- db-wg - mailman.ripe.net

Re: [db-wg] out of region routing in the RIPE Database
by Lu Heng 04 Aug '17

04 Aug '17

Hi, I would like to have the IRR kept open, we have space from various regions and need to be able to make use of a single well known IRR in order to register our policies and be able to mix our ASNs with our space. It is very convenient to be able to use the RIPE IRR for that. I do see that authentication/verification against other RIR's Database is not done at the moment and can be abused and will support any simple mechanism put in place in order to fix that issue. But closing the IRR down for out of region resources far outweighs the negative side effects seen by typos and abuses that comes through from time to time. On 20 July 2017 at 15:41, Gert Doering via db-wg <db-wg(a)ripe.net> wrote: > > > ---------- Forwarded message ---------- > From: Gert Doering <gert(a)space.net> > To: Sander Steffann <sander(a)steffann.nl> > Cc: George Michaelson <ggm(a)algebras.org>, denis walker < > ripedenis(a)yahoo.co.uk>, Database WG <db-wg(a)ripe.net> > Bcc: > Date: Thu, 20 Jul 2017 09:41:09 +0200 > Subject: Re: [db-wg] out of region routing in the RIPE Database > Hi, > > On Tue, Jul 18, 2017 at 04:10:52PM +0200, Sander Steffann via db-wg wrote: > > > its a broken process. it inherently permits things to be said, which > > > should not have been said. > > > > Time to set up a joint IRR database where only authoritative data from > participating RIRs is stored? > > This might indeed be the way forward for "I have a customer in my RIPE > AS which has APNIC space and wants to document that in a way that that > provisioning tools can pick this with sufficient trust on data quality". > > (And no, RADB is not) > > Gert Doering > -- NetMaster > -- > have you enabled IPv6 on something today...? > > SpaceNet AG Vorstand: Sebastian v. Bomhard > Joseph-Dollinger-Bogen 14 Aufsichtsratsvors.: A. Grundner-Culemann > D-80807 Muenchen HRB: 136055 (AG Muenchen) > Tel: +49 (0)89/32356-444 USt-IdNr.: DE813185279 > > -- -- Kind regards. Lu

2 1

NWI-7: abuse-c implementation plan
by William Sylvester 03 Aug '17

03 Aug '17

Working group members, Based on the responses we have received for NWI-7 : Abuse-c implementation, there is a clear consensus for the proposed implementation that has been presented by Tim from RIPE NCC as written for improving "abuse-c:". At this time, the DB-WG co-chairs would like to ask the RIPE NCC to proceed with this implementation. Kind Regards, DB-WG Chairs

1 0

Re: [db-wg] out of region routing in the RIPE Database
by Sebastian Wiesinger 27 Jul '17

27 Jul '17

* Gert Doering via db-wg <db-wg(a)ripe.net> [2017-07-20 09:42]: > > > its a broken process. it inherently permits things to be said, which > > > should not have been said. > > > > Time to set up a joint IRR database where only authoritative data from participating RIRs is stored? > > This might indeed be the way forward for "I have a customer in my RIPE > AS which has APNIC space and wants to document that in a way that that > provisioning tools can pick this with sufficient trust on data quality". Yes please! Regards Sebastian -- GPG Key: 0x93A0B9CE (F4F6 B1A3 866B 26E9 450A 9D82 58A2 D94A 93A0 B9CE) 'Are you Death?' ... IT'S THE SCYTHE, ISN'T IT? PEOPLE ALWAYS NOTICE THE SCYTHE. -- Terry Pratchett, The Fifth Elephant

1 0

Call for Agenda Items DB-WG Meeting - RIPE75 - Dubai, UAE
by William Sylvester 25 Jul '17

25 Jul '17

Dear DB-WG Members, This is the call for agenda items for the DB-WG Meeting at RIPE75 at the Conrad Dubai in Dubai, UAE. Please submit agenda items or propose additional topics to be discussed both on the mailing list or direct to the WG Chairs at db-wg-chairs(a)ripe.net<mailto:db-wg-chairs@ripe.net> The DB-WG Meeting is scheduled for Wednesday, October 25th, starting at 14:00 local time, after lunch and before the coffee break. The length of our timeslot is 90 minutes. For the overall RIPE 74 meeting plan please refer to its most up-to-date version at https://ripe75.ripe.net/programme/meeting-plan/ Note: due to UAE law, confirmed speakers will need to submit a copy of their passport and contact information in advance of the meeting. More details are available here: https://ripe75.ripe.net/attend/dctm-requirements We are looking forward to another successful meeting in Dubai. Kind regards, William, Denis, & David DB WG Chairs

1 0

Re: [db-wg] out of region routing in the RIPE Database
by Gert Doering 20 Jul '17

20 Jul '17

Hi, On Tue, Jul 18, 2017 at 04:10:52PM +0200, Sander Steffann via db-wg wrote: > > its a broken process. it inherently permits things to be said, which > > should not have been said. > > Time to set up a joint IRR database where only authoritative data from participating RIRs is stored? This might indeed be the way forward for "I have a customer in my RIPE AS which has APNIC space and wants to document that in a way that that provisioning tools can pick this with sufficient trust on data quality". (And no, RADB is not) Gert Doering -- NetMaster -- have you enabled IPv6 on something today...? SpaceNet AG Vorstand: Sebastian v. Bomhard Joseph-Dollinger-Bogen 14 Aufsichtsratsvors.: A. Grundner-Culemann D-80807 Muenchen HRB: 136055 (AG Muenchen) Tel: +49 (0)89/32356-444 USt-IdNr.: DE813185279

1 0

Re: [db-wg] out of region routing in the RIPE Database
by Nick Hilliard 18 Jul '17

18 Jul '17

denis walker via db-wg wrote: > Just for the record I have followed all previous discussions on this > issue over many years within the RIPE community. There have been many > (opposing) views expressed. I don't recall any consensus within the RIPE > community to expel all, or even just Afrinic, (foreign) ROUTE objects > from the RIPE Database. If I did miss that, maybe someone can point me > to the message on this or the ROUTING WG mailing lists where that > consensus was drawn. NWI3 was proposed last year. Several people supported the idea and no-one was against it, at least at the time it was suggested. Previously two people thought this was a bad idea (one of these people was you) and stated so on the mailing list. https://www.ripe.net/ripe/mail/archives/db-wg/2016-May/005241.html No formal declaration of consensus was drawn by the wg chairs, but in the circumstances it looked like there was overall support for the idea. As a result of what appeared to be a community mandate, the RIPE NCC started a project which was reported on at the Copenhagen and Madrid meetings: https://ripe72.ripe.net/archives/video/217/ https://ripe73.ripe.net/archives/video/1510/ As Piotr noted in Madrid, there is not yet consensus on how this project should move forward. Right now, I believe that this may be the sticking point. > Does Afrinic have a mandate, with a clear consensus, from the Afrinic > community for the migration of all Afrinic ROUTE objects from the RIPE > Database to the Afrinic Database? Has either community agreed anything > on the (re)creation of Afrinic ROUTE objects in the RIPE Database? The Afrinic people would be best placed to provide feedback on how this proposal has been received by the Afrinic community. Maybe Daniel could comment? Nick

1 0

Re: [db-wg] out of region routing in the RIPE Database
by Tim Bruijnzeels 18 Jul '17

18 Jul '17

> On 18 Jul 2017, at 17:03, Sander Steffann via db-wg <db-wg(a)ripe.net> wrote: > > > From: Sander Steffann <sander(a)steffann.nl> > Subject: Re: [db-wg] out of region routing in the RIPE Database > Date: 18 July 2017 at 16:10:09 GMT+2 > To: George Michaelson <ggm(a)algebras.org> > Cc: Nick Hilliard <nick(a)foobar.org>, Database WG <db-wg(a)ripe.net>, denis walker <ripedenis(a)yahoo.co.uk> > > > Hi George, > >> I think the previously stated position from APNIC region is clear: we >> have problems with the logistics which permit resources from our >> region to be included in IRR statements in the RIPE DB, when no formal >> check is made of permission or integrity, and we do not see any clear >> path to a deployable mechanism to provide authorization checks over >> resources from out of region. >> >> its a broken process. it inherently permits things to be said, which >> should not have been said. > > Time to set up a joint IRR database where only authoritative data from participating RIRs is stored? Thanks sander, we will certainly look into the options and report back to the wg group. Tim

2 1

out of region routing in the RIPE Database
by denis walker 18 Jul '17

18 Jul '17

Hi Daniel and others Just for the record I have followed all previous discussions on this issue over many years within the RIPE community. There have been many (opposing) views expressed. I don't recall any consensus within the RIPE community to expel all, or even just Afrinic, (foreign) ROUTE objects from the RIPE Database. If I did miss that, maybe someone can point me to the message on this or the ROUTING WG mailing lists where that consensus was drawn. Does Afrinic have a mandate, with a clear consensus, from the Afrinic community for the migration of all Afrinic ROUTE objects from the RIPE Database to the Afrinic Database? Has either community agreed anything on the (re)creation of Afrinic ROUTE objects in the RIPE Database? I have no personal interest in this either way. I just want to be clear what the current position is so we can move forward. cheersdenisco-chair DB-WG From: Daniel Shaw via db-wg <db-wg(a)ripe.net> To: Database WG <db-wg(a)ripe.net> Sent: Tuesday, 18 July 2017, 16:39 Subject: Re: [db-wg] out of region routing in the RIPE Database On 18/07/2017, 15:26, Nick Hilliard via db-wg typed: > > > There are two main ways to fix this problem: > > 1. change all non-RIPE address space to have a different source: tag > > 2. remove all non-RIPE address space completely > > There is some previous discussion about this issue on db-wg, and IIRC, > the WG suggestion was to go for option #2. > > On that basis, again IIRC, there was a suggestion to handle this in a > phased way, starting off with the lowest hanging fruit first. As > Afrinic objects formed the largest share of all out-of-region objects in > the ripedb, they were targeted first. Hello WG, That matches my recollection too. And so I'll re-iterate that, as previously mentioned on this list, this neatly matches up with some parallel goals within AFRINIC. Which is that regardless, we see an advantage in having our membership manage their IRR along with RDNS and RPKI and other registry interactions in one place under one authentication. Simpler. And we also see an advantage in general growth in usage of the AFRINIC IRR by our membership, as it's a service we already provide and will maintain and scale as needed in any case. And so, we do already provide tooling to our membership to assist them moving objects into the AFRINIC DB easily. We do liaise with upstream operators of our members when they have in the past implied a requirement for RIPE DB IRR objects. And our hostmasters also do run bootcamp tutorials at nog and other events to encourage migration of objects. In summary there is ongoing work that matches with migrating non-RIPE, AFRINIC route(6) objects underway. I will add that this is a long and slow process however. The work is done as convenient. And for now, only applies where both the IPv{4,6} an AS resources are within the AFRINIC region. The movement is slow. But in the direction of moving AFRINIC resources away from RIPE DB. Regards, Daniel

1 0

Re: [db-wg] out of region routing in the RIPE Database
by Daniel Shaw 18 Jul '17

18 Jul '17

On 18/07/2017, 15:26, Nick Hilliard via db-wg typed: > > > There are two main ways to fix this problem: > > 1. change all non-RIPE address space to have a different source: tag > > 2. remove all non-RIPE address space completely > > There is some previous discussion about this issue on db-wg, and IIRC, > the WG suggestion was to go for option #2. > > On that basis, again IIRC, there was a suggestion to handle this in a > phased way, starting off with the lowest hanging fruit first. As > Afrinic objects formed the largest share of all out-of-region objects in > the ripedb, they were targeted first. Hello WG, That matches my recollection too. And so I'll re-iterate that, as previously mentioned on this list, this neatly matches up with some parallel goals within AFRINIC. Which is that regardless, we see an advantage in having our membership manage their IRR along with RDNS and RPKI and other registry interactions in one place under one authentication. Simpler. And we also see an advantage in general growth in usage of the AFRINIC IRR by our membership, as it's a service we already provide and will maintain and scale as needed in any case. And so, we do already provide tooling to our membership to assist them moving objects into the AFRINIC DB easily. We do liaise with upstream operators of our members when they have in the past implied a requirement for RIPE DB IRR objects. And our hostmasters also do run bootcamp tutorials at nog and other events to encourage migration of objects. In summary there is ongoing work that matches with migrating non-RIPE, AFRINIC route(6) objects underway. I will add that this is a long and slow process however. The work is done as convenient. And for now, only applies where both the IPv{4,6} an AS resources are within the AFRINIC region. The movement is slow. But in the direction of moving AFRINIC resources away from RIPE DB. Regards, Daniel

1 0

Re: [db-wg] out of region routing in the RIPE Database
by George Michaelson 18 Jul '17

18 Jul '17

On Tue, Jul 18, 2017 at 4:10 PM, Sander Steffann via db-wg <db-wg(a)ripe.net> wrote: > > > ---------- Forwarded message ---------- > From: Sander Steffann <sander(a)steffann.nl> > To: George Michaelson <ggm(a)algebras.org> > Cc: Nick Hilliard <nick(a)foobar.org>, Database WG <db-wg(a)ripe.net>, denis walker <ripedenis(a)yahoo.co.uk> > Bcc: > Date: Tue, 18 Jul 2017 16:10:09 +0200 > Subject: Re: [db-wg] out of region routing in the RIPE Database > Hi George, > >> I think the previously stated position from APNIC region is clear: we >> have problems with the logistics which permit resources from our >> region to be included in IRR statements in the RIPE DB, when no formal >> check is made of permission or integrity, and we do not see any clear >> path to a deployable mechanism to provide authorization checks over >> resources from out of region. >> >> its a broken process. it inherently permits things to be said, which >> should not have been said. > > Time to set up a joint IRR database where only authoritative data from participating RIRs is stored? Not a bad idea, I wouldn't oppose. Why do we have the NRO, if not to coordinate these kind of things? -George

1 0