RPKI ROAs

RPKI is a system that cryptographically states which autonomous system may announce a given IP prefix. A ROA is the signed object that says ASN X may originate prefix P up to a maximum length L. Other networks run validators that compare BGP updates to those ROAs and mark each route valid, invalid, or not found. Invalid routes are the ones that get dropped. A valid ROA that names the wrong ASN is a common way to take your own prefix offline, so you should review the object carefully before it goes live.

Match the ROA to the origin you actually announce

If LogicWeb announces the prefix, the ROA should name our ASN. If you announce it from your own ASN, the ROA should name yours instead. Those are separate BGP sessions and separate objects, so you need a clear plan for who originates the space. Two ROAs for two different origins can leave validators choosing one path while the other looks like an outage. Not-found status is still accepted at some networks and rejected at others. Invalid status is treated as a drop at many networks you care about reaching. Coordinate the origin first, then publish the matching ROA.

Choose maxLength with care

maxLength is the other control on the ROA. Setting it too wide can authorize more-specific prefixes you never meant to allow, such as a /25 carved from a /24 that still passes RPKI because you signed for it. Setting it too tight can break a plan to announce two /25s from a /24, or a /24 from a /22, because the more-specific becomes invalid. Sketch the covering aggregate and every more-specific you intend to announce before you create the ROA. Length choices matter in the default-free zone, and they are not something you can fix after traffic is already missing.

Confirm reachability the right way

Filters at other networks may still require a /24 for IPv4 to be globally routed even when maxLength would allow a longer prefix. An RPKI-valid route at a length nobody installs remains invisible. IPv6 has similar limits: many networks will not accept prefixes longer than a /48. Plan the announcement length first, then the ROA, then the BGP session. A looking glass that shows the prefix with the origin you intended, plus a validator that reports valid, is the real check. Ping alone does not prove global acceptance. If you cannot share a looking-glass result yet, send us the prefix and the ASN you intend to use so we can review the plan with you.