What infrastructure changes are commonly required to enable BGP security enhancements (MD5/TCP-AO/RPKI/prefix filtering)?

• A. Only upgrade firmware
• B. Router config updates and PKI enrollment only
• C. Router config updates, PKI enrollment, ROA publishing, potential crypto hardware acceleration, policy updates
• D. Do nothing

Answer: (C)

Enabling BGP security enhancements requires changes across both device-level configurations and the underlying cryptographic and policy infrastructure. You need router configuration updates to turn on and properly configure authentication methods (such as MD5 or TCP-AO) for BGP sessions, and to enable any validation or filtering features that rely on secure data. At the same time, you must engage in PKI enrollment for RPKI, which means joining a trust anchor, obtaining and managing certificates, and setting up the validation framework that will verify route origins. Publishing ROAs is essential so that your own prefixes and origins are authorized in the RPKI system and can be trusted by others, while consuming ROA data from the global RPKI ecosystem allows you to validate routes you receive. In larger networks, crypto hardware acceleration may be useful to handle the load of signing and verifying cryptographic data, keeping performance acceptable as security checks scale. Finally, policy updates are necessary to enforce the outcomes of validation and authentication, deciding whether to accept, reject, or route differently for validated, unknown, or invalid prefixes and to ensure consistent behavior across peering relationships.