- address-policy-wg - mailman.ripe.net

Re: [address-policy-wg] FORMAL PROPOSAL: change of initial PA allocation size
by Jeff Williams 15 Jan '04

15 Jan '04

Hans and all, You are mistaken Hans. It would benefit you and everyone here if you would track Apnic a little closer... Hans Petter Holen wrote: > Dear WG, > As I have seen no proposals to prolong this process, we have consensus on > this matter. > > Seasons Greetings, > Hans Petter Holen > Address Policy WG Chair > > |Dear WG, > |I would like to call for closure on this matter. As this has > |been presented and discussed at the last RIPE meeting and > |proposed to the list as a formal proposal I would like to > |declare consensus on this issue. > | > |There have been discussion on the mainlinglist with some > |critical comments that it is my understanding has been > |clearified. (This proposal does not affect the payment scedule > |or membership structure and it does not affecting the PI policy). > | > |With this I would normaly declare concensus but as no deadline > |was set for the discussion I propose a 1 week last call for > |objections to the process on this matter. If I receive > |objections I propose to set a I month comment period before > |calling for closure on this matter. > | > |Best Regards, > |Hans Petter Holen > |Address Policy WG Chair > | > ||-----Original Message----- > ||From: address-policy-wg-admin(a)ripe.net > ||[mailto:address-policy-wg-admin@ripe.net] On Behalf Of Gert Doering > ||Sent: Friday, October 24, 2003 2:31 PM > ||To: address-policy-wg(a)ripe.net > ||Subject: [address-policy-wg] FORMAL PROPOSAL: change of initial PA > ||allocation size > || > ||Hi, > || > ||this was discussed on the list before the last RIPE meeting, > |and we had > ||it on the address policy working group meeting (presented by me). > || > ||I think we mostly have consensus on this issue, but I want to present > ||it as a formal proposal, before it's incorporated into the policy. > || > || > ||PROPOSAL: > || > || * the minimum initial allocation size (for new LIRs) is reduced from > || a /20, as of today, to a /21. > || (If a new LIR can demonstrate need for a bigger initial > |allocation, > || they can get a larger address block. This will not be changed). > || > || * the requirement to show an immediate need for 25% of the allocated > || address space is removed for the "minimum initial allocation" > || > || > ||The motivation for that is that under the current policy, > ||startup LIRs that do not already hold address space cannot get > ||an initial PA allocation (which would be a /20 as of today, or > ||bigger), because in many cases, they cannot demonstrate > ||immediate need, or prior utilization of sufficient address space. > || > ||To work around this, many startup LIRs use PI address space as > ||a start, and when they have filled enough of this, apply for > ||their own PA again. > ||The problem with this is that in the end, it's very likely > ||that more than one route will end up in the global BGP table > ||(where one PA route would be sufficient), and also it > ||encourages lying to the RIRs (PI space must not be distributed > ||to third parties, i.e., LIR customers). > || > || > ||The drawback of the changes are that it's potentially wasting > ||address space for "very small LIRs" (that would be happy with > ||a /23 PI space and will now get a "huge" /21). The wastage > ||would only happen for very small LIRs that will never grow to > ||fill the initial /21. > ||A rough calculation shows that "1000 new LIR /21 allocations" > ||would need a /11, which is not an unbearable strain on the > ||conservation side, judging from the total number of LIRs in > ||RIPE land today. > || > ||A second drawback of this is that people may need to adapt > ||their BGP filters to permit /21s from the network block(s) > ||where these allocations are made from. So the RIPE NCC needs > ||to document this accordingly, and ideally, well in advance. > || > ||Gert Doering > || -- NetMaster > ||-- > ||Total number of prefixes smaller than registry allocations: > ||57785 (56883) > || > ||SpaceNet AG Mail: netmaster(a)Space.Net > ||Joseph-Dollinger-Bogen 14 Tel : +49-89-32356-0 > ||80807 Muenchen Fax : +49-89-32356-299 > || > | Regards, -- Jeffrey A. Williams Spokesman for INEGroup LLA. - (Over 134k members/stakeholders strong!) "Be precise in the use of words and expect precision from others" - Pierre Abelard "If the probability be called P; the injury, L; and the burden, B; liability depends upon whether B is less than L multiplied by P: i.e., whether B is less than PL." United States v. Carroll Towing (159 F.2d 169 [2d Cir. 1947] =============================================================== CEO/DIR. Internet Network Eng. SR. Eng. Network data security Information Network Eng. Group. INEG. INC. E-Mail jwkckid1(a)ix.netcom.com Contact Number: 214-244-4827 or 214-244-3801

5 11

Re: [address-policy-wg] FORMAL PROPOSAL: change of initial PA allocation size
by Michael.Dillon＠radianz.com 14 Jan '04

14 Jan '04

>> So please: constructive criticism is welcome, but things like >> "all that you do is wrong, because APNIC is doing something!" >> (and no further reason or detail given) are just wasting our >> time. >excuse! where did i say that? please do not put stupid words into >my keyboard, i do that well enough. I suppose Randy has a killfile that discards messages from j-e-f-f w-i-l-l-i-a-m-s so he didn't realize that Gert was replying to one of Jeff's messages to the list. >>> So if we send out a formal proposal to change RIPE things to >>> RIPE lists, and nobody from the RIPE community objects - what's >>> wrong with assuming consensus, then? >i still consider this unwise, and for the reasons i stated. and, >in the face of such statements, i do not consider pointing out that >we are making, or proposing to make, policy that affects the global >internet a waste of time. I agree with Randy here. The regional boundaries are very fuzzy. The Internet routes across these boundaries as if they were not there. Many companies operate networks in more than one region. I was born in the ARIN region, now I live in the RIPE region and I work for a company whose network spans ARIN, RIPE and APNIC regions. Consensus on a RIPE mailing list could be a way to ignore what is happening in other regions and it could be a way to lock out other people in the RIPE region who haven't thought of looking at the mailing list. I know that the IETF uses mailing list consensus very successfully but the IETF is doing a very different job from RIPE. --Michael Dillon

1 0

Re: [address-policy-wg] Re: RIPE Access Policy Change Request to allow allocations to critical infrastructure
by Michael.Dillon＠radianz.com 13 Jan '04

13 Jan '04

>I don't claim that ARIN or ICANN or DENIC are not special, or are not >important for the functioning of the Internet as a whole. ICANN isn't special. They don't offer any infrastructure services. However, ARIN and RIPE maintain resgistry databases which are published in the form of a whois directory. This is part of the Internet infrastructure. DENIC hosts the .de top level domain and provides an authoritative DNS service. That is also part of the infrastructure. If an organization wants special treatment, first they have to show us that they operate a service that is a part of the Internet infrastructure. Then they have to show that this service is special enough to be called "critical". You are right that everyone forwards packets and that is not special enough. But what if someone operates a SIP network to carry VoIP calls for 112 (999) calls? Maybe that would make a part of their network into critical infrastructure. When making policy it is best to think ahead into the future a bit and make sure that they new policy will work for a few years, at least. --Michael Dillon

13 26

RE: [address-policy-wg] RIPE Access Policy Change Request to allow allocations to critical infrastructure
by Daniel Monteith 13 Jan '04

13 Jan '04

/24 if only :) I believe currently its the LIR initial allocation boundary that's the minimum guaranteed not to be filtered. I would welcome a move by the ISP's (mainly a couple of tier 1's) to relax this so that BGP multihoming for the small people becomes easier and more efficient. I am sure we are getting to the stage when route table size is not so much of an issue anymore. Cheers Dan -----Original Message----- From: Andre Chapuis [mailto:chapuis@ip-plus.net] Sent: Monday, January 12, 2004 3:43 PM To: Daniel Karrenberg; address-policy-wg(a)ripe.net Subject: Re: [address-policy-wg] RIPE Access Policy Change Request to allow allocations to critical infrastructure Agreed, And what about defining an address-range where every ISP opens its filter up to /29 (as an example) ? This would deal with both anycast and address-space conservation. Let's show that we (as ISPs) are not bound to the /24 forever ! André At 10:23 12.01.2004, Daniel Karrenberg wrote: >This discussion is *not* about address policy, >it really is about ** routing policy! ** >The goal is to get prefixes propagated. >They could live in any odd part of the address space! > >Routing policy is made by ISPs. (period) > >In order to provide hints to ISPs making such policy I have previolusly >proposed a *registry* for "special" prefixes with some general >categories like: > > - root server > - TLD server > - second level name server > - internet search engine > - other important prefix (see remarks section ;-) > - .... > >Such a registry could be provided by the RIRs and used by the ISPs when >defining and implementing their routing policy. The art here is to >design the categories and to decide which ones can be policed. It is >easy to determine and to check regularly if a prefix contains name >servers for instance. Other categories should be "self-declaration". >ISPs can then decide if and how to use such a registry. > >Is this something that provides added value to ISPs? >Is it something that is useful for those using such prefixes? > >Daniel > > >PS: If getting any address space at all is a problem for these applications, >this needs to be addressed. Maybe it is already addressed by adjusting >the "initial" usage requirements back to "nil" or some reasonable low level and >reducing the initial allocation size. > >This is a different discussion which belongs here, but I do not reeally follow >it anymore, so pardon me if I just assume it is moving along. -------------------------------------------------------- Andre Chapuis IP+ Backbone Engineering AS3303 Swisscom Enterprise Solutions Ltd Genfergasse 14, CH-3050 Bern +41 31 893 89 61 chapuis(a)ip-plus.net CCIE #6023 --------------------------------------------------------

6 5

Re: allocations to critical infrastructure
by Michael.Dillon＠radianz.com 13 Jan '04

13 Jan '04

>They are, but they are not even using the amount of redundancy available >by DNS today (read: "as many name servers as fit into a minimum sized >UDP packet full of glue"). So there is hardly an argument for doing >anycast. I think that it is dangerous for a policy to force people to follow an evolutionary path when they implement technology. If it is considered "best practice" for a DNS infrastructure to use anycast then we should not penalize them because they jump there from a more primitive state. >The route servers use TCP, which will not work over anycast (in the >general case - consider load balancing, every other packet going to >a different destination machine. No problem for UDP, big problem >for TCP) It is also dangerous for a policy to punish people for evolving their technology. If it is considered "best practice" to use anycast to publish critical infrastructure databases then people should be able to change their services to enable them to use UDP and anycast. There are many ways in which a service could be adapted to anycast, even a session-based service. There are also non-anycast ways to solve this type of problem, such as peer-2-peer overlay networks, that could still benefit from having a well-known address range as a rendezvous point. I really don't think that the policy needs to be a close fit for a certain technical implementation. Instead it needs to express the basic principle which is a non-technical principle. Then it can provide a checklist which deal with technical questions. In the future if the technical implementations change, it will be easier to add or change checklist items if there is a solid principle underlying the policy. --Michael Dillon

2 1

Re: [address-policy-wg] RIPE Access Policy Change Request to allow allocations to critical infrastructure
by Michael.Dillon＠radianz.com 12 Jan '04

12 Jan '04

>> meets this criteria but I would argue that part of Google's service >> are the ads which are not offered freely, i.e. they cost money. >Google is free for most users... Google is a business. If they want fault tolerance then they can buy it from Akamai or else build their own global infrastructure. If Google disappears, we can get similar service from many of their competitors. They aren't part of the infrastructure of the Internet. >> exist. But if DENIC ceases to exist, it is 100% certain that ICANN >> would find some other organization to continue offering .de nameservice. > What makes you so sure that DNS and/or ICANN will survive? LDAP is a well-proven robust and scalable directory services technology that is deployed at large organizations world-wide. But even though LDAP can do everything that DNS can do, there is no movement at all to replace DNS with LDAP and very few organizations run their DNS on top of backend LDAP servers. So DNS will survive for a long time. But if DNS would be replaced by LDAP, then I think DENIC would provide LDAP hosting for the .DE domain. And if DENIC does not survive, then ICANN would find someone else to provide LDAP services for .DE. But if ICANN does not survive, then its powers of allocating top level domains will pass to another organization, and this organization will make sure that there is somebody to host .DE. --Michael Dillon

8 8

Re: [address-policy-wg] RIPE Access Policy Change Request to allow allocations to critical infrastructure
by Elmar K. Bins 12 Jan '04

12 Jan '04

chapuis(a)ip-plus.net (Andre Chapuis) wrote: > Agreed, > And what about defining an address-range where every ISP opens its filter up to /29 (as an example) ? This would deal with both anycast and address-space conservation. > Let's show that we (as ISPs) are not bound to the /24 forever ! Nice idea. You try convincing the Tier-1s (and -wannabes). I second this thought, but I deem it impractical, since the "big players" will be hard to convince to change their filtering boundaries. I believe, some answers will be in the style of "who's RIPE anyway?". Yours, Elmar. -- Es gibt Luegen, verdammte Luegen und RIPE-141(-219)-Netzantraege. (mlelstv, dcii 2003) -----------------------------------------------------------[ ELMI-RIPE ]---

1 0

New IPv6 Address Block Allocated to RIPE NCC
by leo vegoda 12 Jan '04

12 Jan '04

Dear Colleagues, The RIPE NCC received the IPv6 address range 2001:1A00::/23 from the IANA in January 2004. You may wish to adjust any filters you have in place accordingly. More information on the IP space administered by the RIPE NCC can be found on our web site at: <http://www.ripe.net/ripe/docs/smallest-alloc-sizes.html> Regards, -- leo vegoda Registration Services Manager RIPE NCC

1 0

RIPE Access Policy Change Request to allow allocations to critical infrastructure
by Andreas Bäß/Denic 12 Jan '04

12 Jan '04

Beeing the first on this list in 2004 I can't resist to express my best wishes to everyone :-) During the last year, when we made plans for our further operations of our nameservice (i.e. anycast and introduction of IPv6), we discovered that we are getting into conflict with some of the RIPE allocation policies. I have been encouraged to start a discussion about making a policy change request. So here it comes: Request For An IPv4/IPv6 Policy Allowing Assignments For Network Critical Infrastructure Abstract At the moment, DENIC has eleven nameservers serving the de zone. At the moment they are all IPv4 only. DENIC wants to change the DNS setup with a higher total number of nameservers which not only have IPv4 but also IPv6 connectivity. However DENIC cannot simply increase the number of NS records and add AAAA records as this would quickly occasion truncation in the authority section of the UDP answer. Ignoring this limitation would cause negative effects that are described in http://www.ietf.org/internet-drafts/draft-ietf- dnsop-respsize-00.txt In order to keep at least the current quality of service, improve the resilience against distributed denial of service attacks (DDoS) and easier future scalability, the deployment of anycast technology (RFC3258) has been chosen for the future DENIC DNS operation. DENIC can not simply use addresses out of their current assignment because it is current practice to filter announcements on allocation boundaries. Therefore DENIC requests to establish a policy for ccTLD and gTLD nameservers that allows RIPE NCC to assign IPv4, IPv6 addresses that are not likely to be filtered by common practise for anycast-operation of their DNS services. Technical justification for this policy Pros: 1. Acceptance of DNS to be network critical Studies like http://www.ripe.net/ripe/meetings/ripe-45/presentations/ripe45-eof- rickard.pdf shows clearly that ccTLD and gTLD nameservers are a critical network infrastructure that justify special policies to guarantee operability of Internet applications. Three out of four RIRs (APNIC, ARIN and LACNIC) have policies allowing assignments to network critical infrastructure. All three policies classify ccTLDs as critical infrastructure. Extracts from these policies can be found in Appendices I through III. 2. Usage of DNS By size DENIC has 7 million registered domains with a monthly increase of 1%. The introduction of IDN in 2004 will increase the number of de-domains by roughly 500,000 to 1,000,000 domains in addition to the normal growth rate. Query load on nameservers DENIC currently serves 10,000 queries per second (all nameservers combined). The load is expected to increase exponentially as the acceptance of the Internet as a communication infrastructure is rising. New usage for DNS New integrating services like ENUM rely on DNS as their distributed information database. The adoption of ENUM will contribute to the importance of DNS for normal life of industry operations. 3. Resilience As availability expectation for Internet applications grow, nameservers are part of the critical Internet infrastructures to make these applications work. Anycasting is currently the state-of- the-art solution to lower the impact of DDoS attacks. 4. Allow smooth IPv6 transition As the world starts exploiting IPv6, the critical infrastructures should support them natively. However the limit of 512 bytes UDP responses put a limit on the total number of names and addresses (IPv4 and IPv6) that can be supplied using DNS protocol. Extension mechanisms for DNS (EDNS0) has removed this limitation but is not widely deployed yet. This dilemma, needing more space in the packets than DNS protocol provides, can be overcome by using anycast technology. Cons: 1. Accepting a number of IPv4/24 and IPv6/32 allocations for critical network infrastructures does not align with the traditional address conservation efforts. With anycasting it is very likely that only a few addresses from the entire assignment would be used. 2. RIPE document 233 dated from 24th May 2002 says: "Although it is undesirable to give special status to any IP (IPv4 or IPv6) address block, it was agreed by the community that the particular need defined in this document is the only justifiable exception to that general principle." Consequences of a policy change After allowing special assignments for anycast ccTLD/gTLD nameservers, there is a need to establish consensus in the RIPE region about which criteria will qualify a service to be considered Internet critical infrastructure. There might be other services beside TLD DNS falling into this category. Appendix I APNIC Policy (Following section is taken from http://www.apnic.net/docs/policy/add-manage-policy.html - 11.3) 11.3 Critical infrastructure The following critical infrastructure networks, if operating in the Asia Pacific region, are eligible to receive a portable assignment: * root domain name system (DNS) server; * global top level domain (gTLD) nameservers; * country code TLD (ccTLDs) nameservers; * IANA; * Regional Internet Registry (RIRs); and * National Internet Registry (NIRs). Assignments to critical infrastructure are available only to the actual operators of the network infrastructure performing such functions. Registrar organisations which do not actually host the network housing the registry infrastructure, will not be eligible for an assignment under this policy. The minimum assignment made under these terms is /24. Appendix II ARIN Policy (Following section taken from http://www.arin.net/policy/ipv4.html#microalloc) Micro-allocations (Policy 2001-3) Note: This policy makes obsolete the former micro-allocation policy. ARIN will make micro-allocations to critical infrastructure providers of the Internet, including public exchange points, core DNS service providers (e.g. ICANN-sanctioned root, gTLD, and ccTLD operators) as well as the RIRs and IANA. These allocations will be no longer than a /24 using IPv4 or a /48 using IPv6. Multiple allocations may be granted in certain situations. Exchange point allocations MUST be allocated from specific blocks reserved only for this purpose. All other micro-allocations WILL be allocated out of other blocks reserved for micro-allocation purposes. ARIN will make a list of these blocks publicly available. Appendix III LACNIC (Following section is taken from http://lacnic.net/policy-en.pdf) 3.3.3 Micro Allocations Micro allocation is the name given to those allocations that imply blocks smaller than /20 but always larger than or equal to /24. LACNIC can grant this type of allocation in case of projects and infrastructure for networks that are key or critical for the region, such as IXPs (Internet Exchange Points), NAPs (Network Access Points), RIRs, ccTLDs, among others. In the case of IXPs or NAPs, in order to be able to apply for this type of allocation, organizations shall meet the following requirements: 1. Duly document the following aspects: 1. 1Prove by means of their bylaws their capacity of IXP or NAP. The organization shall have at least three members and an open policy in relation to the association of new members. 1. 2Submit a company structure organizational diagram. 1. 3Document the numbering plan to be implemented. 2. Provide a usage plan for the following three and six months. The rest of the applications shall be studied based on the analysis of the documentation justifying the critical and/or key aspects of the project. Organizations receiving micro allocations are not authorized to suballocate these addresses. -- Andreas Baess DENIC eG Wiesenhüttenplatz 26 D-60329 Frankfurt

14 31

Re: Antwort: Re: [address-policy-wg] Re: RIPE Access Policy Change Request to allow allocations to critical infrastructure
by Michael.Dillon＠radianz.com 12 Jan '04

12 Jan '04

> >From my observation on this discussion there seem to be no other parties > >beside TLD operators that are currently so much interested in setting up > >anycast services. At least, nobody said so on this list. >Some DNSBL operators are definitely interested. DNS Black Lists are part of the crtitical email infrastructure. Someday a bogon routeserver service like this one: http://www.cymru.com/BGP/bogon-rs.html might want to use anycast. It is part of the critical routing infrastructure. It would be good for the policy to be based on the principle of supporting fault tolerance for critical infrastructure and then it can have a checklist of indicators like TLD operator, anycast implementation, freely available service and so on. It is a good idea to have a checklist that makes the policy easy to implement by the hostmasters, but it is also a good idea for the policy to have a clear foundation statement to cover anything that was not considered in the checklist. --Michael Dillon

2 1