Defense in depth for a protocol designed when the internet was 50 routers and everyone knew each other personally. We're putting locks on a tent.
Still running it though. What choice do we have.
Member
Following this thread with interest. We're looking at RPKI for our Wellington office but the APNIC documentation is... scattered. The myAPNIC portal works fine for allocations but the ROA interface feels like an afterthought.
Has anyone here actually automated their ROA management? Like API calls rather than clicking through the web interface?
APNIC has an API but it's SOAP and you need to request access separately from your normal portal login. Took me two support tickets.
ARIN has a REST API that's decent. RIPE is probably the best of the bunch with their certificate-based auth. Can't speak to LACNIC or AFRINIC.
For automation I use
rpki-client
RIPE's API is decent but their rate limits are aggressive if you're doing anything at scale. I hit 429s trying to sync a /20's worth of ROAs during a renumbering project last year. Their web interface is at https://www.ripe.net if you need it.
For IRR I still end up using whois email templates with RIPE because their web updates are slower. It's 2024 and I'm sending auto-formatted emails like it's 1998. Works though.
Member
Not fully automated but I use APNIC's API for create and delete. The SOAP is annoying but once you have the WSDL it's fine. I do not trust it enough for emergency rollback though. For that I keep the myAPNIC login ready and a document with screenshots.
Vietnam connections to APNIC are okay, not great. Sometimes I need to retry.
This! The API is good for the normal, but when the prefix is drop and the client is angry, you want the button you know. I use the web for emergency, same same.
My RIR is LACNIC and the web is... not fast. Kkkkk. But I know where is the button.
Member
LACNIC user here too. The portal is slow but the price is right for our allocations. I tried to get a /22 last year and the process took months, but that's LACNIC being out of IPv4, not the portal.
For IRR I use NTTCOM and RADb both. Double the work, double the chance someone filters correctly.
Has anyone dealt with Tata Communications filtering based only on IRR and ignoring RPKI? We had a prefix marked RPKI invalid (our mistake, maxLength too tight) and Tata accepted it anyway because the route object was there. Their support said "we check both" but clearly they don't fail on RPKI invalid.
Fixed the ROA but it was an eye opener.
This is exactly what I meant. "We check both" means "we parse both and take the permissive result." It's security theater. You think you have defense in depth but really you have defense in "whatever lets the packet through."
The big transits will never be strict because strict means support tickets and support tickets cost money.
I run 52 VPS across like 8 providers and the RPKI support is all over the map. Vultr and Linode seem to do proper validation. Some of the budget providers in EU? Questionable. One of them in Germany was accepting RPKI invalids last I checked, though I won't name names.
For my own prefixes I do both and pray. Not much else you can do as a small operator.