Description
Hi. It seems that even with RPKI strict configured, FRR lets in invalid BGP prefixes after a restart.
I enabled rpki strict on our v6 IP transit sessions, and I enabled it on our peering sessions with Cloudflare.
After FRR restarts, it still lets the RPKI invalid prefixes in. For testing I use these prefixes:
https://isbgpsafeyet.com
103.21.244.8
2606:4700:7000::6715:f408
When I originally requested the 'rpki strict' feature, we suspected that the connection to the RPKI servers was not yet up, and that waiting for this to be up will solve the problem... but maybe there is another reason it's letting invalid prefixes in after a restart.
As soon as I clear the sessions, it does the correct filtering and the isbpgsafeyet test (above) passes:
clear bgp CLOUDFLARE-PEER-IP soft out
Version
How to reproduce
Configure peering with Cloudflare, set up filtering for invalid RPKI prefixes, restart FRR.
Expected behavior
The isbpgsafeyet RPKI invalid prefixes should be filtered out when FRR restarts.
Actual behavior
The isbpgsafeyet RPKI invalid prefixes make it into the routing table when FRR restarts.
Additional context
No response
Checklist
Description
Hi. It seems that even with RPKI strict configured, FRR lets in invalid BGP prefixes after a restart.
I enabled rpki strict on our v6 IP transit sessions, and I enabled it on our peering sessions with Cloudflare.
After FRR restarts, it still lets the RPKI invalid prefixes in. For testing I use these prefixes:
https://isbgpsafeyet.com
103.21.244.8
2606:4700:7000::6715:f408
When I originally requested the 'rpki strict' feature, we suspected that the connection to the RPKI servers was not yet up, and that waiting for this to be up will solve the problem... but maybe there is another reason it's letting invalid prefixes in after a restart.
As soon as I clear the sessions, it does the correct filtering and the isbpgsafeyet test (above) passes:
clear bgp CLOUDFLARE-PEER-IP soft out
Version
How to reproduce
Configure peering with Cloudflare, set up filtering for invalid RPKI prefixes, restart FRR.
Expected behavior
The isbpgsafeyet RPKI invalid prefixes should be filtered out when FRR restarts.
Actual behavior
The isbpgsafeyet RPKI invalid prefixes make it into the routing table when FRR restarts.
Additional context
No response
Checklist