What is the meaning of the term origin AS mismatch and how do you resolve it?

• A. The origin AS in a BGP update does not match the one authorized by the ROA; resolve by adjusting ROA, filtering policy, or network design.
• B. The origin AS in a BGP update matches the ROA.
• C. ROA is expired; ignore.
• D. Neighbor AS mismatch; ignore.

Answer: (A)

Origin AS mismatch occurs when the AS that originates the prefix in a BGP UPDATE does not match the AS authorized to originate that prefix according to the ROA. The ROA (Route Origin Authorization) is part of the RPKI and specifies which AS is allowed to originate a given prefix. When a route is advertised with an origin AS that isn’t listed in the ROA for that prefix, validators flag the route as invalid or suspicious, and many networks will drop or deprioritize such routes to prevent hijacks.

So the best way to resolve it is to align the announcement with the ROA. Update the ROA to authorize the actual origin AS for that prefix if the business relationship or routing configuration is legitimate. Alternatively, implement filtering policies to reject routes with invalid ROA origins or adjust network design so that the correct AS is the origin for that prefix. This helps ensure only authorized origins are accepted, reducing the risk of misconfigurations or malicious hijacks.

Why the other possibilities don’t fit: a match in the ROA means no mismatch, which isn’t the issue being described; an expired ROA would cause broader validity problems but isn’t specifically about an origin mismatch, and a neighbor AS mismatch is a different concept unrelated to ROA-based origin validation.