March 2023 - db-wg - mailman.ripe.net

Using the RIPE Database for IPAM
by denis walker 04 Oct '23

04 Oct '23

Colleagues Do you use the RIPE Database as your IPAM solution? If so, read on.... The RIPE NCC has done a brief review of the recommendations made by the DB Task Force (DBTF). You can find it here: https://www.ripe.net/participate/ripe/tf/rdb-requirements-tf/initial-analys… There is one point in the summary that I disagree with: One recommendation can be implemented immediately by the RIPE NCC: - 3. Using the RIPE Database as an IPAM solution The recommendation from the DBTF was: "The task force recommends limiting and discouraging the use of the RIPE Database as an enterprise IPAM solution." This has not yet been discussed by the community and there is no consensus on this recommendation. So the RIPE NCC should not be doing anything to implement this recommendation. There are a number of points relating to this. The first BoF held by the DBTF had 46 participants. They had some polls about IPAM: Where do you hold your canonical IP address assignment details? (13 answers) Internal database or IPAM system (5 - 38%) RIPE Database (5 - 38%) Internal database for detailed assignments and RIPE database for allocations (3 - 23%) What should we do about the IPAM use of the RIPE Database? (12 answers) We should discourage it (3-25%) We should tolerate it but provide restrictions and best practices (5-42%) We should promote it and facilitate it (4-33%) During the BoF some comments were also made on this: Shane's comment "IPAM seems to be an important thing" Nathalie said about 50% of people attending training courses over a number of years said they use the RIPE DB for IPAM. Also trainees said open source IPAM solutions often pull data out of the RIPE DB but have no functionality to push data to the RIPE DB. During the presentation by the DBTF in the DB-WG session at RIPE 83 Shane said (on IPAM): "if you had very light requirements for IPAM then maybe it is OK, but it's not really what it's for" "unable to find out if this [response] was based on misunderstanding of the question" "we think there are probably good ways to go forward with that, for example making hooks so that external IPAM solutions can hook into it...that makes sense, there are certainly many commercial vendors that make IPAM products who would be happy to use hooks, there are many ways that third parties could use this but probably not a requirement" So it looks like there are very mixed views on the use of the RIPE Database for IPAM. Some people also expressed surprise that so many people use the database for IPAM. It is clear that we don't actually understand who, how and why people use the database for IPAM. We need a better understanding of the how and why and the number of users doing this before we can make any decision about discouraging or encouraging this use of the database. Even to consider if IPAM should be defined as a purpose of the database. As we are talking about it, maybe now is the time to start this discussion. If you use the RIPE Database as your IPAM solution maybe you can offer some more details. cheers denis co-chair DB-WG

5 5

NWI-14 Authenticating References to Objects
by denis walker 19 Jun '23

19 Jun '23

Colleagues The chairs propose creating NWI-14 for expanding the optional use of the "mnt-ref:" attribute to protect objects from accidental or intentional mis-representation of responsibility. See slide 14 of this presentation for the problem definition: https://ripe78.ripe.net/presentations/129-RIPE78-Operational-Update.pdf We ask the RIPE NCC to add NWI-14 to the list. cheers denis co-chair DB-WG

3 4

Proposed Service Criticality Form
by Edward Shryane 12 May '23

12 May '23

Dear Colleagues, During RIPE 84 in May, we discussed the Service Criticality Framework. We mentioned that we would like the Database Working Group's input on the criticality rating for the RIPE Database. Thank you to the Co-chairs for asking the working group for input in July with the original form: https://www.ripe.net/ripe/mail/archives/db-wg/2022-July/007527.html Since we have yet to receive any feedback so far, we plan to share our proposed completed form with the working group on Monday, 12 December. We hope that this will invite more input. Regards Ed Shryane RIPE NCC

3 4

More specific INET6NUM for IPv6 PI
by Tobias Fiebig 04 Apr '23

04 Apr '23

Heho, for some unrelated reasons I have been thinking about more specific INET6NUM objects for IPv6 PI assignments that still list the same organization but detail a specific purpose of the more specific to aid, e.g., debugging and information sharing. As this is a relatively quick thought that crept up to my brain (I don't want to request or suggest anything; More interested in understanding the current situation), i'd really appreciate some input, mainly to understand where i might have missed some context. With best regards, Tobias # Description The following might, for example, be the use of a /48 PI assignment: 2001:db8:1234::/48 2001:db8:1234::/52 - Public Internet Infrastructure 2001:db8:1234::/56 - Network; Loopbacks, transfer etc. 2001:db8:1234:100::/56 - Infrastructure PoP1 (mail, web, DNS) 2001:db8:1234:200::/56 - Infrastructure PoP2 (backup, DNS) 2001:db8:1234:f000::/52 - Office France 2001:db8:1234:f000::/56 - Office (infra) France 2001:db8:1234:f100::/56 - Office (wired) France 2001:db8:1234:f200::/56 - Office (wifi) France 2001:db8:1234:f300::/56 - Office (guest wifi) France 2001:db8:1234:d000::/52 - Office Germany 2001:db8:1234:d000::/56 - Office (infra) Germany 2001:db8:1234:d100::/56 - Office (wired) Germany 2001:db8:1234:d200::/56 - Office (wifi) Germany 2001:db8:1234:d300::/56 - Office (guest wifi) Germany Dedicated INET6NUM objects could be useful for: - The per-office-country /52 to properly attribute geoloc and direct to the right (local) role contacts (noc.fr(a)example.com vs. noc.de@) - Indicate that the internal office wifis have a /64 on each client - Indicating the status of the guest wifis and a different abuse department, as they--containing externals--might have to be handled differently, and there is no prefix delegation (PI requirements) - Creating objects for pop1/pop2 infra networks (noc.infra@, detailing use for public-facing/DMZish systems) - Creating objects providing additional information on more specifics that may show up in traceroutes - ... In all cases, the ORG of the objects would remain the same as that of the assigned /48. This is currently not possible in the DB as: - There is no fitting status:, and ASSIGNED PI can not use by LIR/end- user MNTs - The creation of more specific INET6NUM objects is not allowed in general Arguments against allowing more specifics below PI are: # The org should just request one PI per pop/use (infra/de/fr) Here, I would argue, that this does not necessarily conform to address space conversation; Technically, the /48 is enough for this specific org. Also, while RIPE 738 2.6 notes that assignments should only be made for _specific_ purposes, it explicitly lists some of the use-cases and splits described above. Furthermore, when requesting PI, the ability to use more specifics from a /48 is a common argument why only a /48 can be provided to one end-user with multiple pops. Similarly, requesting multiple /48s increases the numbering overhead for the end-user, and even if one larger-than /48 assignment was made (which is a discussion out-of-scope and for another wg here), the issue of creating more specifics for the /48s would remain the same. # Policy forbids it I am actually not sure whether ripe-738 actually forbids this. Reading Sec. 2.6, I only see a restriction to specific purposes (see above) and a restriction of more specifics being 'sub-assigned to other parties', which is reiterated in the preamble of Sec. 7. In my reading, though, that does not mean that an assignee could not create more specific INET6NUM to more accurately document the extend of the specific use of the assignment, as long as the ORG remains the same. -- Tobias Fiebig M tobias(a)fiebig.nl

4 3

ORGANISATION country code
by denis walker 23 Mar '23

23 Mar '23

Colleagues We have a number of outstanding issues from RIPE 85 so let's start with NWI-10. Ed said in his update, "Country code is now editable in organisations without co-maintained resources" I think this is a really bad idea. The country codes entered into ORGANISATION objects by the RIPE NCC are well defined, verified and maintained by the RIPE NCC. If we allow users to edit this field in other ORGANISATION objects, the values they enter will be undefined, unverified and meaningless. Just like the country code in resource objects. I don't think we should allow more meaningless data to be added to the RIPE Database. Even worse, we are mixing well defined data with meaningless data in the same attribute in the same object. This will end up with some people trusting all of this data and some people not trusting any of it...confusion. I suggest we don't allow users to enter any data into this attribute and remove any data that may have already been entered. If there is a need for resource holders to enter a country code in ORGANISATION objects set up for end users, then let's define a specific attribute for that with a well defined meaning. Your thoughts are welcome... cheers denis co-chair DB-WG

11 36

RIPE Database Quarterly Planning Q2 2023
by Edward Shryane 21 Mar '23

21 Mar '23

Dear colleagues, We have published our quarterly plans for Q2 2023 for the RIPE Database: https://www.ripe.net/manage-ips-and-asns/db/quarterly-planning In this quarter, we will work on the NWI-12 NRTMv4 implementation, publishing the source code to our web application and opening the Full Text Search API to end users among other items. We hope that by providing these plans, we can better inform the community of the ongoing developments on the RIPE Database and get feedback on our work. The goal of our quarterly planning is to communicate the work we’re doing for the coming months, get your input and start a discussion on other developments we should work on. If you have comments or questions around this, we hope you'll let us know on the list or you can always contact the DB team directly at ripe-dbm(a)ripe.net . Regards Ed Shryane RIPE NCC

1 0

Discussion and Decision making in the DB-WG
by denis walker 08 Mar '23

08 Mar '23

Colleagues I would like to clarify a couple of points here in case anyone has doubts. I often get heavily involved in some discussions on the mailing list. I sometimes have strong views and probably come across as quite pushy. But I always present arguments to support my viewpoint. I am not one of those who make a bold headline and then disappear behind a rock, expecting you to just accept my comment. Of course I am not always right. I am happy to hear from anyone who (partially) disagrees with me or others as long as you offer some arguments to support your viewpoint. I also like to hear from people who (partially) agree with me or others. We don't get a lot of people joining discussions on this mailing list. That's one of the reasons I reply to many comments to try to keep the discussion alive. Sometimes someone makes a comment, no one responds and the conversation dies. But on the other hand, by replying to many of the comments, some people may see me as talking over you. It is a fine line to get it right. The bottom line is, if more people were involved in discussions, expressing a range of supported views, I could say less or even shut up. To make decisions it is always better to have multiple views. When it comes to decisions, if I have been heavily involved in a discussion I always step back from the final decision. In those cases William will make the decision. So just because I am a co-chair and push a particular view does not mean it is a done deal. It really would help if more people expressed opinions on these issues we try to develop... cheers denis co-chair DB-WG

1 0

Set default maintainer on locked inetnum resources
by Edward Shryane 06 Mar '23

06 Mar '23

Dear colleagues, From time to time, the RIPE NCC gets requests from LIRs to unlock their PA assignments that have RIPE-NCC-LOCKED-MNT as mnt-by. These inetnums are locked due to the deprecation of the NONE authentication scheme in 2004: https://www.ripe.net/publications/news/announcements/deprecation-of-the-non… A total of 438 ASSIGNED PA AND 13 LEGACY inetnums have both this maintainer, and a responsible LIR organisation referenced in a less-specific inetnum. The DB team wishes to update these inetnums with the responsible LIR's default maintainer, so they can be maintained by the LIR without needing to contact the RIPE NCC. We will inform the affected maintainers. Please let me know your comments. If there are no objections, I'd like to implement this in the coming weeks. Regards Ed Shryane RIPE NCC

3 6

recording ROV enforcement
by Tomas Hlavacek 03 Mar '23

03 Mar '23

Dear colleagues, In the last few years we saw numerous experiments that strove to identify networks that enforce ROV. These works came not only from the scientific community but also from the industry, which indicates that many different parties are interested in this question and are willing to work to get the answer. This brings me to the question whether there is any structured and machine-readable way that the networks and IXPs can use to publish the fact that they enforce ROV? It seems that the logical place for this would be IRR and therefore I am off-topic here, but since I am not aware of any previous efforts to extend the RPSL for this particular purpose and I can imagine reasons against it, I was wondering if there is something else, possibly in the non-IRR part of the RIPE DB or somewhere else? Best regards, Tomas

3 3