BGP ROA and RPKI

[Kevin_Somers]

Does BGP on PAN-OS, any version, support Route Origin Authorization (ROA) or Resource Public Key Infrastructure (RPKI)?  I find nothing in the docs or in the web interface that would indicate it is supported.

[kiwi · Accepted solution]

Hi @Kevin_Somers ,

I have no experience with this unfortunately but if I'm not mistaken this is discussed in a very interesting article on Linkedin where Gonzalez Diaz used scripts to do this:

https://www.linkedin.com/pulse/automate-firewall-policies-dropping-traffic-invalid-gonzalez-diaz/

Hope this helps,

-Kiwi.

[Kevin_Somers · Accepted solution]

Excellent!  Thank you.  So it's not yet a feature of the firewall, but the article you provided would be an acceptable work-around.

[kiwi]

Hi @Kevin_Somers ,

Exact - I wasn't able to find an existing feature request for it either. 

You might want to reach out to your local sales rep and have him add the feature request for you after which you can add your vote to it.  Others can then also add their votes to the FR# to give it more traction:

https://live.paloaltonetworks.com/t5/blogs/how-to-use-palo-alto-networks-new-feature-request/ba-p/40...

Cheers !

-Kiwi.