> ## Content Index
> Fetch the complete content index at: https://www.bitsinflight.com/llms.txt
> Use this file to discover other available public pages before exploring further.

# Heavy Networking 783: BGP Routing Policy for Enterprise Networkers
- URL: https://www.bitsinflight.com/hn783-bgp-routing-policy-irr-rpsl/
- Published: 2025-05-30T12:00:00.000Z
- Updated: 2026-09-16T15:59:11.000Z
- Description: Ethan Banks read my post on IRR and RPSL and wanted the long version. Jake Khuon, who ran RADb at Merit in the 1990s, joined us: what routing policy is, why you will not get routed without it in 2025, how the registries fit together, and how to get started.
- Author: Jason Gintert
- Tags: media, podcast, packetpushers, heavy networking, BGP, Ohio IX

*Packet Pushers Heavy Networking, Episode 783\. Published 30 May 2025\. Host: Ethan Banks. Guests: Jake Khuon of Fortanix and me.*

Ethan's words: this episode is my fault. I had written a post about keeping public BGP routing in check with Internet Routing Registries and RPSL, it grabbed his interest, and he admitted he was about twenty years out of date on the topic. I invited Jake Khuon along because he was at Merit Networks in the mid-90s running the route servers and RADb, which makes him the person who actually remembers why any of this exists.

## What routing policy is

The rules that govern how your network exchanges routes with everyone else: an import policy for what you accept and an export policy for what you announce. Jake told the AS7007 story from 1997, an ISP that leaked full routes into its IGP, re-announced them into BGP, and, because the upstream did not filter, briefly claimed to be the internet. Policy is how you say what you intend, and it is also what the filters get built from. For an enterprise the use case is usually redundancy, originating a handful of prefixes and taking a default or partial routes from two providers. Provider-independent or provider-assigned space does not change much operationally, though your provider may have already registered objects on your behalf.

## Why you cannot skip it anymore

Ethan asked what the penalty is, and the answer is different from his RADb days. Then it was a nice-to-have. Now, if your objects are not in an IRR, your upstream will either proxy-register them for you or simply not route you. At the Ohio IX we require an AS-set from every member; it is not optional, and neither are most service providers. Without good policy, someone can originate your prefixes and pull your traffic to themselves, and at provider scale the only way to manage the volume of changes is automation built on RPSL.

## How the pieces fit

Jake walked through the history: the NSFNET Policy Routing Database, configured twice a week; RIPE-81 in 1993 and RIPE-181; RPSL in RFC 2622; RIPE integrating address and routing registries while ARIN keeps them separate; RADb, once the Routing Arbiter Database, now the Routing Assets Database; and the real-time mirroring that lets a query against one registry return objects from another, tagged by source. The primitives are route and route6 objects, AS-sets that group them, and aut-num objects where import and export policy lives. Almost nobody uses the full power of RPSL, and almost nobody needs to. RPKI and ROAs are the next layer: RPSL declares what you intend, RPKI lets everyone verify you are authorized to originate it, and the routers have to do the checking.

## Tools, and how to start

IRR Explorer at nlnog.net will take an ASN or prefix and colour-code what is wrong. bgpq3 and bgpq4 turn an AS-set into vendor prefix lists and AS-path filters from the command line. At the Ohio IX, IXP Manager rebuilds the route server filters from every member's AS-set every fifteen minutes; if the object is not there, the prefix is dropped at the perimeter. Ethan's key takeaway was that none of this is a BGP feature. There is always a tool in the middle translating registry policy into router configuration, and an engineer reviewing what came out, ideally in a lab. For a first policy, use your RIR's auto-manage feature if it has one, read the Fremont Cabal Internet Exchange quickstart, which I linked in my post because so many Ohio IX members arrived thinking I could change their policy for them, and if you are stuck, call the registry. The people at ARIN will walk you through it.

[Listen on Packet Pushers →](https://packetpushers.net/podcasts/heavy-networking/hn783-bgp-routing-policy-for-enterprise-networkers-unpacking-irr-and-rpsl/?ref=bitsinflight.com)