IPv6 PI resource question!
Hi, please explain me the following case: There is a small company /ISP/ that wants PI IPs to be independent of upstream providers. The company would not make sub-allocation and will only provide its customers with addresses for Internet access, but these IPs will be the company's infrastructural addresses. The company will use DHCP pool to distribute the addresses to its customers, these will be its own infrastructure addresses and not to the customers /they may receive every time different addresses/. Can that company receive PI IPv6 considering the policy? Thanks, Yasen Simeonov -- Yasen Simeonov Network Management Team Neterra Ltd. Sofia, Bulgaria Phone: +359 2 974 33 11 Fax: +359 2 975 34 36 Mobile: +359 887 477 540 http://www.neterra.net
Hello Yasen,
There is a small company /ISP/ that wants PI IPs to be independent of upstream providers. The company would not make sub-allocation and will only provide its customers with addresses for Internet access, but these IPs will be the company's infrastructural addresses. The company will use DHCP pool to distribute the addresses to its customers, these will be its own infrastructure addresses and not to the customers /they may receive every time different addresses/.
Can that company receive PI IPv6 considering the policy?
With IPv6 you don't give every user one IP address (which would be your infrastructure), but you usually assign them a block of addresses. For making assignments to end-users you need a PA block. And: there is no 'your infrastructure' rule for IPv6. That is only defined for IPv4. This difference has been discussed in the past, and the conclusion was that this difference is intentional. Does anyone feel that this should be re-evaluated? In short: if you provide IPv6 access services to customers you will need to become an LIR and get an IPv6-PA block. I hope this clarifies things for you, Sander
Thanks for the replay. I think this should be reevaluated! On 14/02/2011 12:43, Sander Steffann wrote:
With IPv6 you don't give every user one IP address (which would be your infrastructure), but you usually assign them a block of addresses. For making assignments to end-users you need a PA block. And: there is no 'your infrastructure' rule for IPv6. That is only defined for IPv4. Is that mean that the ISPs should make an entry in the RIPE's database for each household to which gives access to the Internet?
Here is reveal the danger we as LIR can not give PI IPv6 to this ISP, but some of our competitors /another LIR/ to conceal the fact that they will be given to end customers / households / and the ISP will receive this resource. How would you advise a small ISP in a small rural area which has no financial ability to pay the fee for becoming LIR, to be independent from the upstream provider ? What would be the reason a company that deals with Internet delivery can not get a PI IPv6 resources, but a company which is engaged in other activity can get it. Please share your opinion. -- Yasen Simeonov Network Management Team Neterra Ltd. Sofia, Bulgaria Phone: +359 2 974 33 11 Fax: +359 2 975 34 36 Mobile: +359 887 477 540 http://www.neterra.net
Hello, I also thinks this policy should be reevaluated. We are experiencing almost the same issue, but more related to the "your infrastructure" part. One of our customers is a hosting company, and their application got rejected because they wanted to use the addresses for their shared hosting service. This is not how it should be, as a shared hosting server has 1 IP address shared among all of the customers. Why would each customer need it's own allocation? -- Best regards, Vegar Løvås Rent a Rack AS On 14.02.2011 13:59, Yasen Simeonov(Neterra NMT) wrote:
Thanks for the replay. I think this should be reevaluated!
On 14/02/2011 12:43, Sander Steffann wrote:
With IPv6 you don't give every user one IP address (which would be your infrastructure), but you usually assign them a block of addresses. For making assignments to end-users you need a PA block. And: there is no 'your infrastructure' rule for IPv6. That is only defined for IPv4. Is that mean that the ISPs should make an entry in the RIPE's database for each household to which gives access to the Internet?
Here is reveal the danger we as LIR can not give PI IPv6 to this ISP, but some of our competitors /another LIR/ to conceal the fact that they will be given to end customers / households / and the ISP will receive this resource.
How would you advise a small ISP in a small rural area which has no financial ability to pay the fee for becoming LIR, to be independent from the upstream provider ?
What would be the reason a company that deals with Internet delivery can not get a PI IPv6 resources, but a company which is engaged in other activity can get it.
Please share your opinion.
We are facing a different issue but would also like a reevaluation of the policy. We have a fair amount of customers that have IPv4 PI space for valid reasons. The IPv6 PI policy calls for demonstrated multihoming - which if we read it correctly means that if these customers want to migrate from IPv4 to IPv6 all of a sudden they will require an ASN as well as a second transit provider. We would like to see a provision in the policy that allows IPv4 to IPv6 migrations with regards to PI space - say if you qualified for IPv4 PI space - irrespective of what the rules are for IPv6 PI space - you will always qualify for IPv6 PI space. This will allow stricter rules for new applications while also easing the migration from v4 to v6. Jasper -----Original Message----- From: address-policy-wg-admin@ripe.net [mailto:address-policy-wg-admin@ripe.net] On Behalf Of Vegar Løvås Sent: Monday, February 14, 2011 2:08 PM To: Yasen Simeonov(Neterra NMT) Cc: address-policy-wg@ripe.net Subject: Re: [address-policy-wg] IPv6 PI resource question! Hello, I also thinks this policy should be reevaluated. We are experiencing almost the same issue, but more related to the "your infrastructure" part. One of our customers is a hosting company, and their application got rejected because they wanted to use the addresses for their shared hosting service. This is not how it should be, as a shared hosting server has 1 IP address shared among all of the customers. Why would each customer need it's own allocation? -- Best regards, Vegar Løvås Rent a Rack AS On 14.02.2011 13:59, Yasen Simeonov(Neterra NMT) wrote:
Thanks for the replay. I think this should be reevaluated!
On 14/02/2011 12:43, Sander Steffann wrote:
With IPv6 you don't give every user one IP address (which would be your infrastructure), but you usually assign them a block of addresses. For making assignments to end-users you need a PA block. And: there is no 'your infrastructure' rule for IPv6. That is only defined for IPv4. Is that mean that the ISPs should make an entry in the RIPE's database for each household to which gives access to the Internet?
Here is reveal the danger we as LIR can not give PI IPv6 to this ISP, but some of our competitors /another LIR/ to conceal the fact that they will be given to end customers / households / and the ISP will receive this resource.
How would you advise a small ISP in a small rural area which has no financial ability to pay the fee for becoming LIR, to be independent from the upstream provider ?
What would be the reason a company that deals with Internet delivery can not get a PI IPv6 resources, but a company which is engaged in other activity can get it.
Please share your opinion.
Op dit e-mailbericht is een disclaimer van toepassing, welke te vinden is op http://www.espritxb.nl/disclaimer
Hi Yasen,
Thanks for the replay. I think this should be reevaluated!
Can you give your reasons to reevaluate this? The way it currently works is that if you delegate addresses to your customers you must be an LIR. Why and how should that be changed in your opinion?
With IPv6 you don't give every user one IP address (which would be your infrastructure), but you usually assign them a block of addresses. For making assignments to end-users you need a PA block. And: there is no 'your infrastructure' rule for IPv6. That is only defined for IPv4. Is that mean that the ISPs should make an entry in the RIPE's database for each household to which gives access to the Internet?
No, that is not necessary. A policy proposal that describes what you can do has just been accepted (http://www.ripe.net/ripe/policies/proposals/2010-06).
How would you advise a small ISP in a small rural area which has no financial ability to pay the fee for becoming LIR, to be independent from the upstream provider ?
The problem here is that this financial barrier can not be resolved here. The RIPE NCC membership fee is set by the RIPE NCC General Meeting, not here.
What would be the reason a company that deals with Internet delivery can not get a PI IPv6 resources, but a company which is engaged in other activity can get it.
An ISP can still get PI addresses. You just can't delegate addresses from PI space to customers. You need PA space for that. - Sander
And SUB-ALLOCATED PA space can be independently routed, if you really don't want to become a LIR; but of course it's dependent on maintaining a relationship with a friendly LIR... Kind regards Jamie Stallwood -- Jamie Stallwood Security Specialist Imerja Limited Tel: 07795 840385 jamie.stallwood@imerja.com -----Original Message----- From: address-policy-wg-admin@ripe.net on behalf of Sander Steffann Sent: Mon 14/02/2011 14:44 To: Yasen Simeonov(Neterra NMT) Cc: address-policy-wg@ripe.net Subject: Re: [address-policy-wg] IPv6 PI resource question! Hi Yasen,
Thanks for the replay. I think this should be reevaluated!
Can you give your reasons to reevaluate this? The way it currently works is that if you delegate addresses to your customers you must be an LIR. Why and how should that be changed in your opinion?
With IPv6 you don't give every user one IP address (which would be your infrastructure), but you usually assign them a block of addresses. For making assignments to end-users you need a PA block. And: there is no 'your infrastructure' rule for IPv6. That is only defined for IPv4. Is that mean that the ISPs should make an entry in the RIPE's database for each household to which gives access to the Internet?
No, that is not necessary. A policy proposal that describes what you can do has just been accepted (http://www.ripe.net/ripe/policies/proposals/2010-06).
How would you advise a small ISP in a small rural area which has no financial ability to pay the fee for becoming LIR, to be independent from the upstream provider ?
The problem here is that this financial barrier can not be resolved here. The RIPE NCC membership fee is set by the RIPE NCC General Meeting, not here.
What would be the reason a company that deals with Internet delivery can not get a PI IPv6 resources, but a company which is engaged in other activity can get it.
An ISP can still get PI addresses. You just can't delegate addresses from PI space to customers. You need PA space for that. - Sander -- Imerja Limited Tel: 0870 8611488 | Fax: 0870 8611489 | 24x7 ISOC: 0870 8611490 | Web: www.imerja.com Registered Office: Paragon House, Paragon Business Park, Chorley New Road, Horwich, Bolton BL6 6HG Registered in England and Wales No. 5180119 VAT Registered No. 845 0647 22 ISO Registered Firm No. GB2001527 This email is confidential and intended solely for the person or organisation to which it is addressed. It may contain privileged and confidential information. If you are not the intended recipient(s) you should not use, copy, distribute or take any action or reliance on it, since to do so is strictly prohibited and may be unlawful. If you have received this transmission in error please notify the sender immediately by email reply and delete it from your system. E-mail messages are not secure and attachments could contain software viruses which may damage your system. Whilst every reasonable precaution has been taken to minimise this risk, Imerja Limited cannot accept any liability for any damage sustained as a result of these factors. You are advised to carry out your own virus checks before opening any attachment. Any views or opinions expressed in this e-mail are solely those of the author and do not represent those of Imerja Limited unless otherwise stated.
Hi Sander, Not exactly the same issue, but last week I was consulting a customer that requires PI, because the type of services they offer and they have hundreds of sites in Europe, and not all them are multihomed. Somehow, one choice may be to become an LIR, but because not all the sites are using the same ISP, they will need to announce /48 from the /32, not a good way. So the alternative is to request a PI for each site, and today, they can only get this for those multihomed. The other point, is that in some situations, it will be good to aggregate all those PI (or some of them), which will depend on the RIPE NCC staff to be able to provide contiguous /48s. So ... should we propose to remove the multihoming barrier ? What is the feeling of the list members ? Regards, Jordi -----Mensaje original----- De: Sander Steffann <sander@steffann.nl> Responder a: <sander@steffann.nl> Fecha: Mon, 14 Feb 2011 15:44:04 +0100 Para: "Yasen Simeonov (Neterra NMT)" <ysimeonov@neterra.net> CC: <address-policy-wg@ripe.net> Asunto: Re: [address-policy-wg] IPv6 PI resource question!
Hi Yasen,
Thanks for the replay. I think this should be reevaluated!
Can you give your reasons to reevaluate this? The way it currently works is that if you delegate addresses to your customers you must be an LIR. Why and how should that be changed in your opinion?
With IPv6 you don't give every user one IP address (which would be your infrastructure), but you usually assign them a block of addresses. For making assignments to end-users you need a PA block. And: there is no 'your infrastructure' rule for IPv6. That is only defined for IPv4. Is that mean that the ISPs should make an entry in the RIPE's database for each household to which gives access to the Internet?
No, that is not necessary. A policy proposal that describes what you can do has just been accepted (http://www.ripe.net/ripe/policies/proposals/2010-06).
How would you advise a small ISP in a small rural area which has no financial ability to pay the fee for becoming LIR, to be independent from the upstream provider ?
The problem here is that this financial barrier can not be resolved here. The RIPE NCC membership fee is set by the RIPE NCC General Meeting, not here.
What would be the reason a company that deals with Internet delivery can not get a PI IPv6 resources, but a company which is engaged in other activity can get it.
An ISP can still get PI addresses. You just can't delegate addresses from PI space to customers. You need PA space for that.
- Sander
********************************************** IPv4 is over Are you ready for the new Internet ? http://www.facebook.com/IPv6.now This electronic message contains information which may be privileged or confidential. The information is intended to be for the use of the individual(s) named above. If you are not the intended recipient be aware that any disclosure, copying, distribution or use of the contents of this information, including attached files, is prohibited.
Hi,
So ... should we propose to remove the multihoming barrier ?
What is the feeling of the list members ?
The last time we discussed this the feeling seemed to be that such a limitation was necessary to prevent an explosion of the IPv6 routing table. On the other hand we want people to start using IPv6. I am really curious what the rest of the list thinks about this. - Sander
Hello, Monday, February 14, 2011, 4:24:05 PM, you wrote:
So ... should we propose to remove the multihoming barrier ? What is the feeling of the list members ? SS> The last time we discussed this the feeling seemed to be that such a SS> limitation was necessary to prevent an explosion of the IPv6 routing SS> table. On the other hand we want people to start using IPv6. I am really SS> curious what the rest of the list thinks about this.
I think that current IPv6 assignment policy delays IPv6 implementation. ISPs can assign addresses using point-to-point protocols or even give /64 from the PI /48 assignment or use whole /48 for own infrastructure - you'll never know this exactly. As for me, an additional barrier for migration to IPv6 should be removed. -- Sergey
From: address-policy-wg-admin@ripe.net [mailto:address-policy-wg-admin@ripe.net] On Behalf Of Sander Steffann Sent: Monday, February 14, 2011 4:24 PM Hi,
So ... should we propose to remove the multihoming barrier ?
What is the feeling of the list members ?
The last time we discussed this the feeling seemed to be that such a limitation was necessary to prevent an explosion of the IPv6 routing table. On the other hand we want people to start using IPv6. I am really curious what the rest of the list thinks about this.
- Sander
Hello Sander, I would prefer to remove some limitations. The current option for someone that has IPv4 PI space to get IPv6 PI space isn't easy enough if you ask me. Making the transition as easy as possible (while keeping PA or PI space) should be possible I think. Another option (but that isn't something for this list I guess) is to have some LIR extra light account with just 1 IPv6 range and for more you need to become a normal LIR, an extra limitation could be that it would be required that you've some IPv4 PI space. Regards, Mark
Hi Mark,
Another option (but that isn't something for this list I guess) is to have some LIR extra light account with just 1 IPv6 range and for more you need to become a normal LIR, an extra limitation could be that it would be required that you've some IPv4 PI space.
This might be a valid option, but indeed not as something for this list but as something for the RIPE NCC GM. I do get the impression here that the current policy (Get a /32 or larger PA for providing access service to customers, or get a /48 PI as a multi homed end-user) is not 'wrong', but that people have problems with the cost of running an LIR. If this is the case I am not sure if we should start changing the policy... - Sander
Another option (but that isn't something for this list I guess) is to have some LIR extra light account with just 1 IPv6 range and for more you need to become a normal LIR, an extra
From: address-policy-wg-admin@ripe.net [mailto:address-policy-wg-admin@ripe.net] On Behalf Of Sander Steffann limitation
could be that it would be required that you've some IPv4 PI space.
This might be a valid option, but indeed not as something for this list but as something for the RIPE NCC GM.
I do get the impression here that the current policy (Get a /32 or larger PA for providing access service to customers, or get a /48 PI as a multi homed end-user) is not 'wrong', but that people have problems with the cost of running an LIR. If this is the case I am not sure if we should start changing the policy...
Hello Sander, However as this isn't an option for this list (and I don't know if this idea is something that people could agree on at the RIPE NCC GM) I think this list should look for other options to "solve" this practical problem. That could be changing a policy to make it easier to get IPv6 PI if you already own IPv4 PI. I'm happy to write down a proposal for the changes. However I'll vote against it when it isn't accepted and the RIPE NCC GM did decide before that moment to create some option for this problem that is cheaper (but possible very limited, like only 1 IPv6 /48 range and for more you need a LIR account like they currently exist). Regards, Mark
Sander, On Feb 14, 2011, at 2:26 PM, Sander Steffann wrote: […]
I do get the impression here that the current policy (Get a /32 or larger PA for providing access service to customers, or get a /48 PI as a multi homed end-user) is not 'wrong', but that people have problems with the cost of running an LIR. If this is the case I am not sure if we should start changing the policy…
I think you have highlighted a major element of the current system. If you are multi-homed you can either get an IPv6 PI block for whatever a friendly LIR will charge you but possibly less than €100 per year. If you are prepared to pay whatever it costs to sign-up you can get a far larger block and do not have to multi-home. If some ISPs are going to try to get by on a /48 of PI to avoid the higher fees for becoming an LIR, their subscribers are less likely to be able to get decent sized assignments for their own networks. That means their ability to get the full benefit of the innovation we hope will happen around IPv6 will be diminished. Perhaps it would be fairer to take one of two options. Either require an LIR to be multi-homed to qualify for a /32 allocation, using the same justification as is used for the current IPv6 PI policy, or remove the artificial distinction between PI and PA for IPv6. That is, make anyone with a block of addresses received directly from the RIPE NCC a member. Doing the former would probably slow down IPv6 adoption. Doing the latter might well speed it up and it is even possible that the additional of an extra few thousand members would help to lower the annual fee to something that is more accessible to everyone. While that second issue is not strictly on topic for this WG, the fact is that the current billing scheme is built around the policy framework. Changing the policy framework will have knock-on consequences for the billing scheme and it would be irresponsible not to consider the likely impact of a major change to the policy on the billing scheme. Regards, Leo Vegoda
Hi, On Mon, Feb 14, 2011 at 03:50:39PM +0100, JORDI PALET MARTINEZ wrote:
requires PI, because the type of services they offer and they have
Could you elaborate on this? What type of *service* needs PI? In the discussions leading to the current PI policy, the consensus was "for BGP-style multihoming, an entry in the global routing table is inevitable, so PI won't make this better or worse" - so people agreed that this specific usage case warrants PI, and for everything else, they (well, *you* - this community!) wanted to see aggregateable addresses used... Gert Doering -- APWG chair -- did you enable IPv6 on something today...? SpaceNet AG Vorstand: Sebastian v. Bomhard Joseph-Dollinger-Bogen 14 Aufsichtsratsvors.: A. Grundner-Culemann D-80807 Muenchen HRB: 136055 (AG Muenchen) Tel: +49 (89) 32356-444 USt-IdNr.: DE813185279
I know ... very well :-) I will let the customer, which is in the list to decide if they want to provide details, I can't disclose them. Regards, Jordi -----Mensaje original----- De: Gert Doering <gert@space.net> Responder a: <gert@space.net> Fecha: Mon, 14 Feb 2011 16:51:24 +0100 Para: Jordi Palet Martinez <jordi.palet@consulintel.es> CC: <address-policy-wg@ripe.net> Asunto: Re: [address-policy-wg] IPv6 PI resource question!
Hi,
On Mon, Feb 14, 2011 at 03:50:39PM +0100, JORDI PALET MARTINEZ wrote:
requires PI, because the type of services they offer and they have
Could you elaborate on this? What type of *service* needs PI?
In the discussions leading to the current PI policy, the consensus was "for BGP-style multihoming, an entry in the global routing table is inevitable, so PI won't make this better or worse" - so people agreed that this specific usage case warrants PI, and for everything else, they (well, *you* - this community!) wanted to see aggregateable addresses used...
Gert Doering -- APWG chair -- did you enable IPv6 on something today...?
SpaceNet AG Vorstand: Sebastian v. Bomhard Joseph-Dollinger-Bogen 14 Aufsichtsratsvors.: A. Grundner-Culemann D-80807 Muenchen HRB: 136055 (AG Muenchen) Tel: +49 (89) 32356-444 USt-IdNr.: DE813185279
********************************************** IPv4 is over Are you ready for the new Internet ? http://www.facebook.com/IPv6.now This electronic message contains information which may be privileged or confidential. The information is intended to be for the use of the individual(s) named above. If you are not the intended recipient be aware that any disclosure, copying, distribution or use of the contents of this information, including attached files, is prohibited.
On Mon, Feb 14, 2011 at 03:50:39PM +0100, JORDI PALET MARTINEZ wrote:
So ... should we propose to remove the multihoming barrier ?
What is the feeling of the list members ?
+1 On one side, RIPE advocates "we don't care about routing" (IPv4 PI prefix size, see stalled proposal 2006-05 to fix that), on the other side RIPE requests routing policy (multihoming for IPv6 PI). This is arguing with split tongue. You can't have it both ways. IP address space is not only for use on "the Internet". It's also for private networks or hybrid networks (extranets etc.). Requiring "Internet" multihoming is an artificial limitation not really justified when claiming the role of sole owner of IP addresses in a region. So yes, get rid of the multihoming requirement. Best regards, Daniel -- CLUE-RIPE -- Jabber: dr@cluenet.de -- dr@IRCnet -- PGP: 0xA85C8AA0
Daniel, On Tue, 2011-02-15 at 08:48 +0100, Daniel Roesen wrote:
On Mon, Feb 14, 2011 at 03:50:39PM +0100, JORDI PALET MARTINEZ wrote:
So ... should we propose to remove the multihoming barrier ?
What is the feeling of the list members ?
+1
On one side, RIPE advocates "we don't care about routing" (IPv4 PI prefix size, see stalled proposal 2006-05 to fix that), on the other side RIPE requests routing policy (multihoming for IPv6 PI). This is arguing with split tongue. You can't have it both ways.
IP address space is not only for use on "the Internet". It's also for private networks or hybrid networks (extranets etc.). Requiring "Internet" multihoming is an artificial limitation not really justified when claiming the role of sole owner of IP addresses in a region.
So yes, get rid of the multihoming requirement.
Speaking only from the IPv6 side, there are several options if you only need IPv6 space for internal reasons: * ULA addresses, with random addresses * 6to4 addresses, using one or more of your IPv4 addresses Perhaps someday we'll see ULA with a central registry too (that is in itself a long-going, bikeshed discussion that makes me very sleepy). http://en.wikipedia.org/wiki/Unique_local_address -- Shane
On Tue, Feb 15, 2011 at 10:14:41AM +0100, Shane Kerr wrote:
* ULA addresses, with random addresses
Doesn't work for hybrids unless NAT is used for the (potentially single-homed) Internet connection. Didn't we want to avoid NAT?
* 6to4 addresses, using one or more of your IPv4 addresses
"What IPv4 addresses?" :-) Best regards, Daniel -- CLUE-RIPE -- Jabber: dr@cluenet.de -- dr@IRCnet -- PGP: 0xA85C8AA0
Daniel, On Tue, 2011-02-15 at 10:47 +0100, Daniel Roesen wrote:
On Tue, Feb 15, 2011 at 10:14:41AM +0100, Shane Kerr wrote:
* ULA addresses, with random addresses
Doesn't work for hybrids unless NAT is used for the (potentially single-homed) Internet connection. Didn't we want to avoid NAT?
I'm not sure what you mean by "hybrid". Can you explain or give a reference to what you mean? If you mean a site that needs both internal-only and externally-visible addresses, then with IPv6 I think the simple answer is to use ULA for the internal addresses, and PA space for the external addresses. All IPv6 devices can handle multiple addresses.
* 6to4 addresses, using one or more of your IPv4 addresses
"What IPv4 addresses?" :-)
Funny, but you only need a /32 for most purposes here, since each IPv4 /32 becomes a /48 under 2002::/16. It's not for everyone, but if you have even a single IPv4 address you can use this for your internal network numbering. Unless you need more than a /48, in which case are you sure you don't want to multihome? :-P -- Shane
Hi, On Tue, Feb 15, 2011 at 01:01:15PM +0100, Shane Kerr wrote:
I'm not sure what you mean by "hybrid". Can you explain or give a reference to what you mean?
Networks connected to both Internet and in Extranet fashion privately with other networks.
If you mean a site that needs both internal-only and externally-visible addresses, then with IPv6 I think the simple answer is to use ULA for the internal addresses, and PA space for the external addresses.
So also need to run split DNS for services accessible via Internet and via private Extranets. That's signficant operational burden and fails for anything which needs literal stable addresses to connect to (like e.g. sensors).
All IPv6 devices can handle multiple addresses.
Just like every IPv6 stack implements IPSEC, right? We're allowing PIv6 for "multihomed" (whatever that means really) sites. Those could "just simply" use PA space from any ISP they connect to. Why do we make Internet multihoming special compared to Internet-plus-others? With the "multiple IPs per device" argument there cannot be PIv6. I thought we've left that behind by now.
* 6to4 addresses, using one or more of your IPv4 addresses
"What IPv4 addresses?" :-)
Funny, but you only need a /32 for most purposes here, since each IPv4 /32 becomes a /48 under 2002::/16. It's not for everyone, but if you have even a single IPv4 address you can use this for your internal network numbering. Unless you need more than a /48, in which case are you sure you don't want to multihome? :-P
6to4 is special address space and considered "lucky if it works". You certainly didn't want to really propose using a 2002::/16 6to4 scheme derrived /48 as "stable addressing" for internal use?!? Did you consider that folks WILL use 6to4 anycast to reach such addresses? Cannot be meant serious?! Best regards, Daniel -- CLUE-RIPE -- Jabber: dr@cluenet.de -- dr@IRCnet -- PGP: 0xA85C8AA0
Daniel, On Tue, 2011-02-15 at 20:41 +0100, Daniel Roesen wrote:
Hi,
On Tue, Feb 15, 2011 at 01:01:15PM +0100, Shane Kerr wrote:
I'm not sure what you mean by "hybrid". Can you explain or give a reference to what you mean?
Networks connected to both Internet and in Extranet fashion privately with other networks.
Right. So peering with a vendor to gain access to certain services or databases while also connecting to the Internet, for example?
If you mean a site that needs both internal-only and externally-visible addresses, then with IPv6 I think the simple answer is to use ULA for the internal addresses, and PA space for the external addresses.
So also need to run split DNS for services accessible via Internet and via private Extranets. That's signficant operational burden and fails for anything which needs literal stable addresses to connect to (like e.g. sensors).
Why do you need a split DNS? Just publish your local information on the Internet. If your concern is with hiding information about internal networks for whatever reason (security, trade secrets, and so on), then you'll need some sort of split DNS anyway.
All IPv6 devices can handle multiple addresses.
Just like every IPv6 stack implements IPSEC, right?
It's hardly the same. I have never seen an IPv6 deployment that actually used IPSEC. OTOH, every IPv6-enabled device that I have seen supports multiple addresses. Indeed, I cannot imagine how a device would work without this, since you typically need at least one link-local and one global address.
We're allowing PIv6 for "multihomed" (whatever that means really) sites. Those could "just simply" use PA space from any ISP they connect to. Why do we make Internet multihoming special compared to Internet-plus-others? With the "multiple IPs per device" argument there cannot be PIv6. I thought we've left that behind by now.
I'll address this in a separate e-mail. (And I won't address the 6to4 suggestion, which you realize isn't entirely serious.) ;) -- Shane
On Wed, Feb 16, 2011 at 02:15:40PM +0100, Shane Kerr wrote:
Right. So peering with a vendor to gain access to certain services or databases while also connecting to the Internet, for example?
Yep.
Why do you need a split DNS? Just publish your local information on the Internet.
ULA are not supposed to be Internet routable, so you would have to present globally routable PA space-de-jour AAAA to DNS requestors from "the Internet", and present stable ULA AAAA to others.
If your concern is with hiding information about internal networks for whatever reason (security, trade secrets, and so on), then you'll need some sort of split DNS anyway.
No, that's not my (personal) concern in this debate for now.
(And I won't address the 6to4 suggestion, which you realize isn't entirely serious.) ;)
*phew* :-) Best regards, Daniel -- CLUE-RIPE -- Jabber: dr@cluenet.de -- dr@IRCnet -- PGP: 0xA85C8AA0
Daniel, On Tue, 2011-02-15 at 20:41 +0100, Daniel Roesen wrote:
We're allowing PIv6 for "multihomed" (whatever that means really) sites. Those could "just simply" use PA space from any ISP they connect to. Why do we make Internet multihoming special compared to Internet-plus-others? With the "multiple IPs per device" argument there cannot be PIv6. I thought we've left that behind by now.
So I was wondering "why do we allow PI for IPv6 for multihoming?", and realized "that's how we do things in IPv4". AIUI people don't consider it reasonable to get one ISP to carry routes from another on behalf of their customers. Fair enough. ---- In this IPv6 PI discussion people say it is too expensive to be an LIR. This strikes me as weird... even cheap network gear costs way more than the LIR fee, and certainly the personnel costs are many times that, even in countries where technical folks are poorly paid. But anyway.... On the other side we hear the concerns about unchecked routing table growth. This has been addressed many times; it is usually presented as a basic "tragedy of the commons", where the costs of the increased size are borne by everyone but the benefits go to each network which advertises any given route. This position is directly refuted by Geoff Huston who claims that memory is cheap, what we really need to care about is update frequency, which is not actually closely related to the total number of routes today but is more related to a number of problematic AS (see chart at end): http://bgpupdates.potaroo.net/instability/bgpupd.html Further, in IPv6 we're much less likely to have multiple routes per organization (although of course as companies merge and diversify this won't be 100% true). Plus we have the advantage that as IPv4 gets more scarce, it is likely that the number of addresses per advertisement will get smaller, so the IPv6 will be able to use whatever technological means is used to keep IPv4 creaking along. So... it may be there is no routing reason to hold back on PI blocks. ---- Is there another reason to want to limit PI assignments? There may be. Certainly the folks over in abuse-land think we should have super strict controls over all addresses, and revoke them at the first hint of naughtiness. Or there may be administrative reasons - an entirely different kind of infrastructure is needed to manage hundreds of thousands of low-fee (well, NO fee now) PI-holders than thousands of high-fee LIRs. I don't know. So... do you think we should simply remove all restrictions for IPv6 PI and issue space if someone wants it, period? If not, what possible restriction would there be? ---- Finally, I think what bothers me about PI in general though is that once the initial assignment is made... that's it. At least with RIPE 452 we have *some* contractual relationship with the PI holder, but that's about it. I guess the "LIR middleman" model comes from the mists of time, long ago in history. It certainly reduces the burden on the RIPE NCC, but it never really struck me as sensible. After all, isn't the whole point of PI space that you don't want to have to depend on an LIR? -- Shane
Chipping in 1.5 cents, On Wed, Feb 16, 2011 at 8:55 AM, Shane Kerr <shane@time-travellers.org> wrote:
Daniel,
On Tue, 2011-02-15 at 20:41 +0100, Daniel Roesen wrote:
We're allowing PIv6 for "multihomed" (whatever that means really) sites. Those could "just simply" use PA space from any ISP they connect to. Why do we make Internet multihoming special compared to Internet-plus-others? With the "multiple IPs per device" argument there cannot be PIv6. I thought we've left that behind by now.
So I was wondering "why do we allow PI for IPv6 for multihoming?", and realized "that's how we do things in IPv4". AIUI people don't consider it reasonable to get one ISP to carry routes from another on behalf of their customers. Fair enough.
Routing slots notwithstanding, the hurdles the RIPE community puts up for PIv6 is *directly* contra-productive to roll-out of IPv6 in general, and the "end-to-end"-roll-out specifically. In the absence of a solution to the renumbering problem that your random IT-staffed medium sized company can actually understand and use, NAT:ing is a lot simpler, and in many cases fits the v4 model anyway. Forgetting for a moment that having a chunk of your LIRs space is "PA" and not PI, this whole idea that you should route a more-specific of a LIR's allocation is also contra-productive to the ease of understanding and implementing filtering in v6-land (which is key to the future of the 2000::/3 trial, if you will). It makes the PI holder dependent on the LIR, not only for the lease of the address block, but in the face of routing policy, also its reachability. Irregardless of the address block being PI or not, it is the same number of routing slots in an unfiltered DFZ. And I see only clear downsides to "de-aggregating" the LIRs blocks. It also make route lookups deeper. LIRs (in terms of LIRs) are short-sighted to think easening up PI is a threat to their business anyway IMO, since the potential customer base, the size of the market, would grow considerably.
In this IPv6 PI discussion people say it is too expensive to be an LIR. This strikes me as weird... even cheap network gear costs way more than the LIR fee, and certainly the personnel costs are many times that, even in countries where technical folks are poorly paid. But anyway....
I find it hard to motivate a difference between PIv4 and PIv6 in this regard.
Is there another reason to want to limit PI assignments? There may be. Certainly the folks over in abuse-land think we should have super strict controls over all addresses, and revoke them at the first hint of naughtiness. Or there may be administrative reasons - an entirely different kind of infrastructure is needed to manage hundreds of thousands of low-fee (well, NO fee now) PI-holders than thousands of high-fee LIRs. I don't know.
Do you mean there is a superlinear growth of IPRA needs at the RIR if PI scales up? Why? I don't get why that would be the case at all. Isn't it just more of the same? The monetary cost for an application should cover the true costs of the RIR in handling it of course. (The fee for a end-user direct contractual relationship with RIPE is comparative to LIR status today anyway)
So... do you think we should simply remove all restrictions for IPv6 PI and issue space if someone wants it, period? If not, what possible restriction would there be?
Clue-filter seems appropriate and sufficient, ie, no change from v4, except the need to be creative is inherently smaller with PIv6 than PIv4 which is a good thing.
I guess the "LIR middleman" model comes from the mists of time, long ago in history. It certainly reduces the burden on the RIPE NCC, but it never really struck me as sensible. After all, isn't the whole point of PI space that you don't want to have to depend on an LIR?
Indeed. You go to the IP shop and leave your name and number, and a pay small fee and then you walk out with your leased space. Then you go to the Internet field and start playing with it. The only function of a LIR in this sense is to increase the number of shops where you can get the PI, making it more available, so you won't have to travel to the head quarters, if it is far away. :) There is little reason, except for consulting services, for you to be in contract with your random local PI shop for this, since it is only a service mediator for the head quarters. /Martin IPv6 to the people!
On 16/02/2011 16:28, Martin Millnert wrote:
Routing slots notwithstanding, the hurdles the RIPE community puts up for PIv6 is *directly* contra-productive to roll-out of IPv6 in general, and the "end-to-end"-roll-out specifically.
possibly. But these hurdles are insignificant compared to the other hurdles you're going to run into for an ipv6 deployment, including: - poor vendor support, still - training and support costs - poor existing ipv6 connectivity - low cost:return ratio Regarding routing slots, here's some hand-waving / back-of-a-napkin / finger in the air analysis: ipv6 generally takes up either 2 or 4 times the amount of lookup engine space that ipv4 does (implementation / hardware dependent). Unique ASNs on the internet are currently at about ~37000, and increasing at a rate of ~2500 a year. So if we assume that every ASN gets at least one IPv6 prefix in the next two years, and there's going to be an average of 1.4 prefixes per ASN (which seems to be what it's at right now), in two years time, we end up with the following number of TCAM slots (assuming 4 x ipv4 = 1 x ipv6): (37000 + 2500*2) * 1.4 * 4 = 235000 ipv4 equivalent slots. For ipv4, we're currently at 340k and growing at 50k/annum. In two years, we might be at 440k slots, assuming that resource exhaustion doesn't cause massive de-aggregation. This would indicate maybe around 675k ipv4-equivalent lookup engine slots. Then you add in your mpls, IGP and multicast slots. So, within 2 years on a small network, 1m route lookup entries may still work, but almost certainly will not work on a large network. If there is massive ipv6 deaggregation, it will cause 4x the damage of the equivalent ipv4 deaggregation. This is bad, and it will cost lots of people lots of money. Nick -- [note: while no animals were harmed during the production of these numbers, they are basically pulled out of a hat with no real consideration of whether they might correlate to reality in any way. Please don't bother trying to argue with me about them. I _will_ deny everything / plead insanity / blame it on the cat taking over my keyboard]
On Wed, Feb 16, 2011 at 12:33 PM, Nick Hilliard <nick@inex.ie> wrote:
Regarding routing slots, here's some hand-waving / back-of-a-napkin / finger in the air analysis: [...] If there is massive ipv6 deaggregation, it will cause 4x the damage of the equivalent ipv4 deaggregation. This is bad, and it will cost lots of people lots of money.
Nick
Yeah, and this is exactly why I believe keeping stuff simple (eg, approximately 10^3.14 times better with a PIv6 for a AS-cust who wants to announce a route than cracking away at the "PA" LIR-blocks), enables networks to filter deaggs in a much less destructive way. Which brings us into LIR/BGP territory: IMNSHO policies should / should continue to advice operators that "PA" space is provider-dependent whereas PI is PI, in terms of non-guaranteed but best-effort-expected routing goes. ;) There is a much better chance to get it right with v6 due to its size than v4, since we can be pretty specific about where PI and micro allocs come from and where /32s-or-shorter come from, and they're not overlapped. While address assignment policies traditionally does not dictate routing policies (it actually does set the lower bar in v6, plus there's the multihoming bit :) ), it is better to lay the framework for a constructive v6-land then a destructive one. Also, costs, policies and administrativia should incentivize networks to not check out a discontinuous PIv6 /48 per site if they have many. Obviously, it is beneficial that networks operate out of contiguous space rather than fragmented, since it allows routing policies to automatically drop more-specifics. Whether or not someone decides to do so is up to them, of course. The key is of course that the addressing allows it to happen. This is how I mean address assignment policies perhaps not dictate routing policies, but they certainly lays the framework for how it can operate. Cheers, Martin
Hi Shane & Daniel, On Tue, 2011-02-15 at 20:41 +0100, Daniel Roesen wrote:
We're allowing PIv6 for "multihomed" (whatever that means really) sites. Those could "just simply" use PA space from any ISP they connect to.
I see customers that don't want to become a LIR or have the intention to do multi-homing, however they would like to have the option to request IPv6 addresses that are not tied to their provider (PA space). And as a LIR, sorting out their request for PI address space is something we charge for. If they don't want to shell out a couple hundred euro's for the handling of the request via us as their LIR or the cost for a direct end-user assignment or LIR fee, they can use IP's from our PA space which they would have to give back when they decide to take their business elsewhere. The term multi-homing by using BGP in the policy, is something I'm personally as a network provider not very keen on, as every AS they would need to connect to, is a connection to another provider that is a direct competitor. Simple as that. Is it better for the routing table / routers etc, to have larger blocks and as little as small prefixes as possible ? Sure, it will scale a lot better, however as the option of obtainable PI IPv6 space is there, people could request it for their own infrastructure and use it. The limitation of PIv6 in combination with multihomed (as in multihomed with its own AS using BGP) is something I personally would rather see dropped than enforced. Some companies actually take the steps into v6 & multi-homing in steps or want to take the approach, renumber once ... and NEVER again !! And we'll see in the future if multi-homed is going to be pursued or required. ----
In this IPv6 PI discussion people say it is too expensive to be an LIR. This strikes me as weird... even cheap network gear costs way more than the LIR fee, and certainly the personnel costs are many times that, even in countries where technical folks are poorly paid. But anyway....
The cost for a LIR status are not the issue from what I see for most of the companies I speak with. Most of them just don't want to deal with the RIPE stuff (yet). They don't see themselves as an ISP or hoster and are perfectly happy with the fact they can only use PI for their own infrastructure. Next to the stated cost of router equip, most of them are very happy to deal with racks of servers and linux patches etc. but are not up to speed on routing / networking / bgp etc. They just want to be prepared in case they move and / or grow to a size where they would want to run their own network equipment because it is at some point cheaper to sort out their own traffic / network. ----
Is there another reason to want to limit PI assignments? There may be. Certainly the folks over in abuse-land think we should have super strict controls over all addresses, and revoke them at the first hint of naughtiness. Or there may be administrative reasons - an entirely different kind of infrastructure is needed to manage hundreds of thousands of low-fee (well, NO fee now) PI-holders than thousands of high-fee LIRs. I don't know.
So... do you think we should simply remove all restrictions for IPv6 PI and issue space if someone wants it, period? If not, what possible restriction would there be?
In my personal opinion, cost isn't always the topic when deciding for PI. I would even dare to say that currently PI objects are way too cheap. And I wouldn't mind to ask customers to pay a yearly fee of 250 euro up-to 400 Euro per /48 PI IPv6 if they wouldn't have the multi-homing requirement. And by making it a bit more expensive, it will also provide a barrier that this isn't free or something to have for fun. But the companies that really want it for their own reasons, they will request it anyway. ----
Finally, I think what bothers me about PI in general though is that once the initial assignment is made... that's it. At least with RIPE 452 we have *some* contractual relationship with the PI holder, but that's about it.
I guess the "LIR middleman" model comes from the mists of time, long ago in history. It certainly reduces the burden on the RIPE NCC, but it never really struck me as sensible. After all, isn't the whole point of PI space that you don't want to have to depend on an LIR?
Not completely, having a LIR dealing with your requests, db updates and sorting out the route-objects etc. could still add value to those customers that don't want to become a LIR. As said above, a lot of my PI customers have no clue about networking or RIPE policies, having a LIR to fall-back to, adds value to them and it is cheaper than becoming a direct end-user or a LIR themselves. Regards, Erik Bais
Erik, Thank you for wording our exact problems so clearly. We as ISP and sponsor are also really not waiting to see our customers get connectivity from the competition just so that they can qualify for IPv6 space. Because that is what the current policy dictates - dual homing is required for both PI as well as PA space. Jasper -----Original Message----- From: address-policy-wg-admin@ripe.net [mailto:address-policy-wg-admin@ripe.net] On Behalf Of Erik Bais Sent: Wednesday, February 16, 2011 6:09 PM To: 'Shane Kerr'; 'Daniel Roesen' Cc: address-policy-wg@ripe.net Subject: RE: [address-policy-wg] PI concept in general, was IPv6 PI resource question! Hi Shane & Daniel, On Tue, 2011-02-15 at 20:41 +0100, Daniel Roesen wrote:
We're allowing PIv6 for "multihomed" (whatever that means really) sites. Those could "just simply" use PA space from any ISP they connect to.
I see customers that don't want to become a LIR or have the intention to do multi-homing, however they would like to have the option to request IPv6 addresses that are not tied to their provider (PA space). And as a LIR, sorting out their request for PI address space is something we charge for. If they don't want to shell out a couple hundred euro's for the handling of the request via us as their LIR or the cost for a direct end-user assignment or LIR fee, they can use IP's from our PA space which they would have to give back when they decide to take their business elsewhere. The term multi-homing by using BGP in the policy, is something I'm personally as a network provider not very keen on, as every AS they would need to connect to, is a connection to another provider that is a direct competitor. Simple as that. Is it better for the routing table / routers etc, to have larger blocks and as little as small prefixes as possible ? Sure, it will scale a lot better, however as the option of obtainable PI IPv6 space is there, people could request it for their own infrastructure and use it. The limitation of PIv6 in combination with multihomed (as in multihomed with its own AS using BGP) is something I personally would rather see dropped than enforced. Some companies actually take the steps into v6 & multi-homing in steps or want to take the approach, renumber once ... and NEVER again !! And we'll see in the future if multi-homed is going to be pursued or required. ----
In this IPv6 PI discussion people say it is too expensive to be an LIR. This strikes me as weird... even cheap network gear costs way more than the LIR fee, and certainly the personnel costs are many times that, even in countries where technical folks are poorly paid. But anyway....
The cost for a LIR status are not the issue from what I see for most of the companies I speak with. Most of them just don't want to deal with the RIPE stuff (yet). They don't see themselves as an ISP or hoster and are perfectly happy with the fact they can only use PI for their own infrastructure. Next to the stated cost of router equip, most of them are very happy to deal with racks of servers and linux patches etc. but are not up to speed on routing / networking / bgp etc. They just want to be prepared in case they move and / or grow to a size where they would want to run their own network equipment because it is at some point cheaper to sort out their own traffic / network. ----
Is there another reason to want to limit PI assignments? There may be. Certainly the folks over in abuse-land think we should have super strict controls over all addresses, and revoke them at the first hint of naughtiness. Or there may be administrative reasons - an entirely different kind of infrastructure is needed to manage hundreds of thousands of low-fee (well, NO fee now) PI-holders than thousands of high-fee LIRs. I don't know.
So... do you think we should simply remove all restrictions for IPv6 PI and issue space if someone wants it, period? If not, what possible restriction would there be?
In my personal opinion, cost isn't always the topic when deciding for PI. I would even dare to say that currently PI objects are way too cheap. And I wouldn't mind to ask customers to pay a yearly fee of 250 euro up-to 400 Euro per /48 PI IPv6 if they wouldn't have the multi-homing requirement. And by making it a bit more expensive, it will also provide a barrier that this isn't free or something to have for fun. But the companies that really want it for their own reasons, they will request it anyway. ----
Finally, I think what bothers me about PI in general though is that once the initial assignment is made... that's it. At least with RIPE 452 we have *some* contractual relationship with the PI holder, but that's about it.
I guess the "LIR middleman" model comes from the mists of time, long ago in history. It certainly reduces the burden on the RIPE NCC, but it never really struck me as sensible. After all, isn't the whole point of PI space that you don't want to have to depend on an LIR?
Not completely, having a LIR dealing with your requests, db updates and sorting out the route-objects etc. could still add value to those customers that don't want to become a LIR. As said above, a lot of my PI customers have no clue about networking or RIPE policies, having a LIR to fall-back to, adds value to them and it is cheaper than becoming a direct end-user or a LIR themselves. Regards, Erik Bais Op dit e-mailbericht is een disclaimer van toepassing, welke te vinden is op http://www.espritxb.nl/disclaimer
An ISP can still get PI addresses. You just can't delegate addresses from PI space to customers. You need PA space for that. If so then the problem is solved, the ISP will not delegate addresses to
Hi Sander, I think it is wrong to not allow an ISP to be independent of it's providers. There are regions with ISPs that have very few customers, and I think this policy discriminates against them. Why every other company can have PI, but ISPs can't? Let them be able to receive independent resources without making sub-allocation. I'm sure that IPV6 routing table will explode and PI certainly will not be the reason. If you do not give smaller ISPs PI they have to use sub-allocation of any LIR, and because most ISPs are multihomed they will announce their sub-allocation to another provider, the LIR's addresses will be split and that will be the impact over the routing table. On 14/02/2011 16:44, Sander Steffann wrote: the customers. He will give them one address with which they will connect to the ISPs network, but he will not allocate it to them. Best regards, Yasen -- Yasen Simeonov Network Management Team Neterra Ltd. Sofia, Bulgaria Phone: +359 2 974 33 11 Fax: +359 2 975 34 36 Mobile: +359 887 477 540 http://www.neterra.net
Hi,
I think it is wrong to not allow an ISP to be independent of it's providers. There are regions with ISPs that have very few customers, and I think this policy discriminates against them. Why every other company can have PI, but ISPs can't?
An ISP can get PI spac, but only for their own networks, not for customers.
Let them be able to receive independent resources without making sub-allocation.
This is possible.
An ISP can still get PI addresses. You just can't delegate addresses from PI space to customers. You need PA space for that. If so then the problem is solved, the ISP will not delegate addresses to the customers. He will give them one address with which they will connect to the ISPs network, but he will not allocate it to them.
That's not how IPv6 works... And the IPv6 policy does not have the 'point to point links to customers are considered your own infrastructure' rule, so tjis would not be according to polcy anyway. - Sander
* Yasen Simeonov(Neterra NMT) wrote:
Why every other company can have PI, but ISPs can't?
Because ISPs should use PA (as LIR). It's their job to hand out addresses to their customers.
lutz@iks-jena.de (Lutz Donnerhacke) wrote:
* Yasen Simeonov(Neterra NMT) wrote:
Why every other company can have PI, but ISPs can't?
Because ISPs should use PA (as LIR). It's their job to hand out addresses to their customers.
Lutz, nothing against terse answers, especially towards people who are not really explaining and/or addressing the problems at hand, but: ISPs can certainly receive PI space if they can justify the need. Usually ISPs get PI space for a specific customer, working as a handling agent, but in certain special cases, PI space gets issued to ISPs directly. The point in this discussion is that Yasen either does not or does not want to understand the actual issue... Elmar.
At 15-02-2011 09:52, Lutz Donnerhacke wrote:
* Yasen Simeonov(Neterra NMT) wrote:
Why every other company can have PI, but ISPs can't?
Because ISPs should use PA (as LIR). It's their job to hand out addresses to their customers.
Isn't this supposed to be a market of current LIRs to act as a local registry agent and hand out (renting) smaller blocks (/48 for example) of their own PA space to anyone who is willing to use and route it? A LIR does not have to be an ISP, and vice-versa. It just happens most companies are both for the ease of administration. A LIR is nothing more than an administration office and has to act according to RIPE policies when assigning address space to their customers and keep the RIPE whois database up-to-date. As small ISP you can contact any LIR for registry services and receive parts of their PA space if they agree. https://www.ripe.net/membership/indices/
participants (18)
-
Daniel Roesen -
Elmar K. Bins -
Erik Bais -
Gert Doering -
Jamie Stallwood -
Jasper Jans -
JORDI PALET MARTINEZ -
Leo Vegoda -
Lutz Donnerhacke -
Mark Scholten -
Martin Millnert -
Michiel Klaver -
Nick Hilliard -
Sander Steffann -
Sergey Myasoedov -
Shane Kerr -
Vegar Løvås -
Yasen Simeonov(Neterra NMT)