Skip to content

BGP Role model: tracking the adoption of RFC 9234#

NANOG 98 digest Program Core pick 19–21 October 2026

Abstract Slides Recording

Bryton Herdes – Cloudflare, Iliana Xygkou – Georgia Institute of Technology

Play the recording: BGP Role model: tracking the adoption of RFC 9234

  • Why: RFC 9234 (BGP Roles + OTC) is the session-level route-leak defense that complements ASPA's AS-level attestations — and this is a measurement of who's actually setting OTC, and who is actively stripping it.
  • What: Roles encode business relationships per BGP session; OTC is attached automatically on sideways/downward propagation and leaks get rejected. The measurement (using Cloudflare's direct peering to attribute OTC setters with certainty) shows adoption growing but limited, with IX route servers setting the good example. The experiment — announcing OTC to all peers — found 15 OTC-stripping ASes including two Tier-1s; 33.1% of unique IPv4 and 17% of IPv6 AS_PATHs lacked OTC where expected. Arelion (AS1299) promptly fixed after outreach; GTT (AS3257) continues stripping. Plus a proposed RFC 9234 improvement (draft-herdes-idr-otc-rs-verification: RS as apex setting OTC) and an implementation support matrix (Junos/FRR/BIRD/OpenBGPD yes today; IOS XR 26.4.1 and EOS 4.37 coming; SR OS, Huawei, GoBGP no).
  • How: Session-level roles vs ASPA's AS-level granularity (mixed relationships exist); receiver-side compensation for missing OTC; role configs require a BGP session reset (new OPEN).
  • Where applicable: Every eBGP operator — deployment is cheap, has already started, and the stripping measurements make the case that partial adoption still leaks.