------------------------------------------------------- prop-138-v001: Restricting AS-ID in ROA ------------------------------------------------------- Proposer: Aftab Siddiqui (aftab.siddiqui@gmail.com) 1. Problem statement -------------------- RFC6482 - A Profile for Route Origin Authorizations (ROAs) defines the content of a ROA and one of the field is called "asID" Autonomous System Identifier. It is defined in the RFC as "The asID field contains the AS number that is authorized to originate routes to the given IP address prefixes." asID is an Integer value and the RFC doesn't restrict the range of numbers which can be placed here but technically only allocated ASNs should only be allowed to be added as "asID" or "Origin AS". APNIC ROA management system allows any number between 0 - 4294967295, which includes many ranges of Private ASNs, Reserved ASNs and unallocated ASNs as well. This may lead to creating ROAs with Origin AS which should not be in the global routing table. 2. Objective of policy change ----------------------------- Restrict APNIC members to create ROAs with private, reserved or unallocated ASN. 3. Situation in other regions ----------------------------- In process of verifying this information. 4. Proposed policy solution --------------------------- Route Origin Authorization (ROA) is an RPKI object signed by a prefix holder authorizing origination of said prefix from an origin AS specified in said ROA. It verifies whether an AS is authorized to announce a specific IP prefix or not. ROA contains 3 mandators fields Prefix, Origin AS and Maxlength. Prefix: The prefix you would like to originate from the specified ASN. IPv4 and IPv6 Prefixes listed under "Internet Resources" on My APNIC portal can be only be used here. Origin AS: The authorised ASN which can originate the "Prefix". The origin AS can only be from the IANA specified range and MUST not contain an ASN from: - 23456 # AS_TRANS RFC6793 - 64496-64511 # Reserved for use in docs and code RFC5398 - 64512-65534 # Reserved for Private Use RFC6996 - 65535 # Reserved RFC7300 - 65536-65551 # Reserved for use in docs and code RFC5398 - 65552-131071 # Reserved - 4200000000-4294967294 # Reserved for Private Use RFC6996 - 4294967295 # Reserved RFC7300 And any IANA unallocated ASN. 5. Advantages / Disadvantages ----------------------------- Advantages: This will help APNIC members avoid mistakenly creating unncessary Bogon ROAs. Disadvantages: Overhead in implementing Origin AS check. 6. Impact on resource holders ----------------------------- APNIC has to request members to delete existing Bogon ROAs, as of 5th August 2021 there are around 30+ Bogon ROAs of APNIC delegated resources. 7. References ------------- None.