RPKI not working with protocol pipe
Dewangga Alam
dewanggaba at xtremenitro.org
Tue Sep 28 02:01:23 CEST 2021
Hello!
I just migrating configuration using port pipe recently, but I just
realized the RPKI/ROA validation isn’t working.
Debian 10
Bird 2.0.8
… snip …
ipv4 table master4;
ipv6 table master6;
ipv4 table igptable4;
ipv6 table igptable6;
roa4 table t_roa4;
roa6 table t_roa6;
protocol rpki rpki1 {
roa4 { table t_roa4; };
roa6 { table t_roa6; };
remote “ip.ad.dr.es" port 8282;
retry keep 30;
refresh keep 30;
expire keep 3600;
}
function is_v4_rpki_invalid() {
return roa_check(t_roa4, net, bgp_path.last_nonaggregated) = ROA_INVALID;
}
function is_v6_rpki_invalid() {
return roa_check(t_roa6, net, bgp_path.last_nonaggregated) = ROA_INVALID;
}
protocol pipe pipe1 { # sync routing table igp to master
table master4;
peer table igptable4;
export all;
import all;
}
… snip …
Starting using the filter to call is_v4_rpki_invalid(), isn’t working.
But if the setup without proto pipe, the filter and table t_roa4 and
t_roa6 are able validate the prefix.
The configuration for rpki is working.
# show proto rpki1
Name Proto Table State Since Info
rpki1 RPKI --- up 2021-09-11 Established
Is it possible to pipe Roa with pipe protocol and put the RPKI in place?
Any feedback are welcome and appreciated.
Many thanks.
More information about the Bird-users
mailing list