]> New H3C Technologies

China linchangwang.04414@h3c.com

China Mobile

China liuyisong@chinamobile.com

Huawei Technologies

China rainsword.wang@huawei.com

Juniper Networks, Inc.

1133 Innovation Way Sunnyvale, CA 94089 United States of America jishnur@juniper.net

ZDNS

Floor 21, Block B, Greenland Center Chaoyang Beijing, 100102 China madi@zdns.cn

Routing IDR Working Group YANG, BGP, RPKI This document defines YANG data models for managing BGP information about Resource Public Key Infrastructure (RPKI).

Introduction and describe a protocol to deliver the Resource Public Key Infrastructure (RPKI) prefix origin data and router keys from a trusted cache server to a router, referred to as the RPKI to Router protocol. updates by mainly adding a new ASPA (Autonomous System Provider Authorization) PDU (Protocol Data Unit) type. validates the origination Autonomous System (AS) of BGP (Border Gateway Protocol) routes based on the Validated ROA Payload (VRP) received from the RPKI cache server. makes use of ASPA objects in the RPKI to verify the BGP AS_PATH attribute of advertised routes. describes that the public key is published in the RPKI and sent to the router via the RPKI to Router protocol for verifying the signature of BGPsec announcements. This document defines YANG data models for managing BGP information about RPKI. The YANG data models in this document conform to the Network Management Datastore Architecture (NMDA) .

Terminology The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in BCP 14 when, and only when, they appear in all capitals, as shown here.

Model Overview Three YANG data models are defined in this document to augment BGP YANG model . The ietf-bgp-origin-as-validation.yang data model provides the methods for configuring BGP origin AS validation.

• Origin AS validation parameters for BGP routes.
• Origin AS validity states of BGP routes.

The ietf-bgp-sec.yang data model provides the methods for configuring BGPsec.

• BGPsec parameters for BGP routes.
• BGPsec validity states of BGP routes.

The ietf-bgp-aspa.yang data model provides the methods for configuring BGP AS_PATH Verification Based on ASPA.

• BGP ASPA parameters for BGP routes.
• AS_PATH validity states of BGP routes.

BGP Origin AS Validation YANG Module

Tree View The complete tree of the ietf-bgp-origin-as-validation.yang data model is shown below. See for an explanation of the symbols used. /rt-pol:routing-policy | /policy-definitions | /policy-definition/name +--rw redistribution-as? inet:as-number augment /rt:routing/rt:control-plane-protocols /rt:control-plane-protocol/bgp:bgp/bgp:global /bgp:afi-safis/bgp:afi-safi/bgp:ipv6-unicast: +--rw origin-as-validation +--rw enabled? boolean +--rw eligible-prefix-policy? -> /rt-pol:routing-policy | /policy-definitions | /policy-definition/name +--rw redistribution-as? inet:as-number augment /rt:routing/rt:control-plane-protocols /rt:control-plane-protocol/bgp:bgp/bgp:rib /bgp:afi-safis/bgp:afi-safi/bgp:ipv4-unicast /bgp:neighbors/bgp:neighbor/bgp:adj-rib-in-pre: +--ro statistics +--ro validation-state-unverified? yang:gauge32 +--ro validation-state-unknown? yang:gauge32 +--ro validation-state-invalid? yang:gauge32 +--ro validation-state-valid? yang:gauge32 augment /rt:routing/rt:control-plane-protocols /rt:control-plane-protocol/bgp:bgp/bgp:rib /bgp:afi-safis/bgp:afi-safi/bgp:ipv6-unicast /bgp:neighbors/bgp:neighbor/bgp:adj-rib-in-pre: +--ro statistics +--ro validation-state-unverified? yang:gauge32 +--ro validation-state-unknown? yang:gauge32 +--ro validation-state-invalid? yang:gauge32 +--ro validation-state-valid? yang:gauge32 augment /rt:routing/rt:control-plane-protocols /rt:control-plane-protocol/bgp:bgp/bgp:rib /bgp:afi-safis/bgp:afi-safi/bgp:ipv4-unicast /bgp:neighbors/bgp:neighbor/bgp:adj-rib-in-post: +--ro statistics +--ro validation-state-unverified? yang:gauge32 +--ro validation-state-unknown? yang:gauge32 +--ro validation-state-invalid? yang:gauge32 +--ro validation-state-valid? yang:gauge32 augment /rt:routing/rt:control-plane-protocols /rt:control-plane-protocol/bgp:bgp/bgp:rib /bgp:afi-safis/bgp:afi-safi/bgp:ipv6-unicast /bgp:neighbors/bgp:neighbor/bgp:adj-rib-in-post: +--ro statistics +--ro validation-state-unverified? yang:gauge32 +--ro validation-state-unknown? yang:gauge32 +--ro validation-state-invalid? yang:gauge32 +--ro validation-state-valid? yang:gauge32 augment /rt:routing/rt:control-plane-protocols /rt:control-plane-protocol/bgp:bgp/bgp:rib /bgp:afi-safis/bgp:afi-safi/bgp:ipv4-unicast /bgp:loc-rib: +--ro statistics +--ro validation-state-unverified? yang:gauge32 +--ro validation-state-unknown? yang:gauge32 +--ro validation-state-invalid? yang:gauge32 +--ro validation-state-valid? yang:gauge32 augment /rt:routing/rt:control-plane-protocols /rt:control-plane-protocol/bgp:bgp/bgp:rib /bgp:afi-safis/bgp:afi-safi/bgp:ipv6-unicast /bgp:loc-rib: +--ro statistics +--ro validation-state-unverified? yang:gauge32 +--ro validation-state-unknown? yang:gauge32 +--ro validation-state-invalid? yang:gauge32 +--ro validation-state-valid? yang:gauge32 augment /rt:routing/rt:control-plane-protocols /rt:control-plane-protocol/bgp:bgp/bgp:rib /bgp:afi-safis/bgp:afi-safi/bgp:ipv4-unicast /bgp:neighbors/bgp:neighbor/bgp:adj-rib-out-pre: +--ro statistics +--ro validation-state-unverified? yang:gauge32 +--ro validation-state-unknown? yang:gauge32 +--ro validation-state-invalid? yang:gauge32 +--ro validation-state-valid? yang:gauge32 augment /rt:routing/rt:control-plane-protocols /rt:control-plane-protocol/bgp:bgp/bgp:rib /bgp:afi-safis/bgp:afi-safi/bgp:ipv6-unicast /bgp:neighbors/bgp:neighbor/bgp:adj-rib-out-pre: +--ro statistics +--ro validation-state-unverified? yang:gauge32 +--ro validation-state-unknown? yang:gauge32 +--ro validation-state-invalid? yang:gauge32 +--ro validation-state-valid? yang:gauge32 augment /rt:routing/rt:control-plane-protocols /rt:control-plane-protocol/bgp:bgp/bgp:rib /bgp:afi-safis/bgp:afi-safi/bgp:ipv4-unicast /bgp:neighbors/bgp:neighbor/bgp:adj-rib-out-post: +--ro statistics +--ro validation-state-unverified? yang:gauge32 +--ro validation-state-unknown? yang:gauge32 +--ro validation-state-invalid? yang:gauge32 +--ro validation-state-valid? yang:gauge32 augment /rt:routing/rt:control-plane-protocols /rt:control-plane-protocol/bgp:bgp/bgp:rib /bgp:afi-safis/bgp:afi-safi/bgp:ipv6-unicast /bgp:neighbors/bgp:neighbor/bgp:adj-rib-out-post: +--ro statistics +--ro validation-state-unverified? yang:gauge32 +--ro validation-state-unknown? yang:gauge32 +--ro validation-state-invalid? yang:gauge32 +--ro validation-state-valid? yang:gauge32 augment /rt:routing/rt:control-plane-protocols /rt:control-plane-protocol/bgp:bgp/bgp:rib /bgp:afi-safis/bgp:afi-safi/bgp:ipv4-unicast /bgp:loc-rib/bgp:routes/bgp:route: +--ro origin-as-validity? origin-as-validity-state +--ro validity-invalid-reason? route-validity-invalid-reason augment /rt:routing/rt:control-plane-protocols /rt:control-plane-protocol/bgp:bgp/bgp:rib /bgp:afi-safis/bgp:afi-safi/bgp:ipv6-unicast /bgp:loc-rib/bgp:routes/bgp:route: +--ro origin-as-validity? origin-as-validity-state +--ro validity-invalid-reason? route-validity-invalid-reason augment /rt:routing/rt:control-plane-protocols /rt:control-plane-protocol/bgp:bgp/bgp:global /bgp:afi-safis/bgp:afi-safi/bgp:route-selection-options: +--rw origin-as +--rw enabled? boolean +--rw allow-invalid? boolean +--rw allow-not-found? boolean +--rw eligible-prefix-policy? -> /rt-pol:routing-policy /policy-definitions /policy-definition/name augment /rt:routing/rt:control-plane-protocols /rt:control-plane-protocol/bgp:bgp/bgp:neighbors /bgp:neighbor/bgp:afi-safis/bgp:afi-safi /bgp:ipv4-unicast: +--rw origin-as-validity-advertisement | +--rw send-origin-as-validity? boolean | +--rw eligible-prefix-policy? -> /rt-pol:routing-policy | /policy-definitions | /policy-definition/name +--rw export-origin-as-validation +--rw enabled? boolean +--rw allow-not-found? boolean +--rw eligible-prefix-policy? -> /rt-pol:routing-policy /policy-definitions /policy-definition/name augment /rt:routing/rt:control-plane-protocols /rt:control-plane-protocol/bgp:bgp/bgp:neighbors /bgp:neighbor/bgp:afi-safis/bgp:afi-safi /bgp:ipv6-unicast: +--rw origin-as-validity-advertisement | +--rw send-origin-as-validity? boolean | +--rw eligible-prefix-policy? -> /rt-pol:routing-policy | /policy-definitions | /policy-definition/name +--rw export-origin-as-validation +--rw enabled? boolean +--rw allow-not-found? boolean +--rw eligible-prefix-policy? -> /rt-pol:routing-policy /policy-definitions /policy-definition/name augment /rt:routing/rt:control-plane-protocols /rt:control-plane-protocol/bgp:bgp/bgp:peer-groups /bgp:peer-group/bgp:afi-safis/bgp:afi-safi /bgp:ipv4-unicast: +--rw origin-as-validity-advertisement | +--rw send-origin-as-validity? boolean | +--rw eligible-prefix-policy? -> /rt-pol:routing-policy | /policy-definitions | /policy-definition/name +--rw export-origin-as-validation +--rw enabled? boolean +--rw allow-not-found? boolean +--rw eligible-prefix-policy? -> /rt-pol:routing-policy /policy-definitions /policy-definition/name augment /rt:routing/rt:control-plane-protocols /rt:control-plane-protocol/bgp:bgp/bgp:peer-groups /bgp:peer-group/bgp:afi-safis/bgp:afi-safi /bgp:ipv6-unicast: +--rw origin-as-validity-advertisement | +--rw send-origin-as-validity? boolean | +--rw eligible-prefix-policy? -> /rt-pol:routing-policy | /policy-definitions | /policy-definition/name +--rw export-origin-as-validation +--rw enabled? boolean +--rw allow-not-found? boolean +--rw eligible-prefix-policy? -> /rt-pol:routing-policy /policy-definitions /policy-definition/name ]]>

YANG Module This YANG module has normative references to , , , , , , , and the BGP YANG model . WG List: IDR Authors: Changwang Lin Yisong Liu Haibo Wang Jishnu Roy Di Ma "; description "This module describes configuration of the BGP origin AS validation. The key words 'MUST', 'MUST NOT', 'REQUIRED', 'SHALL', 'SHALL NOT', 'SHOULD', 'SHOULD NOT', 'RECOMMENDED', 'NOT RECOMMENDED', 'MAY', and 'OPTIONAL' in this document are to be interpreted as described in BCP 14 (RFC 2119) (RFC 8174) when, and only when, they appear in all capitals, as shown here. Copyright (c) 2026 IETF Trust and the persons identified as authors of the code. All rights reserved. Redistribution and use in source and binary forms, with or without modification, is permitted pursuant to, and subject to the license terms contained in, the Revised BSD License set forth in Section 4.c of the IETF Trust's Legal Provisions Relating to IETF Documents (https://trustee.ietf.org/license-info). All revisions of IETF and IANA published modules can be found at the YANG Parameters registry group (https://www.iana.org/assignments/yang-parameters). This version of this YANG module is part of RFC XXXX; see the RFC itself for full legal notices."; revision 2026-09-28 { description "Initial Version"; reference "RFC XXXX: YANG Data Model for BGP about RPKI"; } identity ineligible-origin-as { base brt:ineligible-route-reason; description "Route was ineligible due to origin AS validation."; } typedef route-validity-invalid-reason { type enumeration { enum ineligible-origin-as { description "Route was ineligible due to origin AS number mismatch."; } enum ineligible-max-len { description "Route was ineligible due to prefix maximum length mismatch."; } } description "Origin AS validation state invalid reason of BGP routes."; } typedef origin-as-validity-state { type enumeration { enum not-found { description "No VRP Covers the Route Prefix."; } enum valid { description "At least one VRP Matches the Route Prefix."; } enum invalid { description "At least one VRP Covers the Route Prefix, but no VRP Matches it."; } enum disabled { description "BGP origin AS validation is not enabled."; } } description "Origin AS validation state of BGP routes."; reference "RFC 6811: BGP Prefix Origin Validation"; } grouping origin-as-validation-config { description "Origin AS validation of BGP prefix."; container origin-as-validation { leaf enabled { type boolean; default "false"; description "Whether origin AS validation of BGP prefix is enabled."; } leaf eligible-prefix-policy { type leafref { path "/rt-pol:routing-policy/rt-pol:policy-definitions/" + "rt-pol:policy-definition/rt-pol:name"; } description "A reference to a routing policy which can be used to restrict the prefixes for which origin AS validation is enabled."; } leaf redistribution-as { type inet:as-number; description "Specifies an AS number that MUST be used in the origin AS validation for redistributed routes since they have no AS_PATH."; reference "RFC 8481: Clarifications to BGP Origin Validation Based on Resource Public Key Infrastructure (RPKI)"; } description "Origin AS validation of BGP prefix."; } } grouping origin-as-selection-option { description "Origin AS option for BGP route selection."; container origin-as { leaf enabled { type boolean; default "false"; description "When set to true, the origin AS validity states are taken into consideration in the best-path calculation. If set to false, the origin AS validity states are not taken into consideration in the best-path calculation."; } leaf allow-invalid { type boolean; default "false"; description "When set to true, routes whose origin AS validation state is 'invalid' MAY be taken into consideration in the best-path calculation. If set to false, such routes MUST be excluded from the best-path calculation."; } leaf allow-not-found { type boolean; default "true"; description "When set to true, routes whose origin AS validation state is 'not-found' MAY be taken into consideration in the best-path calculation. If set to false, such routes MUST be excluded from the best-path calculation."; } leaf eligible-prefix-policy { type leafref { path "/rt-pol:routing-policy/rt-pol:policy-definitions/" + "rt-pol:policy-definition/rt-pol:name"; } description "A reference to a routing policy which can be used to restrict the prefixes for which origin AS option is enabled for BGP route selection."; } description "Origin AS option for BGP route selection."; } } grouping origin-as-validity-advertisement { description "Structural grouping used for advertisement of Origin Validation State Extended Community to neighbor(s)."; container origin-as-validity-advertisement { leaf send-origin-as-validity { type boolean; default "false"; description "If set to true, the origin AS validity MUST be sent to the neighbor(s) using the Origin Validation State Extended Community."; reference "RFC 8097: BGP Prefix Origin Validation State Extended Community"; } leaf eligible-prefix-policy { type leafref { path "/rt-pol:routing-policy/rt-pol:policy-definitions/" + "rt-pol:policy-definition/rt-pol:name"; } description "A reference to a routing policy which can be used to restrict the prefixes for which Origin Validation State Extended Community is advertised."; } description "Advertisement of Origin Validation State Extended Community to neighbor(s)."; } } grouping export-origin-as-validation-config { description "Export origin AS validation of BGP prefix."; container export-origin-as-validation { leaf enabled { type boolean; default "false"; description "When set to true, the origin AS validity states are taken into consideration in BGP export. If set to false, the origin AS validity states are not taken into consideration in BGP export."; } leaf allow-not-found { type boolean; default "false"; description "When set to true, routes with 'not-found' origin AS MAY be sent to the neighbor. If set to false, such routes MUST NOT be sent to the neighbor."; } leaf eligible-prefix-policy { type leafref { path "/rt-pol:routing-policy/rt-pol:policy-definitions/" + "rt-pol:policy-definition/rt-pol:name"; } description "A reference to a routing policy which can be used to restrict the prefixes for which origin AS validity states are considered in BGP export."; } description "Export origin AS validation of BGP prefix."; reference "RFC 8893: Resource Public Key Infrastructure (RPKI) Origin Validation for BGP Export"; } } grouping origin-as-validity-statistics { description "Origin AS validation statistics."; container statistics { config false; leaf validation-state-unverified { type yang:gauge32; description "The number of routes with validation state as unverified."; } leaf validation-state-unknown { type yang:gauge32; description "The number of routes with validation state as unknown."; } leaf validation-state-invalid { type yang:gauge32; description "The number of routes with validation state as invalid."; } leaf validation-state-valid { type yang:gauge32; description "The number of routes with validation state as valid."; } description "Statistical data for origin AS validation states."; } } augment "/rt:routing/rt:control-plane-protocols" + "/rt:control-plane-protocol/bgp:bgp/bgp:global" + "/bgp:afi-safis/bgp:afi-safi/bgp:ipv4-unicast" { description "Origin AS validation augmentation of BGP IPv4 Unicast Address Family."; uses origin-as-validation-config; } augment "/rt:routing/rt:control-plane-protocols" + "/rt:control-plane-protocol/bgp:bgp/bgp:global" + "/bgp:afi-safis/bgp:afi-safi/bgp:ipv6-unicast" { description "Origin AS validation augmentation of BGP IPv6 Unicast Address Family."; uses origin-as-validation-config; } augment "/rt:routing/rt:control-plane-protocols" + "/rt:control-plane-protocol/bgp:bgp/bgp:rib" + "/bgp:afi-safis/bgp:afi-safi/bgp:ipv4-unicast" + "/bgp:neighbors/bgp:neighbor/bgp:adj-rib-in-pre" { description "Augmentation of BGP IPv4 Unicast route statistics."; uses origin-as-validity-statistics; } augment "/rt:routing/rt:control-plane-protocols" + "/rt:control-plane-protocol/bgp:bgp/bgp:rib" + "/bgp:afi-safis/bgp:afi-safi/bgp:ipv6-unicast" + "/bgp:neighbors/bgp:neighbor/bgp:adj-rib-in-pre" { description "Augmentation of BGP IPv6 Unicast route statistics."; uses origin-as-validity-statistics; } augment "/rt:routing/rt:control-plane-protocols" + "/rt:control-plane-protocol/bgp:bgp/bgp:rib" + "/bgp:afi-safis/bgp:afi-safi/bgp:ipv4-unicast" + "/bgp:neighbors/bgp:neighbor/bgp:adj-rib-in-post" { description "Augmentation of BGP IPv4 Unicast route statistics."; uses origin-as-validity-statistics; } augment "/rt:routing/rt:control-plane-protocols" + "/rt:control-plane-protocol/bgp:bgp/bgp:rib" + "/bgp:afi-safis/bgp:afi-safi/bgp:ipv6-unicast" + "/bgp:neighbors/bgp:neighbor/bgp:adj-rib-in-post" { description "Augmentation of BGP IPv6 Unicast route statistics."; uses origin-as-validity-statistics; } augment "/rt:routing/rt:control-plane-protocols" + "/rt:control-plane-protocol/bgp:bgp/bgp:rib" + "/bgp:afi-safis/bgp:afi-safi/bgp:ipv4-unicast" + "/bgp:loc-rib" { description "Augmentation of BGP IPv4 Unicast route statistics."; uses origin-as-validity-statistics; } augment "/rt:routing/rt:control-plane-protocols" + "/rt:control-plane-protocol/bgp:bgp/bgp:rib" + "/bgp:afi-safis/bgp:afi-safi/bgp:ipv6-unicast" + "/bgp:loc-rib" { description "Augmentation of BGP IPv6 Unicast route statistics."; uses origin-as-validity-statistics; } augment "/rt:routing/rt:control-plane-protocols" + "/rt:control-plane-protocol/bgp:bgp/bgp:rib" + "/bgp:afi-safis/bgp:afi-safi/bgp:ipv4-unicast" + "/bgp:neighbors/bgp:neighbor/bgp:adj-rib-out-pre" { description "Augmentation of BGP IPv4 Unicast route statistics."; uses origin-as-validity-statistics; } augment "/rt:routing/rt:control-plane-protocols" + "/rt:control-plane-protocol/bgp:bgp/bgp:rib" + "/bgp:afi-safis/bgp:afi-safi/bgp:ipv6-unicast" + "/bgp:neighbors/bgp:neighbor/bgp:adj-rib-out-pre" { description "Augmentation of BGP IPv6 Unicast route statistics."; uses origin-as-validity-statistics; } augment "/rt:routing/rt:control-plane-protocols" + "/rt:control-plane-protocol/bgp:bgp/bgp:rib" + "/bgp:afi-safis/bgp:afi-safi/bgp:ipv4-unicast" + "/bgp:neighbors/bgp:neighbor/bgp:adj-rib-out-post" { description "Augmentation of BGP IPv4 Unicast route statistics."; uses origin-as-validity-statistics; } augment "/rt:routing/rt:control-plane-protocols" + "/rt:control-plane-protocol/bgp:bgp/bgp:rib" + "/bgp:afi-safis/bgp:afi-safi/bgp:ipv6-unicast" + "/bgp:neighbors/bgp:neighbor/bgp:adj-rib-out-post" { description "Augmentation of BGP IPv6 Unicast route statistics."; uses origin-as-validity-statistics; } augment "/rt:routing/rt:control-plane-protocols" + "/rt:control-plane-protocol/bgp:bgp/bgp:rib" + "/bgp:afi-safis/bgp:afi-safi/bgp:ipv4-unicast" + "/bgp:loc-rib/bgp:routes/bgp:route" { description "Origin AS validity augmentation of BGP IPv4 Unicast route."; leaf origin-as-validity { type origin-as-validity-state; description "Origin AS validity of BGP IPv4 Unicast prefix."; } leaf validity-invalid-reason { type route-validity-invalid-reason; description "Reason for marking a BGP IPv4 Unicast prefix as invalid."; } } augment "/rt:routing/rt:control-plane-protocols" + "/rt:control-plane-protocol/bgp:bgp/bgp:rib" + "/bgp:afi-safis/bgp:afi-safi/bgp:ipv6-unicast" + "/bgp:loc-rib/bgp:routes/bgp:route" { description "Origin AS validity augmentation of BGP IPv6 Unicast route."; leaf origin-as-validity { type origin-as-validity-state; description "Origin AS validity of BGP IPv6 Unicast prefix."; } leaf validity-invalid-reason { type route-validity-invalid-reason; description "Reason for marking a BGP IPv6 Unicast prefix as invalid."; } } augment "/rt:routing/rt:control-plane-protocols" + "/rt:control-plane-protocol/bgp:bgp/bgp:global" + "/bgp:afi-safis/bgp:afi-safi" + "/bgp:route-selection-options" { when "derived-from-or-self(../bgp:name, 'bast:ipv4-unicast') or " + "derived-from-or-self(../bgp:name, 'bast:ipv6-unicast')" { description "This augmentation is valid for IPv4 and IPv6 Unicast."; } description "Augmentation of BGP route selection options."; uses origin-as-selection-option; } augment "/rt:routing/rt:control-plane-protocols" + "/rt:control-plane-protocol/bgp:bgp/bgp:neighbors" + "/bgp:neighbor/bgp:afi-safis/bgp:afi-safi" + "/bgp:ipv4-unicast" { description "Augmentation of origin AS validation sending management for IPv4 Unicast neighbor."; uses origin-as-validity-advertisement; uses export-origin-as-validation-config; } augment "/rt:routing/rt:control-plane-protocols" + "/rt:control-plane-protocol/bgp:bgp/bgp:neighbors" + "/bgp:neighbor/bgp:afi-safis/bgp:afi-safi" + "/bgp:ipv6-unicast" { description "Augmentation of origin AS validation sending management for IPv6 Unicast neighbor."; uses origin-as-validity-advertisement; uses export-origin-as-validation-config; } augment "/rt:routing/rt:control-plane-protocols" + "/rt:control-plane-protocol/bgp:bgp/bgp:peer-groups" + "/bgp:peer-group/bgp:afi-safis/bgp:afi-safi" + "/bgp:ipv4-unicast" { description "Augmentation of origin AS validation sending management for IPv4 Unicast peer group."; uses origin-as-validity-advertisement; uses export-origin-as-validation-config; } augment "/rt:routing/rt:control-plane-protocols" + "/rt:control-plane-protocol/bgp:bgp/bgp:peer-groups" + "/bgp:peer-group/bgp:afi-safis/bgp:afi-safi" + "/bgp:ipv6-unicast" { description "Augmentation of origin AS validation sending management for IPv6 Unicast peer group."; uses origin-as-validity-advertisement; uses export-origin-as-validation-config; } } ]]>

BGPsec YANG Module

Tree View The complete tree of the ietf-bgp-sec.yang data model is shown below. See for an explanation of the symbols used. /rt-pol:routing-policy /policy-definitions /policy-definition/name augment /rt:routing/rt:control-plane-protocols /rt:control-plane-protocol/bgp:bgp/bgp:global /bgp:afi-safis/bgp:afi-safi/bgp:ipv6-unicast: +--rw bgpsec-validation +--rw enabled? boolean +--rw eligible-prefix-policy? -> /rt-pol:routing-policy /policy-definitions /policy-definition/name augment /rt:routing/rt:control-plane-protocols /rt:control-plane-protocol/bgp:bgp/bgp:rib /bgp:afi-safis/bgp:afi-safi/bgp:ipv4-unicast /bgp:loc-rib/bgp:routes/bgp:route: +--ro bgpsec-validity? bgpsec-validity-state augment /rt:routing/rt:control-plane-protocols /rt:control-plane-protocol/bgp:bgp/bgp:rib /bgp:afi-safis/bgp:afi-safi/bgp:ipv6-unicast /bgp:loc-rib/bgp:routes/bgp:route: +--ro bgpsec-validity? bgpsec-validity-state augment /rt:routing/rt:control-plane-protocols /rt:control-plane-protocol/bgp:bgp/bgp:global /bgp:afi-safis/bgp:afi-safi/bgp:route-selection-options: +--rw bgpsec +--rw enabled? boolean +--rw allow-invalid? boolean +--rw eligible-prefix-policy? -> /rt-pol:routing-policy /policy-definitions /policy-definition/name augment /rt:routing/rt:control-plane-protocols /rt:control-plane-protocol/bgp:bgp/bgp:neighbors /bgp:neighbor/bgp:afi-safis/bgp:afi-safi /bgp:ipv4-unicast: +--rw export-bgpsec-validation +--rw enabled? boolean +--rw eligible-prefix-policy? -> /rt-pol:routing-policy /policy-definitions /policy-definition/name augment /rt:routing/rt:control-plane-protocols /rt:control-plane-protocol/bgp:bgp/bgp:neighbors /bgp:neighbor/bgp:afi-safis/bgp:afi-safi /bgp:ipv6-unicast: +--rw export-bgpsec-validation +--rw enabled? boolean +--rw eligible-prefix-policy? -> /rt-pol:routing-policy /policy-definitions /policy-definition/name augment /rt:routing/rt:control-plane-protocols /rt:control-plane-protocol/bgp:bgp/bgp:peer-groups /bgp:peer-group/bgp:afi-safis/bgp:afi-safi /bgp:ipv4-unicast: +--rw export-bgpsec-validation +--rw enabled? boolean +--rw eligible-prefix-policy? -> /rt-pol:routing-policy /policy-definitions /policy-definition/name augment /rt:routing/rt:control-plane-protocols /rt:control-plane-protocol/bgp:bgp/bgp:peer-groups /bgp:peer-group/bgp:afi-safis/bgp:afi-safi /bgp:ipv6-unicast: +--rw export-bgpsec-validation +--rw enabled? boolean +--rw eligible-prefix-policy? -> /rt-pol:routing-policy /policy-definitions /policy-definition/name ]]>

YANG Module This YANG module has normative references to , , , and the BGP YANG model . WG List: IDR Authors: Changwang Lin Yisong Liu Haibo Wang Jishnu Roy Di Ma "; description "This module describes management of BGPsec. The key words 'MUST', 'MUST NOT', 'REQUIRED', 'SHALL', 'SHALL NOT', 'SHOULD', 'SHOULD NOT', 'RECOMMENDED', 'NOT RECOMMENDED', 'MAY', and 'OPTIONAL' in this document are to be interpreted as described in BCP 14 (RFC 2119) (RFC 8174) when, and only when, they appear in all capitals, as shown here. Copyright (c) 2026 IETF Trust and the persons identified as authors of the code. All rights reserved. Redistribution and use in source and binary forms, with or without modification, is permitted pursuant to, and subject to the license terms contained in, the Revised BSD License set forth in Section 4.c of the IETF Trust's Legal Provisions Relating to IETF Documents (https://trustee.ietf.org/license-info). All revisions of IETF and IANA published modules can be found at the YANG Parameters registry group (https://www.iana.org/assignments/yang-parameters). This version of this YANG module is part of RFC XXXX; see the RFC itself for full legal notices."; revision 2026-09-28 { description "Initial Version"; reference "RFC XXXX: YANG Data Model for BGP about RPKI"; } identity ineligible-bgp { base brt:ineligible-route-reason; description "Route was ineligible due to BGPsec."; } typedef bgpsec-validity-state { type enumeration { enum valid { description "The BGPsec validation state of the route is valid."; } enum invalid { description "The BGPsec validation state of the route is invalid."; } enum disabled { description "BGPsec validation is not enabled."; } } description "BGPsec validation state of BGP routes."; reference "RFC 8205: BGPsec Protocol Specification"; } grouping bgpsec-validation-config { description "BGPsec validation of BGP prefix."; container bgpsec-validation { leaf enabled { type boolean; default "false"; description "Whether BGPsec validation of BGP prefix is enabled."; } leaf eligible-prefix-policy { type leafref { path "/rt-pol:routing-policy/rt-pol:policy-definitions/" + "rt-pol:policy-definition/rt-pol:name"; } description "A reference to a routing policy which can be used to restrict the prefixes for which BGPsec validation is enabled."; } description "BGPsec validation of BGP prefix."; } } grouping bgpsec-selection-option { description "BGPsec option for BGP route selection."; container bgpsec { leaf enabled { type boolean; default "false"; description "When set to true, the BGPsec validity states are taken into consideration in the best-path calculation. If set to false, the BGPsec validity states are not taken into consideration in the best-path calculation."; } leaf allow-invalid { type boolean; default "false"; description "When set to true, routes whose BGPsec validity state is 'invalid' MAY be taken into consideration in the best-path calculation. If set to false, such routes MUST be excluded from the best-path calculation."; } leaf eligible-prefix-policy { type leafref { path "/rt-pol:routing-policy/rt-pol:policy-definitions/" + "rt-pol:policy-definition/rt-pol:name"; } description "A reference to a routing policy which can be used to restrict the prefixes for which BGPsec option is enabled in BGP route selection."; } description "BGPsec option for BGP route selection."; } } grouping export-bgpsec-validation-config { description "Export BGPsec validation of BGP prefix."; container export-bgpsec-validation { leaf enabled { type boolean; default "false"; description "When set to true, the BGPsec validity states are taken into consideration in BGP export. If set to false, the BGPsec validity states are not taken into consideration in BGP export."; } leaf eligible-prefix-policy { type leafref { path "/rt-pol:routing-policy/rt-pol:policy-definitions/" + "rt-pol:policy-definition/rt-pol:name"; } description "A reference to a routing policy which can be used to restrict the prefixes for which BGPsec validity states are considered in BGP export."; } description "Export BGPsec validation of BGP prefix."; } } augment "/rt:routing/rt:control-plane-protocols" + "/rt:control-plane-protocol/bgp:bgp/bgp:global" + "/bgp:afi-safis/bgp:afi-safi/bgp:ipv4-unicast" { description "BGPsec augmentation of BGP IPv4 Unicast Address Family."; uses bgpsec-validation-config; } augment "/rt:routing/rt:control-plane-protocols" + "/rt:control-plane-protocol/bgp:bgp/bgp:global" + "/bgp:afi-safis/bgp:afi-safi/bgp:ipv6-unicast" { description "BGPsec augmentation of BGP IPv6 Unicast Address Family."; uses bgpsec-validation-config; } augment "/rt:routing/rt:control-plane-protocols" + "/rt:control-plane-protocol/bgp:bgp/bgp:rib" + "/bgp:afi-safis/bgp:afi-safi/bgp:ipv4-unicast" + "/bgp:loc-rib/bgp:routes/bgp:route" { description "BGPsec augmentation of BGP IPv4 Unicast route."; leaf bgpsec-validity { type bgpsec-validity-state; description "BGPsec validity of BGP IPv4 Unicast prefix."; } } augment "/rt:routing/rt:control-plane-protocols" + "/rt:control-plane-protocol/bgp:bgp/bgp:rib" + "/bgp:afi-safis/bgp:afi-safi/bgp:ipv6-unicast" + "/bgp:loc-rib/bgp:routes/bgp:route" { description "BGPsec augmentation of BGP IPv6 Unicast route."; leaf bgpsec-validity { type bgpsec-validity-state; description "BGPsec validity of BGP IPv6 Unicast prefix."; } } augment "/rt:routing/rt:control-plane-protocols" + "/rt:control-plane-protocol/bgp:bgp/bgp:global" + "/bgp:afi-safis/bgp:afi-safi" + "/bgp:route-selection-options" { when "derived-from-or-self(../bgp:name, 'bast:ipv4-unicast') or " + "derived-from-or-self(../bgp:name, 'bast:ipv6-unicast')" { description "This augmentation is valid for IPv4 and IPv6 Unicast."; } description "BGPsec augmentation of BGP route selection options."; uses bgpsec-selection-option; } augment "/rt:routing/rt:control-plane-protocols" + "/rt:control-plane-protocol/bgp:bgp/bgp:neighbors" + "/bgp:neighbor/bgp:afi-safis/bgp:afi-safi" + "/bgp:ipv4-unicast" { description "BGPsec augmentation for IPv4 Unicast neighbor."; uses export-bgpsec-validation-config; } augment "/rt:routing/rt:control-plane-protocols" + "/rt:control-plane-protocol/bgp:bgp/bgp:neighbors" + "/bgp:neighbor/bgp:afi-safis/bgp:afi-safi" + "/bgp:ipv6-unicast" { description "BGPsec augmentation for IPv6 Unicast neighbor."; uses export-bgpsec-validation-config; } augment "/rt:routing/rt:control-plane-protocols" + "/rt:control-plane-protocol/bgp:bgp/bgp:peer-groups" + "/bgp:peer-group/bgp:afi-safis/bgp:afi-safi" + "/bgp:ipv4-unicast" { description "BGPsec augmentation for IPv4 Unicast peer group."; uses export-bgpsec-validation-config; } augment "/rt:routing/rt:control-plane-protocols" + "/rt:control-plane-protocol/bgp:bgp/bgp:peer-groups" + "/bgp:peer-group/bgp:afi-safis/bgp:afi-safi" + "/bgp:ipv6-unicast" { description "BGPsec augmentation for IPv6 Unicast peer group."; uses export-bgpsec-validation-config; } } ]]>

BGP ASPA YANG Module

Tree View The complete tree of the ietf-bgp-aspa.yang data model is shown below. See for an explanation of the symbols used. /rt-pol:routing-policy /policy-definitions /policy-definition/name augment /rt:routing/rt:control-plane-protocols /rt:control-plane-protocol/bgp:bgp/bgp:global /bgp:afi-safis/bgp:afi-safi/bgp:ipv6-unicast: +--rw aspa-verification +--rw enabled? boolean +--rw eligible-prefix-policy? -> /rt-pol:routing-policy /policy-definitions /policy-definition/name augment /rt:routing/rt:control-plane-protocols /rt:control-plane-protocol/bgp:bgp/bgp:rib /bgp:afi-safis/bgp:afi-safi/bgp:ipv4-unicast /bgp:loc-rib/bgp:routes/bgp:route: +--ro aspa-verification-state? aspa-verification-state augment /rt:routing/rt:control-plane-protocols /rt:control-plane-protocol/bgp:bgp/bgp:rib /bgp:afi-safis/bgp:afi-safi/bgp:ipv6-unicast /bgp:loc-rib/bgp:routes/bgp:route: +--ro aspa-verification-state? aspa-verification-state augment /rt:routing/rt:control-plane-protocols /rt:control-plane-protocol/bgp:bgp/bgp:global /bgp:afi-safis/bgp:afi-safi/bgp:route-selection-options: +--rw aspa +--rw enabled? boolean +--rw allow-invalid? boolean +--rw allow-unknown? boolean +--rw eligible-prefix-policy? -> /rt-pol:routing-policy /policy-definitions /policy-definition/name augment /rt:routing/rt:control-plane-protocols /rt:control-plane-protocol/bgp:bgp/bgp:neighbors /bgp:neighbor/bgp:afi-safis/bgp:afi-safi /bgp:ipv4-unicast: +--rw export-aspa-validation +--rw enabled? boolean +--rw eligible-prefix-policy? -> /rt-pol:routing-policy /policy-definitions /policy-definition/name augment /rt:routing/rt:control-plane-protocols /rt:control-plane-protocol/bgp:bgp/bgp:neighbors /bgp:neighbor/bgp:afi-safis/bgp:afi-safi /bgp:ipv6-unicast: +--rw export-aspa-validation +--rw enabled? boolean +--rw eligible-prefix-policy? -> /rt-pol:routing-policy /policy-definitions /policy-definition/name augment /rt:routing/rt:control-plane-protocols /rt:control-plane-protocol/bgp:bgp/bgp:peer-groups /bgp:peer-group/bgp:afi-safis/bgp:afi-safi /bgp:ipv4-unicast: +--rw export-aspa-validation +--rw enabled? boolean +--rw eligible-prefix-policy? -> /rt-pol:routing-policy /policy-definitions /policy-definition/name augment /rt:routing/rt:control-plane-protocols /rt:control-plane-protocol/bgp:bgp/bgp:peer-groups /bgp:peer-group/bgp:afi-safis/bgp:afi-safi /bgp:ipv6-unicast: +--rw export-aspa-validation +--rw enabled? boolean +--rw eligible-prefix-policy? -> /rt-pol:routing-policy /policy-definitions /policy-definition/name ]]>

YANG Module This YANG module has normative references to , , the BGP YANG model , and the ASPA verification algorithm . WG List: IDR Authors: Changwang Lin Yisong Liu Haibo Wang Jishnu Roy Di Ma "; description "This module describes management of the BGP AS_PATH Verification Based on ASPA. The key words 'MUST', 'MUST NOT', 'REQUIRED', 'SHALL', 'SHALL NOT', 'SHOULD', 'SHOULD NOT', 'RECOMMENDED', 'NOT RECOMMENDED', 'MAY', and 'OPTIONAL' in this document are to be interpreted as described in BCP 14 (RFC 2119) (RFC 8174) when, and only when, they appear in all capitals, as shown here. Copyright (c) 2026 IETF Trust and the persons identified as authors of the code. All rights reserved. Redistribution and use in source and binary forms, with or without modification, is permitted pursuant to, and subject to the license terms contained in, the Revised BSD License set forth in Section 4.c of the IETF Trust's Legal Provisions Relating to IETF Documents (https://trustee.ietf.org/license-info). All revisions of IETF and IANA published modules can be found at the YANG Parameters registry group (https://www.iana.org/assignments/yang-parameters). This version of this YANG module is part of RFC XXXX; see the RFC itself for full legal notices."; revision 2026-09-28 { description "Initial Version"; reference "RFC XXXX: YANG Data Model for BGP about RPKI"; } identity ineligible-aspa { base brt:ineligible-route-reason; description "Route was ineligible due to ASPA verification."; } typedef peer-role { type enumeration { enum customer { description "The role of the BGP peer is customer."; } enum provider { description "The role of the BGP peer is provider."; } enum lateral-peer { description "The role of the BGP peer is lateral peer."; } enum rs { description "The role of the BGP peer is Route Server (RS)."; } enum rs-client { description "The role of the BGP peer is RS-client."; } enum mutual-transit { description "The role of the BGP peer is mutual-transit."; } } description "Roles of BGP peers."; reference "I-D.ietf-sidrops-aspa-verification: BGP AS_PATH Verification Based on Autonomous System Provider Authorization (ASPA) Objects"; } typedef aspa-verification-state { type enumeration { enum valid { description "The ASPA verification outcome is valid."; } enum invalid { description "The ASPA verification outcome is invalid."; } enum unknown { description "The ASPA verification outcome is unknown."; } enum disabled { description "BGP ASPA verification is not enabled."; } } description "ASPA verification state of BGP routes."; reference "I-D.ietf-sidrops-aspa-verification: BGP AS_PATH Verification Based on Autonomous System Provider Authorization (ASPA) Objects"; } grouping aspa-config { description "ASPA verification of BGP prefix."; container aspa-verification { leaf enabled { type boolean; default "false"; description "Whether ASPA verification of BGP prefix is enabled."; } leaf eligible-prefix-policy { type leafref { path "/rt-pol:routing-policy/rt-pol:policy-definitions/" + "rt-pol:policy-definition/rt-pol:name"; } description "A reference to a routing policy which can be used to restrict the prefixes for which ASPA verification is enabled."; } description "ASPA verification of BGP prefix."; } } grouping aspa-selection-option { description "ASPA option for BGP route selection."; container aspa { leaf enabled { type boolean; default "false"; description "When set to true, the ASPA verification states are taken into consideration in the best-path calculation. If set to false, the ASPA verification states are not taken into consideration in the best-path calculation."; } leaf allow-invalid { type boolean; default "false"; description "When set to true, routes whose ASPA verification state is 'invalid' MAY be taken into consideration in the best-path calculation. If set to false, such routes MUST be excluded from the best-path calculation."; } leaf allow-unknown { type boolean; default "true"; description "When set to true, routes whose ASPA verification state is 'unknown' MAY be taken into consideration in the best-path calculation. If set to false, such routes MUST be excluded from the best-path calculation."; } leaf eligible-prefix-policy { type leafref { path "/rt-pol:routing-policy/rt-pol:policy-definitions/" + "rt-pol:policy-definition/rt-pol:name"; } description "A reference to a routing policy which can be used to restrict the prefixes for which ASPA option is enabled in BGP route selection."; } description "ASPA option for BGP route selection."; } } grouping export-aspa-validation-config { description "Export AS_PATH validation of BGP prefix."; container export-aspa-validation { leaf enabled { type boolean; default "false"; description "When set to true, the AS_PATH validity states are taken into consideration in BGP export. If set to false, the AS_PATH validity states are not taken into consideration in BGP export."; } leaf eligible-prefix-policy { type leafref { path "/rt-pol:routing-policy/rt-pol:policy-definitions/" + "rt-pol:policy-definition/rt-pol:name"; } description "A reference to a routing policy which can be used to restrict the prefixes for which AS_PATH validity states are considered in BGP export."; } description "Export AS_PATH validation of BGP prefix."; } } augment "/rt:routing/rt:control-plane-protocols" + "/rt:control-plane-protocol/bgp:bgp/bgp:neighbors" + "/bgp:neighbor" { description "Augmentation of BGP peer roles for neighbors."; leaf peer-role { type peer-role; description "Role of the peer."; } } augment "/rt:routing/rt:control-plane-protocols" + "/rt:control-plane-protocol/bgp:bgp/bgp:peer-groups" + "/bgp:peer-group" { description "Augmentation of BGP peer roles for peer groups."; leaf peer-role { type peer-role; description "Role of the peer group."; } } augment "/rt:routing/rt:control-plane-protocols" + "/rt:control-plane-protocol/bgp:bgp/bgp:global" + "/bgp:afi-safis/bgp:afi-safi/bgp:ipv4-unicast" { description "ASPA verification augmentation of BGP IPv4 Unicast Address Family."; uses aspa-config; } augment "/rt:routing/rt:control-plane-protocols" + "/rt:control-plane-protocol/bgp:bgp/bgp:global" + "/bgp:afi-safis/bgp:afi-safi/bgp:ipv6-unicast" { description "ASPA verification augmentation of BGP IPv6 Unicast Address Family."; uses aspa-config; } augment "/rt:routing/rt:control-plane-protocols" + "/rt:control-plane-protocol/bgp:bgp/bgp:rib" + "/bgp:afi-safis/bgp:afi-safi/bgp:ipv4-unicast" + "/bgp:loc-rib/bgp:routes/bgp:route" { description "ASPA verification state augmentation of BGP IPv4 Unicast route."; leaf aspa-verification-state { type aspa-verification-state; description "ASPA verification state of BGP IPv4 Unicast prefix."; } } augment "/rt:routing/rt:control-plane-protocols" + "/rt:control-plane-protocol/bgp:bgp/bgp:rib" + "/bgp:afi-safis/bgp:afi-safi/bgp:ipv6-unicast" + "/bgp:loc-rib/bgp:routes/bgp:route" { description "ASPA verification state augmentation of BGP IPv6 Unicast route."; leaf aspa-verification-state { type aspa-verification-state; description "ASPA verification state of BGP IPv6 Unicast prefix."; } } augment "/rt:routing/rt:control-plane-protocols" + "/rt:control-plane-protocol/bgp:bgp/bgp:global" + "/bgp:afi-safis/bgp:afi-safi" + "/bgp:route-selection-options" { when "derived-from-or-self(../bgp:name, 'bast:ipv4-unicast') or " + "derived-from-or-self(../bgp:name, 'bast:ipv6-unicast')" { description "This augmentation is valid for IPv4 and IPv6 Unicast."; } description "Augmentation of BGP route selection options."; uses aspa-selection-option; } augment "/rt:routing/rt:control-plane-protocols" + "/rt:control-plane-protocol/bgp:bgp/bgp:neighbors" + "/bgp:neighbor/bgp:afi-safis/bgp:afi-safi" + "/bgp:ipv4-unicast" { description "ASPA export validation augmentation for IPv4 Unicast neighbor."; uses export-aspa-validation-config; } augment "/rt:routing/rt:control-plane-protocols" + "/rt:control-plane-protocol/bgp:bgp/bgp:neighbors" + "/bgp:neighbor/bgp:afi-safis/bgp:afi-safi" + "/bgp:ipv6-unicast" { description "ASPA export validation augmentation for IPv6 Unicast neighbor."; uses export-aspa-validation-config; } augment "/rt:routing/rt:control-plane-protocols" + "/rt:control-plane-protocol/bgp:bgp/bgp:peer-groups" + "/bgp:peer-group/bgp:afi-safis/bgp:afi-safi" + "/bgp:ipv4-unicast" { description "ASPA export validation augmentation for IPv4 Unicast peer group."; uses export-aspa-validation-config; } augment "/rt:routing/rt:control-plane-protocols" + "/rt:control-plane-protocol/bgp:bgp/bgp:peer-groups" + "/bgp:peer-group/bgp:afi-safis/bgp:afi-safi" + "/bgp:ipv6-unicast" { description "ASPA export validation augmentation for IPv6 Unicast peer group."; uses export-aspa-validation-config; } } ]]>

Security Considerations This section is modeled after the template described in Section 3.7.1 of . All the YANG modules in this document define data models that are designed to be accessed via YANG-based management protocols, such as Network Configuration Protocol (NETCONF) and RESTCONF . These YANG-based management protocols (1) have to use a secure transport layer (e.g., Secure Shell (SSH) , TLS , and QUIC ) and (2) have to use mutual authentication. The Network Configuration Access Control Model (NACM) provides the means to restrict access for particular NETCONF or RESTCONF users to a preconfigured subset of all available NETCONF or RESTCONF protocol operations and content. There are a number of data nodes defined in these YANG modules that are writable/creatable/deletable (i.e., config true, which is the default). All writable data nodes are likely to be sensitive or vulnerable in some network environments. Write operations (e.g., edit-config) and delete operations to these data nodes without proper protection or authentication can have a negative effect on network operations. The following subtrees and data nodes have particular sensitivities/vulnerabilities:

• ietf-bgp-origin-as-validation:
  • /bgp-oav:origin-as-validation/bgp-oav:enabled
  • /bgp-oav:origin-as-validation/bgp-oav:redistribution-as
  • /bgp-oav:origin-as/bgp-oav:enabled
  • /bgp-oav:origin-as/bgp-oav:allow-invalid
  • /bgp-oav:origin-as/bgp-oav:allow-not-found
  • /bgp-oav:origin-as-validity-advertisement/bgp-oav:send-origin-as-validity
  • /bgp-oav:export-origin-as-validation/bgp-oav:enabled
  • /bgp-oav:origin-as-validation/bgp-oav:eligible-prefix-policy
  • /bgp-oav:origin-as/bgp-oav:eligible-prefix-policy
  • /bgp-oav:origin-as-validity-advertisement/bgp-oav:eligible-prefix-policy
  • /bgp-oav:export-origin-as-validation/bgp-oav:eligible-prefix-policy
• ietf-bgp-sec:
  • /bgp-sec:bgpsec-validation/bgp-sec:enabled
  • /bgp-sec:bgpsec/bgp-sec:enabled
  • /bgp-sec:bgpsec/bgp-sec:allow-invalid
  • /bgp-sec:export-bgpsec-validation/bgp-sec:enabled
  • /bgp-sec:bgpsec-validation/bgp-sec:eligible-prefix-policy
  • /bgp-sec:bgpsec/bgp-sec:eligible-prefix-policy
  • /bgp-sec:export-bgpsec-validation/bgp-sec:eligible-prefix-policy
• ietf-bgp-aspa:
  • /bgp-aspa:peer-role
  • /bgp-aspa:aspa-verification/bgp-aspa:enabled
  • /bgp-aspa:aspa/bgp-aspa:enabled
  • /bgp-aspa:aspa/bgp-aspa:allow-invalid
  • /bgp-aspa:aspa/bgp-aspa:allow-unknown
  • /bgp-aspa:export-aspa-validation/bgp-aspa:enabled
  • /bgp-aspa:aspa-verification/bgp-aspa:eligible-prefix-policy
  • /bgp-aspa:aspa/bgp-aspa:eligible-prefix-policy
  • /bgp-aspa:export-aspa-validation/bgp-aspa:eligible-prefix-policy

There are no particularly sensitive readable data nodes. There are no particularly sensitive RPC or action operations. These YANG modules define a set of identities, types, and groupings, and augment nodes defined in the modules they import (e.g., ietf-bgp ). An attacker modifying the nodes augmented in ietf-bgp can influence BGP route handling. Refer to the Security Considerations of for information as to which data nodes in the augmented and imported modules may be considered sensitive or vulnerable in network environments.

IANA Considerations RFC Ed.: In this section, replace all occurrences of 'XXXX' with the actual RFC number (and remove this note).

IETF XML Registry The IANA is requested to assign the following URI in the "IETF XML Registry" :

YANG Module Names Registry This document registers the following YANG modules in the "YANG Module Names" registry :

References Normative References In many standards track documents several words are used to signify the requirements in the specification. These words are often capitalized. This document defines these words as they should be interpreted in IETF documents. This document specifies an Internet Best Current Practices for the Internet Community, and requests discussion and suggestions for improvements. This document describes an IANA maintained registry for IETF standards which use Extensible Markup Language (XML) related items such as Namespaces, Document Type Declarations (DTDs), Schemas, and Resource Description Framework (RDF) Schemas. YANG is a data modeling language used to model configuration and state data manipulated by the Network Configuration Protocol (NETCONF), NETCONF remote procedure calls, and NETCONF notifications. [STANDARDS-TRACK] To help reduce well-known threats against BGP including prefix mis- announcing and monkey-in-the-middle attacks, one of the security requirements is the ability to validate the origination Autonomous System (AS) of BGP routes. More specifically, one needs to validate that the AS number claiming to originate an address prefix (as derived from the AS_PATH attribute of the BGP route) is in fact authorized by the prefix holder to do so. This document describes a simple validation mechanism to partially satisfy this requirement. [STANDARDS-TRACK] YANG is a data modeling language used to model configuration data, state data, Remote Procedure Calls, and notifications for network management protocols. This document describes the syntax and semantics of version 1.1 of the YANG language. YANG version 1.1 is a maintenance release of the YANG language, addressing ambiguities and defects in the original specification. There are a small number of backward incompatibilities from YANG version 1. This document also specifies the YANG mappings to the Network Configuration Protocol (NETCONF). This document defines a new BGP opaque extended community to carry the origin validation state of a route as computed according to RFC 6811. RFC 2119 specifies common key words that may be used in protocol specifications. This document aims to reduce the ambiguity by clarifying that only UPPERCASE usage of the key words have the defined special meanings. This document describes BGPsec, an extension to the Border Gateway Protocol (BGP) that provides security for the path of Autonomous Systems (ASes) through which a BGP UPDATE message passes. The standardization of network configuration interfaces for use with the Network Configuration Protocol (NETCONF) or the RESTCONF protocol requires a structured and secure operating environment that promotes human usability and multi-vendor interoperability. There is a need for standard mechanisms to restrict NETCONF or RESTCONF protocol access for particular users to a preconfigured subset of all available NETCONF or RESTCONF protocol operations and content. This document defines such an access control model. This document obsoletes RFC 6536. Datastores are a fundamental concept binding the data models written in the YANG data modeling language to network management protocols such as the Network Configuration Protocol (NETCONF) and RESTCONF. This document defines an architectural framework for datastores based on the experience gained with the initial simpler model, addressing requirements that were not well supported in the initial model. This document updates RFC 7950. This document specifies three YANG modules and one submodule for the management of a router: routing management, Routing Information Bases (RIBs), and control-plane protocols. The YANG modules conform to the Network Management Datastore Architecture (NMDA). Deployment of BGP origin validation based on Resource Public Key Infrastructure (RPKI) is hampered by, among other things, vendor inconsistency, partial implementation, and the lack of operational guidance. This document provides clarification of RFC 6811. A BGP speaker may perform Resource Public Key Infrastructure (RPKI) origin validation on routes it receives. This document describes how it can use that validation state for routes it exports. This document defines a YANG data model for configuring and managing routing policies in a vendor-neutral way and providing a framework for defining common routing policy building blocks. This document defines a collection of common data types to be used with the YANG data modeling language. This document obsoletes RFC 6991. Kloud Services Arrcus Huawei HPE This document defines a YANG data model for configuring and managing BGP, including protocol, policy, and operational aspects, such as RIB, based on data center, carrier, and content provider operational requirements. Yandex Qrator Labs Internet Initiative Japan & Arrcus, Inc. Arrcus BSD Software Development USA National Institute of Standards and Technology This document describes procedures that make use of Autonomous System Provider Authorization (ASPA) objects in the Resource Public Key Infrastructure (RPKI) to verify the Border Gateway Protocol (BGP) AS_PATH attribute of advertised routes. This AS_PATH verification enhances routing security by adding means to detect and mitigate route leaks and AS_PATH manipulations. Informative References The Secure Shell Protocol (SSH) is a protocol for secure remote login and other secure network services over an insecure network. This document describes the SSH authentication protocol framework and public key, password, and host-based client authentication methods. Additional authentication methods are described in separate documents. The SSH authentication protocol runs on top of the SSH transport layer protocol and provides a single authenticated tunnel for the SSH connection protocol. [STANDARDS-TRACK] The Network Configuration Protocol (NETCONF) defined in this document provides mechanisms to install, manipulate, and delete the configuration of network devices. It uses an Extensible Markup Language (XML)-based data encoding for the configuration data as well as the protocol messages. The NETCONF protocol operations are realized as remote procedure calls (RPCs). This document obsoletes RFC 4741. [STANDARDS-TRACK] In order to verifiably validate the origin Autonomous Systems of BGP announcements, routers need a simple but reliable mechanism to receive Resource Public Key Infrastructure (RFC 6480) prefix origin data from a trusted cache. This document describes a protocol to deliver validated prefix origin data to routers. [STANDARDS-TRACK] This document describes an HTTP-based protocol that provides a programmatic interface for accessing data defined in YANG, using the datastore concepts defined in the Network Configuration Protocol (NETCONF). In order to verifiably validate the origin Autonomous Systems and Autonomous System Paths of BGP announcements, routers need a simple but reliable mechanism to receive Resource Public Key Infrastructure (RFC 6480) prefix origin data and router keys from a trusted cache. This document describes a protocol to deliver them. This document describes version 1 of the RPKI-Router protocol. RFC 6810 describes version 0. This document updates RFC 6810. This document captures the current syntax used in YANG module tree diagrams. The purpose of this document is to provide a single location for this definition. This syntax may be updated from time to time based on the evolution of the YANG language. BGPsec-speaking routers are provisioned with private keys in order to sign BGPsec announcements. The corresponding public keys are published in the Global Resource Public Key Infrastructure (RPKI), enabling verification of BGPsec messages. This document describes two methods of generating the public-private key pairs: router-driven and operator-driven. This document defines the core of the QUIC transport protocol. QUIC provides applications with flow-controlled streams for structured communication, low-latency connection establishment, and network path migration. QUIC includes security measures that ensure confidentiality, integrity, and availability in a range of deployment circumstances. Accompanying documents describe the integration of TLS for key negotiation, loss detection, and an exemplary congestion control algorithm. This document specifies version 1.3 of the Transport Layer Security (TLS) protocol. TLS allows client/server applications to communicate over the Internet in a way that is designed to prevent eavesdropping, tampering, and message forgery. This document obsoletes RFC 8446, which specified TLS 1.3. This document obsoletes RFC 5246 (specifying TLS 1.2) and RFCs 5077, 6961, 7627, and 8422, all of which pertain to TLS 1.2 or earlier, and updates RFCs 5705 and 6066. This document also specifies new requirements for TLS 1.2 implementations. This document provides guidelines for authors and reviewers of specifications containing YANG data models, including IANA-maintained YANG modules. Recommendations and procedures are defined, which are intended to increase interoperability and usability of Network Configuration Protocol (NETCONF) and RESTCONF protocol implementations that utilize YANG modules. This document obsoletes RFC 8407; it also updates RFC 8126 by providing additional guidelines for writing the IANA considerations for RFCs that specify IANA-maintained YANG modules. Arrcus, DRL, & IIJ Research Dragon Research Labs Asia Pacific Network Information Centre In order to validate the origin Autonomous Systems (ASes) and Autonomous System relationships behind BGP announcements, routers need a simple but reliable mechanism to receive Resource Public Key Infrastructure (RFC6480) prefix origin data, Router Keys, and ASPA data from a trusted cache. This document describes a protocol to deliver them. This document describes version 2 of the RPKI-Router protocol. [RFC6810] describes version 0, and [RFC8210] describes version 1. This document is compatible with both.

Contributors Juniper Networks, Inc.

1133 Innovation Way Sunnyvale, CA 94089 United States of America jhaas@juniper.net

ZTE Corporation

China liu.hongwei3@zte.com.cn

H3C

China chen.mengxiao@h3c.com