implementing-bgp-security-with-rpki

Implement BGP route origin validation using RPKI with Route Origin Authorizations, RPKI-to-Router protocol, and ROV policies on Cisco and Juniper routers to prevent route hijacking.

الانتقال إلى التثبيت

المستودع: xalgord/xalgorix
آخر نشاط في المصدر: ٦ يونيو ٢٠٢٦ في ١٦:٤١
لغة SKILL.md المكتشفة: الإنجليزية
النجوم: ٨١٣
التفرعات: ١٤٦

خيارات التثبيت

يُحدَّد Prompt الذي يراجع المصدر أولًا بشكل افتراضي. يمكنك التبديل إلى أمر مباشر أو تنزيل نسخة محلية.

التثبيت باستخدام Codex أو Claude انسخ هذا Prompt والصقه في Codex أو Claude أو مساعد آخر ليراجع صفحة Skill ويثبّتها لك.

يتجاوز الأمر المباشر Prompt المخصّص للمراجعة. افحص المصدر قبل تشغيله.

npx skills add https://github.com/xalgord/xalgorix --skill implementing-bgp-security-with-rpki

يبقى الأمر في سطر واحد. مرّر أفقيًا لمراجعته كاملًا قبل النسخ.

تفضّل نسخة محلية؟ نزّل الملفات المتاحة حاليًا لدى SkillsMP.

مراجعة ملفات المصدر

اقرأ SKILL.md وأي ملفات مرافقة يعرضها SkillsMP قبل أن تقرر التثبيت.

SKILL.md

تعليمات المصدر · معاينة للقراءة فقط

العودة إلى البحث العودة إلى التثبيت

exploiting-http-request-smuggling

Detecting and exploiting HTTP request smuggling vulnerabilities caused by Content-Length and Transfer-Encoding parsing discrepancies between front-end and back-end servers.

2026-07-20

exploiting-oauth-misconfiguration

Identifying and exploiting OAuth 2.0 and OpenID Connect misconfigurations including redirect URI manipulation, token leakage, and authorization code theft during security assessments.

2026-07-20

exploiting-subdomain-takeover-vulnerabilities

Identifying and exploiting dangling DNS records pointing to unclaimed cloud services, enabling subdomain takeover for phishing, cookie stealing, and authentication bypass during authorized penetration tests.

2026-06-19

عرض الكل من هذا المستودع

Implementing BGP Security with RPKI

Overview

Resource Public Key Infrastructure (RPKI) provides cryptographic validation of BGP route origins to prevent route hijacking and accidental route leaks. RPKI enables network operators to create Route Origin Authorizations (ROAs) that declare which Autonomous Systems (ASes) are authorized to originate specific IP prefixes. BGP routers validate received route announcements against RPKI data through Route Origin Validation (ROV), rejecting routes with invalid origins. This skill covers creating ROAs through Regional Internet Registries (RIRs), deploying RPKI validator software, configuring ROV on Cisco IOS-XE and Juniper Junos routers, and implementing BGP filtering policies based on RPKI validation state.

When to Use

When deploying or configuring implementing bgp security with rpki capabilities in your environment

When establishing security controls aligned to compliance requirements

When building or improving security architecture for this domain

When conducting security assessments that require this implementation

Common Misconfigurations & Verification

Invalid vs NotFound confusion: dropping Invalid does nothing for prefixes that are NotFound (no ROA at all). Forget to create a ROA and your own prefix is accepted everywhere with zero protection. Check with routinator vrps | grep <prefix> — no VRP means NotFound, not safe.

Max-length too loose: a ROA with max-length /24 on a /24 is correct; a wide max-length (e.g. /23-/24) lets an attacker announce a more-specific that still validates Valid. Set max-length equal to the announced length.

Policy attached but not enforced: on IOS-XE the route-map RPKI-FILTER must be applied in on every eBGP neighbor and you must clear bgp ... soft in; a configured-but-unapplied map silently accepts Invalids.

Validator down = fail-open: if the RTR session to Routinator drops, the router treats all routes as NotFound and accepts them. Run two independent caches.

Verification: show bgp ipv4 unicast rpki table should list non-zero VRPs and per-neighbor show bgp ... rpki state should read valid/invalid/not-found, not disabled. Announce a deliberately-invalid test route and confirm rejection (show route validation-state invalid on Junos). A converged table with no Invalids no VRPs loaded means validation isn't actually running.

Implementing BGP Security with RPKI

Overview

When to Use

When deploying or configuring implementing bgp security with rpki capabilities in your environment

When establishing security controls aligned to compliance requirements

When building or improving security architecture for this domain

When conducting security assessments that require this implementation

Common Misconfigurations & Verification

Validator down = fail-open: if the RTR session to Routinator drops, the router treats all routes as NotFound and accepts them. Run two independent caches.

#!/usr/bin/env python3 """Monitor RPKI ROV deployment health and coverage statistics.""" import json import sys import urllib.request class RPKIMonitor: def __init__(self, routinator_url: str = "http://localhost:8080"): self.routinator_url = routinator_url def get_status(self) -> dict: """Get Routinator server status.""" url = f"{self.routinator_url}/api/v1/status" try: with urllib.request.urlopen(url) as resp: return json.loads(resp.read()) except Exception as e: print(f"Error connecting to Routinator: {e}") return {} def check_validity(self, asn: int, prefix: str) -> dict: """Check RPKI validity of a prefix/origin pair.""" url = f"{self.routinator_url}/api/v1/validity/AS{asn}/{prefix}" try: with urllib.request.urlopen(url) as resp: return json.loads(resp.read()) except Exception as e: return {"error": str(e)} def get_vrp_count(self) -> int: """Get total number of Validated ROA Payloads.""" status = self.get_status() return status.get("vrpsCount", 0) def report(self, prefixes_to_check: list): """Generate RPKI monitoring report.""" status = self.get_status() print(f"\n{'='*60}") print("RPKI MONITORING REPORT") print(f"{'='*60}") print(f"\nRoutinator Status:") print(f" Version: {status.get('version', 'Unknown')}") print(f" VRPs Total: {status.get('vrpsCount', 'N/A')}") print(f" Last Update: {status.get('lastUpdateDone', 'N/A')}") if prefixes_to_check: print(f"\nPrefix Validity Checks:") for asn, prefix in prefixes_to_check: result = self.check_validity(asn, prefix) validity = result.get("validated_route", {}).get( "validity", {}).get("state", "error") print(f" AS{asn} -> {prefix}: {validity.upper()}") if __name__ == "__main__": monitor = RPKIMonitor() # Check own prefixes own_prefixes = [ (64512, "198.51.100.0/24"), ] monitor.report(own_prefixes)

name	implementing-bgp-security-with-rpki
description	Implement BGP route origin validation using RPKI with Route Origin Authorizations, RPKI-to-Router protocol, and ROV policies on Cisco and Juniper routers to prevent route hijacking.
domain	cybersecurity
subdomain	network-security
tags	["bgp","rpki","route-origin-validation","rov","roa","route-hijacking","internet-routing","bgp-security","prefix-hijack"]
version	1.0
author	mahipal
license	Apache-2.0
nist_csf	["PR.IR-01","DE.CM-01","ID.AM-03","PR.DS-02"]

name	implementing-bgp-security-with-rpki
description	Implement BGP route origin validation using RPKI with Route Origin Authorizations, RPKI-to-Router protocol, and ROV policies on Cisco and Juniper routers to prevent route hijacking.
domain	cybersecurity
subdomain	network-security
tags	["bgp","rpki","route-origin-validation","rov","roa","route-hijacking","internet-routing","bgp-security","prefix-hijack"]
version	1.0
author	mahipal
license	Apache-2.0
nist_csf	["PR.IR-01","DE.CM-01","ID.AM-03","PR.DS-02"]

State	Meaning	Recommended Action
Valid	ROA exists, origin AS and prefix match	Accept route (prefer)
Invalid	ROA exists, but origin AS or prefix length mismatch	Reject route
NotFound	No ROA covers this prefix	Accept (but lower preference)

implementing-bgp-security-with-rpki

خيارات التثبيت

مراجعة ملفات المصدر