[lir-wg] AS Number Policy

  Beri,
  
  I agree with most of your statements, in particular your assessment of
  the "credibility" of RIS data *) to base such important decisions on -
  as well as the suggestion to accept a "statement of use" as sufficient.
  
  However, doing so leaves me with a cost vs. benefit ratio for the whole
  exercise!

  I guess there is a considerably big number of AS#s the RIR/LIR tree does
  not have authority over (or rather: distribution predating existence of
  those structures).

  And, unless we have a _clear consensus_ that going through this exercise
  can avoid the introduction of AS#s with more than 16 bits _altogether_
  (or at least extends the lifetime of the 16bit version *considerably*),
  the whole issue might be mute...
  
  Wilfried.

*) this is not questioning the usefulness or utility of RIS data, but it
   seems to be the wrong tool for obtaining a reliable reading for this
   context. And I guess it's pretty easy to fake...
______________________________________________________________________

Date: Tue, 9 Jul 2002 15:33:53 +0200 (CEST)
From: Berislav Todorovic <beri at kpnqwest.net>
To: leo vegoda <leo at ripe.net>
CC: lir-wg at ripe.net
Subject: Re: [lir-wg] AS Number Policy

On Tue, 9 Jul 2002, leo vegoda wrote:

>> We would be grateful if the community would clarify the policy so
>> that it is clear when an unused AS number should be returned to
>> the pool.

Let's try to summarize things a bit: this issue is not only about numbers and
timescale. A complete AS number revokation policy must comprise of 4
components:

* Audit policy on AS number usage.
* Clear definition of policy violation.
* Revoking AS numbers from customers violating AS number usage policies.
* Reusing revoked AS numbers.

RIPE NCC reserves the right to perform periodic audits on AS number usage and
take appropriate actions if necessary, to enforce compliance with ripe-245
and RFC 1930.

RIPE NCC will use RIS to check if an AS number is used with compliance with
those documents.

RIPE NCC must never consider RIS as the ultimate source and must always raise
an audit ticket towards the LIR and/or an end customer of an AS before taking
any further action.

A possible violation of the policy happens if an AS number:

(1) Does not appear in the routing table at all:
    (a) Assigned, but never appeared (startup case) within S months.
    (b) Missing completely for more than D months.
(2) Appears in the routing table via a single AS path for more than M months.

While we can discuss on the values of S, D and M special care must be taken
on revokation and reusal policy.

For (1a) - there seems to be a consensus that S would be 3 months.
For (1b) - just to be on the safe side D should be at least 6 months.
For (2)  - also to be on the safe side M should be at least 12 months.

If a violation if found, RIPE NCC reserves the right to notify the LIR that
requested the AS number about violation and ask them to provide additional
evidence that the AS number is still in valid use. A clear statement from the
LIR that the AS number is still used in compliance with the policy MUST be
enough to close the audit ticket. No further action should be taken in that
case.

If there is no response from the LIR, RIPE NCC should contact the admin-c and
tech-c specified in the aut-num object. In a lot of cases an AS number is
issued by a LIR that doesn't have anything to do with the customer any more.

If no response counting from notification date is received from the end
customer:

* In the case (1a) - within 3 months,
* In the case (1b) - within 6 months,
* In the case (2)  - within 12 months

the AS number may be revoked by RIPE NCC.

AS number reusage policy - a revoked AS number may be reused after certain
period of time, defined as:

* In the case (1a) - 3 months after it is revoked from the end customer.
* In the case (1b) - same time period that elapsed between revokation date
  and initial assignment date of the AS number. That should give enough time
  to all people to cleanup their configurations, policies etc.
* In the case (2) - same as (1b).

Regards,
Beri

--------------------------------------------------------------------------------