Beyond RPKI Origin Validation: How to Close the Route Leak Gap with ASPA, Today.#

Sthefany Conceição Duquini (UFMS); slides co-credit Antonio Marcos Moreiras (NIC.br)

• Why: ROV is now treated as done; route leaks are the unsolved residue because origin validation says nothing about path. This talk gives the actual deployment state of ASPA and a go/no-go framework, not just theory.
• What: How ASPA works (an object lists an AS's authorized transit providers; upstream/downstream algorithms verify adjacent AS_PATH pairs via up-ramp/down-ramp counting, catching valley violations), current adoption (3.66% of routed ASNs globally — 3,249 of 88,714 per Hurricane Electric, Oct 14 2026; 195 LACNIC ASNs publishing, 156 of them in Brazil), tooling (Krill ≥0.14.0, Routinator ≥0.13 with ASPA enabled explicitly or objects silently ignored, FORT 1.7.0 experimental, RTR v2 required), and router support (OpenBGPD and BIRD available now; Juniper in Junos 26.1; Huawei NetEngine 8000; FRR not yet; MikroTik waiting on RFCs; Cisco testing in IOS XR). Includes a real misconfiguration case: AS945's ASPA omitted a genuine provider (AS61138), turning legitimate routes ASPA-Invalid.
• How: Publish an ASPA listing only real transit providers — never peers or transparent IXP route servers; use {AS0} for ASes with no providers (e.g., tier-1s); the recommended posture is observe first, enforce later. Validation checks what you published, not what you intended.
• Where applicable: Any AS that has finished ROA/ROV. IXPs are the best early testbed (route servers on BIRD/OpenBGPD reach many members at once). In the LAC region, publication is available hosted via MiLACNIC or delegated via Krill. Missing providers in your ASPA is the main operational risk.