BGP was built to exchange reachability between networks, not to prove that every route announcement is authorized. If an autonomous system announces a prefix, neighboring networks decide whether to accept and prefer that path based on routing policy. RPKI adds a missing piece: a cryptographically verifiable statement about which ASN is allowed to originate a prefix.
That statement is a Route Origin Authorization, or ROA. RPKI does not replace BGP and it does not magically validate the full AS path. It gives operators a way to validate the origin of a route before trusting it.
The three objects you need to understand
Prefix
This is the IP space being announced, such as an IPv4 /24 or IPv6 /48. The resource holder controls the authorization for covered space through the relevant RIR RPKI system.
Origin ASN
The ROA identifies the autonomous system authorized to originate the route. If your network announces the prefix from AS64500, the ROA needs to authorize AS64500 for that prefix.
maxLength
The maximum length controls how specific an authorized route may be. This is powerful and easy to misconfigure. If a ROA covers a /20 with maxLength /24, then authorized more-specifics down to /24 can validate. If you only ever announce the /20, a maxLength of /20 is safer because it authorizes less.
Valid, invalid, and not found
| Validation state | Meaning | Typical operator treatment |
|---|---|---|
| Valid | A covering ROA authorizes the origin ASN and prefix length | Eligible under normal routing policy |
| Invalid | A ROA exists, but the origin ASN or prefix length does not match | Commonly rejected or strongly de-preferenced |
| Not found | No covering ROA is available | Still routable on much of the internet, but lacks RPKI origin authorization |
The dangerous transition is creating a ROA that does not match what you actually announce. The instant networks enforce route-origin validation, your own route can become invalid. That is why RPKI changes should be treated like DNS or firewall changes: compare intended state with live state before and after.
What RPKI protects against
RPKI is effective against a class of accidental route leaks and malicious origin hijacks where the wrong ASN originates space. If a network sees an invalid origin and its policy rejects invalids, that bad route is less likely to propagate or attract traffic.
It does not prove that the entire path is legitimate. A valid origin can still be propagated through an unexpected path. Other BGP security work, including ASPA and operational filtering, addresses different pieces of the routing trust problem.
A safe rollout checklist
- Inventory every prefix and the ASN or ASNs that legitimately originate it.
- Check live BGP announcements from multiple external route collectors.
- Create ROAs with the narrowest practical prefix and maxLength authorization.
- Wait for publication and verify that intended routes show as valid.
- Only then tighten route-origin validation policy on your network.
- Review ROAs whenever you change upstreams, origin ASNs, deaggregate prefixes, or move address space.
Leased IPv4 and RPKI
Leased address space adds an administrative layer because the resource holder and the network originating the route may be different organizations. The lease must include a clear authorization process: LOA for the BGP announcement, IRR objects where applicable, and an RPKI/ROA workflow that authorizes the actual origin ASN.
LogicWeb’s IP leasing includes LOA, IRR, and RPKI/ROA support for eligible space, which is exactly the operational bundle an announcing network should ask about rather than treating the subnet as a bag of addresses.
The operator mindset
RPKI is most useful when it becomes routine. Creating a ROA at the end of a migration project is too late. Put origin authorization in the same change plan as BGP sessions, prefix lists, route objects, reverse DNS, and geolocation. The routing table does not care that the paperwork was “almost done.”
FAQ
What is RPKI in simple terms?
RPKI is a public-key infrastructure for internet number resources. It lets resource holders publish cryptographically verifiable authorizations for which ASN may originate a prefix.
What is a ROA?
A Route Origin Authorization is a signed object that identifies an allowed origin ASN, prefix, and maximum prefix length.
Does RPKI stop all BGP hijacks?
No. Route-origin validation checks the origin authorization, not every hop in the AS path. It addresses an important class of routing incidents but is one layer of BGP security.
Written at the desk
ChadBe the first to weigh in.