RPKI not working with protocol pipe
    Dewangga Alam 
    dewanggaba at xtremenitro.org
       
    Tue Sep 28 02:01:23 CEST 2021
    
    
  
Hello!
I just migrating configuration using port pipe recently, but I just
realized the RPKI/ROA validation isn’t working.
Debian 10
Bird 2.0.8
… snip …
ipv4 table master4;
ipv6 table master6;
ipv4 table igptable4;
ipv6 table igptable6;
roa4 table t_roa4;
roa6 table t_roa6;
protocol rpki rpki1 {
  roa4 { table t_roa4; };
  roa6 { table t_roa6; };
  remote “ip.ad.dr.es" port 8282;
  retry keep 30;
  refresh keep 30;
  expire keep 3600;
}
function is_v4_rpki_invalid() {
  return roa_check(t_roa4, net, bgp_path.last_nonaggregated) = ROA_INVALID;
}
function is_v6_rpki_invalid() {
  return roa_check(t_roa6, net, bgp_path.last_nonaggregated) = ROA_INVALID;
}
protocol pipe pipe1 {			# sync routing table igp to master
        table master4;
        peer table igptable4;
        export all;
        import all;
}
… snip …
Starting using the filter to call is_v4_rpki_invalid(), isn’t working.
But if the setup without proto pipe, the filter and table t_roa4 and
t_roa6 are able validate the prefix.
The configuration for rpki is working.
# show proto rpki1
Name       Proto      Table      State  Since         Info
rpki1      RPKI       ---        up     2021-09-11    Established
Is it possible to pipe Roa with pipe protocol and put the RPKI in place?
Any feedback are welcome and appreciated.
Many thanks.
    
    
More information about the Bird-users
mailing list