I would want to implement RPKI in my network. I have gone through some documents by which i cant understand the implementation process.
What are the steps i should follow to implement RPKI in my network, Please help...
Network Engineering Stack Exchange is a question and answer site for network engineers. It only takes a minute to sign up.Sign up to join this community
Your question is very broad, and you're not providing many details (for example which documents you read or what your network topology and equipment used is), but I'll try to give you some pointers.
First, implementing RPKI consists of two parts: 1. signing your prefixes so others can validate them 2. implementing RPKI validation on your network
Signing your prefixes usually is the easier and less impacting task. RIRs (like ARIN and RIPE) offer online tools to sign your prefixes by linking a prefix and prefix length to an autonomous system. Be wary of setups where prefixes are sometimes announced with a different prefix length or source ASN. This typically happens with DDoS mitigation, where sometimes more specific routes are advertised, possibly from a different network, to divert IP space under attack to a DDoS scrubbing center.
Once you've signed your prefixes, others are able to validate them if they implemented RPKI validation. Since more and more networks are doing this (for example, Tier1 network Telia started doing so last week), this will prevent your prefixes from being hijacked intentionally or unintentionally by other ASNs. Keep in mind that RPKI only offers a solution for Route Origin Validation (ROV), man-in-the-middle attacks by injecting an ASN in the AS-path are still possible, since RPKI offers no path validation.
My guess is that you're mostly interested in this. Since you're not providing any details on your network, it's a bit hard to be specific, but I can give some details on how to do this.
To do RPKI validation, a number of steps need to be taken:
That last step is by far the most complex and time consuming step. A few additional remarks on that:
There's a number of good resources on RPKI I can recommend: