[members-discuss] An ISP offers to announce our prefix. Is that normal?

Hello,

If the IP's are your's, PCCW should definitely not continue to announce
them if you tell them not to, perhaps start announcing it from somewhere
else and remove any route objects so that from everyone's perspective they
are hijacking the IP range, this has happened to us before and we usually
just threaten to make the issue public and talk to RIPE and usually it
works.

On Tue, Nov 12, 2019 at 1:09 PM Bothe, Jason <Jason.Bothe at invesco.com>
wrote:

> If anyone could tell me how to get an ISP to 'un-announce' prefixes on
> your behalf I will buy them dinner. I have two prefixes of mine that PCCW
> won't to take down and at this point I have better chances of convincing
> Donald Trump to resign than I do getting PCCW to remove them from their
> announcements.
>
> J~
>
> On 11/12/19, 6:48 AM, "members-discuss on behalf of Job Snijders" <
> members-discuss-bounces at ripe.net on behalf of job at ntt.net> wrote:
>
>     Dear Bernd,
>
>     Good questions, thanks for bringing them up, this topic indeed doesn't
>     receive much attention.
>
>     I can't comment on the specifics of your case in regard to SLA and what
>     the best choices are for your organisation, but I can share one small
>     data point.
>
>     On Tue, Nov 12, 2019 at 12:16:53PM +0100, Bernd Naumann wrote:
>     > Then the ISP offered us to announce _our_ prefix for us, from their
>     > ASN, and here I lost trust, and stopped the planning for now to get
>     > either confirmation or an other red flag.
>
>     This actually is a common practise!
>
>     Speaking from NTT's perspective we see that customer's used to run BGP
>     in the past, but no longer have interest in maintaining that
>     infrastructure and switch to a "Direct Internet Access" (DIA) product
>     which usually is statically routing the IP space and perhaps using a
>     first-hop redundancy protocol. In such cases the customers request NTT
>     to announce the space on their behalf - which we can do provided that a
>     RPKI ROA and IRR route object are created to demonstrate to the world
>     that we in fact are allowed to originate the prefix.
>
>     > - Is this even "allowed" or recommend by RIPE policies or BCPs?
>
>     yes, this is allowed; and if it adequately addresses the challenges you
>     are trying to solve for your organisation I'd say it is even
>     'recommended' ;-) - the real answer is "it depends".
>
>     > - Wouldn't that be at least looks like a/an BGP hijacking (attempt)?
>
>     it would not look like a BGP hijack if RPKI ROAs / IRR "route:/route6:"
>     objects are created in the appropriate places authorising the ASN that
>     originates the prefix.
>
>     > - Just in case this is ok-ish, how would I setup the ROA with RPKI
> so that
>     > it would be come valid?
>
>     You'd go to the RIPE web portal, and create a RPKI ROA like you'd
>     normally do, but instead of inputting your own ASN you input the ASN of
>     the provider that will announce the space on your behalf. You
>     create/have multiple ROAs covering the same prefix but with different
>     Origin ASNs co-exist - this allows you to make-before-break in
>     transitions such as you might be going through at this moment.
>
>     A variant of the scenario you describe is "BYOIP" in context of the
>     cloud providers. The analogy is that instead of routing your IP space
> to
>     your office, some cloud providers offer to announce your IP space and
>     route it to your virtual datacenter:
>
>
> https://urldefense.proofpoint.com/v2/url?u=https-3A__aws.amazon.com_vpc_faqs_-23Bring-5FYour-5FOwn-5FIP&d=DwICAg&c=MWFkEADu9ctt4KEmLIuwsQ&r=aNH3UFbvNKJFeaKLnEx5sWc0jPyXLBSnLQU0V6pTp1U&m=cngdDIcxq1dCVmEzgJd6Uq2XrWGQdta0BKRKcDWzHe4&s=r6F6zj0eWYSBLwke7RzsjRWmiMDnA48kBc8MtH6LHY4&e=
>
> https://urldefense.proofpoint.com/v2/url?u=https-3A__developers.cloudflare.com_spectrum_getting-2Dstarted_byoip_&d=DwICAg&c=MWFkEADu9ctt4KEmLIuwsQ&r=aNH3UFbvNKJFeaKLnEx5sWc0jPyXLBSnLQU0V6pTp1U&m=cngdDIcxq1dCVmEzgJd6Uq2XrWGQdta0BKRKcDWzHe4&s=FVQO-bem3vPPgWp_IBnXM0T--YTxtYfdLWLEWXRQPQs&e=
>
> https://urldefense.proofpoint.com/v2/url?u=https-3A__cloud.ibm.com_docs_tutorials-3Ftopic-3Dsolution-2Dtutorials-2Dbyoip&d=DwICAg&c=MWFkEADu9ctt4KEmLIuwsQ&r=aNH3UFbvNKJFeaKLnEx5sWc0jPyXLBSnLQU0V6pTp1U&m=cngdDIcxq1dCVmEzgJd6Uq2XrWGQdta0BKRKcDWzHe4&s=8REIxiHlVLSmo3TNJ7qNSmgsfGVHpxq5Ttd0mibZ0ww&e=
>
> https://urldefense.proofpoint.com/v2/url?u=https-3A__www.zdnet.com_article_google-2Dcloud-2Dnow-2Dlets-2Dyou-2Dbring-2Dyour-2Down-2Dip-2Daddress-2Dto-2Dall-2D20-2Dregions_&d=DwICAg&c=MWFkEADu9ctt4KEmLIuwsQ&r=aNH3UFbvNKJFeaKLnEx5sWc0jPyXLBSnLQU0V6pTp1U&m=cngdDIcxq1dCVmEzgJd6Uq2XrWGQdta0BKRKcDWzHe4&s=TdoE7Lfs-p40nmMmMndCui0e-SGGPxEGMxGkvD9N9aQ&e=
>
> https://urldefense.proofpoint.com/v2/url?u=https-3A__ideas.digitalocean.com_ideas_DO-2DI-2D566-23-3A-7E-3AtargetText-3DSupport-2520Bring-2520Your-2520Own-2520IP-2520Space-2Ctheir-2520AS-2520to-2520your-2520server&d=DwICAg&c=MWFkEADu9ctt4KEmLIuwsQ&r=aNH3UFbvNKJFeaKLnEx5sWc0jPyXLBSnLQU0V6pTp1U&m=cngdDIcxq1dCVmEzgJd6Uq2XrWGQdta0BKRKcDWzHe4&s=TYJoDyr0WewiKRJ3rLvbaA1Y1q2ICKACpeEI7stPDw8&e=
> .
>
>     Your IP resources are yours*, and you are free to authorize anyone to
>     route them on your behalf on the public internet.
>
>     Kind regards,
>
>     Job
>
>     * not meaning to start debate about ownership, just wanted to emphasize
>       that whether you do your own BGP or have someone do it on your behalf
>       is the same.
>
>     _______________________________________________
>     members-discuss mailing list
>     members-discuss at ripe.net
>
> https://urldefense.proofpoint.com/v2/url?u=https-3A__lists.ripe.net_mailman_listinfo_members-2Ddiscuss&d=DwICAg&c=MWFkEADu9ctt4KEmLIuwsQ&r=aNH3UFbvNKJFeaKLnEx5sWc0jPyXLBSnLQU0V6pTp1U&m=cngdDIcxq1dCVmEzgJd6Uq2XrWGQdta0BKRKcDWzHe4&s=LLJl3WzcTkyuUBaUuRuuAvmBoRj00wIunLBsYcEpE1M&e=
>     Unsubscribe:
> https://urldefense.proofpoint.com/v2/url?u=https-3A__lists.ripe.net_mailman_options_members-2Ddiscuss_jason.bothe-2540invesco.com&d=DwICAg&c=MWFkEADu9ctt4KEmLIuwsQ&r=aNH3UFbvNKJFeaKLnEx5sWc0jPyXLBSnLQU0V6pTp1U&m=cngdDIcxq1dCVmEzgJd6Uq2XrWGQdta0BKRKcDWzHe4&s=zF-69Zepe30kowdDFJeO2wQGvCB9SrGXxicJii7w6Ug&e=
>
>
>
> ****************************************************************
> Confidentiality Note: The information contained in this
> message, and any attachments, may contain confidential
> and/or privileged material.  It is intended solely for the
> person(s) or entity to which it is addressed.  Any review,
> retransmission, dissemination, or taking of any action in
> reliance upon this information by persons or entities other
> than the intended recipient(s) is prohibited.  If you received
> this in error, please contact the sender and delete the
> material from any device.
> ****************************************************************
> _______________________________________________
> members-discuss mailing list
> members-discuss at ripe.net
> https://mailman.ripe.net/
> Unsubscribe:
> https://lists.ripe.net/mailman/options/members-discuss/miao%40epik.com
>


-- 
Kind Regards,
Marcelo Goncalves
Director of Network Operations and President of Sibyl Systems

Skype: grumpycatofficial
Discord: Miao#0001
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://www.ripe.net/ripe/mail/archives/members-discuss/attachments/20191112/1da0f9f3/attachment.html>