Designing and Implementing Routing Security in Your Network

Designing and Implementing Routing Security in Your Network

Deploying routing security across an active production network requires a structured, multi-phase engineering process. Implementing controls haphazardly—such as enforcing hard ROV drops before auditing address allocations—is a guaranteed recipe for self-inflicted outages.

This chapter outlines an end-to-end, seven-step blueprint for hardening an Autonomous System.

+--------------------------------------------------------------------------+
|                     Routing Security Rollout Pipeline                    |
|                                                                          |
|  [Phase 1] Audit Address Space & Current BGP Announcements               |
|       |                                                                  |
|       v                                                                  |
|  [Phase 2] Publish Precise Minimal ROAs (No Unnecessary maxLength)      |
|       |                                                                  |
|       v                                                                  |
|  [Phase 3] Deploy Inbound Hygiene Filters (Bogons, Special Space, Limits)|
|       |                                                                  |
|       v                                                                  |
|  [Phase 4] Deploy Strict Outbound Export Filters (Block Transit Leaks)   |
|       |                                                                  |
|       v                                                                  |
|  [Phase 5] Stand up Redundant RTR Validators -> Staged ROV Enforcement  |
|       |                                                                  |
|       v                                                                  |
|  [Phase 6] Implement External Telemetry & Origin Alarms (BGPStream/BMP)  |
|       |                                                                  |
|       v                                                                  |
|  [Phase 7] Codify Runbooks, Emergency Rollback & Validation Drills       |
+--------------------------------------------------------------------------+

Step 1: Inventory and Audit Your Address Space and Announcements

Before touching a single firewall or router configuration, create an authoritative inventory: - Query public route collectors (e.g., whois -h whois.radb.net -- "-i origin AS<YOUR_ASN>") to list all prefixes currently seen on the global Internet. - Check internal IP Address Management (IPAM) systems to identify all assigned, unassigned, and delegated subnets. - Reconcile differences: identify any ghost prefixes being announced without business justification, or internal subnets missing from external tables.

Step 2: Verify Ownership and Create or Update ROAs

Log into your organization’s RIR portal (ARIN, RIPE, APNIC, LACNIC, AFRINIC): - Verify that your organization is listed as the authoritative Org-ID on all resource certificates. - Generate cryptographically valid ROAs matching your active BGP announcements. - Enforce the Minimal ROA rule (RFC 9319): Set maxLength equal to the announced prefix length. If you announce a /22 and two /24 subprefixes, create three explicit ROAs rather than a single /22 max-length 24.

Step 3: Design and Deploy Import Filters

Apply deterministic inbound hygiene filters on all transit and peering sessions: - Unconditionally deny IPv4/IPv6 bogon ranges (RFC 6890). - Unconditionally deny default routes (0.0.0.0/0 and ::/0) from lateral peers and IXPs. - Enforce prefix length sanity: drop IPv4 \(< /8\) or \(> /24\); drop IPv6 \(< /19\) or \(> /48\). - Configure hardware maximum-prefix limits on every neighbor session with an 80% warning threshold and auto-restart cooldown.

Step 4: Design and Deploy Export Filters

Prevent accidental route leaks at your outbound border: - Define an explicit prefix-list containing only your locally owned and operated address space. - Apply this prefix-list to all outbound route-maps facing transit providers and settlement-free peers. - Tag all inbound routes from providers and peers with internal NO-TRANSIT communities, and ensure export policies discard any route bearing those tags.

Step 5: Enable ROV with Staged Enforcement

Never transition directly from zero validation to hard drops in production. Execute a staged migration:

Stage A: Validation Without Enforcement (Telemetry Mode)

Deploy validators (Routinator / rpki-client) and establish RTR sessions with border routers. Configure the router to evaluate ROV states, but do not alter forwarding:

route-map PEER-IN permit 10
 match rpki invalid
 set community 65000:666 additive   <-- Tag only; do not drop

Monitor logs and NetFlow data for 30 days to identify legitimate partners whose routes evaluate as Invalid due to clerical errors.

Stage B: Hard Drop Enforcement

Once telemetry confirms that no critical business services are flagged as Invalid, activate hard drops across all transit and peer borders:

route-map PEER-IN deny 10
 match rpki invalid
!
route-map PEER-IN permit 20

Step 6: Implement Monitoring, Logging and Alerting

Set up automated alerting infrastructure: - Stream BGP Monitoring Protocol (BMP, RFC 7854) data from border routers to an internal collector. - Subscribe to real-time public telemetry (RIS-Live or BGPStream). - Configure automated alerts that trigger immediately if an unauthorized ASN originates your prefixes or if a validator RTR session drops.

Step 7: Document Policies, Plan Rollback and Test Recovery

Every security configuration must have an emergency recovery procedure: - Document the exact CLI command required to bypass ROV globally if an RIR infrastructure outage corrupts the VRP cache. - Schedule bi-annual fire drills in staging or containerized lab environments (Containerlab) where engineers practice mitigating simulated hijacks, invalid states, and validator synchronization failures.