<!DOCTYPE html>
<html>
<head>
<meta http-equiv="Content-Type" content="text/xhtml; charset=utf-8">
</head>
<body>
<div style="font-family:sans-serif"><div style="white-space:normal">
<p dir="auto">I was hoping someone else would respond before me:</p>
<p dir="auto">In general I feel that organisations that publish RPKI data should also reject invalids, or we end up possibly passing on hijacked announcements which we set out to stop in the first place.</p>
<p dir="auto">However, AFRINIC is one of the atypical organisations that may not do that at least not for all their network for the very same reasons spelt out in the first part of that article.</p>
<p dir="auto">In short the training (and likely other) teams would likely appreciate stats on how many invalids look like typos rather than hijacks.</p>
<p dir="auto">Therefore, what could be useful is an approach where:</p>
<ol>
<li>
<p dir="auto">AFRINIC border routers tag invalids so a route collector doing stats generation has access to the invalid routes for analysis. It will be very important for this collector to have a public facing looking glass or some sort of output that can be seen due to point 2.</p>
</li>
<li>
<p dir="auto">The routers that act as the “gateways” for the AFRINIC servers, corporate network(s), i.e parts not participating in analysis (1) above would then drop the invalids.</p>
</li>
<li>
<p dir="auto">Reachability issues to AFRINIC members (or anyone worldwide really) due to 2 would need to be checked against possible errors based on data available in (1) and possibly trigger direct outreach/training/.. efforts.</p>
</li>
</ol>
<p dir="auto">my 2 cents.</p>
<p dir="auto">On 14 Apr 2021, at 9:50 EAT, Amreesh Phokeer wrote:</p>
</div><blockquote style="border-left:2px solid #5855D5; color:#5855D5; margin:0 0 5px; padding-left:5px"><div id="ECA3CEF4-3D97-4AFD-A1F7-EB96F431116D"><div dir="ltr">Hi all,<div><br></div><div>Just to spark some discussions here. What do you think about AFRINIC dropping invalids?</div><div><br></div><div>Cheers,</div><div>Amreesh</div><div><br></div><div><br><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">---------- Forwarded message ---------<br>From: <strong class="gmail_sendername" dir="auto">Nathalie Trenaman</strong> <span dir="auto"><<a href="mailto:nathalie@ripe.net">nathalie@ripe.net</a>></span><br>Date: Tue, Apr 13, 2021 at 5:28 PM<br>Subject: [routing-wg] RPKI Route Origin Validation on RIPE NCC Network<br>To: <<a href="mailto:routing-wg@ripe.net">routing-wg@ripe.net</a>><br></div><br><br>Dear colleagues,<br>
<br>
(My colleagues are drafting a reply on the rsync issue)<br>
<br>
Following up on my previous email and the discussion we had in this mailing last about enabling Route Origin Validation (ROV) invalid == reject on the RIPE NCC’s network, AS3333, I am happy to inform you that we will be going ahead on Monday, 19 April. <br>
<br>
I have written a RIPE Labs article with more information, which you can find at:<br>
<a href="https://labs.ripe.net/author/nathalie_nathalie/rpki-and-as3333-or-how-we-eat-our-own-dogfood/" rel="noreferrer" target="_blank">https://labs.ripe.net/author/nathalie_nathalie/rpki-and-as3333-or-how-we-eat-our-own-dogfood/</a><br>
<br>
Thank you very much for your contributions, discussion and support.<br>
<br>
Kind Regards,<br>
<br>
Nathalie Trenaman<br>
Routing Security Programme Manager<br>
RIPE NCC<br>
<br>
<br>
</div><br clear="all"><div><br></div>-- <br><div dir="ltr" class="gmail_signature" data-smartmail="gmail_signature">Amreesh Phokeer<br></div></div></div></div></blockquote>
<div style="white-space:normal">
</div><div style="white-space:normal"><blockquote style="border-left:2px solid #5855D5; color:#5855D5; margin:0 0 5px; padding-left:5px"><p dir="auto">_______________________________________________
<br>
RPKI-Discuss mailing list
<br>
RPKI-Discuss@afrinic.net
<br>
<a href="https://lists.afrinic.net/mailman/listinfo/rpki-discuss">https://lists.afrinic.net/mailman/listinfo/rpki-discuss</a>
</p>
</blockquote></div>
<div style="white-space:normal">
<p dir="auto">--<br>
patrick</p>
</div></div>
</body>
</html>