<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body>
<p>Hello Nathalie,</p>
<p>I am a bit puzzled. Isn't that bebavior exactly what we wanted?</p>
<p>RIPE NCC depends on other networks/providers that implemted RPKI
as desired, and it works!</p>
<p>So what's the problem? Helping people that are on the "invalid"
side of the network? No. please don't.</p>
<p>They should raise their connectivity issue locally with their
network provider that should fix the problem.<br>
</p>
<p>I believe there is no action to RIPE NCC here. <br>
</p>
<p>Regards, Kurt<br>
</p>
<br>
<div class="moz-cite-prefix">Am 18.03.21 um 16:03 schrieb Nathalie
Trenaman:<br>
</div>
<blockquote type="cite"
cite="mid:629DA6AF-EE4C-4AE7-9324-562D11E3072E@ripe.net">
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
<span id="docs-internal-guid-23584f02-7fff-41d2-ae39-78c710be0a51"
class="">
<div style="line-height: 1.38; margin-top: 0pt; margin-bottom:
0pt;" class=""><span style="font-variant-ligatures: normal; font-variant-east-asian: normal; font-variant-position: normal; vertical-align: baseline; white-space: pre-wrap;" class="">Dear Colleagues, Working Group,</span></div>
<br class="">
<div style="line-height: 1.38; margin-top: 0pt; margin-bottom:
0pt;" class=""><span style="font-variant-ligatures: normal; font-variant-east-asian: normal; font-variant-position: normal; vertical-align: baseline; white-space: pre-wrap;" class="">As discussed previously in this mailing list, some community members expressed that they would like to see the RIPE NCC perform Route Origin Validation on AS3333. We decided to ask the community for advice and guidance on how we should proceed. </span></div>
<br class="">
<div style="line-height: 1.38; margin-top: 0pt; margin-bottom:
0pt;" class=""><span style="font-variant-ligatures: normal; font-variant-east-asian: normal; font-variant-position: normal; vertical-align: baseline; white-space: pre-wrap;" class="">What is Route Origin Validation?</span></div>
<div style="line-height: 1.38; margin-top: 0pt; margin-bottom:
0pt;" class=""><span style="background-color: rgb(255, 255, 255); font-variant-ligatures: normal; font-variant-east-asian: normal; font-variant-position: normal; vertical-align: baseline; white-space: pre-wrap;" class="">Route Origin Validation is a mechanism by which route advertisements can be authenticated as originating from an expected autonomous system (AS). </span></div>
<div style="line-height: 1.38; margin-top: 0pt; margin-bottom:
0pt;" class=""><span style="background-color: rgb(255, 255, 255); font-variant-ligatures: normal; font-variant-east-asian: normal; font-variant-position: normal; vertical-align: baseline; white-space: pre-wrap;" class="">The best current practice is to drop </span><span style="font-variant-ligatures: normal; font-variant-east-asian: normal; font-variant-position: normal; vertical-align: baseline; white-space: pre-wrap;" class="">RPKI invalid BGP announcements. These are announcements that conflict with the statement as described in a Route Origin Authorization (ROA).</span></div>
<br class="">
<div style="line-height: 1.38; margin-top: 0pt; margin-bottom:
0pt;" class=""><span style="font-variant-ligatures: normal; font-variant-east-asian: normal; font-variant-position: normal; vertical-align: baseline; white-space: pre-wrap;" class="">What is AS3333?</span></div>
<div style="line-height: 1.38; margin-top: 0pt; margin-bottom:
0pt;" class=""><span style="font-variant-ligatures: normal; font-variant-east-asian: normal; font-variant-position: normal; vertical-align: baseline; white-space: pre-wrap;" class="">This is the AS Number for the RIPE NCC’s main service network. It includes most of our *.</span><a
href="http://ripe.net/" style="text-decoration:none;"
class="" moz-do-not-send="true"><span style="color: rgb(0, 0, 0); font-variant-ligatures: normal; font-variant-east-asian: normal; font-variant-position: normal; text-decoration: underline; text-decoration-skip: none; vertical-align: baseline; white-space: pre-wrap;" class="">ripe.net</span></a><span style="font-variant-ligatures: normal; font-variant-east-asian: normal; font-variant-position: normal; vertical-align: baseline; white-space: pre-wrap;" class=""> websites, including the LIR Portal (</span><a
href="http://my.ripe.net/" style="text-decoration:none;"
class="" moz-do-not-send="true"><span style="color: rgb(0, 0, 0); font-variant-ligatures: normal; font-variant-east-asian: normal; font-variant-position: normal; text-decoration: underline; text-decoration-skip: none; vertical-align: baseline; white-space: pre-wrap;" class="">my.ripe.net</span></a><span style="font-variant-ligatures: normal; font-variant-east-asian: normal; font-variant-position: normal; vertical-align: baseline; white-space: pre-wrap;" class="">) and the RIPE Database. </span></div>
<br class="">
<div style="line-height: 1.38; margin-top: 0pt; margin-bottom:
0pt;" class=""><span style="font-variant-ligatures: normal; font-variant-east-asian: normal; font-variant-position: normal; vertical-align: baseline; white-space: pre-wrap;" class="">What is the Problem?</span></div>
<div style="line-height: 1.38; margin-top: 0pt; margin-bottom:
0pt;" class=""><span style="font-variant-ligatures: normal; font-variant-east-asian: normal; font-variant-position: normal; vertical-align: baseline; white-space: pre-wrap;" class="">Currently, some of our upstream providers already perform ROV. This means that some of our members that potentially misconfigured their ROA or members who have lost control of creation and modification of their ROAs cannot reach our services via those peers. </span></div>
<br class="">
<div style="line-height: 1.38; margin-top: 0pt; margin-bottom:
0pt;" class=""><span style="font-variant-ligatures: normal; font-variant-east-asian: normal; font-variant-position: normal; vertical-align: baseline; white-space: pre-wrap;" class="">On the other hand, some of our upstream providers do not perform ROV, and if a member’s prefix is being announced by a hijacker, they cannot access our services. We already received a report about this.This is also not an ideal situation. </span></div>
<br class="">
<div style="line-height: 1.38; margin-top: 0pt; margin-bottom:
0pt;" class=""><span style="font-variant-ligatures: normal; font-variant-east-asian: normal; font-variant-position: normal; vertical-align: baseline; white-space: pre-wrap;" class="">From the network operations perspective, there are no obstacles to enable ROV on AS3333, however, we have to consider that members or End Users who announce something different in BGP than their ROA claims, will be dropped and lose access to our services from their network. This includes the RPKI Dashboard where they can make changes to their ROAs. This is specially relevant when members operate certificate generation in hosted mode which is the current operation mode for almost all for our members. </span></div>
<div style="line-height: 1.38; margin-top: 0pt; margin-bottom:
0pt;" class=""><span style="font-variant-ligatures: normal; font-variant-east-asian: normal; font-variant-position: normal; vertical-align: baseline; white-space: pre-wrap;" class="">
</span><span style="font-variant-ligatures: normal; font-variant-east-asian: normal; font-variant-position: normal; vertical-align: baseline; white-space: pre-wrap;" class="">From an analysis we made on 10 February, there were 511 of such announcements from our members and End Users.</span></div>
<br class="">
<div style="line-height: 1.38; margin-top: 0pt; margin-bottom:
0pt;" class=""><span style="font-variant-ligatures: normal; font-variant-east-asian: normal; font-variant-position: normal; vertical-align: baseline; white-space: pre-wrap;" class="">Our current RPKI Terms and Conditions do not mention that a Member or End User ROA should match their routing intentions, or any implications it may have if the ROA does not match their BGP announcement. If the community decides it is important that AS3333 performs ROV, our legal team needs to update the RPKI Terms and Conditions to reflect the potential impact. </span></div>
<br class="">
<div style="line-height: 1.38; margin-top: 0pt; margin-bottom:
0pt;" class=""><span style="font-variant-ligatures: normal; font-variant-east-asian: normal; font-variant-position: normal; vertical-align: baseline; white-space: pre-wrap;" class="">I welcome a respectful discussion and look forward to your advice and guidance.</span></div>
<br class="">
<div style="line-height: 1.38; margin-top: 0pt; margin-bottom:
0pt;" class=""><span style="font-variant-ligatures: normal; font-variant-east-asian: normal; font-variant-position: normal; vertical-align: baseline; white-space: pre-wrap;" class="">Kind regards,</span></div>
<br class="">
<div style="line-height: 1.38; margin-top: 0pt; margin-bottom:
0pt;" class=""><span style="font-variant-ligatures: normal; font-variant-east-asian: normal; font-variant-position: normal; vertical-align: baseline; white-space: pre-wrap;" class="">Nathalie Trenaman</span></div>
<div style="line-height: 1.38; margin-top: 0pt; margin-bottom:
0pt;" class=""><span style="font-variant-ligatures: normal; font-variant-east-asian: normal; font-variant-position: normal; vertical-align: baseline; white-space: pre-wrap;" class="">Routing Security Programme Manager</span></div>
<div style="line-height: 1.38; margin-top: 0pt; margin-bottom:
0pt;" class=""><span style="font-variant-ligatures: normal; font-variant-east-asian: normal; font-variant-position: normal; vertical-align: baseline; white-space: pre-wrap;" class="">RIPE NCC</span></div>
<div class=""><span style="font-size: 13.5pt; font-family: Arial; font-variant-ligatures: normal; font-variant-east-asian: normal; font-variant-position: normal; vertical-align: baseline; white-space: pre-wrap;" class="">
</span></div>
</span>
</blockquote>
</body>
</html>