IDR Working Group                                                Y. Liu
Internet Draft                                             China Mobile
Intended status: Standards Track                                 C. Lin
Expires: July 19, 2026                             New H3C Technologies
                                                                H. Wang
                                                                 Huawei
                                                                J. Roy
                                                Juniper Networks, Inc.
                                                                  D. Ma
                                                                   ZDNS
                                                       January 19, 2026


                    YANG Data Model for BGP about RPKI
                      draft-ietf-idr-bgp-rpki-yang-01


Abstract

   This document defines YANG data models for configuring and managing
   BGP information about Resource Public Key Infrastructure (RPKI).

Status of this Memo

   This Internet-Draft is submitted in full conformance with the
   provisions of BCP 78 and BCP 79.

   Internet-Drafts are working documents of the Internet Engineering
   Task Force (IETF). Note that other groups may also distribute
   working documents as Internet-Drafts. The list of current Internet-
   Drafts is at https://datatracker.ietf.org/drafts/current/.

   Internet-Drafts are draft documents valid for a maximum of six
   months and may be updated, replaced, or obsoleted by other documents
   at any time. It is inappropriate to use Internet-Drafts as reference
   material or to cite them other than as "work in progress."

   This Internet-Draft will expire on July 19, 2026.

Copyright Notice

   Copyright (c) 2026 IETF Trust and the persons identified as the
   document authors. All rights reserved.

   This document is subject to BCP 78 and the IETF Trust's Legal
   Provisions Relating to IETF Documents
   (https://trustee.ietf.org/license-info) in effect on the date of
   publication of this document. Please review these documents
   carefully, as they describe your rights and restrictions with
   respect to this document. Code Components extracted from this

Liu, et al.             Expires July 19, 2026                 [Page 1]

Internet-Draft     YANG Data Model for BGP about RPKI      January 2026


   document must include Revised BSD License text as described in
   Section 4.e of the Trust Legal Provisions and are provided without
   warranty as described in the Revised BSD License.



Table of Contents


   1. Introduction...................................................2
      1.1. Terminology...............................................3
   2. Model Overview.................................................3
   3. BGP Origin AS Validation YANG Module...........................4
      3.1. Tree View.................................................4
      3.2. Yang Module...............................................9
   4. BGPSec YANG Module............................................20
      4.1. Tree View................................................20
      4.2. Yang Module..............................................23
   5. BGP ASPA YANG Module..........................................29
      5.1. Tree View................................................29
      5.2. Yang Module..............................................32
   6. Security Considerations.......................................39
   7. IANA Considerations...........................................40
      7.1. IETF XML Registry........................................40
      7.2. YANG Module Names Registry...............................41
   8. References....................................................41
   9. References....................................................42
      9.1. Normative References.....................................42
      9.2. Informative References...................................43
   Contributors.....................................................43
   Authors' Addresses...............................................44



1. Introduction

   [RFC6810] and [RFC8210] describes a protocol to deliver Resource
   Public Key Infrastructure (RPKI) prefix origin data and router keys
   from a trusted cache server to a router, referred to as RPKI-Router
   protocol. [I-D.ietf-sidrops-8210bis] updates [RFC8210].

   [RFC6811] validates the origination Autonomous System (AS) of BGP
   routes based on the Validated ROA Payload (VRP) received from the
   RPKI cache server. [I-D.ietf-sidrops-aspa-verification] makes use of
   Autonomous System Provider Authorization (ASPA) objects in the
   Resource Public Key Infrastructure (RPKI) to verify the Border
   Gateway Protocol (BGP) AS_PATH attribute of advertised routes.
   [RFC8635] describes that the public key is published in the Resource

Liu, et al.             Expires July 19, 2026                 [Page 2]

Internet-Draft     YANG Data Model for BGP about RPKI      January 2026


   Public Key Infrastructure (RPKI) and sent to the router via the RPKI
   to Router protocol for verifying the signature of BGPsec
   announcements.

   This document defines YANG [RFC7950] data models for configuring and
   managing BGP information about RPKI.

   The YANG data models in this document conform to the Network
   Management Datastore Architecture (NMDA) [RFC8342].

1.1. Terminology

   The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
   "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and
   "OPTIONAL" in this document are to be interpreted as described in
   BCP 14 [RFC2119] [RFC8174] when, and only when, they appear in all
   capitals, as shown here.

2. Model Overview

   Three YANG data models are defined in this document to augment BGP
   YANG model [I-D.ietf-idr-bgp-model].

   The ietf-bgp-origin-as-validation.yang data model provides the
   methods for configuring BGP origin AS validation.

   o Origin AS validation parameters for BGP routes.

   o Origin AS validity states of BGP routes.

   The ietf-bgp-sec.yang data model provides the methods for
   configuring BGPSec.

   o BGPSec parameters for BGP routes.

   o BGPSec validity states of BGP routes.

   The ietf-bgp-aspa.yang data model provides the methods for
   configuring BGP AS PATH Verification Based on ASPA.

   o BGP ASPA parameters for BGP routes.

   o AS PATH validity states of BGP routes.






Liu, et al.             Expires July 19, 2026                 [Page 3]

Internet-Draft     YANG Data Model for BGP about RPKI      January 2026


3. BGP Origin AS Validation YANG Module

3.1. Tree View

   The complete tree of the ietf-bgp-origin-as-validation.yang data
   model is represented as following. See [RFC8340] for an explanation
   of the symbols used.









































Liu, et al.             Expires July 19, 2026                 [Page 4]

Internet-Draft     YANG Data Model for BGP about RPKI      January 2026


   module: ietf-bgp-origin-as-validation

     augment /rt:routing/rt:control-plane-protocols
               /rt:control-plane-protocol/bgp:bgp/bgp:global
               /bgp:afi-safis/bgp:afi-safi/bgp:ipv4-unicast:
       +--rw origin-as-validation
          +--rw enabled?             boolean
          +--rw eligible-prefix-policy?  leafref
          +--rw redistribution-as?   inet:as-number

     augment /rt:routing/rt:control-plane-protocols
               /rt:control-plane-protocol/bgp:bgp/bgp:global
               /bgp:afi-safis/bgp:afi-safi/bgp:ipv6-unicast:
       +--rw origin-as-validation
          +--rw enabled?             boolean
          +--rw eligible-prefix-policy?  leafref
          +--rw redistribution-as?   inet:as-number

     augment /rt:routing/rt:control-plane-protocols
               /rt:control-plane-protocol/bgp:bgp/bgp:rib
               /bgp:afi-safis/bgp:afi-safi/bgp:ipv4-unicast
               /bgp:neighbors/bgp:neighbor/bgp:adj-rib-in-pre:
       +--ro statistics
          +--ro validation-state-unverified?   yang:gauge32
          +--ro validation-state-unknown?      yang:gauge32
          +--ro validation-state-invalid?      yang:gauge32
          +--ro validation-state-valid?        yang:gauge32

     augment /rt:routing/rt:control-plane-protocols
               /rt:control-plane-protocol/bgp:bgp/bgp:rib
               /bgp:afi-safis/bgp:afi-safi/bgp:ipv6-unicast
               /bgp:neighbors/bgp:neighbor/bgp:adj-rib-in-pre:
       +--ro statistics
          +--ro validation-state-unverified?   yang:gauge32
          +--ro validation-state-unknown?      yang:gauge32
          +--ro validation-state-invalid?      yang:gauge32
          +--ro validation-state-valid?        yang:gauge32

     augment /rt:routing/rt:control-plane-protocols
               /rt:control-plane-protocol/bgp:bgp/bgp:rib
               /bgp:afi-safis/bgp:afi-safi/bgp:ipv4-unicast
               /bgp:neighbors/bgp:neighbor/bgp:adj-rib-in-post:
       +--ro statistics
          +--ro validation-state-unverified?   yang:gauge32
          +--ro validation-state-unknown?      yang:gauge32
          +--ro validation-state-invalid?      yang:gauge32
          +--ro validation-state-valid?        yang:gauge32


Liu, et al.             Expires July 19, 2026                 [Page 5]

Internet-Draft     YANG Data Model for BGP about RPKI      January 2026


     augment /rt:routing/rt:control-plane-protocols
               /rt:control-plane-protocol/bgp:bgp/bgp:rib
               /bgp:afi-safis/bgp:afi-safi/bgp:ipv6-unicast
               /bgp:neighbors/bgp:neighbor/bgp:adj-rib-in-post:
       +--ro statistics
          +--ro validation-state-unverified?   yang:gauge32
          +--ro validation-state-unknown?      yang:gauge32
          +--ro validation-state-invalid?      yang:gauge32
          +--ro validation-state-valid?        yang:gauge32

     augment /rt:routing/rt:control-plane-protocols
               /rt:control-plane-protocol/bgp:bgp/bgp:rib
               /bgp:afi-safis/bgp:afi-safi/bgp:ipv4-unicast/bgp:loc-
   rib:
       +--ro statistics
          +--ro validation-state-unverified?   yang:gauge32
          +--ro validation-state-unknown?      yang:gauge32
          +--ro validation-state-invalid?      yang:gauge32
          +--ro validation-state-valid?        yang:gauge32

     augment /rt:routing/rt:control-plane-protocols
               /rt:control-plane-protocol/bgp:bgp/bgp:rib
               /bgp:afi-safis/bgp:afi-safi/bgp:ipv6-unicast/bgp:loc-
   rib:
       +--ro statistics
          +--ro validation-state-unverified?   yang:gauge32
          +--ro validation-state-unknown?      yang:gauge32
          +--ro validation-state-invalid?      yang:gauge32
          +--ro validation-state-valid?        yang:gauge32

     augment /rt:routing/rt:control-plane-protocols
               /rt:control-plane-protocol/bgp:bgp/bgp:rib
               /bgp:afi-safis/bgp:afi-safi/bgp:ipv4-unicast
               /bgp:neighbors/bgp:neighbor/bgp:adj-rib-out-pre:
       +--ro statistics
          +--ro validation-state-unverified?   yang:gauge32
          +--ro validation-state-unknown?      yang:gauge32
          +--ro validation-state-invalid?      yang:gauge32
          +--ro validation-state-valid?        yang:gauge32

     augment /rt:routing/rt:control-plane-protocols
               /rt:control-plane-protocol/bgp:bgp/bgp:rib
               /bgp:afi-safis/bgp:afi-safi/bgp:ipv6-unicast
               /bgp:neighbors/bgp:neighbor/bgp:adj-rib-out-pre:
       +--ro statistics
          +--ro validation-state-unverified?   yang:gauge32
          +--ro validation-state-unknown?      yang:gauge32
          +--ro validation-state-invalid?      yang:gauge32

Liu, et al.             Expires July 19, 2026                 [Page 6]

Internet-Draft     YANG Data Model for BGP about RPKI      January 2026


          +--ro validation-state-valid?        yang:gauge32

     augment /rt:routing/rt:control-plane-protocols
               /rt:control-plane-protocol/bgp:bgp/bgp:rib
               /bgp:afi-safis/bgp:afi-safi/bgp:ipv4-unicast
               /bgp:neighbors/bgp:neighbor/bgp:adj-rib-out-post:
       +--ro statistics
          +--ro validation-state-unverified?   yang:gauge32
          +--ro validation-state-unknown?      yang:gauge32
          +--ro validation-state-invalid?      yang:gauge32
          +--ro validation-state-valid?        yang:gauge32

     augment /rt:routing/rt:control-plane-protocols
               /rt:control-plane-protocol/bgp:bgp/bgp:rib
               /bgp:afi-safis/bgp:afi-safi/bgp:ipv6-unicast
               /bgp:neighbors/bgp:neighbor/bgp:adj-rib-out-post:
       +--ro statistics
          +--ro validation-state-unverified?   yang:gauge32
          +--ro validation-state-unknown?      yang:gauge32
          +--ro validation-state-invalid?      yang:gauge32
          +--ro validation-state-valid?        yang:gauge32

     augment /rt:routing/rt:control-plane-protocols
               /rt:control-plane-protocol/bgp:bgp/bgp:rib
               /bgp:afi-safis/bgp:afi-safi/bgp:ipv4-unicast
               /bgp:loc-rib/bgp:routes/bgp:route:
       +--ro origin-as-validity?        origin-as-validity-state
       +--ro validity-invalid-reason?   route-validity-invalid-reason

     augment /rt:routing/rt:control-plane-protocols
               /rt:control-plane-protocol/bgp:bgp/bgp:rib
               /bgp:afi-safis/bgp:afi-safi/bgp:ipv6-unicast
               /bgp:loc-rib/bgp:routes/bgp:route:
       +--ro origin-as-validity?        origin-as-validity-state
       +--ro validity-invalid-reason?   route-validity-invalid-reason

     augment /rt:routing/rt:control-plane-protocols
               /rt:control-plane-protocol/bgp:bgp/bgp:global
               /bgp:afi-safis/bgp:afi-safi/bgp:route-selection-options:
       +--rw origin-as
          +--rw enabled?           boolean
          +--rw allow-invalid?     boolean
          +--rw allow-not-found?   boolean
          +--rw eligible-prefix-policy?  leafref

     augment /rt:routing/rt:control-plane-protocols
               /rt:control-plane-protocol/bgp:bgp/bgp:neighbors
               /bgp:neighbor/bgp:afi-safis/bgp:afi-safi

Liu, et al.             Expires July 19, 2026                 [Page 7]

Internet-Draft     YANG Data Model for BGP about RPKI      January 2026


               /bgp:ipv4-unicast:
       +--rw send-origin-as-validity?       boolean
       +--rw export-origin-as-validation
       |  +--rw enabled?           boolean
       |  +--rw allow-not-found?   boolean
       |  +--rw eligible-prefix-policy?  leafref
       +--rw statistics
          +--rw validation-state-unverified?   yang:gauge32
          +--rw validation-state-unknown?      yang:gauge32
          +--rw validation-state-invalid?      yang:gauge32
          +--rw validation-state-valid?        yang:gauge32

      augment /rt:routing/rt:control-plane-protocols
               /rt:control-plane-protocol/bgp:bgp/bgp:neighbors
               /bgp:neighbor/bgp:afi-safis/bgp:afi-safi
               /bgp:ipv6-unicast:
       +--rw send-origin-as-validity?       boolean
       +--rw export-origin-as-validation
       |  +--rw enabled?           boolean
       |  +--rw allow-not-found?   boolean
       |  +--rw eligible-prefix-policy?  leafref
       +--rw statistics
          +--rw validation-state-unverified?   yang:gauge32
          +--rw validation-state-unknown?      yang:gauge32
          +--rw validation-state-invalid?      yang:gauge32
          +--rw validation-state-valid?        yang:gauge32

     augment /rt:routing/rt:control-plane-protocols
               /rt:control-plane-protocol/bgp:bgp/bgp:peer-groups
               /bgp:peer-group/bgp:afi-safis/bgp:afi-safi
               /bgp:ipv4-unicast:
       +--rw send-origin-as-validity?       boolean
       +--rw export-origin-as-validation
          +--rw enabled?           boolean
          +--rw allow-not-found?   boolean
          +--rw eligible-prefix-policy?  leafref

     augment /rt:routing/rt:control-plane-protocols
               /rt:control-plane-protocol/bgp:bgp/bgp:peer-groups
               /bgp:peer-group/bgp:afi-safis/bgp:afi-safi
               /bgp:ipv6-unicast:
       +--rw send-origin-as-validity?       boolean
       +--rw export-origin-as-validation
          +--rw enabled?           boolean
          +--rw allow-not-found?   boolean
          +--rw eligible-prefix-policy?  Leafref



Liu, et al.             Expires July 19, 2026                 [Page 8]

Internet-Draft     YANG Data Model for BGP about RPKI      January 2026



3.2. Yang Module

   <CODE BEGINS> file "ietf-bgp-origin-as-validation@2022-10-18.yang"

   module ietf-bgp-origin-as-validation {
     yang-version "1.1";
     namespace "urn:ietf:params:xml:ns:yang:"
             + "ietf-bgp-origin-as-validation";
     prefix "oav";

     import ietf-yang-types {
          prefix "yang";
          reference
            "RFC 6991: Common YANG Data Types.";
     }

     import ietf-inet-types {
       prefix "inet";
       reference
         "RFC 6991: Common YANG Data Types";
     }

     import ietf-routing {
       prefix "rt";
       reference
         "RFC 8349, A YANG Data Model for Routing Management
          (NMDA Version).";
     }

     import ietf-bgp {
       prefix "bgp";
       reference
         "RFC XXXX: YANG Model for Border Gateway Protocol (BGP-4)";
     }

     import iana-bgp-types {
       prefix "bt";
       reference
         "RFC XXXX: YANG Model for Border Gateway Protocol (BGP-4)";
     }

     import iana-bgp-rib-types {
       prefix "brt";
       reference
         "RFC XXXX: YANG Model for Border Gateway Protocol (BGP-4)";
     }


Liu, et al.             Expires July 19, 2026                 [Page 9]

Internet-Draft     YANG Data Model for BGP about RPKI      January 2026


     import ietf-routing-policy {
       prefix rt-pol;
       reference
         "RFC 9067: A YANG Data Model for Routing Policy Management.";
     }

     organization
       "IETF SIDROPS Working Group";

     contact
       "TBD";

     description
       "This module describes configuration of the BGP origin AS
        validation.

        This YANG model conforms to the Network Management
        Datastore Architecture (NMDA) as described in RFC 8342.

        Copyright (c) 2022 IETF Trust and the persons identified as
        authors of the code.  All rights reserved.

        Redistribution and use in source and binary forms, with or
        without modification, is permitted pursuant to, and subject to
        the license terms contained in, the Revised BSD License set
        forth in Section 4.c of the IETF Trust's Legal Provisions
        Relating to IETF Documents
        (https://trustee.ietf.org/license-info).

        This version of this YANG module is part of RFC XXXX;
        see the RFC itself for full legal notices.

        The key words 'MUST', 'MUST NOT', 'REQUIRED', 'SHALL', 'SHALL
        NOT', 'SHOULD', 'SHOULD NOT', 'RECOMMENDED', 'NOT RECOMMENDED',
        'MAY', and 'OPTIONAL' in this document are to be interpreted as
        described in BCP 14 (RFC 2119) (RFC 8174) when, and only when,
        they appear in all capitals, as shown here.";

     reference "RFC XXXX";

     revision 2022-10-18 {
       description
         "Initial Version";
       reference
         "RFC XXXX, YANG Data Model for RPKI to Router Protocol";
     }

     identity ineligible-orgin-as {

Liu, et al.             Expires July 19, 2026                [Page 10]

Internet-Draft     YANG Data Model for BGP about RPKI      January 2026


       base brt:ineligible-route-reason;
       description
         "Route was ineligible due to origin as validation";
     }

     typedef route-validity-invalid-reason {
       type enumeration {
         enum ineligible-orgin-as {
           description
             "Route was ineligible due to origin as number mismatch";
         }
         enum ineligible-max-len {
           description
             "Route was ineligible due to prefix maximum length
   mismatch";
         }
       }
       description
       "Origin AS validation state invalid reason of BGP routes.";
     }

     typedef origin-as-validity-state {
       type enumeration {
         enum not-found {
           description
             "No VRP Covers the Route Prefix.";
         }
         enum valid {
           description
             "At least one VRP Matches the Route Prefix.";
         }
         enum invalid {
           description
             "At least one VRP Covers the Route Prefix, but no VRP
              Matches it.";
         }
         enum disabled {
           description
             "BGP origin AS validation is not enabled.";
         }
       }
       description
         "Origin AS validation state of BGP routes.";
       reference
         "RFC 6811, BGP Prefix Origin Validation.";
     }

     grouping origin-as-validation-config {

Liu, et al.             Expires July 19, 2026                [Page 11]

Internet-Draft     YANG Data Model for BGP about RPKI      January 2026


       description
         "Origin AS validation of BGP prefix.";
       container origin-as-validation {
         leaf enabled {
           type boolean;
           default "false";
           description
             "Whether origin-AS validation of BGP prefix is enabled.";
         }
         leaf eligible-prefix-policy {
           type leafref {
             path "/rt-pol:routing-policy/rt-pol:policy-definitions/"
                   + "rt-pol:policy-definition/rt-pol:name";
              }
           description
             "A reference to a routing policy which can be used to
              restrict the prefixes for which Origin AS validation
              is enabled.";
         }
         leaf redistribution-as {
           type inet:as-number;
           description
             "Uses this AS number in the origin-AS validation for
              redistributed routes since they have no AS-PATH.";
           reference
             "RFC 8481, Clarifications to BGP Origin Validation Based
              on Resource Public Key Infrastructure (RPKI).";
         }
         description
           "Origin AS validation of BGP prefix.";
       }
     }

     grouping origin-as-selection-option {
       description
         "Origin AS option for BGP route selection.";
       container origin-as {
         leaf enabled {
           type boolean;
           default "false";
           description
             "When enabled allows the origin AS validity states to be
              taken into consideration in the best-path calculation.";
         }
         leaf allow-invalid {
           type boolean;
           default "false";
           description

Liu, et al.             Expires July 19, 2026                [Page 12]

Internet-Draft     YANG Data Model for BGP about RPKI      January 2026


             "When enabled allows the route with 'invalid' origin AS
              to be taken into consideration in the best-path
              calculation.";
         }
         leaf allow-not-found {
           type boolean;
           default "true";
           description
             "When enabled allows the route with 'not-found' origin
              AS to be taken into consideration in the best-path
              calculation.";
         }
         leaf eligible-prefix-policy {
           type leafref {
             path "/rt-pol:routing-policy/rt-pol:policy-definitions/"
                   + "rt-pol:policy-definition/rt-pol:name";
              }
           description
             "A reference to a routing policy which can be used to
              restrict the prefixes for which Origin AS option
              is enabled for BGP route selection.";
         }
         description
           "Origin AS option for BGP route selection.";
       }
     }

     grouping origin-as-validity-advertisement {
       description
         "Advertisement of Origin Validation State Extended
          Community to neighbor(s).";
       leaf send-origin-as-validity {
         type boolean;
         default "false";
         description
           "If set to true, send the origin AS validity to the
            neighbor(s) using Origin Validation State Extended
            Community";
         reference
           "RFC 8097, BGP Prefix Origin Validation State Extended
            Community.";
       }
       leaf eligible-prefix-policy {
         type leafref {
           path "/rt-pol:routing-policy/rt-pol:policy-definitions/"
                 + "rt-pol:policy-definition/rt-pol:name";
              }
         description

Liu, et al.             Expires July 19, 2026                [Page 13]

Internet-Draft     YANG Data Model for BGP about RPKI      January 2026


           "A reference to a routing policy which can be used to
            restrict the prefixes for which Origin Validation
            State Extended Community is advertised.";
       }
     }

     grouping export-origin-as-validation-config {
       description
         "Export Origin AS validation of BGP prefix.";
       container export-origin-as-validation {
         leaf enabled {
           type boolean;
           default "false";
           description
             "When enabled allows the origin AS validity states to be
              taken into consideration in BGP export.";
         }
         leaf allow-not-found {
           type boolean;
           default "false";
           description
             "When enabled allows the route with 'not-found' origin
              AS to be sent to the neighbor.";
         }
         leaf eligible-prefix-policy {
           type leafref {
             path "/rt-pol:routing-policy/rt-pol:policy-definitions/"
                   + "rt-pol:policy-definition/rt-pol:name";
              }
           description
             "A reference to a routing policy which can be used to
              restrict the prefixes for which Origin AS validity
              states are considered in BGP export.";
         }
         description
           "Export Origin AS validation of BGP prefix.";
         reference
           "RFC 8893, Resource Public Key Infrastructure (RPKI) Origin
           Validation for BGP Export.";
          }
        }

     grouping origin-as-validity-statistics {
          description
            "Origin-AS validation statistics.";
          container statistics {
            leaf validation-state-unverified {
              type yang:gauge32;

Liu, et al.             Expires July 19, 2026                [Page 14]

Internet-Draft     YANG Data Model for BGP about RPKI      January 2026


              description
                "The number of routes with validation state as
   unverified.";
            }
            leaf validation-state-unknown {
              type yang:gauge32;
              description
                "The number of routes with validation state as
   unknown.";
            }
            leaf validation-state-invalid {
              type yang:gauge32;
              description
                "The number of routes with validation state as
   invalid.";
            }
            leaf validation-state-valid {
              type yang:gauge32;
              description
                "The number of routes with validation state as valid.";
            }
            description
              "Statistical data for Origin-AS validation states.";
       }
     }

     augment "/rt:routing/rt:control-plane-protocols"
           + "/rt:control-plane-protocol/bgp:bgp/bgp:global"
           + "/bgp:afi-safis/bgp:afi-safi/bgp:ipv4-unicast" {
       description
         "Origin AS validation augmentation of BGP IPv4 Unicast
          Address Family.";
       uses origin-as-validation-config;
     }

     augment "/rt:routing/rt:control-plane-protocols"
           + "/rt:control-plane-protocol/bgp:bgp/bgp:global"
           + "/bgp:afi-safis/bgp:afi-safi/bgp:ipv6-unicast" {
       description
         "Origin AS validation augmentation of BGP IPv6 Unicast
          Address Family.";
       uses origin-as-validation-config;
     }

     augment "/rt:routing/rt:control-plane-protocols"
           + "/rt:control-plane-protocol/bgp:bgp/bgp:rib"
           + "/bgp:afi-safis/bgp:afi-safi/bgp:ipv4-unicast"
              + "/bgp:neighbors/bgp:neighbor/bgp:adj-rib-in-pre" {

Liu, et al.             Expires July 19, 2026                [Page 15]

Internet-Draft     YANG Data Model for BGP about RPKI      January 2026


          description
            "Augmentation of BGP IPv4 Unicast route statistics.";

          uses origin-as-validity-statistics;
        }

        augment "/rt:routing/rt:control-plane-protocols"
              + "/rt:control-plane-protocol/bgp:bgp/bgp:rib"
              + "/bgp:afi-safis/bgp:afi-safi/bgp:ipv6-unicast"
              + "/bgp:neighbors/bgp:neighbor/bgp:adj-rib-in-pre" {
          description
            "Augmentation of BGP IPv6 Unicast route statistics.";

          uses origin-as-validity-statistics;
        }

        augment "/rt:routing/rt:control-plane-protocols"
              + "/rt:control-plane-protocol/bgp:bgp/bgp:rib"
              + "/bgp:afi-safis/bgp:afi-safi/bgp:ipv4-unicast"
              + "/bgp:neighbors/bgp:neighbor/bgp:adj-rib-in-post" {
          description
            "Augmentation of BGP IPv4 Unicast route statistics.";

          uses origin-as-validity-statistics;
        }

        augment "/rt:routing/rt:control-plane-protocols"
              + "/rt:control-plane-protocol/bgp:bgp/bgp:rib"
              + "/bgp:afi-safis/bgp:afi-safi/bgp:ipv6-unicast"
              + "/bgp:neighbors/bgp:neighbor/bgp:adj-rib-in-post" {
          description
            "Augmentation of BGP IPv6 Unicast route statistics.";

          uses origin-as-validity-statistics;
        }

        augment "/rt:routing/rt:control-plane-protocols"
              + "/rt:control-plane-protocol/bgp:bgp/bgp:rib"
              + "/bgp:afi-safis/bgp:afi-safi/bgp:ipv4-unicast"
              + "/bgp:loc-rib" {
          description
            "Augmentation of BGP IPv4 Unicast route statistics.";

          uses origin-as-validity-statistics;
        }

        augment "/rt:routing/rt:control-plane-protocols"
              + "/rt:control-plane-protocol/bgp:bgp/bgp:rib"

Liu, et al.             Expires July 19, 2026                [Page 16]

Internet-Draft     YANG Data Model for BGP about RPKI      January 2026


              + "/bgp:afi-safis/bgp:afi-safi/bgp:ipv6-unicast"
              + "/bgp:loc-rib" {
          description
            "Augmentation of BGP IPv6 Unicast route statistics.";

          uses origin-as-validity-statistics;
        }

        augment "/rt:routing/rt:control-plane-protocols"
              + "/rt:control-plane-protocol/bgp:bgp/bgp:rib"
              + "/bgp:afi-safis/bgp:afi-safi/bgp:ipv4-unicast"
              + "/bgp:neighbors/bgp:neighbor/bgp:adj-rib-out-pre" {
          description
            "Augmentation of BGP IPv4 Unicast route statistics.";

          uses origin-as-validity-statistics;
        }

        augment "/rt:routing/rt:control-plane-protocols"
              + "/rt:control-plane-protocol/bgp:bgp/bgp:rib"
              + "/bgp:afi-safis/bgp:afi-safi/bgp:ipv6-unicast"
              + "/bgp:neighbors/bgp:neighbor/bgp:adj-rib-out-pre" {
          description
            "Augmentation of BGP IPv6 Unicast route statistics.";

          uses origin-as-validity-statistics;
        }

        augment "/rt:routing/rt:control-plane-protocols"
              + "/rt:control-plane-protocol/bgp:bgp/bgp:rib"
              + "/bgp:afi-safis/bgp:afi-safi/bgp:ipv4-unicast"
              + "/bgp:neighbors/bgp:neighbor/bgp:adj-rib-out-post" {
          description
            "Augmentation of BGP IPv4 Unicast route statistics.";

          uses origin-as-validity-statistics;
        }

        augment "/rt:routing/rt:control-plane-protocols"
              + "/rt:control-plane-protocol/bgp:bgp/bgp:rib"
              + "/bgp:afi-safis/bgp:afi-safi/bgp:ipv6-unicast"
              + "/bgp:neighbors/bgp:neighbor/bgp:adj-rib-out-post" {
          description
            "Augmentation of BGP IPv6 Unicast route statistics.";

          uses origin-as-validity-statistics;
        }


Liu, et al.             Expires July 19, 2026                [Page 17]

Internet-Draft     YANG Data Model for BGP about RPKI      January 2026


        augment "/rt:routing/rt:control-plane-protocols"
              + "/rt:control-plane-protocol/bgp:bgp/bgp:rib"
              + "/bgp:afi-safis/bgp:afi-safi/bgp:ipv4-unicast"
           + "/bgp:loc-rib/bgp:routes/bgp:route" {
       description
         "Origin AS validity augmentation of BGP IPv4 Unicast
          route.";
       leaf origin-as-validity {
         type origin-as-validity-state;
         description
           "Origin AS validity of BGP IPv4 Unicast prefix";
          }
          leaf validity-invalid-reason {
            type route-validity-invalid-reason;
            description
              "Reason for marking a BGP IPv4 Unicast prefix as
   invalid";
       }
     }

     augment "/rt:routing/rt:control-plane-protocols"
           + "/rt:control-plane-protocol/bgp:bgp/bgp:rib"
           + "/bgp:afi-safis/bgp:afi-safi/bgp:ipv6-unicast"
           + "/bgp:loc-rib/bgp:routes/bgp:route" {
       description
         "Origin AS validity augmentation of BGP IPv6 Unicast
          route.";
       leaf origin-as-validity {
         type origin-as-validity-state;
         description
           "Origin AS validity of BGP IPv6 Unicast prefix";
          }
          leaf validity-invalid-reason {
            type route-validity-invalid-reason;
            description
              "Reason for marking a BGP IPv6 Unicast prefix as
   invalid";
       }
     }

     augment "/rt:routing/rt:control-plane-protocols"
           + "/rt:control-plane-protocol/bgp:bgp/bgp:global"
           + "/bgp:afi-safis/bgp:afi-safi"
           + "/bgp:route-selection-options" {
       when "derived-from-or-self(../bgp:name, 'bt:ipv4-unicast') or "
          + "derived-from-or-self(../bgp:name, 'bt:ipv6-unicast')" {
         description
           "This augmentation is valid for IPv4 and IPv6 Unicast.";

Liu, et al.             Expires July 19, 2026                [Page 18]

Internet-Draft     YANG Data Model for BGP about RPKI      January 2026


       }
       description
         "augmentation of BGP route selection options";
       uses origin-as-selection-option;
     }

     augment "/rt:routing/rt:control-plane-protocols"
           + "/rt:control-plane-protocol/bgp:bgp/bgp:neighbors"
           + "/bgp:neighbor/bgp:afi-safis/bgp:afi-safi"
           + "/bgp:ipv4-unicast" {
       description
         "augmentation of Origin Validation State Extended
          Community advertisement for IPv4 Unicast neighbor";
       uses origin-as-validity-advertisement;
       uses export-origin-as-validation-config;
          uses origin-as-validity-statistics;
     }

     augment "/rt:routing/rt:control-plane-protocols"
           + "/rt:control-plane-protocol/bgp:bgp/bgp:neighbors"
           + "/bgp:neighbor/bgp:afi-safis/bgp:afi-safi"
           + "/bgp:ipv6-unicast" {
       description
         "augmentation of Origin Validation State Extended
          Community advertisement for IPv6 Unicast neighbor";
       uses origin-as-validity-advertisement;
       uses export-origin-as-validation-config;
          uses origin-as-validity-statistics;
     }

     augment "/rt:routing/rt:control-plane-protocols"
           + "/rt:control-plane-protocol/bgp:bgp/bgp:peer-groups"
           + "/bgp:peer-group/bgp:afi-safis/bgp:afi-safi"
           + "/bgp:ipv4-unicast" {
       description
         "augmentation of Origin Validation State Extended
          Community advertisement for IPv4 Unicast peer group";
       uses origin-as-validity-advertisement;
       uses export-origin-as-validation-config;
     }

     augment "/rt:routing/rt:control-plane-protocols"
           + "/rt:control-plane-protocol/bgp:bgp/bgp:peer-groups"
           + "/bgp:peer-group/bgp:afi-safis/bgp:afi-safi"
           + "/bgp:ipv6-unicast" {
       description
         "augmentation of Origin Validation State Extended
          Community advertisement for IPv6 Unicast peer group";

Liu, et al.             Expires July 19, 2026                [Page 19]

Internet-Draft     YANG Data Model for BGP about RPKI      January 2026


       uses origin-as-validity-advertisement;
       uses export-origin-as-validation-config;
     }
   }

   <CODE ENDS>

4. BGPSec YANG Module

4.1. Tree View

   The complete tree of the ietf-bgp-sec.yang data model is represented
   as following. See [RFC8340] for an explanation of the symbols used.



































Liu, et al.             Expires July 19, 2026                [Page 20]

Internet-Draft     YANG Data Model for BGP about RPKI      January 2026


   module: ietf-bgp-sec

     augment /rt:routing/rt:control-plane-protocols
               /rt:control-plane-protocol/bgp:bgp/bgp:global
               /bgp:afi-safis/bgp:afi-safi/bgp:ipv4-unicast:
       +--rw bgpsec-validation
          +--rw enabled?                 boolean
          +--rw eligible-prefix-policy?  leafref

     augment /rt:routing/rt:control-plane-protocols
               /rt:control-plane-protocol/bgp:bgp/bgp:global
               /bgp:afi-safis/bgp:afi-safi/bgp:ipv6-unicast:
       +--rw bgpsec-validation
          +--rw enabled?                 boolean
          +--rw eligible-prefix-policy?  leafref

     augment /rt:routing/rt:control-plane-protocols
               /rt:control-plane-protocol/bgp:bgp/bgp:rib
               /bgp:afi-safis/bgp:afi-safi/bgp:ipv4-unicast
               /bgp:loc-rib/bgp:routes/bgp:route:
       +--ro bgpsec-validity?     bgpsec-validity-state

     augment /rt:routing/rt:control-plane-protocols
               /rt:control-plane-protocol/bgp:bgp/bgp:rib
               /bgp:afi-safis/bgp:afi-safi/bgp:ipv6-unicast
               /bgp:loc-rib/bgp:routes/bgp:route:
       +--ro bgpsec-validity?     bgpsec-validity-state

     augment /rt:routing/rt:control-plane-protocols
               /rt:control-plane-protocol/bgp:bgp/bgp:global
               /bgp:afi-safis/bgp:afi-safi/bgp:route-selection-options:
       +--rw bgpsec
          +--rw enabled?                 boolean
          +--rw allow-invalid?           boolean
          +--rw eligible-prefix-policy?  leafref

     augment /rt:routing/rt:control-plane-protocols
               /rt:control-plane-protocol/bgp:bgp/bgp:neighbors
               /bgp:neighbor/bgp:afi-safis/bgp:afi-safi
               /bgp:ipv4-unicast:
       +--rw export-bgpsec-validation
          +--rw enabled?                 boolean
          +--rw eligible-prefix-policy?  leafref

     augment /rt:routing/rt:control-plane-protocols
               /rt:control-plane-protocol/bgp:bgp/bgp:neighbors
               /bgp:neighbor/bgp:afi-safis/bgp:afi-safi
               /bgp:ipv6-unicast:

Liu, et al.             Expires July 19, 2026                [Page 21]

Internet-Draft     YANG Data Model for BGP about RPKI      January 2026


       +--rw export-bgpsec-validation
          +--rw enabled?                 boolean
          +--rw eligible-prefix-policy?  leafref

     augment /rt:routing/rt:control-plane-protocols
               /rt:control-plane-protocol/bgp:bgp/bgp:peer-groups
               /bgp:peer-group/bgp:afi-safis/bgp:afi-safi
               /bgp:ipv4-unicast:
       +--rw export-bgpsec-validation
          +--rw enabled?                 boolean
          +--rw eligible-prefix-policy?  leafref

     augment /rt:routing/rt:control-plane-protocols
               /rt:control-plane-protocol/bgp:bgp/bgp:peer-groups
               /bgp:peer-group/bgp:afi-safis/bgp:afi-safi
               /bgp:ipv6-unicast:
       +--rw export-bgpsec-validation
          +--rw enabled?                 boolean
          +--rw eligible-prefix-policy?  leafref





























Liu, et al.             Expires July 19, 2026                [Page 22]

Internet-Draft     YANG Data Model for BGP about RPKI      January 2026


4.2. Yang Module

   <CODE BEGINS> file "ietf-bgp-sec@2022-10-18.yang"

   module ietf-bgp-sec {
     yang-version "1.1";
     namespace "urn:ietf:params:xml:ns:yang:"
             + "ietf-bgp-sec";
     prefix "sec";

     import ietf-routing {
       prefix "rt";
       reference
         "RFC 8349, A YANG Data Model for Routing Management
          (NMDA Version).";
     }

     import ietf-bgp {
       prefix "bgp";
       reference
         "RFC XXXX: YANG Model for Border Gateway Protocol (BGP-4)";
     }

     import iana-bgp-types {
       prefix "bt";
       reference
         "RFC XXXX: YANG Model for Border Gateway Protocol (BGP-4)";
     }

     import iana-bgp-rib-types {
       prefix "brt";
       reference
         "RFC XXXX: YANG Model for Border Gateway Protocol (BGP-4)";
     }

     import ietf-routing-policy {
       prefix rt-pol;
       reference
         "RFC 9067: A YANG Data Model for Routing Policy Management.";
     }

     organization
       "IETF SIDROPS Working Group";

     contact
       "TBD";

     description

Liu, et al.             Expires July 19, 2026                [Page 23]

Internet-Draft     YANG Data Model for BGP about RPKI      January 2026


       "This module describes configuration of BGPsec.

        This YANG model conforms to the Network Management
        Datastore Architecture (NMDA) as described in RFC 8342.

        Copyright (c) 2022 IETF Trust and the persons identified as
        authors of the code.  All rights reserved.

        Redistribution and use in source and binary forms, with or
        without modification, is permitted pursuant to, and subject to
        the license terms contained in, the Revised BSD License set
        forth in Section 4.c of the IETF Trust's Legal Provisions
        Relating to IETF Documents
        (https://trustee.ietf.org/license-info).

        This version of this YANG module is part of RFC XXXX;
        see the RFC itself for full legal notices.

        The key words 'MUST', 'MUST NOT', 'REQUIRED', 'SHALL', 'SHALL
        NOT', 'SHOULD', 'SHOULD NOT', 'RECOMMENDED', 'NOT RECOMMENDED',
        'MAY', and 'OPTIONAL' in this document are to be interpreted as
        described in BCP 14 (RFC 2119) (RFC 8174) when, and only when,
        they appear in all capitals, as shown here.";

     reference "RFC XXXX";

     revision 2022-10-18 {
       description
         "Initial Version";
       reference
         "RFC XXXX, YANG Data Model for RPKI to Router Protocol";
     }

     identity ineligible-bgp {
       base brt:ineligible-route-reason;
       description
         "Route was ineligible due to bgpsec";
     }

     typedef bgpsec-validity-state {
       type enumeration {
         enum valid {
           description
             "The BGPsec UPDATE message is valid.";
         }
         enum invalid {
           description
             "The BGPsec UPDATE message is invalid.";

Liu, et al.             Expires July 19, 2026                [Page 24]

Internet-Draft     YANG Data Model for BGP about RPKI      January 2026


         }
         enum disabled {
           description
             "BGPsec validation is not enabled.";
         }
       }
       description
         "BGPsec validation state of BGP routes.";
       reference
         "RFC 8205, BGPsec Protocol Specification.";
     }

     grouping bgpsec-validation-config {
       description
         "BGPsec validation of BGP prefix.";
       container bgpsec-validation {
         leaf enabled {
           type boolean;
           default "false";
           description
             "Whether BGPsec validation of BGP prefix is enabled.";
         }
         leaf eligible-prefix-policy {
           type leafref {
             path "/rt-pol:routing-policy/rt-pol:policy-definitions/"
                   + "rt-pol:policy-definition/rt-pol:name";
              }
           description
             "A reference to a routing policy which can be used to
              restrict the prefixes for which BGPsec validation
              is enabled.";
         }
         description
           "BGPsec validation of BGP prefix.";
       }
     }

     grouping bgpsec-selection-option {
       description
         "BGPsec option for BGP route selection.";
       container bgpsec {
         leaf enabled {
           type boolean;
           default "false";
           description
             "When enabled allows the BGPsec validity states to be
              taken into consideration in the best-path calculation.";
         }

Liu, et al.             Expires July 19, 2026                [Page 25]

Internet-Draft     YANG Data Model for BGP about RPKI      January 2026


         leaf allow-invalid {
           type boolean;
           default "false";
           description
             "When enabled allows the route with 'invalid' BGPsec
              to be taken into consideration in the best-path
              calculation.";
         }
         leaf eligible-prefix-policy {
           type leafref {
             path "/rt-pol:routing-policy/rt-pol:policy-definitions/"
                   + "rt-pol:policy-definition/rt-pol:name";
              }
           description
             "A reference to a routing policy which can be used to
              restrict the prefixes for which BGPsec option
              is enabled in BGP route selection.";
         }
         description
           "BGPsec option for BGP route selection.";
       }
     }

     grouping export-bgpsec-validation-config {
       description
         "Export BGPsec validation of BGP prefix.";
       container export-bgpsec-validation {
         leaf enabled {
           type boolean;
           default "false";
           description
             "When enabled allows the BGPsec validity states to be
              taken into consideration in BGP export.";
         }
         leaf eligible-prefix-policy {
           type leafref {
             path "/rt-pol:routing-policy/rt-pol:policy-definitions/"
                   + "rt-pol:policy-definition/rt-pol:name";
              }
           description
             "A reference to a routing policy which can be used to
              restrict the prefixes for which BGPsec validity
              states are considered in BGP export.";
         }
         description
           "Export BGPsec validation of BGP prefix.";
       }
     }

Liu, et al.             Expires July 19, 2026                [Page 26]

Internet-Draft     YANG Data Model for BGP about RPKI      January 2026



     augment "/rt:routing/rt:control-plane-protocols"
           + "/rt:control-plane-protocol/bgp:bgp/bgp:global"
           + "/bgp:afi-safis/bgp:afi-safi/bgp:ipv4-unicast" {
       description
         "BGPSec augmentation of BGP IPv4 Unicast Address Family.";
       uses bgpsec-validation-config;
     }

     augment "/rt:routing/rt:control-plane-protocols"
           + "/rt:control-plane-protocol/bgp:bgp/bgp:global"
           + "/bgp:afi-safis/bgp:afi-safi/bgp:ipv6-unicast" {
       description
         " BGPSec augmentation of BGP IPv6 Unicast Address Family.";
       uses bgpsec-validation-config;
     }

     augment "/rt:routing/rt:control-plane-protocols"
           + "/rt:control-plane-protocol/bgp:bgp/bgp:rib"
           + "/bgp:afi-safis/bgp:afi-safi/bgp:ipv4-unicast"
           + "/bgp:loc-rib/bgp:routes/bgp:route" {
       description
         " BGPSec augmentation of BGP IPv4 Unicast route.";
       leaf bgpsec-validity {
         type bgpsec-validity-state;
         description
           "BGPsec validity of BGP IPv4 Unicast prefix";
       }
     }

     augment "/rt:routing/rt:control-plane-protocols"
           + "/rt:control-plane-protocol/bgp:bgp/bgp:rib"
           + "/bgp:afi-safis/bgp:afi-safi/bgp:ipv6-unicast"
           + "/bgp:loc-rib/bgp:routes/bgp:route" {
       description
         "BGPSec augmentation of BGP IPv6 Unicast route.";
       leaf bgpsec-validity {
         type bgpsec-validity-state;
         description
           "BGPsec validity of BGP IPv6 Unicast prefix";
       }
     }

     augment "/rt:routing/rt:control-plane-protocols"
           + "/rt:control-plane-protocol/bgp:bgp/bgp:global"
           + "/bgp:afi-safis/bgp:afi-safi"
           + "/bgp:route-selection-options" {
       when "derived-from-or-self(../bgp:name, 'bt:ipv4-unicast') or "

Liu, et al.             Expires July 19, 2026                [Page 27]

Internet-Draft     YANG Data Model for BGP about RPKI      January 2026


          + "derived-from-or-self(../bgp:name, 'bt:ipv6-unicast')" {
         description
           "This augmentation is valid for IPv4 and IPv6 Unicast.";
       }
       description
         "augmentation of BGP route selection options";
       uses bgpsec-selection-option;
     }

     augment "/rt:routing/rt:control-plane-protocols"
           + "/rt:control-plane-protocol/bgp:bgp/bgp:neighbors"
           + "/bgp:neighbor/bgp:afi-safis/bgp:afi-safi"
           + "/bgp:ipv4-unicast" {
       description
         "augmentation of BGPSec for IPv4 Unicast neighbor";
       uses export-bgpsec-validation-config;
     }

     augment "/rt:routing/rt:control-plane-protocols"
           + "/rt:control-plane-protocol/bgp:bgp/bgp:neighbors"
           + "/bgp:neighbor/bgp:afi-safis/bgp:afi-safi"
           + "/bgp:ipv6-unicast" {
       description
         "augmentation of BGPSec for IPv6 Unicast neighbor";
       uses export-bgpsec-validation-config;
     }

     augment "/rt:routing/rt:control-plane-protocols"
           + "/rt:control-plane-protocol/bgp:bgp/bgp:peer-groups"
           + "/bgp:peer-group/bgp:afi-safis/bgp:afi-safi"
           + "/bgp:ipv4-unicast" {
       description
         "augmentation of BGPSec for IPv4 Unicast peer group";
       uses export-bgpsec-validation-config;
     }

     augment "/rt:routing/rt:control-plane-protocols"
           + "/rt:control-plane-protocol/bgp:bgp/bgp:peer-groups"
           + "/bgp:peer-group/bgp:afi-safis/bgp:afi-safi"
           + "/bgp:ipv6-unicast" {
       description
         "augmentation of BGPSec for IPv6 Unicast peer group";
       uses export-bgpsec-validation-config;
     }
   }

   <CODE ENDS>


Liu, et al.             Expires July 19, 2026                [Page 28]

Internet-Draft     YANG Data Model for BGP about RPKI      January 2026


5. BGP ASPA YANG Module

5.1. Tree View

   The complete tree of the ietf-bgp-aspa.yang data model is
   represented as following. See [RFC8340] for an explanation of the
   symbols used.









































Liu, et al.             Expires July 19, 2026                [Page 29]

Internet-Draft     YANG Data Model for BGP about RPKI      January 2026


   module: ietf-bgp-aspa

     augment /rt:routing/rt:control-plane-protocols
               /rt:control-plane-protocol/bgp:bgp/bgp:neighbors
               /bgp:neighbor:
       +--rw peer-role?           peer-role

     augment /rt:routing/rt:control-plane-protocols
               /rt:control-plane-protocol/bgp:bgp/bgp:peer-groups
               /bgp:peer-group:
       +--rw peer-role?           peer-role

     augment /rt:routing/rt:control-plane-protocols
               /rt:control-plane-protocol/bgp:bgp/bgp:global
               /bgp:afi-safis/bgp:afi-safi/bgp:ipv4-unicast:
       +--rw aspa-verification
          +--rw enabled?                 boolean
          +--rw eligible-prefix-policy?  leafref

     augment /rt:routing/rt:control-plane-protocols
               /rt:control-plane-protocol/bgp:bgp/bgp:global
               /bgp:afi-safis/bgp:afi-safi/bgp:ipv6-unicast:
       +--rw aspa-verification
          +--rw enabled?                 boolean
          +--rw eligible-prefix-policy?  leafref

     augment /rt:routing/rt:control-plane-protocols
               /rt:control-plane-protocol/bgp:bgp/bgp:rib
               /bgp:afi-safis/bgp:afi-safi/bgp:ipv4-unicast
               /bgp:loc-rib/bgp:routes/bgp:route:
       +--ro aspa-verification-state?  aspa-verification-state

     augment /rt:routing/rt:control-plane-protocols
               /rt:control-plane-protocol/bgp:bgp/bgp:rib
               /bgp:afi-safis/bgp:afi-safi/bgp:ipv6-unicast
               /bgp:loc-rib/bgp:routes/bgp:route:
       +--ro aspa-verification-state?  aspa-verification-state

     augment /rt:routing/rt:control-plane-protocols
               /rt:control-plane-protocol/bgp:bgp/bgp:global
               /bgp:afi-safis/bgp:afi-safi/bgp:route-selection-options:
       +--rw aspa
          +--rw enabled?                 boolean
          +--rw allow-invalid?           boolean
          +--rw allow-unknown?           boolean
          +--rw eligible-prefix-policy?  leafref

     augment /rt:routing/rt:control-plane-protocols

Liu, et al.             Expires July 19, 2026                [Page 30]

Internet-Draft     YANG Data Model for BGP about RPKI      January 2026


               /rt:control-plane-protocol/bgp:bgp/bgp:neighbors
               /bgp:neighbor/bgp:afi-safis/bgp:afi-safi
               /bgp:ipv4-unicast:
       +--rw export-aspa-validation
          +--rw enabled?                 boolean
          +--rw eligible-prefix-policy?  leafref

     augment /rt:routing/rt:control-plane-protocols
               /rt:control-plane-protocol/bgp:bgp/bgp:neighbors
               /bgp:neighbor/bgp:afi-safis/bgp:afi-safi
               /bgp:ipv6-unicast:
       +--rw export-aspa-validation
          +--rw enabled?                 boolean
          +--rw eligible-prefix-policy?  leafref

     augment /rt:routing/rt:control-plane-protocols
               /rt:control-plane-protocol/bgp:bgp/bgp:peer-groups
               /bgp:peer-group/bgp:afi-safis/bgp:afi-safi
               /bgp:ipv4-unicast:
       +--rw export-aspa-validation
          +--rw enabled?                 boolean
          +--rw eligible-prefix-policy?  leafref

     augment /rt:routing/rt:control-plane-protocols
               /rt:control-plane-protocol/bgp:bgp/bgp:peer-groups
               /bgp:peer-group/bgp:afi-safis/bgp:afi-safi
               /bgp:ipv6-unicast:
       +--rw export-aspa-validation
          +--rw enabled?                 boolean
          +--rw eligible-prefix-policy?  leafref


















Liu, et al.             Expires July 19, 2026                [Page 31]

Internet-Draft     YANG Data Model for BGP about RPKI      January 2026


5.2. Yang Module

   <CODE BEGINS> file "ietf-bgp-aspa@2022-10-18.yang"

   module ietf-bgp-aspa {
     yang-version "1.1";
     namespace "urn:ietf:params:xml:ns:yang:"
             + "ietf-bgp-aspa";
     prefix "aspa";

     import ietf-routing {
       prefix "rt";
       reference
         "RFC 8349, A YANG Data Model for Routing Management
          (NMDA Version).";
     }

     import ietf-bgp {
       prefix "bgp";
       reference
         "RFC XXXX: YANG Model for Border Gateway Protocol (BGP-4)";
     }

     import iana-bgp-types {
       prefix "bt";
       reference
         "RFC XXXX: YANG Model for Border Gateway Protocol (BGP-4)";
     }

     import iana-bgp-rib-types {
       prefix "brt";
       reference
         "RFC XXXX: YANG Model for Border Gateway Protocol (BGP-4)";
     }

     import ietf-routing-policy {
       prefix rt-pol;
       reference
         "RFC 9067: A YANG Data Model for Routing Policy Management.";
     }

     organization
       "IETF SIDROPS Working Group";

     contact
       "TBD";

     description

Liu, et al.             Expires July 19, 2026                [Page 32]

Internet-Draft     YANG Data Model for BGP about RPKI      January 2026


       "This module describes configuration of the BGP AS PATH
        Verification Based on ASPA.

        This YANG model conforms to the Network Management
        Datastore Architecture (NMDA) as described in RFC 8342.

        Copyright (c) 2022 IETF Trust and the persons identified as
        authors of the code.  All rights reserved.

        Redistribution and use in source and binary forms, with or
        without modification, is permitted pursuant to, and subject to
        the license terms contained in, the Revised BSD License set
        forth in Section 4.c of the IETF Trust's Legal Provisions
        Relating to IETF Documents
        (https://trustee.ietf.org/license-info).

        This version of this YANG module is part of RFC XXXX;
        see the RFC itself for full legal notices.

        The key words 'MUST', 'MUST NOT', 'REQUIRED', 'SHALL', 'SHALL
        NOT', 'SHOULD', 'SHOULD NOT', 'RECOMMENDED', 'NOT RECOMMENDED',
        'MAY', and 'OPTIONAL' in this document are to be interpreted as
        described in BCP 14 (RFC 2119) (RFC 8174) when, and only when,
        they appear in all capitals, as shown here.";

     reference "RFC XXXX";

     revision 2022-10-18 {
       description
         "Initial Version";
       reference
         "RFC XXXX, YANG Data Model for RPKI to Router Protocol";
     }

     identity ineligible-aspa {
       base brt:ineligible-route-reason;
       description
         "Route was ineligible due to ASPA verification";
     }

     typedef peer-role {
       type enumeration {
         enum customer {
           description
             "The role of the BGP peer is customer.";
         }
         enum provider {
           description

Liu, et al.             Expires July 19, 2026                [Page 33]

Internet-Draft     YANG Data Model for BGP about RPKI      January 2026


             "The role of the BGP peer is provider.";
         }
         enum lateral-peer {
           description
             "The role of the BGP peer is lateral peer.";
         }
         enum rs {
           description
             "The role of the BGP peer is Route Server (RS).";
         }
         enum rs-client {
           description
             "The role of the BGP peer is RS-client.";
         }
         enum mutual-transit {
           description
             "The role of the BGP peer is mutual-transit.";
         }
       }
       description
         "Roles of BGP peers.";
       reference
         "RFC XXXX, BGP AS_PATH Verification Based on Autonomous
          System Provider Authorization (ASPA) Objects.";
     }

     typedef aspa-verification-state {
       type enumeration {
         enum valid {
           description
             "The ASPA verification outcome is valid.";
         }
         enum invalid {
           description
             "The ASPA verification outcome is invalid.";
         }
         enum unknown {
           description
             "The ASPA verification outcome is unknown.";
         }
         enum disabled {
           description
             "BGP ASPA verification is not enabled.";
         }
       }
       description
         "ASPA verification state of BGP routes.";
       reference

Liu, et al.             Expires July 19, 2026                [Page 34]

Internet-Draft     YANG Data Model for BGP about RPKI      January 2026


         "RFC XXXX, BGP AS_PATH Verification Based on Autonomous
          System Provider Authorization (ASPA) Objects.";
     }

     grouping aspa-config {
       description
         "ASPA verification of BGP prefix.";
       container aspa-verification {
         leaf enabled {
           type boolean;
           default "false";
           description
             "Whether ASPA verification of BGP prefix is enabled.";
         }
         leaf eligible-prefix-policy {
           type leafref {
             path "/rt-pol:routing-policy/rt-pol:policy-definitions/"
                   + "rt-pol:policy-definition/rt-pol:name";
              }
           description
             "A reference to a routing policy which can be used to
              restrict the prefixes for which ASPA verification
              is enabled.";
         }
         description
           "ASPA verification of BGP prefix.";
       }
     }

     grouping aspa-selection-option {
       description
         "ASPA option for BGP route selection.";
       container aspa {
         leaf enabled {
           type boolean;
           default "false";
           description
             "When enabled allows the ASPA verification states to be
              taken into consideration in the best-path calculation.";
         }
         leaf allow-invalid {
           type boolean;
           default "false";
           description
             "When enabled allows the route with 'invalid' ASPA
              verification state to be taken into consideration in
              the best-path calculation.";
         }

Liu, et al.             Expires July 19, 2026                [Page 35]

Internet-Draft     YANG Data Model for BGP about RPKI      January 2026


         leaf allow-unknown {
           type boolean;
           default "true";
           description
             "When enabled allows the route with 'unknown' ASPA
              verification state to be taken into consideration in
              the best-path calculation.";
         }
         leaf eligible-prefix-policy {
           type leafref {
             path "/rt-pol:routing-policy/rt-pol:policy-definitions/"
                   + "rt-pol:policy-definition/rt-pol:name";
              }
           description
             "A reference to a routing policy which can be used to
              restrict the prefixes for which ASPA option
              is enabled in BGP route selection.";
         }
         description
           "ASPA option for BGP route selection.";
       }
     }

     grouping export-aspa-validation-config {
       description
         "Export AS PATH validation of BGP prefix.";
       container export-aspa-validation {
         leaf enabled {
           type boolean;
           default "false";
           description
             "When enabled allows the AS PATH validity states to be
              taken into consideration in BGP export.";
         }
         leaf eligible-prefix-policy {
           type leafref {
             path "/rt-pol:routing-policy/rt-pol:policy-definitions/"
                   + "rt-pol:policy-definition/rt-pol:name";
              }
           description
             "A reference to a routing policy which can be used to
              restrict the prefixes for which AS PATH validity
              states are considered in BGP export.";
         }
         description
           "Export AS PATH validation of BGP prefix.";
       }
     }

Liu, et al.             Expires July 19, 2026                [Page 36]

Internet-Draft     YANG Data Model for BGP about RPKI      January 2026



     augment "/rt:routing/rt:control-plane-protocols"
           + "/rt:control-plane-protocol/bgp:bgp/bgp:neighbors"
           + "/bgp:neighbor" {
       description
         "augmentation of BGP peer roles for neighbors";
       leaf peer-role {
         type peer-role;
         description
           "Role of the peer";
       }
     }

     augment "/rt:routing/rt:control-plane-protocols"
           + "/rt:control-plane-protocol/bgp:bgp/bgp:peer-groups"
           + "/bgp:peer-group" {
       description
         "augmentation of BGP peer roles for peer groups";
       leaf peer-role {
         type peer-role;
         description
           "Role of the peer group";
       }
     }

     augment "/rt:routing/rt:control-plane-protocols"
           + "/rt:control-plane-protocol/bgp:bgp/bgp:global"
           + "/bgp:afi-safis/bgp:afi-safi/bgp:ipv4-unicast" {
       description
         "ASPA verification augmentation of BGP IPv4 Unicast
          Address Family.";
       uses aspa-config;
     }

     augment "/rt:routing/rt:control-plane-protocols"
           + "/rt:control-plane-protocol/bgp:bgp/bgp:global"
           + "/bgp:afi-safis/bgp:afi-safi/bgp:ipv6-unicast" {
       description
         "ASPA verification augmentation of BGP IPv6 Unicast
          Address Family.";
       uses aspa-config;
     }

     augment "/rt:routing/rt:control-plane-protocols"
           + "/rt:control-plane-protocol/bgp:bgp/bgp:rib"
           + "/bgp:afi-safis/bgp:afi-safi/bgp:ipv4-unicast"
           + "/bgp:loc-rib/bgp:routes/bgp:route" {
       description

Liu, et al.             Expires July 19, 2026                [Page 37]

Internet-Draft     YANG Data Model for BGP about RPKI      January 2026


         "ASPA verification state augmentation of BGP IPv4
          Unicast route.";
       leaf aspa-verification-state {
         type aspa-verification-state;
         description
           "ASPA verification state of BGP IPv4 Unicast prefix.";
       }
     }

     augment "/rt:routing/rt:control-plane-protocols"
           + "/rt:control-plane-protocol/bgp:bgp/bgp:rib"
           + "/bgp:afi-safis/bgp:afi-safi/bgp:ipv6-unicast"
           + "/bgp:loc-rib/bgp:routes/bgp:route" {
       description
         "ASPA verification state augmentation of BGP IPv6
          Unicast route.";
       leaf aspa-verification-state {
         type aspa-verification-state;
         description
           "ASPA verification state of BGP IPv6 Unicast prefix.";
       }
     }

     augment "/rt:routing/rt:control-plane-protocols"
           + "/rt:control-plane-protocol/bgp:bgp/bgp:global"
           + "/bgp:afi-safis/bgp:afi-safi"
           + "/bgp:route-selection-options" {
       when "derived-from-or-self(../bgp:name, 'bt:ipv4-unicast') or "
          + "derived-from-or-self(../bgp:name, 'bt:ipv6-unicast')" {
         description
           "This augmentation is valid for IPv4 and IPv6 Unicast.";
       }
       description
         "augmentation of BGP route selection options";
       uses aspa-selection-option;
     }
   }

     augment "/rt:routing/rt:control-plane-protocols"
           + "/rt:control-plane-protocol/bgp:bgp/bgp:neighbors"
           + "/bgp:neighbor/bgp:afi-safis/bgp:afi-safi"
           + "/bgp:ipv4-unicast" {
       description
         "augmentation of AS PATH for IPv4 Unicast neighbor";
       uses export-aspa-validation-config;
     }

     augment "/rt:routing/rt:control-plane-protocols"

Liu, et al.             Expires July 19, 2026                [Page 38]

Internet-Draft     YANG Data Model for BGP about RPKI      January 2026


           + "/rt:control-plane-protocol/bgp:bgp/bgp:neighbors"
           + "/bgp:neighbor/bgp:afi-safis/bgp:afi-safi"
           + "/bgp:ipv6-unicast" {
       description
         "augmentation of AS PATH for IPv6 Unicast neighbor";
       uses export-aspa-validation-config;
     }

     augment "/rt:routing/rt:control-plane-protocols"
           + "/rt:control-plane-protocol/bgp:bgp/bgp:peer-groups"
           + "/bgp:peer-group/bgp:afi-safis/bgp:afi-safi"
           + "/bgp:ipv4-unicast" {
       description
         "augmentation of AS PATH for IPv4 Unicast peer group";
       uses export-aspa-validation-config;
     }

     augment "/rt:routing/rt:control-plane-protocols"
           + "/rt:control-plane-protocol/bgp:bgp/bgp:peer-groups"
           + "/bgp:peer-group/bgp:afi-safis/bgp:afi-safi"
           + "/bgp:ipv6-unicast" {
       description
         "augmentation of AS PATH for IPv6 Unicast peer group";
       uses export-aspa-validation-config;
     }
   }

   <CODE ENDS>

6. Security Considerations

   This section is modeled after the template described in Section 3.7
   of [YANG-GUIDE].

   The YANG data models in this document define data models that is
   designed to be accessed via YANG-based management protocols, such as
   NETCONF [RFC6241] and RESTCONF [RFC8040]. These protocols have to
   use a secure transport layer (e.g., SSH [RFC4252], TLS [RFC8446],
   and QUIC [RFC9000]) and have to use mutual authentication.

   The Network Configuration Access Control Model (NACM) [RFC8341]
   provides the means to restrict access for particular NETCONF or
   RESTCONF users to a preconfigured subset of all available NETCONF or
   RESTCONF protocol operations and content.

   There are a number of data nodes defined in this YANG module that
   are writable/creatable/deletable (i.e., config true, which is the
   default). These data nodes can be considered sensitive or vulnerable

Liu, et al.             Expires July 19, 2026                [Page 39]

Internet-Draft     YANG Data Model for BGP about RPKI      January 2026


   in some network environments. Write operations (e.g., edit-config)
   to these data nodes without proper protection can have a negative
   effect on network operations. Specifically, the following subtrees
   and data nodes have particular sensitivities/vulnerabilities:



   Some of the readable data nodes in this YANG module may be
   considered sensitive or vulnerable in some network environments. It
   is thus important to control read access (e.g., via get, get-config,
   or notification) to these data nodes. Specifically, the following
   subtrees and data nodes have particular
   sensitivities/vulnerabilities:

   There are no particularly sensitive RPC or action operations.

7. IANA Considerations

   RFC Ed.: In this section, replace all occurrences of 'XXXX' with the
   actual RFC number (and remove this note).

7.1. IETF XML Registry

   The IANA is requested to assign the following URI in the "IETF XML
   Registry" [RFC3688]:

      URI: urn:ietf:params:xml:ns:yang:ietf-bgp-origin-as-validation
      Registrant Contact: The IESG.
      XML: N/A, the requested URI is an XML namespace.

      URI: urn:ietf:params:xml:ns:yang:ietf-bgp-sec
      Registrant Contact: The IESG.
      XML: N/A, the requested URI is an XML namespace.



      URI: urn:ietf:params:xml:ns:yang: ietf-bgp-aspa
      Registrant Contact: The IESG.
      XML: N/A, the requested URI is an XML namespace.




Liu, et al.             Expires July 19, 2026                [Page 40]

Internet-Draft     YANG Data Model for BGP about RPKI      January 2026


7.2. YANG Module Names Registry

   This document registers the following YANG modules in the "YANG
   Module Names" registry [RFC6020]:

      Name:       ietf-bgp-origin-as-validation
      Maintained by IANA?  N
      Namespace:  urn:ietf:params:xml:ns:yang:ietf-bgp-origin-as-
   validation
      Prefix:     oav
      Reference:  RFC XXXX



      Name:       ietf-bgp-sec
      Maintained by IANA?  N
      Namespace:  urn:ietf:params:xml:ns:yang:ietf-bgp-sec
      Prefix:     sec
      Reference:  RFC XXXX



      Name:       ietf-bgp-aspa
      Maintained by IANA?  N
      Namespace:  urn:ietf:params:xml:ns:yang:ietf-bgp-aspa
      Prefix:     aspa
      Reference:  RFC XXXX



8. References








Liu, et al.             Expires July 19, 2026                [Page 41]

Internet-Draft     YANG Data Model for BGP about RPKI      January 2026


9. References

9.1. Normative References

   [RFC2119] Bradner, S., "Key words for use in RFCs to Indicate
             Requirement Levels", BCP 14, RFC 2119, DOI
             10.17487/RFC2119, March 1997, <https://www.rfc-
             editor.org/info/rfc2119>.

   [RFC6810] Bush, R. and R. Austein, "The Resource Public Key
             Infrastructure (RPKI) to Router Protocol", RFC 6810, DOI
             10.17487/RFC6810, January 2013, <https://www.rfc-
             editor.org/info/rfc6810>.

   [RFC6811] Mohapatra, P., Scudder, J., Ward, D., Bush, R., and R.
             Austein, "BGP Prefix Origin Validation", RFC 6811, DOI
             10.17487/RFC6811, January 2013, <https://www.rfc-
             editor.org/info/rfc6811>.

   [RFC7950] Bjorklund, M., Ed., "The YANG 1.1 Data Modeling Language",
             RFC 7950, DOI 10.17487/RFC7950, August 2016,
             <https://www.rfc-editor.org/info/rfc7950>.

   [RFC8174] Leiba, B., "Ambiguity of Uppercase vs Lowercase in RFC
             2119 Key Words", BCP 14, RFC 8174, DOI 10.17487/RFC8174,
             May 2017, <https://www.rfc-editor.org/info/rfc8174>.

   [RFC8210] Bush, R. and R. Austein, "The Resource Public Key
             Infrastructure (RPKI) to Router Protocol, Version 1", RFC
             8210, DOI 10.17487/RFC8210, September 2017,
             <https://www.rfc-editor.org/info/rfc8210>.

   [RFC8342] Bjorklund, M., Schoenwaelder, J., Shafer, P., Watsen, K.,
             and R. Wilton, "Network Management Datastore Architecture
             (NMDA)", RFC 8342, DOI 10.17487/RFC8342, March 2018,
             <https://www.rfc-editor.org/info/rfc8342>.

   [RFC8635] Bush, R., Turner, S., and K. Patel, "Router Keying for
             BGPsec", RFC 8635, DOI 10.17487/RFC8635, August 2019,
             <https://www.rfc-editor.org/info/rfc8635>.

   [I-D.ietf-sidrops-8210bis] Bush, R. and R. Austein, "The Resource
             Public Key Infrastructure (RPKI) to Router Protocol,
             Version 2", Work in Progress, Internet-Draft, draft-ietf-
             sidrops-8210bis-16, 27 September 2024,
             <https://datatracker.ietf.org/doc/html/draft-ietf-sidrops-
             8210bis-16>.


Liu, et al.             Expires July 19, 2026                [Page 42]

Internet-Draft     YANG Data Model for BGP about RPKI      January 2026


   [I-D.ietf-sidrops-aspa-verification] Azimov, A., Bogomazov, E.,
             Bush, R., Patel, K., Snijders, J., and K. Sriram, "BGP
             AS_PATH Verification Based on Autonomous System Provider
             Authorization (ASPA) Objects", Work in Progress, Internet-
             Draft, draft-ietf-sidrops-aspa-verification-20, 4 January
             2025, <https://datatracker.ietf.org/doc/html/draft-ietf-
             sidrops-aspa-verification-20>.

   [I-D.ietf-idr-bgp-model] Jethanandani, M., Patel, K., Hares, S., and
             J. Haas, "YANG Model for Border Gateway Protocol (BGP-4)",
             Work in Progress, Internet-Draft, draft-ietf-idr-bgp-
             model-18, 21 October 2024,
             <https://datatracker.ietf.org/doc/html/draft-ietf-idr-bgp-
             model-18>.

9.2. Informative References

   [RFC8340] Bjorklund, M. and L. Berger, Ed., "YANG Tree Diagrams",
             BCP 215, RFC 8340, DOI 10.17487/RFC8340, March 2018,
             <https://www.rfc-editor.org/info/rfc8340>.

   [YANG-GUIDE] Bierman, A., Boucadair, M., and Q. Wu, "Guidelines for
             Authors and Reviewers of Documents Containing YANG Data
             Models", Work in Progress, Internet-Draft, draft-ietf-
             netmod-rfc8407bis-28, 5 June 2025,
             <https://datatracker.ietf.org/doc/html/draft-ietf-netmod-
             rfc8407bis-28>.



Contributors

   Jeffrey Haas
   Juniper Networks, Inc.
   1133 Innovation Way
   Sunnyvale, CA 94089
   United States of America
   Email: jhaas@juniper.net










Liu, et al.             Expires July 19, 2026                [Page 43]

Internet-Draft     YANG Data Model for BGP about RPKI      January 2026


   Hongwei Liu
   ZTE Corporation
   China
   Email: liu.hongwei3@zte.com.cn

   Mengxiao Chen
   H3C
   China
   Email: chen.mengxiao@h3c.com


Authors' Addresses

   Yisong Liu
   China Mobile
   China
   Email: liuyisong@chinamobile.com


   Changwang Lin
   New H3C Technologies
   China
   Email: linchangwang.04414@h3c.com


   Haibo Wang
   Huawei Technologies
   China
   Email: rainsword.wang@huawei.com


   Jishnu Roy
   Juniper Networks, Inc.
   1133 Innovation Way
   Sunnyvale, CA 94089
   United States of America
   Email: jishnur@juniper.net


   Di Ma
   ZDNS
   Floor 21, Block B, Greenland Center
   Chaoyang Beijing, 100102
   China
   Email: madi@zdns.cn




Liu, et al.             Expires July 19, 2026                [Page 44]

