- ncc-services-wg - mailman.ripe.net

LIR Portal X.509 Authentication change
by Alex Band 24 Aug '11

24 Aug '11

[Apologies for duplicate emails] Dear colleagues, This announcement applies to any LIR Portal users that currently sign in using an X.509 certificate in their browser. On Tuesday, 6 September, the RIPE NCC will deploy an update to the LIR Portal, replacing the existing X.509 login system with a new, more robust and easier to maintain platform. The update will also make a fundamental change to user management. In the current system, any user can decide to generate and use an identity certificate to log in; under the new system, it will be up to the LIR Portal administrator to allow that LIR's users to login using X.509 certificates. There will be an article published on RIPE Labs around the time of deployment that will will go into greater detail about these changes. For now, however, it is important to note that: 1. The upgrade will mean that on 6 September, users currently accessing the LIR portal via X.509 certificates will no longer be able to do so. All users will still be able to access the LIR Portal using their RegID, username and password. 2. Users wishing to access the LIR Portal using an X.509 identity certificate will need to generate a new certificate. If you are not the LIR Portal administrator, you will need to have your administrator generate a certificate for you. Details on this process will be included in the RIPE Labs article. A further announcement will be sent to this mailing list on 6 September. If you have any questions or comments in the meantime, please contact sw-enhancements(a)ripe.net. Best regards, Alex Band Product Manager RIPE NCC

1 0

New feature: Comparing certified resources to BGP routing
by Alex Band 24 Aug '11

24 Aug '11

[Apologies for duplicate e-mails] Dear Colleagues, The power of the Resource Certification system lies within the fact that you can always be sure that a valid Route Origin Authorisation (ROA), stating which Autonomous System (AS) is authorised to originate a certain prefix, can only be created by the legitimate holder of the address space. In addition, our aim to make the data set as complete and well maintained as possible. To make it easier for our members using the service to achieve this, we have just released a new feature in the Resource Certification Service that compares the certified resources an LIR holds and the ROAs they have created with the BGP announcements seen by the RIPE NCC Remote Route Collectors. It will display the validation results, and can notify the user of mismatches and potential hijacking attempts. To learn more about it, please refer to this article on RIPE Labs: https://labs.ripe.net/Members/AlexBand/matching-roas-to-bgp-routing We look forward to hearing about your experiences using the first iteration of this feature, so we can work on refining it. Kind regards, Alex Band Product Manager RIPE NCC

1 0

Announcement: RIPE NCC Training Courses
by Training Mailbox 23 Aug '11

23 Aug '11

[Apologies for duplicate e-mails] Dear Colleagues, The RIPE NCC invites you to register for one of our upcoming training courses: - The LIR Training Course This course teaches LIRs how to request Internet number resources and interact with the RIPE NCC. A course outline is available at: http://www.ripe.net/lir-services/training/courses/lir/outline/ - The Routing Registry Training Course This course teaches LIRs how to use the RIPE Database for routing. A course outline is available at: http://www.ripe.net/lir-services/training/courses/rr/ - The IPv6 Training Course This course teaches LIRs about the need for IPv6 and includes basic information on how to plan your deployment. A course outline is available at: http://www.ripe.net/training/ipv6/outline.html To see the location of upcoming courses and to register, please use the LIR Portal or complete the registration form on our website at: RIPE NCC Upcoming Courses List & Registration https://lirportal.ripe.net/lirportal/training/course-list.html If you have any questions, please do not hesitate to contact us at <training(a)ripe.net>. Kind regards, Rumy Spratley-Kanis Training Services Manager RIPE NCC

1 0

Announcement: New E-Learning videos for the RIPE Database
by Sandra Bras 17 Aug '11

17 Aug '11

[Apologies for duplicate emails] Dear colleagues, The RIPE NCC is pleased to announce the launch of five new RIPE Database videos as part of our E-Learning service. The videos cover the following topics: - The New Organisation Startup Form: Create your organisation's first PERSON and MAINTAINER objects - Create an additional PERSON object using webupdates - Create a MAINTAINER using webupdates - Add a MAINTAINER to an object using webupdates - Delete an object using webupdates These videos can be viewed at: http://www.ripe.net/lir-services/training/e-learning/ripe-database In the coming months, we will be releasing modules focused on the following topics: - RIPE Database - RIPE Policy development Process - DNSSEC (Module 3) RIPE NCC E-Learning modules are provided as a free service that is available to everyone. If you have any questions, please feel free to contact us at: e-learning(a)ripe.net. Happy learning, Sandra Brás Trainer/E-Learning Coordinator RIPE NCC

1 0

Launch of the Local Certification Service
by Alex Band 16 Aug '11

16 Aug '11

Dear colleagues, The RIPE NCC Resource Certification (RPKI) Service was launched on 1 January 2011. Since then, over 570 LIRs have generated a digital certificate in the LIR Portal, listing their Internet number resources. In addition, most LIRs have used it to specify their routing policy through Route Origin Authorisations (ROAs), indicating which Autonomous Systems are authorised to originate the prefixes they hold. Currently, there are thousands of IPv4 and IPv6 prefixes covered by a ROA in our repository, which network operators around the world can validate against. Today marks an important step in the development of this service. We are launching a proof of concept of the Local Certification Service, enabling you to run Resource Certification on your own systems. It will allow you to generate, manage and publish a resource certificate, with the RIPE NCC as parent. If there is broad community interest, we will turn the Local Certification Service into a full-featured production software package. For details on the Local Certification Service, please refer to the RIPE Labs article: https://labs.ripe.net/Members/AlexBand/local-certification-service-launched We look forward to your feedback. Kind regards, Alex Band Product Manager RIPE NCC

1 0

Deployment of New RIPE Database Web Forms
by Denis Walker 10 Aug '11

10 Aug '11

[Apologies for duplicate emails] Dear colleagues, The RIPE NCC Database Group are pleased to inform you that, after a successful trial period, the new and improved set of web forms for accessing the RIPE Database is now fully in production. The old Query CGI is no longer available. Details of the new services are contained in the recent announcement to the Database Working Group: http://www.ripe.net/ripe/maillists/archives/db-wg/2011/msg00170.html Regards, Denis Walker Business Analyst RIPE NCC Database Group

1 0

LIR portal member status / members-discuss subscriptions
by Daniel Suchy 03 Aug '11

03 Aug '11

Hello, recently I updated some informations on LIR portal (added new email to be subscribed in members-discuss mailing list). But I'm still receiving messages about message awaiting aproval from the system. I did some investigation. On "FAQs", there's mentioned, that members-discuss subscriptions are for "FULL" members only. But this condition should be met, as mentioned organisation is LIR for several years. On LIR portal, I discovered, that in member status is listed "PROVIDER" membership status - where I expect "FULL", "CANDIDATE" and so on (based on articles of associations). "PROVIDER" isn't expected by me - it's unknown in articles of association. I think, this confusion is due to recent changes on LIR portal / RIPE website in general. Secondary, "new" membership status may be reason, why my email isn't properly subscribed. And In my oppinion, LIR portal should correctly show membership status. Someone from RIPE NCC should answer, why there's something else ;) With regards, Daniel

2 1

Re: [members-discuss] New Charging Scheme
by Christian 'wiwi' Wittenhorst 03 Aug '11

03 Aug '11

Hello Simon, Hello Erik, Dear List, >> - linear: An IP address should have a price. An LIR with a /12 allocation >> uses 256 times the resources of an LIR with a /20. This should be >> reflected in the fee. > No, they don't. See above. Of course, they do ;-) IPv4 address space is a scarce and valuable resource now. And a /12 user occupies a lot more that limited resource than a /20 user does. If someone justifies a /12, Internet is obviously a major part of his business (or he's incredibly huge). And more importantly, he uses a major part of the limited resource. A "fee" of EUR 0.002 per IP is more than reasonable. > How about the annual fee, calculated at the end of each calendar year is comprised of: > > - A base RIPE "membership" fee > - A "maintenance" fee for each allocation to the LIR (e.g. EUR 50 per > allocation, like the PI blocks) > - A "allocation" fee for each allocation made in the previous 12 months. I strongly feel that there should be a fee on IP address consumption (e.g. the EUR 0.002/IP Address). I tried to avoid the "per usage" fee as it will make billing more complicated. I personally would not care about EUR 50 per allocation request. > But what about the other objects ? ASN: I would give away ASN for free. We have rules in place that define, when an ASN is justified. The supply of ASN is unlimited for all pratical means. Don't forget": In my proposal, every resource owner will pay at least EUR 500, so this should be covered. Besides, an ASN is not very useful on its own without associated address space. We could follow ARIN: Pay EUR 500 per ASN (and USD 100 per year once per organization). PI space: Just treat it as usual, either have a sponsoring entity, where is just counts as regular IP address space, or become an extra small LIR on your own. IPv6: Have no clear opinion on this. For now, I would give it away for free now and let's discuss the matter, when IPv6 traffic approaches 25% of IPv4 traffic. >> - Major players pay EUR 5500 at most, which will be less than "peanuts" >> for them. > Not necessarily. Okay, most LIRs are also ISPs, but not all. You can't assume > that for an LIR that a bigger allocation means a bigger revenue stream. Let's assume "less than /16" (2012: "large" category) for "major player". So you can justify more than 65k addresses, you have at least 65k services instances allocated to these addresses, which will need some kind of hardware. The EUR 0.002 will NEVER be an important part of your budget. We are a government funded, small "ISP" that's confined to the schoolyard. We're providing services for the schools in our district. The budget of our associated schools exceed EUR 40M/y easily. So don't tell me, that EUR 5k will be a problem for anyone who can honestly justify more than a /16. Just as a reminder, the comparison the RIPE2012 proposal and the ARIN fees: wiwi RIPE2012 ARIN /23 EUR 502 EUR 250 USD 1250 /22 EUR 502 EUR 750 USD 1250 /21 EUR 904 EUR 1750 USD 1250 /20 EUR 1308 EUR 1750 USD 2250 /19 EUR 1716 EUR 2500 USD 2250 /18 EUR 2132 EUR 2500 USD 4500 /17 EUR 2565 EUR 2500 USD 4500 /16 EUR 3031 EUR 2500 USD 4500 /15 EUR 3562 EUR 5000 USD 9000 /14 EUR 4224 EUR 5000 USD 9000 /13 EUR 5148 EUR 5000 USD 14000 /12 EUR 6597 EUR 5000 USD 14000 /11 EUR 9094 EUR 7500 USD 14000 /10 EUR 13688 EUR 7500 USD 14000 /9 EUR 22477 EUR 7500 USD 14000 /8 EUR 39654 EUR 15000 USD 14000 Calculation is simple: EUR 500 + ((log2(#IPv4)-10)*EUR 400+(EUR 0.002*#IPv4). My assumptions were: EUR 15M with 7100 members results in EUR 2100 need per member and per year in average, so a /18+ will pay more than the average share. Having members with less than EUR 500 fee is not useful, commercially. ...a and get me right, please: RIPE does a great job, no doubt. I do NOT want to deplete RIPE of money. Greetings from rainy Switzerland wiwi ---- If you don't want to receive mails from the RIPE NCC Members Discuss list, please log in to your LIR Portal account at: http://lirportal.ripe.net/ First click on General and then click on Edit. At the bottom of the page you can add or remove addresses.

1 0

RE: [members-discuss] idea Christian 'wiwi' Wittenhorst
by Erik Bais 03 Aug '11

03 Aug '11

Hi Jørgen, > Paying for an "object" in a "database" is kindof silly as there are > little or no expenses related to a database itself these days. If it > would be up to me I would get 1x /18 instead of 2x /19 in the > beginning, > but RIPE NCC didn't approve on that. I shouldn't be punished because I > am "saving" resources by using /19s instead of a /18 which was forced > upon me by RIPE NCC. I don't think you understand what the job of the RIPE hostmasters is about. It is not their role (or nature) to punish you, if you motivate why you require specific resources, you will get them (within the policies that are currently in place.) If you didn't provide the correct motivation, sobbing here doesn't make it better. The hostmasters only do their job, as it is our job to discuss and change the policies if we don't agree with the current model. Paying per object does actually reflect somewhat on the amount of labor/time/effort that the RIPE NCC workforce has to deal with you. Just my 2cp. Erik ---- If you don't want to receive mails from the RIPE NCC Members Discuss list, please log in to your LIR Portal account at: http://lirportal.ripe.net/ First click on General and then click on Edit. At the bottom of the page you can add or remove addresses.

3 2

Assigning 32-bit AS Numbers
by Mirjam Kuehne 18 Jul '11

18 Jul '11

[apologies for duplicates] Dear colleagues, The RIPE NCC has been assigning 32-bit Autonomous System Numbers for quite some time now. Please see some statistics and analysis on RIPE Labs: http://labs.ripe.net/Members/mirjam/assigning-32-bit-asns Kind Regards, Mirjam Kuehne RIPE NCC

1 0