How can we be sure that a network advertised through BGP, and claiming to originate from a specific Autonomous System, has actually been delegated to that Autonomous System? In other words, what tool can I use to verify that a BGP advertisement originates from an Autonomous System authorized to make that announcement?
The answer to these questions is what is known as Origin Validation, and the protocol created to establish and verify this validation is Resource Public Key Infrastructure (RPKI).
Basically, the global RPKI infrastructure connects the networks advertised by BGP to the Autonomous Systems authorized to advertise them, using digital certificates known as Route Origin Authorizations (ROAs).
(Free access, no subscription required)
So, who generates these ROAs?
ROAs must be generated by the holders of number resources — meaning IP addresses in either of their two versions, IPv4 and IPv6 — delegated by one of the five Regional Internet Registries. In our region, that registry is LACNIC.
To achieve this, RPKI infrastructure currently manages, on the one hand, certificates that establish which IP address blocks and Autonomous System Numbers (ASNs) have been legitimately assigned by the corresponding Regional Internet Registry to an Internet service provider or organization. These certificates are known as Infrastructure Objects.
So, who generates these ROAs?
ROAs must be generated by the holders of number resources — meaning IP addresses in either of their two versions, IPv4 and IPv6 — delegated by one of the five Regional Internet Registries. In our region, that registry is LACNIC.
To achieve this, RPKI infrastructure currently manages, on the one hand, certificates that establish which IP address blocks and Autonomous System Numbers (ASNs) have been legitimately assigned by the corresponding Regional Internet Registry to an Internet service provider or organization. These certificates are known as Infrastructure Objects.
On the other hand, RPKI infrastructure manages another type of certificate, which is used by those who have been delegated these number resources (End Entities) to establish their routing policies. These certificates are known as End Entity Objects, or ROAs in the case of RPKI.
But who uses these two types of certificates, and how are they used to validate the origin of a BGP advertisement? The answer to “who?” is the RPKI validator; the answer to “how?” is by verifying that the ROA objects have been signed by a valid object of the first type, i.e., an infrastructure object.
FORT is an RPKI validator created jointly by LACNIC and NIC.mx. When the FORT validator runs, it downloads these objects from the repositories maintained by the five Regional Internet Registries and cryptographically verifies that the ROAs have been signed by a valid resource certificate. The result of this validation process is a text file containing all the ROA objects validated by the FORT validator.
Finally, how is this list of ROAs used?
Network operators using BGP can put this information to good use in different ways. One of the main uses is to connect edge routers to the RPKI validator so that the routers can use this information to validate the origin of the AS PATH of each route in their BGP table. They can also be used to monitor, detect, and even mitigate route hijacking and other types of attacks.
A few days ago, LACNIC released a new version of the FORT validator software, version 1.7.0.experimental, which includes several new object-related features. One of these is experimental support for new objects such as those used by the ASPA protocol.
To provide the regional community with a detailed instruction manual based on hands-on, proven experience with the latest version of the FORT validator, I decided to perform a complete installation and configuration from scratch. As an example, I performed the installation on a virtual server running Proxmox with Ubuntu Server 26.04. I decided to compile the FORT validator code so that the process could be replicated on other Linux-based operating systems.
I hope this guide serves as a modest contribution to the regional and global community, and I congratulate the entire FORT development team on their work.
