topic BGP ROA and RPKI in General Topics

BGP ROA and RPKI

Kevin_Somers — Tue, 17 Jan 2023 17:47:44 GMT

Does BGP on PAN-OS, any version, support Route Origin Authorization (ROA) or Resource Public Key Infrastructure (RPKI)? I find nothing in the docs or in the web interface that would indicate it is supported.

Re: BGP ROA and RPKI

kiwi — Wed, 18 Jan 2023 16:16:47 GMT

Hi @Kevin_Somers ,

I have no experience with this unfortunately but if I'm not mistaken this is discussed in a very interesting article on Linkedin where Gonzalez Diaz used scripts to do this:

https://www.linkedin.com/pulse/automate-firewall-policies-dropping-traffic-invalid-gonzalez-diaz/

Hope this helps,

-Kiwi.

Re: BGP ROA and RPKI

Kevin_Somers — Wed, 18 Jan 2023 16:23:59 GMT

Excellent! Thank you. So it's not yet a feature of the firewall, but the article you provided would be an acceptable work-around.

Re: BGP ROA and RPKI

kiwi — Wed, 18 Jan 2023 16:33:06 GMT

Hi @Kevin_Somers ,

Exact - I wasn't able to find an existing feature request for it either.

You might want to reach out to your local sales rep and have him add the feature request for you after which you can add your vote to it. Others can then also add their votes to the FR# to give it more traction:

https://live.paloaltonetworks.com/t5/blogs/how-to-use-palo-alto-networks-new-feature-request/ba-p/409590

Cheers !

-Kiwi.