<html><body><div style="font-family: arial, helvetica, sans-serif; font-size: 12pt; color: #000000"><div>Hello</div><div><br data-mce-bogus="1"></div><div> <span style="color: #000000; font-family: calibri; font-size: 14px; font-style: normal; font-variant-ligatures: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; white-space: normal; background-color: #ffffff; text-decoration-thickness: initial; text-decoration-style: initial; text-decoration-color: initial; display: inline !important; float: none;" data-mce-style="color: #000000; font-family: calibri; font-size: 14px; font-style: normal; font-variant-ligatures: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; white-space: normal; background-color: #ffffff; text-decoration-thickness: initial; text-decoration-style: initial; text-decoration-color: initial; display: inline !important; float: none;">Did your ddos provider say that their upstreams required exact route6 matches for your announcements? <span> --- No, but I was wondering what do other AS-s do with my ipv6 prefix, if they are using IRR filtering in bgp. <br></span></span></div><div><span style="color: #000000; font-family: calibri; font-size: 14px; font-style: normal; font-variant-ligatures: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; white-space: normal; background-color: #ffffff; text-decoration-thickness: initial; text-decoration-style: initial; text-decoration-color: initial; display: inline !important; float: none;" data-mce-style="color: #000000; font-family: calibri; font-size: 14px; font-style: normal; font-variant-ligatures: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; white-space: normal; background-color: #ffffff; text-decoration-thickness: initial; text-decoration-style: initial; text-decoration-color: initial; display: inline !important; float: none;"><span style="color: #000000; font-family: calibri; font-size: 14px; font-style: normal; font-variant-ligatures: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; white-space: normal; background-color: #ffffff; text-decoration-thickness: initial; text-decoration-style: initial; text-decoration-color: initial; display: inline !important; float: none;" data-mce-style="color: #000000; font-family: calibri; font-size: 14px; font-style: normal; font-variant-ligatures: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; white-space: normal; background-color: #ffffff; text-decoration-thickness: initial; text-decoration-style: initial; text-decoration-color: initial; display: inline !important; float: none;"><span>I am not talking only about providers and providers providers. I am talking about all the AS-s in that participate in the global table and accept the full bgp table and filter it based on the IRR and/or ROA record. How can I be sure that they won't just drop my prefixes only because of the incorrect route6 object values?</span></span></span><div style="clear: both;" data-mce-style="clear: both;">To eliminate the risk of my prefix getting blocked in some third party AS I would like to have correct route(6) objects, not almost correct (which technically are incorrect).</div></div><div><span style="color: #000000; font-family: calibri; font-size: 14px; font-style: normal; font-variant-ligatures: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; white-space: normal; background-color: #ffffff; text-decoration-thickness: initial; text-decoration-style: initial; text-decoration-color: initial; display: inline !important; float: none;" data-mce-style="color: #000000; font-family: calibri; font-size: 14px; font-style: normal; font-variant-ligatures: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; white-space: normal; background-color: #ffffff; text-decoration-thickness: initial; text-decoration-style: initial; text-decoration-color: initial; display: inline !important; float: none;"><span><br data-mce-bogus="1"></span></span></div><div><div style="clear: both;" data-mce-style="clear: both;"><font face="calibri"><span style="font-size: 14px;">In 99% cases you must have route(6) objects and it is good to also have ROA record to announce prefix to higher tier transit providers. But as far as I know you can't add "max length" to route6 object.</span></font></div><div style="clear: both;" data-mce-style="clear: both;"><font face="calibri"><span style="font-size: 14px;">Since route6 object is a must and ROA is a should and they ultimately fill the same purpose, than why isn't there a "max length" in route6 object?</span></font></div></div><div><br></div><div data-marker="__SIG_PRE__"><div style="font-family:'helvetica' , 'arial';font-size:12.96px;background-color:rgb( 253 , 253 , 253 )"><span style="font-size:11pt">Lugupidamisega / Best regards,</span><br><br><span style="font-size:11pt">Kaupo Ehtnurm</span></div><div style="font-family:'helvetica' , 'arial';font-size:12.96px;background-color:rgb( 253 , 253 , 253 )"><span style="font-size:11pt"><br></span></div><div style="font-family:'helvetica' , 'arial';font-size:12.96px;background-color:rgb( 253 , 253 , 253 )"><span style="font-size:11pt"><img data-mce-src="https://zimbra.wavecom.ee/home/kris@wavecom.ee/Briefcase/logo signatuur.png" src="cid:0afde61abec649b3d782af7586b998508d28c489@zimbra"></span><br><span style="font-size:11pt">Network & System administrator</span></div><div style="font-family:'helvetica' , 'arial';font-size:12.96px;background-color:rgb( 253 , 253 , 253 )"><span style="font-size:11pt">WaveCom AS <br></span></div><div style="font-family:'helvetica' , 'arial';font-size:12.96px;background-color:rgb( 253 , 253 , 253 )"><span style="font-size:11pt">ISO 9001 & 27001 Certified DC and verified VMware Cloud<br></span></div><div style="font-family:'helvetica' , 'arial';font-size:12.96px;background-color:rgb( 253 , 253 , 253 )"><span style="font-size:11pt"><span class="Object" id="OBJ_PREFIX_DWT778_ZmEmailObjectHandler" style="color:darkblue"><span class="Object" id="OBJ_PREFIX_DWT796_ZmEmailObjectHandler">kaupo@wavecom.ee</span></span> | <span class="Object" id="OBJ_PREFIX_DWT779_com_zimbra_phone" style="color:darkblue"><a style="color:darkblue">+372 5685 0002</a></span></span><br><span style="font-size:11pt">Endla 16, Tallinn 10142 Estonia | <span class="Object" id="OBJ_PREFIX_DWT780_com_zimbra_url" style="color:darkblue"><span class="Object" id="OBJ_PREFIX_DWT797_com_zimbra_url"><a href="http://www.wavecom.ee/" style="color:darkblue" rel="nofollow noopener noreferrer nofollow noopener noreferrer" target="_blank">www.wavecom.ee</a></span></span></span></div></div><div><br></div><hr id="zwchr" data-marker="__DIVIDER__"><div data-marker="__HEADERS__"><b>From: </b>"Nick Hilliard" <nick@foobar.org><br><b>To: </b>"Kaupo Ehtnurm" <kaupo@wavecom.ee><br><b>Cc: </b>"Kaupo Ehtnurm via db-wg" <db-wg@ripe.net><br><b>Sent: </b>Friday, July 7, 2023 7:25:20 PM<br><b>Subject: </b>Re: [db-wg] Route(6) objects<br></div><div><br></div><div data-marker="__QUOTED_TEXT__"><div style="font-size:14px;font-family:'calibri'">Did your ddos provider say that their upstreams required exact route6 matches for your announcements? The bgp session between you and your DDOS provider definitely won't require this, and the likelihood is that a covering /32 route6: object will be sufficient in many cases for your provider's providers. I.e. you won't have serious connectivity problems if there aren't exact matches for your /48s.<br><br>In any event, this isn't really catered for in RPSL. Some organisations implement strict filtering on route objects; others loose. RPKI might be a better option, as it allows you to specify a prefix length range. See RFC 9319 for some suggestions.<br><br>Nick<br><br>Kaupo Ehtnurm via db-wg wrote on 07/07/2023 16:11:<br><blockquote><pre>Hello Sorry, you didn't say. But starting to manually advertise /48 to my DDoS protection provider beats the purpose of automatic DDoS protection. Lugupidamisega / Best regards, Kaupo Ehtnurm Network & System administrator WaveCom AS ISO 9001 & 27001 Certified DC and verified VMware Cloud <a href="mailto:kaupo@wavecom.ee" target="_blank" rel="nofollow noopener noreferrer">kaupo@wavecom.ee</a> | +372 5685 0002 Endla 16, Tallinn 10142 Estonia | [ <a href="http://www.wavecom.ee/" target="_blank" rel="nofollow noopener noreferrer">http://www.wavecom.ee/</a> | <a href="http://www.wavecom.ee" target="_blank" rel="nofollow noopener noreferrer">www.wavecom.ee</a> ] ----- Original Message ----- From: "Randy Bush via db-wg" <a href="mailto:db-wg@ripe.net" target="_blank" rel="nofollow noopener noreferrer"><db-wg@ripe.net></a> To: "Kaupo Ehtnurm via db-wg" <a href="mailto:db-wg@ripe.net" target="_blank" rel="nofollow noopener noreferrer"><db-wg@ripe.net></a> Sent: Friday, July 7, 2023 6:05:53 PM Subject: Re: [db-wg] Route(6) objects </pre><blockquote><pre>Here the problem is "for longer defensive prefixes" For example in normal situation I advertise /32 to my ip transit providers. When DDoS happens then one of my providers will start advertisin 1x/48 of my /32 prefix to hi-jack the route from us and filter it. </pre></blockquote><pre>i did not say that your provider advertised, did i? </pre><blockquote><blockquote><pre>By doing this the internet will always (also under normal circumstances) prefer that one provider. 0 - register irr and rpki objects for aggregates and for longer defensive prefixes 1 - announce only aggregates to both providers 2 - when ddosed, - do not change announcement of aggregate to non-mediating - deaggregate announcement to mediating provider 3 - when ddos ends, return to state 1 </pre></blockquote></blockquote><pre>randy </pre></blockquote></div><br></div></div></body></html>