November 2013 - ncc-services-wg

comments on proposal 2012-07
by Nick Hilliard 05 Feb '14

05 Feb '14

Hello, I thought I'd chip in on 2012-07. The current version of the proposal is a huge improvement on v1.0 and thanks / kudos need to go to the authors for what was obviously a huge amount of work. I still have issues with a number of areas. Serious issues: Section 3.0 needs to include a term in the contract to state that the services provided by the RIPE NCC to the legacy resource holder are defined by RIPE community policy and may be amended from time to time, according to ripe community policy. Section 2.6 still provides carte blanche for legacy resource holders to freeload services off the RIPE NCC with no consequences. As a RIPE NCC member, I am not at all happy about this. The amount of work that the RIPE NCC is going to have to undertake to handle the legacy resource holder community is very large indeed, and it is not reasonable to expect the RIPE membership to foot the bill for those legacy resource holders who aren't members and who feel un-inclined to contribute towards registration services just because they couldn't be bothered to pay. Section 2.5: I see where this is coming from, namely there will probably be situations where the users of the address space will be unable to identify themselves adequately as having any claim to their assignment. However, this section is open to abuse and it concerns me that it's still there. I concede that there is a requirement to have some type of arrangement like this, but the wording of the current section needs to be tightened up considerably. Less serious issues: Section 2.4 is redundant. We have a well established precedent under the terms of 2007-01 for engaging with sponsoring LIRs and this seems to work well in practice. Creating this policy option merely adds cost to the RIPE NCC's bottom line for no gain. Nits: Section 3.0: "a statement that the RIPE NCC is not entitled to deregister the resources for whatever purpose unless so instructed by the resource holder". This statement is advisory only and it needs to be made clear that the sponsoring LIR does not have power to make a legally binding statement of this form. This actually applies to all four statements in section 3.0. Nick

7 25

Follow up on implementation of Resource Certification (RPKI) for PI End User Resources
by Alex Band 26 Nov '13

26 Nov '13

Dear colleagues, Over the last few weeks, we have been consulting the RIPE community on the practical implementation of providing Resource Certification (RPKI) for Provider Independent (PI) End Users. In about two weeks, we plan to start with the implementation and, based on the feedback that you have provided, we would like to offer the following two solutions: 1. A management interface for sponsoring LIRs in the LIR Portal Sponsoring LIRs will be able to issue access credentials for the RPKI Management interface to either themselves if they manage ROAs on behalf of the PI End User, or directly to the PI End User if they have requested to set up and maintain ROAs. 2. A form on the RIPE NCC website, allowing PI End Users to request access directly from the RIPE NCC PI End Users will be able to log in with their RIPE NCC Access account, enter the resources they would like a certificate for and authenticate against the INETNUM database object to prove they have authoritative control over the address space. If you have any feedback, please do not hesitate to respond to this message. Kind regards, Alex Band Product Manager RIPE NCC P.S. The RIPE NCC has explained the implementation options and associated cost at the following locations: http://www.ripe.net/ripe/mail/archives/ncc-services-wg/2013-March/002145.ht… http://www.ripe.net/ripe/mail/archives/ncc-services-wg/2013-March/002149.ht… http://www.ripe.net/ripe/mail/archives/ncc-services-wg/2013-March/002252.ht… http://www.ripe.net/ripe/mail/archives/ncc-services-wg/2013-March/002256.ht… http://www.ripe.net/ripe/mail/archives/ncc-services-wg/2013-October/002587.…

2 1

RPKI Validator 2.13 released
by Alex Band 25 Nov '13

25 Nov '13

Hello everyone, We just released RPKI Validator 2.13 and I would just like to highlight a couple of important improvements and fixes. 1. Single, unified configuration file We recently received a request to allow overriding the default paths of the application to allow Debian packaging. This meant we ended up with so many startup flags and environment variables that we decided to put every user configurable option together in one single file. You can choose your own name and path for the config file, to allow for easy updating without overwriting your preferences. 2. Application health and trust anchor monitoring Quite some users have asked us to implement monitoring, so they can keep an eye on whether the application itself is running properly and if the RPKI repositories are available and serving data. Application health monitoring currently only checks if the rsync binary can be found and executed. For Trust Anchor monitoring we built a dedicated page. For example: http://localcert.ripe.net:8088/trust-anchor-monitor/44a4f26e67 Both are a basic, initial implementations. We’re actively looking for feedback on which checks you would like to see and how you would like to be able to implement them in your monitoring setups. 3. Deep linking You can specify an AS Number or prefix in the URL of the ROA and BGP Preview pages to get direct, bookmark-able access to information. For example: - http://localcert.ripe.net:8088/roas?q=2001:7fb:fe01::/48 - http://localcert.ripe.net:8088/bgp-preview?q=AS12654 4. Bug and conformance fixes At IETF88 in Vancouver we did some rigorous testing with other implementors to see how the application handles malformed objects. A couple of bugs and other anomalies came to light that have been fixed in this version. You can download RPKI Validator 2.13 here: https://www.ripe.net/lir-services/resource-management/certification/tools-a… We recommend that you update to this release. As always, we look forward to your feedback. Kind regards, Alex Band Product Manager RIPE NCC

1 0

[training] RIPE NCC Training Courses January-March 2014
by Training Team 19 Nov '13

19 Nov '13

Dear Colleagues, Our training team travels the RIPE NCC service region to deliver training courses to our members without any additional cost. Over the next few months, we'll be in Lisbon, Frankfurt, Busto Arsizio, Manamah, St. Petersburg, Tallinn, London, Warsaw, Copenhagen, Amsterdam, Bucharest. Visit the following page to register and to check which training courses we are giving in your area: https://lirportal.ripe.net/training/courses The RIPE NCC delivers the following training courses: - LIR Training Course - RIPE Database Training Course - IPv6 for LIRs Training Course - Routing Security Training Course For more information visit: http://www.ripe.net/lir-services/training/courses With kind regards, Rumy Spratley-Kanis Training Services Manager

1 0

2012-07 Last Call for Comments (RIPE NCC Services to Legacy Internet Resource Holders)
by Marco Schmidt 18 Nov '13

18 Nov '13

Dear colleagues, The proposal described in 2012-07, RIPE NCC Services to Legacy Internet Resource Holders, is now in its Concluding Phase. The RIPE NCC Services Working Group co-Chairs have declared that consensus for the proposal has been reached and it will now move to Last Call. As per the RIPE Policy Development Process (PDP), the purpose of these coming four weeks of Last Call is to give the community the opportunity to present well-justified objections in case anyone missed the previous two phases and want to oppose the proposal. Any objection must be made by 17 December 2013 and must be supported by an explanation. If no substantive objections are raised by the end of Last Call, the proposal will complete the PDP and will be evaluated by the co-Chairs of all RIPE Working Groups for consensus. You can find the full proposal at: https://www.ripe.net/ripe/policies/proposals/2012-07 Please e-mail any final comments about this proposal to ncc-services-wg(a)ripe.net before 17 December 2013. Regards Marco Schmidt Policy Development Office RIPE NCC

1 0

2012-07 RIPE NCC Services to Legacy Internet Resource Holders - moving to last call
by Bijal Sanghani 18 Nov '13

18 Nov '13

Greetings colleagues, The NCC Services working group co-chairs have concluded that policy proposal 2012-07 - RIPE NCC Services to Legacy Internet Resource Holders will now move to last call, we believe consensus has been reached. During the last call phase the community still has an opportunity to present any sound objections that may have been missed in the previous two phases. Marco will send a mail shortly with full details of the last call shortly. Best regards, Kurtis and Bijal NCC Services WG co-chairs

1 0

RIPE Database Release 1.70
by Denis Walker 12 Nov '13

12 Nov '13

Dear colleagues, The new release 1.70 of the RIPE Database was deployed to the TEST Database environment on Thursday, 31 October 2013 and is now ready to be deployed to the production database. The deployment will commence at 20:00 (UTC+1) on Thursday, 14 November 2013 and may take up to three hours to complete. During this time, updates will not be available. Any email updates submitted during this period will be queued. Updates by any other means will return an error message. Queries will not be affected during this deployment. The reason for the outage is an operational clean-up that the RIPE NCC has to do occasionally on the RIPE Database. Some long-since deprecated objects and attributes will be removed from the SQL table structure. This clean-up will not cause any visible change to users. The clean-up was done on the TEST Database during the deployment of 1.70 in October. Regards Denis Walker Business Analyst RIPE NCC Database Team

1 0

Re: [ncc-services-wg] comments on proposal 2012-07
by Andrew de la Haye 06 Nov '13

06 Nov '13

Dear colleagues, In this email thread, the RIPE NCC was asked to provide a cost estimate for the implementation of policy proposal 2012-07. The estimated total costs for implementation of this proposal are between 100 kEUR and 350 kEUR, spread out over several years. These costs include things such as setting up the appropriate fields in the RIPE Database, internal software development, and administrative overhead - including creating the appropriate legal contracts. Whether the actual costs are closer to the upper or lower end of this estimate will be determined by how many legacy holders decide to enter into a contractual relationship with the RIPE NCC or a sponsoring LIR. The smaller estimate reflects 25% of legacy holders, while the larger estimate represents 100% of legacy holders deciding to enter into a contractual relationship. Note also that these costs have not been offset against the additional income that would likely come as the result of some legacy holders deciding to become RIPE NCC members. There are obvious parallels between implementation of this policy and the implementation of policy proposal 2007-01, "Direct Internet Resource Assignments to End Users from the RIPE NCC". However, the overall number of organisations and Internet number resources related to this proposal is lower. Also, it is optional, rather than mandatory, for organisations to enter into a contractual relationship with the RIPE NCC. For this reason, the operational and financial impact of implementation will be considerably lower. Kind regards Andrew de la Haye Chief Operations Officer RIPE NCC

1 0

RIPE Database Release 1.70 Available
by Denis Walker 06 Nov '13

06 Nov '13

Dear colleagues, The RIPE NCC is pleased to announce that we will deploy a new release of the RIPE Database to the TEST Database environment on Thursday, 31 October 2013. The release is scheduled for production deployment on Thursday, 12 November 2013. Detailed information about the new release, including dates and information about the changes, can be found at: https://www.ripe.net/data-tools/db/release-notes/ripe-database-release-1.70 Of special note in this release is the inclusion of "pending route authentication". This is an alternative and simplified way of authorising route object creation. Two separate updates for a single route/route6 object are treated as one create request. This has no impact on users who still submit a complete route object with all authorisations included. If you have any questions or comments, we look forward to hearing them. Regards, Denis Walker Business Analyst RIPE NCC Database Team

1 1

2012-07 Services to Legacy Internet Resource Holders
by Gilles Massen 06 Nov '13

06 Nov '13

Dear all, I support proposal 2012-07's adoption as policy. It seems fairly balanced and should provide an option for every LRH without putting unacceptable load on the RIPE NCC (or its members). Thanks to the authors. Best regards, Gilles -- Fondation RESTENA - DNS-LU 6, rue Coudenhove-Kalergi L-1359 Luxembourg tel: (+352) 424409 fax: (+352) 422473

1 0