]

Hello @onibala

IOS-XE XR Ok. A doubt about IOS.... because you have a peering with ISP and have the full table.... you need plateform with IOS-XR or XE. Thens it is ok! 

[onibala]

Thanks for replying M02@rt37

I will get the XR or XE as long it can function as RPKI server.

[onibala]

M02@rt37,

I knew already the link given (https://beufa.net/blog/rpki-use-routinator-rtr-cache-validator-cisco-ios-xr/). I will accept it as solution, but I was looking an article from Cisco.com.

Thank You

[onibala]

Anyone has the solution from Cisco.com, and "other than" from beufa.net?

I have seen this link before. Has anyone tried it?

Thanks

[MHM Cisco World]

What you need exactly' you want to try it in lab?

[onibala]

MHM Cisco World,

I want to setup simple setup of 5 (IOS, IOS-XE) routers, with one functioning as the Validator. I am hesitant to buy an XR router functioning as the Validator, and does not work! I have not found an article by Cisco to back it up.

I want to see proof by Cisco that the XR can support the Validator function.

[Harold Ritter · Accepted solution]

Hi @onibala ,

The validator function is normally run on a separate Linux server. As far as I know, XR and XE do not support the RPKI Validator (or equivalent) functionality natively, but they both allow you to run 3rd party applications in a container. This might be an option, but I think the safest implementation would be to run it on a separate Linux server.

Regards,

[onibala]

This is what I suspected Harold. I hope you are wrong though. That is why I was skeptical of the beufa.net article.

Thanks!