If you find an invalid ROA for a prefix you originate, what should you do?

• A. Immediately shut down the BGP session
• B. Investigate ROA accuracy; adjust ROA or filtering; coordinate with ROA authority if needed
• C. Ignore and proceed as normal
• D. File a complaint with your ISP

Answer: (B)

ROA integrity and how origins are validated are what this is testing. When you find an invalid ROA for a prefix you originate, the right move is to investigate the ROA data and your advertisement to determine why there’s a mismatch. Verify the ROA’s stated origin ASN, the prefix, and the maximum length, and check whether the ROA is current or expired. If the ROA does not cover what you’re advertising or if the data is out of date, adjust the ROA to reflect the intended prefix and origin, or adjust your filtering so legitimate routes aren’t blocked by a misconfiguration. If the issue stems from a misconfiguration or outdated record on the ROA authority’s side, coordinate with the ROA issuer or administrator to correct it. The aim is to keep legitimate reachability while preserving protection against invalid or misoriginated routes. Avoid actions that cause outages or ignore the issue; both would undermine routing reliability and security.