Resource Certification

Size: px

Start display at page:

Download "Resource Certification"

Gordon Walker
5 years ago
Views:

1 Resource Certification Guide to Resource Certification in MyAPNIC Registration Guide for MyAPNIC Page 1 of 11

2 Table of Contents 1 Guide to Resource Certification in MyAPNIC Access to Resource Certification Activate Resource Certification Creating Route Origin Authorization (ROA) objects View or delete ROA objects 9 Registration Guide for MyAPNIC Page 2 of 11

3 1 Guide to Resource Certification in MyAPNIC This guide explains how to use the Resource Certification (RPKI) feature in MyAPNIC. Resource Public Key Infrastructure (RPKI) is a public key infrastructure framework designed to secure the Internet's routing infrastructure. 1.1 Access to Resource Certification All users should have Two-Factor-authentication enabled in MyAPNIC to use the Resource Certification feature Corporate Contacts by default have the update privilege Other contacts by default only have the view privilege The Corporate Contact can manage user privileges from the Manage Contact menu in MyAPNIC. Registration Guide for MyAPNIC Page 3 of 11

4 1.2 Activate Resource Certification To start using the Resource Certification feature, click on the Certification menu under Resources. Select if you want to operate in the MyAPNIC RPKI portal or if you want to host your own certificate authority. After selecting the first option, you will be taken to the terms and conditions. Please read this carefully, and if you agree to the conditions please accept by clicking the following button at the bottom of the page. With that your RPKI engine will be activated. This is required to request/receive your Resource Certificate from APNIC and create your ROA (Route Origin Authorization) objects in MyAPNIC. Once Registration Guide for MyAPNIC Page 4 of 11

5 this service is activated, it is available to all MyAPNIC users from that account with the Resource Certification privilege. Option 2. Host your own Certificate Authority Select the second option and click Next. Registration Guide for MyAPNIC Page 5 of 11

6 Read the terms and conditions and click on I accept. Enable provisioning protocol to my own Certification Authority. Click on Upload XML and attach your identity.xml file. Registration Guide for MyAPNIC Page 6 of 11

7 After you attach your identity.xml file, click on Submit. Click on Download parent XML to download the XML file that is needed to configure the parent of your RPKI engine. Should your RPKI engines business PKI (BPKI) certificate change in the future, you need to upload your new identity XML file by clicking on Upload new XML. Registration Guide for MyAPNIC Page 7 of 11

8 1.3 Creating Route Origin Authorization (ROA) objects This section only refers to the MyAPNIC RPKI Engine. If you are hosting your own certification authority, please refer to the documentation of your RPKI engine to create your ROA objects. Route Origin Authorization (ROA) is an object that embeds information as to which Autonomous System (AS) Number is authorized to announce particular IP prefixes. The ROA object has to be digitally signed by the IP custodian, thus validation tools can verify the authenticity of the authorization. 1) Select the BGP announcement(s) from the list 2) Click Suggest ROA button 3) Click Commit To create your ROA object: Option 1: Using Suggest ROAs option in MyAPNIC Registration Guide for MyAPNIC Page 8 of 11

9 Option 2 : Manual ROA configuration 1) Enter the Origin ASN you authorize to announce routes for your IP prefix 4) Click Add 3) Enter the most specific prefix that you authorize for this ROA 2) Enter your IP prefix that is being announced Registration Guide for MyAPNIC Page 9 of 11

10 Example: With IP prefix /23 and max length entered as 24, the following are considered authorized announcements with origin AS / / /24 After you click on Add you will be requested to commit the changes by clicking on Commit. Click on Commit to register your ROA object. Registration Guide for MyAPNIC Page 10 of 11

11 1.4 View or delete ROA objects You can view, search and sort the list of your ROA objects in the RPKI page. To delete an existing ROA click on the delete icon corresponding to the ROA you wish to delete and then click Commit. If successful, the following message will be displayed. Registration Guide for MyAPNIC Page 11 of 11

Route Management Guide to manage your routes and (RPKI) ROA

Route Management Guide to manage your routes and (RPKI) ROA 1 1 Introduction... 3 2 Activating RPKI engine... 3 2.1 Permissions required for Resource Certification... 3 2.2 RPKI Engine activation (enabling