junos-R3.conf

# -*- junos -*-
interfaces {
    em1 {
        unit 0 {
            family inet6 {
                address 2001:db8:aaaa::2/124;
            }
        }
    }
    em2 {
        unit 0 {
            family inet6 {
                address 2001:db8:bbbb::2/124;
            }
        }
    }
}

protocols {
    bgp {
        group peers {
            type external;
            import [ only-directly-connected accept-valid reject-all ];
            export reject-all;
            enforce-first-as;
            multipath;
            family inet6 {
                unicast {
                    no-install;
                }
            }
            neighbor 2001:db8:aaaa::f {
                peer-as 65000;
            }
        }
    }
}

routing-options {
    autonomous-system 65002;
    router-id 3.3.3.3;
    validation {
        group RPKI {
            # No support for SSH on JunOS
            session 2001:db8:bbbb::f {
                hold-time 60;         # session is considered down after 1 minute
                record-lifetime 3600; # cache is kept for 1 hour
                refresh-time 30;      # cache is refreshed every 30 seconds
                port 8282;
            }
        }
    }
}

policy-options {
    as-path exactly-one-asn "^.$";
    policy-statement only-directly-connected {
        term exactly-one-asn {
            from {
                protocol bgp;
                as-path exactly-one-asn;
            }
            then next policy;
        }
        then reject;
    }
    policy-statement accept-valid {
        term valid {
            from {
                protocol bgp;
                validation-database valid;
            }
            then {
                validation-state valid;
                accept;
            }
        }
        term invalid {
            from {
                protocol bgp;
                validation-database invalid;
            }
            then {
                validation-state invalid;
                reject;
            }
        }
    }
    policy-statement reject-all {
        then reject;
    }
}