Fishing for an IP address: getting RPKI when your prefix isn't signed
Our IPv4 address sat in one of the only two unsigned prefixes our cloud assigns to virtual machines in Zurich — and a ROA can only be signed by the hosting provider. Our solution: reserve addresses until one lands in a validated prefix. First cast, seven seconds of downtime.
Also available in: Français
A field note — one problem, one manoeuvre, one lesson.
While working on our 100% on internet.nl, one item resisted: RPKI validation for our IPv4. RPKI lets networks cryptographically verify that a route announcement is legitimate; validation relies on a ROA (Route Origin Authorization) signed by the prefix holder — the hosting provider, never the customer. Our dynamically assigned address sat in one of the only two ROA-less prefixes among the eight the cloud assigns to virtual machines in the Zurich region. Six of eight were signed. Bad luck, in the literal sense.
We couldn't sign it ourselves, and waiting for the cloud to sign that specific prefix was out of our hands. That left one unapologetic manoeuvre: fishing.
- Reserve a fixed IP address (free with our provider, and it survives restarts — two advantages over the ephemeral address).
- Check which prefix it lands in, and whether that prefix has a valid ROA.
- Return it if not, and cast again.
First cast: an address in a signed prefix, valid ROA. Switching the old address for the new one cost seven seconds of IPv4 downtime — dual-stack clients noticed nothing, and IPv6 (already validated) never moved.
Two lessons. The small one: a reserved address is better practice than an ephemeral one anyway — the fishing merely accelerated a decision that was already right. The big one: part of your network posture belongs to your hosting provider, not to you. Knowing it before you choose — or knowing how to work around it — is part of the job.