RIPE-706: 4 Practical Steps To Implement MANRS Routing Security

The internet’s backbone relies on the Border Gateway Protocol (BGP) to direct traffic across global networks. Yet, BGP’s vulnerabilities have long exposed it to risks like route hijacks, leaks, and misconfigurations that can disrupt services worldwide. To counter these threats, the Mutually Agreed Norms for Routing Security (MANRS) initiative has emerged as a cornerstone effort. A major milestone came when its Best Current Operational Practices (BCOP) document was officially published as RIPE-706 by the RIPE Network Coordination Centre (NCC), a key regional internet registry. This development provides network operators—especially smaller providers and stub networks—with actionable, community-vetted guidance to strengthen routing integrity.

Understanding the Need for Routing Security Norms

BGP, designed decades ago, lacks built-in mechanisms for validating route announcements. This openness enables attackers to advertise false paths, diverting traffic to malicious destinations or causing outages. High-profile incidents, such as the 2018 MyEtherWallet hijack or repeated leaks from major providers, underscore the urgency. MANRS addresses this by promoting voluntary commitments from network operators to adopt four core actions: filtering routes, validating global announcements, maintaining accurate public data, and coordinating on suspicious activities.

RIPE-706 builds on this foundation by translating these high-level actions into detailed, implementable steps. Targeted primarily at stub networks (those not transiting traffic for others) and small to medium providers, the document draws from real-world experiences shared by MANRS participants. It emphasizes practicality, ensuring even resource-constrained teams can comply without overhauling infrastructure.

Core Elements of the MANRS Framework in RIPE-706

At its heart, RIPE-706 outlines operational best practices aligned with MANRS actions. Here’s a breakdown:

• Route Filtering: Implement prefix and AS-path filters on all peering and transit sessions to prevent invalid announcements. For inbound routes, reject prefixes not matching your policy; for outbound, ensure only authorized prefixes are exported.
• Global Route Validation: Use tools like the RPKI (Resource Public Key Infrastructure) to cryptographically validate route origins. Deploy ROAs (Route Origin Authorizations) for your prefixes and check them on peers.
• Public Data Transparency: Publish comprehensive peering policies, prefix lists, and contact details in registries like IRR (Internet Routing Registry) and RPSL (Routing Policy Specification Language).
• Incident Coordination: Establish processes for rapid response to hijacks or leaks, including 24/7 NOC contacts and participation in global alerts.

These aren’t abstract ideals; RIPE-706 includes configuration snippets for common routers (e.g., Cisco, Juniper), checklists for compliance audits, and troubleshooting tips for common pitfalls like over-filtering legitimate traffic.

Practical Implementation Roadmap for Operators

Adopting RIPE-706 starts with assessment. Operators should inventory BGP sessions, map prefixes, and baseline current filters. The document recommends a phased approach:

1. Phase 1: Basic Hygiene (1-2 weeks): Document all peers in an IRR, add NOC/abuse contacts to WHOIS, and enable basic prefix filters.
2. Phase 2: Validation Setup (2-4 weeks): Generate ROAs via your RIR, configure RPKI validators, and test validation on a subset of sessions.
3. Phase 3: Advanced Filtering (4-6 weeks): Roll out AS-path filters, max-prefix limits, and dampening for unstable routes.
4. Phase 4: Monitoring & Response: Integrate with tools like BGPmon or RouteViews for anomaly detection and join MANRS for peer support.

For stub networks, the focus narrows: primarily outbound filtering and ROA deployment, as they rarely receive complex inbound routes. Small providers benefit from templates for customer cone filtering, preventing downstream leaks.

Technical Deep Dive: Filtering and Validation Mechanics

Effective filtering hinges on precise prefix lists. RIPE-706 advises using IRR databases to auto-generate filters via tools like RTConfig or IRRToolSet. For example, a max-prefix limit of 10 on a /24 peer prevents overload from leaks.

RPKI validation is transformative. By signing prefixes with ROAs, operators enable peers to drop invalid routes. The document details validator setup: fetch from trusted caches (e.g., RIPE NCC’s), integrate via BGPsec or rpki-client, and handle ‘NotFound’ states gracefully to avoid blocking legitimate but unsigned routes during transition.

Global coordination leverages platforms like the MANRS Observatory, which monitors compliance and flags issues. Operators are urged to report anomalies via email lists or the MXP (Mutually Agreed eXchange of Filtered BGP Routes) hub.

Benefits and Real-World Outcomes

Since MANRS’s inception, participant networks have seen measurable gains. Route leak incidents dropped by 40% among members (per MANRS reports), and RPKI adoption surged past 50% of IPv4 prefixes by 2026. RIPE-706 accelerates this by standardizing practices, fostering interoperability.

For end-users, secure routing means fewer outages, faster DDoS mitigation, and reliable access to services. Economically, it cuts remediation costs— a single hijack can cost millions in lost revenue and reputation.

Challenges and Mitigation Strategies

Implementation barriers include legacy gear lacking RPKI support and coordination with uncooperative peers. RIPE-706 counters with vendor-agnostic advice, fallback filters, and advocacy scripts for peer negotiations. It also addresses IPv6 parity, ensuring dual-stack security.

Measuring success requires tools: BGP looking glasses, prefix monitoring, and compliance checkers like the MANRS self-assessment portal.

Future Directions for Routing Security

RIPE-706 isn’t static; it’s a living document open to updates. Emerging trends include BGPsec for path validation and SIDR (Secure Inter-Domain Routing) extensions. MANRS aims for broader adoption, targeting 80% coverage by 2030.

Operators joining MANRS gain badges for marketing and access to a collaborative community. Regional IRs like RIPE NCC promote it through workshops and policy incentives.

Frequently Asked Questions (FAQs)

What is the difference between MANRS and RIPE-706?

MANRS defines the norms; RIPE-706 provides the how-to BCOP for implementation.

Is RIPE-706 mandatory?

No, it’s voluntary best practices, but MANRS participants commit to it.

How do I check MANRS compliance?

Use the online validator at manrs.org or audit against RIPE-706 checklists.

Does it cover IPv6?

Yes, fully—recommendations apply equally to IPv4 and IPv6.

What if my vendor doesn’t support RPKI?

Fallback to IRR-based filtering and plan upgrades; software solutions exist.