[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6AF11ZEPCP0VWH2E0PKNR2P":3,"skill-same:01M6AF11ZEPCP0VWH2E0PKNR2P":103},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":44,"linkOnly":45,"markdownContent":46,"markdownBody":47,"frontMatter":48,"refName":62,"commitSha":63,"skillDirectory":64,"forksCount":65,"repositoryHtmlUrl":66,"repositoryHomepageUrl":67,"ownerHtmlUrl":68,"ownerBlogUrl":69,"ownerDescription":70,"updatedAt":71,"install":72,"resources":85},"01M6AF11ZEPCP0VWH2E0PKNR2P","implementing-bgp-security-with-rpki",null,"Implement RPKI-based BGP route origin validation by creating Route Origin Authorizations (ROAs) at RIRs (ARIN, RIPE, APNIC, AFRINIC, LACNIC), deploying validator software (Routinator, FORT, OctoRPKI), and configuring RPKI-to-Router protocol and ROV accept\u002Freject policies on Cisco IOS-XE and Juniper Junos routers. Use when hardening BGP against route hijacking or leaks, or when configuring ROV filtering policy on production routers.","mukul975\u002FAnthropic-Cybersecurity-Skills","mukul975","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42860185?v=4","01M6ADEQR8T5M4EEG6C67BQCWF","Mahipal","01M6ADJPMYWG1E5GM1FWBE3128",35990,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-bgp-security-with-rpki\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43],"bgp","implementing bgp security with rpki","rpki","security","pr","routing","validation","ios","network","network-security","implement","cybersecurity","route-hijacking","route-origin-validation","rov","roa","internet-routing","bgp-security","prefix-hijack","policy","2026-11-10 10:12:30",false,"---\nname: implementing-bgp-security-with-rpki\ndescription: Implement RPKI-based BGP route origin validation by creating Route Origin\n  Authorizations (ROAs) at RIRs (ARIN, RIPE, APNIC, AFRINIC, LACNIC), deploying validator\n  software (Routinator, FORT, OctoRPKI), and configuring RPKI-to-Router protocol and\n  ROV accept\u002Freject policies on Cisco IOS-XE and Juniper Junos routers. Use when hardening\n  BGP against route hijacking or leaks, or when configuring ROV filtering policy on\n  production routers.\ndomain: cybersecurity\nsubdomain: network-security\ntags:\n- bgp\n- rpki\n- route-origin-validation\n- rov\n- roa\n- route-hijacking\n- internet-routing\n- bgp-security\n- prefix-hijack\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\nnist_csf:\n- PR.IR-01\n- DE.CM-01\n- ID.AM-03\n- PR.DS-02\nmitre_attack:\n- T1046\n- T1040\n- T1557\n- T1071\n---\n\n# Implementing BGP Security with RPKI\n\n## Overview\n\nResource Public Key Infrastructure (RPKI) provides cryptographic validation of BGP route origins to prevent route hijacking and accidental route leaks. RPKI enables network operators to create Route Origin Authorizations (ROAs) that declare which Autonomous Systems (ASes) are authorized to originate specific IP prefixes. BGP routers validate received route announcements against RPKI data through Route Origin Validation (ROV), rejecting routes with invalid origins. This skill covers creating ROAs through Regional Internet Registries (RIRs), deploying RPKI validator software, configuring ROV on Cisco IOS-XE and Juniper Junos routers, and implementing BGP filtering policies based on RPKI validation state.\n\n\n## When to Use\n\n- When deploying or configuring implementing bgp security with rpki capabilities in your environment\n- When establishing security controls aligned to compliance requirements\n- When building or improving security architecture for this domain\n- When conducting security assessments that require this implementation\n\n## Prerequisites\n\n- IP address space allocated from an RIR (ARIN, RIPE, APNIC, AFRINIC, LACNIC)\n- RIR member portal access for ROA creation\n- BGP routers (Cisco IOS-XE 16.x+, Juniper Junos 12.2+, or similar)\n- Linux server for RPKI validator\u002Fcache (Routinator, FORT, or OctoRPKI)\n- Understanding of BGP routing and AS path concepts\n\n## Core Concepts\n\n### RPKI Architecture\n\n```\n┌──────────────────────────────────────────────┐\n│           Regional Internet Registries        │\n│    (ARIN, RIPE, APNIC, AFRINIC, LACNIC)      │\n│                                               │\n│  ┌─────────────────────────────────────────┐  │\n│  │  Trust Anchor (Root CA Certificate)      │  │\n│  │  ├── CA Certificate (ISP\u002FOrganization)   │  │\n│  │  │   ├── ROA: AS64512 → 198.51.100.0\u002F24 │  │\n│  │  │   └── ROA: AS64512 → 2001:db8::\u002F32   │  │\n│  │  └── CA Certificate (Another Org)        │  │\n│  │      └── ROA: AS64513 → 203.0.113.0\u002F24  │  │\n│  └─────────────────────────────────────────┘  │\n└──────────────────────────────────────────────┘\n                     │ rsync\u002FRRDP\n                     ▼\n         ┌──────────────────────┐\n         │  RPKI Validator\u002FCache │  (Routinator, FORT, OctoRPKI)\n         │  Validates ROAs       │\n         │  Serves VRPs to RTR   │\n         └──────────────────────┘\n                     │ RTR Protocol (TCP 8323)\n                     ▼\n         ┌──────────────────────┐\n         │  BGP Router           │\n         │  Performs ROV          │\n         │  Applies policy:      │\n         │   Valid → Accept      │\n         │   Invalid → Reject    │\n         │   NotFound → Accept   │\n         └──────────────────────┘\n```\n\n### RPKI Validation States\n\n| State | Meaning | Recommended Action |\n|-------|---------|-------------------|\n| **Valid** | ROA exists, origin AS and prefix match | Accept route (prefer) |\n| **Invalid** | ROA exists, but origin AS or prefix length mismatch | Reject route |\n| **NotFound** | No ROA covers this prefix | Accept (but lower preference) |\n\n### Route Origin Authorization (ROA)\n\nA ROA is a signed object that states:\n- **Prefix**: The IP address range (e.g., 198.51.100.0\u002F24)\n- **Origin AS**: The AS authorized to originate this prefix (e.g., AS64512)\n- **Max Length**: Maximum prefix length that can be announced (e.g., \u002F24)\n\n## Workflow\n\n### Step 1: Create ROAs at Your RIR\n\n**ARIN (North America):**\n1. Log into ARIN Online portal\n2. Navigate to Routing Security > Route Origin Authorizations\n3. Create ROA:\n   - Prefix: 198.51.100.0\u002F24\n   - Origin AS: AS64512\n   - Max Length: \u002F24 (set equal to prefix length to prevent sub-prefix hijacking)\n4. Sign and submit\n\n**RIPE NCC (Europe):**\n1. Log into RIPE NCC LIR Portal\n2. Navigate to Certification (RPKI) > ROAs\n3. Create ROA with prefix, origin AS, and max prefix length\n\n### Step 2: Deploy RPKI Validator (Routinator)\n\n```bash\n# Install Routinator on Ubuntu\nsudo apt install -y routinator\n\n# Or install via Cargo (Rust)\ncurl --proto '=https' --tlsv1.2 -sSf https:\u002F\u002Fsh.rustup.rs | sh\ncargo install routinator\n\n# Initialize Routinator (accept TALs)\nroutinator init --accept-arin-rpa\n\n# Start Routinator in RTR server mode\nroutinator server \\\n  --rtr 0.0.0.0:8323 \\\n  --http 0.0.0.0:8080 \\\n  --refresh 600 \\\n  --retry 60 \\\n  --expire 7200\n\n# Run as systemd service\ncat > \u002Fetc\u002Fsystemd\u002Fsystem\u002Froutinator.service \u003C\u003C 'SYSTEMD'\n[Unit]\nDescription=Routinator RPKI Validator\nAfter=network.target\n\n[Service]\nType=simple\nUser=routinator\nExecStart=\u002Fusr\u002Fbin\u002Froutinator server --rtr 0.0.0.0:8323 --http 0.0.0.0:8080\nRestart=always\nRestartSec=10\n\n[Install]\nWantedBy=multi-user.target\nSYSTEMD\n\nsudo systemctl enable routinator\nsudo systemctl start routinator\n\n# Verify Routinator is serving data\ncurl http:\u002F\u002Flocalhost:8080\u002Fapi\u002Fv1\u002Fstatus\ncurl http:\u002F\u002Flocalhost:8080\u002Fapi\u002Fv1\u002Fvalidity\u002FAS64512\u002F198.51.100.0\u002F24\n\n# View Validated ROA Payloads (VRPs)\nroutinator vrps --format json | head -50\n```\n\n### Step 3: Configure ROV on Cisco IOS-XE\n\n```\n! Configure RPKI cache server connection\nrouter bgp 64512\n bgp rpki server tcp 10.0.5.50 port 8323 refresh 600\n\n! Verify RPKI session\nshow bgp rpki server\nshow bgp rpki table\n\n! Create route-map for RPKI-based filtering\nroute-map RPKI-FILTER permit 10\n match rpki valid\n set local-preference 200\n\nroute-map RPKI-FILTER permit 20\n match rpki not-found\n set local-preference 100\n\nroute-map RPKI-FILTER deny 30\n match rpki invalid\n\n! Apply to BGP neighbors\nrouter bgp 64512\n address-family ipv4 unicast\n  neighbor 198.51.100.1 route-map RPKI-FILTER in\n  neighbor 203.0.113.1 route-map RPKI-FILTER in\n\n address-family ipv6 unicast\n  neighbor 2001:db8::1 route-map RPKI-FILTER in\n\n! Verify ROV operation\nshow bgp ipv4 unicast rpki validation\nshow bgp ipv4 unicast 198.51.100.0\u002F24\nshow ip bgp rpki table\nshow ip bgp neighbors 198.51.100.1 rpki state\n```\n\n### Step 4: Configure ROV on Juniper Junos\n\n```\n# Configure RPKI cache connection\nset routing-options validation group RPKI-VALIDATORS session 10.0.5.50 port 8323\nset routing-options validation group RPKI-VALIDATORS session 10.0.5.50 refresh-time 600\nset routing-options validation group RPKI-VALIDATORS session 10.0.5.50 hold-time 7200\nset routing-options validation group RPKI-VALIDATORS session 10.0.5.50 record-lifetime 7200\n\n# Create validation policy\nset policy-options policy-statement RPKI-POLICY term valid from validation-database valid\nset policy-options policy-statement RPKI-POLICY term valid then validation-state valid\nset policy-options policy-statement RPKI-POLICY term valid then local-preference 200\nset policy-options policy-statement RPKI-POLICY term valid then accept\n\nset policy-options policy-statement RPKI-POLICY term invalid from validation-database invalid\nset policy-options policy-statement RPKI-POLICY term invalid then validation-state invalid\nset policy-options policy-statement RPKI-POLICY term invalid then reject\n\nset policy-options policy-statement RPKI-POLICY term unknown from validation-database unknown\nset policy-options policy-statement RPKI-POLICY term unknown then validation-state unknown\nset policy-options policy-statement RPKI-POLICY term unknown then local-preference 100\nset policy-options policy-statement RPKI-POLICY term unknown then accept\n\n# Apply to BGP peers\nset protocols bgp group TRANSIT import RPKI-POLICY\nset protocols bgp group PEERS import RPKI-POLICY\n\n# Verify\nshow validation session\nshow validation database\nshow validation statistics\nshow route validation-state invalid\n```\n\n### Step 5: Monitor RPKI Deployment\n\n```python\n#!\u002Fusr\u002Fbin\u002Fenv python3\n\"\"\"Monitor RPKI ROV deployment health and coverage statistics.\"\"\"\n\nimport json\nimport sys\nimport urllib.request\n\n\nclass RPKIMonitor:\n    def __init__(self, routinator_url: str = \"http:\u002F\u002Flocalhost:8080\"):\n        self.routinator_url = routinator_url\n\n    def get_status(self) -> dict:\n        \"\"\"Get Routinator server status.\"\"\"\n        url = f\"{self.routinator_url}\u002Fapi\u002Fv1\u002Fstatus\"\n        try:\n            with urllib.request.urlopen(url) as resp:\n                return json.loads(resp.read())\n        except Exception as e:\n            print(f\"Error connecting to Routinator: {e}\")\n            return {}\n\n    def check_validity(self, asn: int, prefix: str) -> dict:\n        \"\"\"Check RPKI validity of a prefix\u002Forigin pair.\"\"\"\n        url = f\"{self.routinator_url}\u002Fapi\u002Fv1\u002Fvalidity\u002FAS{asn}\u002F{prefix}\"\n        try:\n            with urllib.request.urlopen(url) as resp:\n                return json.loads(resp.read())\n        except Exception as e:\n            return {\"error\": str(e)}\n\n    def get_vrp_count(self) -> int:\n        \"\"\"Get total number of Validated ROA Payloads.\"\"\"\n        status = self.get_status()\n        return status.get(\"vrpsCount\", 0)\n\n    def report(self, prefixes_to_check: list):\n        \"\"\"Generate RPKI monitoring report.\"\"\"\n        status = self.get_status()\n\n        print(f\"\\n{'='*60}\")\n        print(\"RPKI MONITORING REPORT\")\n        print(f\"{'='*60}\")\n        print(f\"\\nRoutinator Status:\")\n        print(f\"  Version: {status.get('version', 'Unknown')}\")\n        print(f\"  VRPs Total: {status.get('vrpsCount', 'N\u002FA')}\")\n        print(f\"  Last Update: {status.get('lastUpdateDone', 'N\u002FA')}\")\n\n        if prefixes_to_check:\n            print(f\"\\nPrefix Validity Checks:\")\n            for asn, prefix in prefixes_to_check:\n                result = self.check_validity(asn, prefix)\n                validity = result.get(\"validated_route\", {}).get(\n                    \"validity\", {}).get(\"state\", \"error\")\n                print(f\"  AS{asn} -> {prefix}: {validity.upper()}\")\n\n\nif __name__ == \"__main__\":\n    monitor = RPKIMonitor()\n\n    # Check own prefixes\n    own_prefixes = [\n        (64512, \"198.51.100.0\u002F24\"),\n    ]\n\n    monitor.report(own_prefixes)\n```\n\n## Best Practices\n\n- **Create ROAs for All Prefixes** - Sign ROAs for every prefix your organization announces\n- **Max Length = Prefix Length** - Set max-length equal to announced prefix length to prevent sub-prefix hijacking\n- **Dual Validator** - Run two independent RPKI validators for redundancy\n- **Soft Policy First** - Start with logging RPKI-invalid routes before dropping them\n- **Monitor ROA Expiry** - Set alerts for ROA certificates approaching expiration\n- **Coordinate with Upstreams** - Notify transit providers about your RPKI deployment\n- **Test with Looking Glass** - Verify your ROAs are visible using public RPKI validators\n\n## References\n\n- [RPKI Documentation](https:\u002F\u002Frpki.readthedocs.io\u002Fen\u002Flatest\u002F)\n- [Cloudflare RPKI Blog](https:\u002F\u002Fblog.cloudflare.com\u002Frpki\u002F)\n- [NLnet Labs Routinator](https:\u002F\u002Fwww.nlnetlabs.nl\u002Fprojects\u002Frpki\u002Froutinator\u002F)\n- [RIPE NCC RPKI Dashboard](https:\u002F\u002Frpki.ripe.net\u002F)\n- [RFC 6480 - RPKI Architecture](https:\u002F\u002Fwww.rfc-editor.org\u002Frfc\u002Frfc6480)\n- [RFC 6811 - BGP Origin AS Validation](https:\u002F\u002Fwww.rfc-editor.org\u002Frfc\u002Frfc6811)\n","# Implementing BGP Security with RPKI\n\n## Overview\n\nResource Public Key Infrastructure (RPKI) provides cryptographic validation of BGP route origins to prevent route hijacking and accidental route leaks. RPKI enables network operators to create Route Origin Authorizations (ROAs) that declare which Autonomous Systems (ASes) are authorized to originate specific IP prefixes. BGP routers validate received route announcements against RPKI data through Route Origin Validation (ROV), rejecting routes with invalid origins. This skill covers creating ROAs through Regional Internet Registries (RIRs), deploying RPKI validator software, configuring ROV on Cisco IOS-XE and Juniper Junos routers, and implementing BGP filtering policies based on RPKI validation state.\n\n\n## When to Use\n\n- When deploying or configuring implementing bgp security with rpki capabilities in your environment\n- When establishing security controls aligned to compliance requirements\n- When building or improving security architecture for this domain\n- When conducting security assessments that require this implementation\n\n## Prerequisites\n\n- IP address space allocated from an RIR (ARIN, RIPE, APNIC, AFRINIC, LACNIC)\n- RIR member portal access for ROA creation\n- BGP routers (Cisco IOS-XE 16.x+, Juniper Junos 12.2+, or similar)\n- Linux server for RPKI validator\u002Fcache (Routinator, FORT, or OctoRPKI)\n- Understanding of BGP routing and AS path concepts\n\n## Core Concepts\n\n### RPKI Architecture\n\n```\n┌──────────────────────────────────────────────┐\n│           Regional Internet Registries        │\n│    (ARIN, RIPE, APNIC, AFRINIC, LACNIC)      │\n│                                               │\n│  ┌─────────────────────────────────────────┐  │\n│  │  Trust Anchor (Root CA Certificate)      │  │\n│  │  ├── CA Certificate (ISP\u002FOrganization)   │  │\n│  │  │   ├── ROA: AS64512 → 198.51.100.0\u002F24 │  │\n│  │  │   └── ROA: AS64512 → 2001:db8::\u002F32   │  │\n│  │  └── CA Certificate (Another Org)        │  │\n│  │      └── ROA: AS64513 → 203.0.113.0\u002F24  │  │\n│  └─────────────────────────────────────────┘  │\n└──────────────────────────────────────────────┘\n                     │ rsync\u002FRRDP\n                     ▼\n         ┌──────────────────────┐\n         │  RPKI Validator\u002FCache │  (Routinator, FORT, OctoRPKI)\n         │  Validates ROAs       │\n         │  Serves VRPs to RTR   │\n         └──────────────────────┘\n                     │ RTR Protocol (TCP 8323)\n                     ▼\n         ┌──────────────────────┐\n         │  BGP Router           │\n         │  Performs ROV          │\n         │  Applies policy:      │\n         │   Valid → Accept      │\n         │   Invalid → Reject    │\n         │   NotFound → Accept   │\n         └──────────────────────┘\n```\n\n### RPKI Validation States\n\n| State | Meaning | Recommended Action |\n|-------|---------|-------------------|\n| **Valid** | ROA exists, origin AS and prefix match | Accept route (prefer) |\n| **Invalid** | ROA exists, but origin AS or prefix length mismatch | Reject route |\n| **NotFound** | No ROA covers this prefix | Accept (but lower preference) |\n\n### Route Origin Authorization (ROA)\n\nA ROA is a signed object that states:\n- **Prefix**: The IP address range (e.g., 198.51.100.0\u002F24)\n- **Origin AS**: The AS authorized to originate this prefix (e.g., AS64512)\n- **Max Length**: Maximum prefix length that can be announced (e.g., \u002F24)\n\n## Workflow\n\n### Step 1: Create ROAs at Your RIR\n\n**ARIN (North America):**\n1. Log into ARIN Online portal\n2. Navigate to Routing Security > Route Origin Authorizations\n3. Create ROA:\n   - Prefix: 198.51.100.0\u002F24\n   - Origin AS: AS64512\n   - Max Length: \u002F24 (set equal to prefix length to prevent sub-prefix hijacking)\n4. Sign and submit\n\n**RIPE NCC (Europe):**\n1. Log into RIPE NCC LIR Portal\n2. Navigate to Certification (RPKI) > ROAs\n3. Create ROA with prefix, origin AS, and max prefix length\n\n### Step 2: Deploy RPKI Validator (Routinator)\n\n```bash\n# Install Routinator on Ubuntu\nsudo apt install -y routinator\n\n# Or install via Cargo (Rust)\ncurl --proto '=https' --tlsv1.2 -sSf https:\u002F\u002Fsh.rustup.rs | sh\ncargo install routinator\n\n# Initialize Routinator (accept TALs)\nroutinator init --accept-arin-rpa\n\n# Start Routinator in RTR server mode\nroutinator server \\\n  --rtr 0.0.0.0:8323 \\\n  --http 0.0.0.0:8080 \\\n  --refresh 600 \\\n  --retry 60 \\\n  --expire 7200\n\n# Run as systemd service\ncat > \u002Fetc\u002Fsystemd\u002Fsystem\u002Froutinator.service \u003C\u003C 'SYSTEMD'\n[Unit]\nDescription=Routinator RPKI Validator\nAfter=network.target\n\n[Service]\nType=simple\nUser=routinator\nExecStart=\u002Fusr\u002Fbin\u002Froutinator server --rtr 0.0.0.0:8323 --http 0.0.0.0:8080\nRestart=always\nRestartSec=10\n\n[Install]\nWantedBy=multi-user.target\nSYSTEMD\n\nsudo systemctl enable routinator\nsudo systemctl start routinator\n\n# Verify Routinator is serving data\ncurl http:\u002F\u002Flocalhost:8080\u002Fapi\u002Fv1\u002Fstatus\ncurl http:\u002F\u002Flocalhost:8080\u002Fapi\u002Fv1\u002Fvalidity\u002FAS64512\u002F198.51.100.0\u002F24\n\n# View Validated ROA Payloads (VRPs)\nroutinator vrps --format json | head -50\n```\n\n### Step 3: Configure ROV on Cisco IOS-XE\n\n```\n! Configure RPKI cache server connection\nrouter bgp 64512\n bgp rpki server tcp 10.0.5.50 port 8323 refresh 600\n\n! Verify RPKI session\nshow bgp rpki server\nshow bgp rpki table\n\n! Create route-map for RPKI-based filtering\nroute-map RPKI-FILTER permit 10\n match rpki valid\n set local-preference 200\n\nroute-map RPKI-FILTER permit 20\n match rpki not-found\n set local-preference 100\n\nroute-map RPKI-FILTER deny 30\n match rpki invalid\n\n! Apply to BGP neighbors\nrouter bgp 64512\n address-family ipv4 unicast\n  neighbor 198.51.100.1 route-map RPKI-FILTER in\n  neighbor 203.0.113.1 route-map RPKI-FILTER in\n\n address-family ipv6 unicast\n  neighbor 2001:db8::1 route-map RPKI-FILTER in\n\n! Verify ROV operation\nshow bgp ipv4 unicast rpki validation\nshow bgp ipv4 unicast 198.51.100.0\u002F24\nshow ip bgp rpki table\nshow ip bgp neighbors 198.51.100.1 rpki state\n```\n\n### Step 4: Configure ROV on Juniper Junos\n\n```\n# Configure RPKI cache connection\nset routing-options validation group RPKI-VALIDATORS session 10.0.5.50 port 8323\nset routing-options validation group RPKI-VALIDATORS session 10.0.5.50 refresh-time 600\nset routing-options validation group RPKI-VALIDATORS session 10.0.5.50 hold-time 7200\nset routing-options validation group RPKI-VALIDATORS session 10.0.5.50 record-lifetime 7200\n\n# Create validation policy\nset policy-options policy-statement RPKI-POLICY term valid from validation-database valid\nset policy-options policy-statement RPKI-POLICY term valid then validation-state valid\nset policy-options policy-statement RPKI-POLICY term valid then local-preference 200\nset policy-options policy-statement RPKI-POLICY term valid then accept\n\nset policy-options policy-statement RPKI-POLICY term invalid from validation-database invalid\nset policy-options policy-statement RPKI-POLICY term invalid then validation-state invalid\nset policy-options policy-statement RPKI-POLICY term invalid then reject\n\nset policy-options policy-statement RPKI-POLICY term unknown from validation-database unknown\nset policy-options policy-statement RPKI-POLICY term unknown then validation-state unknown\nset policy-options policy-statement RPKI-POLICY term unknown then local-preference 100\nset policy-options policy-statement RPKI-POLICY term unknown then accept\n\n# Apply to BGP peers\nset protocols bgp group TRANSIT import RPKI-POLICY\nset protocols bgp group PEERS import RPKI-POLICY\n\n# Verify\nshow validation session\nshow validation database\nshow validation statistics\nshow route validation-state invalid\n```\n\n### Step 5: Monitor RPKI Deployment\n\n```python\n#!\u002Fusr\u002Fbin\u002Fenv python3\n\"\"\"Monitor RPKI ROV deployment health and coverage statistics.\"\"\"\n\nimport json\nimport sys\nimport urllib.request\n\n\nclass RPKIMonitor:\n    def __init__(self, routinator_url: str = \"http:\u002F\u002Flocalhost:8080\"):\n        self.routinator_url = routinator_url\n\n    def get_status(self) -> dict:\n        \"\"\"Get Routinator server status.\"\"\"\n        url = f\"{self.routinator_url}\u002Fapi\u002Fv1\u002Fstatus\"\n        try:\n            with urllib.request.urlopen(url) as resp:\n                return json.loads(resp.read())\n        except Exception as e:\n            print(f\"Error connecting to Routinator: {e}\")\n            return {}\n\n    def check_validity(self, asn: int, prefix: str) -> dict:\n        \"\"\"Check RPKI validity of a prefix\u002Forigin pair.\"\"\"\n        url = f\"{self.routinator_url}\u002Fapi\u002Fv1\u002Fvalidity\u002FAS{asn}\u002F{prefix}\"\n        try:\n            with urllib.request.urlopen(url) as resp:\n                return json.loads(resp.read())\n        except Exception as e:\n            return {\"error\": str(e)}\n\n    def get_vrp_count(self) -> int:\n        \"\"\"Get total number of Validated ROA Payloads.\"\"\"\n        status = self.get_status()\n        return status.get(\"vrpsCount\", 0)\n\n    def report(self, prefixes_to_check: list):\n        \"\"\"Generate RPKI monitoring report.\"\"\"\n        status = self.get_status()\n\n        print(f\"\\n{'='*60}\")\n        print(\"RPKI MONITORING REPORT\")\n        print(f\"{'='*60}\")\n        print(f\"\\nRoutinator Status:\")\n        print(f\"  Version: {status.get('version', 'Unknown')}\")\n        print(f\"  VRPs Total: {status.get('vrpsCount', 'N\u002FA')}\")\n        print(f\"  Last Update: {status.get('lastUpdateDone', 'N\u002FA')}\")\n\n        if prefixes_to_check:\n            print(f\"\\nPrefix Validity Checks:\")\n            for asn, prefix in prefixes_to_check:\n                result = self.check_validity(asn, prefix)\n                validity = result.get(\"validated_route\", {}).get(\n                    \"validity\", {}).get(\"state\", \"error\")\n                print(f\"  AS{asn} -> {prefix}: {validity.upper()}\")\n\n\nif __name__ == \"__main__\":\n    monitor = RPKIMonitor()\n\n    # Check own prefixes\n    own_prefixes = [\n        (64512, \"198.51.100.0\u002F24\"),\n    ]\n\n    monitor.report(own_prefixes)\n```\n\n## Best Practices\n\n- **Create ROAs for All Prefixes** - Sign ROAs for every prefix your organization announces\n- **Max Length = Prefix Length** - Set max-length equal to announced prefix length to prevent sub-prefix hijacking\n- **Dual Validator** - Run two independent RPKI validators for redundancy\n- **Soft Policy First** - Start with logging RPKI-invalid routes before dropping them\n- **Monitor ROA Expiry** - Set alerts for ROA certificates approaching expiration\n- **Coordinate with Upstreams** - Notify transit providers about your RPKI deployment\n- **Test with Looking Glass** - Verify your ROAs are visible using public RPKI validators\n\n## References\n\n- [RPKI Documentation](https:\u002F\u002Frpki.readthedocs.io\u002Fen\u002Flatest\u002F)\n- [Cloudflare RPKI Blog](https:\u002F\u002Fblog.cloudflare.com\u002Frpki\u002F)\n- [NLnet Labs Routinator](https:\u002F\u002Fwww.nlnetlabs.nl\u002Fprojects\u002Frpki\u002Froutinator\u002F)\n- [RIPE NCC RPKI Dashboard](https:\u002F\u002Frpki.ripe.net\u002F)\n- [RFC 6480 - RPKI Architecture](https:\u002F\u002Fwww.rfc-editor.org\u002Frfc\u002Frfc6480)\n- [RFC 6811 - BGP Origin AS Validation](https:\u002F\u002Fwww.rfc-editor.org\u002Frfc\u002Frfc6811)\n",{"name":5,"tags":49,"author":50,"domain":35,"license":15,"version":51,"nist_csf":52,"subdomain":33,"description":7,"mitre_attack":57},[24,26,37,38,39,36,40,41,42],"mahipal","1.0",[53,54,55,56],"PR.IR-01","DE.CM-01","ID.AM-03","PR.DS-02",[58,59,60,61],"T1046","T1040","T1557","T1071","main","54a798831d2266a3ca61ce68a7acb80b81160d57","skills\u002Fimplementing-bgp-security-with-rpki",4395,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills","https:\u002F\u002Fmahipal.engineer\u002FAnthropic-Cybersecurity-Skills\u002F","https:\u002F\u002Fgithub.com\u002Fmukul975","Mahipal.engineer","🔐 Cybersecurity | 💻 Dev | 📷 Street Photographer\r\n🎓 MSc | 📚 Research & AI Security","2026-08-31 12:32:44",{"source":8,"skillName":5,"commands":73,"prompt":83,"zipAvailable":84},[74,77,80],{"tool":75,"command":76},"npx","npx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill implementing-bgp-security-with-rpki",{"tool":78,"command":79},"bunx","bunx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill implementing-bgp-security-with-rpki",{"tool":81,"command":82},"pnpm","pnpm dlx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill implementing-bgp-security-with-rpki","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-bgp-security-with-rpki\u002FSKILL.md",true,[86,91,97],{"path":87,"resourceType":87,"resourceTypeDesc":88,"sizeBytes":89,"sourceHtmlUrl":90},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-bgp-security-with-rpki\u002FLICENSE",{"path":92,"resourceType":93,"resourceTypeDesc":94,"sizeBytes":95,"sourceHtmlUrl":96},"references\u002Fapi-reference.md","REFERENCE","参考文档",1577,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-bgp-security-with-rpki\u002Freferences\u002Fapi-reference.md",{"path":98,"resourceType":99,"resourceTypeDesc":100,"sizeBytes":101,"sourceHtmlUrl":102},"scripts\u002Fagent.py","SCRIPT","脚本",4522,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-bgp-security-with-rpki\u002Fscripts\u002Fagent.py",[104,129,152,179,205,232],{"skillNo":105,"name":106,"nameZh":6,"description":107,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":108,"categories":109,"keywords":111,"publishedAt":44},"01M6AGDM3HJXTKXX15ZZ0ZVCJ3","verifying-build-provenance-with-slsa-sigstore","Verifies artifact signatures and SLSA provenance using Sigstore's cosign (verify, verify-attestation, verify-blob-attestation) and slsa-verifier (verify-artifact), enforcing keyless OIDC builder identity and source repo against SLSA Build levels. Use in CI\u002FCD before deploying artifacts, when consuming third-party attestations, establishing a SLSA Build L3 pipeline, or confirming provenance during incident response or admission control.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fverifying-build-provenance-with-slsa-sigstore\u002FSKILL.md",[110],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[112,113,114,115,27,35,116,117,28,118,119,120,121,122,123,124,125,126,127,128],"sigstore","provenance","slsa","verifying build provenance with slsa sigstore","incident response","identity","code","artifacts","ci","supply-chain","pipeline","supply-chain-security","t1195","attestation","code-signing","cosign","keyless",{"skillNo":130,"name":131,"nameZh":6,"description":132,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":133,"categories":134,"keywords":136,"publishedAt":44},"01M6AGDGBPWYVZ2F11GFKJ4HZ9","validating-tpm-measured-boot-attestation","Verifies TPM 2.0 measured-boot integrity and remote attestation with tpm2-tools -- reading PCRs (tpm2_pcrread), replaying the boot event log, generating and checking signed quotes (tpm2_quote\u002Ftpm2_checkquote), and sealing secrets to a PCR policy. Use to confirm a system booted trusted firmware\u002Fkernel for Zero Trust device posture, detect boot-chain tampering via PCR drift, or build a golden-value baseline for fleet attestation.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-tpm-measured-boot-attestation\u002FSKILL.md",[135],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[137,125,138,139,27,43,35,28,140,141,142,143,144,145,146,147,148,149,150,151],"boot","TPM","validating tpm measured boot attestation","verification","ZeRO","firmware","Tools","measured-boot","PCR","integrity","secrets","remote-attestation","tpm2-tools","integrity-verification","trusted-computing",{"skillNo":153,"name":154,"nameZh":6,"description":155,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":156,"categories":157,"keywords":162,"publishedAt":44},"01M6AGDCW0Y4FXZ3362GT1941M","validating-backup-integrity-for-recovery","Validates backup integrity through cryptographic hash verification, automated restore testing, corruption detection, and recoverability checks to confirm backups are reliable for disaster recovery and ransomware response. Use before relying on backups for recovery, when building post-backup validation pipelines, auditing backup infrastructure for compliance, or checking immutable\u002Fair-gapped backups for silent corruption or tampering.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-backup-integrity-for-recovery\u002FSKILL.md",[158,161],{"categoryNo":159,"categoryName":160,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[146,163,164,165,166,35,167,30,140,168,169,170,171,172,173,174,175,176,177,178],"backup","recovery","validating backup integrity for recovery","testing","infrastructure","compliance","hash-verification","incident-response","ransomware","cryptocurrency","detection","t1078","t1490","immutable","disaster-recovery","restore-testing",{"skillNo":180,"name":181,"nameZh":6,"description":182,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":183,"categories":184,"keywords":186,"publishedAt":44},"01M6AGD9GBG2KZ336AE763J3WH","triaging-windows-with-kape","Runs KAPE (Kroll Artifact Parser and Extractor) to collect targeted forensic artifacts (registry hives, $MFT, event logs, prefetch, browser data) via Targets and parse them with Modules wrapping Eric Zimmerman's EZ Tools (PECmd, MFTECmd, RECmd). Use during early incident containment\u002Ftriage when full disk imaging is impractical but a defensible, parseable Windows artifact set is needed quickly, including at-scale remote collection.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-windows-with-kape\u002FSKILL.md",[185],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[187,188,189,35,190,191,192,193,194,195,196,197,198,199,200,201,143,202,203,204],"windows","kape","triaging windows with kape","registry","browser","logs","windows-forensics","dfir","mft","mftecmd","data","prefetch","eric-zimmerman","digital-forensics","SET","collection","pecmd","artifact-collection",{"skillNo":206,"name":207,"nameZh":6,"description":208,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":209,"categories":210,"keywords":212,"publishedAt":44},"01M6AGD5PW5J4EVZM958WD74ZQ","triaging-vulnerabilities-with-ssvc-framework","Triages and prioritizes vulnerabilities with CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree, weighing exploitation status (via the CISA KEV catalog and FIRST EPSS API), technical impact, automatability, and mission prevalence to output Track\u002FTrack*\u002FAttend\u002FAct decisions. Use when prioritizing vulnerability scan results (OpenVAS, Nessus, Qualys) for remediation planning beyond raw CVSS scores.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-vulnerabilities-with-ssvc-framework\u002FSKILL.md",[211],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[213,214,215,35,216,217,218,219,220,221,222,223,224,225,226,227,228,229,230,231],"vulnerabilities","framework","triaging vulnerabilities with ssvc framework","status","planning","CISA","vulnerability-management","risk-management","nessus","qualys","openvas","cvss","remediation","risk","vulnerability","api","prioritization","ssvc","decision-tree",{"skillNo":233,"name":234,"nameZh":6,"description":235,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":236,"categories":237,"keywords":239,"publishedAt":44},"01M6AGD24TTQQM4CXG69E3B9TJ","triaging-security-incident","Performs initial triage of security incidents using the NIST SP 800-61r3 and SANS PICERL frameworks, classifying incident type, assigning priority by business impact, and routing to the appropriate response team. Use when a SIEM\u002FEDR alert needs human classification, concurrent alerts must be prioritized, or a user report or threat-intel IOC match requires initial incident categorization.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-security-incident\u002FSKILL.md",[238],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[27,240,35,241,242,243,244,245,246,247,248,174,249,175,250,251,252,253,254,255],"triaging security incident","siem","file","ioc","soc","NIST-800-61","NIST","severity","edr","execution","analysis","classification","severity-classification","incident-triage","SANS-PICERL","SOC-operations"]