- ncc-services-wg - mailman.ripe.net

RPKI Resource Certification: building features
by Alex Band 03 Oct '10

03 Oct '10

Most of the discussions around RPKI Resource Certification that have been held up to now have largely revolved around infrastructure and policy topics. I would like to move away from that here and discuss what kind of value and which features can be offered with Certification for network administrators around the world. Because in the end, the goal is to make Internet routing more robust and create a more reliable method for network operators to make routing decisions. We all know about the shortcomings of the IRR system and that just half of all prefixes on the Internet have a route object associated with them (http://bgpmon.net/blog/?p=140). However, it does mean that there is ton of valuable information in the IRRs, whereas the Certification system needs to start from scratch. Based on many discussion I've had with members and the Community, here is my idea for a Route Origin Authorisation** (ROA) wizard that retrieves IRR information, compares it to real world routing and uses that for the creation of ROA Specifications. This has a number of benefits: - Network operators don't have to create their routing policy in the Certification system from scratch - Because a comparison between is done the IRR and RIS (http://ripe.net/ris/), only accurate up-to-date information is added to the Certification system - The accuracy of the IRR is increased as a bonus, and is achieved without leaving the wizard Ideally, a network operator should be able to manage and publish their routing policy – both for the IRR and Certification – from one single interface. Here are the basic steps for the wizard after a certificate is generated: 1. Start ROA Wizard 2. Detect IRR information using the AS numbers in the Certificate, like for example: http://www.db.ripe.net/whois?searchtext=AS286&inverse_attributes=origin&for… 3: Compare results with RIS using RRCC/Netsense, like for example: http://www.ris.ripe.net/cgi-bin/rrccng/query.cgi?target=AS286 4: Allow user to flag which ROA specifications they would actually like to create, based on the IRR and RRCC/Netsense results. 5: Allow user to create additional ROA Specifications 6: Detect which maintainer is used for the route objects in the IRR 7: Allow user to specify maintainer password/pgp key, so all route objects are updated/removed/added based on the ROAs that were created. This makes sure the data in the IRR and the Certification system is consistent. 8: Save and publish ROAs and route objects Do you think there is value in creating a system like this? Are there any glaring holes that I missed, or something that could be added? I'm looking forward to your feedback. Alex Band RIPE NCC http://ripe.net/certification ** The certification system largely revolves around three main elements: (1) the Certificate, that offers validated proof of holdership of an Internet Resource, (2) the Route Orgin Authorisation Object (ROA), a standardised document that states that the holder of a certain prefix authorises a particular AS to announce that prefix and (3) the Validator, which relying parties, i.e. your peers, can use to validate certificates and ROAs.

1 0

A case study for using public RIPE NCC Tools on RIPE Labs
by Mirjam Kuehne 20 Sep '10

20 Sep '10

[Apologies for duplicate emails] Dear Colleagues, After a short K-root outage last week, RIPE NCC Chief Scientist Daniel Karrenberg investigated exactly what happened using the public RIPE NCC tools DNSMON and RIS. Read this interesting and informative step-by-step case study on RIPE Labs: https://labs.ripe.net/Members/dfk/investigating/investigating-events-with-r… Kind regards, Mirjam Kühne RIPE Labs

1 0

LIR Portal Upgrade
by Trudy Prins 31 Aug '10

31 Aug '10

Dear Colleagues, The RIPE NCC is currently upgrading the LIR Portal to a newer software version, increasing the flexibility, quality and reliability, and including a single sign-on system. To help ensure a smooth deployment, the upgrade is rolled out in stages. The first stage of deployment, upgrading the Billing section of the site, was carried out on 14 April 2010. The Training section and the Resource Lists were upgraded as well. The second stage, which includes all resource request forms and wizards, will be deployed today, 31 August. Downtime of the portal should be less than one minute. The deployment of the new portal software including the sign-in system does not yet include the entire LIR Portal. Users may find that they are asked to sign in more than once as they move between different sections of the site. This will continue until the single sign-on system has been fully deployed throughout the LIR Portal. The remaining old LIR Portal sections will be replaced in the final upgrade, scheduled to take place in the fourth quarter of 2010. After this final deployment, all functionality of the LIR Portal will be available under the single sign-on system. The migration to newer software might result in some small changes, but the overall look and feel should not be affected in a very noticeable way. If you have any questions or comments regarding this upgrade, please email <sw-bugs(a)ripe.net>. Best regards, Trudy Prins Manager Business Applications RIPE NCC

1 0

2007-01 Policy Implementation - Phase 3 draft procedures available
by Arne Kiessling 23 Aug '10

23 Aug '10

Dear Colleagues, As announced during the RIPE NCC Services Working Group session at RIPE 60, the RIPE NCC will provide the RIPE community with a draft procedure for Phase 3 of the policy implementation for "Contractual Requirements for Provider Independent Resource Holders in the RIPE NCC Service Region". The draft document is available at: http://www.ripe.net/news/2007-01-phase3.html Please note that the draft document describes an internal RIPE NCC procedure and is provided for informational purposes. If you have any feedback for the RIPE NCC regarding the procedure for Phase 3 of the policy implementation, please send an email to <enduser-contract(a)ripe.net>. -- Kind Regards Arne Kiessling IP Resource Analyst RIPE Network Coordination Centre

1 0

IPv6 RIPEness - Criteria for a Potential Fifth Star Rating - RIPE Labs
by Amanda Gowland 17 Aug '10

17 Aug '10

[Apologies for duplicates] Dear Colleagues, Earlier this year, RIPE Labs posted an article about IPv6 "RIPEness", a 4-star rating system of LIR IPv6 deployment. In that article, we asked for feedback on what criteria we could use to determine the potential addition of a 5th star to the rating system. We received some great feedback on how we could determine a 5-star RIPEness rating, you can read about it on RIPE Labs: https://labs.ripe.net/Members/becha/ipv6-ripeness-5th-star-criteria As always, any comments or suggestions are welcome. You can send us email or post in the article's comment section. Kind Regards, Amanda Gowland RIPE NCC

1 0

Data Repository on RIPE Labs
by Mirjam Kuehne 27 Jul '10

27 Jul '10

[apologies for duplicates] Dear colleagues, We launched a new project on RIPE Labs: the RIPE Data Repository. You can read the announcement here: https://labs.ripe.net/Members/mirjam/ripe-data-repository On the projects pages you will find a more detailed description of the project, a list of data sets and the terms and conditions for using those data sets: https://labs.ripe.net/datarepository If you have any questions or comments, please do not hesitate to leave a comment on RIPE Labs or send mail to labs(a)ripe.net. Kind Regards, Mirjam Kühne RIPE NCC

1 0

Outage report for RIPE Database updates
by Denis Walker 21 Jul '10

21 Jul '10

[Apologies for duplicate emails] Dear colleagues, Between 22:06 and 23:37 (UTC) on Tuesday, 20 July 2010, there was an interruption to the update service for the RIPE Database. All update processes were affected. If you did not receive any acknowledgement, you might need to check any objects you were updating in the RIPE Database to see if the update was successful. If you received an acknowledgement, you need to check the messages in that acknowledgement to see if any errors occurred. Apologies for any inconvenience this may have caused. Regards, Denis Walker Business Analyst RIPE NCC Database Group

1 0

Splitted PI billing
by Max Tulyev 21 Jul '10

21 Jul '10

Hi All! Recently RIPE NCC has assigned a PI network for my client. It is 1536 IPs (/22+/23), and it was assigned as two completely different inetnums (with one same netname). I have asked how it will be billed, and got an answer - as two separate objects. I understand, in future it will be harder and harder to get a non-splitted networks, and splitted networks will be more frequent. But how I can predict it in my agreements with customers? I don't know how much pieces will be splitted the next network to. When I said it will be twice more expensive than expected, customer was unhappy and said there is an agreement already signed, with the exact price in it. I think, one request shold be billed as one object, isn't it? -- WBR, Max Tulyev (MT6561-RIPE, 2:463/253@FIDO)

5 5

RIPE Labs 2.0 now live
by Mirjam Kuehne 15 Jul '10

15 Jul '10

[apologies for duplicates] Dear Colleagues, RIPE Labs 2.0 is now live: http://labs.ripe.net In the year since its launch, RIPE Labs has grown into a dynamic resource that allows the RIPE community to present and discuss new Internet-related tools and ideas. To accommodate the increasing content load on the site, and based on feedback from users, we've made some improvements to ensure a better experience for our users. To promote discussion and sharing of ideas: - It's now easier to comment on each article or tool - You no longer need to register to make comments or join discussions - Registration is only required for contributors of articles or tools To make it easier to navigate RIPE Labs: - The search functionality has been upgraded - A tag cloud shows the most popular topics - Long-term projects now have dedicated pages with detailed descriptions and regular updates Your participation is vital for the continued success of RIPE Labs. If you have any comments or questions about RIPE Labs, or you'd like to contribute to the platform, please don't hesitate to contact us at: labs(a)ripe.net Kind Regards, Mirjam Kühne RIPE Labs Community Builder

1 0

C0902070 - SFINX: Peering with RIPE, AS 12654: down
by NCC 05 Jul '10

05 Jul '10

Dear all, we see the peering to your side down. Our AS: 6805 Your AS: 12654 IP: 194.68.129.38 Do you have some maintenance on your side? Please give us some feedback. best regards, Arkadiusz Baclawski

1 0