Network & Infrastructure / BGP Policy & Internet Edge
RPKI origin validation: invalid is different from not found
A newly advertised aggregate is rejected by some networks while older more-specific routes remain reachable. The origin AS or maximum length in its authorization may not match the announcement.
Environment and inputs: BGP speakers and route reflectors; policy syntax, RPKI integration and address-family behavior depend on the implementation. Diagnostic/design example; not tested on production equipment.
Collect the evidence
Compare the announced prefix and origin ASN with validated authorization data, validator freshness and router policy. Check each affected prefix independently rather than treating a whole neighbor as invalid.
Explain the result
Invalid can indicate an origin mismatch or excessive prefix length. Not-found means no covering authorization is available; it is not equivalent to a cryptographic statement that the origin is wrong.
Plan the fix
Correct the authorization or advertisement at the authorized owner and allow validator refresh. Avoid disabling validation globally to solve a single inaccurate record.
Check the result and rollback
Verify the route's validation state on independent receivers and confirm export policy still rejects a controlled invalid example. Restore the previous advertisement if the authorization cannot be corrected safely.