October 2007 - address-policy-wg

2007-08 New Policy Proposal (Enabling Methods for Reallocation of IPv4 Resources)
by Filiz Yilmaz 12 Nov '07

12 Nov '07

PDP Number: 2007-08 Enabling Methods for Reallocation of IPv4 Resources Dear Colleagues, A new RIPE Policy Proposal has been made and is now available for discussion. This proposal outlines a framework to migrate previously allocated IPv4 resources from one Local Internet Registry (LIR) to another LIR within the RIPE NCC Service Region. You can find the full proposal at: http://www.ripe.net/ripe/policies/proposals/2007-08.html We encourage you to review this proposal and send your comments to <address-policy-wg(a)ripe.net> before 20 November 2007. Regards Filiz Yilmaz RIPE NCC Policy Development Officer

14 24

Commercial IPv6 firewall support
by michael.dillon＠bt.com 07 Nov '07

07 Nov '07

Some people have claimed that they cannot yet sell IPv6 Internet access because there is no IPv6 firewall support. According to this ICANN study: http://www.icann.org/committees/security/sac021.pdf this is not quite true. At least 30% of the 42 vendors surveyed, had IPv6 support. According to this talk <http://www.guug.de/veranstaltungen/ecai6-2007/slides/2007-ECA-I6-Status -IPv6-Firewalling-PeterBieringer-Talk.pdf> many open-source and commercial firewalls supporting IPv6 are available. IPCop is based on Linux <http://www.ipcop.org/index.php?module=pnWikka&tag=IPCopScreenshots> m0n0wall is based on FreeBSD <http://m0n0.ch/wall/screenshots.php> pfSense is also based on FreeBSD <http://pfsense.com/index.php?id=26> FWBuilder is a management tool that builds filter setups for several different firewalls. <http://www.fwbuilder.org/archives/cat_screenshots.html> Checkpoint FW1 NGX R65 on SecurePlatform supports IPv6 FortiGate supports IPv6 in FortiOS 3.0 and up. Juniper SSG (formerly Netscreen) supports IPv6 in ScreenOS 6.0 and up. Cisco ASA (formerly PIX) supports IPv6 in version 7.0 and up. I suspect that the people complaining about IPv6 support are partially complaining because they have older hardware that the vendor does not plan to upgrade to IPv6 support until they have all features implemented in their newer products, and partially complaining because their vendor has not implemented some feature which they happen to use. Commercial firewall support may be lagging behind OS and router support, but not by much. And if commercial vendors are not responsive, maybe you should try pricing out an open source solution with a consultant. I believe there is a gap here that startup firewall companies could fill if they understand the enterprise market. --Michael Dillon

3 3

RE: [address-policy-wg] 2007-08 New Policy Proposal (Enabling Methods for Reallocation of IPv4 Resources)
by Tim Streater 03 Nov '07

03 Nov '07

At 15:14 29/10/2007, Mark Pace Balzan wrote: > > > > IPv6 Internet is working even now, but completely useless. Because of > > there is no resources at all. > > > > In my opinion, the concrete goal is make 51% of _resources_ > > (not users) > > to be reachable through IPv6 before we run out of IPv4. If it > > succeeds, > > other 49% will go with "the majority", if not - IPv6 migration > > completely fails and something other (NAT, secondary market of IPv4, > > higher level proxies over non-IP protocols, ...) will be implemented > > instead. > > > >my 2c worth: > >v4 and v6 will co-exist for a while, whether we like it or not, and >therefore v4 and v6 stuff will need a way to get to each other depending >on the service at hand. They will co-exist for a long while due to lack of pressure from the users. If v4 really runs out, there will start to be some parts of the Internet that are not accessible to some users. Then they will complain to their ISP and something starts to happen. Then it gets in the mainstream press, at which point you may see a more rapid transition. Plenty of people will however say, why should I bother to get a new xxx box when I can reach all sites I care about. Unless the govts get involved, of course. -- Tim

7 10

Policy proposal - Cooperative distribution of the end of the IPv4 free pool.
by Tony Hain 31 Oct '07

31 Oct '07

Policy Proposal Name: Cooperative distribution of the end of the IPv4 free pool. Author name: Tony Hain email: alh-ietf(a)tndh.net telephone: +1-425-468-1061 organization: Cisco Systems Proposal Version: 1.0 Submission Date: Oct-30-2007 Proposal type: new Policy term: permanent Policy summary: This policy will establish a process for RIR-to-RIR redistribution of the tail-end of the IPv4 pool, taking effect after the IANA Reserve is exhausted. Each redistribution Allocation will be triggered by the recipient RIR depleting its reserve to a 30 day supply, and will result in up to a 3 month supply being transferred from the RIR with the longest remaining time before it exhausts its own pool. Policy statement: At the point when any given RIR is within 30 days of depleting its remaining IPv4 pool, a survey will be taken of the other 4 to determine the remaining time before each of them exhausts their pool (including both member use and recent redistribution allocations to other RIRs). The one with the longest window before exhausting its pool will be designated as the source RIR. The recipient RIR will follow procedures for an LIR in the source RIR region to request a block that is expected to be sufficient for up to 3 months, but is no larger than 1/8th of the source RIR's remaining pool. At the point where no RIR can supply a block that is less than 1/8th of their remaining pool that will sustain the recipient RIR for 30 days, the recipient RIR will collect its requests each week, and forward those individual requests to the source RIR designated that week. Rationale: This policy will establish a mechanism for the Allocation of IPv4 address blocks between RIR's, but will not go into effect until the IANA pool has been depleted. It is really bizarre to watch the maneuvering as the global RIR community grapples with 'fairness' of distributing the last few IANA Reserve /8 blocks. On one level this just appears to be petty sibling rivalry, as people are bickering over who gets the last cookie and whimpering about 'fairness'. At the same time, each RIR is chartered to look after the interests of its membership so it is to be expected that they will each want to get as much as possible to meet the needs of their respective membership. Existing practice requires RIR's to acquire blocks from IANA, which leads to the current round of nonsense about optimal distribution of the remaining pool based on elaborate mathematical models. This globally submitted policy proposal attempts to resolve the issue by shifting to an RIR-to-RIR Allocation model after the IANA pool is depleted. This policy would effectively result in each RIR becoming a virtual LIR member of all of the other RIR's for the sole purpose of managing the tail-end of the IPv4 pool. Timetable for implementation: Before 1/1/2009

5 4

RE: [address-policy-wg] 2007-08 New Policy Proposal (Enabling Methods for Reallocation of IPv4 Resources)
by Niall Murphy 31 Oct '07

31 Oct '07

Michael, all, > > The address space in question is already allocated, hence > > unavailable. The question is how to incent folks to put > > their "allocated but unused" address space back into play. > > Stamping your foot and declaring "markets are bad" > > isn't likely to be too helpful. > And thinking that you can influence address-holders decision making > without pricing an IPv4 at several hundred thousand dollars, is also not > likely to be too helpful. I don't think that anyone knows how the pricing is going to work yet, so I'm going to leave aside discussion of your specific figure. Similarly, "an IPv4" (an IPv4 what?) probably needs clarification, but it's not the substantive issue. Notwithstanding the detail of the numbers, which is obviously a crucial detail, I have to take issue with your assertion is that we cannot influence address-holder decision making without setting a price, and setting it high. The fact is, after IPv4 exhaustion we will still need IPv4 addresses. Address holders who have more IPv4 addresses than they will ever use will have a strong incentive to exchange those addresses for money, and IPv4-dependent organisations will have a strong incentive to purchase them. That's going to happen, make no mistake, because as an industry, we are *nowhere near* where we need to be in order to have an IPv6 world by 2010. So, there's already no question of address holders being uninfluenced. They certainly will be by 2010, if they're not already, and such pricing as emerges in a back-door market does not have to be high in order to provoke the release of addresses in an ad-hoc fashion. It's entirely plausible that a steady drip-feed of low-priced prefixes would suit many organisations better than holding on for higher prices (think cashflow, for example). For these and other reasons, there'll be no question of, for example, the RIR system being frustrated in its attempt to influence address-holders because of too low a price. The danger is not the RIR system and is not the market; the danger is the unregulated market, and the chaos of the current post-exhaustion scenario. > Any organization who contemplates selling a block of IPv4 addresses has > to conside the reality that it would be an extremely constrained market > where the supply is going down and they are not making any new IPv4 > addresses. Indeed - that's exactly right, and that's one of the reasons why it's such a powerful incentive to move to IPv6, which is, IIUYC, where we both want to be. But you must also consider that such a market as we proposed is not intended to be *the* solution: it is explicitly not for continually recycling existing prefixes. It is to provide liquidity to the participants for an undefined period until IPv6 is a workable day-to-day alternative to IPv4. So the fact that the market is constrained *doesn't matter* in the long term - we're inventing our way out of scarcity elsewhere. > This means that if you do sell, and then discover that you > needed those addresses after all, the price to buy them back could be > substantially higher than your sale price. In the face of continually > rising prices, it is risky to sell any addresses at all, unless you are > absolutely certain, at the CEO/board level, that the addresses are not > needed, or if the price that you would receive is at least several > hundred thousand dollars. (Again, I'm not going to talk about the figures here, but that's not a central point in your argument.) If I parse what you're saying correctly, you posit that the danger of accidentally selling addresses that it turns out that you'll need will motivate people to stay away from the market, and therefore cause rising prices and liquidity problems. Well, my argument would be that from an economic point of view, organisations are incentivized to only sell what they explicitly don't need. We all know of organisations that have much more spare than they could possibly use, so it's unclear where the original 'dump everything' motivation could come from. Furthermore, the meta-assertion that "a market might have problems" reinforces the fact that the community *must keep transfers where it can see them*. If they are happening out of sight, we have no direction observation or control of the same set of problems. > This is a recipe for a gold-rush style market followed by liquidity > collapse which will have additional knock-on effects in the real > markets, i.e. share prices. If you watch our talk webcast (when RIPE gets around to putting them up) you'll see more details of our argument here, but in brief the dangers of *not* having a realistic plan in place will cause as much damage to stock prices etc as much as leaving things alone will. I'm in sympathy with you on the topic of avoiding gold-rush markets and liquidity collapses, but I think with a bit of careful planning, we'll be able to avoid both. (If only we'd had that careful planning years ago, then we could have saved ourselves a lot of trouble. But now we're in the position of having no wholly good choices, it's only a question of choosing which set of bad effects we want.) Niall

1 0

Re: [address-policy-wg] Commercial IPv6 firewall support
by jwkckid1＠ix.netcom.com 29 Oct '07

29 Oct '07

Nick and all, Chiming in here as a kinda unusual occurance. I agree with Nicks assessment here unfortunately. Seems across a broad business spectrum a disinterest in IPv6 remains or presists. Given, what I believe to be an accurate essesment by Nick below, it would seem that a more concerted effort to make IPv6 more palatable in very short order is advisable. As to how to accomplish that, I do not know. -----Original Message----- >From: Nick Hilliard <nick(a)inex.ie> >Sent: Oct 27, 2007 9:25 AM >To: michael.dillon(a)bt.com >Cc: address-policy-wg(a)ripe.net, ipv6-wg(a)ripe.net >Subject: Re: [address-policy-wg] Commercial IPv6 firewall support > >> Some people have claimed that they cannot yet sell >> IPv6 Internet access because there is no IPv6 firewall >> support. According to this ICANN study: >> http://www.icann.org/committees/security/sac021.pdf >> this is not quite true. At least 30% of the 42 vendors >> surveyed, had IPv6 support. > >There is, of course, "support" and support when talking about any feature, >whether ipv6 related or not. > >As a useful example of what "support" implies, the "support" from one of my >firewall vendors includes basic support for ipv6 packet forwarding and >filtering, but no support for configuring this from the GUI. And no support >for failover / failback on ipv6. And no support for ospfv3. Or DHCPv6. Or >v6 support for VPNs. And so on - you get the idea. There are piles more >features which just aren't there if you use v6. In fact, I would suggest >that there is such a large functionality gap between their ipv4 and ipv6 >support right now, that even if they invested heavily between now and the >current expected dates for ipv4 exhaustion, I seriously doubt that they >would achieve feature parity, not to mind stability parity for these >features. > >I have talked to them about this, and their opinion is that there is no >commercial demand for ipv6, and therefore ipv6 feature parity is on the >feature roadmap. And indeed, it is difficult for the organisation I work >for to demand ipv6 support, when other companies can talk to their vendors >with a EUR100m firewall / networking contract going a-begging. I have >little doubt that this is the reason that MOP got re-enabled by default on a >certain router vendor's products. > > >Them: "We have EUR200m to spend and we want MOP enabled by default". >Vendor: "Three bags full, sir". > >Me: "I want to you spend $50m in development costs to support ipv6, and > then i'll buy some low end kit from you" >Vendor: <laughs hysterically> > >Open source solutions tend to fare better in this regard. Lots of people >may end up using them in a future ipv6 world, but you're not going to end up >seeing F500 companies stampeding to replace their current high-end solutions >with m0n0wall installations, just because they have more-or-less parity >support for ipv4 and ipv6. > >There's a more interesting discussion of this of this linked from: > >http://www.arin.net/meetings/minutes/ARIN_XX/ppm.html > >See the talk entitled "IPv6 Support Among Commercial Firewalls", by Dave >Piscitello. > >Nick > >-- >Network Ability Ltd. | Technical Operations | Tel: +353 1 6169698 >3 Westland Square | INEX - Internet Neutral | Fax: +353 1 6041981 >Dublin 2, Ireland | Exchange Association | Email: nick(a)inex.ie > 'Regards, Jeffrey A. Williams Spokesman for INEGroup LLA. - (Over 277k members/stakeholders strong!) "Obedience of the law is the greatest freedom" - Abraham Lincoln "Credit should go with the performance of duty and not with what is very often the accident of glory" - Theodore Roosevelt "If the probability be called P; the injury, L; and the burden, B; liability depends upon whether B is less than L multiplied by P: i.e., whether B is less than PL." United States v. Carroll Towing (159 F.2d 169 [2d Cir. 1947] =============================================================== Updated 1/26/04 CSO/DIR. Internet Network Eng. SR. Eng. Network data security IDNS. div. of Information Network Eng. INEG. INC. ABA member in good standing member ID 01257402 E-Mail jwkckid1(a)ix.netcom.com

1 0

ASO AC Elections: Hans Petter Holen Elected - Correction
by Axel Pawlik 25 Oct '07

25 Oct '07

Dear Colleagues, Hans Petter Holen will serve on the Address Supporting Organization (ASO) Address Council (AC) for three years and not two years as stated in the previous e-mail that you received. We apologise for any confusion. Kind regards, Axel Pawlik Managing Director RIPE NCC

1 0

RIPE Community Resolution on IPv4 Depletion and Deployment of IPv6
by JORDI PALET MARTINEZ 25 Oct '07

25 Oct '07

I don't think my comment was well understood today in the session, so I drafted how I think the community resolution should look. See below. English nits should be reviewed, but the main idea is that we start with a short kind of intro of the situation (those points from the original 5 that are generic), staying focus, keeping it short, but at the same time help each "kind of reader" to identify what is the paragraph that is *more* relevant to him. I also added a specific action for policy makers/regulators and one for users. I hope that, as very few people (in the list and session) has provided input on this, we are allowed to participate in the final drafting of the document. Not being a big group is possible to do it, as otherwise, will not really be a community resolution. Regards, Jordi At current allocation rates, the remaining pool of unallocated IPv4 address space is likely to be allocated within the next two to four years. Although the Internet will continue to function as normal after this point, this event will have a significant influence on future network operations as well as IP address management and allocation policies. Therefore we recognise that the widespread deployment of IPv6 will be essential to sustain future growth of the Internet. We recognise that the responsibility for creating policies related to the management of critical Internet resources in the RIPE NCC service region rests with the RIPE community and the proven success of the RIPE Policy Development Process (PDP). In recognition of this responsibility, we commit to continue development of effective policies for the responsible management of IPv4 and IPv6 address space. We agree that this situation requires a committed effort from network operators, ISPs and the RIPE community. We urge that the widespread deployment of IPv6 be made a high priority. In addition to that, other sectors must take their own measures in order to success on this mission: 1) Network operators and Internet Service Providers (ISPs) are called to the urgent deployment of IPv6 across their networks as soon as possible. This deployment must include providing IPv6 access to End Users and ensuring services are accessible by IPv6. 2) Vendors (hardware and software) are called to the urgent support of IPv6 support in their products, to make it possible for network operators and Internet Service Providers to provide these services. 3) Regulators and policy makers are called to make sure the relevance of the IPv6 support is considered in all their decisions, including as an immediate condition for public procurements. 4) Users must ensure, when acquiring new services, hardware or software, that it supports IPv6 (natively or by means of transition mechanisms). ********************************************** The IPv6 Portal: http://www.ipv6tf.org Bye 6Bone. Hi, IPv6 ! http://www.ipv6day.org This electronic message contains information which may be privileged or confidential. The information is intended to be for the use of the individual(s) named above. If you are not the intended recipient be aware that any disclosure, copying, distribution or use of the contents of this information, including attached files, is prohibited.

3 3

ASO AC Elections: Hans Petter Holen Elected
by Axel Pawlik 25 Oct '07

25 Oct '07

[Apologies for duplicate e-mails.] Dear Colleagues, We are pleased to announce that Hans Petter Holen has been selected by the RIPE community to take the vacant seat on the Address Supporting Organization (ASO) Address Council (AC). He will serve a two-year term. Selection took place during the Plenary session on Wednesday, 24 October 2007, at the RIPE 55 Meeting in Amsterdam. More information about the ASO AC and the selection process can be found at: http://www.ripe.net/info/resource-admin/aso2007/index.html Kind Regards, Axel Pawlik Managing Director RIPE NCC

1 0

Question about IP block Misusage
by Ali Dinçkan 22 Oct '07

22 Oct '07

Hello, I have a question. I am searhing now what happens if an ISP use IP address space that is assigned to another ISP. Is there any technical control eleminate this condition? And what is the legal sanction of this misuse? This might be intentional or unintentional. But ISP that use another ISP's IP address space damage the Internet nature. Thank you for your answer in advance Best regards, Ali Dinçkan <address-policy-wg(a)ripe.net>

3 2