Getting IPv6 &Securing your RoutingIPv6 KongressMay 2012, FrankfurtSandra Brás & Ferenc Csorba, RIPE NCC
Schedule•   IPv4 exhaustion•   IPv6 address space•   European IPv6 deployment statistics•   BGP multihoming•   Routing Reg...
RIPE / RIPE NCCRIPE Open community Develops addressing policies Working group mailing listsRIPE NCC Located in Amsterdam N...
The five RIRs                4
Internet Number Resources•   IP addresses     - IPv4      eg. 193.0.0.203     - IPv6      eg. 2001:610:240:11::c100:1319• ...
Registration               6
Conservation               7
Aggregation              8
Who makes policies?                            ICANN / IANA                                  ASO   AfriNIC    Reach consen...
Why would you want to participate?•   Policy determines how you run your business•   Over 8000 LIRs•   Only a fraction are...
How can you participate?•   Working Group mailing lists     -   RIPE website → RIPE → Mailing Lists•   Come to the RIPE Me...
IPv4 Address PoolExhaustion
IANA IPv4 pool  40%  30%  20%  10%  0%    2000   2001   2002   2003   2004   2005   2006   2007   2008   2009   2010   201...
IPv4 address distribution                             /0                              IANA                        /8      ...
IANA and RIRs IPv4 pool           IANA Pool             RIR Allocations            Advertised             RIR Pool        ...
Our slice of the IPv4 pie                                Legacy                   Other IANA                              ...
IPv4 exhaustion phases                    IPv4 still available.     RIPE NCC’s allocation                                 ...
Run Out Fairly (of IPv4)•   Gradually reduced allocation / assignment periods•   Needs for “Entire Period” of up to...    ...
RIPE NCC’s last /8•   We do things differently!•   Ensures IPv4 access for all members     - 16000+ /22s in a /8     - mem...
Transfer of IPv4 Allocations•   Policy 2007-08: Allocation Transfer Policy     -   Don’t buy your IPv4 on eBay!          -...
IPv4 Depletion in the RIPE NCC’s Region      -   https://www.ripe.net/internet-coordination/ipv4-exhaustion               ...
0               75                    150                          225                                300     2000-01     ...
IPv4 Depletion Worldwide                                          IPv4 Pool in /8’s 6 5 4 3 2 1 0     AfriNIC   RIPE NCC  ...
IPv6 Address Space
Where do all the addresses come from?                      IETF                      IANA   AfriNIC   ARIN   RIPE NCC    A...
IPv6 address distribution                                 /3                                IANA                          ...
IPv6 basics•   IPv6 address: 128 bits     -   32 bits in IPv4•   Every subnet should be a /64•   Customer assignments (sit...
IPv4 vs IPv6 (rounded off)                   IPv4                  IPv6addresses            4x109                2x1019   ...
Classless Inter-Domain Routing (CIDR) IPv6 Chart   Prefix   /48s     /56s    /64s   Bits                                   ...
Address Notation2001:0db8:003e:ef11:0000:0000:c100:004d2001:0db8:003e:ef11: 0000:0000:c100:004d2001:db8:3e:ef11:0:0:c100:4...
Getting an IPv6 allocation•   To qualify, an organisation must:     - Be an LIR     - Have a plan for making assignments w...
RIPE Policy Proposal 2011-04•   Extension of the Minimum Size for IPv6      Initial Allocation     - Proposes initial allo...
What does the first IPv6 allocation cost?  - for all  - pending General Meeting decision                             or:  ...
Why Create an IPv6 Addressing Plan?•   Mental health during implementation(!)•   Easier implementation of security policie...
IPv6 Subnetting                  35
Make an addressing plan (I)•   Number of hosts is irrelevant•   Multiple /48s per pop can be used     - separate blocks fo...
Make an addressing plan (II)•   Use one /64 block (per site) for loopbacks     - One /128 per device     - One /64 contain...
More On Addressing Plans for ISPs•   For private networks, look at ULA•   For servers you want manual configuration•   Use ...
Point-to-Point Connections•   How much space for point-to-point connections?     - RFC4291: Interface IDs are required to ...
Customer assignments•   Give your customers enough addresses     -   Up to a /48•   For more addresses, send in request fo...
Using AGGREGATED-BY-LIR                                    ALLOCATED-BY-RIR                                      ASSIGNED ...
Group assignments in the RIPE DB inet6num:           2001:db8:1000::/36 netname:            Bluelight descr:              ...
Customers And Their /48•   Customers have no idea how to handle 65536    subnets!•   Provide them with information    – ht...
IPv6 Address Management•   Your Excel sheet might not scale    – There   are 65.536 /48s in a /32    – There   are 65.536 ...
Getting IPv6 PI address space•   To qualify, an organisation must:     -   Meet the contractual requirements for         p...
Reverse DNS2001:db8:3e:ef11::c100:4d                            46
Reverse DNS2001 db82001:0db8:003e:ef11:0000:0000 :c100: 004d  . . . . . . . .ip6.arpad.4.0.0.0.0.1.c.0.0.0.0.0.0.0.0.1.1.f...
IPv6 DeploymentStatistics
IPv6 Allocation Rate                       2
IPv6 PI Assignments                      3
Members with IPv6 and IPv4 7853 members with IP resources                           3846                         3918     ...
IPv6 Ripeness •   Rating system:      -   One star if the LIR has an IPv6 allocation      -   Additional stars if:        ...
IPv6 RIPEness: 8097 LIRs (5 May 2012)   1 star   2 stars    3 stars   4 stars            No IPv6                          ...
0                              225                                    450                                          675    ...
0%                               25%                                     50%                                           75%...
IPv6 enabled ASes in global routing                    All          Germany     Belgium     France          Netherlands50%...
World IPv6 Launch•   http://www.worldipv6launch.org/                                      57
Useful information    Websites•   http://www.getipv6.info/•   http://www.ipv6actnow.org•   http://datatracker.ietf.org/wg/...
Multihomed BGPRouting Setup
Scenario 1: LIR = PA allocation + ASN           ISP 1                      ISP 2                          x              A...
Scenario 2: End User = PI + ASN                ISP 1                         ISP 2                                  x•   C...
Scenario 3: LIR = PI + ASN                ISP 1                         ISP 2                                  x•   Can NO...
Scenario 4: PI End User, not multihomed            ISP 1                       ISP 2                            x•   Part ...
How to get an AS Number•   Assignment requirements     - Address space     - Multihoming     - One AS Number per network• ...
32-bit AS Numbers and you•   New format: “AS4192351863”•   Act now!•   Prepare for 32-bit ASNs in your organisation:     -...
RIPE Database
RIPE Database•   Public Internet resource and routing registry      database                                              ...
RIPE Database objects•   Resources    – inetnum,   inet6num, aut-num, domain•   Routing    – route,   route6, aut-num•   S...
Protection mntner:          LIR-MNT             person:    John Smith admin-c:         JS123-RIPE          nic-hdl:   JS12...
Protection                                     inetnum:   85.11.186.0/25                                     descr:     My...
Routing Registry
What is “Internet Routing Registry”•   Distributed databases with public routing policy      information, mirroring each o...
Publishing routing policy in IRR•   Required by some Transit Providers & IXPs     -   they use it for prefix-based filtering...
RIPE RR is part of the RIPE Database•   route[6] object creation is responsibility of LIR     -   every time you receive a...
Route and route6 object                                                      organisation: ORG-BB2-RIPE                rou...
IPv6 in the Routing RegistryRoute6 object:  route6:	   2001:DB8::/32  origin:	   AS65550Aut-num object:  aut-num:	 AS65550...
Automation of router configuration•   Describing routing policy in aut-num enables     generation of route-maps for policy...
Resource Certification
Limitations of the Routing Registry•   Many registries exist, operated by different    parties:    – Not   all of them mir...
The RIPE NCC involvement in RPKI•   The authority who is the holder of an Internet    Number Resource in our region    – I...
Digital resource certificates•   Issue digital certificates along with the    registration of Internet Resources•   Two mai...
Using certificates•   Certification is a free, opt-in service    – Your   choice to request a certificate    – Linked   to y...
The PKI system•   The RIRs hold a self-signed root certificate for all    the resources that they have in the registry    –...
Certificate Authority (CA) Structure Root CA (RIPE NCC) Member CA (LIR) Customer CA                                       84
Which resources are certified?•   Provider Aggregatable (PA) IP addresses•   Provider Independent (PI) addresses marked as...
Route Origination Authorisation (ROA)•   Next to the prefix and the ASN which is allowed    to announce it, the ROA contain...
Publication and validation•   ROAs are published in the same repositories as    the certificates and their keys•   You can ...
Validator
ROA Validation•   You can download all the certificates, public keys    and ROAs which form the RPKI•   Software running on...
Reasons for a ROA to be invalid•   The start date is in the future    – Actually   this is flagged as an error•   The end d...
The Decision Process•   When you receive a BGP announcement from    one of your neighbors you can compare this to    the v...
Modifying the Validated Cache•   The RIPE NCC Validator allows you to manually    override the validation process•   Addin...
The Decision is Yours•   The Validator is a tool which can help you    making informed decisions about routing•   Using it...
Public Testbeds  •   A few people allow access to routers that run      RPKI and allow you to have a look at it  •   RIPE ...
Roadmap•   Support for non-hosted is still under    development by the RIPE NCC    – Expected    release will be third qua...
Follow us!         @TrainingRIPENCC                            96
Questions? training@ripe.net
The End!             Kрай             Y Diwedd                                       Fí                  Соңы             ...
Upcoming SlideShare
Loading in...5
×

Getting IPv6 & Securing your Routing

1,752

Published on

Presentation given by Ferenc Csorba at:
IPv6 Kongress, Frankfurt, Germany, on 10-11 May 2012

Published in: Technology
0 Comments
0 Likes
Statistics
Notes
  • Be the first to comment

  • Be the first to like this

No Downloads
Views
Total Views
1,752
On Slideshare
0
From Embeds
0
Number of Embeds
2
Actions
Shares
0
Downloads
26
Comments
0
Likes
0
Embeds 0
No embeds

No notes for slide

Getting IPv6 & Securing your Routing

  1. 1. Getting IPv6 &Securing your RoutingIPv6 KongressMay 2012, FrankfurtSandra Brás & Ferenc Csorba, RIPE NCC
  2. 2. Schedule• IPv4 exhaustion• IPv6 address space• European IPv6 deployment statistics• BGP multihoming• Routing Registry and the RIPE Database• Resource Certification 2
  3. 3. RIPE / RIPE NCCRIPE Open community Develops addressing policies Working group mailing listsRIPE NCC Located in Amsterdam Not for profit membership organisation One of five RIRs 3
  4. 4. The five RIRs 4
  5. 5. Internet Number Resources• IP addresses - IPv4 eg. 193.0.0.203 - IPv6 eg. 2001:610:240:11::c100:1319• Autonomous System Numbers (ASN)• Other public services - Training Services - RIPE Labs - RIPE Database - RIPE Stat - K-root name server - RIPE Atlas - Measurement tools - E-learning 5
  6. 6. Registration 6
  7. 7. Conservation 7
  8. 8. Aggregation 8
  9. 9. Who makes policies? ICANN / IANA ASO AfriNIC Reach consensusARIN RIPE NCC across communities APNIC LACNIC AfriNIC RIPE ARIN APNIC LACNIC community community community community community proposal proposal Global proposal Policy Proposal proposal proposal 9
  10. 10. Why would you want to participate?• Policy determines how you run your business• Over 8000 LIRs• Only a fraction are active participants in the PDP 10
  11. 11. How can you participate?• Working Group mailing lists - RIPE website → RIPE → Mailing Lists• Come to the RIPE Meetings - Two free tickets for new LIRs - Remote participation is also possible 11
  12. 12. IPv4 Address PoolExhaustion
  13. 13. IANA IPv4 pool 40% 30% 20% 10% 0% 2000 2001 2002 2003 2004 2005 2006 2007 2008 2009 2010 2011 13
  14. 14. IPv4 address distribution /0 IANA /8 RIR /21 LIR /23 /25 /25 End User Allocation PA Assignment PI Assignment 14
  15. 15. IANA and RIRs IPv4 pool IANA Pool RIR Allocations Advertised RIR Pool Today256 Data19212864 0 1999 2000 2001 2002 2003 2004 2005 2006 2007 2008 2009 2010 2011 2012 15
  16. 16. Our slice of the IPv4 pie Legacy Other IANA AfriNIC LACNIC RIPE NCC ARIN APNIC 16
  17. 17. IPv4 exhaustion phases IPv4 still available. RIPE NCC’s allocation RIPE NCC can only RIPE NCC continues policy from last /8 distribute IPv6 distributing it applies ? now timeIANA pool RIPE NCC RIPE NCCexhausted reaches pool final /8 exhausted Each ofthe 5 RIRsgiven a /8 17
  18. 18. Run Out Fairly (of IPv4)• Gradually reduced allocation / assignment periods• Needs for “Entire Period” of up to... - 12 months (January 2010) - 9 months (July 2010) - 6 months (January 2011) - 3 months (July 2011)• 50% has to be used up by half-period 18
  19. 19. RIPE NCC’s last /8• We do things differently!• Ensures IPv4 access for all members - 16000+ /22s in a /8 - members can get one /22 (=1024 addresses) - must already hold IPv6 - must qualify for allocation• /16 set aside for unforeseen situations - if unused, will be distributed• No PI 19
  20. 20. Transfer of IPv4 Allocations• Policy 2007-08: Allocation Transfer Policy - Don’t buy your IPv4 on eBay! - Transfer unused allocations to another LIR - Minimum allocation size /21 - Evaluated by RIPE NCC - Update in RIPE Database http://www.ripe.net/lir-services/resource-management/listing 20
  21. 21. IPv4 Depletion in the RIPE NCC’s Region - https://www.ripe.net/internet-coordination/ipv4-exhaustion 21
  22. 22. 0 75 150 225 300 2000-01 2000-07 2001-01 2001-07 2002-01 2002-07 2003-01 2003-07 2004-01 2004-07 2005-01 IPv4 Allocation Rate 2005-07 2006-01 2006-07 2007-01 2007-07 2008-01 2008-07 2009-01 2009-07 2010-01 2010-07 2011-01 2011-07 2012-0122
  23. 23. IPv4 Depletion Worldwide IPv4 Pool in /8’s 6 5 4 3 2 1 0 AfriNIC RIPE NCC LACNIC ARIN APNIC 23
  24. 24. IPv6 Address Space
  25. 25. Where do all the addresses come from? IETF IANA AfriNIC ARIN RIPE NCC APNIC LACNIC 8000 LIRs End Users 25
  26. 26. IPv6 address distribution /3 IANA /12 RIR /32 LIR /48 /56 /48 End User PA Allocation Provider Aggregatable PI Assignment Assignment 26
  27. 27. IPv6 basics• IPv6 address: 128 bits - 32 bits in IPv4• Every subnet should be a /64• Customer assignments (sites) between: - /64 (1 subnet) - /48 (65536 subnets)• Minimum allocation size /32 - 65536 /48’s - 16777216 /56’s 27
  28. 28. IPv4 vs IPv6 (rounded off) IPv4 IPv6addresses 4x109 2x1019 subnets allocations 2x106 4x109to members in each allocation: in each allocation: subnetsaddresses 2048 4x109 28
  29. 29. Classless Inter-Domain Routing (CIDR) IPv6 Chart Prefix /48s /56s /64s Bits IPv4 CIDR Chart RIPE NCC /24 16M 4G 1T 104 /25 8M 2G 512G 103 IP Addresses Bits Prefix Subnet Mask /26 4M 1G 256G 102 /27 2M 512M 128G 101 /28 1M 256M 64G 100 1 0 /32 255.255.255.255 /29 512K 128M 32G 99 2 1 /31 255.255.255.254 /30 256K 64M 16G 98 4 2 /30 255.255.255.252 /31 128K 32M 8G 97 8 3 /29 255.255.255.248 /32 64K 16M 4G 96 16 4 /28 255.255.255.240 /33 32K 8M 2G 95 32 5 /27 255.255.255.224 /34 16K 4M 1G 94 64 6 /26 255.255.255.192 /35 8K 2M 512M 93 128 7 /25 255.255.255.128 /36 4K 1M 256M 92 256 8 /24 255.255.255.0 /37 2K 512K 128M 91 512 9 /23 255.255.254.0 /38 1K 256K 64M 90 1K 10 /22 255.255.252.0 /39 512 128K 32M 89 2K 11 /21 255.255.248.0 /40 256 64K 16M 88 4K 12 /20 255.255.240.0 /41 128 32K 8M 87 8K 13 /19 255.255.224.0 /42 64 16K 4M 86 16 K 14 /18 255.255.192.0 /43 32 8K 1M 85 32 K 15 /17 255.255.128.0 /44 16 4K 1M 84 64 K 16 /16 255.255.0.0 /45 8 2K 512K 83 128 K 17 /15 255.254.0.0 /46 4 1K 256K 82 256 K 18 /14 255.252.0.0 /47 2 512 128K 81 512 K 19 /13 255.248.0.0 /48 1 256 64K 80 1M 20 /12 255.240.0.0 /49 128 32K 79 /50 64 16K 78 2M 21 /11 255.224.0.0 /51 32 8K 77 4M 22 /10 255.192.0.0 /52 16 4K 76 8M 23 /9 255.128.0.0 /53 8 2K 75 16 M 24 /8 255.0.0.0 /54 4 1K 74 32 M 25 /7 254.0.0.0 /55 2 512 73 64 M 26 /6 252.0.0.0 /56 1 256 72 128 M 27 /5 248.0.0.0 /57 128 71 256 M 28 /4 240.0.0.0 RIPE NCC /58 64 70 512 M 29 /3 224.0.0.0 /59 32 69 1024 M 30 /2 192.0.0.0 /60 16 68 2048 M 31 /1 128.0.0.0 /61 8 67 4096 M 32 /0 0.0.0.0 /62 4 66 /63 2 65 Contact Registration Services: /64 1 64 www.ripe.net 29
  30. 30. Address Notation2001:0db8:003e:ef11:0000:0000:c100:004d2001:0db8:003e:ef11: 0000:0000:c100:004d2001:db8:3e:ef11:0:0:c100:4d1 1 1 0 1 1 1 1 0 0 0 1 0 0 0 1 30
  31. 31. Getting an IPv6 allocation• To qualify, an organisation must: - Be an LIR - Have a plan for making assignments within two years• Minimum allocation size /32• Announcement as a single prefix recommended 31
  32. 32. RIPE Policy Proposal 2011-04• Extension of the Minimum Size for IPv6 Initial Allocation - Proposes initial allocation up to a /29 - For example, for small LIRs to deploy IPv6 via 6RD (RFC 5969) DER DISCUSSION UN• Proposal currently in Review Phase - The RIPE NCC is working on impact analysis 32
  33. 33. What does the first IPv6 allocation cost? - for all - pending General Meeting decision or: - for approximately 97% of the LIRs - more points, but not higher category! 33
  34. 34. Why Create an IPv6 Addressing Plan?• Mental health during implementation(!)• Easier implementation of security policies• Efficient addressing plans are scalable• More efficient route aggregation 34
  35. 35. IPv6 Subnetting 35
  36. 36. Make an addressing plan (I)• Number of hosts is irrelevant• Multiple /48s per pop can be used - separate blocks for infrastructure and customers - document address needs for allocation criteria• /64 for all subnets - autoconfiguration works - renumbering easier - less typo errors because of simplicity 36
  37. 37. Make an addressing plan (II)• Use one /64 block (per site) for loopbacks - One /128 per device - One /64 contains enough /128s for 18.446.744.073.709.551.616 devices 37
  38. 38. More On Addressing Plans for ISPs• For private networks, look at ULA• For servers you want manual configuration• Use port numbers for addresses - pop server 2001:db8:1::110 - dns server 2001:db8:1::53 - etc... 38
  39. 39. Point-to-Point Connections• How much space for point-to-point connections? - RFC4291: Interface IDs are required to be /64 - RFC3627: Use of /127 between routers considered harmful - RFC6547: RFC3627 to Historic Status - RFC6164: Using /127 on Inter-Router links• Be safe: reserve a /64, assign a /127 per point-to-point connection 39
  40. 40. Customer assignments• Give your customers enough addresses - Up to a /48• For more addresses, send in request form - Alternatively, make a sub-allocation• Every assignment must now be registered in the RIPE database 40
  41. 41. Using AGGREGATED-BY-LIR ALLOCATED-BY-RIR ASSIGNED AGGREGATED-BY-LIRALLOCATED-BY-LIR /36 /44 assignment-size: 56 /34AGGREGATED-BY-LIR assignment-size: 48 /40 hint :)/48 /48 /48 /48 /48 41
  42. 42. Group assignments in the RIPE DB inet6num:        2001:db8:1000::/36 netname:         Bluelight descr:           We want more Bluelight B.V. descr:      Colocation services country:          NL admin-c:         BN649-RIPE tech-c:          BN649-RIPE status:          AGGREGATED-BY-LIR assignment-size: 48 mnt-by:          BLUELIGHT-MNT notify:          noc@example.net changed:        noc@example.net 20110218 source:         RIPE 42
  43. 43. Customers And Their /48• Customers have no idea how to handle 65536 subnets!• Provide them with information – https://www.ripe.net/lir-services/training/material/IPv6- for-LIRs-Training-Course/IPv6_addr_plan4.pdf 43
  44. 44. IPv6 Address Management• Your Excel sheet might not scale – There are 65.536 /48s in a /32 – There are 65.536 /64s in a /48 – There are 16.777.216 /56s in a /32• Find a suitable IPAM solution 44
  45. 45. Getting IPv6 PI address space• To qualify, an organisation must: - Meet the contractual requirements for provider independent resources• Minimum assignment size /48 45
  46. 46. Reverse DNS2001:db8:3e:ef11::c100:4d 46
  47. 47. Reverse DNS2001 db82001:0db8:003e:ef11:0000:0000 :c100: 004d . . . . . . . .ip6.arpad.4.0.0.0.0.1.c.0.0.0.0.0.0.0.0.1.1.f.e.e. 3.0.0.8.b.d.0.1.0.0.2.ip6.arpa PTR yourname.domain.tldd.4.0.0.0.0.1.c.0.0.0.0.0.0.0.0.1.1.f.e.e.3.0.0.8.b.d.0.1.0.0.2.ip6.arpa PTR yourname.domain.tld 47
  48. 48. IPv6 DeploymentStatistics
  49. 49. IPv6 Allocation Rate 2
  50. 50. IPv6 PI Assignments 3
  51. 51. Members with IPv6 and IPv4 7853 members with IP resources 3846 3918 89 IPv4 only IPv6 only IPv6 and IPv4 51
  52. 52. IPv6 Ripeness • Rating system: - One star if the LIR has an IPv6 allocation - Additional stars if: - IPv6 Prefix is announced on router - A route6 object is in the RIPE Database - Reverse DNS is set up - A list of all 4 star LIRs: http://ripeness.ripe.net/ 52
  53. 53. IPv6 RIPEness: 8097 LIRs (5 May 2012) 1 star 2 stars 3 stars 4 stars No IPv6 1 star 14% No IPv6 51% 2 stars 6% 3 stars 11% 4 stars 18%
  54. 54. 0 225 450 675 900 Slovenia (47 LIRs) Netherlands (418 LIRs) 1starCzech Republic (221 LIRs) Germany (821 LIRs) 2star Switzerland ( 260 LIRs) Poland (214 LIRs) 3star Austria (155 LIRs) Portugal (37 LIRs) 4star Norway (163 LIRs) IPv6 RIPEness – countries (5 May 2012) Denmark (123 LIRs) 0star 54
  55. 55. 0% 25% 50% 75% 100% Slovenia (47 LIRs) Netherlands (418 LIRs) 1starCzech Republic (221 LIRs) Germany (821 LIRs) 2star Switzerland (260 LIRs) Poland (214 LIRs) 3star Austria (155 LIRs) Portugal (37 LIRs) 4star Norway (163 LIRs) IPv6 RIPEness – relative (5 May 2012) Denmark (123 LIRs) 0star 55
  56. 56. IPv6 enabled ASes in global routing All Germany Belgium France Netherlands50% http://v6ASNs.ripe.net42%33%25%17%8%0% 2004 2005 2006 2007 2008 2009 2010 2011 2012 56
  57. 57. World IPv6 Launch• http://www.worldipv6launch.org/ 57
  58. 58. Useful information Websites• http://www.getipv6.info/• http://www.ipv6actnow.org• http://datatracker.ietf.org/wg/v6ops/• http://www.ripe.net/ripe/docs/ripe-501.html Mailing lists• http://lists.cluenet.de/mailman/listinfo/ipv6-ops• http://www.ripe.net/mailman/listinfo/ipv6-wg 58
  59. 59. Multihomed BGPRouting Setup
  60. 60. Scenario 1: LIR = PA allocation + ASN ISP 1 ISP 2 x AS3 AS7 AS4 AS5 AS6• Can make assignments to End Users 60
  61. 61. Scenario 2: End User = PI + ASN ISP 1 ISP 2 x• Can NOT sub-assign further!!! - (in IPv4 can still use PI for xDSL, broadband...) 61
  62. 62. Scenario 3: LIR = PI + ASN ISP 1 ISP 2 x• Can NOT sub-assign further!!! - (in IPv4 can still use PI for xDSL, broadband...) 62
  63. 63. Scenario 4: PI End User, not multihomed ISP 1 ISP 2 x• Part of LIR’s AS number - does not want to / can not run BGP - still wants “portable” addresses 63
  64. 64. How to get an AS Number• Assignment requirements - Address space - Multihoming - One AS Number per network• For LIR itself• For End User - Sponsoring LIR requests it for End User - Direct Assignment User requests it for themselves 64
  65. 65. 32-bit AS Numbers and you• New format: “AS4192351863”• Act now!• Prepare for 32-bit ASNs in your organisation: - Check if hardware is compatible; if not, contact hardware vendor - Check if upstream uses compatible hardware; if not, they should upgrade! 65
  66. 66. RIPE Database
  67. 67. RIPE Database• Public Internet resource and routing registry database 67
  68. 68. RIPE Database objects• Resources – inetnum, inet6num, aut-num, domain• Routing – route, route6, aut-num• Security – mntner• Contact – organisation, person, role 68
  69. 69. Protection mntner: LIR-MNT person: John Smith admin-c: JS123-RIPE nic-hdl: JS123-RIPE tech-c: JS123-RIPE address: sesamestreet 1 mnt-by: LIR-MNT phone: +1 555 0101 notify: noc@example.org e-mail: john@example.org mnt-nfy: list@example.org mnt-by: LIR-MNT abuse-mailbox: abuse@example.org auth: MD5-PW $1$xT9SJ 69
  70. 70. Protection inetnum: 85.11.186.0/25 descr: My Assignment status: ASSIGNED PA mnt-by: LIR-MNT admin-c: LA789-RIPE tech-c: LA789-RIPEmntner: LIR-MNTadmin-c: LA789-RIPE person: John Smithtech-c: LA789-RIPE nic-hdl: JS123-RIPEmnt-by: LIR-MNT mnt-by: LIR-MNTnotify: noc@example.org address: sesamestreet 1mnt-nfy: list@example.org phone: +1 555 0101abuse-mailbox: abuse@example.org e-mail: john@example.orgauth: MD5-PW $1$xT9SJ aut-num: 64551 descr: My AS Number mnt-by: RIPE-NCC-END-MNT mnt-by: LIR-MNT org: ORG-BB2-RIPE admin-c: LA789-RIPE tech-c: LA789-RIPE 70
  71. 71. Routing Registry
  72. 72. What is “Internet Routing Registry”• Distributed databases with public routing policy information, mirroring each other: irr.net - APNIC, RADB, Level3, SAVVIS...• RIPE NCC operates “RIPE Routing Registry”• Big operators make use of it - AS286 (KPN), AS5400 (BT), AS1299 (Telia), AS8918 (Carrier1), AS2764 (Connect), AS3561 (Savvis), AS3356 (Level 3)... 72
  73. 73. Publishing routing policy in IRR• Required by some Transit Providers & IXPs - they use it for prefix-based filtering• Allows for automated generation of prefix filters - and router configuration commands, based on RR• Contributes to routing security - prefix filtering based on IRR registered routes prevents accidental leaks and route hijacking• Good housekeeping 73
  74. 74. RIPE RR is part of the RIPE Database• route[6] object creation is responsibility of LIR - every time you receive a new allocation, do create a route or route6 object• route and route6 objects represent routed prefix - address space being announced by an AS number 74
  75. 75. Route and route6 object organisation: ORG-BB2-RIPE route6: 2001:db8::/32 origin: AS2 tech-c: LA789-RIPE admin-c: JD1-RIPE mnt-by: RIPE-NCC-HM-MNTinet6num: 2001:db8::/32 aut-num: AS2tech-c: LA789-RIPE tech-c: LA789-RIPEadmin-c: JD1-RIPE admin-c: JD1-RIPEmnt-by: RIPE-NCC-HM-MNT mnt-by: RIPE-NCC-HM-MNT 75
  76. 76. IPv6 in the Routing RegistryRoute6 object: route6: 2001:DB8::/32 origin: AS65550Aut-num object: aut-num: AS65550 mp-import: afi ipv6.unicast from AS64496 accept ANY mp-export: afi ipv6.unicast to AS64496 announce AS65550 76
  77. 77. Automation of router configuration• Describing routing policy in aut-num enables generation of route-maps for policy routing• Tools can read your policy towards peers - translation from RPSL to router configuration commands• Tools collect the data your peers have in RR - if their data changes, you only have to periodically run your scripts to collect updates 77
  78. 78. Resource Certification
  79. 79. Limitations of the Routing Registry• Many registries exist, operated by different parties: – Not all of them mirror each other – Do you trust the information they provide?• The IRR system is far from complete• Resulting filters are hard to maintain and can take a lot of router memory 79
  80. 80. The RIPE NCC involvement in RPKI• The authority who is the holder of an Internet Number Resource in our region – IPv4 and IPv6 address ranges – Autonomous System Numbers• Information is kept in the registry• Accuracy and completeness are key 80
  81. 81. Digital resource certificates• Issue digital certificates along with the registration of Internet Resources• Two main purposes: – Make the registry more robust – Making Internet Routing more secure• Validation is the added value 81
  82. 82. Using certificates• Certification is a free, opt-in service – Your choice to request a certificate – Linked to your membership – Renewed every 12 months• Certificate does not list any identity information• Digital proof you are the holder of a resource 82
  83. 83. The PKI system• The RIRs hold a self-signed root certificate for all the resources that they have in the registry – They are the trust anchor for the system• That root certificate is used to sign a certificate that lists your resources• You can issue child certificates for those resources to your customers – When making assignments or sub allocations 83
  84. 84. Certificate Authority (CA) Structure Root CA (RIPE NCC) Member CA (LIR) Customer CA 84
  85. 85. Which resources are certified?• Provider Aggregatable (PA) IP addresses• Provider Independent (PI) addresses marked as “Infrastructure”• Other resources will be added over time: – PI addresses for which we have a contract – ERX resources 85
  86. 86. Route Origination Authorisation (ROA)• Next to the prefix and the ASN which is allowed to announce it, the ROA contains: –A minimum prefix length –A maximum prefix length – An expiry date• Multiple ROAs can exist for the same prefix• ROAs can overlap 86
  87. 87. Publication and validation• ROAs are published in the same repositories as the certificates and their keys• You can download them and use software to verify all the cryptographic signatures are valid – Was this really the owner of the prefix?• You will end up with a list of prefixes and the ASN that is expected to originate them – And you can be sure the information comes from the holder of the resources 87
  88. 88. Validator
  89. 89. ROA Validation• You can download all the certificates, public keys and ROAs which form the RPKI• Software running on your own machine can retrieve and then verify the information – Cryptographic tools can check all the signatures• The result is a list of all valid combinations of ASN and prefix, the “validated cache” 89
  90. 90. Reasons for a ROA to be invalid• The start date is in the future – Actually this is flagged as an error• The end date is in the past – It is expired and the ROA will be ignored• The signing certificate or key pair has expired or has been revoked• It does not validate back to a configured trust anchor 90
  91. 91. The Decision Process• When you receive a BGP announcement from one of your neighbors you can compare this to the validated cache• There are three possible outcomes: – Unknown: there is no covering ROA for this prefix – Valid: a ROA matching the prefix and ASN is found – Invalid: There is a ROA but it does not match the ASN or the prefix length 91
  92. 92. Modifying the Validated Cache• The RIPE NCC Validator allows you to manually override the validation process• Adding an ignore filter will ignore all ROAs for a given prefix – The end result is the validation state will be “unknown”• Creating a whitelist entry for a prefix and ASN will locally create a valid ROA – The end result is the validation state becomes “valid” 92
  93. 93. The Decision is Yours• The Validator is a tool which can help you making informed decisions about routing• Using it properly can enhance the security and stability of the Internet• It is your network and you make the final decision 93
  94. 94. Public Testbeds • A few people allow access to routers that run RPKI and allow you to have a look at it • RIPE NCC has a Cisco: – Telnet to rpki-rtr.ripe.net – User: ripe, no password • Eurotransit has a Juniper: – Telnet to 193.34.50.25 or 193.34.50.26 – Username: rpki, password: testbed(http://www.ripe.net/lir-services/resource-management/certification/tools-and-resources) 94
  95. 95. Roadmap• Support for non-hosted is still under development by the RIPE NCC – Expected release will be third quarter 2012• We can give you access to beta test – Mail certification@ripe.net if you are interested• More information will be published on the certification website – http://www.ripe.net/certification 95
  96. 96. Follow us! @TrainingRIPENCC 96
  97. 97. Questions? training@ripe.net
  98. 98. The End! Kрай Y Diwedd Fí Соңы Finis Liðugt Ende Finvezh KiнецьKonec Kraj Ënn FundLõpp Beigas Vége Son Kpaj An Críoch ‫הסוף‬ EndirFine Sfârşit Fin Τέλος Einde Конeц Slut Slutt Pabaiga Amaia Loppu Tmiem Koniec Fim
  1. A particular slide catching your eye?

    Clipping is a handy way to collect important slides you want to go back to later.

×