05.08.2013 Views

What is an LIR?

What is an LIR?

What is an LIR?

SHOW MORE
SHOW LESS

You also want an ePaper? Increase the reach of your titles

YUMPU automatically turns print PDFs into web optimized ePapers that Google loves.

RIPE NCC<br />

Local Internet Reg<strong>is</strong>try<br />

Training Course<br />

<strong>LIR</strong> Training Course<br />

Spring 2007<br />

http://www.ripe.net<br />

1


Learning Goals<br />

• Your responsibilities as <strong>LIR</strong>s<br />

• IP resources admin<strong>is</strong>tration<br />

• Efficient communication with the RIPE NCC<br />

<strong>LIR</strong> Training Course Spring 2007<br />

http://www.ripe.net 2


Overview<br />

1. Introduction to the RIPE NCC<br />

2. Being <strong>an</strong> <strong>LIR</strong><br />

3. The RIPE Database<br />

4. Making Assignments<br />

5. Assignment Window<br />

6. M<strong>an</strong>aging Allocations<br />

7. PI Address Space<br />

8. IPv6<br />

9. Reverse DNS<br />

10. ASN<br />

11. RIPE & Policy Development Process<br />

<strong>LIR</strong> Training Course Spring 2007<br />

http://www.ripe.net 3


1. Introduction to the RIPE NCC<br />

• RIPE<br />

• RIPE NCC<br />

• Internet Reg<strong>is</strong>try System<br />

<strong>LIR</strong> Training Course<br />

Spring 2007<br />

http://www.ripe.net<br />

4


RIPE <strong>an</strong>d RIPE NCC<br />

• Réseaux IP Européens (1989)<br />

- collaborative operators’ community for coordinating<br />

IP infrastructure development<br />

- open to all<br />

- developing policies; input to the RIPE NCC<br />

• RIPE Network Coordination Centre (1992)<br />

- independent not-for-profit membership org<strong>an</strong><strong>is</strong>ation<br />

- one of five Regional Internet Reg<strong>is</strong>tries (RIRs)<br />

<strong>LIR</strong> Training Course Spring 2007<br />

http://www.ripe.net 5


RIR Service Regions<br />

<strong>LIR</strong> Training Course Spring 2007<br />

http://www.ripe.net 6


Problem<br />

Internet Reg<strong>is</strong>try System Goals<br />

Uniqueness <strong>an</strong>d<br />

contact details<br />

Routing table<br />

growth<br />

Limited resource<br />

Solution<br />

RIPE Database<br />

Scalable routing<br />

Efficient use<br />

<strong>LIR</strong> Training Course Spring 2007<br />

Principle/Goal<br />

Reg<strong>is</strong>tration<br />

Aggregation<br />

Conservation<br />

http://www.ripe.net 7


Hierarchical D<strong>is</strong>tribution<br />

<strong>LIR</strong> Training Course Spring 2007<br />

http://www.ripe.net 8


RIPE NCC Services<br />

Member Services<br />

• IP resources<br />

- IPv4<br />

- IPv6<br />

- AS Numbers<br />

• Reverse DNS delegation<br />

• Training courses<br />

- <strong>LIR</strong><br />

- Routing Reg<strong>is</strong>try & Tools<br />

- DNS for <strong>LIR</strong>s<br />

<strong>LIR</strong> Training Course Spring 2007<br />

Public Services<br />

• RIPE Database<br />

– Routing Reg<strong>is</strong>try<br />

• RIPE support<br />

• Spreading information<br />

• ENUM (e164.arpa)<br />

• K-root name server<br />

• Test Traffic Measurements*<br />

• DNSMon*<br />

• E-Learning<br />

http://www.ripe.net 9


<strong>LIR</strong> Training Course Spring 2007<br />

http://www.ripe.net 10


Influencing RIPE NCC<br />

Members attending<br />

RIPE NCC General Meeting<br />

vote on Charging Scheme<br />

RIPE NCC proposes yearly<br />

Activity Pl<strong>an</strong> <strong>an</strong>d Budget<br />

RIPE proposes actions<br />

<strong>LIR</strong> Training Course Spring 2007<br />

http://www.ripe.net 11


Org<strong>an</strong><strong>is</strong>ation Structure<br />

<strong>LIR</strong> Training Course<br />

Spring 2007<br />

http://www.ripe.net<br />

12


Budget <strong>an</strong>d Charging Scheme<br />

• RIPE NCC <strong>is</strong> not-for-profit<br />

- activities determined by RIPE; expenses based on activities<br />

- money comes from (yearly) membership fees<br />

- money split from between ex<strong>is</strong>ting <strong>an</strong>d projected new / closed <strong>LIR</strong>s<br />

• Your fee / category depends on:<br />

• your "score“ <strong>an</strong>d “scores" of all the other <strong>LIR</strong>s<br />

• “draft income budget”<br />

• Your billing score based on:<br />

• units <strong>an</strong>d formula in (yearly) "Charging Scheme“<br />

• Score matched to category in "Billing Procedure“<br />

- document publ<strong>is</strong>hed only after the approval of GM (Oct.)<br />

- category c<strong>an</strong> not be guessed beforeh<strong>an</strong>d!<br />

• Billing phases<br />

<strong>LIR</strong> Training Course Spring 2007<br />

http://www.ripe.net 13


RIPE NCC: Learning Points<br />

• The RIPE NCC <strong>is</strong> not RIPE<br />

• You c<strong>an</strong> influence RIPE NCC activities<br />

• Remember: aggregation, conservation, reg<strong>is</strong>tration<br />

Questions?<br />

<strong>LIR</strong> Training Course<br />

Spring 2007<br />

http://www.ripe.net<br />

14


2. Being <strong>an</strong> <strong>LIR</strong><br />

• Benefits <strong>an</strong>d Responsibilities<br />

• Terminology<br />

• Set-Up Procedure<br />

<strong>LIR</strong> Training Course Spring 2007<br />

http://www.ripe.net 15


<strong>What</strong> <strong>is</strong> <strong>an</strong> <strong>LIR</strong>?<br />

• Local Internet Reg<strong>is</strong>try<br />

- responsible for obtaining, d<strong>is</strong>tributing <strong>an</strong>d reg<strong>is</strong>tering<br />

IP resources, according to the RIPE policies<br />

• Member of the RIPE NCC<br />

- receiving resources directly from the RIPE NCC<br />

• Benefits<br />

- flexibility<br />

- independence (BGP multihoming)<br />

<strong>LIR</strong> Training Course Spring 2007<br />

http://www.ripe.net 16


Allocation <strong>an</strong>d Assignment<br />

/24<br />

/21<br />

/25 /26<br />

<strong>LIR</strong> Training Course Spring 2007<br />

/8<br />

RIPE NCC Allocation<br />

<strong>LIR</strong> Allocation<br />

End User Assignments<br />

or <strong>LIR</strong>’s Infrastructure<br />

http://www.ripe.net 17


Terminology<br />

• Allocation:<br />

- address space set apart, by the RIPE NCC for <strong>LIR</strong>’s <strong>an</strong>d<br />

its customers’ future use<br />

• Assignment:<br />

- address space in use in networks<br />

(End User, downstream ISP or <strong>LIR</strong>’s own infrastructure)<br />

- made from allocation or sub-allocation<br />

• Assignment Window:<br />

- maximum nr of addresses <strong>an</strong> <strong>LIR</strong> c<strong>an</strong> assign without<br />

RIPE NCC’s approval. New <strong>LIR</strong>: AW=0<br />

<strong>LIR</strong> Training Course Spring 2007<br />

http://www.ripe.net 18


PI versus PA Assignments<br />

No Aggregation<br />

BGP Announcements (4)<br />

ISP<br />

Customer Assignments<br />

Provider Independent<br />

(Portable Assignments)<br />

<strong>LIR</strong> Training Course Spring 2007<br />

Aggregation<br />

BGP Announcement (1)<br />

Customer Assignments<br />

Provider Aggregatable<br />

(Non-portable Assignments)<br />

<strong>LIR</strong><br />

Allocation<br />

http://www.ripe.net 19


Classless Addressing<br />

• Classful addressing (’80-’93) now obsolete<br />

- waste of addresses; routing table growth<br />

• ’93: Classless Inter Domain Routing (CIDR)<br />

– flexible allocation / assignment sizes<br />

– w.x.y.z/nn notation<br />

• CIDR implemented in all modern routing protocols<br />

• CIDR used for address space d<strong>is</strong>tribution<br />

<strong>LIR</strong> Training Course Spring 2007<br />

http://www.ripe.net 20


<strong>LIR</strong> Set-up Process<br />

• Steps<br />

- read policy documents<br />

- apply for membership<br />

• RegID, contacts<br />

- pay the fees<br />

- sign the contract<br />

• Next steps<br />

- <strong>LIR</strong>: reg<strong>is</strong>ter RIPE Database contact data<br />

- RIPE NCC: “Reg” file, “org<strong>an</strong><strong>is</strong>ation” object<br />

- <strong>LIR</strong>: activate <strong>LIR</strong> Portal account<br />

<strong>LIR</strong> Training Course Spring 2007<br />

http://www.ripe.net 21


Sources of Contact Information<br />

<strong>LIR</strong> Portal<br />

• RIPE NCC confidential<br />

- access only by “users”<br />

• “admin” creates “users”<br />

• “users” create “contacts”<br />

• Log-in: Reg-ID, user, pwd<br />

Reg File<br />

• RIPE NCC “contacts” c<strong>an</strong>:<br />

- request resources<br />

- update contact info<br />

• Use: Reg-ID, name<br />

<strong>LIR</strong> Training Course Spring 2007<br />

RIPE Database<br />

• Public info<br />

- access by <strong>an</strong>yone<br />

- updates by <strong>an</strong>yone<br />

• Operational contacts<br />

- troubleshooting<br />

• Responsibility over<br />

reg<strong>is</strong>tered resources<br />

• Use: nic-h<strong>an</strong>dle<br />

• Additional author<strong>is</strong>ation:<br />

using “maintainer”<br />

http://www.ripe.net 22


First IPv4 Allocation<br />

• If you<br />

- w<strong>an</strong>t independent addresses<br />

- have <strong>an</strong> estimate of usage for two years<br />

- know how much space needed in first six months<br />

• Send us<br />

- “IPv4 first allocation request form”<br />

- PA assignment request form for infrastructure<br />

- PA assignment request form for each customer<br />

• Slow start: minimum initial allocation size /21<br />

<strong>LIR</strong> Training Course Spring 2007<br />

http://www.ripe.net 23


Being <strong>an</strong> <strong>LIR</strong>: Learning Points<br />

• You are part of the global Reg<strong>is</strong>try System<br />

• Think CIDR!<br />

• <strong>LIR</strong> Portal: main interface<br />

Questions?<br />

<strong>LIR</strong> Training Course<br />

Spring 2007<br />

http://www.ripe.net<br />

24


3. The RIPE Database<br />

• Creating contact information objects<br />

• Protection<br />

<strong>LIR</strong> Training Course<br />

Spring 2007<br />

http://www.ripe.net<br />

25


RIPE Database Contact Info<br />

• All <strong>LIR</strong>s must have<br />

-person object<br />

- maintainer (mntner) object<br />

-org<strong>an</strong><strong>is</strong>ation object<br />

-role object, use it!<br />

• To create / update object<br />

- use “webupdates”; or<br />

- “syncupdates”; or<br />

- e-mail completed template to <br />

<strong>LIR</strong> Training Course Spring 2007<br />

http://www.ripe.net 26


Creating person Object<br />

person: John Smith<br />

address: Herengracht 258<br />

phone: +31 20 535 4444<br />

e-mail: john.smith@bluelight.net<br />

abuse-mailbox: abuse@bluelight.net<br />

nic-hdl: auto-1<br />

ch<strong>an</strong>ged: j.smith@bluelight.net 20051031<br />

source: RIPE<br />

<strong>LIR</strong> Training Course Spring 2007<br />

JS5888-RIPE<br />

http://www.ripe.net 27


Contact Person Leaves<br />

1. Get all the relev<strong>an</strong>t objects (inetnum, aut-num, etc)<br />

2. Create new person object<br />

3. Ch<strong>an</strong>ge the “tech-c:” reference in all objects<br />

4. Delete old person object<br />

inetnum:<br />

80.35.64.80<br />

JAJA1-RIPE<br />

CD2-RIPE<br />

...<br />

inetnum:<br />

80.35.64.130<br />

CD2-RIPE JAJA1-RIPE<br />

<strong>LIR</strong> Training Course Spring 2007<br />

person:<br />

CD2-RIPE<br />

person:<br />

JAJA1-RIPE<br />

http://www.ripe.net 28


inetnum:<br />

80.35.64.80<br />

JAJA1-RIPE<br />

BL7-RIPE<br />

inetnum:<br />

80.35.64.130<br />

Better if Using Role Object<br />

1. Create one person object for each technical contact<br />

2. Create one new role object for all technical contacts<br />

3. In all inetnums: ch<strong>an</strong>ge “tech-c:” to refer to role object<br />

4. Keep role object up-to-date<br />

...<br />

BL7-RIPE JAJA1-RIPE<br />

<strong>LIR</strong> Training Course Spring 2007<br />

role:<br />

BL7-RIPE<br />

CD2-RIPE<br />

JAJA1-RIPE<br />

person:<br />

CD2-RIPE<br />

person:<br />

JAJA1-RIPE<br />

http://www.ripe.net 29


RIPE Database Protection<br />

• mntner holds the password / key for author<strong>is</strong>ation of updates<br />

of other objects<br />

• Include “mnt-by: NAME-MNT” in all objects!<br />

- for updates: include “password: bla” or sign<br />

• Authentication methods:<br />

- CRYPT-PW deprecated !<br />

- MD5-PW <br />

• encryption web interface available<br />

- PGPKEY-<br />

- X509-<br />

• Forgot password? Go to RIPE DB > DB Support > Security<br />

<strong>LIR</strong> Training Course Spring 2007<br />

http://www.ripe.net 30


Multiple Protection Illustrated<br />

person: John Brown<br />

mnt-by: ONE-MNT<br />

mnt-by: TWO-MNT<br />

mntner: ONE-MNT mntner: TWO-MNT<br />

auth: MD5-PW $glg87^&$%xy auth: MD5-PW $bla34^&$%bla.<br />

auth: PGPKEY-AE6FBBF7<br />

•In order to update th<strong>is</strong> person object, need to have:<br />

– Either the first MD5-PW password<br />

– Or the second MD5-PW password<br />

– Or the PGP key<br />

<strong>LIR</strong> Training Course Spring 2007<br />

http://www.ripe.net 31


Hierarchical Author<strong>is</strong>ation<br />

inetnum: 85.118.184.0/21<br />

status: ALLOCATED PA<br />

mnt-by: RIPE-NCC-HM-MNT<br />

mnt-lower: <strong>LIR</strong>-MNT<br />

inetnum: 85.118.186.0/24<br />

status: ASSIGNED PA<br />

mnt-by: <strong>LIR</strong>-MNT<br />

<strong>LIR</strong> Training Course Spring 2007<br />

Allocation<br />

Assignment<br />

http://www.ripe.net 32


RIPE Database: Learning Points<br />

• Modify objects on-line<br />

• Easier admin<strong>is</strong>tration with role objects<br />

• Protect data in all objects<br />

Questions?<br />

<strong>LIR</strong> Training Course<br />

Spring 2007<br />

http://www.ripe.net<br />

33


4. Making Assignments<br />

• Assignment process<br />

• Policy<br />

• Reg<strong>is</strong>tering assignments in the DB<br />

<strong>LIR</strong> Training Course<br />

Spring 2007<br />

http://www.ripe.net<br />

34


Assignment Policies<br />

• Policies help <strong>LIR</strong> in finding comprom<strong>is</strong>e<br />

- End User w<strong>is</strong>hes versus Reg<strong>is</strong>try System goals<br />

- Conservation versus aggregation<br />

• <strong>LIR</strong>’s responsibility to implement policies<br />

• If you don’t like current policies, you c<strong>an</strong> ch<strong>an</strong>ge<br />

them!<br />

<strong>LIR</strong> Training Course Spring 2007<br />

http://www.ripe.net 35


Get it Right<br />

• Before sending PA request, read:<br />

- FAQ, “Quick Tips”<br />

- “IPv4 Address Assignment <strong>an</strong>d Allocation Policies”<br />

- “The <strong>LIR</strong> H<strong>an</strong>dbook”<br />

• Request online via <strong>LIR</strong> Portal<br />

- or “PA Assignment Request Form”<br />

- or “PA Assignment Wizard” via <strong>LIR</strong> Portal<br />

• Not more th<strong>an</strong> 5 requests at a time<br />

<strong>LIR</strong> Training Course Spring 2007<br />

http://www.ripe.net 36


Assignment Process, AW=0<br />

<strong>LIR</strong> Collects Information<br />

<strong>LIR</strong> Evaluates Request<br />

<strong>LIR</strong> Chooses Addresses<br />

<strong>LIR</strong> Keeps Documentation<br />

<strong>LIR</strong> Reg<strong>is</strong>ters in RIPE DB<br />

<strong>LIR</strong> Training Course Spring 2007<br />

Approach RIPE NCC<br />

RIPE NCC<br />

evaluates<br />

http://www.ripe.net 37


Step 1: <strong>LIR</strong> Collects Information<br />

• Why?<br />

- To determine the operational need<br />

- To justify the dec<strong>is</strong>ion<br />

• Info needed<br />

- Contact details<br />

- Network setup<br />

- Current address space usage<br />

- Address space requirements<br />

- Future pl<strong>an</strong>s<br />

• Confidential, local l<strong>an</strong>guage<br />

<strong>LIR</strong> Training Course Spring 2007<br />

http://www.ripe.net 38


Step 2: <strong>LIR</strong> Evaluates Request<br />

• Current address space<br />

• Returning addresses?<br />

– Renumbering encouraged!<br />

• All subnets classless<br />

• Pl<strong>an</strong>ning of growth two years ahead maximum<br />

- util<strong>is</strong>ation: 25% now, 50% in one year<br />

<strong>LIR</strong> Training Course Spring 2007<br />

http://www.ripe.net 39


Step 3: <strong>LIR</strong> Makes Dec<strong>is</strong>ion<br />

• Size<br />

- Based on demonstrated need<br />

• For End User? For own Infrastructure?<br />

• Classless<br />

- “/23 & /25” or /27… not always /24<br />

• R<strong>an</strong>ge<br />

- Your choice<br />

<strong>LIR</strong> Training Course Spring 2007<br />

http://www.ripe.net 40


Step 4: Request Form<br />

• General Information<br />

• Address Space User<br />

• Addressing Pl<strong>an</strong><br />

• Equipment description<br />

• Network description<br />

• Network diagram<br />

• Example of the completed form<br />

- for the small ISP Laika, customer of the <strong>LIR</strong> Bluelight<br />

<strong>LIR</strong> Training Course Spring 2007<br />

http://www.ripe.net 41


Separate Request Forms for:<br />

• Each End User network<br />

• <strong>LIR</strong>’s own infrastructure<br />

- c<strong>an</strong> be a single request form for the whole block<br />

- separate subnet for each type of usage<br />

<strong>LIR</strong> Training Course Spring 2007<br />

http://www.ripe.net 42


Portal Communication<br />

Use the same<br />

ticket number<br />

Portal Request Form<br />

Real time syntax checks<br />

Ticket created<br />

Request queued<br />

<strong>LIR</strong> <strong>an</strong>swers<br />

e-mail<br />

Hum<strong>an</strong> (<strong>an</strong>alyst)<br />

e-mail<br />

yes<br />

Questions?<br />

<strong>LIR</strong> Training Course Spring 2007<br />

no<br />

Approval<br />

RIPE NCC<br />

Evaluation<br />

http://www.ripe.net 43


Email Communication<br />

<strong>LIR</strong> fixes errors<br />

Use the same<br />

ticket number<br />

<strong>LIR</strong> <strong>an</strong>swers<br />

PA Assignment<br />

Request Form<br />

<br />

yes<br />

Ticket created<br />

Syntax checks<br />

no<br />

correct?<br />

yes<br />

Request queued<br />

Hum<strong>an</strong> (<strong>an</strong>alyst)<br />

Questions?<br />

no<br />

Approval<br />

<strong>LIR</strong> Training Course Spring 2007<br />

Always include:<br />

-Reg-ID<br />

- your name<br />

RIPE NCC<br />

Evaluation<br />

http://www.ripe.net 44


RIPE NCC Evaluates Requests<br />

• Based on “IPv4 Address Policies” document<br />

- Dynamic assigning encouraged<br />

• not static<br />

- More th<strong>an</strong> /20: usage stat<strong>is</strong>tics verification<br />

• Always-on technologies: xDSL, cable, GPRS…<br />

- Name-based virtual web hosting encouraged<br />

• not IP-based<br />

• exceptions: SSL, ftp & mail servers...<br />

<strong>LIR</strong> Training Course Spring 2007<br />

http://www.ripe.net 45


Approval<br />

• RIPE NCC sends approval message to <strong>LIR</strong><br />

- Size<br />

- “netname:”<br />

- Date<br />

• ticket closed<br />

• <strong>LIR</strong> keeps approval message<br />

• keep all original documents too<br />

• contract with customer<br />

• Next steps<br />

- <strong>LIR</strong> chooses addresses<br />

- <strong>LIR</strong> creates inetnum object<br />

<strong>LIR</strong> Training Course Spring 2007<br />

http://www.ripe.net 46


Step 5: <strong>LIR</strong> Reg<strong>is</strong>ters in RIPE DB<br />

• Validity<br />

• Uniqueness<br />

• Overview<br />

- r<strong>an</strong>ge<br />

- netname<br />

• Contact info<br />

- admin-c<br />

- tech-c<br />

• inetnum must match internal documentation<br />

<strong>LIR</strong> Training Course Spring 2007<br />

http://www.ripe.net 47


Reg<strong>is</strong>tering End Users Separately<br />

• Obligatory. Benefits:<br />

- Abuse complaints c<strong>an</strong> go directly to End User<br />

- Network operators c<strong>an</strong> block End User prefix<br />

• Why? In case of attack by your End Users on<br />

other networks<br />

<strong>LIR</strong> Training Course Spring 2007<br />

http://www.ripe.net 48


Making Assignments: Learning Points<br />

• Shown for AW=0<br />

• Evaluate End User needs<br />

• Always reg<strong>is</strong>ter End Users separately<br />

Questions?<br />

<strong>LIR</strong> Training Course<br />

Spring 2007<br />

http://www.ripe.net<br />

49


5. Assignment Window<br />

• AW Definition<br />

• Assignments above/within the AW<br />

• Assignments for <strong>LIR</strong>’s Infrastructure<br />

<strong>LIR</strong> Training Course<br />

Spring 2007<br />

http://www.ripe.net<br />

50


Assignment Window Concept<br />

• Maximum number of IP addresses the <strong>LIR</strong> c<strong>an</strong> assign<br />

without approval from the RIPE NCC<br />

• For each End User, within <strong>an</strong>y 12 months<br />

• New <strong>LIR</strong>, AW = zero<br />

• RIPE NCC increases AW gradually<br />

• <strong>What</strong> <strong>is</strong> my AW size?<br />

− <strong>LIR</strong> Portal<br />

− “reg” file<br />

<strong>LIR</strong> Training Course Spring 2007<br />

http://www.ripe.net 51


Ask for Approval if…<br />

• Request <strong>is</strong> above AW:<br />

– Th<strong>is</strong> request <strong>an</strong>d all previous assignments you made<br />

without the RIPE NCC to the same End User in the last<br />

12 months<br />

– New <strong>LIR</strong>’s AW=0 – need approval for every<br />

assignment!<br />

<strong>LIR</strong> Training Course Spring 2007<br />

http://www.ripe.net 52


Assignment Process<br />

<strong>LIR</strong> Collects Information<br />

<strong>LIR</strong> Evaluates Request<br />

request > AW?<br />

no<br />

need<br />

2nd opinion?<br />

no<br />

yes<br />

<strong>LIR</strong> Chooses Addresses<br />

<strong>LIR</strong> Keeps Documentation<br />

<strong>LIR</strong> Reg<strong>is</strong>ters in RIPE DB<br />

<strong>LIR</strong> Training Course Spring 2007<br />

yes<br />

Approach RIPE NCC<br />

RIPE NCC<br />

evaluates<br />

http://www.ripe.net 53


Assignments within AW<br />

<strong>LIR</strong>s’ Responsibilities :<br />

• Evaluate all requests<br />

• No need for approval<br />

• Keep documentation for all assignments<br />

- RIPE NCC may ask for it later<br />

• Reg<strong>is</strong>ter all assigned networks in RIPE DB<br />

- choose netname<br />

<strong>LIR</strong> Training Course Spring 2007<br />

http://www.ripe.net 54


Assignments for <strong>LIR</strong>s’ Infrastructure<br />

• <strong>LIR</strong> c<strong>an</strong> make multiple assignments to own infrastructure.<br />

Each assignment = or < AW<br />

• In inetnum object: separate attribute:<br />

remarks: INFRA-AW<br />

• Only if assignment hasn’t been requested!<br />

• C<strong>an</strong>not be merged<br />

• Keep documentation to justify assignments<br />

• Assignments > AW : send request to the RIPE NCC !<br />

<strong>LIR</strong> Training Course Spring 2007<br />

http://www.ripe.net 55


Infrastructure versus End User<br />

• <strong>LIR</strong> / ISP infrastructure<br />

• blocks for co-location: server housing, web hosting<br />

• blocks for connection to End Users (dial-up, P2P)<br />

- Within AW: assign <strong>an</strong>d reg<strong>is</strong>ter as one block<br />

- Bigger th<strong>an</strong> AW: request on one form<br />

• End User network<br />

• their equipment, their location (usually more th<strong>an</strong> four IPs)<br />

- Within AW: assignment <strong>an</strong>d inetnum for each End<br />

User<br />

- Bigger th<strong>an</strong> AW: one request form for each End User<br />

<strong>LIR</strong> Training Course Spring 2007<br />

http://www.ripe.net 56


Object Created but Invalid<br />

(for End User or <strong>LIR</strong>’s infrastructure)<br />

• RIPE Database syntax checks passed, but…<br />

• Assignment not valid if inetnum :<br />

- Bigger th<strong>an</strong> AW, but not approved by the RIPE NCC<br />

- Overlapping<br />

- Not separate for separate org<strong>an</strong><strong>is</strong>ations<br />

• Invalid assignments<br />

- delay AW increase, additional allocations<br />

- cause extra work<br />

<strong>LIR</strong> Training Course Spring 2007<br />

http://www.ripe.net 57


When Is the AW Ra<strong>is</strong>ed ?<br />

• Correct requests<br />

• Policies applied<br />

• Valid DB objects<br />

• AW = average size of requests<br />

• If you w<strong>an</strong>t the AW ra<strong>is</strong>ed<br />

- approach RIPE NCC: <br />

<strong>LIR</strong> Training Course Spring 2007<br />

http://www.ripe.net 58


Assignment Window: Learning Points<br />

• New <strong>LIR</strong>: AW=0<br />

• Assignment > AW: send request for approval<br />

• Assignment < AW: evaluate & assign yourself<br />

Questions?<br />

<strong>LIR</strong> Training Course<br />

Spring 2007<br />

http://www.ripe.net<br />

59


6. M<strong>an</strong>aging Allocations<br />

• Choosing the address r<strong>an</strong>ge<br />

• M<strong>an</strong>aging RIPE Database data<br />

• Requesting new allocation<br />

<strong>LIR</strong> Training Course<br />

Spring 2007<br />

http://www.ripe.net<br />

60


Grouping <strong>an</strong>d Splitting<br />

• Grouping assignments<br />

- Per service, location, customer size ?<br />

- Fragmentation ?<br />

• Splitting your allocation<br />

-status: SUB-ALLOCATED PA<br />

-status: <strong>LIR</strong>-PARTITIONED<br />

Customers<br />

20%<br />

<strong>LIR</strong> Training Course Spring 2007<br />

Infrastructure<br />

POP 1 POP2<br />

p<br />

2<br />

p<br />

loops<br />

http://www.ripe.net 61


Sub-allocation Policy<br />

• From <strong>LIR</strong> to Downstream ISP<br />

- No approval needed<br />

• Up to four times AW<br />

- For each Downstream ISP within 12 months<br />

- Minimum /24; maximum /20<br />

• <strong>LIR</strong> reg<strong>is</strong>ters inetnum<br />

- Use Downstream ISP’s maintainer in “mnt-lower:”<br />

• Assignments from sub-allocations<br />

– AW rules also apply<br />

<strong>LIR</strong> Training Course Spring 2007<br />

http://www.ripe.net 62


Using Sub-allocation<br />

BlueLight’s Allocation<br />

Sub-allocation for<br />

ISP INOX <strong>an</strong>d<br />

all its (future)<br />

customers<br />

INOX makes assignments for its own<br />

infrastructure <strong>an</strong>d for its End Users from<br />

its sub-allocation<br />

<strong>LIR</strong> Training Course Spring 2007<br />

status: ALLOCATED PA<br />

status: SUB-ALLOCATED PA<br />

status: ASSIGNED PA<br />

http://www.ripe.net 63


Finding Assignments<br />

• RIPE DB: hierarchical (-m, -M, -l, -L)<br />

- More & less specific address r<strong>an</strong>ges<br />

- Grouped by relev<strong>an</strong>ce (to group by type: use “-G”)<br />

• Email addresses in objects filtered<br />

- Use “-B” to show whole object<br />

• Not interested in person objects?<br />

- Use non-recursive lookup (“-r”)<br />

- Prevents being blocked for too m<strong>an</strong>y person object queries<br />

• Limiting search to inetnums?<br />

“-T inetnum”<br />

• Inverse lookups (-i)<br />

<strong>LIR</strong> Training Course Spring 2007<br />

http://www.ripe.net 64


Need New IPv4 Allocation?<br />

• 80% used (assigned <strong>an</strong>d sub-allocated)?<br />

- Or: large request pending<br />

• Assignment Window used correctly?<br />

- have documentation about assignments?<br />

- approved assignments still valid?<br />

• Correct RIPE Database objects?<br />

• Tools: asused <strong>an</strong>d “Web Asused”<br />

<strong>LIR</strong> Training Course Spring 2007<br />

http://www.ripe.net 65


Correcting Invalid Objects<br />

• Larger th<strong>an</strong> AW, but not requested?<br />

- Send request for approval<br />

• <strong>an</strong>d update the “ch<strong>an</strong>ged:” line date<br />

• Not-matching approved “netname:”?<br />

- Ask to update the Reg file<br />

• “Subject:” original “ticket number”<br />

• “Ch<strong>an</strong>ged:” line date before the approval date?<br />

- Update the "ch<strong>an</strong>ged:" line date<br />

• Overlaps? Delete wrong inetnum<br />

• Assignment no longer in use?<br />

- Inform <br />

• “Subject:” original “ticket number”<br />

- Delete the inetnum<br />

<strong>LIR</strong> Training Course Spring 2007<br />

http://www.ripe.net 66


Making New IPv4 Allocation<br />

• Incons<strong>is</strong>tencies?<br />

- <strong>LIR</strong> corrects data / agrees on deadline<br />

- RIPE NCC reviews AW<br />

• RIPE NCC allocates new block<br />

- <strong>an</strong>d creates allocation inetnum<br />

- Size depends on previous usage rate<br />

• <strong>LIR</strong> c<strong>an</strong> start <strong>an</strong>nouncing the whole new prefix<br />

- As one aggregate<br />

- <strong>LIR</strong> creates route object<br />

<strong>LIR</strong> Training Course Spring 2007<br />

http://www.ripe.net 67


M<strong>an</strong>aging Allocations: Learning Points<br />

• Choose the r<strong>an</strong>ge carefully<br />

• Keep the RIPE Database tidy<br />

• “asused”<br />

Questions?<br />

<strong>LIR</strong> Training Course<br />

Spring 2007<br />

http://www.ripe.net<br />

68


7. PI Address Space<br />

• Definition<br />

• Requesting<br />

• Responsibilities<br />

<strong>LIR</strong> Training Course<br />

Spring 2007<br />

http://www.ripe.net<br />

69


PA versus PI Assignments<br />

• Provider Aggregatable assignments<br />

- <strong>LIR</strong> assigns to End User<br />

- Must renumber when ch<strong>an</strong>ging providers<br />

- Only way to effectively scale the Internet!<br />

• Provider Independent assignments<br />

- RIPE NCC assigns to End User<br />

- Portable<br />

- C<strong>an</strong> be difficult to route<br />

- Next assignment not aggregatable<br />

- Affects yearly fee<br />

- Increases size of the routing tables<br />

<strong>LIR</strong> Training Course Spring 2007<br />

http://www.ripe.net 70


Requesting PI Space<br />

• Explain consequences to End User<br />

• Create RIPE Database objects<br />

-person/role, mntner, org<strong>an</strong><strong>is</strong>ation<br />

• Send request on behalf of End User<br />

- <strong>LIR</strong> Portal,<br />

- or “PI Assignment Request Form”<br />

<strong>LIR</strong> Training Course Spring 2007<br />

http://www.ripe.net 71


Evaluation of PI requests<br />

• Additional questions<br />

- Why does End User w<strong>an</strong>t PI (<strong>an</strong>d not PA)?<br />

- Requesting extra address space for routing?<br />

- Aware of consequences?<br />

• Same criteria as for PA assignments<br />

- Conservative estimates<br />

- Classless<br />

• Assignment <strong>is</strong> only valid as long as original criteria<br />

remain valid<br />

<strong>LIR</strong> Training Course Spring 2007<br />

http://www.ripe.net 72


PI Responsibilities<br />

• RIPE NCC<br />

- Assigns to End User<br />

- Creates inetnum<br />

• <strong>LIR</strong><br />

- Makes contracts with End Users<br />

- Helps End Users with reverse DNS, route objects<br />

- Helps End Users if ch<strong>an</strong>ging provider<br />

• End User<br />

- Maintains objects<br />

- Must not assign further<br />

<strong>LIR</strong> Training Course Spring 2007<br />

http://www.ripe.net 73


PI Address Space: Learning Points<br />

• PA recommended<br />

• <strong>LIR</strong> requests PI space for End User<br />

• Shared responsibilities<br />

Questions?<br />

<strong>LIR</strong> Training Course<br />

Spring 2007<br />

http://www.ripe.net<br />

74


8. IPv6 Address Space<br />

• Definition<br />

• Requesting<br />

<strong>LIR</strong> Training Course<br />

Spring 2007<br />

http://www.ripe.net<br />

75


First IPv6 Allocation<br />

• If you<br />

- a) are <strong>an</strong> <strong>LIR</strong><br />

- b) not <strong>an</strong> End Site<br />

- c) pl<strong>an</strong> to provide IPv6 connectivity to aggregated<br />

‘customers’, who are assigned /48s<br />

- d) pl<strong>an</strong> to assign 200 /48s within two years<br />

• Send us “IPv6 first allocation request form”<br />

• Minimum initial allocation size /32<br />

– Assignment policy being d<strong>is</strong>cussed<br />

<strong>LIR</strong> Training Course Spring 2007<br />

http://www.ripe.net 76


IPv6 Assignments<br />

• Usual assignment size - /48 for each “site”<br />

- End User network<br />

- <strong>LIR</strong> infrastructure (per PoP)<br />

- No approval needed<br />

• Smaller size<br />

- /64 just one subnet<br />

- /128 just one device<br />

• Multiple /48 for very large End Users<br />

- Approval needed<br />

<strong>LIR</strong> Training Course Spring 2007<br />

http://www.ripe.net 77


New IPv6 Allocation<br />

• HD ratio = 0.8 usage of previous allocation<br />

- 7132 /48s assignments in a /32<br />

• Correct reg<strong>is</strong>trations (all /48s reg<strong>is</strong>tered)<br />

• New allocation’s size: the same as the first<br />

- Resulting in IPv6 prefix one bit shorter<br />

- Or bigger if justified (sufficient for two years)<br />

<strong>LIR</strong> Training Course Spring 2007<br />

http://www.ripe.net 78


3<br />

IPv6 Format<br />

/23<br />

16 bits<br />

16 bits<br />

/32 /48 /64<br />

<strong>LIR</strong> Training Course Spring 2007<br />

64 bits<br />

/128<br />

http://www.ripe.net 79


IPv6 Address Space: Learning Points<br />

• Allocation<br />

• Assignment<br />

Questions?<br />

<strong>LIR</strong> Training Course<br />

Spring 2007<br />

http://www.ripe.net<br />

80


9. Reverse DNS<br />

• Definition<br />

• Domain objects<br />

• Requesting<br />

<strong>LIR</strong> Training Course<br />

Spring 2007<br />

http://www.ripe.net<br />

81


Why Reverse DNS?<br />

• Mapping IP numbers to domain names<br />

• Needed for applications (mail, IRC, ftp)<br />

- Troubleshooting (traceroute)<br />

• <strong>LIR</strong>’s responsibility<br />

<strong>LIR</strong> Training Course Spring 2007<br />

http://www.ripe.net 82


inet(6)num <strong>an</strong>d domain Objects<br />

inet6num: 2001:0888::/32<br />

status: ALLOCATED-BY-RIR<br />

mnt-by: RIPE-NCC-HM-MNT<br />

mnt-domains: <strong>LIR</strong>-MNT<br />

domain: 8.8.8.0.1.0.0.2.ip6.arpa<br />

mnt-by: <strong>LIR</strong>-MNT<br />

inetnum: 85.118.190.0/24<br />

status: ASSIGNED PA<br />

mnt-by: <strong>LIR</strong>-MNT<br />

mnt-domains: END-USER-MNT<br />

domain: 190.118.85.in-addr.arpa<br />

mnt-by: END-USER-MNT<br />

<strong>LIR</strong> Training Course Spring 2007<br />

http://www.ripe.net 83


Preparations<br />

• Decide on the address r<strong>an</strong>ge<br />

- Whole allocation? Assignment?<br />

- IPv4: One or more /24, /16<br />

- IPv6: One or more /36, /32<br />

• Decide who will be responsible<br />

- <strong>LIR</strong>?<br />

- End User? (create mntner)<br />

• Allow hierarchical author<strong>is</strong>ation<br />

- Add appropriate mntner in the “mnt-domains:” of<br />

the inetnum object<br />

<strong>LIR</strong> Training Course Spring 2007<br />

http://www.ripe.net 84


Set-up & Request<br />

• Configure DNS server for chosen zones<br />

- RFC 1912, RFC 2182<br />

• Find the secondary server<br />

- ns.ripe.net m<strong>an</strong>datory for IPv4 /16<br />

• Request = submit domain object to RIPE DB<br />

nserver: ns.bluelight.nl<br />

nserver: ns2.pinklight.de<br />

<strong>LIR</strong> Training Course Spring 2007<br />

http://www.ripe.net 85


<strong>What</strong> Will Be Checked<br />

1. RIPE Database syntax<br />

2. Authentication<br />

- “mnt-domains:” in corresponding inetnum<br />

<strong>an</strong>d<br />

- “mnt-by:” in domain<br />

3. Name servers setup<br />

• Errors / warnings: ask <br />

• Success: RIPE NCC updates parent zone<br />

<strong>LIR</strong> Training Course Spring 2007<br />

http://www.ripe.net 86


Sizes Other th<strong>an</strong> /24<br />

• Multiple /24 delegations<br />

- C<strong>an</strong> be requested as one domain object<br />

- Use “shorth<strong>an</strong>d” notation for consecutive zones<br />

- Broken down & then reg<strong>is</strong>tered as multiple objects<br />

• Smaller th<strong>an</strong> /24 delegation<br />

- End User c<strong>an</strong> run own primary nameserver<br />

- <strong>LIR</strong> requests delegation for whole /24<br />

- <strong>LIR</strong> uses CNAME (RFC 2317)<br />

- Reverse DNS for PI addresses done by the RIPE NCC<br />

<strong>LIR</strong> Training Course Spring 2007<br />

http://www.ripe.net 87


Reverse DNS: Learning Points<br />

• Import<strong>an</strong>t service to End Users<br />

• Whole allocation in one go<br />

• Request = RIPE Database domain object<br />

Questions?<br />

<strong>LIR</strong> Training Course<br />

Spring 2007<br />

http://www.ripe.net<br />

88


10. Autonomous System Numbers<br />

• ASN<br />

• requesting<br />

• route object<br />

<strong>LIR</strong> Training Course<br />

Spring 2007<br />

http://www.ripe.net<br />

89


Autonomous System<br />

• RFC 1930:<br />

- “An AS <strong>is</strong> a connected group of … IP prefixes … which<br />

has a single <strong>an</strong>d clearly defined routing policy.”<br />

• <strong>LIR</strong> c<strong>an</strong> request <strong>an</strong> ASN<br />

- For own network, or for <strong>an</strong>other org<strong>an</strong><strong>is</strong>ation<br />

• Assignment criteria: multihomed<br />

- Unique routing policy<br />

- E-mail addresses of peers<br />

<strong>LIR</strong> Training Course Spring 2007<br />

http://www.ripe.net 90


Multihomed Routing Policy<br />

First Peer<br />

AS64512<br />

ASNEW<br />

<strong>LIR</strong> Training Course Spring 2007<br />

Second Peer<br />

AS64513<br />

http://www.ripe.net 91


aut-num in ASN Request Form<br />

aut-num: ASNEW<br />

as-name: Bluelight-ASN<br />

<br />

descr: <br />

org: <br />

import: <br />

export: to <br />

import: from <br />

export: to <br />

[... ]<br />

<strong>LIR</strong> Training Course Spring 2007<br />

http://www.ripe.net 92


aut-num Object<br />

• RIPE NCC creates aut-num object<br />

-mnt-by: <strong>LIR</strong>-MNT<br />

-mnt-routes: End-User-MNT (or <strong>LIR</strong>)<br />

-org: “of whoever uses the ASN”<br />

• When the peering <strong>is</strong> establ<strong>is</strong>hed, <strong>LIR</strong> should<br />

update routing policy<br />

• AS Number assignment <strong>is</strong> only valid as long as<br />

the original criteria remain valid<br />

<strong>LIR</strong> Training Course Spring 2007<br />

http://www.ripe.net 93


32 Bit AS Numbers<br />

• Problem: no more AS numbers available in 2012<br />

- Solution: 32 bit AS numbers<br />

• 2007-2008: 16 bit AS default, 32 bit AS on request<br />

• in 2009: 32 bit AS default, 16 bit AS on request<br />

• as of 2010: Only 32 bit AS numbers<br />

• Don’t wait until 2009!<br />

- C<strong>an</strong> you h<strong>an</strong>dle your new AS 1.5432 ?<br />

<strong>LIR</strong> Training Course Spring 2007<br />

http://www.ripe.net 94


oute Object<br />

• route objects: part of Routing Reg<strong>is</strong>try<br />

• <strong>LIR</strong> creates route/route6 objects for <strong>an</strong>y<br />

(new) allocations they <strong>an</strong>nounce<br />

- Both “route:” <strong>an</strong>d “origin:” are primary key<br />

- Complex hierarchical author<strong>is</strong>ation for creation<br />

- Used for prefix filtering by some ISPs<br />

<strong>LIR</strong> Training Course Spring 2007<br />

http://www.ripe.net 95


ASN: Learning Points<br />

• If you w<strong>an</strong>t to be multihomed<br />

• Describe your routing policy<br />

• Route object recommended<br />

Questions?<br />

<strong>LIR</strong> Training Course<br />

Spring 2007<br />

http://www.ripe.net<br />

96


11. RIPE <strong>an</strong>d<br />

Policy Development Process<br />

• RIPE<br />

• PDP<br />

• Participation<br />

<strong>LIR</strong> Training Course<br />

Spring 2007<br />

http://www.ripe.net<br />

97


How RIPE Works<br />

• Open forum<br />

• Voluntary participation<br />

• Dec<strong>is</strong>ions by consensus<br />

• Working groups<br />

• Not a legal entity<br />

• Does not develop Internet st<strong>an</strong>dards<br />

• RIPE chair: <br />

• <br />

<strong>LIR</strong> Training Course Spring 2007<br />

http://www.ripe.net 98


Come to the RIPE Meetings!<br />

• Two in a year / a week long<br />

• 300+ particip<strong>an</strong>ts<br />

• Working group meetings<br />

• Plenary<br />

• RIPE NCC Services Centre<br />

• Long breaks / social events<br />

• 2 free tokens for new <strong>LIR</strong>s<br />

• Remote participation: webcast, jabber / irc<br />

• <br />

<strong>LIR</strong> Training Course Spring 2007<br />

http://www.ripe.net 99


Bottom-up Process<br />

<strong>LIR</strong> Training Course Spring 2007<br />

http://www.ripe.net 100


Policy Development Process<br />

• Proposal (from <strong>an</strong>yone)<br />

• D<strong>is</strong>cussion in working group (WG)<br />

• Review by WG<br />

- Consensus? Chair <strong>an</strong>nounces dec<strong>is</strong>ion<br />

• Concluding phase<br />

- last call for comments<br />

<strong>LIR</strong> Training Course Spring 2007<br />

http://www.ripe.net 101


Your Participation <strong>is</strong> Needed!<br />

• <strong>What</strong> c<strong>an</strong> you do?<br />

- propose new policy<br />

• we c<strong>an</strong> help to draft it<br />

• RIPE NCC Policy Development Officer <strong>is</strong> your contact<br />

• filiz@ripe.net<br />

- comment on other proposals<br />

- check the drafts & recent ch<strong>an</strong>ges web page<br />

<strong>LIR</strong> Training Course Spring 2007<br />

http://www.ripe.net 102


Your Participation <strong>is</strong> Needed (2)<br />

• How to take part?<br />

- subscribe to mailing l<strong>is</strong>ts<br />

- come to the meetings<br />

• watch webcast <strong>an</strong>d use jabber / irc<br />

<strong>LIR</strong> Training Course Spring 2007<br />

http://www.ripe.net 103


Global IPv4 Usage, in /8s<br />

Available, 49<br />

~ 19%<br />

Public reserved, 1<br />

AfriNIC, 1<br />

Multicast, 16<br />

Experimental, 16<br />

LACNIC, 4<br />

APNIC, 24<br />

ARIN, 27<br />

<strong>LIR</strong> Training Course Spring 2007<br />

Private reserved, 1<br />

Central Reg<strong>is</strong>try, 94<br />

RIPE NCC, 22<br />

Source: http://www.potaroo.net/<br />

http://www.ripe.net 104


Growth of Global Routing Table<br />

Projected routing table<br />

growth without CIDR<br />

<strong>LIR</strong> Training Course Spring 2007<br />

Rapid growth due to<br />

Large number of longer<br />

prefixes <strong>an</strong>nounced<br />

Deployment<br />

Period of CIDR<br />

But the routing<br />

table still grows<br />

ISPs<br />

tend to<br />

filter<br />

longer<br />

prefixes<br />

CIDR made it work for a while<br />

last updated 27 J<strong>an</strong>uary 2005<br />

http://www.ripe.net 105


RIPE & PDP: Learning Points<br />

• RIPE <strong>is</strong> not the RIPE NCC<br />

• You c<strong>an</strong> influence RIPE policies<br />

• Join the d<strong>is</strong>cussions<br />

Questions?<br />

<strong>LIR</strong> Training Course<br />

Spring 2007<br />

http://www.ripe.net<br />

106


<strong>LIR</strong> Training Course: Summary<br />

<strong>LIR</strong> Training Course<br />

Spring 2007<br />

http://www.ripe.net<br />

107


Do You W<strong>an</strong>t to Host<br />

RIPE NCC Training Courses?<br />

• You will provide:<br />

- Location with lunch facilities<br />

- High speed Internet connection<br />

• The RIPE NCC will:<br />

- Provide the Training Course<br />

- Announce the Training Course at your location<br />

- Reg<strong>is</strong>ter the attendees<br />

- Send the training material to your location<br />

• The RIPE NCC will pay for:<br />

- Catering (Food <strong>an</strong>d drink)<br />

- Travel <strong>an</strong>d accommodation for the RIPE NCC trainers<br />

- Shipping the training material<br />

• http://www.ripe.net/training/hosting.html<br />

<strong>LIR</strong> Training Course Spring 2007<br />

http://www.ripe.net 108


The End!<br />

ﺔﻳﺎﻬﻨﻟا<br />

Konec<br />

Lõpp<br />

Fine<br />

Fim<br />

Einde<br />

Kraj<br />

ף וסה<br />

დასასრული<br />

Соңы<br />

Ende<br />

Vége<br />

Endir<br />

Kрай<br />

<strong>LIR</strong> Training Course Spring 2007<br />

Վերջ Fí<br />

Son<br />

Fund<br />

Sfârşit<br />

Конeц<br />

Pabaiga<br />

Liðugt<br />

An Críoch<br />

Slut<br />

نﺎﻳﺎﭘ<br />

Fin<br />

Amaia Loppu<br />

Tmiem<br />

Y Diwedd<br />

Fin<strong>is</strong><br />

Kiнець<br />

Slutt<br />

Kpaj<br />

Τέλος<br />

Koniec<br />

http://www.ripe.net 109

Hooray! Your file is uploaded and ready to be published.

Saved successfully!

Ooh no, something went wrong!