3 ms·

I’m sure it’s a naive question, but isn’t this what route filters and community policy rules are meant to prevent? These are universally in use in the Tier 1s t

I’m sure it’s a naive question, but isn’t this what route filters and community policy rules are meant to prevent? These are universally in use in the Tier 1s to automate route management permissions at a large scale. I understand that Tier 1 backbone peers trust other Tier 1s’ announcements implicitly. But couldn’t US Tier 1s simply block announcements by China Telecom of non-transit prefixes that don’t belong to Chinese ASNs? Or would that be a monumentally unmanageable undertaking? Aren’t RIR address block delegations broadly regionalised, to the degree that one could obtain a list of all address ranges delegated by APNIC to the PRC, fairly straightforwardly?

lima 7y ago
No, IRR assignments are only regional in terms of the company requesting them. A European company can use their RIPE resources anywhere in the world without "delegating" them. Yes, filter lists generated by recursively resolving IRR AS-SETs and RPKI can prevent incidents like this, if they were universally applied. Note that origin validation on its own (i.e. what RPKI does) does not prevent malicious attacks, which can just spoof the right origin. Some Tier 1's - most notably NTT - also use a mechanism called "Peer Lock", where an ASN can specify that it will only ever use a given set of transit providers (i.e. "NTT should never receive a Google prefix from a China Telecom peer"), which would have prevented this. https://archive.nanog.org/sites/default/files/Snijders_Everyday_Practical_Bgp.pdf https://archive.nanog.org/sites/default/files/Snijders_Every... https://blogs.akamai.com/Minimizing%20BGP%20Hijacking%20Risk_2018-10-29.pdf https://blogs.akamai.com/Minimizing%20BGP%20Hijacking%20Risk...