* "Sascha Luck [ml]" <apwg@c4inet.net>

On Tue, Mar 10, 2015 at 03:36:41PM +0000, Nick Hilliard wrote:

...

and without knowing the background it seems peculiar that APNIC feels it necessary to consult ARIN about APNIC->RIPE NCC resource transfers.

I reckon APNIC is afraid they will not get transfers from ARIN if there is a possibility that those may subsequently be transferred to RIPE.

Indeed, that's how I understood Paul Wilson's mic comments after Andrea's APRICOT 2015 presentation, i.e., even though ARIN and APNIC transfer policies are compatible to begin with, the worry is that if transfers between the APNIC and RIPE regions commence without demonstrated need, than this fact would somehow «infect» the APNIC policy such that ARIN would no longer consider it to be sufficiently «needs based» and thus incompatible (even though the APNIC policy text would not change at all). As I understand it, transfers between the APNIC and RIPE regions without demonstrated need is exactly what would happen with the current APNIC policy + 2015-05, since current APNIC policy doesn't «require the receiving region to have needs-based policies». However, the transcript quotes Andrea as saying «Both RIRs that have an inter-RIR transfer policy in place, meaning ARIN and APNIC, confirmed that their policy requires a needs base in order to do inter-RIR transfers». After reading APNIC's policy document, I do not think this is accurate. I wonder how this understanding of APNIC's inter-RIR transfer policy requiring needs basis came to be. In any case, ARIN staff has confirmed on multiple occasions now that 1) 2014-05 is compatible with ARIN's transfer policy, and even if it wasn't 2) that any policy adopted by a third-party RIR community cannot alter the compatibility state between the ARIN and APNIC policies. Thus it seems very clear that there is absolutely no cause for concern; after the passage of 2014-05, all three RIRs in question will be compatible with the other two. I guess that the APNIC EC meeting might have happened before these assurances from ARIN staff was made public, and that would help explain why they decided to temporarily override their own community policies. Now that it is known that their worries were unfounded, I'd expect the them to lift the freeze at the next EC meeting. Tore

Hello Nick, On 11/03/15 11:22, Nick Hilliard wrote:

Unfortunately, this is not respected in the ARIN inter-rir transfer policy:

https://www.arin.net/policy/nrpm.html#eight4

which includes the text:

"Recipients within the ARIN region will be subject to current ARIN policies and sign an RSA for the resources being received."

In other words, multinational organisations headquartered in the ARIN region who receive resources transferred to another RIR will be subject to ARIN policies.

This is potentially a serious problem because transferring policy encumbrances is likely to cause policy problems in future, if RIR policy differences crop up.

So the question is: can the RIPE NCC accept transfers from ARIN if the receiver organisation has signed the ARIN RSA for these resources? And if transfers are accepted within these terms and there's a conflict between RIPE NCC policy and ARIN policy, whose policies takes precedence? RIPE's or ARIN's?

The proposed RIPE Policy for Inter-RIR Transfers of Internet Resources includes the statement: "While the transfer is in process, during the time the internet number resources are registered in the RIPE NCC service region, then RIPE policies will apply." https://www.ripe.net/ripe/policies/proposals/2014-05 And the RIPE NCC impact analysis states: "For transfers to the RIPE NCC service region, the resources will only be registered in the RIPE Registry when the transfer is completed. It is the RIPE NCC’s understanding that resources being transferred are subject to the policies of an RIR as long their are registered in its registry. " ARIN has confirmed that the proposed policy text is compatible with its own inter-RIR transfer policy. No potential issues have been indicated. Further, the complete paragraph 8.4 of the ARIN Number Resource Policy Manual says: "Conditions on recipient of the transfer: - The conditions on a recipient outside of the ARIN region will be defined by the policies of the receiving RIR. - Recipients within the ARIN region will be subject to current ARIN policies and sign an RSA for the resources being received. - Recipients within the ARIN region must demonstrate the need for up to a 24-month supply of IPv4 address space. - The minimum transfer size is a /24." https://www.arin.net/policy/nrpm.html#eight4 Regards, Marco Schmidt Policy Development Officer RIPE NCC

On Mar 11, 2015, at 9:40 AM, Nick Hilliard <nick@inex.ie> wrote:

Hi Marco,

There are two fundamental problems here, one operational- and one policy-related.

On 11/03/2015 13:24, Marco Schmidt wrote: [...]

...

ARIN has confirmed that the proposed policy text is compatible with its own inter-RIR transfer policy. No potential issues have been indicated.

1. If there is a future incompatibility between RIPE policy and ARIN policy which concerns resources transferred under this category:

...

- Recipients within the ARIN region will be subject to current ARIN policies and sign an RSA for the resources being received.

... whose policy applies? RIPE's or ARIN's?

Nick - ARIN's policies only apply to number resources that are contained within in the ARIN registry. To the best of my knowledge, number resources which have been transferred to another regional registry would be subject to that regional Internet registry's policies. ARIN's policies most certainly apply to all resources in the ARIN registry database, and could easily have implications for ability to transfer to another party in the ARIN region or party in another region, but once transferred to another region, I am unaware of any ARIN policy that would be applicable to transferred number resources. I hope this helps clarify matters. Thanks! /John John Curran President and CEO ARIN p.s. Note also that the ARIN Policy Development Process (PDP) allows for development of policies for administration of number resources "in the ARIN region" (and IANA-applicable global number resource policies per the ASO MOU); it is questionable if a policy proposal for administration of number resources in another regional registry would even be within the scope for the ARIN PDP...

On Mar 12, 2015, at 9:16 AM, Nick Hilliard <nick@inex.ie> wrote:

On 12/03/2015 12:45, John Curran wrote:

...

ARIN's policies only apply to number resources that are contained within in the ARIN registry. To the best of my knowledge, number resources which have been transferred to another regional registry would be subject to that regional Internet registry's policies. ... It clarifies the intent, but "to the best of my knowledge" is an expression of opinion rather than a formal statement of policy. If we're going to have a working transfer mechanism, given that there is a level of ambiguity in the text in the ARIN transfer policy, it would be good if this could be clarified formally so that we can remove any doubt.

Nick - Actually, it is unclear if there is indeed any ambiguity in the ARIN inter-RIR transfer policy, but regardless, the following statement that I made above _is_ a formal clarification - "ARIN's policies only apply to number resources that are contained within in the ARIN registry." What follows is prefaced by "To the best of my knowledge" simply because it reflects my belief that other RIRs also do apply their policies to resources within their registry (something over which neither ARIN nor I have any control...) I hope this helps; please let me know if any further clarification is needed. Thanks! /John John Curran President and CEO ARIN

On Wed, Mar 11, 2015 at 3:22 AM, Nick Hilliard <nick@inex.ie> wrote:

On 11/03/2015 09:38, Tore Anderson wrote:

...

Indeed, that's how I understood Paul Wilson's mic comments after Andrea's APRICOT 2015 presentation, i.e., even though ARIN and APNIC transfer policies are compatible to begin with, the worry is that if transfers between the APNIC and RIPE regions commence without demonstrated need, than this fact would somehow «infect» the APNIC policy such that ARIN would no longer consider it to be sufficiently «needs based» and thus incompatible (even though the APNIC policy text would not change at all).

that is also my understanding - this should be fixed with the current transfer proposal. Although I found the statement from Einar Bohlin (policy analyst at ARIN) disturbing:

...

ARIN does not have policy regarding the relationship between RIPE and APNIC. So we don't have -- there is no policy text in our policy manual regarding that relationship. There could be in the future but there is no such thing at this time.

The RIPE policy operates on the principal that once address space is transferred in or out of a RIR, that for the duration of the transfer (whether temporary or permanent), the receiving RIR policy applies and that the sending RIR has no input on the resources.

Unfortunately, this is not respected in the ARIN inter-rir transfer policy:

https://www.arin.net/policy/nrpm.html#eight4

which includes the text:

"Recipients within the ARIN region will be subject to current ARIN policies and sign an RSA for the resources being received."

In other words, multinational organisations headquartered in the ARIN region who receive resources transferred to another RIR will be subject to ARIN policies.

That was not the intent of the policy language as drafted. Rather, than clause was meant to apply to 8.4 inter-RIR transfers inbound to the ARIN region from a source outside the ARIN region. So if someone in the RIPE region decides for some reason to transfer resources to someone in the ARIN region, and the addresses end up registered in the ARIN database, then the recipient must sign an RSA and will be subject to current ARIN policies. This was *not* intended to apply to a transfer from the ARIN region to an organization in the RIPE region, where the addresses will end up registered in the RIPE NCC database. So it shouldn't matter whether the recipient also has a presence in the ARIN region, or has an ARIN account. The actual recipient should be considered to be in the RIPE region (not the ARIN region) if the addresses are going to end up registered in the RIPE NCC database. ARIN staff can comment on their interpretation of the language, but hopefull it matches our original intent as summarized above. -Scott (speaking for myself, as someone involved in passing the ARIN draft policy that became NRPM 8.4)

This is potentially a serious problem because transferring policy encumbrances is likely to cause policy problems in future, if RIR policy differences crop up.

So the question is: can the RIPE NCC accept transfers from ARIN if the receiver organisation has signed the ARIN RSA for these resources? And if transfers are accepted within these terms and there's a conflict between RIPE NCC policy and ARIN policy, whose policies takes precedence? RIPE's or ARIN's?

Nick

On Mar 11, 2015, at 5:38 AM, Tore Anderson <tore@fud.no> wrote:

... In any case, ARIN staff has confirmed on multiple occasions now that 1) 2014-05 is compatible with ARIN's transfer policy, and even if it wasn't 2) that any policy adopted by a third-party RIR community cannot alter the compatibility state between the ARIN and APNIC policies.

That is correct, specifically, we assess the compatibility of an RIR's policies with our Inter-RIR transfer policy, and reassess if an RIR should change policies, i.e. RIPE adoption of policy text does not have any impact on ARIN transfers to/from APNIC.

Thus it seems very clear that there is absolutely no cause for concern; after the passage of 2014-05, all three RIRs in question will be compatible with the other two.

I believe that to be correct, although nothing precludes the community in any region from deciding that outcome does not meet their needs, and changing inter-RIR transfer policy in their region. Such would be a rather surprising development, but I have long since given up attempting to predict the outcomes of the various RIR policy development processes... Thanks! /John John Curran President and CEO ARIN