RPKI Invalid Route Still Selected as Best Path in Cisco IOS-XE

Hi all,

I am testing BGP Prefix Origin Validation (RPKI) on Cisco IOS-XE.

R2 is configured with an RPKI cache server, and origin validation is working correctly. When I check the BGP table, I can see that a specific prefix (1.0.0.0/24) is marked as: RPKI State invalid.

However, despite being marked as invalid, the route is still selected as: "valid, external, best" and is being installed and used by BGP.

There is no alternative path for this prefix.

My questions are:

1. Is it normal behavior in IOS-XE for an RPKI Invalid route to still be selected as best if it is the only available path?
2. Does IOS-XE require an explicit route-map policy to drop invalid routes? I've tried to match on rpki state and deny Invalid routes and it does work.
3. Is automatic rejection of RPKI Invalid routes version-dependent?

I do not have the bgp bestpath prefix-validate disable-invalid command available in my IOS-XE version.

Thank you.