RIPE NCC Local Internet Registry Training Course

1
RIPE NCCLocal Internet RegistryTraining Course

2
Learning Goals

• Your responsibilities as LIRs
• IP resources administration
• Efficient communication with the RIPE NCC

3
Overview

• 1. Introduction to the RIPE NCC
• 2. Being an LIR
• 3. The RIPE Database
• 4. Making Assignments
• 5. Assignment Window
• 6. Managing Allocations
• 7. PI Address Space
• 8. IPv6
• 9. Reverse DNS
• 10. ASN
• 11. RIPE Policy Development Process

4
1. Introduction to the RIPE NCC

• RIPE
• RIPE NCC
• Internet Registry System

5
RIPE and RIPE NCC

• Réseaux IP Européens (1989)
• collaborative operators community for
  coordinating IP infrastructure development
• open to all
• developing policies input to the RIPE NCC
• RIPE Network Coordination Centre (1992)
• independent not-for-profit membership
  organisation
• one of five Regional Internet Registries (RIRs)

6
RIR Service Regions
7
Internet Registry System Goals
8
Hierarchical Distribution
9
RIPE NCC Services

• Public Services
• RIPE Database
• Routing Registry
• RIPE support
• Spreading information
• ENUM (e164.arpa)
• K-root name server
• Test Traffic Measurements
• DNSMon
• E-Learning

• Member Services
• IP resources
• IPv4
• IPv6
• AS Numbers
• Reverse DNS delegation
• Training courses
• LIR
• Routing Registry Tools
• DNS for LIRs

10
(No Transcript)
11
Influencing RIPE NCC

• Members attending
• RIPE NCC General Meeting
• vote on Charging Scheme
• RIPE NCC proposes yearly
• Activity Plan and Budget
• RIPE proposes actions

12
Budget and Charging Scheme

• RIPE NCC is not-for-profit
• activities determined by RIPE expenses based on
  activities
• money comes from (yearly) membership fees
• money split from between existing and projected
  new / closed LIRs
• Your fee / category depends on
• your "score and scores" of all the other LIRs
• draft income budget
• Your billing score based on
• units and formula in (yearly) "Charging Scheme
• Score matched to category in "Billing Procedure
• document published only after the approval of GM
  (Oct.)
• category can not be guessed beforehand!
• Billing phases

13
RIPE NCC Learning Points

• The RIPE NCC is not RIPE
• You can influence RIPE NCC activities
• Remember aggregation, conservation, registration

Questions?
14
2. Being an LIR

• Benefits and Responsibilities
• Terminology
• Set-Up Procedure

15
What is an LIR?

• Local Internet Registry
• responsible for obtaining, distributing and
  registering IP resources, according to the RIPE
  policies
• Member of the RIPE NCC
• receiving resources directly from the RIPE NCC
• Benefits
• flexibility
• independence (BGP multihoming)

16
Allocation and Assignment
IANA
/0
/8
RIR
LIR
/21
End User
/23
/25
/23
Allocation
PA Assignment
PI Assignment
17
Terminology

• Allocation
• address space set apart, by the RIPE NCC for
  LIRs and its customers future use
• Assignment
• address space in use in networks
  (End User,
  downstream ISP or LIRs own infrastructure)
• made from allocation or sub-allocation
• Assignment Window
• maximum nr of addresses an LIR can assign without
  RIPE NCCs approval. New LIR AW0

18
PI versus PA Assignments
Aggregation
No Aggregation
BGP Announcement (1)
BGP Announcements (4)
LIR Allocation
Customer Assignments
Customer Assignments
Provider Aggregatable (Non-portable Assignments)
Provider Independent (Portable Assignments)
19
Classless Addressing

• Classful addressing (80-93) now obsolete
• waste of addresses routing table growth
• 93 Classless Inter Domain Routing (CIDR)
• flexible allocation / assignment sizes
• w.x.y.z/nn notation
• CIDR implemented in all modern routing protocols
• CIDR used for address space distribution

20
LIR Set-up Process

• Steps
• read policy documents
• apply for membership
• RegID, contacts
• pay the fees
• sign the contract
• Next steps
• LIR register RIPE Database contact data
• RIPE NCC Reg file, organisation object
• LIR activate LIR Portal account

21
Confidential

LIR
Resource Request

Reg File
Update
RIPE Database
22
First IPv4 Allocation

• If you
• want independent addresses
• have an estimate of usage for one year
• Send us
• IPv4 first allocation request form
• PA assignment request form for infrastructure
• PA assignment request form for each customer
• Slow start minimum initial allocation size /21

23
Being an LIR Learning Points

• You are part of the global Registry System
• Think CIDR!
• LIR Portal main interface

Questions?
24
3. The RIPE Database

• Creating contact information objects
• Protection

25
RIPE Database Contact Info

• All LIRs must have
• person object
• maintainer (mntner) object
• organisation object
• role object, use it!
• To create / update object
• use webupdates or
• syncupdates or
• e-mail completed template to ltauto-dbm_at_ripe.netgt

26
Not using a Role Object
27
Using a Role Object
tech-c JS123-RIPE
tech-c SB456-RIPE
28
Creating person Object

• person John Smith
• address Herengracht 258
• phone [phone]
• e-mail john.smith_at_bluelight.net
• abuse-mailbox abuse_at_bluelight.net
• nic-hdl auto-1
• changed j.smith_at_bluelight.net 20051031
• source RIPE

29
RIPE Database Protection

• mntner holds the password / key for authorisation
  of updates of other objects
• Include mnt-by NAME-MNT in all objects!
• for updates include password bla or sign
• Authentication methods
• CRYPT-PW ltencrypted passwordgt deprecated !
• MD5-PW ltencrypted passwordgt
• encryption web interface available
• PGPKEY-ltkey IDgt
• X509-ltIDgt
• Forgot password? Go to RIPE DB gt DB Support gt
  Security

30
Multiple protection

• auth MD5-PW bla34
• auth PGPKEY-AE6FBBF7

mntner ONE-MNT
nic-hdl JS1-RIPE mnt-by ONE-MNT mnt-by
TWO-MNT
person John Smith

• auth MD5-PW 1o93UxR

mntner TWO-MNT

• Any of the three authentications

31
Hierarchical Authorisation
status ALLOCATED PA mnt-by
RIPE-NCC-HM-MNT mnt-lower LIR-MNT
inetnum 85.118.184.0/21
/21
Allocation
status ASSIGNED PA mnt-by LIR-MNT
inetnum 85.118.186.0/25
/25
Assignment
32
RIPE Database Learning Points

• Modify objects on-line
• Easier administration with role objects
• Protect data in all objects

Questions?
33
4. Making Assignments

• Assignment process
• Policy
• Registering assignments in the DB

34
Assignment Policies

• Policies help LIR in finding compromise
• End User wishes versus Registry System goals
• Conservation versus aggregation
• LIRs responsibility to implement policies
• If you dont like current policies, you can
  change them!

35
Get it Right

• Before sending PA request, read
• FAQ, Quick Tips
• IPv4 Address Assignment and Allocation Policies
• The LIR Handbook
• Request online via LIR Portal
• or PA Assignment Request Form
• or PA Assignment Wizard via LIR Portal
• Not more than 5 requests at a time

36
Assignment Process
Collect information and evaluate request
Request gt AW?
yes
no
Need 2nd opinion?
RIPE NCC evaluates request
yes
no
Choose addresses
Keep documentation and register in RIPE DB
37
Step 1 LIR Collects Information

• Why?
• To determine the operational need
• To justify the decision
• Info needed
• Contact details
• Network setup
• Current address space usage
• Address space requirements
• Future plans
• Confidential, local language

38
Step 2 LIR Evaluates Request

• Current address space
• Returning addresses?
• Renumbering encouraged!
• All subnets classless
• Planning of growth two years ahead maximum
• utilisation 25 now, 50 in one year

39
Step 3 LIR Makes Decision

• Size
• Based on demonstrated need
• For End User? For own Infrastructure?
• Classless
• /23 /25 or /27 not always /24
• Range
• Your choice

40
Step 4 Request Form

• General Information
• Address Space User
• Addressing Plan
• Equipment description
• Network description
• Network diagram
• Example of the completed form
• for the small ISP Laika, customer of the LIR
  Bluelight

41
Separate Request Forms for

• Each End User network
• LIRs own infrastructure
• can be a single request form for the whole block
• separate subnet for each type of usage

42
Portal Communication

Portal Request Form
Real time syntax checks
Ticket created Request queued
Use the same ticket number

e-mail
LIR answers
Human (analyst)
RIPE NCCEvaluation
e-mail
Questions?
yes
no
Approval
43
Email Communication
PA Assignment Request Form

LIR fixes errors
lthostmaster_at_ripe.netgt
Always include - Reg-ID - your name
Ticket created Syntax checks
no
correct?
yes
Use the same ticket number
Request queued

Human (analyst)
LIR answers
RIPE NCCEvaluation
Questions?
yes
no
Approval
44
RIPE NCC Evaluates Requests

• Based on IPv4 Address Policies document
• Dynamic assigning encouraged
• not static
• More than /20 usage statistics verification
• Always-on technologies xDSL, cable, GPRS
• Name-based virtual web hosting encouraged
• not IP-based
• exceptions SSL, ftp mail servers...

45
Approval

• RIPE NCC sends approval message to LIR
• Size
• netname
• Date
• ticket closed
• LIR keeps approval message
• keep all original documents too
• contract with customer
• Next steps
• LIR chooses addresses
• LIR creates inetnum object

46
Step 5 LIR Registers in RIPE DB

• Validity
• Uniqueness
• Overview
• range
• netname
• Contact info
• admin-c
• tech-c
• inetnum must match internal documentation

47
Registering End Users Separately

• Obligatory. Benefits
• Abuse complaints can go directly to End User
• Network operators can block End User prefix
• Why? In case of attack by your End Users on other
  networks

48
Making Assignments Learning Points

• Shown for AW0
• Evaluate End User needs
• Always register End Users separately

Questions?
49
5. Assignment Window

• AW Definition
• Assignments above/within the AW
• Assignments for LIRs Infrastructure

50
Assignment Window Concept

• Maximum number of IP addresses the LIR can assign
  without approval from the RIPE NCC
• For each End User, within any 12 months
• New LIR, AW zero
• RIPE NCC raises AW to /21 six months after first
  assignment request
• unless invalid assignments
• or overlapping assignments
• What is my AW size?
• LIR Portal or reg file

51
Ask for Approval if

• Request is above AW
• This request and all previous assignments you
  made without the RIPE NCC to the same End User in
  the last 12 months
• New LIRs AW0 need approval for every
  assignment!

52
Assignment Process
Collect information and evaluate request
Request gt AW?
yes
no
Need 2nd opinion?
RIPE NCC evaluates request
yes
no
Choose addresses
Keep documentation and register in RIPE DB
53
Assignments within AW LIRs Responsibilities

• Evaluate all requests
• No need for approval
• Keep documentation for all assignments
• RIPE NCC may ask for it later
• Register all assigned networks in RIPE DB
• choose netname

54
Assignments for LIRs Infrastructure

• LIR can make multiple assignments to own
  infrastructure. Each assignment or lt AW
  
• In inetnum object separate attribute
• remarks INFRA-AW
• Only if assignment hasnt been requested!
• Cannot be merged
• Keep documentation to justify assignments
• Assignments gt AW send request to the RIPE NCC
  !

55
Infrastructure vs. End User
Grey Area Co-location Server housing Web
hosting
End User Their equipment, their
location Usually more than four IPs

• Infrastructure
• Blocks for connection to end users (dial-up, P2P)
• Blocks for co-location
• Server housing
• Web hosting

when the customer has a few addresses out of a
larger address block
if the customer has a separate subnet
56
Object Created but Invalid (for End User or
LIRs infrastructure)

• RIPE Database syntax checks passed, but
• Assignment not valid if inetnum
• Bigger than AW, but not approved by the RIPE NCC
• Overlapping
• Not separate for separate organisations
• Invalid assignments
• delay AW increase, additional allocations
• cause extra work

57
When Is the AW Raised ?

• Correct requests
• Policies applied
• Valid DB objects
• If you want the AW raised
• approach RIPE NCC ltlir-help_at_ripe.netgt

58
Assignment Window Learning Points

• New LIR AW0
• Assignment gt AW send request for approval
• Assignment lt AW evaluate assign yourself

Questions?
59
6. Managing Allocations

• Choosing the address range
• Managing RIPE Database data
• Requesting new allocation

60
Grouping and Splitting

• Grouping assignments
• Per service, location, customer size ?
• Fragmentation ?
• Splitting your allocation
• status SUB-ALLOCATED PA
• status LIR-PARTITIONED

p 2 p
20
Customers

Infrastructure
loops
POP 1
POP2
61
Sub-allocation Policy

• From LIR to Downstream ISP
• No approval needed
• Up to four times AW
• For each Downstream ISP within 12 months
• Minimum /24 maximum /20
• LIR registers inetnum
• Use Downstream ISPs maintainer in mnt-lower
• Assignments from sub-allocations
• AW rules also apply

62
Using Sub-allocation
status ALLOCATED PA
BlueLights Allocation
status SUB-ALLOCATED PA
status ASSIGNED PA
Sub-allocation for ISP INOX and all its
(future) customers
INOX makes assignments for its own
infrastructure and for its End Users from its
sub-allocation
63
Finding Assignments

• RIPE DB hierarchical (-m, -M, -l, -L)
• More less specific address ranges
• Grouped by relevance (to group by type use
  -G)
• Email addresses in objects filtered
• Use -B to show whole object
• Not interested in person objects?
• Use non-recursive lookup (-r)
• Prevents being blocked for too many person
  object queries
• Limiting search to inetnums?
• -T inetnum
• Inverse lookups (-i)

64
Need New IPv4 Allocation?

• 80 used (assigned and sub-allocated)?
• Or large request pending
• Assignment Window used correctly?
• have documentation about assignments?
• approved assignments still valid?
• Correct RIPE Database objects?
• Tools asused and Web Asused

65
Correcting Invalid Objects

• Larger than AW, but not requested?
• Send request for approval
• and update the changed line date
• Not-matching approved netname?
• Ask ltlir-help_at_ripe.netgt to update the Reg file
• Subject original ticket number
• Changed line date before the approval date?
• Update the "changed" line date
• Overlaps? Delete wrong inetnum
• Assignment no longer in use?
• Inform ltlir-help_at_ripe.netgt
• Subject original ticket number
• Delete the inetnum

66
Making New IPv4 Allocation

• Inconsistencies?
• LIR corrects data / agrees on deadline
• RIPE NCC reviews AW
• RIPE NCC allocates new block
• and creates allocation inetnum
• Size depends on previous usage rate
• LIR can start announcing the whole new prefix
• As one aggregate
• LIR creates route object

67
Managing Allocations Learning Points

• Choose the range carefully
• Keep the RIPE Database tidy
• asused

Questions?
68
7. PI Address Space

• Definition
• Requesting
• Responsibilities

69
PA versus PI Assignments

• Provider Aggregatable assignments
• LIR assigns to End User
• Must renumber when changing providers
• Only way to effectively scale the Internet!
• Provider Independent assignments
• RIPE NCC assigns to End User
• Portable
• Can be difficult to route
• Next assignment not aggregatable
• Affects yearly fee
• Increases size of the routing tables

70
Requesting PI Space

• Explain consequences to End User
• Create RIPE Database objects
• person/role, mntner, organisation
• Send request on behalf of End User
• LIR Portal,
• or PI Assignment Request Form

71
Evaluation of PI requests

• Additional questions
• Why does End User want PI (and not PA)?
• Requesting extra address space for routing?
• Aware of consequences?
• Same criteria as for PA assignments
• Conservative estimates
• Classless
• Assignment is only valid as long as original
  criteria remain valid

72
PI Responsibilities

• RIPE NCC
• Assigns to End User
• Creates inetnum
• LIR
• Makes contracts with End Users
• Helps End Users with reverse DNS, route objects
• Helps End Users if changing provider
• End User
• Maintains objects
• Must not assign further

73
PI Address Space Learning Points

• PA recommended
• LIR requests PI space for End User
• Shared responsibilities

Questions?
74
8. IPv6 Address Space

• Definition
• Requesting

75
First IPv6 Allocation

• If you
• a) are an LIR
• b) advertise allocation as a single prefix
• c) plan to make sub-allocations to other
  organisations and/or End Site assignments within
  two years
• Send us IPv6 first allocation request form
• Minimum initial allocation size /32
• Assignment policy being discussed

76
IPv6 Assignments

• Usual assignment size - /48 for each site
• End User network
• LIR infrastructure (per PoP)
• No approval needed
• Smaller size
• /64 just one subnet
• /128 just one device
• Multiple /48 for very large End Users
• Approval needed

77
New IPv6 Allocation

• HD ratio 0.8 usage of previous allocation
• 7132 /48s assignments in a /32
• Correct registrations (all /48s registered)
• New allocations size the same as the first
• Resulting in IPv6 prefix one bit shorter
• Or bigger if justified (sufficient for two years)

78
IPv6 Allocations
79
IPv6 Address Space Learning Points

• Allocation
• Assignment

Questions?
80
9. Reverse DNS

• Definition
• Domain objects
• Requesting

81
Why Reverse DNS?

• Mapping IP numbers to domain names
• Needed for applications (mail, IRC, ftp)
• Troubleshooting (traceroute)
• LIRs responsibility

82
inet(6)num and domain Objects
inet6num 20010888/32 status
ALLOCATED-BY-RIR mnt-by RIPE-NCC-HM-MNT mnt-domai
ns LIR-MNT
domain 8.8.8.0.1.0.0.2.ip6.arpa mnt-by LIR-MNT
inetnum 85.118.190.0/24 status ASSIGNED
PA mnt-by LIR-MNT mnt-domains END-USER-MNT
domain 190.118.85.in-addr.arpa mnt-by
END-USER-MNT
83
Preparations

• Decide on the address range
• Whole allocation? Assignment?
• IPv4 One or more /24, /16
• IPv6 One or more /36, /32
• Decide who will be responsible
• LIR?
• End User? (create mntner)
• Allow hierarchical authorisation
• Add appropriate mntner in the mnt-domains of
  the inetnum object

84
Set-up Request

• Configure DNS server for chosen zones
• RFC 1912, RFC 2182
• Find the secondary server
• Request submit domain object to RIPE DB
• nserver ns.bluelight.nl
• nserver ns2.pinklight.de

85
What Will Be Checked

• RIPE Database syntax
• Authentication
• mnt-domains in corresponding inetnum
• and
• mnt-by in domain
• Name servers setup
• Errors / warnings ask ltripe-dbm_at_ripe.netgt
• Success RIPE NCC updates parent zone

86
Sizes Other than /24

• Multiple /24 delegations
• Can be requested as one domain object
• Use shorthand notation for consecutive zones
• Broken down then registered as multiple objects
  
• Smaller than /24 delegation
• End User can run own primary nameserver
• LIR requests delegation for whole /24
• LIR uses CNAME (RFC 2317)
• Reverse DNS for PI addresses done by the RIPE NCC

87
Reverse DNS Learning Points

• Important service to End Users
• Whole allocation in one go
• Request RIPE Database domain object

Questions?
88
10. Autonomous System Numbers

• ASN
• requesting
• route object

89
Autonomous System

• RFC 1930
• An AS is a connected group of IP prefixes
  which has a single and clearly defined routing
  policy.
• LIR can request an ASN
• For own network, or for another organisation
• Assignment criteria multihomed
• Unique routing policy
• E-mail addresses of peers

90
Multihomed Routing Policy
First Peer AS64512
Second Peer AS64513
ASNEW
91
aut-num in ASN Request Form

• aut-num ASNEW
• as-name ltadd name for the ASgt
• descr ltadd AS Number User namegt
• org ltadd org-IDgt
• import ltspecify the outgoing routing policy
  for the first peergt
• export ltspecify the incoming routing policy
  for the first peergt
• import ltspecify the outgoing routing policy
  for the second peergt
• export ltspecify the incoming routing policy
  for the second peergt
• ...

Bluelight-ASN
Bluelight Ltd
ORG-Bb2-RIPE
action pref20
from AS64512 accept ANY
to AS64512 announce ASNEW
from AS64513 accept ANY
action pref80
to AS64513 announce ASNEW
92
aut-num Object

• RIPE NCC creates aut-num object
• mnt-by LIR-MNT
• mnt-routes End-User-MNT (or LIR)
• org of whoever uses the ASN
• When the peering is established, LIR should
  update routing policy
• AS Number assignment is only valid as long as the
  original criteria remain valid

93
32 Bit AS Numbers

• Problem no more AS numbers available in 2012
• Solution 32 bit AS numbers
• 2007-2008 16 bit AS default, 32 bit AS on
  request
• in 2009 32 bit AS default, 16 bit AS on
  request
• as of 2010 Only 32 bit AS numbers
• Dont wait until 2009!
• Can you handle your new AS 1.5432 ?

94
route Object

• route objects part of Routing Registry
• LIR creates route/route6 objects for any (new)
  allocations they announce
• Both route and origin are primary key
• Complex hierarchical authorisation for creation
• Used for prefix filtering by some ISPs

95
ASN Learning Points

• If you want to be multihomed
• Describe your routing policy
• Route object recommended

Questions?
96
11. RIPE and Policy Development Process

• RIPE
• PDP
• Participation

97
How RIPE Works

• Open forum
• Voluntary participation
• Decisions by consensus
• Working groups
• Not a legal entity
• Does not develop Internet standards
• RIPE chair ltchair_at_ripe.netgt
• ltripe-list_at_ripe.netgt

98
Come to the RIPE Meetings!

• Two in a year / a week long
• 300 participants
• Working group meetings
• Plenary
• RIPE NCC Services Centre
• Long breaks / social events
• 2 free tokens for new LIRs
• Remote participation webcast, jabber / irc
• ltmeeting_at_ripe.netgt

99
Policy Development Process
ICANN
ASO
AfriNIC
RIPE NCC
ARIN
APNIC
LACNIC
Reach consensus across communities
AfriNIC community
RIPE community
ARIN community
APNIC community
LACNIC community
Regional Policy Proposal
Global Policy Proposal
100
PDP Cycle
101
PDP Process
Discussion Phase Suggested
timeline up to 9 weeks
Review Phase Suggested
timeline up to 5 weeks
Concluding Phase Suggested
timeline up to 5 weeks
Create Policy Proposal
Comment and review
Initial discussion of proposal
Last call
Proceed to documentation?
Is there consensus?
Document is drafted
Is there consensus?
Announce decision
102
Your Participation is Needed!

• What can you do?
• propose new policy
• we can help to draft it
• RIPE NCC Policy Development Officer is your
  contact
• filiz_at_ripe.net
• comment on other proposals
• check the drafts recent changes web page

103
Your Participation is Needed (2)

• How to take part?
• subscribe to mailing lists
• come to the meetings
• watch webcast and use jabber / irc

104
IPv4 Address Pool June 2005
Other
Central Registry

• 25

available
APNIC
RIPE NCC
AfriNIC
LACNIC
ARIN
source http//potaroo.net
105
IPv4 Address Pool - Now
Other
Central Registry

• 18

available
APNIC
RIPE NCC
AfriNIC
LACNIC
source http//potaroo.net
ARIN
106
Growth of Global Routing Table
300.000
250.000
200.000
Active BGP entries (FIB)
150.000
100.000
50.000
95
94
96
98
97
99
01
00
02
04
03
05
07
06
107
RIPE PDP Learning Points

• RIPE is not the RIPE NCC
• You can influence RIPE policies
• Join the discussions

Questions?
108
LIR Training Course Summary
109
Do You Want to Host RIPE NCC Training Courses?

• You will provide
• Location with lunch facilities
• High speed Internet connection
• The RIPE NCC will
• Provide the Training Course
• Announce the Training Course at your location
• Register the attendees
• Send the training material to your location
• The RIPE NCC will pay for
• Catering (Food and drink)
• Travel and accommodation for the RIPE NCC
  trainers
• Shipping the training material
• http//www.ripe.net/training/hosting.html

110
The End!
Y Diwedd
K???
Fí
Finis
????
Liðugt
Ki????
Ende
Fund
Konec
Kraj
Son
Kpaj
Lõpp
Vége
An Críoch
????
Endir
Fine
Sfârsit
Fin
?????
Einde
???e?
Slut
Slutt
Pabaiga
Tmiem
Koniec
Amaia
Loppu
Fim